Migration / Control Tower

03 — Technology

Every choicehas a reason.

Gemini and Google ADK provide bounded interpretation and planning. Deterministic services own permissions, state, validation truth, idempotency, budgets and approval integrity.

T.01The stack

Eight layers, no decoration.

  • 01

    Intelligence

    • Gemini 3.7 Flash
    • Gemini 3.5 Flash
    • Google ADK 2.7.1
    • google-genai
    • Vertex AI

    Bounded structured reasoning, explanation, and read-only assistant behavior.

  • 02

    Application

    • Python
    • FastAPI
    • Oracle JET 20.1.3
    • Preact
    • TypeScript

    The orchestrator, agents, policy services, adapters and validation logic.

  • 03

    Cloud runtime

    • Cloud Run services
    • Cloud Run Jobs
    • Artifact Registry
    • Cloud Build

    Independent service identities, autoscaling, and execution isolation for finite work.

  • 04

    State and messaging

    • Firestore
    • Pub/Sub
    • Dead-letter topics
    • Transactional idempotency

    Durable workflow state and at-least-once delivery that stays safe under retry.

  • 05

    Data

    • SQL Server
    • Cloud SQL for PostgreSQL
    • BigQuery
    • Cloud Storage staging

    The measured source, the analytics target, and the staging between them.

  • 06

    Security

    • IAM
    • OIDC
    • Secret Manager
    • Firebase Authentication
    • Policy-as-code

    Secrets stay references; identity and policy are evaluated outside the model.

  • 07

    Observability

    • OpenTelemetry
    • Cloud Trace
    • Cloud Logging
    • Cloud Monitoring

    Traces, logs and metrics that make a claim checkable after the fact.

  • 08

    Delivery and QA

    • Terraform
    • Docker
    • Make
    • pytest
    • Vitest
    • Playwright
    • axe

    Repeatable infrastructure and the gates that keep the estate portable.

T.02Rationale

Why each part of the system is there.

Gemini 3.7 / 3.5 Flash

Bounded structured reasoning, explanation, and read-only assistant behavior.

Google ADK

Agent construction, tool orchestration, and framework compliance.

Cloud Run services

Independent service identities, autoscaling, and containerized control-plane deployment.

Cloud Run Jobs

Execution isolation for finite data-movement tasks and independent job evidence.

Firestore

Durable workflow state, transactions, registry records, evidence pointers and idempotency claims.

Pub/Sub

At-least-once stage delivery, push authentication, retries and dead-letter routing.

BigQuery

Target analytics store, validation queries, cost estimates and bounded query execution.

Cloud SQL

Managed PostgreSQL source for the measured live migration path.

Terraform

Repeatable infrastructure for services, identities, topics, subscriptions, storage and data resources.

T.03Research

Realistic enough to be credible. Controlled enough to be falsifiable.

No confidential or production client data is used. Because the harness knows which dependency should exist, which risk was planted, which action should be blocked and which check should fail, evaluation is repeatable rather than anecdotal.

Next

The console

Application Guide