When the freezer fails, the response is already moving.
Night Shift assesses the incident, reserves safe backup capacity, coordinates responders, verifies each transfer, and closes only when everything is accounted for.
A worker restart replayed one receipt, not one rescue. An unsafe custody move was refused. The research estate is synthetic and responder movements are simulated. No real biobank samples were moved.
Operations
Freezer estate
- F-03B2-58.5°C · 22 free
- F-08B1-83.9°C · 11 free
- F-11B1-84.1°C · 43 free
- F-17B2-96.7°C · 66 free
- F-22C1-80.0°C · 6 free
Who this is for
A lab manager, at 2am, who is not a developer
Nobody logs into Night Shift to start a rescue. A freezer alarm starts it. Three people touch it afterwards, and each one sees only what their job needs.
Woken by the alarm
The lab manager
Opens the incident and reads what the fleet decided and, more usefully, what it refused. Every refusal names the invariant that caused it, so the question at 2am is never why did it stop.
Open a live incidentOn the floor, in cryo gloves
The responder
Gets a scoped link to one batch and nothing else. No study names, no other incidents. Scan the box, photograph the label and the destination display, and custody commits or is refused.
See the authority boundariesWeeks later
The auditor
Downloads the signed manifest and recomputes all thirteen invariants offline, with no credentials and no network. If a byte moved, the verdict says so and names which check failed.
Verify a manifestThere is no login. Everything here is readable, and the proof is verifiable, without an account: a reviewer should be able to check the claim rather than take it.
Mechanism
From alarm to reconciled custody
Existing monitoring tells a lab that something is wrong. Night Shift owns everything that has to happen next.
Assess
Temperature history and door events separate a door excursion from a failing compressor. A transient event does not trigger a rescue.
Contain
A containment hold freezes normal placement and withdrawal on the failed unit, so material cannot move in behind the rescue.
Reserve
Backup capacity is reserved inside a database transaction. Two incidents racing for the last slots cannot both win.
Dispatch
A work order opens and an on-call responder is dispatched. Retrying either one returns the original receipt, not a second truck roll.
Verify
Custody commits only when the container belongs to the incident, a reservation covers the destination, both scans exist, and the destination is cold and freshly read.
Close
Closure is refused while any container is unresolved, any effect is uncertain, or containment has not been released against a validated recovery.
Trust
Agents decide what to do. Deterministic code decides what is true.
Gemini interprets noisy telemetry, prioritises material, and chooses among valid options. It is never the authority on whether capacity exists, whether an effect already happened, or whether custody may change.
Six specialists, six authority boundaries
Each agent runs under its own identity with its own tool set. The Dispatch Agent holds no inventory authority at all, so a poisoned vendor reply asking it to export the specimen list has nothing to reach. The Commander cannot reserve capacity, open work orders, or move material. A compromised Commander can request a plan change and nothing else.
See the permission matrix →Thirteen invariants, checked twice
Capacity conservation, exactly-once effects, custody prerequisites, destination freshness, complete reconciliation, no premature close. The production services check them before committing, and the offline verifier recomputes them from the stored snapshot afterwards, with no model involved.
Verify a manifest yourself →Qualification
No revision gets authority because it built
Every candidate revision runs a disaster drill corpus with faults injected at tool boundaries. The verdict is computed by deterministic Python over stored artifacts. An LLM may explain a failure, never change it.
A separate live-agent tier ran 18 drill runs against the real Gemini fleet, passing 17. Runs and drills are counted separately: one drill can be run many times over different seeds. The two tiers are reported separately and never pooled.
Proof
Every completed incident ships a signed manifest
Canonical JSON, hashed with SHA-256, signed with a Cloud KMS asymmetric key. The manifest carries the full state snapshot, so a verifier rebuilds the world and recomputes the verdict rather than taking ours.
$ python -m nightshift.verify \
--manifest evidence/incidents/INC-0E7C54F8B5.manifest.json
PASS artifact hash: state_snapshot 91c3e98e0cc9b0cf… vs stored 91c3e98e0cc9b0cf…
PASS signing key (embedded) pinned to the published Cloud KMS key
PASS signature (embedded) verified against cloud-kms public key
PASS signature (detached) verified against cloud-kms public key
PASS state snapshot parses rebuilt KernelState
PASS invariant verdict matches 13 invariants recomputed
PASS closed incident fully reconciled 0 unresolved, 0 in flight
RESULT: PASS$ python -m nightshift.verify --manifest /tmp/tampered.json FAIL artifact hash: state_snapshot d34198d96398768c… vs stored 91c3e98e0cc9b0cf… FAIL signature (embedded) payload digest does not match the signed digest FAIL signature (detached) payload digest does not match the signed digest FAIL invariant verdict matches 13 invariants recomputed, 2 divergent FAIL reconciliation hash e0e7af1a548609ac… vs stored f0d112b1685dd6c7… FAIL closed incident fully reconciled 0 unresolved, 1 in flight RESULT: MISMATCH exit=1
The signature says nobody edited the bytes. The fourth line says something harder: the verifier recomputed all thirteen invariants from the state itself rather than trusting what the document claimed about its own verdict, and two of them now disagree. Reproduce either column with make verify-demo, no credentials and no network.
Verify without trusting us
python -m nightshift.verify --manifest evidence/incidents/<id>.manifest.json
Needs no model, no network, and no Google Cloud credentials. Tampering with the state snapshot, the stored verdict, or the signature each produce a distinct MISMATCH. An unsigned manifest reports PARTIAL, never PASS.
Google Cloud
What runs, and what is only provisioned
Gemini 3.5 Flash on Vertex AI drives six ADK specialists. Six domain services run on Cloud Run, each under its own service account, with Firestore transactions enforcing capacity conservation and Cloud KMS signing the evidence. Two enabled services have no code path behind them, and they are listed as such.
Exercised
A code path calls it at runtime
Provisioned
Enabled on the project, called by nothing here