Recall

As a former lawyer who practised for fifteen years before moving into computational biology, I now run AIstanbul Research Lab as a solo researcher. That route matters to how I build. The law trains you to ask who decided, on what record, and whether the reasoning survives being read back by someone hostile. Those turn out to be exactly the right questions to ask of an autonomous agent.

My main line of work is VUS Pipeline, a production-grade clinical decision-support system for variant classification. It applies the ACMG/AMP 2015 framework with ClinGen SVI specifications and the Tavtigian point system deterministically, gathers evidence in parallel from eight authoritative layers (gnomAD v4, ClinVar, SpliceAI, ClinGen, CIViC among them), and adds an advisory mechanistic interpretation that is never allowed to change the class. The class comes from the rules:

$$ \text{class} = f!\left(\sum_i p_i\right), \qquad \begin{cases} \text{Pathogenic} & \sum_i p_i \geq 10\[2pt] \text{Likely pathogenic} & 6 \leq \sum_i p_i \leq 9\[2pt] \text{Uncertain significance} & 0 \leq \sum_i p_i \leq 5\[2pt] \text{Likely benign} & -6 \leq \sum_i p_i \leq -1\[2pt] \text{Benign} & \sum_i p_i \leq -7 \end{cases} $$

An LLM never touches $f$. It never touches $p_i$ either.

Building that system taught me where the real pain is, and it is not the first classification. It is the VUS burden: the enormous and growing population of variants classified as uncertain significance. "Uncertain" is not a diagnosis. It is an instruction to wait. A cancer patient's report comes back uncertain, and that single label can stand between her and a therapy approved for exactly her tumour type.

The uncertainty is usually temporary. Evidence accumulates in the literature, in functional assay repositories, in population databases. The classification is supposed to move when the evidence moves. In practice nobody is watching, because watching is unbounded work: every variant, against every source, forever.

I have a documented example. For one real variant in BRCA2, c.7522G>C, functional data indicating a damaging effect became public in GEO on 2024-09-27. The ClinVar record first reflected a change on 2026-04-25. That is 575 days. The qualifying publication is a separate line and a different number: 2025-01-08 to 2026-04-25 is 472 days. The chronology does not prove the paper caused the later submission, and the aggregate record became conflicting rather than uniformly pathogenic. But the gap is real, and during it nothing was watching.

If you write software, the analogy is immediate. You monitor your dependencies for CVEs. Now imagine your alerts only fired when the vendor updated the changelog, not when the exploit went public. That is clinical genetics today.

So Recall is not a demo idea I reverse-engineered into a clinical story. It is the thing VUS Pipeline needed next, and it came out of a real clinical need, the same way VUS Pipeline did.

What I built

Recall is a zero-trust institutional agent fleet that audits genomic evidence continuously, without letting any model become the scientific authority.

It runs unattended. There is no operator interface, and that is deliberate: a system whose job is to watch does not wait to be asked. A scheduled Cloud Run job wakes the fleet, and three agents with separated duties do the work.

• an Evidence Watcher looks for new evidence bearing on a variant under watch;
• an Evidence Assessor evaluates what the watcher surfaced;
• a Citation Auditor independently verifies every citation, because models invent them.

The agent that proposes is never the agent that checks. None of the three may decide anything. A deterministic controller routes the work and a deterministic policy gate produces the outcome, so a terminal state is always the output of code, never of a model's confidence. When the evidence is too weak, the system abstains and says so, rather than guessing.

Everything is written to an append-only Firestore ledger, every tool call passes a gateway that issues an authorization receipt, and each role runs under its own service identity with a role-scoped capability. Clinical text never reaches the cloud at all: the outbound payload declares only registered structured field paths and has no free-text field, so laboratory prose has nowhere to travel. A local Gemma model proposes residual spans the deterministic detectors missed, and deterministic adjudication decides what that proposal is worth.

How I built it

Gemini 3.7 Flash on Vertex AI, with Google's Agent Development Kit running in-process on Cloud Run. Firestore for the ledger, Cloud Logging and traces for observability, a Vertex AI Agent Engine for the managed runtime path.

The design rule that drove every decision: models propose, deterministic code decides. Whenever an agent could have been given authority, that authority was moved into a rule instead, and the rule was made auditable. What is left for the models is the part they are genuinely good at, which is reading and comparing evidence, and none of the part they are bad at, which is being trusted.

The final cohort run executed 456 cases across six hours and eleven minutes, unattended:

• 9,543 artifacts parsed under the production contract, 0 rejected;
• 1,363 tool calls and exactly 1,363 authorization receipts, 0 unauthorized;
• 456 cases, 456 distinct traces, 0 mismatches, 0 untraced;
• 445 cases reached NO_ACTION, which is the correct answer when the evidence has not moved.

Challenges

Timeouts are not the same as crashes, and I had to make the system prove it. Eight cases hit an agent timeout during the run. They were contained where they stood, two in the watcher, one in the assessor, five in the auditor, and each left a receipt on the way down. The fleet never crashed and never restarted, the other 448 cases went through to a decision, and the job reported success. Failure tolerance is easy to claim in a README; the only convincing version is a real fault, in a real run, with the containment visible in the record.

Provider throttling. The run absorbed 60 HTTP 429 responses. Not one of them cost a case. Getting there meant treating rate limits as an expected condition of the runtime rather than an error path bolted on afterwards.

Long-running work is a different engineering problem from a request. Six hours of unattended execution means state has to survive the process, not live in it. That pushed everything durable into the append-only ledger and made recovery a matter of reading the record rather than remembering anything.

Keeping myself honest about my own evidence. This was the hardest part, and the most useful. It is very easy to build a page that shows numbers, and very hard to build one that cannot show a number it did not measure. Every figure the project displays is derived from a committed artifact, and the surfaces refuse to render a value they cannot source. I broke this rule myself more than once, caught it, and put guards in place so the code catches it instead of me.

What I learned

The instinct from law turned out to be the right engineering instinct. The interesting question about an autonomous agent is not how capable it is, it is who is allowed to decide, and what record survives the decision. Once I stopped trying to make the models trustworthy and started making them structurally unable to be the authority, the architecture simplified rather than complicated.

I also learned that separation of duty is not a diagram, it is an identity boundary. Saying "the auditor checks the assessor" means nothing if both run as the same principal with the same capabilities. Making the separation real, with distinct service identities and role-scoped capabilities enforced at a gateway that issues receipts, is what turned the claim into something a reviewer can verify without trusting me.

And the smallest lesson, which I keep relearning: a system that reports its own gaps is more useful than one that reports success. ABSTAIN is a feature.

What's next

Recall is one evidence-watch cell. The same pattern, specialist agents that may propose, deterministic policy that decides, and a record that outlives both, applies to any institutional decision that depends on evidence which keeps changing after the decision was made. The immediate work is closing the loop with VUS Pipeline, so that a variant classified today is watched tomorrow, and the clinician hears about it in weeks rather than in 575 days.

Built With

• artifact-registry
• bioinformatic
• clinvar
• cloud-run
• cloud-run-jobs
• cloud-trace
• docker
• firebase-hosting
• firestore
• gemini
• gemini-3.7-flash
• gemma
• genomics
• google-adk
• google-cloud
• multi-agent-systems
• python
• react
• secret-manager
• typescript
• vertex-ai
• vertex-ai-agent-engine
• vite
• vitest
• zero-trust