Argus

An air-gapped, audit-trailed RAG system for drug-safety triage — built to the standard a regulated (GxP) environment would demand. Given an individual adverse-event report, Argus retrieves and cites the relevant passages from authoritative drug labeling so a qualified human reviewer can triage faster. Every answer is evidence with citations, never a decision — a named human signs off, and everything is recorded in a tamper-evident audit trail.

Scope: a GAMP 5-aligned demonstration, not a validated system. Public data only (openFDA FAERS + DailyMed SPL). No medical claims. The point is the engineering and the regulatory rigor, not clinical use.

---

Why this exists

LLMs hallucinate, and in drug safety a confident wrong answer is unaffordable. Argus is built around one principle: the system may only answer from cited sources, and when it can't, it refuses — loudly — to a human. No silent fallback, no un-checkable claims. Every architectural rule maps to a real regulatory requirement (21 CFR Part 11, GAMP 5 2nd ed., ALCOA+, draft EU GMP Annex 22, EU AI Act) — that mapping is the project.

Architecture

Layered + ports-and-adapters. Dependencies point inward; the domain imports no infrastructure. Exactly two ports (repository family + LLM) keep the core swappable.

API (FastAPI)          auth · RBAC · review-binding contract
      │
Services               RAG · triage/HITL · ingestion · eval/drift
      │
Domain (pure)          frozen models · state machines · ports        ← imports nothing outward
      │
Adapters               PostgreSQL + pgvector · Ollama
Cross-cutting          hash-chained audit · versioned config

Pipeline: FAERS/SPL → content-addressed raw store → deterministic chunking → identity-versioned pgvector embeddings → citation-verified RAG → human-in-the-loop decision with e-signature → tamper-evident audit → eval + drift monitoring.

Engineering decisions worth a look

• Hash-chained, append-only audit log with a database-level trigger that rejects UPDATE/DELETE — tamper-evidence independent of the application code.
• Identity-versioned embeddings (model@digest): a silently swapped model produces a new version, so stale vectors become visible instead of quietly corrupting search.
• Refusal-first RAG: an answer is constructed refused by default; "answered" must be earned by passing a similarity gate and per-answer citation verification. A fabricated or uncited claim is rejected, not repaired.
• Content-bound e-signatures (21 CFR Part 11): the signature carries a hash of exactly what was decided; the domain rejects a signature over tampered content.
• Savepoint-per-record ingestion: one bad row fails alone — Postgres aborts the whole transaction on a constraint violation, so each record commits inside its own savepoint.
• Structurally isolated destructive tests: integration tests refuse to run unless the target database name ends in _test (learned the hard way).

Quickstart

cp .env.example .env            # set DB_PASSWORD (+ TEST_DATABASE_URL for tests)
make up                         # pinned Postgres+pgvector + Ollama (Docker Compose)
make install                    # deps + pre-commit hooks
docker exec -it argus-ollama-1 ollama pull llama3.2:3b
docker exec -it argus-ollama-1 ollama pull nomic-embed-text
alembic upgrade head
make test                       # unit + integration

Run the pipeline:

python -m pipeline.run --source labels --drug ibuprofen --total 10   # ingest
python -m pipeline.run --source faers  --drug ibuprofen --total 200
python -m pipeline.embed_run                                         # embed
python -m pipeline.ask_run "What are the serious adverse reactions of ibuprofen?"
python -m pipeline.triage_run open                                  # HITL workflow
python -m pipeline.eval_run                                         # golden-set eval
python -m pipeline.monitor_run                                      # drift checks

The whole stack — app, database, model — also runs containerized: docker compose up.

Tech

Python 3.11 · FastAPI · PostgreSQL 16 + pgvector (HNSW cosine) · SQLAlchemy 2 / Alembic · Ollama (local LLM + embeddings) · pytest (unit / integration / validation markers) · ruff + pre-commit · Docker & Compose. Air-gap capable: no external calls at answer time.

Validation dossier

docs/dossier/ carries the GAMP 5-style paperwork the code implements: context of use, user requirements, risk assessment, design spec, IQ/OQ/PQ, a URS↔test traceability matrix, and a regulatory crosswalk (GAMP 5, 21 CFR Part 11, ALCOA+, Annex 22, EU AI Act). The engineering and the documentation are built as one artifact.