Utah DOT publishes a work zone feed under WZDx, the federal specification that tells navigation services where the road is closed. Run that feed through USDOT’s own validator and it comes back with zero errors.
The same feed asserts 744 work zones currently active. Every one of them carries an end date that has already passed. The feed’s update_date has not moved in over three years.
Both facts hold at once, and there is no contradiction between them, because they answer different questions. The validator asked whether the document is shaped like a WZDx feed. Nothing in the pipeline asked whether it is describing the road.
A routing service consuming that feed inherits 744 phantom closures and a green light from every automated check standing between it and the publisher. Conformance and trustworthiness are different properties, and only one of them was being measured.
I spent the last few weeks building Interchange, a governed ingestion fleet that measures the other one. It is my entry for the All Things Agentic hackathon, in the Fortified Enterprise Fleet track, and the whole thing is public.
Validators check the shape, nobody checks the claim
Conformance is a property of a document. Fields present, types correct, enumerations in range, required relationships satisfied. It is cheap to check and entirely local to the file.
Trustworthiness is a property of the relationship between that document and the world it claims to describe. It is not decidable from the file alone, and no schema can express it. Nothing in WZDx says a work zone marked active must not have already ended, and adding such a constraint would only push the problem one level down, because a publisher can satisfy any constraint you can write while still describing a road that reopened years ago.
This is not a work zone problem. It is the shape of every dependency you consume and cannot audit: a partner API, a vendor’s nightly export, a price oracle, a public registry, another team’s service behind an internal contract. The contract test passes. The payload validates. The values are wrong, and the pipeline has no opinion about it because nobody gave it one.
The gap is easy to miss precisely because the conformance layer is so good. Green checks accumulate, and green reads as fine.
Nobody in this pipeline can be compelled
What turns this from a data-cleaning task into a governance one is who publishes the data.
The federal registry lists 41 publisher feeds across 40 organizations, a publisher being keyed on organization plus feed name, and Colorado DOT publishing two of them. Each organization is a sovereign public agency with its own budget, staff, contractors and priorities. You cannot fix their data. You cannot make them fix it. You cannot decline to consume it, because the whole point of a national feed is national coverage.
So the only decision actually available to a consumer is whether to believe each publisher today. That decision has to be made continuously, because feeds decay between polls. It has to be defensible, because the output of the decision is a public statement that a named public agency is publishing something wrong. And it has to be made the same way every time, because a rule applied inconsistently across 40 agencies is not one any of them has reason to accept.
What a trust gate has to do instead
Interchange runs one agent per publisher, polls each feed on its own cadence, and scores the result against six versioned rules:
R1, the feed did not respond across consecutive polls.R2, the feed reports a last-updated time older than its own declared cadence allows.R3, the feed does not validate against the WZDx version it declares.R4, the feed marks work zones active whose end date has already passed.R5, the feed content has not changed while its last-updated time advanced.R6, the feed reports a last-updated time that is missing, unreadable or in the future.
Only R3 is a conformance rule. The rest measure the feed against the publisher’s own claims. R2 does not impose an outside freshness standard, it holds the publisher to the cadence the publisher declared. Utah DOT quarantines on two rules at once, R2 and R4, and both findings are stated in the publisher’s own terms.
The verdict is the most severe rule currently firing, ADMIT, WATCH or QUARANTINE, with no weighted average anywhere in the path. Averaging would let five clean rules dilute one disqualifying one, and a feed asserting 744 impossible closures is not five sixths fine.
Escalation happens on the poll that detects the problem. Recovery does not. Leaving quarantine takes 12 consecutive clean polls and at least 6 hours, leaving watch takes another 6, and any non-clean poll resets the counter to zero. That gap is where the gate earns its keep. A stale feed that flickers back to life for one cycle has demonstrated nothing, and a publisher that could flap back into admission on a single good poll would turn the gate into a coin toss during exactly the incidents it exists for.
Absence is never a pass
The failure mode I care most about is not a wrong verdict. It is a publisher that sailed through because nothing could be measured against it.
That failure is quiet, and on a dashboard it looks exactly like success. So the system keeps four distinct records for absence, and none of them is a pass.
A rule that cannot be evaluated returns NOT_APPLICABLE, which sits below ADMIT in severity and therefore can never raise a verdict. The reason is recorded and it matters: MEASURED_INAPPLICABLE, meaning the rule genuinely does not apply here, counts toward a publisher’s recovery, while MISSING_INPUT, meaning we never got what the rule needed, does not. An unresolvable schema version records SCHEMA_UNKNOWN and suppresses the affected rule rather than failing the publisher for our own ignorance. A key-gated feed is NO_ACCESS and drops out of every coverage denominator instead of being counted as fine, which is why 13 of the registry’s feeds show as unprobed rather than healthy.
And a publisher on which every single rule came back inapplicable returns WATCH, not ADMIT. Nothing spoke against it, and nothing spoke for it either.
The same rule governs the edges of the system. Publisher free text is screened before it can reach a model, a notice, or the republished feed, and when the screener is unavailable the text is redacted and flagged exactly as if it had been blocked, so an outage on my side cannot quietly become a pass on theirs. The republisher validates its own merged output against the WZDx 4.2 schema before emitting and refuses to publish if it fails, recording the refusal as an artifact rather than as silence. A merged feed that would quarantine its own publisher is the one failure this project cannot ship.
Where the model is not
Interchange is a fleet of agents, and there is a language model in it. Gemini appears in exactly two places: adjudicating duplicate zone pairs that the geometric matcher cannot resolve, and drafting the prose of a notice that a human then approves or withholds. Both are injected ports. The offline reproduction supplies neither, and it produces the same verdicts.
The model has no path to a trust verdict, and I never ask it for a confidence score. A scalar invites a threshold, and a threshold puts the model straight back into the gate through a side door.
The reason is not that the model would do it badly. A verdict has to come out the same way on identical inputs, and it has to be explainable to the agency it names, under a ruleset version I can point at. That is what a deterministic ruleset is for, and asking a model for it produces the wrong kind of artifact.
Where the model does run, absence still resolves toward safety. An ambiguous duplicate pair with no adjudication available is counted NOT_RUN and left as two zones, because a wrong merge hides a real closure while a wrong split only double counts one.
The part I would point a skeptic at first is the negative controls, because a matcher that accepts everything looks spectacular on the flagship example and is worthless. Missouri DOT against St. Charles County produces four candidate pairs inside the distance threshold, three of which intersect at zero metres, for zones that are plainly different work zones. One is a 4.8 km ramp closure lying inside a 33 km pavement corridor. Symmetric length coverage scores those pairs between 0.039 and 0.075 against a 0.6 threshold and rejects all four, where minimum distance alone would have merged them. CivicLink against Missouri DOT has overlapping bounding boxes and yields zero candidate pairs. Both run as tests, against real data, offline.
The number I did not round
A post arguing that absence must never be recorded as a pass should not round its own downtime to zero.
The fleet has polled since 2026-08-14. It was also down from 2026-08-20 20:03 UTC until 2026-08-22 21:10 UTC, roughly 49 hours, because the canonical source map had grown to 303,962 documents and reading it whole at startup was a single unbounded Firestore query. Once the collection crossed some size the query began timing out, the client library’s retry path raised an AttributeError instead of retrying, and a recoverable timeout became a fatal crash inside startup before the first poll. The runner crash-looped 2,468 times over two days. Reading the collection in 2,000 document pages returns all 303,962 in 81 seconds.
That bug only showed up because the thing had been running for weeks. It was in no test, and no demo would have found it.
As of 2026-08-23 the fleet had recorded 8,254 observations across 389 cycles, with the outage sitting visibly in that history. Utah DOT is still quarantined on R2 and R4, which is where this started.
The console is live and read-only with any Google account, and scheduled polling is paused while judging runs, which the masthead says. Everything else reproduces offline from a checksummed snapshot of the live feeds, 473 tests, no cloud account, in three commands.
Validation tells you a document is well formed. It cannot tell you the document is true, and in any supply chain where you consume from sources you cannot compel, the second question is the only one that was ever load-bearing. Somebody has to ask it on every cycle, deterministically, and write down what they found.
