diff --git a/.gitignore b/.gitignore
index 772b405..bed6b58 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@ tfplan
infra/terraform/backend.hcl
_private/
.worktrees/
+docs/backups/
diff --git a/README.md b/README.md
index 63deca7..8f7eff2 100644
--- a/README.md
+++ b/README.md
@@ -1,34 +1,63 @@
# StayLong
-See the [product brief](docs/product-brief.md) for policy context, MVP workflow and safety boundaries.
+> StayLong is an ageing-in-place coordination agent that helps older Australians who live alone remain independent at home for longer.
-> Help older Australians live independently at home for longer.
+StayLong turns a non-emergency home-living concern into an assessment-ready Home Independence Plan, keeps proposed next steps pending until the person approves them, and records follow-through over time.
-StayLong is a consent-governed, event-driven coordination layer for older Australians living alone. It turns a home-living concern into an accountable, assessment-ready plan, coordinates approved next steps, and follows up until every approved action is complete. The older person can work independently or invite an authorised supporter for a specific task.
+StayLong prepares and coordinates approved steps; it does not deliver care, determine eligibility, access MyGov, select providers, prescribe modifications or make payments.
-The public-sandbox runtime passes concern text through Vertex Model Garden MaaS `gemma-4-26b-a4b-it-maas` before persistence or tool actions. Gemini 3.6 Flash remains the primary ADK coordinator; Gemma returns only a strict privacy contract and cannot change safety, consent or approval transitions. If the privacy guard is unavailable or returns invalid output, the workflow fails closed without persisting the concern or starting a plan.
+## What it does
+
+- Captures a non-emergency concern in plain language, such as difficulty reaching the bathroom safely at night.
+- Uses deterministic safety routing before any model-assisted planning.
+- Prepares an assessment-ready summary and practical notes for the person to review.
+- Proposes bounded next steps and keeps them waiting until the person approves.
+- Records approved follow-through, reminders and outcomes in an auditable case timeline.
+- Shows a visible plan, approval status and outcome timeline.
+
+## Product principles
+
+- **The older person stays in control.** Consent to involve someone is separate from approval to take an external action.
+- **One clear step at a time.** The experience reduces coordination burden without pressuring the person to disclose more than needed.
+- **Public means safe to try.** The public demonstration uses anonymous sessions, synthetic data and sandbox actions only.
+- **Approval is an action boundary.** StayLong does not send information, create a booking or use an external account without recorded approval.
+- **Privacy is bounded by design.** A Gemma privacy guard removes unnecessary personal information before persistence or planning, and fails closed if its response is invalid.
+- **Official pathways remain with the person.** StayLong prepares and coordinates; it does not access MyGov, determine eligibility, select providers, prescribe modifications or make payments.
+
+## Architecture at a glance
+
+
+
+StayLong runs on Google Cloud with Google ADK, Gemini 3.6 Flash and a Gemma 4 privacy guard. An explicit approval gate separates a proposed step from any external action. The public demonstration cannot create real Calendar, Gmail, provider, payment, My Aged Care or MyGov actions; private Calendar OAuth and Gmail draft preparation are available only in the authenticated private runtime after user approval. See the complete [architecture and boundary documentation](docs/architecture.md).
-## Public demonstration URL
+## Public demonstration
-The long-lived judge-facing experience is available at `https://staylonghome.com`.
-It is a temporary-data demonstration, not a production care service: it does
-not connect to real Gmail, Calendar, provider, payment, My Aged Care, or MyGov
-accounts. The generated Cloud Run URL remains available as a rollback path.
-Only an explicitly reviewed
-`public_edge_lockdown_enabled=true` configuration switches Cloud Run to accept
-traffic through the managed load balancer and branded URL.
+The long-lived demonstration is available at [staylonghome.com](https://staylonghome.com). It is a temporary-data demonstration, not a production care service. The generated Cloud Run URL remains available as a rollback path; only an explicitly reviewed `public_edge_lockdown_enabled=true` configuration restricts Cloud Run traffic to the managed load balancer and branded URL.
+
+## Privacy and safety boundaries
+
+The public-sandbox runtime passes concern text through Vertex Model Garden MaaS `gemma-4-26b-a4b-it-maas` before persistence or tool actions. Gemini 3.6 Flash remains the primary ADK coordinator; Gemma returns only a strict privacy contract and cannot change safety, consent or approval transitions. If the privacy guard is unavailable or returns invalid output, the workflow fails closed without persisting the concern or starting a plan.
## What it is—and is not
-StayLong helps older people and their chosen supporters prepare, coordinate and track. It sits between family care apps, provider operations software and My Aged Care: it does **not** deliver care, diagnose health conditions, prescribe home modifications, determine AT-HM eligibility, submit government forms, select a provider, or make payments. For acute emergencies or immediate danger, StayLong immediately halts workflow progression and directs users to call Triple Zero (000). Human confirmation is required before every external action or information disclosure.
+StayLong helps an older person prepare, coordinate and track approved next steps. It sits between family care apps, provider operations software and My Aged Care: it does **not** deliver care, diagnose health conditions, prescribe home modifications, determine AT-HM eligibility, submit government forms, select a provider, or make payments. For acute emergencies or immediate danger, StayLong immediately halts workflow progression and directs users to call Triple Zero (000). Human confirmation is required before every external action or information disclosure.
+
+## Technology stack
+
+- **Application:** Python, FastAPI and an accessible browser experience.
+- **Agentic AI:** Google ADK with Gemini 3.6 Flash on Vertex AI; Gemma 4 through Vertex Model Garden MaaS as a schema-validated, fail-closed privacy guard.
+- **Google Cloud runtime:** Cloud Run, Firestore, Cloud Tasks, Pub/Sub and Cloud Logging.
+- **Public edge:** Cloudflare DNS, Google-managed TLS, Global HTTPS Load Balancing and a Serverless NEG.
+- **Private integrations:** user-approved Google Calendar OAuth and review-only Gmail draft preparation.
+- **Infrastructure and delivery:** Terraform, GitHub Actions and Workload Identity Federation—no long-lived Google Cloud service-account keys in GitHub.
+
+## Documentation
-## Competition fit
+See the [product brief](docs/product-brief.md) for policy context, MVP workflow and safety boundaries; the public [architecture](docs/architecture.md) explains the runtime, approval and deployment boundaries.
-StayLong is designed for the **Taskmaster** track of the All Things Agentic Hackathon. It uses Gemini 3.6 Flash through Vertex AI, Google ADK, and Google Cloud services (Cloud Run, Firestore, Cloud Tasks and Pub/Sub).
+Competition requirements and evidence are recorded in [competition references](docs/competition-references.md) and [submission readiness](docs/devpost-submission-readiness.md).
-See [competition references](docs/competition-references.md) and the public [architecture](docs/architecture.md).
The single source-of-truth capability mapping is in the [capability matrix](docs/capability-matrix.md).
-The complete Devpost requirements and bonus evidence plan are in [submission readiness](docs/devpost-submission-readiness.md).
The locked stack and live-submission compliance checklist are in [technology and compliance](docs/technology-and-compliance.md).
The additional Gemma privacy integration is documented in [Gemma privacy guard](docs/gemma-privacy.md).
Task documentation, human-action gates and pull-request practice follow the [delivery standards](docs/delivery-standards.md).
diff --git a/docs/architecture.md b/docs/architecture.md
index 27094a4..9291dc1 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -4,6 +4,23 @@
Build a small, demonstrable Taskmaster that persists a household coordination plan, reacts to events, seeks approval for consequential actions, and records an auditable result. See the [capability matrix](capability-matrix.md) for the exhaustive mapping from user capabilities to API endpoints, code modules, test suites, and infrastructure components.
+## Architecture overview
+
+
+
+This visual overview complements the executable Mermaid flow below; it does not replace it. The diagram is designed to make four boundaries immediately clear:
+
+1. **Your experience** — an older person can prepare a plan independently. The current demo records whether they would like to involve someone, but does not create supporter invitations, notifications or information sharing; consent-based supporter collaboration is a later extension.
+2. **Public demo, safe by design** — the public Cloud Run sandbox accepts anonymous, synthetic sessions and records simulation results only; it cannot use real MyGov, provider, payment, Calendar, Gmail or SMS accounts.
+3. **Agentic coordination core** — deterministic safety routing runs before the Gemma privacy guard and Google ADK/Gemini coordinator. Firestore holds case state and approvals; Cloud Tasks and Pub/Sub support approved follow-through.
+4. **You stay in control** — an explicit approval gate separates proposals from action. Google Calendar OAuth and a review-only Gmail draft are private-runtime capabilities, shown as optional dashed paths; neither is available to the public demo or triggered automatically.
+
+GitHub Actions uses Workload Identity Federation to authenticate without long-lived cloud keys. Terraform provisions the Google Cloud infrastructure and policies; it does not deploy models or grant an automatic right to call external Google APIs. Cloud Logging records privacy-safe workflow timing evidence.
+
+The editable source is [`assets/architecture/staylong-architecture-diagram.drawio`](assets/architecture/staylong-architecture-diagram.drawio), with an [SVG version](assets/architecture/staylong-architecture-diagram.drawio.svg).
+
+## Executable system flow
+
```mermaid
flowchart LR
subgraph EXPERIENCE["Independent-living experience"]
@@ -64,7 +81,7 @@ The demo seed is [`fixtures/demo/seeded-household.json`](../fixtures/demo/seeded
## Core event flow
-1. An older person living alone creates a concern independently, or an authorised supporter creates one with the person's permission.
+1. An older person living alone creates a concern independently. The public demo may record a preference to involve someone later, but does not create a supporter account, invitation, notification or disclosure.
2. The API performs deterministic red-flag screening before invoking any model.
3. For a non-emergency concern, Gemma redacts unnecessary PII. An unavailable or invalid privacy response fails closed before persistence or planning.
4. The intake agent produces a typed concern summary and lists missing facts.
@@ -116,6 +133,6 @@ Emergency handling is a static, deterministic route, not an LLM feature. A possi
- The branded public entry point is `https://staylonghome.com`, served by a global external HTTPS Load Balancer, Google-managed TLS certificate and Serverless NEG in front of Cloud Run; direct Cloud Run domain mapping is not used. During Phase A, the existing generated `run.app` URL remains available as a rollback path. Phase B can restrict direct Cloud Run access only after branded-domain TLS, smoke tests and evidence have passed.
The detailed boundary, lifecycle controls and DNS-token handling are in the
-[public-edge design](architecture/public-edge-design.md). The public edge is
+[public-edge design](public-edge-design.md). The public edge is
still a temporary-data sandbox: it does not provide real Calendar, Gmail, SMS,
provider, payment, MyGov or government-account actions.
diff --git a/docs/assets/architecture/staylong-architecture-diagram.drawio b/docs/assets/architecture/staylong-architecture-diagram.drawio
new file mode 100644
index 0000000..b02a4c9
--- /dev/null
+++ b/docs/assets/architecture/staylong-architecture-diagram.drawio
@@ -0,0 +1,899 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/assets/architecture/staylong-architecture-diagram.drawio.png b/docs/assets/architecture/staylong-architecture-diagram.drawio.png
new file mode 100644
index 0000000..8f849f8
Binary files /dev/null and b/docs/assets/architecture/staylong-architecture-diagram.drawio.png differ
diff --git a/docs/assets/architecture/staylong-architecture-diagram.drawio.svg b/docs/assets/architecture/staylong-architecture-diagram.drawio.svg
new file mode 100644
index 0000000..4e8f703
--- /dev/null
+++ b/docs/assets/architecture/staylong-architecture-diagram.drawio.svg
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/docs/devpost-submission-readiness.md b/docs/devpost-submission-readiness.md
index 8e117ac..e6fb2f4 100644
--- a/docs/devpost-submission-readiness.md
+++ b/docs/devpost-submission-readiness.md
@@ -1,18 +1,21 @@
# StayLong Devpost submission readiness
-This checklist is based on the [official Devpost overview](https://allthingsagentichackathon.devpost.com/) and [official rules](https://allthingsagentichackathon.devpost.com/rules), checked on 30 August 2026. Devpost currently shows a submission deadline of **31 August 2026 at 5:00 PM Pacific Time**.
+This checklist is based on the [official Devpost overview](https://allthingsagentichackathon.devpost.com/) and [official rules](https://allthingsagentichackathon.devpost.com/rules), rechecked on 31 August 2026. The submission deadline is **31 August 2026 at 5:00 PM Pacific Time** (**1 September 2026 at 10:00 AM AEST**).
+
+Use this as the final release gate: do not submit until every required item is verified against its live URL or final Devpost preview.
## Required
- [ ] Select **Taskmaster**.
-- [ ] English description covers the problem, features, technologies, data sources, findings and learnings.
+- [ ] English description covers the problem, customer, solution, technologies, data sources, findings and learnings.
- [ ] Show Gemini 3.5+, Google ADK, and Google Cloud services in the description and repository.
- [ ] Link `https://github.com/sailing-together/StayLong` and verify it in an incognito window.
- [ ] Keep README spin-up instructions reproducible for local testing and Terraform deployment.
-- [ ] Upload an architecture diagram showing the public sandbox, private runtime boundary, Gemma privacy guard, ADK/Gemini, Cloud Run, Firestore and asynchronous services.
+- [ ] Upload the architecture diagram showing the public sandbox, optional private-runtime boundary, Gemma privacy guard, ADK/Gemini, Cloud Run, Firestore and asynchronous services.
- [ ] Provide a public English (or English-subtitled) YouTube or Vimeo video of **four minutes or less**.
- [ ] Video covers the problem, customer, solution, working demo, approved action and visible Google Cloud proof in one live, unedited flow.
-- [ ] Add the hosted public-sandbox URL after deployment is verified; never submit the private Sydney v2 URL as the product entry.
+- [ ] Add the hosted public-sandbox URL: `https://staylonghome.com`; never submit the private runtime URL as the product entry.
+- [ ] Link the rendered architecture diagram from the repository: `docs/assets/architecture/staylong-architecture-diagram.drawio.png`.
## Eligibility and disclosure
@@ -22,12 +25,19 @@ This checklist is based on the [official Devpost overview](https://allthingsagen
- [ ] Keep the project free to test through judging, or provide testing credentials if a login is unavoidable.
- [ ] Keep all submitted materials English-first and freeze linked materials after the deadline.
+### Minimum, accurate disclosure
+
+- [ ] State only what the rules require: new work during the submission period, any incorporated pre-existing work, and third-party/open-source components where relevant.
+- [ ] Keep the technical description factual: Gemini 3.6 Flash on Vertex AI and Google ADK coordinate the workflow; Gemma 4 MaaS is a fail-closed privacy guard.
+- [ ] Do not disclose credentials, OAuth tokens, private runtime URLs, private prompts, personal information or internal-only operational detail.
+- [ ] Do not claim a real Calendar event, Gmail message, supporter invitation or data sharing from the public demo. Public actions are recorded simulations.
+
## Bonus points — complete all three
### Public technical content
- [ ] Publish an English technical article or public video describing ADK orchestration, Gemini, Gemma privacy, approval gates, Terraform/WIF and lessons learned.
-- [ ] Include: **“This content was created for the purposes of entering the All Things Agentic Hackathon.”**
+- [ ] Include this exact sentence: **“This piece of content was created for the purposes of entering the All Things Agentic Hackathon.”**
- [ ] Provide a public URL (not private or unlisted) in the Devpost submission.
### Social post
@@ -44,9 +54,18 @@ This checklist is based on the [official Devpost overview](https://allthingsagen
## Evidence bundle
-- [ ] Public sandbox URL and fresh-browser smoke test.
-- [ ] Passing Python, React/TypeScript, Terraform and Trivy CI links.
-- [ ] Successful Terraform deployment evidence.
-- [ ] Architecture diagram, public demo video, technical article and social-post URLs.
-- [ ] Gemma implementation and test evidence.
-- [ ] Final Devpost preview checked before submission.
+- [ ] Public sandbox URL and fresh-browser smoke test: `https://staylonghome.com` and [`live browser acceptance evidence`](live-browser-acceptance-evidence.md).
+- [ ] Passing Python, React/TypeScript, Terraform and Trivy CI links: [`release evidence`](release-evidence.md).
+- [ ] Successful Terraform deployment evidence: [`release evidence`](release-evidence.md).
+- [ ] Architecture diagram URL: `docs/assets/architecture/staylong-architecture-diagram.drawio.png`.
+- [ ] Public demo video URL: _add after publishing_.
+- [ ] Public technical article URL: _add after publishing_.
+- [ ] Public social-post URL: _add after publishing_.
+- [ ] Gemma implementation and test evidence: [`Gemma privacy integration`](gemma-privacy.md).
+- [ ] Final Devpost preview checked by the submitting team member before submission.
+
+## Final two-person release gate
+
+- [ ] Reviewer A checks every public link, the video duration and the English-language requirement.
+- [ ] Reviewer B checks the Devpost preview against this checklist, including the disclosure boundary.
+- [ ] The submitting team member confirms that all teammates have accepted invitations and selects **Submit**.
diff --git a/docs/product-brief.md b/docs/product-brief.md
index ac5acb2..b17799c 100644
--- a/docs/product-brief.md
+++ b/docs/product-brief.md
@@ -1,24 +1,24 @@
# StayLong product brief
-StayLong helps older Australians who live alone remain independent at home for longer. It is a consent-governed coordination layer that an older person can use independently, or with authorised trusted supporters they choose to invite. It turns a non-emergency home-living concern into a durable workflow: collect non-clinical facts, prepare for the relevant assessment, obtain approval, coordinate follow-up and prove completion.
+StayLong helps older Australians who live alone remain independent at home for longer. It is a consent-governed coordination layer that an older person can use independently. It turns a non-emergency home-living concern into a durable workflow: collect non-clinical facts, prepare for the relevant assessment, obtain approval, coordinate follow-up and prove completion.
## Australian policy context
Australia's [Support at Home program](https://www.health.gov.au/our-work/support-at-home) began on 1 November 2025, replacing the Home Care Packages Program and Short-Term Restorative Care Programme. Its [Assistive Technology and Home Modifications (AT-HM) scheme](https://www.health.gov.au/our-work/support-at-home/delivering-services-for-support-at-home/assistive-technology-and-home-modifications-at-hm-scheme) gives the project a real local context for home modifications and assistive technology. High-tier home-modification funding is capped at AUD $15,000 per lifetime (excluding any additional eligible supplement) and can cover examples such as handrails, ramps, bathroom redesign and widened doorways.
-StayLong helps an older person and their authorised trusted supporters prepare and coordinate approved steps; it does not determine eligibility, submit applications, access MyGov, select providers, prescribe modifications, make payments or claim funds.
+StayLong helps an older person prepare and coordinate approved steps; it does not determine eligibility, submit applications, access MyGov, select providers, prescribe modifications, make payments or claim funds.
-The need for coordinated home support is substantial. In 2023–24, around **835,000 people aged 65 and over** used home-support services in Australia, according to [AIHW aged-care reporting](https://www.aihw.gov.au/reports/australias-welfare/aged-care). In 2022, an estimated **3 million Australians (12% of the population)** provided informal care; the average carer age was 50, and an estimated **1.05 million carers were aged 35–54**, according to [AIHW informal-carer reporting](https://www.aihw.gov.au/reports/australias-welfare/informal-carers). These figures support an initial focus on independent older people living alone, while recognising that an adult child, partner, relative, friend, neighbour or advocate may become an authorised supporter when the older person chooses.
+The need for coordinated home support is substantial. In 2023–24, around **835,000 people aged 65 and over** used home-support services in Australia, according to [AIHW aged-care reporting](https://www.aihw.gov.au/reports/australias-welfare/aged-care). In 2022, an estimated **3 million Australians (12% of the population)** provided informal care; the average carer age was 50, and an estimated **1.05 million carers were aged 35–54**, according to [AIHW informal-carer reporting](https://www.aihw.gov.au/reports/australias-welfare/informal-carers). These figures support an initial focus on independent older people living alone, while informing a future consent-based trusted-supporter model.
## MVP
-For a concern such as difficulty reaching the bathroom at night, StayLong performs: concern → deterministic emergency check → non-clinical fact collection → a durable three-task Home Independence Plan and assessment-preparation pack → two separately approval-gated actions (Calendar reminder and unsent contact draft) → outcome and audit timeline. The older person can complete these steps alone or invite a supporter only for a specific approved task.
+For a concern such as difficulty reaching the bathroom at night, StayLong performs: concern → deterministic emergency check → non-clinical fact collection → a durable three-task Home Independence Plan and assessment-preparation pack → two separately approval-gated actions (Calendar reminder and unsent contact draft) → outcome and audit timeline. The current public demo supports this journey for an older person completing it independently; a consent-based trusted-supporter model is planned separately.
Possible emergencies route immediately to Triple Zero (000), without a model call or delayed work. User-supplied photos are household context only, never a clinical risk diagnosis.
## Hackathon fit
-**Taskmaster:** a long-running, event-driven workflow with explicit approval boundaries, persistent state and a real approved coordination action. The implementation uses Gemini 3.5+ on Vertex AI, Google ADK, Cloud Run, Firestore, Cloud Tasks and Pub/Sub.
+**Taskmaster:** a long-running, event-driven workflow with explicit approval boundaries, persistent state and a real approved coordination action. The implementation uses Gemini 3.6 Flash on Vertex AI (meeting the Gemini 3.5+ requirement), Google ADK, Cloud Run, Firestore, Cloud Tasks and Pub/Sub.
## Differentiation
diff --git a/docs/architecture/public-edge-design.md b/docs/public-edge-design.md
similarity index 100%
rename from docs/architecture/public-edge-design.md
rename to docs/public-edge-design.md
diff --git a/docs/superpowers/plans/2026-08-28-public-edge.md b/docs/superpowers/plans/2026-08-28-public-edge.md
index dd5e1de..b6b2933 100644
--- a/docs/superpowers/plans/2026-08-28-public-edge.md
+++ b/docs/superpowers/plans/2026-08-28-public-edge.md
@@ -8,7 +8,7 @@
**Tech Stack:** Terraform >= 1.9; hashicorp/google ~> 6; cloudflare/cloudflare ~> 5; Google Cloud Load Balancing; Cloud Run; GitHub Actions; pytest; Trivy.
-**Spec:** `docs/architecture/public-edge-design.md`
+**Spec:** `docs/public-edge-design.md`
## Global Constraints
diff --git a/docs/technology-and-compliance.md b/docs/technology-and-compliance.md
index 989b1eb..3f38fbe 100644
--- a/docs/technology-and-compliance.md
+++ b/docs/technology-and-compliance.md
@@ -10,7 +10,7 @@
| Agent runtime | Google ADK for Python |
| Model | Gemini 3.6 Flash on Vertex AI; Gemma 4 MaaS is a separate fail-closed privacy guard |
| API and workflow service | Python 3.12, FastAPI and Pydantic |
-| Web experience | React, TypeScript, Vite and Tailwind; built static assets served with the FastAPI service |
+| Web experience | React, TypeScript and Vite; built static assets served with the FastAPI service |
| Persistent case state | Firestore: household, consent, approval, case and immutable audit-event records |
| Autonomous work | Cloud Tasks for delayed reminders/retries and Pub/Sub for domain-event routing |
| Approved real-world action | Private runtime only: Google Calendar API creates an authorised coordination event; Gmail remains an unsent-draft capability. Public sandbox actions are simulations. |
@@ -18,7 +18,7 @@
| Infrastructure | Terraform provisions all GCP resource lifecycle; GitHub Actions runs reviewed plans/applies through WIF |
| Automation | GitHub Actions for test, lint, Terraform plan/apply and Cloud Run deployment |
| Cloud authentication | GitHub OIDC Workload Identity Federation; no service-account JSON keys |
-| Observability | Cloud Logging, OpenTelemetry traces and the product audit timeline |
+| Observability | Cloud Logging and the product audit timeline |
## Agent responsibilities
@@ -73,8 +73,8 @@ The detailed training-informed architecture choices are recorded in [official tr
| Google Agent Framework | Google ADK Python application (SAI-23) |
| Google Cloud infrastructure | Cloud Run, Firestore, Cloud Tasks and Pub/Sub, provisioned by Terraform |
| Autonomous agent beyond a chat loop | Event-triggered state transitions, durable tasks, retries, reminders and authorised escalation |
-| Taskmaster takes action | After human approval, create a Google Calendar coordination event and persist its audit record |
-| Complete multi-step workflow | Concern intake → safety route → fact collection → assessment pack → approval → calendar coordination → reminders/escalation → completion proof |
+| Taskmaster takes action | A private runtime with complete OAuth configuration can create an approved Google Calendar coordination event and persist its audit record; public-sandbox actions are recorded simulations. |
+| Complete multi-step workflow | Concern intake → safety route → fact collection → assessment pack → approval → sandbox-safe follow-through; private Calendar coordination is available only when OAuth is configured and approved. |
| Project can be tested | Public hosted Cloud Run demo with demo data, reproducible README and test instructions |
| English submission materials | English-first product/docs/UI/video; Chinese is internal supplementary material only |
| Architecture diagram and ≤4-minute video | SAI-34 to SAI-37 require the diagram, Google Cloud deployment evidence and English/public video |
@@ -88,10 +88,11 @@ The architecture is compliant **by design**. The submission is compliant only wh
StayLong does not diagnose, medically triage, prescribe modifications, determine funding eligibility, submit government applications, select a provider or make payments. It uses demo or fully authorised data only. Human approval is mandatory for external action and information disclosure.
The initial experience is for an older Australian living alone, who can use the
-agent without involving anyone else. A child, partner, relative, friend,
-neighbour or advocate becomes a trusted supporter only when the older person
-chooses to invite them for a specific task. The product never silently informs
-that support network.
+agent without involving anyone else. The current public demo records whether
+the person would like to involve someone, but does not create supporter
+invitations, accounts, notifications or information sharing. A consent-based
+trusted-supporter collaboration capability is planned separately; it must never
+silently inform that support network.
## Authoritative competition sources
diff --git a/docs/training-informed-improvements.md b/docs/training-informed-improvements.md
index 3407a74..51535dd 100644
--- a/docs/training-informed-improvements.md
+++ b/docs/training-informed-improvements.md
@@ -90,6 +90,6 @@ The self-evolving course shows that a model can game a weak metric. In StayLong,
## Resulting product narrative
-"When a family member raises a non-emergency concern, StayLong collects only the needed information, produces an assessment-preparation pack, waits for explicit approval, creates one authorised coordination event, and then follows up on schedule—even if the service restarts. Every decision, approval and action is visible in the timeline."
+"When an older person raises a non-emergency concern, StayLong collects only the needed information, produces an assessment-preparation pack, waits for explicit approval, records a sandbox-safe coordination action, and then follows up on schedule—even if the service restarts. Every decision, approval and action is visible in the timeline."
This is a stronger Taskmaster demonstration than a generic care chatbot because the agent performs a bounded, real workflow autonomously over time and proves it did so safely.