comgu

Commerce reliability and change intelligence

Catch commerce changes before customers do.

A merchant changes one price. Checkout updates. The product feed does not. For the next few hours shoppers are shown one price and charged another — and nobody is alerted, because every system involved is working correctly. They are faithfully emitting values that were true yesterday.

Comgu is continuous integration for commerce operations. It asks DataHub what depends on the change, checks every downstream surface, and — only after a human approves — generates a validated fix.

Open the demo View the source

No account, no card. Passphrase northstar-2026 — everything a judge needs.

Shopify catalog $109.00 · 3 units AUTHORITATIVE Merchant feed $89.00 — stale Bundle availability commits 5 of 3 — oversell Promotion basis $89.00 — overstates AI shopping manifest $89.00 · 12 units no owner recorded Storefront policy 14-day returns — is 30 Discovered by traversing DataHub lineage — not a hardcoded diagram.
The Commerce Lab topology as Comgu finds it: five surfaces reached through get_lineage, four disagreeing with the catalog.

Five things that break, every time

Each is a deterministic check with its own evidence, severity and remediation template.

price_parity

Price parity

Every customer-visible price must equal the authoritative one — feeds, checkout, marketplaces, manifests.

inventory_safety

Inventory safety

No commitment may exceed sellable units. Overselling is the expensive one: the customer has already paid.

promotion_integrity

Promotion integrity

A discount anchored to a superseded price overstates the saving — regulated in most markets.

ai_commerce_freshness

AI-commerce freshness

Shopping agents quote manifests verbatim, with no human in the loop to catch a stale figure.

policy_consistency

Policy consistency

Advertised terms are the ones a customer can hold you to. A short window is a compliance problem.

DataHub decides what is true

The easy way to fake this category is to show a lineage graph next to an answer computed some other way. Comgu is built so it cannot.

Blast radius is lineage. Downstream assets come from get_lineage rooted at the changed asset. There is no hardcoded topology to fall back on — delete the edges and no rule can fire.
Authority is a catalog property. Which asset is the source of truth is read from comgu.authority. Remove it and the engine halts rather than assuming Shopify wins.
Severity is governance. Graded from comgu.criticality and comgu.customer_facing. Re-govern an asset and the same failure is graded differently.

Real MCP calls from one run — persisted with the run and shown in the UI: 

tool                          duration  result
get_lineage                    1227ms  downstreams.total=10
get_entities                   5370ms  11 items
graphql:dataset.assertions      152ms  0 assertions, 0 failing
graphql:dataset.assertions      261ms  1 assertions, 1 failing
add_structured_properties      1549ms  success
add_tags                        793ms  success
save_document                  1066ms  success

Every argument, duration and result is recorded. The reasoning is inspectable rather than asserted.

How DataHub is used, in detail →

Nothing happens without a human

Comgu stops at approval and shows its whole case first: findings, evidence, blast radius, owners, the exact diff, the validation plan and the rollback.

The approval is bound to what you saw

A decision records the plan checksum and the context snapshot checksum, so it cannot be replayed against a different plan. Remediation then replays the stored snapshot rather than re-querying DataHub — it acts on exactly the graph that was approved.

The gate is structural

From AWAITING_APPROVAL there is no edge to PATCH_GENERATING, and from VALIDATION_FAILED there is no edge to a pull request. Both are properties of the state machine, pinned by test — not conventions someone can forget.

A patch you can read, and a test that proves it

Corrections come from registered templates writing to allowlisted paths in an isolated workspace. Comments explaining why a value exists survive the edit. 

--- a/feeds/google_merchant.transform.yaml
+++ b/feeds/google_merchant.transform.yaml
@@ -16,5 +16,5 @@
     title_from_catalog: true
     # Pinned value. Does not follow the catalog — if the catalog price moves,
     # this must be updated deliberately.
-    price_override: "89.00"
+    price_override: "109.00"
     availability_from_catalog: true
Validation is a real test run, not a claim. The commerce parity suite fails 6 of 7 before remediation and passes 7 of 7 after. A failing validation blocks the pull request — there is no override.

Every artefact above is generated output, reproducible from the repository: examples/ · a pull request a run actually opened

Open source, and honest about what is real

Real

  • A self-hosted DataHub Core instance, ~1,270 entities
  • Every MCP call, the lineage graph, the governance metadata
  • The transformation code — contradictions are produced by executing it
  • The generated patches, the pytest run, the pull request
  • The catalog write-back, read back and verified

Simulated

  • The downstream commerce platforms themselves
  • There is no live Merchant Center account or promotion engine
  • Every lab asset is tagged comgu:simulated-downstream in DataHub
  • The product labels it wherever the output is shown

Architecture and contributions →

Everything a judge needs

No account and no card. The product sits behind a passphrase only because this instance mutates a real catalog and opens real pull requests.

Try it

The judge role is sandbox-only: it can run the full flow and approve a remediation, but it cannot open a live pull request. Reset the demo as often as you like — the contradictions come back every time.

Read it

Contributed back

  • datahub-skills#58 — a Skill for driving DataHub over MCP
  • datahub#18642 — a quickstart defect that silently under-indexes the catalog, found while building this

See it break, then fix itself

One price change, ten downstream assets, six findings, five files patched, seven tests green — in under a minute.

Open the demo Read the source