Every claim a worker emits is intercepted mid-flight, judged against memory by an adversarial panel and a deterministic tripwire, and — if it survives — written back as verified ground truth. The verification gate is the hero; everything else is neutral plumbing.
The whole design exists to put one adjudication seam between an agent's claim and the tool that would act on it.
Real LlmAgent workers exposed over A2A with to_a2a() and live AgentCards; the orchestrator
delegates as a RemoteA2aAgent. This is a genuine multi-agent fleet, not a single prompt.
before_tool_callbackThe non-experimental ADK hook where returning a dict skips the real tool. This is the one seam that makes an in-path veto possible: a vetoed claim's tool never fires.
Three adversarial lenses — robust, overreach, nevers — judge the claim in parallel at temperature 0, returning JSON verdicts against memory as ground truth, with retry / backoff.
A regex word-boundary gate that hard-vetoes money / auth / destructive claims with no model in the loop — the place a confident hallucination is most expensive.
Any SQLite store with a memories table. Agreement supports a claim; contradiction caps at a flag.
Curated context, never a hard veto on its own.
sentinel.db — its own file, so broker refresh jobs can't clobber rulings. Provenance-tracked accepts
ground the next run, and re-serve at 0 model calls.
Each Google technology is doing real work in the critical path, not name-checked for the rubric.
LlmAgent workers; EvalSet + AgentEvaluator for the referee eval.to_a2a() workers with live AgentCards + RemoteA2aAgent orchestration — a real fleet boundary to defend.