Shade as Software: Giving an Outdoor Worker a Heat Decision That Can Be Audited
Chhaya is a serverless heat action system for outdoor workers. It combines ISO 7243 and NIOSH with strict human consent, dual-engine arbitration (stricter wins), and a persistent auditable ledger. Built on AWS (Lambda, API Gateway, DynamoDB, EventBridge, SNS, IAM, Bedrock, SAM) with 360 tests and citations to primary sources.
The Problem
India already has heat action plans. Court orders in Andhra Pradesh and Telangana have mandated afternoon construction bans for years, yet reports consistently show these plans don't reach contract labour. The bottleneck isn't the science - it's accountability. Critical decisions to stop work often live only in a supervisor's head and disappear at the end of a shift. There is no receipt for who said "stop", when, why, or under what conditions.
The Solution: Chhaya
Chhaya is a site-level heat action plan system built for outdoor workers in heavy infrastructure, civil construction, logistics, and industrial operations. It prevents heat illness before it happens by making safety decisions deterministic, citeable, and fully auditable.
At its core, Chhaya runs two published scientific standards (ISO 7243:2017 and NIOSH 2016-106 Table 6-2) over the same hourly weather inputs. When the engines disagree, the stricter band wins - no averaging, no compromise. Every action proposed comes only from a strict, versioned policy file. No model can invent an action; the policy decides, the model only narrates.
Key Principles
- Exact human consent. Every intervention requires the supervisor to type the exact case-sensitive approval phrase printed by the policy. A typo is a refusal and is recorded in the audit trail.
- Two engines, stricter wins. ISO 7243 and NIOSH are evaluated independently; disagreements are resolved by adopting the higher-risk band, with both outputs preserved for audit.
- Executes exactly once. Proposals are consumed atomically; retries replay the stored result rather than acting twice.
- Store-backed verification. Actions verify their effect against the store (where possible) rather than trusting the caller.
- The escalation clock is persistent. Unanswered Stop-band proposals have a 10-minute window. A scheduled check fires the site owner once if the window elapses - state lives in DynamoDB, not in memory, so it survives cold starts.
- Citations for everything. All constants trace to primary sources (Stull 2011, ISO 7243:2017, NIOSH 2016-106, Rothfusz 1990, Bolton 1980). Corrections made when secondary sources disagreed with primary ones are documented in docs/LEARNINGS.md.
How We Used AWS
Chhaya is deployed as a serverless application on AWS with least-privilege design:
- AWS SAM CLI (open source) - Built, packaged, and deployed the stack with Infrastructure as Code.
- Amazon API Gateway (HTTP API) - Serves the zero-build FastAPI console via Mangum, providing a single app for both local (make serve) and cloud.
- AWS Lambda - Three functions: ApiFunction (console + API), TriageFunction (scheduled 15-min triage), and EscalationFunction (scheduled 5-min escalation checks).
- Amazon DynamoDB - Single-table design storing advisories, action records, exposure/coverage (worker-hours ledger), and pending proposals. This is the source of truth - including the escalation clock.
- Amazon EventBridge Scheduler - Triggers triage every 15 minutes and escalation checks every 5 minutes.
- Amazon SNS - Sends escalation alerts to site owners (SMS/email parameter-gated with delivery tracking).
- AWS IAM - Granular managed policies: read-only agent role, write-only notifier role, and scoped store access per function.
- Amazon Bedrock - Provides supervisor-facing narration via Converse API (never decides actions). Deployed with AgentBackend=local today due to account authorization hold; switching to Bedrock is a one-parameter redeploy.
Build Quality & Testing
Chhaya has 360 tests with 94% coverage, running offline via moto for DynamoDB. The safety model is asserted directly - including consent variants (typos must be refused), stricter-wins merge behavior, store-backed verification, and escalation idempotency. The same code runs locally (JSON store + scripted agent) and on AWS (DynamoDB + SNS + Bedrock/local) with no business logic in the HTTP layer.
Try It
- Local: python -m venv .venv && .venv/Scripts/pip install -e ".[dev,aws]" && python -m chhaya.cli serve
- Demo: python -m chhaya.cli demo
Conclusion
Construction labour on a 40+ °C afternoon doesn't need a black-box AI making stop-work calls. It needs a receipt - proof of who decided, on what basis, with what consent, and that the decision was recorded and enforced. Chhaya delivers that receipt through policy-bound rules, dual-engine arbitration, exact consent, and a persistent, auditable ledger. The result is not just safer work, but defensible safety.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article