AquaLens

Satellite water-quality screening for any lake, run by GitLab Duo agents that cannot ship a science change until it passes physics checks on real scenes and lab truth, with a person's go-ahead.

Comment

Inspiration

In May 2026 AquaLens's tests were green while every water-risk score it had published since 2022 was wrong: ESA had added 1,000 to every Sentinel-2 value, and nothing in the pipeline looked at the real world. We found it in October, when Earth Truth ran the production science on real scenes for the first time (17 physics violations).

In August 2014 an algae bloom at the Lake Erie intake left more than 400,000 people in Toledo, Ohio, without safe tap water for two days. Lab samples are precise but rare; a satellite passes every lake every few days. In May I built AquaLens: pick a lake, get a plain-language risk level from the newest Sentinel-2 image. It worked, but every step after the code was manual: no review, no checks that the science was still right, no security scanning, a free host that slept, and nobody noticed when an upstream data change silently moved every score.

For a public-health tool, "the code merged" is not the finish line. The finish line is: the number a water manager reads is still right, and a person approved every change that could move it.

What it does

The product. Search any lake or tap it on the map; AquaLens traces its outline from JRC Global Surface Water, finds the newest clear Sentinel-2 image and returns in about half a minute: Low, Medium or High on the WHO algae alert levels, what it means for swimming, pets, fishing and drinking water, how sure it is, a map of where the algae is, rain and water temperature around the image, 12 months from space, a PDF report, and the carbon, energy and water that answer cost.

Why a utility would use it. A water team cannot sample every station every day. On 28 NOAA survey days in western Lake Erie, the station AquaLens scored highest was the lab's worst on 55 % of days (95 % CI 37–73 %), against 16 % for a random pick; catching the worst station on 8 days in 10 takes 2 lab samples a day in AquaLens's order instead of 6 (about US$544 saved a survey day at an ELISA test's price). Out of sample (GLORIA, 40 days) it is weaker, 35 % against 21 %, and we say so.

The lifecycle around it, on GitLab. Ten Duo flows and two custom agents cover every stage of the DevSecOps lifecycle, and each one stops for a person's go-ahead (Assisted):

  • Plan: Upstream Watch reads the provider's live scenes daily against a written data contract and files evidence with pictures; Upstream Analyst classifies it.
  • Create: Science Triage diagnoses an issue; Science Fix Proposal writes the exact diff; Science Fix commits it to a draft merge request, only after the person assigns it.
  • Verify: tests, Earth Truth (the production science on 20 real reference scenes, with physics checks that must hold), NOAA lab truth (213 samples from western Lake Erie) and GLORIA lab truth worldwide; the Drift Explainer posts what the change does to public scores before merge.
  • Secure: SAST, secret detection, dependency and container scanning, a licence gate; Security Watch files open findings as one issue and Security Triage says what is exploitable and proposes the fix or a recorded decision.
  • Package and Release: images by commit, SBOMs, an evidence bundle; Release Scribe writes the notes and opens the release merge request; an approval ledger checks every agent commit against the go-ahead that started it.
  • Configure, Deploy, Monitor: the deployment is code, deployed by a manual job that waits for both hosts to serve the exact commit and then runs the production checks (health, Earth Truth on the deployed build, model availability); a daily check opens an incident when production drifts.
  • Govern: a go-ahead guard on every merge request pipeline matches each agent commit to the person who approved it (every one of the recent merge request pipelines: 21 of 21 on 27 Oct); when the science changes, Restatement Writer republishes the public scores that moved, with the reason.

How we built it

FastAPI and PostGIS behind a Next.js app; Sentinel-2 L2A from Microsoft Planetary Computer, read as windows of cloud-optimised GeoTIFFs; a deterministic score on the WHO chlorophyll levels; Gemini writes the explanation and never changes the number. On GitLab: 10 Duo flows and 2 agents in the repository, a CI file of 49 jobs (each pipeline runs only those whose inputs changed), Eco CI on every measured job, and more than 200 merged merge requests since the hackathon began.

Challenges we ran into

  • The data moved under us. Microsoft's Planetary Computer stopped marking empty pixels in its Sentinel-2 files from April 2026. The provider contract caught it on its first scheduled run; we reported it with a reproduction (microsoft/PlanetaryComputer#513), and AquaLens masks empty pixels itself, so no score moved. Pointed at another project, the same checks found that Microsoft's Planetary Explorer reads every Sentinel-2 band 0.100 too bright on the newest processing baseline (9 of 9 readings; evidence issue #16).
  • Agents that are confidently wrong. Every number an agent writes in a note is checked against a record by code (1,000 of 1,176 backed on 27 Oct); the gate is the physics and the lab, not the agent's word.
  • Deploying for free. The service runs on free tiers (Render and Vercel). Testing it live found and fixed a wrong CORS origin, rate limits that counted proxies instead of people, and rounding that put a chlorophyll estimate on the wrong side of a WHO line.

Accomplishments that we're proud of

  • Version 1.1.0 of the science: the risk level now matches the lab's WHO band on 213 NOAA samples 58 % of the time (33 % in the May version), and flags all 3 samples above the EPA microcystin limit.
  • Earth Truth passes on the deployed build: 20 real scenes, 0 physics failures.
  • Sample first where it matters: the top-scored station was the lab's worst on 55 % of NOAA survey days (random: 16 %), 2 samples a day instead of 6 to catch it 8 days in 10.
  • Every public result carries its own SCI receipt; a re-run with nothing new costs 0.016 g CO₂e.
  • Accessibility 100 on every page we measured with Lighthouse.

What we learned

Agentic automation is only as trustworthy as the evidence that gates it. For science software that evidence is real data: scenes, lab samples and restatements in public, not green unit tests alone.

What's next

Utilities' own lab samples beside the satellite (already in the product), keeping the service warm for judges and users, and a pilot with a reservoir operator.

Built With

Share this project:

Updates

Submission history