Anomaly / complete workflow

How an investigation moves.

Anomaly runs one linear workflow from source registration to reviewed findings. Deterministic code owns acquisition, profiling, detector execution, replay, and report assembly. The agent interprets recorded outputs. The journalist controls both approval gates.

Detector output is recorded as a lead. It can enter findings/findings.json only after replay, independent review, and Gate B approval.

P0

Create, resume, or fork the case.

Anomaly creates the portable case structure and durable workflow state. An existing case requires an explicit choice to resume or fork; report files alone never determine progress.

case.json · .anomaly/state.json

P1

Acquire or register data.

Register journalist-supplied files or use a requested public-source skill. Every source record includes its relative path, hash, format, acquisition time, license, sensitivity, redistribution status, and reacquisition instructions.

data/sources.json

P2

Prepare, contextualize, and profile.

Load supported data into DuckDB, preserve permitted originals, normalize prepared tables, infer field types and semantic roles, and record:

  • row counts, missingness, and cardinality;
  • ranges, distributions, and duplicates;
  • temporal and geographic coverage;
  • ambiguous mappings and transformation notes.
data/prepared/ · data/index.duckdb · instructions/

P3

Recommend compatible detectors.

Remove detectors that cannot run on the available tables, fields, types, or coverage. Score the remaining packages for relevance, fit, utility, cost, and false-positive risk. Recommend no more than ten with their parameters, assumptions, reasons, and failure modes.

detectors/plan.json

Gate A

Journalist decision

Approve the scope and detector plan.

The journalist reviews source coverage, field mappings, detector choices, and parameters. No detector runs until this hash-bound plan is approved.

P4

Run the approved detectors.

Open the prepared DuckDB index read-only with external access disabled. Run only approved detectors within memory, time, thread, and output limits. Record full results, redacted previews, detector snapshots, and provenance.

evidence/signals.jsonl · evidence/runs/ · detectors/used/

P5

Draft proposed findings.

The Anomaly agent reads ranked, redacted signal previews and makes provenance-wrapped, read-only queries when clarification is needed. Each proposal records supporting evidence, calculations, detector hashes, alternatives, limitations, and confidence.

findings/draft.json

P6

Replay calculations and review the draft.

Deterministic replay checks every cited calculation against recorded source, prepared-data, detector, run, and query hashes. A separate read-only reviewer then checks:

  • coverage, freshness, transformations, joins, and field meanings;
  • denominators, baselines, windows, thresholds, and units;
  • multiple comparisons, selection bias, and shared-source dependence;
  • alternative explanations and whether wording exceeds the evidence.
findings/review.json · replay receipt

Gate B

Journalist decision

Accept, revise, or reject reviewed claims.

The journalist decides which claims advance. A review verdict is an input to that decision; the reviewer cannot promote a claim.

P7

Write findings and the report.

Materialize only accepted claims, preserve unresolved questions, generate the report and deterministic charts, and refresh the case README only after every output succeeds.

findings/findings.json · findings/unresolved.md · findings/report.md

Artifact chain

Each decision stays linked to its source.

data/sources.json

Source identity, hash, provenance, licensing, sensitivity, and reacquisition details.

detectors/plan.json

Recommended and approved detectors, mappings, parameters, reasons, and blocked packages.

evidence/signals.jsonl

Canonical detector observations linked to evidence and recorded runs.

findings/draft.json

Proposed claims with calculations, alternatives, limitations, and evidence references.

findings/review.json

Replay status, independent verdicts, unavailable inputs, gaps, and unresolved questions.

findings/findings.json

Only the reviewed claims accepted by the journalist at Gate B.

Remediation

One bounded return, not an endless loop.

If replay or review finds a correctable problem, one remediation pass may return to detector execution or claim drafting. Further cycles require the journalist’s approval. Missing data, detector code, replay evidence, or independent review remains visibly unavailable; Anomaly does not fill the gap.

Back to Anomaly → View on GitHub →