It starts from an event
A run begins from the console, an API client supplying an NID identifier, or Cloud Scheduler. Never from an operator pressing start. The trigger is the first entry on the timeline.
Evaluation path
An autonomous partner you can verify in one request.
Press Run the whole thing in one request on the home page, or POST /downstream/demo/run. The agent opens a run, reads the drawing, grounds the facts, derives the source conflict, drafts every section it has evidence for, applies the mapping gate, schedules two durable wakes and fires them, then hands back a receipt counted from stored state. Typical result: 15 automatic steps, 0 continue clicks.
Run it in one requestDrive it by hand insteadOpen evidence dashboardOpen raw proofInspect repository
- One request. The whole workflow runs server-side and returns the autonomy receipt, the draft, the evidence ledger and the measured context.
- Read the timeline. Every step names the actor that performed it: agent, owner authority, or external event. The counts are derived from it, not asserted.
- Check where it stopped. It pauses only on owner knowledge, which is the one input it is not permitted to invent.
- Watch it work unattended. Durable wakes reopen held questions and follow up on a stalled draft. Cloud Scheduler calls
/internal/scan-dueevery fifteen minutes. - Then drive it by hand. Ask for simpler language, hold and reopen a gap, save a correction, and inspect both answer versions.
- Confirm the boundary held. No inundation extent, no certification, no submission, however complete the run.
92,606USACE records measured through the public service
15automatic agent steps per run, 0 continue clicks
371standalone automated tests
63/63executable end-to-end checks
2durable wakes registered and fired per run
0unvalidated boundaries generated
Public and synthetic inputsUSACE NID, drawing facts, owner knowledgeEvery fact keeps its provenance, status, and conflict state.
Google Cloud agent loopCloud Run, Firestore, Cloud Scheduler, Vertex AIResolve, ground, decide, compose, schedule, wake, verify.
Reviewable resultCited EAP draft, evidence ledger, safe stopNever certified, submitted, or represented as engineering analysis.
Autonomy is counted, not claimed
What runs without anyone asking.
The receipt at /downstream/workspaces/{id}/autonomy is derived from the stored run timeline.
It decides, then stops
It resolves the record, reads the drawing, grounds every fact in a quote, derives the 28-versus-31-foot conflict, composes each section that has evidence, and applies the mapping gate. Then it pauses on owner knowledge.
It works while nobody watches
Durable wakes reopen questions held for later and record a follow-up on a stalled draft. They claim once by compare-and-swap, retry a bounded number of times, and dead-letter rather than loop.
The conflict is derived
It is not a fixture. The agent compares the drawing read against the registry row, so a drawing that agrees raises no sixth question, and there is a test for that.
Authority is reserved in writing
Owner knowledge, engineering resolution of a conflict, approval or submission, and any inundation extent. The receipt reports zero system decisions over any of them.
Context is measured, not asserted
The meter estimates the assembled turn payload against naive replay: flat at 496 tokens across twelve further empty sessions while replay grows to 1,415. The proof endpoint includes a check that the meter can report a breach.
Adaptation is observable
Feedback changes the work product, not just a profile flag.
The public workflow makes the full correction chain inspectable.
Conflict-driven question
The 28-foot registry value and 31-foot drawing value produce a targeted sixth question with both source fragments attached.
Versioned owner correction
A revised access answer becomes version two and immediately changes the preparedness section. Version one remains in history.
Section evidence ledger
Every rendered section names its evidence class: published requirement, owner answer, or fail-closed safety policy.
Claim boundaries
Public data
A null public EAP field means unreported in that field. It is not proof that a plan is absent.
Mapping
The product shows a single flow-path input. No extent, depth, velocity, arrival time, or evacuation zone is generated.
Authority
The result is a draft for owner, emergency manager, engineer, and state review. Nothing is approved or submitted.
Architecture evidence
See the standalone repository for reproducible setup, tests, Mermaid source, rendered architecture, research traceability, and the timed submission kit.