# CascadeWatch CascadeWatch is an open-source, raw-data detector for ice-rock avalanches, large landslides, and the flash-flood cascades they can create. It consumes public seismic waveforms and river telemetry; it does not require an operator to hand-enter “signal strength,” “duration,” or a desired result. The first target is the 26 August 2026 Lāngtāng–Lhende Khola disaster in Nepal. Nepal is a held-out test event: no Nepal-event waveform, gauge value, label, or timing is used to fit the classifier. This is actual detection, not pre-event replay. It detects a collapse after the physical process begins and tries to warn downstream locations before the flood wave arrives. It does **not** yet predict that a slope will fail before it starts. ## Verified result The reproducible benchmark currently produces: - first causal station trigger at `2026-08-26T02:52:26.980Z`; - two-station mass-movement watch at `02:55:43.950Z`, after a fixed 180-second feature window; - three-station confirmation at `02:57:21.990Z` using public `NK.KKN`, `IO.EVN`, and `IN.SHL` miniSEED; - held-out Nepal probability `0.728` at watch and `0.737` at confirmation; - 19.3 minutes before ICIMOD's approximately 03:15 UTC first reported basin rise; - 17.6 minutes of lead at the stronger three-station confirmation tier; - two source-side DHM gauges detectably silent by `03:30 UTC`; - Malekhu's raw public record rising 3.82 m in ten minutes at `05:45 UTC`; - 169.2 minutes of seismic lead and 135 minutes of correlated-gauge-outage lead to that downstream rise. The non-Nepal classifier now contains nine public mass-movement events and nine earthquakes. Leave-one-event-out station balanced accuracy is `0.783`; at the two-station event level it is `0.844` with sensitivity `0.889` and specificity `0.800`. The all-trigger audit inspected 3,803 causal triggers across 32 full-day background windows plus the off-target portions of every event window. The confirmation policy rejected 29 candidates through causal precursor evidence, 59 through source-zone arrival order, 37 through source travel-time fit, and one because no operational source zone was declared. Held-out Nepal passes from the complete 22-trigger stream—not a hand-selected replay—with a worst-case arrival score of `+0.5`, 0.260-second RMS source-fit residual, and fitted apparent velocity of 5.8 km/s. Zero false confirmations survived across 649.08 gap-aware off-target three-station network-hours, including zero across 341.01 hours in a 16-day post-selection holdout added only after the parameters were frozen. The 470 positive two-station watches are why that tier is operator-only and never public dispatch. This exposure is still too small for a deployment-rate claim, and every trigger and veto is retained in the machine-readable result. The machine-readable result is [validation/nepal-2026-raw-data.json](validation/nepal-2026-raw-data.json); the concise report is [validation/nepal-2026-raw-data.md](validation/nepal-2026-raw-data.md). ### Historical and external generalization tests The later frozen tests are deliberately less flattering and are retained in full: | Test | Observed result | |---|---| | 0.8 historical Nepal: Seti 2012 / Jure 2014 | 0/2 network watches; station-level evidence only — fail | | 0.9 untouched Chamoli 2021 | 0 target watches, 2 control watches, one event station unavailable — fail | | 0.9 untouched Gwalpeten 2023 / Peters Dome 2023 | 2/2 event-interval two-station watches; 2/14 control windows also watch | | External three-station confirmation | 0/2 because the independently selected third event trace was unavailable; 0/14 controls confirm — full suite fails | | Rasuwa hydrology repair | 3/3 event gauges, 0/18 matched control station-windows — development regression pass, not external validation | | 0.10 six-station roster development | Event availability repaired, but 0/2 event confirmations and 1/14 control confirmations — fail | | 0.11 bounded consensus development | 2/2 event confirmations, but the same control confirmation survives — fail | | 0.12 untouched dam-forming Oso 2014 / Blatten 2025 | 2/2 event watches about 4.5 minutes after onset; 0/2 confirmations; 0/14 control confirmations — strict suite fails | | 0.15a/0.15b/0.18 opened development events | 6/6 event watches, 5/6 strict confirmations, 0/42 matched-control confirmations — regression evidence only | | 0.19 untouched Xinmo 2017 / West Salt Creek 2014 | Xinmo watch hit but strict confirmation missed; West Salt Creek had only two usable stations; 1/7 scorable controls strictly confirmed and 7 West Salt controls were below quorum — fail | | 0.20 untouched Nile Valley 2009 | Four usable stations, but no event watch or confirmation; 0/7 controls strictly confirmed — fail | | 0.21 expanded EHZ/SHZ Nile development | 48/48 waveform windows available and event raw triggers recovered, but no event watch or confirmation; 0/7 controls strictly confirmed — development fail | | 0.25 untouched cross-region network-model holdout | 6/6 target mass movements detected across the Alps and Taiwan; 3/6 paired earthquakes rejected — target BA 0.750 | | 0.27 untouched European holdout | 5/6 target mass movements detected and 6/6 paired earthquakes rejected — target BA 0.917; strict whole-window BA 0.667 | | 0.28 hard-negative development | Opened 0.27 strict whole-window replay improved from BA 0.667 to 0.833, but this was development evidence only | | 0.29 untouched Greenland/US/Alaska/Swiss holdout | 5/6 target mass movements detected and 5/6 paired earthquakes rejected — target BA 0.833; all 6 positive windows but also 4/6 controls alerted, strict BA 0.667 | | 0.31 Oso downstream-flow-loss development / sealed controls | Oso discharge loss detected at 22:00 UTC, 4 h 22 m after onset; 0/12 unopened same-station annual controls triggered — pass, but Oso was inspected development data and this is not cross-basin validation | | 0.32 Blatten source-outage fusion / sealed controls | Previously external seismic watch at 13:29 UTC plus generic FOEN gauge outage at 13:35 UTC; 0/12 unopened same-station annual controls triggered — pass, but the official station-destruction endpoint was known before the raw series was opened | The external stations were selected mechanically from complete FDSN station-registry snapshots, not from event pick annotations. Detection processes each raw continuous stream before the published event interval is used for scoring. The Oso/Blatten and later Xinmo/West Salt Creek/Nile Valley external protocols were committed before waveform access; the post-failure Nile channel repair is explicitly development-only. The later network-model tests are summarized in the [0.25–0.29 generalization and operational audit](docs/V0_25_V0_29_GENERALIZATION.md). See that record, the [0.9 validation record](docs/V0_9_VALIDATION.md), [0.12 untouched dam-event record](docs/V0_12_UNSEEN_DAM_VALIDATION.md), [0.19–0.21 river-blocking audit](docs/V0_19_V0_21_RIVER_BLOCKING_GENERALIZATION.md), and machine artifacts rather than treating the original Nepal demonstration as a deployment claim. ## How it works ```text raw miniSEED -> causal 0.5-8 Hz streaming filter -> trailing RMS + prior-only median/MAD anomaly trigger -> 180 s automatically extracted waveform features -> causal multi-station association -> network-event classifier -> seismic mass-movement watch (never a public warning by itself) \ raw DHM/BIPAD gauges -> source outage + multi-gauge rise association raw discharge gauges -> persistent downstream-flow-loss association / -> hydrology-corroborated cascade-warning candidate pre-event OSM glacier + public elevation -> hazard context and routing priority Copernicus STAC -> slower imagery-availability metadata (no pixel model yet) -> time-stamped, non-dispatching decision-support advisory ``` The trigger is causal: it uses no future samples, centered windows, or zero-phase filtering. Event origin times are used only after detection to score benchmark matches. Classifier validation is grouped by event so different stations observing one source cannot leak that source between train and test. The current shadow configuration uses the 0.28 cross-region network-event model. Because sealed continuous-window tests exposed false seismic alerts, station count cannot promote its output beyond a watch. A cascade-warning state requires independently observed river evidence. See [decision 0012](docs/decisions/0012-seismic-candidate-requires-independent-corroboration.md). The first post-fix prospective two-poll service run is reported in the [Nepal shadow audit](docs/PROSPECTIVE_SHADOW_AUDIT.md). It measures feed and quorum exposure without claiming a false-alert rate from an unlabeled window. ## Run it Python 3.11+ is required. For a persistent, non-root shadow deployment with no inbound port: ```bash docker compose build docker compose up -d docker compose ps ``` The container health check measures process liveness. Use the separate readiness check to expose insufficient station quorum or degraded public-gauge coverage. See [unattended deployment](docs/DEPLOYMENT.md) before operating it. ```bash python -m venv .venv .venv/bin/python -m pip install -e . # Download the public raw benchmark into an ignored local cache. .venv/bin/cascadewatch benchmark download \ --manifest benchmark/manifest.json \ --cache-dir .cache/benchmark # Train without Nepal and evaluate the held-out event. .venv/bin/cascadewatch benchmark run \ --manifest benchmark/manifest.json \ --cache-dir .cache/benchmark \ --format markdown # Re-run the post-freeze historical Nepal challenge without refitting. .venv/bin/cascadewatch challenge download \ --manifest benchmark/nepal-historical-challenges.json \ --cache-dir .cache/nepal-historical .venv/bin/cascadewatch challenge run \ --manifest benchmark/nepal-historical-challenges.json \ --cache-dir .cache/nepal-historical \ --format markdown # Run the frozen unseen-event validation and fourteen matched controls. .venv/bin/cascadewatch external-validation download \ --cache-dir .cache/v0.9-dense-validation .venv/bin/cascadewatch external-validation run \ --cache-dir .cache/v0.9-dense-validation \ --output validation/v0.9-dense-network-validation.json # Run the separately frozen untouched dam-forming Oso/Blatten suite. .venv/bin/cascadewatch external-validation download \ --protocol benchmark/v0.12-unseen-landslide-dam-validation.json \ --cache-dir .cache/v0.12-unseen-landslide-dam .venv/bin/cascadewatch external-validation run \ --protocol benchmark/v0.12-unseen-landslide-dam-validation.json \ --cache-dir .cache/v0.12-unseen-landslide-dam \ --output validation/v0.12-unseen-landslide-dam-validation.json # Reproduce the Rasuwa windowed-rise development regression. .venv/bin/cascadewatch hydrology-validation download \ --cache-dir .cache/v0.9-hydrology-controls .venv/bin/cascadewatch hydrology-validation run \ --cache-dir .cache/v0.9-hydrology-controls \ --output validation/v0.9-rasuwa-hydrology-development.json # Run the causal detector on any miniSEED file. .venv/bin/cascadewatch detect-seismic path/to/waveform.mseed # Reproduce the frozen Blatten FOEN source-outage fusion validation. .venv/bin/cascadewatch source-outage-validation download \ --protocol benchmark/v0.32-blatten-source-outage-sealed-controls.json \ --cache-dir .cache/v0.32-blatten-source-outage .venv/bin/cascadewatch source-outage-validation run \ --protocol benchmark/v0.32-blatten-source-outage-sealed-controls.json \ --cache-dir .cache/v0.32-blatten-source-outage \ --output validation/v0.32-blatten-source-outage-sealed-controls.json # Run the continuous shadow service: SeedLink ingestion, supervised reconnect, # five-minute typed stage/discharge fusion, atomic state, and append-only audit events. .venv/bin/cascadewatch run-service config/nepal-research.json # Reconstruct prospective quorum, station, gauge, and advisory exposure. # Use --as-of with an actively running session. .venv/bin/cascadewatch shadow-audit .cache/live/events.jsonl \ --output validation/shadow-audit.json # Evaluate a single archive/public-gauge snapshot, including historical as-of tests. # Do not use this command to continuously poll EarthScope's archive API. .venv/bin/cascadewatch live-once config/nepal-research.json \ --cache-dir .cache/live # Verify every retained gauge payload and retrieval reference. .venv/bin/cascadewatch verify-evidence .cache/live/gauges/evidence .venv/bin/python -m unittest discover -s tests -v ``` The benchmark manifest pins the exact query windows and SHA-256 hashes used for validation. Raw waveforms are not committed. The separate [historical Nepal challenge](docs/HISTORICAL_NEPAL_CHALLENGE.md) pins release 0.8.0 and applies source-authored clocks only after full-stream detection and association. It currently records unconfounded Seti and Jure station evidence, zero clean-positive network watches or confirmations, earthquake-confounded false watches, and a Rasuwa gauge-network miss rather than tuning any of them away. ## Public sources - [EarthScope FDSN](https://service.earthscope.org/fdsnws/) for raw seismic waveforms and station metadata. - [USGS ComCat](https://earthquake.usgs.gov/fdsnws/event/1/) for event labels used to construct non-Nepal training and negative controls. - [USGS global landslide seismic catalog](https://doi.org/10.5066/P13FCYQO) for source-authored signal intervals and independent mass-movement examples. - [Nepal DHM River Watch](https://www.dhm.gov.np/hydrology/river-watch) as the direct operational gauge source, with the [BIPAD API](https://bipadportal.gov.np/api/) as source-gauge failover and the pinned historical source. - [Swiss FOEN Open Data](https://data.bafu.admin.ch/en/dataproduct-water-observations) for identity-checked 10-minute discharge and source-gauge-outage validation. - [OpenStreetMap/Overpass](https://overpass-api.de/) historical snapshots for pre-event glacier geometry. - [Open-Meteo Elevation API](https://open-meteo.com/en/docs/elevation-api) for static terrain context. - [Copernicus Data Space STAC](https://dataspace.copernicus.eu/) for slower satellite confirmation and mapping. See [docs/DATA_SOURCES.md](docs/DATA_SOURCES.md) for latency, licensing, and failure roles. ## What is and is not operational Implemented: - causal waveform trigger and automatic feature extraction; - trained mass-movement/earthquake classifier; - two-station watch and three-station confirmation tiers; - repeated-single-station sparse watch with a causally available USGS phase/coda exclusion, restricted to operator use; - causal earthquake phase-train veto at the confirmation tier; - predeclared monitored-source arrival geometry at the confirmation tier; - physical 2–6 km/s basin-source travel-time consistency with a 0.5-second residual gate; - fail-closed confirmation when no monitored source zone is declared; - stateful coda suppression after a three-station episode fails physical consistency; - all-trigger, off-target false-alarm audit with a failing release gate; - real-time EarthScope SeedLink ingestion with rolling causal buffers; - supervised continuous service with SeedLink reconnect and bounded DHM/BIPAD provider failover, atomic advisory state, and append-only JSONL evidence; - one-shot FDSN/public-gauge evaluation and retained-event fusion via `live-once`; - identity-validated DHM/BIPAD stage, USGS OGC discharge, and Swiss FOEN GraphQL adapters; irregular-window rate-of-rise detection, persistent downstream-flow-loss detection, multi-gauge correlation, and gauge-heartbeat detection; - compressed content-addressed gauge evidence, per-poll provenance records, and an integrity verifier; - FDSN downloader with checksums; - pre-event glacier and terrain context adapters; - leakage-controlled Nepal holdout and event-grouped cross-validation; - deterministic model artifact and evidence-rich validation output. - frozen untouched-event/control harnesses with independent station selection and checksum-verified acquisition lineage. Still required before a public warning service: - hundreds of additional mass movements, earthquakes, blasts, storms, and station-failure controls; - continuous shadow operation and measured false alarms per station-day; - a maintained catchment graph and hydraulic travel-time ensembles; - redundant telemetry near high-risk headwaters; - agency-approved alert thresholds, escalation, delivery, drills, and failover. CascadeWatch never directly activates sirens or sends public instructions. It is decision-support research for trained operators. Read [SECURITY.md](SECURITY.md) before any safety-critical integration. The current evidence-by-capability boundary is published in the [operational-readiness matrix](docs/OPERATIONAL_READINESS.md) and its [machine-readable artifact](validation/operational-readiness.json). Licensed under Apache-2.0. Source datasets retain their own terms and citation requirements.