The trial is running. Is the ground still the ground you designed on?
A prediction made at design time assumes the population, the endpoint and the sites hold still. They do not. Sentinel watches a running trial for drift — a shift in the inputs, the prediction distribution, or the calibration — and closes the loop: recalibrate when it can, pause serving when it must, and sign every step into an append-only ledger. Scrub the 14 weeks below and watch all four panels move together.
Pre-deployment · not for clinical useSynthetic · illustrative — not a real asset, no accuracy claim, no FDA authorization. Every number on this page comes from a hand-authored synthetic time series and is not a Talaria prediction.
Moving the slider drives all four panels to that week's synthetic values.
envelope_max 0.010 · hover a cell for |ΔECE| vs envelope
Current decision: no_action
row_signature verified
cal_version
commit_sha 9471cf1
Append-only Ed25519-signed rows in a SHA-256 hash-chained ledger. Audit-trail architecture designed to meet 21 CFR §11.10 — no FDA clearance exists.
One watch, two escalations
Sentinel runs two independent ladders. Ladder A is the customer alert driven by the 7-day move in predicted failure probability. Ladder B is the drift / calibration state — the star of this page — which drives the closed loop: YELLOW recalibrates softly while serving continues; RED recalibrates hard and pauses inference in under 60 seconds.
A · Customer alert — ΔP over 7 days
- INFO — nominal drift, no customer action ΔP < 0.03
- WARNING — watch the move ΔP ≥ 0.03
- ALERT — material shift ΔP ≥ 0.05
- CRITICAL — large shift, review now ΔP ≥ 0.10
B · Drift / calibration — the closed loop
- GREEN — normal, serving continues severity ≤ 0.5
- YELLOW — soft recalibrate, serving continues 0.5–0.8
- RED — hard recalibrate, serving paused > 0.8
When a recalibration is allowed to promote
Drift detection combines a per-feature KS test (marginal shift), an MMD on the prediction distribution (threshold 0.05), per-Mondrian-cell ECE, a PSI magnitude, and a domain-classifier AUC (threshold 0.7). No single signal decides alone.
Promote only when every cell's |ΔECE| is within envelope — YELLOW ≤ 0.005, RED ≤ 0.010 — and bump the calibration version by a PATCH. Halt when any cell exceeds: record the failed cells, open an incident, mint no new version, mark those cells BLOCKED, and keep RED serving paused until a clean promotion or a manual override. Fail-closed if the coverage_inflation_factor exceeds 2.0.
In this synthetic run, t6 promoted cleanly (cal-v1.4.2 cal-v1.4.3). At t10 the ta_cardiovascular|ph3|genetic_high cell hit |ΔECE| 0.0142 — over the 0.010 envelope — so the run halted, opened INC-SYN-0087, and held serving paused until the manual override at t11 promoted cal-v1.5.0.
The engine that predicts also watches
A prediction that cannot tell you when its own ground has moved is a liability. Sentinel is the watch layer for M01. Talaria is pre-deployment; we are opening a founding cohort ahead of it.
Back to the overview