HauntScope: the alarm, the silence, and the ghost

Bradley Grubbs — Fri, 30 Oct 2026 21:47:39 +0000

By Brad Grubbs.

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine.

What I Built

At 08:01, a learned detector flags a combination of sensor readings that a simple rule passes. At 05:28, the same model stays quiet while temperature reaches 61.749 °C, well outside its training normal. At 06:16, both detectors raise an alarm even though the generator injected nothing.

HauntScope puts those three minutes in front of you. Read the evidence, predict which detector will flag, reveal the answer, and try changing one reading. The point is to discover what an alarm can support before turning it into a story.

The setting is a fictional pump room on the night shift. Four synthetic channels describe its imagined behavior. An open-source Isolation Forest supplies learned scores; a simple baseline asks whether any individual sensor is far enough from its training mean.

This is my interpretation of Ghost in the Machine: an unexplained trace invites a story, and a persuasive detector can become part of that story too. An optional fiction layer uses hand-authored templates, clearly labeled and off by default. Its spooky prose is never a diagnosis or model explanation.

All readings and labels are synthetic. No microphone, machine, customer data, or industrial safety claim is involved.

Demo

Watch the 76-second walkthrough (MP4) · Video repository page

The silent walkthrough records the actual local interface, with captions added below it. It shows the predictions, real re-scoring, reset, failure cases and unchanged comparison.

Run python preview.py from the project directory and open the printed http://127.0.0.1:.../ address. The README explains setup. This local preview serves only named project assets on loopback. Direct file:// launch is not the verified route.

The short investigation has three steps:

Choose a case and inspect its sensor readings before revealing the detector outcomes or injected label.
Choose “Forest only,” “Baseline only,” “Both detectors,” or “Neither detector,” then select “Reveal the evidence.”
In the 08:01 case, test one narrow hypothesis by changing only current and re-scoring the hypothetical row with the frozen model.

Full console view.

The minute where the detectors disagree

At 08:01, vibration is 2.138 mm/s, temperature is 50.365 °C, and acoustic level is 57.987 dB. All three exceed their training means. Current, at 6.043 A, falls below its training mean. None of the four absolute standardized deviations crosses the baseline cutoff of 1.999, so the baseline does not flag the minute.

The forest's score is 0.609, just over its 0.599 cutoff. Revealing the synthetic answer key shows that the generator altered current. This makes a useful teaching case: a combination can look unusual even when no individual reading crosses the marginal rule. It does not establish which feature caused the forest's decision.

Across the entire altered-current window, the forest flags 16 of 30 minutes and the baseline flags one. These are neighboring, correlated minutes from one constructed event—not 30 independent incidents.

Change one reading, keep the model still

The sensitivity experiment asks a smaller question than “what caused the anomaly?”: what happens to these detector scores if current changes while the other three readings stay fixed?

Choose a bounded current value or select “Use reference current.” Neither action changes the forest, training means and standard deviations, or calibrated cutoffs. The app scores a separate hypothetical row through the exported learned trees locally in the browser. The original log, labels, and benchmark stay untouched.

For the reference button, the exporter finds the normal training row closest in standardized vibration, temperature, and acoustic level, excluding current from that match. Training index 89 supplies a reference current of 10.384690 A. Substituting only that value produces:

Reading	Current	Forest score / flag	Baseline score / flag
Original 08:01	6.043 A	0.609 / flagged	1.647 / unflagged
Hypothetical reference current	10.385 A	0.519 / unflagged	1.654 / unflagged

A lower score would establish sensitivity to that input under this fitted model. It would not establish a repaired fault, the correct physical current, or a causal mechanism. Even a value inside a sensor's training range can form an unfamiliar combination with the other readings. The experiment therefore labels edits hypothetical and keeps uncertainty visible.

Resetting to the original reading supplies a no-change control. If the scores or flags do not change meaningfully, the useful outcome is “no decisive change,” not a more elaborate story. For a physical cause, the available evidence remains insufficient: there is no independent load measurement, maintenance record, or reference sensor.

Code

HauntScope source code — MIT licensed

The repository contains the generator, detector, baseline, exported forest, browser scorer, log, tests, and interface. No API key, paid service, language model download, or GPU is required.

How I Built It

The core is scikit-learn's IsolationForest. Its randomized partition trees tend to isolate unusual observations in fewer steps. HauntScope negates score_samples, making larger displayed scores more unusual. These scores are not probabilities of failure, danger, or haunting.

Training uses 2,048 synthetic normal observations. A separate set of 1,024 normal observations establishes each detector's cutoff at its own 98th percentile. The demonstration log contains 720 minutes, including 92 injected-event minutes. Only the four numeric sensor columns enter scoring; the labels are used for evaluation and reveal controls.

The forest has 128 trees and at most 256 training observations per tree. Training, calibration, the demonstration log, and the forest have fixed seeds: 1729, 2718, 31415, and 42. The sensitivity experiment uses the original model configuration, calibration, and evaluation fixture.

Python remains responsible for fitting and exporting the model. The browser's small scorer traverses the exported trees for hypothetical inputs. The original timeline displays the saved Python results. Sensor z-deviations help inspect the readings; they are not formal feature attributions.

Against Python, the JavaScript scorer matched all flags across 2,157 test vectors, including unseen normal data and split-boundary probes. Maximum forest-score error was 1.11 × 10⁻¹⁶; baseline scores matched exactly. That comparison runs in Node, separately from browser interaction checks.

Automated tests cover the numerical pipeline and export. Browser interaction checks are executed separately and saved as a checklist; that receipt is not a shipped executable browser regression suite. The evidence report distinguishes those checks and their limits.

The baseline wins overall

Detector	True alerts	False alerts	Correct normal	Missed labeled minutes	Precision	Recall	F1
IsolationForest	50	8	620	42	86.2%	54.3%	0.667
Maximum absolute z-score	58	6	622	34	90.6%	63.0%	0.744

Both cutoffs produce 21 exceedances among the 1,024 normal calibration observations. On the separate demonstration log, the baseline finds more labeled minutes and raises fewer false alerts. The learned detector contributes an interesting disagreement, but the overall result does not justify preferring it on accuracy.

The other two cases make that limitation concrete. At 05:28, temperature is about 5.82 standard deviations above its training mean. The baseline flags it; the forest's 0.570 score stays below its cutoff. Across that whole heat window, the forest misses all 28 minutes while the baseline detects 23.

At 06:16, temperature is 40.663 °C, about 2.23 standard deviations below the training mean. Both methods flag it, but its generator label is normal. An unusual reading can arise from the normal process. “Insufficient evidence to name a cause” is a legitimate conclusion, including when two detectors agree.

These are controlled synthetic results, not field performance estimates. Training and evaluation share a deliberately simple normal generator, and adjacent samples are correlated. A future evaluation would need separately designed operating regimes and real measurement evidence before making engineering claims.

Why Does Open Innovation Matter?

Openness makes the disagreement inspectable. The data recipe, trained trees, baseline, and thresholds are available together. Exporting the forest enables local what-if inference and creates an obligation to verify agreement with Python.

With the documented dependencies present, rebuilding and previewing use local files and the CPU. There are no API charges or external runtime requests. Readers control the experiment that produced the scores, including its less flattering result.

scikit-learn, NumPy, and SciPy are credited in the versioned license inventory. Codex assisted implementation, tests, interface work, and this article; it is not a runtime dependency. The scenarios, interface, and fictional templates are project-specific work.

The machine room can keep its ghost story. The investigation has to keep its uncertainty.

DEV Community: Bradley Grubbs