DRIFTZERO GitHub

Architecture

One idea holds the whole design together: agents propose, the Truth Engine decides.

What you are looking at right now

PUBLIC INTERNET you, with no Google account
driftzero-web Cloud Run · public · read-only · scale to zero this page
Google-signed service-to-service ID token
driftzero-api Cloud Run · private · IAM-gated unauthenticated request → 403
Firestoredurable state · action ledger · proofs · idempotency
Private backend: SERVINGauthenticated server-to-server call to the private Cloud Run backend returned 200checked 2026-09-04T05:39:44+00:00

The browser never receives a backend token. It talks only to this public service, which calls the private backend server-side using the identity Cloud Run attaches to it. There is no key file anywhere in this system.

The hero flow

  1. 1SOURCE CHANGEan approved procedure change arrives as a real event
  2. 2IMPACTwhich downstream work does this actually affect?
  3. 3ACTIONremediate that one artifact, under an explicit capability
  4. 4FRONTLINE VERIFICATIONthe worker does the work and photographs it
  5. 5CHANGE PROOFissued only when all seven conditions hold

The authority boundary

ComponentOwns
Change Intelligenceproposes candidates
Remediationedits one artifact within a capability
Frontline Enablementcomposes the delta
Field Verificationreports a position
Truth Engineevery decision that matters

Impact qualification, capability authorization, all four trust-boundary crossings, the verification verdict, state transitions, the seven completion conditions, and proof identity — all deterministic, none reachable from model output.

Durability

A workflow outlives the process that created it.

Runtime Acreates, runs to the evidence pause
Runtime Brecovers from Firestore → FAIL
Runtime Crecovers → PASS → PROOF_COMPLETE

Three separate processes, one workflow, with exactly one remediation, one delivery and one proof. A durable lease means two instances can never resume the same workflow at once.