Rally by Agent9

Create role-based AI specialists with real company addresses. Each teammate uses only the data and systems you approve, coordinates the right workers behind the scenes, and replies with deliverables.

Comment

Inspiration

Every company can buy excellent AI. The broken part is the work between them.

At Agent9, we felt that problem firsthand. We could give one task to Gemini, another to Claude, and another to Codex—but a person still had to act as the message bus between them. These capable systems behaved like brilliant employees who had never met.

People still carry context between tabs, decide which model should do what, restart work when an API balance or subscription usage window runs out, reconcile conflicting answers, and police confident results. Small-business owners and operators feel that management tax most sharply: they can afford excellent AI, but not a dedicated AI operations team.

The All Things Agentic brief challenged us to move beyond a standard chat loop and build an agent that could keep working asynchronously, take real action, and prove what it accomplished. We built Rally by Agent9 for that challenge—and for the unlikely hero who needs enterprise-grade execution without an AI operations department.

The idea was simple: give a company an email-first, accountable AI team, equip it with only the systems that company approves, and govern the work through a secure Google-backed control plane. A person should be able to send one familiar message and receive finished, independently verified work—not supervise another chain of prompts.

What it does

Rally is our Fortified Enterprise Fleet entry: it turns the AIs and company systems a team already trusts into one accountable AI workforce.

A user can commission work from either a private dashboard or an ordinary email to rally@updates.agent9.dev. Both doors enter the same replay-safe queue and the same governed runtime. The user can leave; Rally keeps working in the background. Rally preserves the business goal, decomposes it into independently checkable work, routes that work across configured model families, and returns the result where the request began.

Stage What the user experiences What Rally enforces
Commission Send an email or create a dashboard job Stable identity, idempotent intake, preserved intent
Govern Describe the goal, choose bounded recovery, and approve systems Frozen model order, connector scope, retry, turn, and send ceilings
Execute Gemini, Claude, and Codex work under configured roles and independent review Durable state, isolated workers, asynchronous progress
Prove Receive a finished deliverable, evidence, and residual risk owner != verified_by for every completed checklist item

Rally's completion rule is a persisted invariant, not a suggestion inside a prompt:

$$ \operatorname{Complete}(c) \Rightarrow \operatorname{owner}(c) \ne \operatorname{verified_by}(c) $$

Rally's key product capabilities are:

  • Email-first commissioning. Work begins in a universal interface employees already understand, while the authenticated dashboard provides setup, progress, evidence, and control.
  • Role-shaped onboarding. The dashboard translates the workforce concept into familiar roles while Rally keeps configured model routing out of the user interface.
  • Approved company systems only. Connector authority is per user and fail-closed. A configured adapter is never presented as connected until live discovery proves exactly what it can do.
  • Second Wind recovery. When one worker hits a usage limit, tool failure, or evidence blocker, Rally preserves accepted state and hands recoverable work to the next eligible model without transferring approval authority.
  • Independent verification. No model can sign off on its own work. Unsupported claims are rejected, repaired, and checked again.
  • Real deliverables. Rally can return polished email, images, audio, and downloadable artifacts—not merely chat text. Our live proof includes a Lyria 3 Pro Preview song and Nano Banana 2 image with prompts, hashes, and provider receipts.
  • Open agent boundaries. Rally implements an A2A v1 admission boundary for governed agent tasks and exposes bounded WebMCP actions for inspecting evidence and preparing human-approved jobs.

🎧 Proof of action: Play the 73-second All Things Agentic hip-hop song Rally generated with Lyria 3 Pro Preview on Vertex AI. The repository also preserves the original MP3, exact prompt, model ID, hash, and provider receipt. Rally's completed-run delivery path supports bounded audio attachments and inline image previews; we keep the media generation receipt separate from the email-run receipt.

The live product is at rally.agent9.dev, and the full evidence-first repository is on GitHub.

How we built it

We deliberately separated coordination authority from model execution.

Email or Dashboard
        |
Replay-safe edge inbox + workspace identity
        |
Google control plane: Cloud Run + Gemini + ADK + Firestore
        |
Controlled licensed-worker host: Gemini / Claude / Codex CLIs
        |
Independent verifier + evidence receipts
        |
Executive email + authenticated dashboard + deliverables

Google is load-bearing in Rally:

  • Gemini 3.7 Flash through Vertex AI interprets the commission and coordinates governed handoffs.
  • Google ADK defines the coordinator and its strictly scoped tools.
  • Cloud Run provides the IAM-protected coordination and customer control-plane services.
  • Firestore atomically claims coordination work, fences retries, and persists cross-session coordination state.
  • Cloud Trace records content-free execution metadata so operations remain observable without storing prompt content.
  • Cloud KMS protects connector credentials with envelope encryption; models receive bounded tools, never raw tokens.
  • Vertex AI media models provide real creative output through Lyria 3 Pro Preview and Gemini 3.1 Flash Image (Nano Banana 2).

Cloudflare complements that Google core. Pages serves the product UI, a Worker verifies Resend/Svix webhooks and protects the browser boundary, D1 holds the replay-safe inbox and tenant-scoped projections, and R2 stores verified artifacts privately. Resend gives each workflow a professional HTML email with a text fallback, thread-safe replies, inline image previews, and attachments.

The execution loop runs on a controlled licensed-worker host so each provider remains isolated behind its own supported CLI boundary. Its local state.json is authoritative for checklist completion, while Firestore coordinates authenticated handoffs and retry fencing. The runtime itself is a deterministic state machine: prompts may propose work, but they cannot change model families, ownership, verification rules, send authority, retry ceilings, or connector scope. Every accepted transition is saved before the next worker is dispatched. Artifact delivery is also two-phase: Rally stages metadata, uploads bounded bytes, verifies the checksum, and only then exposes the file as ready.

The architecture, security boundaries, deployment receipts, and reproducible setup are documented in our architecture guide, security guide, and judge packet.

Challenges we ran into

Making a workflow instead of another chatbot. The hardest design decision was refusing to make the chat box the center of the product. Email had to become a real asynchronous command surface, and the dashboard had to show durable state rather than animated sample data.

Recovering without weakening governance. It is easy to retry a model call. It is much harder to preserve accepted work, reject stale attempts, select a new worker, and guarantee that recovery does not silently transfer approval authority. Second Wind came directly from solving that problem.

Keeping credentials out of model context. A frictionless connector can easily become a security liability. We separated human identity, provider OAuth, storage encryption, runtime tool authority, and model context. The connector catalog intentionally says “coming soon” or “setup required” when a provider application has not completed live discovery.

Making email genuinely professional. Real mail includes signatures, quoted threads, malformed HTML, retries, and client-specific rendering. We built multipart templates with clean executive summaries, text fallbacks, stable threading, attachment support, and signature-aware request extraction.

Proving execution honestly. A polished fake run would have been faster. Instead, Rally displays an explicit failure when live state is unavailable and commits sanitized receipts for real runs, live ADK evaluations, provider-generated media, deployment versions, and known limitations.

Accomplishments that we're proud of

  • A real 13-turn executive research run coordinated three model families, rejected unsupported claims, repaired the brief, and closed 6/6 independently verified checks with zero self-approvals. Its preserved 882-word checkpoint contains 22/22 supported claims; the repository separately discloses the later workspace mutation and earlier email payload instead of merging them into a cleaner story.
  • A real Second Wind run recovered from blocked evidence, preserved accepted state, reassigned the work, and still finished 6/6 without relaxing the owner/verifier rule.
  • Email and dashboard commissions now enter the same governed queue and runner path, with immediate run receipts and durable promotion from queued to authoritative state.
  • Company-email magic-link authentication reaches a polished, tenant-scoped workspace without creating another password.
  • Rally generated a complete hackathon song through Lyria 3 Pro Preview on Vertex AI and cover art through Nano Banana 2, with playable output, exact prompt, model ID, hash, and generation receipt committed to the repository.
  • The release includes 376 deterministic tests (190 product and integration tests plus 186 Cloud, A2A, and connector-security tests) and a 6/6 live Google ADK evaluation, plus documented Cloud Run, Firestore, Trace, KMS, Worker, Pages, D1, and R2 deployment anchors.
  • We implemented A2A and WebMCP as bounded trust surfaces rather than marketing badges.
  • Most importantly, the product is understandable without knowing what a model router is: describe a goal, approve its systems, and choose whether bounded recovery is allowed.

Judges can inspect the sanitized run evidence, media proof, and reproducible setup directly.

What we learned

  1. The best model is not a substitute for a team. Quality improved when research, synthesis, challenge, repair, and verification had explicit owners.
  2. Authority must live outside the prompt. “Please verify independently” is a preference. A persisted owner != verified_by invariant is a control.
  3. Asynchronous UX is an architecture decision. Durable queues, replay protection, state receipts, and resumable threads matter more than a typing animation.
  4. Email is an underrated agent interface. It is already cross-platform, asynchronous, searchable, familiar, and accepted inside every company.
  5. Recovery and accountability can coexist. A new model can inherit recoverable work without inheriting the right to approve it.
  6. Google Cloud is an unusually strong agent control plane. IAM, Cloud Run, Firestore, Trace, KMS, Vertex AI, and ADK gave us a coherent way to make multi-model execution governable rather than merely impressive.
  7. Honest boundaries build more trust than broad claims. “Adapter ready” is not “account connected,” and Rally treats that distinction as a product feature.

What's next for Rally by Agent9

Our next milestone is turning this vertical slice into a complete small-company AI workforce:

  • Finish provider review and live OAuth certification for Google Workspace, Slack, GitHub, Cloudflare, n8n, Stripe, BigQuery, Atlassian, Salesforce, and eligible A2A agents.
  • Give every configured specialist its own memorable company address while retaining one shared, accountable task queue.
  • Add team invitations, administrator approval flows, cost budgets, and richer per-role policy presets.
  • Expand verified dashboard delivery from audio and images to presentations, PDFs, documents, spreadsheets, video, and governed cloud links.
  • Add Slack and other messaging channels without fragmenting the underlying run history.
  • Add low-friction communication connectors for SMS through Twilio or an equivalent provider, WhatsApp, and Discord, while preserving one accountable run history across every channel.
  • Add governed voice and media specialists through ElevenLabs and Deepgram, and expand eligible model families through xAI/Grok without weakening Rally's owner/verifier separation.
  • Deepen the enterprise layer with versioned agent registry workflows, long-horizon memory, policy analytics, and bring-your-own-cloud deployment.
  • Continue making Rally feel less like AI infrastructure and more like the most dependable teammate in the company.

The long-term vision is not another assistant tab. It is a secure layer that helps every AI a company already pays for work together, see the job through, and return something the business can trust.

Built With

  • a2a-protocol
  • cloud-firestore
  • cloudflare-workers
  • gemini-3.7-flash
  • google-adk
  • google-cloud-kms
  • google-cloud-run
  • lyria-3-pro
  • nano-banana-2
  • vertex-ai
Share this project:

Updates