SentinelFleet

• 

  Architecture & Google Cloud deployment

• 

  Module interdependency circuit - AST-derived from the live import graph (32 modules, 66 edges)

Inspiration

Autonomous agents fail enterprises in predictable ways: prompt injection hijacks decisions, private context crosses boundaries, and "autonomous" too often means "unaccountable." Back-office teams need agents that act, but under governance they can inspect and prove. Our test is simple: after an agent action, an operator should be able to point to the gate, policy, identity, and evidence that allowed or refused it.

What it does

SentinelFleet is a fortified enterprise agent control plane with four pillars - Control, UAS, Memory, and Domain - plus a conductor layer.

• Zero-Trust Sovereign Gateway: Every tool, chat, race, template, and research call crosses agent-scoped least-privilege permissions, concurrency locks, Model Armor, and an auditable gate ledger.
• OmniLedger Taskmaster: A complete synthetic invoice workflow extracts documents, checks German Section 14 UStG and GoBD rules, books valid invoices, and drafts correction letters behind human approval gates.
• Tasks, routines, and chains: Reusable templates support bounded single-model, race, and research steps. Cloud Scheduler can wake authenticated deployments; persistent automation is deliberately disabled in the anonymous public demo.
• Human in the loop: Tickets are scoped to their organization, owner, and assigned user or role. Sensitive actions cannot be approved by the requester just because they can see the ticket.
• Scoped memory and contacts: Memory, contact, task, component, chat, telemetry, document, and result records enforce owner, department, organization, and named-share boundaries. Generated results are stored before download, private by default, creator-shareable, retention-aware, and legal-hold protected.
• Fleet Chat and Race Mode: The same prompt can run across up to four supported Gemini lanes. Each lane has its own agent identity so latency measures the model, not a shared gateway queue.
• Governance and observability: The UI exposes permission decisions, user/profile scope, policies, tickets, agent lifecycle, redacted OpenTelemetry spans, and Cloud Trace export.
• Live architecture blueprint: The circuit is generated from Python imports on every request. The current source and deployment show 51 modules and 158 internal imports; tests reject invented edges.
• 32 governed enterprise skills: Versioned component-v1 skills and prompt templates use the same tenant and permission boundaries as their execution paths.

The public showcase intentionally has no human login. Anonymous browser workspaces are isolated with non-replayable share handles, bounded write/model/web quotas, workspace-local quarantine overlays, and locked administration. Non-demo deployments fail closed unless a signed Google IAP assertion maps to an active registered identity and unsafe cross-origin requests are rejected.

How we built it

SentinelFleet uses Python, FastAPI, Pydantic, Jinja2, and vanilla JavaScript. Gemini 3.5 Flash is called through the Google GenAI SDK. Cloud Run hosts the service; Firestore stores governed metadata; Cloud Storage holds private result bytes; Cloud Scheduler drives authenticated recurring work; Secret Manager supplies runtime secrets; and OpenTelemetry exports documented spans to Cloud Trace.

The current public revision is healthy on Cloud Run with Firestore and 100 percent traffic. The full repository suite passes: 553 tests passed on August 21, 2026, with one non-failing upstream Starlette/httpx deprecation warning.

Honesty is part of the product: without an API key, model paths return clearly labelled deterministic demo output. The app never presents simulated text or latency as a live Gemini result.

Challenges we ran into

The hardest work was making governance operational rather than decorative: carrying the verified principal through every store and websocket; preventing caller-supplied viewer aliases; scoping telemetry and memory before retrieval; separating anonymous workspace authentication secrets from safe share identifiers; keeping public-demo cost and quarantine effects bounded; and preserving backward compatibility while forcing legacy unscoped rows to fail closed.

Cloud Run also taught us practical lessons: a body-less Scheduler POST can be rejected with 411, source must be copied before package installation in the container, optional exporters are not executable claims, and an in-process scheduler lock only supports a one-instance deployment until a distributed lease exists.

Accomplishments that we're proud of

• A real governed execution path, not a governance mock-up.
• 553 passing tests spanning identity, ACLs, injection defense, workflows, storage, telemetry, UI, and the live-derived architecture.
• Private-by-default chat, memory, task, document, telemetry, and result boundaries with explicit sharing.
• A guided 3:35 public demo rendered from the current Cloud Run experience.
• A public AGPL-3.0 repository with reproducible local and Google Cloud deployment instructions.

What we learned

Filming was a quality gate: visual review exposed stale material and helped force a final audit of what the UI actually proves. Security review repeatedly showed that a feature is not tenant-safe merely because it has an owner field; identity, organization, assignment, mutation rights, storage, telemetry, background work, and legacy data all need the same boundary.

What's next

Next steps are a distributed Firestore lease for multi-instance scheduling, a complete owned-data transfer/erasure workflow for offboarding, self-service chat retention and legal-hold controls, tenant-local agent lifecycle state in authenticated deployments, Pub/Sub-backed event delivery, and deeper Vertex AI integration.

Built With

• edge-tts
• fastapi
• ffmpeg
• gemini-3.5-flash
• google-cloud
• google-cloud-firestore
• google-cloud-run
• google-cloud-scheduler
• google-cloud-trace
• google-genai
• google-secret-manager
• javascript
• jinja
• opentelemetry
• pydantic
• pytest
• python