SciGuard Autopilot

Protect the scientific decision, not just the data pipeline. SciGuard detects silent drift, proves exact impact with DataHub lineage, contains selectively, and ships a proof-carrying repair.

Comment

Inspiration

Scientific and ML pipelines break silently. A glass-transition temperature logged in Kelvin instead of Celsius, a molecular weight that flips from g/mol to kg/mol — the numbers stay plausible, nothing errors, and the model keeps ranking candidates on quietly corrupted inputs. Usually nobody can answer the question that actually matters: if this field changed, which downstream decision is now wrong, and who owns it?

That is not a pipeline-failure problem. Every job is green. It is a scientific decision failure — and it is exactly the question a metadata graph should answer.

What it does

In our canonical incident, a firmware update emits 187 mixed-unit rows in batch B042. Every pipeline step passes, yet candidate P-204 jumps from trusted rank 18 to unsafe rank 1 — sending the lab's next weeks of experiments toward the wrong material.

SciGuard runs one continuous loop — SIGNAL, IMPACT, CONTROL, REPAIR, RECOVERY — with DataHub as the context, evidence, and action-state layer.

1. Detect. A lightweight deterministic Sentinel catches the silent unit-contract drift.

2. Prove exact impact. DataHub field-level lineage shows the contaminated temperature field feeding the heat-resistance feature, then the Tg model, then candidate ranking — so that branch is HALTED. Molecular weight follows a separate lineage into the durability model and formulation report, proven clean and ALLOWED to continue. Selective containment, not a platform-wide shutdown.

3. Repair with proof. A Kelvin-to-Celsius normalization patch, plus contract, ranking, and safe-branch tests and a rollback plan — bound to a real public GitHub pull request, 3 of 3 hosted CI checks passing, and the exact head commit ea1a4760520fcb299d8b8f73d955e5c66cc03ee3.

4. Gate recovery on humans. An owner approval gate, exact-revision application to isolated synthetic staging, and two fresh clean recovery runs — with production authorization explicitly recorded as false.

5. Write closure back to DataHub. The incident reaches RESOLVED and a reusable Decision Log is published, proven by a live read-back receipt.

Measured, not asserted. In a 13-scenario gated evaluation, DataHub lineage recovered 3 of 3 exact decision cones at 100% precision, recall, and F1. Search-only context recovered 0 of 3. With no DataHub at all, the agent abstained rather than inventing dependencies. That is the "why DataHub" answer in numbers.

How we built it

  • Deterministic Python core — no LLM in the decision path, so every HALT and ALLOW is reproducible and testable. Pydantic for structured outputs, pytest and a gated evaluation harness to protect the core.
  • DataHub (open-source, Docker quickstart) — schema, unit contracts, ownership, governance, and directed lineage are read through the DataHub MCP Server, with live parity tests comparing those reads against the SDK. Fine-grained field lineage and incident/Decision-Log write-back use a clearly labelled SDK fallback.
  • YAML domain profiles (generic, materials, polymer) — adding a new scientific domain is a config change, not new code.
  • Public judge experience — a React command center streaming a frozen 55-event replay over server-sent events, deployed on Cloudflare Pages, with an Evidence Center exposing every receipt: the DataHub read-back, the evaluation report, and the GitHub pull request and CI bound to the exact commit.
  • An optional bounded narration layer sees only redacted metadata and has no authority over policy, recovery, or DataHub writes.

Challenges we ran into

  • Proving "why DataHub" instead of claiming it. We built a three-arm ablation — full lineage, search-only, and no DataHub — and shipped the harness together with machine-readable results.
  • Selective containment. Stopping one decision path while keeping independent science running requires field-level rather than table-level lineage, plus deterministic per-asset policy.
  • Making an agent trustworthy. Every mutating step needed a receipt: exact commit SHAs, hosted check-run IDs, approval bindings, staging tree digests, and a DataHub read-back that anyone can inspect.

Accomplishments that we're proud of

  • A complete, inspectable evidence chain — pull request, then 3 of 3 CI checks, then the exact commit, then owner approval, then two clean recovery runs, then DataHub RESOLVED — with every link reachable from the public demo.
  • The unsafe ranking is blocked while safe work keeps running. Containment happens at decision granularity.
  • An upstream open-source contribution: a domain-neutral field-impact evidence contract proposed to DataHub's skills repository as Issue 82 and Draft PR 83. Both are open and publicly reviewable; acceptance is not claimed.
  • Honesty as architecture. The public demo deliberately cannot write to GitHub, DataHub, or production, and it says so on screen.

What we learned

Metadata becomes a control boundary the moment it is directed, field-level, and owned. Search can find similar names; only lineage can prove which decision actually consumed a changed value — and which did not. And an agent earns trust not by acting fast, but by leaving receipts.

What's next for SciGuard Autopilot

Practitioner pilots with real lab workflows, more domain profiles such as bio-assay and battery chemistry, production-grade approval identity through SSO/OIDC, and continuing the upstream DataHub contribution.

Verify every claim

All scientific data in this project is deterministic and synthetic. Production authorization is never claimed.

Built With

Share this project:

Updates