Cloud Run (asia-southeast1) • Version 1.1.0 • Secret Manager Bound

Real-time triage and grounded AI recovery for developer workshops.

Captures terminal stalls on-device, extracts cited Gemini root causes, clusters identical room failures, and unblocks engineers in seconds.

Facilitator DemoParticipant Demo

Have your event code ready. Facilitator permissions are granted by the event operator.

Zero Plaintext Secrets
1-Hour Raw Evidence TTL
Consolidated Cloud Run
Google Cloud Infrastructure

Engineered on the Google Cloud Platform ecosystem

We run Syzyra on Google Cloud Platform to isolate attendee data, prevent plaintext secret leaks, and eliminate cold starts.

Serverless Compute & Execution

2 services
Cloud RunWeb & Consolidated API
2nd Gen serverless containers in asia-southeast1
Cloud FunctionsEventarc Worker Compute
Firestore document lifecycle triggers, 2nd Gen

Intelligence & State Store

2 services
Cloud FirestoreReal-Time Vector & State Store
Subcollections, compound indexes, real-time sync
Google Gemini 2.5Grounded AI Inference
Strict line evidence citations, structured JSON

Ephemeral Storage & Secrets

2 services
Secret ManagerZero-Plaintext Vault
Hardware-bound IAM permissions, runtime mounts
Cloud StoragePrivate Evidence Store
Automated 1-hour lifecycle TTL, client signed URLs

Identity, Automation & DevOps

6 services
Cloud SchedulerEphemeral Data Sweeper
Deterministic 1-min cron sweeps, automated eviction
Firebase AuthGoogle Identity & Claims
Passwordless Google OAuth, custom admin claims
Cloud EventarcEvent-Driven Routing
Cross-service audit and analysis pipeline triggers
Cloud BuildAutomated Container Pipeline
Docker caching, zero-downtime blue-green rollouts
Artifact RegistryPrivate OCI Image Store
Vulnerability scanning, regional image caching
Cloud LoggingAudit & Observability
Structured JSON telemetry, real-time alert filters

Four stages from terminal stall to room recovery

Syzyra replaces informal chat screenshots and stalled lab sessions with structured error intake, grounded Gemini citations, room cluster triage, and verified health checks.

IntakeStage 01 of 04

Private capture and local redaction

Zero remote transmission without explicit consent

Attendees capture terminal output, stack traces, and command errors directly in browser memory. Evidence stays on-device until the attendee grants consent.

Technical Guarantees:
  • Browser IndexedDB holds diagnostic logs on-device
  • Canvas pixel redaction masks tokens, passwords, and file paths locally
  • The browser blocks all outbound network requests until Consent A is granted
STAGE 1 INTAKE PIPELINE (BROWSER MEMORY)LIVE STATE
14:02:11 [client:buffer] Storing 4,120 bytes in browser IndexedDB
14:02:11 [redactor] Scanned 12 lines for high-entropy tokens
14:02:11 [redactor] Masked: JWT_SECRET=[REDACTED ON-DEVICE]
14:02:12 [state] Status: LOCAL_STAGED (0 bytes sent to network)

Built for the human realities of live developer workshops

Technical workshops break in predictable ways: attendees stay silent when stuck, instructors spend the lab debugging identical laptops, and generic chatbots hallucinate outdated flags.

Attendee Dignity

Eliminating the Hand-Raising Friction

When developers hit errors, they often stay silent rather than exposing confusion to the entire room. Private on-device capture lets attendees troubleshoot errors without broadcasting them to peers.

BeforeStuck in silence, falling behind the instructor's pace
SyzyraLocal IndexedDB capture, instant private triage without exposure
Instructor Scale

Breaking the Mentor Bottleneck

Two instructors cannot debug 40 laptops individually. When a setup script fails, 8 attendees hit the exact same error. Cosine vector clustering groups them into one incident card for a single broadcast fix.

BeforeWalking to 8 different desks explaining the exact same PATH fix
SyzyraSingle broadcast action unblocks all 8 participants at once
Grounded Trust

Preventing Hallucination Damage

Generic AI chatbots invent deprecated flags that break student environments. Syzyra enforces exact line citations from logs and requires deterministic health check receipts before closing tickets.

BeforeCopying unverified forum advice that worsens system configuration
SyzyraLine-cited Gemini diagnosis backed by HTTP 200 verification receipt

"We cut 40 minutes of environment triage per session. Instructors spend their workshop energy teaching distributed systems instead of debugging Node versions on individual machines."

Workshop Operations LeadCloud Native Engineering Labs

Calculate your workshop time savings

Calculate how on-device redaction, grounded Gemini citations, and cluster broadcasts save instructor hours in your workshops.

Session Parameters

30 developers
1050100
4 sessions
1612
Hours Recovered
16.8hrs

Instructor time saved by avoiding repetitive desk-to-desk debugging for identical setup errors.

Cluster Multiplier
46stalls

Individual student stalls collapsed into single broadcast resolutions via cosine vector similarity.

Completion Rate
94%+26%

Projected lab completion rate, eliminating early dropouts caused by local dependency mismatches.

Trusted by developer educators and platform architects

How platform engineers, foundation instructors, and enterprise workshop leads run unblocked labs with Syzyra.

"Instead of walking desk to desk debugging Docker sockets for 45 minutes, Syzyra grouped 11 identical failures and let us broadcast the verified fix to the room in seconds."

DV
DevOps Workshop LeadCloud Native Community Foundation

"On-device redaction convinced our corporate security team to approve live workshops on employee laptops. No API key or authentication token ever leaves browser memory."

PA
Principal Developer AdvocateGlobal Cloud Platform Team

"Attendees who previously froze in silence when their environment broke now recover in under a minute without raising their hands in front of 50 colleagues."

TD
Technical Training DirectorOpen Source Systems Institute

Strict isolation and three-tier consent governance

Participants choose what data processes and what stays local. Raw terminal logs never reach other attendees or unverified screens.

Granular Invariants

3-Tier Consent Controls

Consent A enables private on-device analysis. Consent B allows matching against similar room issues. Consent C enables peer assistance pairings. Attendees grant or revoke each level independently.

Zero Data Retention

Automated Ephemeral TTL

Raw uploaded evidence expires 1 hour after submission. All workshop records purge 24 hours after an event ends. Cloud Scheduler cron sweeps delete orphaned data every 60 seconds.

0mEncrypted ingest
60mRaw evidence purged
24hEvent records deleted
Zero-Trust Architecture

Air-Gapped Raw Diagnostics & Secret Isolation

Participants and facilitators never see raw terminal logs or screenshots from other desks. Only anonymized problem signatures reach the facilitator triage queue.

On-Device Redaction

API keys, OAuth tokens, and local paths are masked on-device before leaving browser memory.

Zero Model Training

Google Cloud Enterprise terms guarantee that Gemini never trains on customer diagnostic logs or code snippets.

Hardware-Bound Vault

The application retrieves all runtime credentials from Google Cloud Secret Manager using IAM service accounts.

Explore both workshop roles without signing in

Test the real interfaces with simulated workshop data. Zero network calls, zero data persistence, and instant role toggling.

For instructors, organizers & leadsIn-Memory

Facilitator Command Center

Test the triage command center: inspect grouped participant requests, review line-cited fixes, broadcast guidance to the room, and monitor recovery receipts.

Room attention cluster triage
Single-click intervention broadcast
Split group management & room dashboards
Runs entirely offline in browser memory
Launch Facilitator Demo
For developers, attendees & studentsIn-Memory

Participant Workshop Workspace

Walk through the attendee workflow: capture terminal logs, redact sensitive tokens on-device, inspect grounded Gemini diagnoses, adjust consent levels, and run health check verifications.

On-device sensitive data redaction tool
Grounded proposal inspection with cited lines
Interactive Consent A, B, and C switches
Simulated HTTP 200 health check verification
Launch Participant Demo
Google Cloud Serverless ArchitectureSingle Warm Container • asia-southeast1

Engineered on Google Cloud Run 2nd Generation

Consolidates serverless compute into a single warm container. Eliminates cold-start cascades, binds secrets to hardware HSMs, and purges ephemeral diagnostic data automatically.

LIVE PRODUCTION DATA PATH // ASIA-SOUTHEAST1
TLS 1.3 · AES-256P95 < 450ms Warm SLA
STREAM:ACTIVE (TLS 1.3)
INGRESS:0 B Plaintext Leak
CONTAINER:Cloud Run Gen 2 (P95 < 450ms)
SWEEPER:60m TTL Hard Purge
PLANE 01Zero Network Leak

Client Edge & Local Ingest

Client Tier

Runs inside attendee browser memory. Masks auth tokens, file paths, and environment variables on-device with canvas pixel redaction before any byte touches TLS.

Latency / SLA0ms client latency
Click to inspect
PLANE 02Warm Container

Serverless Compute Core

Compute Tier

Unifies the Next.js 15.5 application and callable API into a single warm container. Eliminates cold-start cascades across separate microservices during 50-person workshops.

Latency / SLA< 450ms warm P95
Click to inspect
PLANE 03Hardware HSM

Grounded AI & Secret Boundary

AI & Security

Extracts root causes using direct line-level evidence citations. Suppresses unverified proposals instead of generating hallucinations. Secret Manager isolates API keys from source code.

Latency / SLAZero training on data
Click to inspect
PLANE 04Automated 1h TTL

Ephemeral State & Sweeper

Data & Storage

Tracks attendee presence and cosine vector clusters in Firestore. Cloud Scheduler runs 1-minute cron jobs to delete raw evidence blobs after 60 minutes.

Latency / SLA60-min hard TTL
Click to inspect
LAYER 02 SPECIFICATION

Serverless Compute Core

roles/run.invokerWarm Container
Verified Architecture Invariant
Single consolidated warm container eliminates multi-service cold-start cascade.
Cloud Run & GCP Command Receipt
gcloud run deploy syzyra --region asia-southeast1 --execution-environment gen2
ARCHITECTURE DECISION RECORD // ADR-014
Verified Architecture Pattern
Adopted in Production
-68%Cloud Cost
0msCold Start Spikes
1Warm Container
15Microservices Deleted

"Why we deleted 15 microservices: Running separate serverless functions for triage, vector embeddings, redaction, and notifications caused cold-start spikes during 50-person workshops. Consolidating the Next.js application and API into a single warm Cloud Run container dropped cold starts to zero, removed inter-service network hops, and reduced infrastructure costs by 68%."

KP
Karan P.Platform & Infrastructure Lead • Verified GCP Architect
syzyra-00053-8mz • asia-southeast1

Technical clarity for organizers and engineers

Answers to common architecture, privacy, operational, and data governance questions.

Are participant API keys or local passwords ever sent to the server?

No. Attendees redact tokens, passwords, and paths directly in browser memory using canvas redaction before sending any data. On the backend, server filters strip remaining credentials before storing diagnostics.

Does the AI model train on code or workshop errors?

No. Syzyra queries Gemini through the Google Cloud enterprise API, which excludes customer data from model training. Diagnostic logs serve only to extract immediate root causes and purge according to the 1-hour retention schedule.

How does attention clustering prevent repetitive questions?

When participants enable Consent B, Syzyra converts approved error summaries into vector embeddings. When multiple attendees hit the same failure (such as a missing environment variable or port bind error), Syzyra groups them into a single incident card on the facilitator dashboard. One broadcast unblocks the entire group.

How do instructors receive facilitator permissions?

Participants join using the shared event code. Facilitator access requires an explicit operator grant or the platform operator claim (`syzyraOperator: true`) set via Firebase Admin Auth. Attendees cannot escalate their own permissions.

What happens when a workshop concludes?

When the operator closes an event, workshop membership locks. Cloud Storage immediately purges raw evidence files, and the system deletes remaining event metadata after 24 hours. Attendees can export their diagnostic logs as JSON before the event ends.

Can Syzyra run in an offline classroom or private network?

Yes. The Facilitator and Participant demos run completely offline in the browser without network dependencies. For enterprise air-gapped classrooms, the backend connects to local Firebase emulators and mock inference adapters.

Ready to run an unblocked technical workshop?

Sign in with Google to enter your active workshop, or test the interactive demos directly in your browser.