senih25 · senih25 · Jun 30, 2026 · Jun 20, 2026
diff --git a/docs/modules/module-21-kaggle-vibe-coding/COURSE_COMPLETION_RECORD.md b/docs/modules/module-21-kaggle-vibe-coding/COURSE_COMPLETION_RECORD.md
@@ -0,0 +1,63 @@
+# Kaggle Five-Day Course Completion Record
+
+## Source
+
+On 2026-06-20, the learner supplied the official Kaggle course completion email
+for "5-Day AI Agents: Intensive Vibe Coding Course With Google." The email says
+the five-day course has concluded and introduces a separate capstone process.
+
+## Day-by-Day Status
+
+| Day | Course outcome | Repository evidence | Status |
+|---|---|---|---|
+| 1 | Vibe coding, AI Studio, Cloud Run concepts | `DAY_1_PLAN.md`, `DAY_1_EVIDENCE.md` | Local/docs complete; cloud deploy deferred |
+| 2 | Tools, MCP, interoperability | `DAY_2_EVIDENCE.md`, local mock workbench | Complete locally |
+| 3 | Skills, Agents CLI, ADK workflows | `DAY_3_EVIDENCE.md`, customer-support agent | Complete locally |
+| 4 | Security, evaluation, expense approval HITL | `DAY_4_SECURITY_AND_HITL_EVIDENCE.md`, two local test suites | Complete locally |
+| 5 | Spec-driven production development | `DAY_5_PRODUCTION_GRADE_PLAN.md` | Required concepts mapped; optional cloud labs deferred |
+
+## Day 5 Comparison
+
+The repository already captured the Unit 5 requirements accurately:
+
+- behavior-first specifications and Gherkin examples
+- zero-trust pipeline and review controls
+- optional Cloud Run deployment
+- optional frontend-to-cloud-agent integration
+
+The course email explicitly labels both Day 5 codelabs as optional and notes
+that they may require a billing account. Deferring them behind the existing
+Stage 3 manual review gate is therefore course-compatible and repo-compliant.
+
+## Closing Email Follow-Ups
+
+| Item | Current decision |
+|---|---|
+| Antigravity quota reset | Informational; no repository action required |
+| Capstone project | Not submitted; track as a separate future project |
+| Kaggle badge and certificate | Not claimed; eligibility requires capstone participation |
+| Badge/certificate delivery | Email states eligible profiles are updated by the end of July 2026 |
+| Kaggle Learn guide | Await publication; update references only when available |
+| Feedback form | Optional learner action; no repository evidence needed |
+
+## Completion Decision
+
+The five-day curriculum is closed in this repository as a **local-first,
+evidence-backed learning milestone**.
+
+This decision does not claim:
+
+- completion of optional paid cloud labs
+- capstone submission or ranking
+- Kaggle badge or certificate eligibility
+- production deployment
+
+Module 21 remains `Needs manual review` in `MODULE_INDEX.md` because live Cloud
+Run, AI Studio, Secret Manager, public endpoint, and billing work are still
+gated. Course completion and cloud deployment approval are separate states.
+
+## Learner-Attested Activities
+
+Podcast listening, whitepaper reading, livestream attendance, Discord activity,
+and feedback submission are not machine-verifiable from this repository. They
+should be marked complete only by the learner, not inferred by an AI agent.
diff --git a/docs/modules/module-21-kaggle-vibe-coding/DAY_4_SECURITY_AND_HITL_EVIDENCE.md b/docs/modules/module-21-kaggle-vibe-coding/DAY_4_SECURITY_AND_HITL_EVIDENCE.md
@@ -0,0 +1,77 @@
+# Day 4 Security and Human-in-the-Loop Evidence
+
+## Assignment Mapping
+
+Kaggle Unit 4 requires:
+
+- security and evaluation concepts
+- a synthetic expense-approval agent with human-in-the-loop triage
+- automated threat checks and safety tests
+
+## Implemented Locally
+
+### Expense Approval Workflow
+
+Location:
+
+`experiments/module-21-kaggle-vibe-coding/expense-approval-agent/`
+
+The project was created with Agents CLI `0.5.0` as a prototype with deployment
+target `none`. Its ADK workflow is deterministic:
+
+- amount at or below `100.00`: automatic approval
+- amount above `100.00`: ADK `RequestInput` interrupt
+- resume input `approve`: approved result
+- resume input `reject`: rejected result
+- any other response: human review remains required
+
+The workflow uses only synthetic categories and descriptions. It makes no LLM,
+API, network, or cloud call.
+
+### Security Guardrails
+
+The existing Day 3 customer-support workflow was extended during Day 4 with:
+
+- PHI-like term detection
+- prompt-injection pattern detection
+- an unsafe route that prevents normal agent processing
+- explicit policy violation output
+
+## Local Evaluation
+
+Commands:
+
+```powershell
+cd experiments\module-21-kaggle-vibe-coding\expense-approval-agent
+uv sync
+uv run pytest tests/unit/test_expense_workflow.py -q
+
+cd ..\customer-support-agent
+uv run pytest tests/unit/test_security_guardrails.py -q
+```
+
+Observed results on 2026-06-20:
+
+- expense approval HITL tests: `6 passed`
+- customer support security guardrail tests: `4 passed`
+
+Warnings were limited to ADK deprecation and experimental resumability notices.
+No test failure occurred.
+
+## Evidence Limits
+
+- Podcast listening and whitepaper reading are learner activities and cannot be
+  proven by repository automation.
+- The repository records the supplied assignment content and its implementation
+  mapping; it does not fabricate completion telemetry.
+- No managed Agent Platform evaluation was run because that would require cloud
+  authentication and could create billing impact.
+
+## Safety Boundary
+
+- No PHI or real personal data
+- No e-Nabiz export
+- No secret, token, credential, or `.env`
+- No deploy, IAM, API enablement, or cloud resource
+- No public endpoint
+- Synthetic local inputs only
diff --git a/docs/modules/module-21-kaggle-vibe-coding/MODULE_21_MILESTONE_CLOSURE.md b/docs/modules/module-21-kaggle-vibe-coding/MODULE_21_MILESTONE_CLOSURE.md
@@ -1,57 +1,55 @@
-# Module 21 Milestone Closure — Kaggle Vibe Coding Course
-
-## Module Metadata
-
-- **Module**: 21 — Kaggle AI Agents Vibe Coding
-- **Date**: 2026-06-17
-- **Final Status**: **CLOSED (Local-First Verified)**
-- **Target Environment**: Local (MOCK_MODE=true) + Antigravity CLI + ADK
-- **Cloud Cost Incurred**: $0.00 (Zero cloud resources provisioned)
-
----
-
-## 1. Executive Summary
-
-This document marks the official, local-first completion of Module 21 (Kaggle 5-Day AI Agents Intensive Course). In compliance with the project's safety boundary (`SAFETY_BOUNDARY.md`) and resource limits, all codelab assignments, agent builds, and tool integrations were successfully simulated, scaffolded, implemented, and verified in a secure local environment. 
-
-By executing the entire workflow locally, we avoided all risks associated with cloud budget overruns, raw API key exposure, and unverified runtime integrations, while delivering a fully functional prototype ready for staging.
-
----
-
-## 2. Completed Deliverables & Evidence
-
-Across the course curriculum, the following outcomes were produced and verified:
-
-| Deliverable / Day | Scope | Verification Evidence |
-|---|---|---|
-| **Day 1: Intro & Vibe Coding** | Course mapping, environment setup, and mock local server scaffolding. | [DAY_1_EVIDENCE.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DAY_1_EVIDENCE.md)<br>[DEVTOOLS_CHECKLIST_DAY1.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DEVTOOLS_CHECKLIST_DAY1.md) |
-| **Day 2: Agent Tools & APIs** | MCP server configuration and Google Developer Knowledge search documentation integration. | [DAY_2_EVIDENCE.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DAY_2_EVIDENCE.md)<br>[DEVTOOLS_CHECKLIST_DAY2.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DEVTOOLS_CHECKLIST_DAY2.md) |
-| **Day 3: Agent Skills & Graph** | Scaffolding, implementation, and playground testing of `customer-support-agent` graph. | [DAY_3_EVIDENCE.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DAY_3_EVIDENCE.md)<br>[DEVTOOLS_CHECKLIST_DAY3.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/DEVTOOLS_CHECKLIST_DAY3.md) |
-| **Official Citation** | Integrated Kaggle intensive course citation in module documentation. | [README.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/README.md) |
-| **Manual Review Gate** | Established compliance guidelines and checklists for future Cloud Run migrations. | [MODULE_21_STAGE_3_MANUAL_REVIEW_GATE.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/MODULE_21_STAGE_3_MANUAL_REVIEW_GATE.md) |
-
----
-
-## 3. Key Technical Achievements
-
-* **ADK 2.2.0 Compatibility Resolution**: Adapted the customer support agent imports and edge declaration logic to align with ADK 2.2.0 package structures, eliminating deprecated `Edge.chain` methods.
-* **Event Value Propagation Fix**: Resolved a state passing bug by changing `Event` constructor parameters from `data` (unrecognized/ignored by the Pydantic validator) to `output`. This allowed user query payloads to correctly propagate through the workflow graph and feed the downstream LLM agents.
-* **Interactive Playground Validation**: Started the ADK Dev Server (`adk web`) locally to test the compiled graph, verifying that queries route correctly to `shipping_faq` or `handle_unrelated` based on dynamic classifications.
-
----
-
-## 4. Safety & Boundary Confirmation
-
-In strict adherence to `SAFETY_BOUNDARY.md` and `AGENTS.md` guidelines:
-* **No Secret Leaks**: Checked and confirmed that no active Google Cloud credentials, API keys, or `.env` files were tracked or committed.
-* **No PHI**: Confirming zero patient data or e-Nabız medical exports were accessed, requested, or stored.
-* **Working Tree Hygiene**: Removed all `.venv`, `.ruff_cache`, and `__pycache__` artifacts from the source directories before commit.
-
----
-
-## 5. Transition Path to Stage 3 (Cloud Run)
-
-If a decision is ever made to transition this module to a live GCP environment, the following gate constraints must be met:
-1. Complete all checkmarks in [MODULE_21_STAGE_3_MANUAL_REVIEW_GATE.md](file:///C:/Users/YeniKullanici/chrome-devtools-cloud-migration-lab/docs/modules/module-21-kaggle-vibe-coding/MODULE_21_STAGE_3_MANUAL_REVIEW_GATE.md).
-2. Configure a restricted Google Cloud API key with access limited *only* to the `Developer Knowledge API` and `Semantic Search API`.
-3. Provision GCP Secret Manager to inject the API key as an environment variable in the Cloud Run service container, preventing local key persistence.
+# Module 21 Milestone Closure
+
+## Final Status
+
+- Curriculum status: `CLOSED - LOCAL-FIRST VERIFIED`
+- Cloud deployment status: `DEFERRED - MANUAL REVIEW REQUIRED`
+- Capstone status: `NOT SUBMITTED`
+- Badge/certificate status: `NOT CLAIMED`
+- Closure date: 2026-06-20
+
+## Verified Outcomes
+
+- Day 1 concepts and Cloud Run architecture mapped without deployment.
+- Day 2 MCP and tool interoperability documented and tested locally.
+- Day 3 Agents CLI and ADK customer-support workflow implemented locally.
+- Day 4 security guardrails and deterministic expense-approval HITL workflow
+  implemented and tested locally.
+- Day 5 spec-driven production controls mapped to repository guardrails.
+- Optional Cloud Run and live frontend integration intentionally deferred.
+
+## Evidence Index
+
+- [Day 1 plan](DAY_1_PLAN.md)
+- [Day 1 evidence](DAY_1_EVIDENCE.md)
+- [Day 2 evidence](DAY_2_EVIDENCE.md)
+- [Day 3 evidence](DAY_3_EVIDENCE.md)
+- [Day 4 security and HITL evidence](DAY_4_SECURITY_AND_HITL_EVIDENCE.md)
+- [Day 5 production-grade plan](DAY_5_PRODUCTION_GRADE_PLAN.md)
+- [Five-day completion record](COURSE_COMPLETION_RECORD.md)
+- [Stage 3 manual review gate](MODULE_21_STAGE_3_MANUAL_REVIEW_GATE.md)
+- [Safety boundary](SAFETY_BOUNDARY.md)
+
+## Validation Summary
+
+```text
+expense-approval-agent: 6 passed
+customer-support-agent security guardrails: 4 passed
+cloud resources provisioned: 0
+public endpoints created: 0
+secrets committed: 0
+```
+
+## Safety Confirmation
+
+- No PHI, health records, e-Nabiz exports, or personal expense data
+- No API keys, credentials, tokens, `.env`, or service-account files
+- No Cloud Run deploy, API enablement, IAM change, or Secret Manager operation
+- No public endpoint or billing-impacting configuration
+- All examples are synthetic and public-safe
+
+## Follow-Up Boundary
+
+The capstone is a separate future milestone. It requires the official submission
+rules before implementation. No badge, certificate, prize, ranking, or Kaggle
+submission claim may be added until externally verified.
diff --git a/docs/modules/module-21-kaggle-vibe-coding/README.md b/docs/modules/module-21-kaggle-vibe-coding/README.md
@@ -6,6 +6,10 @@ This module maps the Kaggle "5-Day AI Agents: Intensive Vibe Coding Course With
 
 Needs manual review
 
+The five-day curriculum is complete as a local-first learning milestone. Live
+cloud work remains gated, and the separate capstone has not been submitted. See
+`COURSE_COMPLETION_RECORD.md` for the exact completion boundary.
+
 This module includes Cloud Run, AI Studio, and API key handling decisions. Per repository guardrails, anything involving deployment, public endpoints, or secret management must remain gated until manual review is complete.
 
 ## Source Basis
@@ -115,6 +119,13 @@ Explicitly excluded until manual review:
 4. Keep Day 4 local quality/evaluation work inside mock and guardrail boundaries.
 5. Keep Day 5 production/deploy behavior documentation-only until manual review.
 
+## Final Course Records
+
+- `DAY_4_SECURITY_AND_HITL_EVIDENCE.md`
+- `DAY_5_PRODUCTION_GRADE_PLAN.md`
+- `COURSE_COMPLETION_RECORD.md`
+- `MODULE_21_MILESTONE_CLOSURE.md`
+
 ## Expected Portfolio Outcome
 
 A safe, reproducible, and repo-compliant Kaggle AI Agents module that demonstrates:

diff --git a/...riments/module-21-kaggle-vibe-coding/expense-approval-agent/.agents-cli-spec.md b/...riments/module-21-kaggle-vibe-coding/expense-approval-agent/.agents-cli-spec.md
@@ -0,0 +1,36 @@
+# Expense Approval Agent Spec
+
+## Overview
+
+Create a deterministic, local-only ADK workflow for Kaggle Day 4. Small
+synthetic expenses are automatically approved; larger requests pause for an
+explicit human decision.
+
+## Example Use Cases
+
+- A synthetic 75-unit supplies request is approved automatically.
+- A synthetic 750-unit training request requires human review.
+- A reviewer can resume the request with `approve` or `reject`.
+
+## Tools Required
+
+No external tools, APIs, credentials, or data sources.
+
+## Constraints and Safety Rules
+
+- Local prototype only; no deployment target.
+- Synthetic business expenses only.
+- No PHI, personal data, secrets, `.env`, or public endpoint.
+- Human review cannot be bypassed above the fixed threshold.
+- Decisions and tests must remain deterministic.
+
+## Success Criteria
+
+- The project is recognized by Agents CLI.
+- ADK compiles the workflow as a resumable app.
+- Local tests prove automatic approval and both human decision outcomes.
+- No cloud or LLM call is required for validation.
+
+## Reference Pattern
+
+ADK Workflow human-in-the-loop using `RequestInput` and resume inputs.