Quorum

• 

  Quorum separates autonomous code generation from approval through independent safety, intent, and reasoning layers.

• 

  Each proposal passes through Sentry, IntentGraph, and the Reasoning Kernel, resulting in PASS, REJECT, or human ESCALATION.

• 

• 

• 

• 

About the project

Inspiration

I use autonomous coding agents every day. The hard part was never getting an agent to draft a patch — it was deciding, every single time, whether to trust a patch I did not write enough to let it ship unsupervised. Reviewing everything myself defeats the point of delegating. Reviewing nothing is how a bad patch reaches production.

I wanted to build the part of that workflow I was doing manually and inconsistently: not another agent that writes code, but the governor that decides whether another agent's patch is trustworthy enough to act on.

That framing shaped every design decision. Quorum never drafts or edits a line of code. A separate Worker Agent (Gemini 3.5 via Google's Agent Development Kit on Vertex AI) does that. Quorum's only job is to decide whether to let the patch through, send it back for one redraft, or stop and hand the decision to a person. The agent that acts and the system that decides whether the action is allowed are deliberately two different things. Neither is allowed to grade its own work.

How I built it

The architecture sits three independent, deterministic checks between a drafted patch and any real action:

• Sentry scans the Worker Agent's own diff and rationale for injected or manipulative content.
• IntentGraph checks whether the current task is a reformulated return to an objective the gate already rejected.
• Claim verification (inside the gate) re-reads every cited source. VERIFIED is granted only when an exact quoted span is found at a specific location; keyword overlap alone can never produce VERIFIED. The Reasoning Kernel then checks the resulting claim graph.

None of these components trusts the agent's account of its own output, and none is fused into a single model judging itself.

The result is an explicit state machine:

• PASS → the system opens a real GitHub pull request.
• REJECT → the reason is fed back for one automatic redraft.
• ESCALATE → the process stops for a human and is never auto-resolved.

Live runs of the deployed service on Google Cloud Run have opened real pull requests on PASS verdicts. Every stage is written to an append-only audit trail.

I come from a program-delivery background, not a traditional software-engineering one. I built Quorum over roughly two months with heavy AI assistance — primarily Claude for implementation and testing under close direction, with an independent re-audit later performed by another model. The architecture and what it was tested against are the lead story; the background is simply context.

Challenges I ran into

Two rounds of live adversarial testing against the deployed service surfaced real evasions: a trigger phrase split across a sentence boundary, a fabricated prior-approval claim, a request to disable one of Sentry's own rules, and a spelled-out email that bypassed a literal pattern. Each was fixed and verified against the exact payload that originally got through.

A later independent re-audit found a more structural problem in claim verification: a claim could be marked VERIFIED simply because its words appeared somewhere in the cited file, even when the surrounding assertion was false. Confirming that a quoted span exists is not the same as confirming that the sentence around it is true. I had conflated the two. That path is now closed — VERIFIED requires an exact quoted span; overlap alone produces only REPORTED — and it is the limitation I describe most carefully.

What could not be closed in the remaining time (the true cross-instance Firestore transaction, a few advanced Sentry bypass surfaces) is disclosed rather than hidden.

What I learned

Several failures only appeared once the service was live and under real queries: a Vertex AI location assumption that worked locally but not in the deployed project, and a missing Firestore composite index that had been silently serving reads from ephemeral local disk. More importantly, a system whose job is to check other systems has to be checked the same way — by someone other than the person who built it. The most useful step in this project was not a new rule or regex; it was inviting an outside adversarial pass and fixing what it found instead of arguing with it.

Built With

• adk-runner
• gemini-3.5
• google-adk
• google-agent-development-kit
• google-cloud-firestore
• google-cloud-run
• llm-agents
• multi-agent-systems
• prompt-injection-detection
• pytest
• python
• vertex-ai