Inspiration
Small businesses can describe the software they need, but getting from that description to a backend, frontend, authentication, deployment, and reliable release process still requires several specialist workflows. General-purpose coding agents can generate code quickly, but generation alone does not prove that authorization, tenant boundaries, booking conflicts, lifecycle actions, or browser behavior work.
We built Spala Web Agency to test a different operating model: the user gives one business brief to an AI-operated delivery pipeline. Gemini coordinates the work, Spala turns the backend proposal into a bounded candidate, and deterministic gates decide whether anything may be applied, published, or described as live.
What it does
Spala Web Agency runs inside Gemini Enterprise as a private agent. For a new MVP request it can:
- turn the user's brief into explicit product and behavior requirements;
- ask Gemini to prepare the backend and frontend artifacts;
- send a structured, caller-funded backend request to Spala's A2A service;
- bind backend changes to a candidate ID and content hash;
- validate authentication, ownership, lifecycle, and route contracts;
- compile and inspect the frontend in a real browser;
- preserve job state so an interrupted request can resume; and
- stop with evidence when a required behavior is missing instead of claiming that an incomplete product is ready.
The product is intentionally fail-closed. A rejected candidate is a product result: no backend is published and no frontend is described as live.
How we built it
The coordinator is a Python application built with Google ADK and deployed to Vertex AI Agent Engine. Gemini Enterprise provides the user-facing agent surface and forwards a request-local Spala OAuth authorization. The coordinator removes that authorization before model handling and uses it only for the fixed Spala A2A request.
Gemini performs natural-language planning and artifact generation in the customer's Google Cloud project. The current configured model is Gemini 3.5 Flash. Spala performs deterministic candidate storage, validation, apply, publish, and runtime execution without invoking a Spala-hosted model for these caller-funded requests.
Factory state and generated artifacts use customer-project storage. Browser QA verifies desktop and mobile rendering, console failures, requests, and navigation. Behavioral acceptance checks the generated API against the requirements derived from the original brief.
Challenges
The hardest problem was not generating code. It was preventing a plausible artifact from being mistaken for a working business application. Early live runs exposed missing authentication fields, unsupported generated grammar, incomplete booking lifecycles, and repeated continuation prompts. We converted those failures into bounded, durable checks and regression tests.
Another challenge was authorization. Gemini Enterprise must authenticate both the Google-hosted agent and the user's Spala account without exposing either credential to the model or durable session state. The supported path uses an ADK registration with request-local tool authorization rather than a second model-visible login flow.
Accomplishments
- A private Gemini Enterprise agent can authenticate to Spala and inspect the exact authorized organization and project.
- Customer-funded Gemini inference and deterministic Spala execution have a documented trust boundary.
- Durable jobs can preserve progress across disconnects and explicit resumes.
- Candidate hashes bind review, apply, publish, and acceptance evidence to the same proposed backend.
- The local test suite currently passes 399 tests with one live integration test skipped.
- Local factory runs can exercise generation, compilation, browser QA, and two-user behavioral probes without spending Vertex AI quota.
These are implementation and controlled acceptance results. They are not a claim that every arbitrary one-prompt application completes successfully.
What we learned
AI-native operations need deterministic release authority. A model is useful for turning intent into a candidate, but authentication, ownership, tenant isolation, required lifecycle operations, browser failures, and publication state must be checked outside the model. We also learned that a durable job ID is not enough: every continuation needs an explicit project, candidate, hash, attempt, and evidence boundary.
What's next
The next milestone is a public judge-accessible demo that completes one narrow small-business workflow end to end, reports its actual Gemini usage and cost, and exposes the generated application's behavioral evidence. Broader domain coverage will be added only after that canary remains reproducible.
Log in or sign up for Devpost to join the conversation.