Safe sensor data for autonomous agents

An autonomous agent cannot choose its inputs. If it is going to read the data that instruments actually produce — across microscopy, remote sensing, medicine, geophysics, astronomy, and more — it will eventually be handed a file that is malformed, mislabeled, or deliberately hostile. The question is not whether that happens. It is whether the system opens the file correctly when it is valid, and refuses it precisely when it is not, without ever crashing, hanging, or leaking data it was never meant to read.

We put that question to the test directly. OME-NGFF, the next-generation file format for bioimaging, is an n-dimensional array format with canonical axes t, c, z, y, x. BisQue Ultra’s reader is strict about that geometry, which is exactly what lets it carry radically different scientific modalities through one code path. To prove it, we built a synthetic sensor-data corpus spanning seven scientific domains and a stress harness that drives every store through the production reader, renderer, viewer contract, and live image service.

One geometry, every modality

The reason a single reader can serve a hyperspectral cube, a climate reanalysis grid, a radio interferometry cube, and an audio spectrogram is that the geometry is always canonical and the scientific meaning lives in four other places: the channel axis and its labels, the axis units, the physical calibration in the coordinate transformations, and the data type. A spectral band becomes a labeled c axis. A survey line becomes a t axis with a unit. Two-way travel time becomes a z axis in milliseconds. A microphone’s frequency-versus-time spectrogram repurposes y and x as hertz and seconds.

That discipline is what the corpus exercises. It contains 29 spec-correct OME-Zarr stores covering micro-CT alloys, EDS and EBSD maps, 4D-STEM detector images, confocal and light-sheet volumes, whole-slide histology, calcium imaging, Sentinel-2 multispectral and AVIRIS-style hyperspectral scenes, climate reanalysis, weather radar, clinical CT and multi-sequence MRI, cardiac ultrasound, 3-D seismic volumes, ground-penetrating radar, radio and optical astronomy cubes, solar EUV timelapses, thermography, and mass-spectrometry imaging. It spans NGFF 0.4 and 0.5, Zarr v2 and v3, five data types, and seven distinct axis orders — and every one of them opens, reports a consistent viewer contract, and renders a correct thumbnail, slice, and tile.

Failing closed is a feature, not an accident

Coverage is half the contract. The other half is what happens when a store is wrong. The harness includes 23 adversarial and malformed stores, and every one of them fails closed with a specific, actionable error and an HTTP 422 — never an exception that reaches the user as a 500, never a hang, and never a read outside the store. A store that is broken should tell you exactly how it is broken and stop. That is the behavior an autonomous system needs, because it turns an unbounded class of bad inputs into a bounded, typed outcome.

The six defects the stress test closed

A stress test earns its keep by finding real defects. This one found six, each now fixed, default-on, and guarded by regression tests. The numbers are measured peak memory for a single request.

The headline consequence is the third row. After the fix, a gigapixel slice or thumbnail request peaks at about 46 MB instead of 2.5 to 4.7 GB, and a symlinked chunk is refused rather than leaking host bytes end to end. Under a concurrency storm of 400 mixed valid and malformed requests across 16 threads at roughly 500 requests per second, the service returned zero errors with healthy cache accounting.

The boundary we are honest about

A separate multi-agent audit independently reproduced the resource findings and surfaced twelve more items — interoperability, correctness, and frontend issues such as multi-series and high-content-screening store layouts, RGB auto-contrast, and label rendering — all catalogued in an open punch list with recommended directions. They involve product decisions and cross-service changes owned by the respective teams, so they are documented, not quietly closed.

Why an agent platform needs this

Governed autonomy is usually discussed at the level of the model — sandboxes, confidence gates, provenance. This is the same discipline one layer down, at the data. An agent that can be handed any instrument file needs a format layer that is correct across domains and safe against the malformed and the malicious. That is the difference between a demo that works on the maintainer’s three files and a system that can be pointed at a stranger’s data and trusted to either read it right or refuse it cleanly.

For the layer above this, see the scientific image engine and the performance envelope that serves it.