Architecture
One idea holds the whole design together: agents propose, the Truth Engine decides.
What you are looking at right now
The browser never receives a backend token. It talks only to this public service, which calls the private backend server-side using the identity Cloud Run attaches to it. There is no key file anywhere in this system.
The hero flow
- 1SOURCE CHANGEan approved procedure change arrives as a real event
- 2IMPACTwhich downstream work does this actually affect?
- 3ACTIONremediate that one artifact, under an explicit capability
- 4FRONTLINE VERIFICATIONthe worker does the work and photographs it
- 5CHANGE PROOFissued only when all seven conditions hold
The authority boundary
| Component | Owns |
|---|---|
| Change Intelligence | proposes candidates |
| Remediation | edits one artifact within a capability |
| Frontline Enablement | composes the delta |
| Field Verification | reports a position |
| Truth Engine | every decision that matters |
Impact qualification, capability authorization, all four trust-boundary crossings, the verification verdict, state transitions, the seven completion conditions, and proof identity — all deterministic, none reachable from model output.
Durability
A workflow outlives the process that created it.
| Runtime A | creates, runs to the evidence pause |
| Runtime B | recovers from Firestore → FAIL |
| Runtime C | recovers → PASS → PROOF_COMPLETE |
Three separate processes, one workflow, with exactly one remediation, one delivery and one proof. A durable lease means two instances can never resume the same workflow at once.