@mosadd/detection-sdk

Pluggable detection pipeline used by mosadd B2C (mobile) and mosadd-gov (edge appliance). Defines the Detector, Signal and Verdict interfaces plus a runDetectors pipeline runner with fail-open semantics.

Status: alpha skeleton. Real detectors (AASIST voice deepfake, Bielik distilled phishing classifier, baseband anomaly) land in their own packages or apps/* and implement the Detector interface from here.

License: MIT. See LICENSE in this package.

Why fail-open is the default

runDetectors defaults to failOpen: true. A detector that throws, times out or returns garbage must not block the host application — for mosadd-gov this is a hard requirement: a buggy ML model cannot cause us to drop a 112 call. Set failOpen: false only in tests.

Minimal usage

import { runDetectors, createNoopDetector } from "@mosadd/detection-sdk";

const detectors = [
  createNoopDetector("voice_deepfake"),
  createNoopDetector("phishing_text"),
];

const result = await runDetectors(detectors, { payload: utterance });
if (result.top && result.top.confidence > 0.7) {
  // route to quarantine queue — never auto-drop
}

Implementing a Detector

import type { Detector } from "@mosadd/detection-sdk";

export const voiceDeepfakeDetector: Detector = {
  meta: {
    id: "aasist-pl-v1",
    kind: "voice_deepfake",
    version: "1.0.0",
    modelHash: "sha256:...",
    supportedEnvironments: ["mobile", "edge"],
    local: true,
  },
  canHandle: (input) => input.payload instanceof Float32Array,
  async evaluate(input) {
    const confidence = await runOnnx(input.payload as Float32Array);
    return {
      detectorId: "aasist-pl-v1",
      kind: "voice_deepfake",
      confidence,
      severity: confidence > 0.7 ? "high" : confidence > 0.4 ? "medium" : "low",
      reasons: ["synthetic_voice_probability"],
      emittedAt: Date.now(),
    };
  },
};