We shipped the prototype.
Then questioned the model.

I built the hackathon's data-to-investigation loop, then helped turn its weak evaluation into a stricter research question.

Ship
Correlate
Score
Stress test
Explain
Bound

Engineering evidence

Evidence receiptStress test

BASELINERandom rows
TIMEChronological
SENSORNew detector
ORGNew organization

Results held until artifacts are mapped

Draft research methodOpen team repository

Swipe through the evidence04 / 06

Four contributors connected data, scoring, explanations, and a working dashboard during the hackathon.
TEAMFour contributors
DEMOWorking dashboard
AWARD2nd Place
Four contributorsEnd-to-end demo2nd Place
Keep the pipeline runnable and the analyst loop reviewable while four workstreams converged.
Open public team repository
Hackathon prototype
The public prototype grouped nearby rows; the research design replaces that batch shortcut with bounded, past-only state.
TOKENSEntity + context
STATEActive stories
BOUNDSExpiry + suppression
Past onlyExpiryMega-node control
Cap candidate expansion, expire stale state, and keep incident IDs out of deployable features.
Draft research design
Not in the public prototype
A tree model ranks the queue; the interface keeps its grade, confidence, and local drivers visible.
POLICYAllow / block fields
MODELIncident grade
QUEUEPriority + drivers
Feature policyTree modelVisible drivers
Put a leakage boundary before scoring and reserve explanation work for the cases an analyst opens.
Open public scoring source
Prototype metric is exploratory
The research plan tests the same estimator across time, detector, and organization boundaries.
BASELINERandom rows
TIMEChronological
SENSORNew detector
ORGNew organization
Random baselineFuture windowHeld-out environments
Choose the deployment-shaped split first; let that boundary decide how broad the eventual claim may be.
Draft research method
Results held until artifacts are mapped
The research design tests whether SHAP drivers stay stable and actually affect the fitted model.
STABILITYCompare driver ranks
DELETERemove top drivers
KEEPRetain top drivers
StabilityDeletionSufficiency
Run all three checks, then label the result correctly: model faithfulness, not attacker causality.
Draft research method
Results held until artifacts are mapped
A local LLM receives a selected evidence packet only after deterministic triage.
PACKETPrediction + SHAP + story
LOCALSelected cases only
CHECKSchema + claim IDs
Allowed IDsJSON schemaFail closed
Keep prediction, drivers, and story facts fixed; reject rationales that cite anything outside the packet.
Draft research design
No analyst-outcome claim

System viewThe evaluation boundary is chosen before the metricThe draft research plan keeps one model family fixed while changing only what the test set is allowed to share with training.

We shipped the prototype.Then questioned the model.

We shipped the prototype.
Then questioned the model.