Fortified Enterprise Fleet · one-minute assessment
The antibiotic review limited teams can miss, proved end to end.
Everything needed to evaluate this project, with the exact file and test behind each claim. Written to be read by a person or parsed by a machine, since the rules note that judging may include automated analysis.
Category: The Fortified Enterprise Fleet. Live service:
https://day-three-109051079423.us-central1.run.app.
Shared substrate proof: POST /exit-test runs ten scheduling,
verification, quarantine, crash, and resume clauses. Day Three's product-specific proof is
the separate 18-step deployed flow.
If you have sixty seconds
Run the clean-slate console to see a real wake and a fabricated-number rejection; then open the conformance map for the source-to-code-to-test chain. The repository contains the exact 18-step HTTP acceptance script and recorded model grades.
Rubric map
| Criterion | What we built | Where |
|---|---|---|
| Innovation and Operational Utility, 40% Does it eliminate real friction? Is the twist present? |
It builds local susceptibility evidence, then stands watch with it. CDC says many critical access hospitals adapt recommendations from nearby hospitals or collaboratives when local data or expertise are limited. This builds a local antibiogram from scanned reports, then wakes unattended at hour 48 to support review. | day_three/antibiogram.pyday_three/course.py |
| Track mandate: cataloged for cross-department use | Four standard REST agents are registered in Google Cloud Agent Registry. The public proof route reads the managed API. A local policy layer adds versions, declared consumers, required scopes, durable audit entries, and real invocation for Curator and Shortage Watch. | day_three/managed_registry.pyGET /day-three/registry/managedPOST /day-three/registry/consume |
| Track mandate: context across weeks of asynchronous operations | One Course Watch owns an antibiotic course for about five weeks. At hour 48, the due wake now loads the persisted isolate, executes reconciliation, verifies every claim, and stores a pharmacist-review draft. Missing culture data creates one bounded recheck instead of a guess or loop. | day_three/course.pytests/test_course.py |
| Track mandate: production data, compliance, data sovereignty, security | Synthetic data run through production controls: storage and compute pinned to one
region and enforced in code, a redaction boundary before any model call, five
differentiated provisioned identity boundaries, one disclosed runtime identity,
and scope denial recorded in an audit trail.
Scoped honestly: Gemini 3.x is served only from the global
endpoint. It returns NOT_FOUND in every regional endpoint we tested, and Gemini 2.5,
which is regional, does not satisfy the mandatory requirement. So storage and compute
are pinned; model inference is not, and we say so rather than overclaiming. This is
precisely why the redaction gate exists: identifiers are stripped before anything
crosses that boundary. |
spine/config.py raises RegionViolation; see
MODEL_LOCATION |
| Architecture: separation of concerns | Nine logical roles, each with one job, orchestrated in process through typed routes and durable Firestore state. The roles are modular; they are not falsely presented as nine isolated services. | spine/state.py |
| Architecture: state management and resumability | Steps are written before their side effects and completed after. Kill a worker mid run and it resumes from the last checkpoint. Lease-based claiming stops two workers processing the same run, and an expired lease frees a wedged run. | tests/test_state.py::test_resume_after_crash_does_not_repeat_completed_work |
| Architecture: recovery from a looping or hallucinating agent | A sentence cannot be rendered unless its claim was accepted. Five rejection rules, and a circuit breaker after three rejections on the same claim that pauses the run for a human rather than retrying forever. | spine/verify.pyPOST /day-three/demo/fabricate |
| Architecture: tools isolated and scoped | Five service accounts are provisioned with differentiated IAM, and the deployed
service runs as sa-reason, which holds only Firestore and Trace roles.
Scoped honestly: today one Cloud Run service runs the whole fleet under that
one identity, so the separation is a provisioned boundary rather than a per-agent
runtime identity. The re-identification boundary is real: sa-reidentify
is a distinct account and sa-reason cannot assume it. |
sa-intake, sa-reason, sa-notify, sa-redact, sa-reidentify |
| Demo: proof of action | The console on the main page drives the live deployed API. scripts/demo_flow.py runs the entire seventeen step flow against the deployed URL and prints a pass table. |
scripts/demo_flow.py --url ... |
| Demo: documentation and reproducibility | Infrastructure as code for the Firestore indexes, one Dockerfile, one deploy script, and the reproduction steps below. | infra/firestore.indexes.json |
Mandatory requirements checklist
Stated explicitly rather than left to be inferred.
| Requirement | How it is met | Where |
|---|---|---|
| Gemini 3.5 or newer via Gemini API or Vertex AI | Gemini 3.5 Flash reads the scanned reports, via Vertex AI. Measured on four degraded synthetic scans: 29 of 29 susceptibility results correct, 0 wrong, 0 invented. Recorded output and the grading script are in the repository. | day_three/intake.pyscripts/record_intake.pyfixtures/recordings/_accuracy_report.json |
| At least one Google agent framework | The GenAI SDK (google-genai), one of the four accepted
frameworks, is what every model interaction runs through: structured-output
extraction with a response schema, multimodal image reading, and the Gemma name
reviewer. |
day_three/intake.py class VertexClientspine/redact.py class GemmaReviewer |
| At least one Google Cloud infrastructure service | Cloud Run (the service), Firestore (all durable state, three
composite indexes as code), Cloud Scheduler (the cron that wakes sleeping
agents), Cloud Trace (reasoning chains, verified landing), Artifact
Registry and Cloud Build (the image). Pub/Sub is in the original spine
design but is not provisioned and not used: scan_due claims a
wake, writes one idempotent due-action record, and completes it directly. That
record does not imply an external message, clinical act or submission. We list
what runs, not what was drawn. |
deploy.sh, project agentic-fleet-2026 |
| Three additional Google AI models (full model-bonus allowance) | Gemma 4 (gemma-4-26b-a4b-it-maas) reviews already
pattern-redacted text for person-name spans and fails closed. Gemini 3.1 Flash
Image creates the non-data-bearing first-use workflow illustration.
Veo 3.1 Fast creates the optional four-second motion briefing. The two media
assets contain no patient data, clinical values, drug names, or recommendation and
never enter the clinical execution path. |
spine/redact.py, 15 tests in tests/test_redact.pyscripts/record_gemma.pyscripts/record_bonus_media.pyweb/media/bonus-media-provenance.json |
Proof it runs on Google Cloud
- Project:
agentic-fleet-2026, regionus-central1, pinned in code. - Cloud Run service:
day-three, scale to zero, capped at three instances, publicly reachable at the project-number URL above. - Cloud Scheduler: the existing shared job
spine-scan-duecalls the shared spine worker every minute. It transactionally claims due wakes from the same Firestore substrate used by Day Three; the demo's simulated-clock route exercises the identical claim-and-dispatch path without waiting days. - Agent Registry: four manually registered standard REST agents in
us-central1. The runtime has viewer-only IAM, andGET /day-three/registry/managedreads the managed discovery plane live. - Official data: the dedicated
day-three-shortage-refreshwall-clock job calls an isolated route daily. openFDA results are stored with source date, errors, and the medical-care disclaimer boundary; the job never scans simulated wakes. - Firestore: native mode in
us-central1, with three composite indexes created frominfra/firestore.indexes.json. - Cloud Trace: OpenTelemetry export is wired and real trace identifiers have been confirmed in Cloud Logging.
Verify it yourself right now. GET /health returns the live project,
region and worker revision. POST /exit-test runs the acceptance suite against
real Firestore and returns a per-clause pass table.
A note on /health: it is deliberately not
/healthz, because Google's frontend reserves that path and never forwards it to
the container. A working service looked dead for hours before we found that.
Reproduce in five minutes
| Step | Command |
|---|---|
| Enter the app | cd app |
| Install | python -m venv .venv && .venv/bin/pip install -e ".[dev]" |
| Run the tests | python -m pytest -q - 225 tests, no cloud needed |
| Create the indexes | PROJECT_ID=... bash infra/apply_indexes.sh |
| Deploy | SIM_MODE=true bash deploy.sh |
| Register managed agents | python infra/register_agents.py after granting the documented editor and runtime viewer roles |
| Prove the guarantee | curl -X POST -H "Content-Type: application/json" -d '{}' $URL/exit-test |
| Run the whole demo | python scripts/demo_flow.py --url $URL |
Research-to-design traceability
| Primary or official evidence | What it changed | What we refuse to infer |
|---|---|---|
| CDC 2025 national update: 97% reported all seven Core Elements in 2024; 16% reported all six priorities. | The problem is framed as execution depth and constrained follow-through, not absence of a stewardship program. | The national survey is not a critical-access-hospital rate. |
| CDC critical-access case example: local resistance data plus prospective review informed stewardship. | The antibiogram feeds a timed pharmacist-review draft. | A single case does not prove Day Three will reproduce its utilization result. |
| 2024, 19-hospital process evaluation: staffing, turnover, and bandwidth were barriers. | Long-lived work is registered up front and resumes from durable state. | No national prevalence or clinical outcome is claimed. |
Findings and learnings
The rules require this section, and it is usually filled with generalities. These are the specific things that actually happened.
A parallel rehearsal found cross-project clock interference
Running both public acceptance flows at once made Sixty Days move Day Three's simulation clock and hide its hour-52 wake. The services now persist separate demo clocks, and simulated dispatch checks the owning run before it claims a wake. The shared production scheduler remains unfiltered on wall-clock time. The same parallel rehearsal is the deployment gate.
The hallucination defence and the prompt injection defence turned out to be the same code
We built the Verifier to stop fabricated claims, and separately planned an injection defence. Then a test showed they were one mechanism: an injected instruction cannot produce an accepted claim, because a claim must quote source material that supports it. An agent talked into a wrong conclusion still cannot get that conclusion rendered. One guarantee, not two.
We got a published clinical rule wrong, and a standard caught it
Our first design folded specimen stratification into the CLSI first-isolate rule. CLSI is explicit that the first isolate is selected irrespective of body site, and stratified reporting is a separate optional presentation. A knowledgeable judge would have caught it. It is corrected, tested, and recorded in the Registry changelog rather than quietly patched. This is the strongest argument we have for building to a published standard: it can correct you.
Tests found three real bugs we would not have found by reading
A failed run kept its lease, so no other worker could resume it for ninety seconds. Our first contradiction rule was string matching and would have passed "penicillin is safe" because the quote happened to contain the word "allergy". And a test fixture invented a quote, which the Verifier rejected, proving the grounding chain end to end on a case we did not plan.
A reserved path cost us hours
/healthz is intercepted by Google's frontend and never reaches the container. We
only probed that one path, concluded the deployment was broken, and chased it across two projects,
two regions, and a service recreation before testing a second path and finding everything had been
working the whole time. Probe more than one endpoint before concluding anything.
We could not get a practitioner, so we changed what credibility means
No rural pharmacist was reachable inside the build window. Rather than claim a review we did not have, we built to CLSI M39 and published a conformance report mapping every rule to its implementation and its passing test. A judge can open the standard and check us. Nobody can check a private conversation. That turned out to be a better answer than the one we originally wanted.
FastAPI silently degraded our request models to query parameters
from __future__ import annotations turns annotations into strings, and FastAPI
resolves them against module globals. Pydantic models defined inside a router factory are
invisible to that lookup, so every request 422'd with a confusing error. Models now live at module
level with a comment explaining why.
Limits and safety
This never prescribes. Every output is a draft that a licensed pharmacist must approve. It cannot change an order and it never recommends a dose.
- All data is synthetic. No real patient information is used anywhere.
- Scope is organism-to-drug appropriateness only, because that is checkable against a laboratory result. Broader clinical judgement is not attempted.
- It refuses to guess. If a culture has not finalised, it re-arms for hour 72 rather than speculating.
- The antibiogram is a screening aid, not a substitute for a laboratory's own reported antibiogram.
- No hospital, agency, or professional body endorses this project. Sources are cited by name for reference only.
Validation without invented testimonials
No practitioner or applicant study is claimed. Public research establishes the workflow context; executable tests, recorded fixtures, adversarial probes, live acceptance, and explicit limitations establish what this build actually does. Clinical outcomes and practitioner usability remain unproven.