Nexus Synergy Engagement Package — A01 · NDFEM / National Emergency Coordination + a storm-hit Local Authority Severe Weather Coordinator

STANDING BANNER (read first). Nexus Synergy Ltd is pre-incorporation, pre-revenue, pre-pilot. NDFEM and the storm-hit Local Authorities named here are TARGETS, not customers — nothing in this file is a deployment, an engagement, or traction; the ~178-surface gallery is a gallery, not a deployed system. Anti-cookie-cutter: the §8 mockups are programmatically generated from this buyer's real entities (Storm Éowyn, ESB 768k outage, Tuam comms-dark cluster, Connacht CSCs) — they are this buyer's screens, not a reused template. Every probability below is [PRIOR] — a subjective pre-pilot estimate for prioritisation, not a forecast. Decline-safe scope only: operational coordination + resilience; aggregate/registered/consented data; human-gated; fully audited. No predictive policing, biometric ID, emotion recognition, social scoring, untargeted scraping, or psychometric profiling.

---

§0 — Header + one-line thesis

A multi-hazard responder Common Operating Picture (COP) that sits above public-alerting tools — fusing Met Éireann warnings, ESB Networks outage clusters, Uisce Éireann supply status, telecoms-degradation and Local Authority road/asset feeds onto one live map, surfacing the power-out ∩ comms-out ∩ registered-vulnerable intersection that no single agency's tool shows today, and closing one human-gated, fully-audited action (open a Community Support Centre / dispatch a generator / issue a targeted local alert) — built to answer Storm-Éowyn-review Recs 3.11.6 (reach vulnerable & isolated people) and 3.11.7 (operational systems for public communications).

§1 — Entity snapshot (cited)

• Policy/funding owner: National Directorate for Fire and Emergency Management (NDFEM), within the Department of Housing, Local Government and Heritage (DHLGH); set up 2009; coordinates emergency response across departments and local authorities. National Director Keith Leonard is the named owner of the Framework for Major Emergency Management and convenes the National Emergency Coordination Group (NECG). [verified — gov.ie NDFEM page; Review of Storm Éowyn 21 Oct 2025]
• Operational champion (the reachable wedge): a repeatedly storm-hit Local Authority Severe Weather Coordinator / Director of Service running a Local Co-ordination Centre (LCC) — Galway, Mayo or Roscommon were among the worst-hit by Éowyn. [verified — Éowyn impact reporting]
• Co-buying context: Local Authorities (31), the Government Task Force on Emergency Planning, and the Office of Emergency Planning (OEP, Dept of Defence) which holds the cross-government Strategic Emergency Management framework. [verified — EU civil-protection national-system page; gov.ie SEM framework]
• Mandate artefacts in hand: the Review of Storm Éowyn (published 21 Oct 2025) recommending Community Support Centres, increased Uisce Éireann generator capacity, satellite-comms capacity, and 72-hour public-resilience guidance; the Fire Services Capital Programme 2026–2030 (€328.5m, NDFEM-administered) with a €10.5m National Mobilisation and Communications System line; and the National Strategy on the Resilience of Critical Entities 2026–2029 (published 19 March 2026). [verified — gov.ie; fireireland.ie; localauthoritynews.ie]

§2 — The pain (web-verified, dated, cited)

Storm Éowyn (24 Jan 2025) caused the most widespread power disruption of any Irish storm in the instrumental/modern record — gusts to 184 km/h and the largest outage ESB Networks has recorded (the 1839 "Night of the Big Wind" remains the most devastating in pre-instrumental Irish history). It knocked out power to a peak of 768,000 ESB customers (~30% of the population); ESB called the infrastructure damage "unprecedented." Critically, areas lost power and telecoms simultaneously — phone trees and email, the actual coordination substrate, went dark exactly where help was most needed. [verified — Review of Storm Éowyn, 21 Oct 2025; ESB statements]

The Review's named recommendations expose the gap precisely: Rec 3.11.7 asks for operational systems to support public communications and Rec 3.11.6 for outreach systems to reach vulnerable and isolated people — and the Review stood up Community Support Centres, Local Critical Infrastructure Groups, and a telecoms-resilience workstream. [verified — gov.ie]

The operational reality today: an LCC duty officer assembles "the picture" by toggling between a Met Éireann warning page, the ESB PowerCheck public map, Uisce Éireann supply notices, ComReg/operator outage notices, a road-closure list, and a CSC status spreadsheet — by phone and email — with no single fused situational picture and no auditable record of who knew what, when, and who authorised what. The incumbent public-alerting tool (MapAlerter, used by 23 LAs) does outbound alerting well but is scoped to public alerting — it does not provide a responder COP, cross-agency data fusion, or incident-commander situational awareness (none are in its published feature set). [verified — mapalerter.ie; responder-COP gap is our assessment, not a vendor admission]

§3 — Use-case & value (DECLINE-SAFE framing)

What this is: a responder-facing COP for resilience, safety and multi-agency coordination during severe-weather and multi-hazard events. It fuses lawful operational feeds, surfaces priority clusters, and closes one human-gated coordination action with a tamper-evident audit trail.

What this is explicitly NOT (stated up-front in every showing, and written into the MOU): not predictive policing; not biometric identification; not emotion recognition; not social scoring; not untargeted scraping; not psychometric profiling; not individual risk-scoring or inference. The vulnerable-person layer surfaces only who registered for help on an LA's existing consented register (or CSO small-area / GeoDirectory aggregates) — never an inference about who "might" be vulnerable. This is the line that keeps the product off the Declined List, and it is also the selling point: aggregate/registered/consented data only; human-gated; fully audited (PROV-O).

Value to the buyer: decision lead-time (warning → coordinated action), journeys-protected / households-reached, and audit-grade reconstruction of the response — the exact evidence the Éowyn review asked for and that CER/NIS2 resilience reporting will increasingly demand.

§4 — Ontology (this buyer's domain entities + relationships)

HazardWarning (Met Éireann; red/orange; wind/rain/snow; valid_from/to)
    └─ COVERS → ElectoralDivision (ED) / EircodeRoutingKey
OutageCluster (ESB PowerCheck snapshot; customers_affected; polygon)   ── AGGREGATE
    └─ INTERSECTS → ElectoralDivision
TelecomsDegradation (ComReg/operator notice; mast/cell; coarse polygon) ── AGGREGATE
    └─ INTERSECTS → ElectoralDivision
WaterSupplyStatus (Uisce Éireann; supply/boil-notice; on_backup_gen)
    └─ SERVES → ElectoralDivision
RoadClosure (LA; route_id; cause=tree-fall/flood; crew_tasked)
VulnerableRegisterCount (per-ED COUNT from CONSENTED LA register)       ── CONSENTED, count-only
    └─ SCOPED_BY → LocalAuthorityArea  (federation seam, per-LA sovereign)
CommunitySupportCentre (CSC; status=open/staging; gen_backed; capacity)
    └─ ACTIVATED_BY → DecisionRoomVerdict
ResourceTask (generator drop / crew dispatch / CSC open)
    └─ AUTHORISED_BY → DualControlSignoff (2-of-2 QES)
CapMessage (targeted local alert; severity×certainty×urgency; languages[])
    └─ REQUIRES → DualControlSignoff   (LOAD-BEARING: no broadcast without it)

The TriageCluster is a derived entity, not a fact: power-out ∩ comms-out ∩ vulnerable-register-count > 0 over an ElectoralDivision. It is surfaced for a human; it never auto-tasks.

§5 — Data model (synergy.* tables; RLS + a load-bearing CHECK)

SQL
56 lines
Copy
-- Aggregate hazard/outage operational picture. Every row is org-scoped for RLS;
-- local_authority_area_id is the federation seam keeping each LA's ground-truth sovereign.
CREATE TABLE synergy.hazard_overlay (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,                              -- RLS: app.current_org_id
    local_authority_area_id uuid NOT NULL,                      -- per-LA sovereignty seam
    layer           text NOT NULL CHECK (layer IN
                      ('met_warning','esb_outage','telecoms_degrade','water_status','road_closure')),
    extent_geom     geometry(MultiPolygon, 4326) NOT NULL,
    metric_value    numeric,                                    -- e.g. customers_affected (AGGREGATE)
    severity        text,                                       -- met: red/orange/yellow
    valid_from      timestamptz NOT NULL,
    valid_to        timestamptz,
    prov_source     text NOT NULL                               -- PROV-O: Met feed / PowerCheck snapshot id
);
ALTER TABLE synergy.hazard_overlay ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.hazard_overlay
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- Vulnerable-register is COUNT-ONLY per ED, derived from a CONSENTED LA register.
-- No row may carry an individual identifier; the CHECK enforces decline-safety at the schema.
CREATE TABLE synergy.vuln_register_count (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,
    local_authority_area_id uuid NOT NULL,
    electoral_division text NOT NULL,                           -- ED / Eircode routing key
    registered_count integer NOT NULL CHECK (registered_count >= 0),
    basis           text NOT NULL CHECK (basis IN ('consented_la_register','cso_smallarea_aggregate')),
    person_identifier text                                      -- MUST stay NULL (decline-safe)
        CHECK (person_identifier IS NULL),                      -- LOAD-BEARING: no individual data, ever
    recorded_at     timestamptz NOT NULL DEFAULT now()
);
ALTER TABLE synergy.vuln_register_count ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.vuln_register_count
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- A coordination action (CSC open / generator drop / targeted alert) is a first-class
-- audited entity. It CANNOT be executed without a 2-of-2 dual-control human sign-off.
CREATE TABLE synergy.resource_task (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,
    local_authority_area_id uuid NOT NULL,
    kind            text NOT NULL CHECK (kind IN ('open_csc','dispatch_generator','targeted_alert','crew_dispatch')),
    target_ed       text NOT NULL,
    proportionality numeric(3,2),                               -- P score surfaced to the gate
    sign_la_coord   text,                                       -- LA Severe-Weather Coordinator QES; NULL until signed
    sign_regional   text,                                       -- Regional Steering Group QES;       NULL until signed
    executed_at     timestamptz,                                -- NULL until tasked
    merkle_leaf     bytea NOT NULL,
    prov_derived_from text NOT NULL,                            -- PROV-O: which overlay rows + triage rule
    -- LOAD-BEARING INVARIANT: the human-gated decision. No execution without 2-of-2 sign-off.
    CHECK (executed_at IS NULL OR (sign_la_coord IS NOT NULL AND sign_regional IS NOT NULL))
);
ALTER TABLE synergy.resource_task ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.resource_task
    USING (org_id = current_setting('app.current_org_id')::uuid);

Two load-bearing invariants: (1) vuln_register_count.person_identifier IS NULL makes the decline-safety promise structural — the schema physically cannot store an individual; (2) resource_task cannot be executed_at without both QES signatures — the human gate is enforced in the database, not just the UI.

§6 — Action-loop pseudocode (detect → enrich → triage → gate → task → execute → BDA → close)

Python
46 lines
Copy
def coordinate_severe_weather(region_state, overlays, requesting_org):
    # 1. DETECT — Met red warning live + ESB outage snapshot + telecoms-degrade notices.
    if not met_red_or_orange(region_state):
        return Disposition.MONITOR_ONLY

    # 2. ENRICH — fuse aggregate layers onto one ED grid; recall the analogue event from CMA memory.
    grid = fuse_by_electoral_division(overlays["esb_outage"], overlays["telecoms_degrade"],
                                      overlays["water_status"], overlays["road_closure"])
    analogue = cma_collective_memory.recall_analogue(region_state)        # -> Storm Éowyn 2025

    # 3. TRIAGE — the intersection no single tool shows: power-out AND comms-out AND registered-vulnerable.
    clusters = [ed for ed in grid
                if ed.power_out and ed.comms_out
                and vuln_register_count(ed) > 0]                          # COUNT-ONLY, consented basis
    if not clusters:
        return Disposition.NO_PRIORITY_CLUSTER
    top = rank_by(clusters, key="households_at_risk")[0]                  # e.g. Tuam ED (H54): 38 registered

    # 4. GATE — human Decision Room; lawful basis Art 6(1)(d) vital-interests + 6(1)(e) public-task.
    gate = decision_room(
        proposal  = OpenCSC_DispatchGen_TargetedAlert(top),
        personas  = [OP_TASKING, PROPORTIONALITY, CIVIL_SOCIETY("AlgorithmWatch"),
                     DEVILS_ADVOCATE, DOMAIN_EXPERT("LA-Emergency-Mgmt-Officer")],
        threshold = P_MIN_TIER2)                                          # P = 0.92
    if gate.civil_society.flag == "NO_IRISH_OR_PLAIN_LANGUAGE":
        proposal.add_condition("ga + plain-language notice; Art-50 AI-disclosure")
    if not gate.passed:
        audit.append(top.id, f"refused: {gate.rationale}", merkle=True)
        return Disposition.REFUSED(gate.rationale)

    # 5. TASK + 6. EXECUTE — only after 2-of-2 QES; the DB CHECK also forbids it otherwise.
    sign_coord = await qes_sign("la.severe_weather_coordinator", proposal)
    sign_reg   = await qes_sign("regional.steering_group", proposal)
    if not (sign_coord and sign_reg):
        audit.append(top.id, "action unsigned -- withheld", merkle=True)
        return Disposition.WITHHELD
    receipts = execute([open_csc(top), dispatch_generator(top),
                        cap_fanout(targeted_alert(top), targets=["eu-alert","rte-radio","la-cad","mapalerter"])])
    write_back("synergy.resource_task", proposal, executed_at=now(),
               sign_la_coord=sign_coord, sign_regional=sign_reg, merkle=True)

    # 7. BDA — confirm alert delivery (MNO receipt) + 38/38 register contacted (Rec 3.11.6).
    bda = assess_delivery(receipts) & confirm_outreach(top, target=vuln_register_count(top))

    # 8. CLOSE — UNO loop close; register a ProspectiveItem if a feed-gap recurred (e.g. mast-down latency).
    return close_loop(top, bda, prospective=detect_recurring_gap(receipts))

§7 — nexus-workflows YAML DAG (same loop, declarative, blocking human-gate node)

YAML
36 lines
Copy
# nexus-workflows job: civil_protection_cop_loop  (NO cron — scheduled/triggered as a workflow)
name: civil_protection_cop_loop
trigger:
  on: met_eireann_warning            # red/orange escalation event
  org: "{{ tenant.org_id }}"
nodes:
  - id: detect
    run: synergy.detect.met_red_or_orange
  - id: enrich
    needs: [detect]
    run: synergy.fuse.by_electoral_division
    with: { layers: [esb_outage, telecoms_degrade, water_status, road_closure] }
  - id: triage
    needs: [enrich]
    run: synergy.triage.power_comms_vuln_intersection   # COUNT-ONLY, consented basis
  - id: human_gate                    # BLOCKING — workflow halts here until a human signs
    needs: [triage]
    type: human_approval
    blocking: true
    decision_room:
      personas: [op_tasking, proportionality, civil_society_algowatch,
                 devils_advocate, domain_la_em_officer]
      threshold: P_MIN_TIER2
      dual_control: { signers: 2, method: QES }   # mirrors the DB CHECK on resource_task
    on_reject: { goto: close, status: refused }
  - id: task_execute
    needs: [human_gate]
    run: synergy.execute.csc_gen_alert
    with: { targets: [eu-alert, rte-radio, la-cad, mapalerter] }
  - id: bda
    needs: [task_execute]
    run: synergy.assess.delivery_and_outreach        # Rec 3.11.6: register contacted
  - id: close
    needs: [bda]
    run: synergy.uno.close_loop
    emits: prospective_item                          # recurring feed-gap -> backlog

The human_gate node is blocking — the DAG cannot reach task_execute until two named officers sign. This is the same invariant the database CHECK enforces, expressed declaratively.

§8 — UI/UX mockups (VERBATIM generated ASCII)

Surface 1 (PRIMARY) — map_ops. Caption: ShellLayout + TopBar (with PccPill in rightSlot, RendererChip = MapLibre-2D) + LeftSidebar glyph-rail + LAYERS panel + MapConsole rendering the Connacht hazard overlays and the Tuam triage cluster + right-docked ChatTerminal Decision Room + HistoryRail + BottomStatusBar + ClassificationBanner.

Figure — Operational picture (map_ops · live MapLibre). Production-fidelity React surface (buildable); the faithful ASCII follows.

+------------------------------------------------------------------------------------------------------+
| Connacht Multi-Hazard Responder COP - Storm Eowyn replay (MapConsole + MapLibre-2D)                  |
+--------------------+---------------------------------------------------------------------------------+
| LAYERS             | MAP  ========================================================================== |
| [x] Met warnings   |   W Connacht region (Galway / Mayo / Roscommon Local Co-ord Centre)             |
| [x] ESB outage     |   |   ### MET RED wind warning 06:00-12:00 ### gusts 184 km/h logged            |
| [x] Uisce Eireann  |   |                                                                             |
| [x] Telecoms down  |   o GALWAY CITY   ESB out 41,200 cust | 3G/4G DEGRADED | water OK               |
| [x] Road closures  |   |   CSC-G2 Westside OPEN (gen-backed) | CSC-G5 staging                        |
| [x] CSC status     |   o TUAM         ESB out 12,800 | mast down -> COMMS DARK <!>                   |
| [~] Vuln. register |   |   >> power-out AND comms-out AND 38 registered vuln. residents              |
| [ ] Tree-fall jobs |   o CASTLEBAR    ESB out 27,500 | water-pump on backup gen                      |
|                    |   |   R331 / N5 blocked: fallen trees x6 (LA crews tasked)                      |
| REPLAY             |   o BALLINA      ESB out 9,400 | telecoms OK | CSC-M1 staging                   |
| Storm Eowyn        |   |                                                                             |
| 24 Jan 2025        |   o ROSCOMMON    ESB out 18,900 | water OK | CSC-R1 OPEN                        |
| [<<] t+06:20 [>>]  |                                                                                 |
|                    |   TRIAGE CLUSTER: Tuam = power-out n comms-out n vuln-register (38)             |
| SOURCES            |   the intersection no single agency tool surfaces today                         |
| Met Eireann WX     |   Proportionality P=0.92 | HUMAN SIGN-OFF required before tasking               |
| ESB PowerCheck     |   [ Open Decision Room ]  [ Hold + re-poll 15m ]  [ Drop CSC pin ]              |
| ComReg outages     |                                                                                 |
| LA road/asset      |                                                                                 |
| consented register |                                                                                 |
+--------------------+---------------------------------------------------------------------------------+
| INCIDENTS: 06:18 Tuam mast DOWN | 768k peak outage | CSC-G2 open | gen convoy staged | vuln-list set |
+------------------------------------------------------------------------------------------------------+

Surface 2 — cap_composer. Caption: the targeted-local-alert write-back surface — alert form (Event/Area/Onset/Headline/Instruction/Languages/Expires), the severity×certainty matrix, the AI-Act Art-50 watermark toggle, the consented-data-basis note, the per-LA fan-out targets, and the 2-of-2 dual-control sign-off, rendered inside ChatTerminal over the same ontology the MapConsole reads.

Figure — Alert composer (CAP 1.2 write-back). Production-fidelity React surface (buildable); the faithful ASCII follows.

+----------------------------------------------------------------------------------------------+
| Targeted Local Alert + CSC Activation - Tuam (cap_composer write-back)                       |
+--------------------------------------------------+-------------------------------------------+
| Event:    Severe weather - power & comms outage  | SEVERITY x CERTAINTY                      |
| Area:     Tuam ED + 3 adjacent (Eircode H54)     |           Obs  Likely Poss                |
| Onset:    Immediate (replay t+06:20)             |  Extreme   .    .     .                   |
| Headline: Community Support Centre OPEN - Tuam   |  Severe   [X]   .     .                   |
| Instruction:                                     |  Moderate  .    .     .                   |
|   CSC at Tuam Town Hall open now. Charging,      | Urgency: Immediate                        |
|   heat, water, welfare check. If you or a        |                                           |
|   neighbour is on the vulnerable register and    | TARGETS (fan-out)                         |
|   has no power/phone, call to the centre or      |  [x] EU-Alert / 112                       |
|   ask a neighbour to call in for you.            |  [x] RTE local radio                      |
| Languages: [ga] [en] [pl] [uk]                   |  [x] LA CSC dashboard                     |
| Expires:   06:20 +12h                            |  [x] MapAlerter LA push                   |
|                                                  |  [ ] EU-CECIS (natl only)                 |
| Art-50 AI-disclosure watermark: [x] ON           |                                           |
| Source basis: consented LA register +            | DUAL-CONTROL 2/2 QES                      |
|   aggregate ESB/ComReg outage polygons           |  sign 1: LA Severe-Wx Coord               |
|   (NO inference, NO individual scoring)          |  sign 2: Regional Steering                |
+--------------------------------------------------+-------------------------------------------+
|  [ Preview CAP-XML ]   [ /dual-control sign ]   [ Broadcast ]                                |
+----------------------------------------------------------------------------------------------+

Surface 3 — command_dashboard. Caption: the NECG roll-up — KPI tiles (customers off supply / comms-dark areas / CSCs activated) + the live alert feed reading off the HistoryRail, the national-coordination view above the regional map_ops.

Figure — Command dashboard (KPI + live feed). Production-fidelity React surface (buildable); the faithful ASCII follows.

+--------------------------------------------------------------------------------------------------+
| National Emergency Coordination Group - Storm Eowyn replay (command_dashboard)                   |
+--------------------------------------------------------------------------------------------------+
| CUSTOMERS OFF SUPPLY           | COMMS-DARK AREAS               | CSC ACTIVATED                  |
| 768,000 peak (~30%)            | 11 EDs power+comms out         | 23 open / 14 staging           |
| ESB: 'unprecedented'           | telecoms-degrade layer         | gen-backed: 19                 |
+--------------------------------------------------------------------------------------------------+
| LIVE ALERT FEED                                                                                  |
|  06:18  Tuam mast DOWN -> ED H54 comms-dark; 38 vuln-register residents flagged                  |
|  06:20  Decision Room: CSC-Tuam open + gen dispatch + targeted alert - SIGNED 2/2                |
|  06:24  CAP fan-out OK: EU-Alert+RTE+LA-CAD receipts logged to HistoryRail                       |
|  06:31  Roscommon CSC-R1 reports 64 welfare check-ins; water supply nominal                      |
|  06:45  ESB ETR Galway-city feeder 11:30; Castlebar pump on backup gen (6h fuel)                 |
|  07:02  Rec 3.11.6 outreach: 38/38 vuln-register residents contacted or visited                  |
|  07:10  BDA: alert delivery confirmed T+6m (MNO receipt); UNO loop closed                        |
+--------------------------------------------------------------------------------------------------+

(Bespoke SVG of the primary screen: _build/figures/ndfem-civil-protection/uc-map_ops.svg.)

§8b — Field-unit (Pixel) surfaces

The same scenario on the Pixel 10 Pro Fold field unit (Nexus Field app), tightly coordinated with the dashboard COP above — command pushes the task, the unit accepts + ACKs, shares position and reports back to the COP. Built on the same synergy.field_unit / field_task / field_report contract; see §9 and the cluster coordination composite.

Figure §8b.1 — Folded cover · tasking glance (ground_glance): the incoming IMMEDIATE task, ACCEPT + ACK, alert chips, bearing-to-objective.

Figure §8b.2 — Unfolded inner display · field COP: two-pane mini-map + task list + teammate roster + air/command coordination + PTT, with the Material-3 NavigationBar + Report FAB.

§9 — UI/UX flow

Figure §9.0 — Dashboard ↔ field-unit coordination loop (cluster A): the command COP, the Pixel field unit, and the wire between them annotated with the real synergy-server endpoints — LIVE (/api/v1/cop/picture, /viewport/state) vs PENDING-for-demo (/api/v1/field/{tasks,reports}).

Literal click-path: Operator scrubs the [<<] t+06:20 [>>] REPLAY control on the LeftSidebar → the MapConsole paints Met red + ESB outage + telecoms-degrade onto the ED grid → the Tuam triage cluster auto-highlights (red halo) with Proportionality P=0.92 → operator clicks [ Open Decision Room ] → reads the five persona bubbles in the right-docked ChatTerminal, accepts the AlgorithmWatch condition (Irish + plain-language notice) → clicks [ /dual-control sign ] → second signer (Regional Steering) signs → [ Broadcast ] fires the cap_composer fan-out → receipts and the PROV-O attribution land on the HistoryRail, scrubbable as "who knew what, when."

[map_ops scrub replay] → [triage cluster auto-surfaces] → [Open Decision Room]
        → [accept civil-society condition] → [/dual-control sign 2/2]
        → [cap_composer Broadcast] → [HistoryRail PROV-O + BDA] → [close loop]

§10 — Decision-Room transcript (the gated decision)

Op-tasking · L3 EuroLLM-EU: "Recommend: open CSC-Tuam (Town Hall), dispatch one generator to the comms-dark feeder, and issue a targeted local alert to ED H54. This directly answers Review Recs 3.11.6 (reach the 38 registered residents) and 3.11.7 (operational comms when the mast is down)."

Proportionality · L3 Mistral-Large-EU: "Lawful basis: Art 6(1)(d) vital-interests + 6(1)(e) public-task. Data minimised — we act on an aggregate outage polygon and a count of registered residents, not individuals. Necessity/proportionality/legitimacy P=0.92 [N:0.96 P:0.92 L:0.89]. Proportionate. Set a re-open/stand-down review at T+90m."

Civil-society reviewer · AlgorithmWatch: "Two conditions before I concur. (1) The alert text must carry an Irish-language version and plain-language phrasing — a power-and-comms-out cohort over-indexes for older/isolated residents. (2) AI Act Article 50 AI-disclosure watermark must be on, since the draft text is AI-composed. Add both or I dissent." → conditions accepted.

Devil's advocate · L2 Mistral-7B (local): "Is this a false alarm — could the mast register recover and the outage be transient? Cross-check: the ESB PowerCheck snapshot and the ComReg operator notice both confirm the Tuam outage; this is not a single-source artefact. Holding costs an isolated cohort a warm centre during the worst power-outage storm in the modern record. Hold = NO."

Domain expert · LA Emergency-Management Officer: "Tuam mast outage verified against the operator notice; the vulnerable register is the LA's consented register, not an inference. CSC-Tuam Town Hall is gen-ready. Concur — open CSC, with the civil-society conditions carried."

GATE VERDICT — ACCEPT (conditional): P=0.92 ≥ P_min; conditions carried (Irish + plain-language notice; Art-50 watermark); 2-of-2 dual-control QES required before any execution. Dissent log: AlgorithmWatch's two conditions are recorded as a discoverable provenance edge — if a resident later challenges the alert, the chain proves the disclosure and the Irish-language obligation were honoured.

§11 — Write-back + BDA + PROV-O + deltas-only regulatory traceback

Write-back. On 2-of-2 sign-off, a WriteBackBubble in the ChatTerminal posts the resource_task (CSC open + generator + targeted alert) with executed_at=now(), Merkle-anchored. The cap_composer fan-out writes delivery receipts back to the LA CAD and the CSC dashboard.

BDA (loop close). Delivery is assessed against MNO delivery receipts (alert confirmed T+6m), and outreach is assessed against the register: 38/38 registered residents contacted or visited (Rec 3.11.6 satisfied). A residual feed-gap (mast-down notification latency) registers a ProspectiveItem to the backlog.

PROV-O attribution chain (every node carries prov:wasAttributedTo agent + prov:wasGeneratedBy activity; Merkle-anchored to a Sigstore-Rekor-style transparency log):

MetWarning(Entity, Met Éireann)  +  OutageSnapshot(Entity, ESB PowerCheck)
        └─ used ─► Triage-Fusion(Activity)  ── wasInformedBy ── TelecomsNotice(Entity, ComReg)
                          └─ wasGeneratedBy ─► TriageCluster:Tuam-H54(Entity)
                                  └─ used ─► DecisionRoom-EOWYN-R1(Activity, 5 personas + LA-DO)
                                          └─ wasAssociatedWith ─► DualControlSigners(Agent, Coord+Regional 2/2)
                                                  └─ wasGeneratedBy ─► ResourceTask:CSC-Tuam(Entity)
                                                          └─ used ─► CAP-Fanout(Activity)
                                                                  └─ wasGeneratedBy ─► CapMessage:IE-NDFEM-…(Entity)
                                                                          └─ BDA: MNO-delivery T+6m (Obs-L4) ─► UNO-close

Regulatory traceback (deltas only — what differs from the platform defaults). AI Act Annex III §5(d) (AI for emergency-call evaluation / dispatch of emergency first-response = high-risk) ⇒ Art 27 FRIA completed for the COP/CAP pipeline; Art 14 human-oversight satisfied by the blocking 2-of-2 gate; Art 50 end-user transparency is the load-bearing delta here — the AlgorithmWatch persona forces the AI-disclosure watermark onto the public alert. GDPR delta: the only personal-data touchpoint is the LA's pre-existing consented register, surfaced count-only (person_identifier IS NULL by schema) — no new processing of individuals, no special-category inference.

§12 — Buyer & stakeholders

§13 — Competition / incumbency + comparator

Incumbent: MapAlerter (mapalerter.ie) — entrenched public-alerting tool across 23 Irish local authorities, performed well in Éowyn, and now markets a "Storm Day" live dashboard. It does not provide a responder COP, cross-agency fusion, or incident-commander situational awareness (none appear in its published feature set; responder-COP gap is our assessment). [verified — mapalerter.ie] Strategy: integrate above it, never displace — MapAlerter is a fan-out target in our cap_composer, not a competitor for the responder-COP slot.

Adjacent: Esri/ArcGIS is the deep LA-GIS incumbent (and Dublin Fire Brigade signed a new Esri deal Jan 2026) — so the COP must be positioned as the cross-agency decision/audit layer above GIS, not a GIS replacement. D4H covers single-agency incident management. Comparator framing (folded): the responder-COP + human-gated action-loop + PROV-O audit layer is genuine white space above all three — none provides the power∩comms∩vulnerable triage or the auditable dual-control decision record the Éowyn review asked for.

§14 — Readiness (honest, pre-pilot)

Reusable today (on /synergy-console): MapConsole triple renderer; the COP entity model + /api/v1/cop/picture (117 live entities incl. DOLPHIN-21, isolated adverant-demo tenant); HistoryRail bitemporal playback + audit (SC-MAP-HIST); dropped-pin/map-object CRUD + elevation (SC-MAP-OBJ/PIN, for CSC/generator drops); ChatTerminal right-dock Decision Room; the EM/COP routes already merged.

Real gaps (build, honestly): the Irish storm-data adapters (Met warnings, ESB PowerCheck snapshot — public map, confirm permitted use or use a recorded snapshot, do not scrape live in production without permission, ComReg notices, road/rail status); the deterministic recorded Éowyn dataset for offline replay; the consented vulnerable-register count overlay (data-governance line is the differentiator — do last, get it right); the five buyer lenses. Maturity statement for every showing: demo-ready (faithful gallery + recorded real-past-storm), not deploy-ready; no live tasking against any real agency.

§15 — ENGAGEMENT PLAYBOOK

Warm-intro email (adapt from outreach-drafts §1, ask 1):

Subject: A no-cost responder operating-picture for the next Storm Éowyn [Name] — [Patrick's intro context]. We've built a storm-replay common-operating-picture that re-plays Éowyn (24 Jan 2025) on one live map — fusing Met warnings, ESB outage, telecoms-degradation and your road/CSC feeds — and surfaces the power-out ∩ comms-out ∩ registered-vulnerable cluster no single tool shows today, then closes one human-gated, fully-audited action that answers review Recs 3.11.6 and 3.11.7. It's aggregate/consented data only — no profiling, no scoring. Free discovery, no cost, no obligation. Could I show you 20 minutes?

60-min discovery agenda (adapt from discovery-playbook §3): 0:00 frame + permission ("discovery, not a pitch"); 0:05 walk me through your last storm from detection to stand-down — how many systems for one picture?; 0:20 lawful basis of the vulnerable register + CER/AI-Act scope; 0:35 who owns the problem / the budget (Fire Services Capital ICT line? LA resilience capital?); 0:45 map their loop onto detect→enrich→triage→gate→task→execute→assess→close, find the gap; 0:55 reflect top-3 pains, ask for the scoped-demo date.

1-page pilot proposal (filled for THIS buyer): Title: Winter-2026 LCC Responder-COP pilot, one MEM region. The one thing we'll prove: "We can fuse Met + ESB-outage + telecoms-degrade + LA road/CSC feeds into one operating picture and surface the power∩comms∩registered-vulnerable cluster, reducing time-from-warning-to-coordinated-action from X to Y (baseline measured week 1)." Scope IN: one region, recorded + (permitted) live feeds, one human-gated action, audit ledger. Scope OUT / Declined: any individual scoring/inference, biometrics, predictive analytics. Data & lawful basis: aggregate feeds + consented LA register (count-only), EU-hosted, hardened-container tier. Success criteria: (1) decision lead-time X→Y; (2) % registered-vulnerable in priority cluster contacted; (3) auditable PROV-O reconstruction passes a tabletop review. Timeline: 10–14 wks, mid-point checkpoint. Commercials: €0 to the LA if grant/own-budget-funded; production band Tier-1 €120–240k only if asked. After: LOI if criteria met.

LOI checklist (key items): parties (institution + founder in own name pending NewCo, s.45 ratification); statement of intent (proceed with next-phase pilot, conditional on funding/procurement); scope carried from pilot; success-criteria reference; named sponsor + budget owner; indicative timeline; indicative commercials ("to be scoped under [OGP/sub-OJEU]"); Declined-List affirmation; non-binding (save confidentiality); Irish law; solicitor review confirmed before sending.

§16 — PM / timeline

Stage          M1   M2   M3   M4   M5   M6   M7   M8   M9   M10  M11  M12
First contact  ##
Free discovery   ####
Scoped demo         ####
Pilot (LCC)            ##############         (winter-2026 storm season window)
LOI                                ####
Vehicle/Stamp  ===============================>  (Stamp-1G → Stamp-4 / MAHI/Dogpatch vehicle: CRITICAL PATH)
Contract                                      ########

Milestones: M1 warm intro sent · M2 discovery sponsor named · M4 scoped demo accepted · M6 pilot start (storm season) · M9 LOI signed (Patrick-check trigger) · M12 sub-OJEU contract. Critical path: NOT the technical build — it's the legal vehicle. A solo Stamp-1G founder cannot sign a paid pilot; the Stamp-1G → Stamp-4 resolution (~t_resolve 12 mo) or a partner/Dogpatch-brokered contracting vehicle gates every paid stage. Discovery, demo and a non-binding MOU/LOI can proceed before that resolves; a paid pilot/contract cannot.

RACI:

§17 — Funding / procurement vehicle

1. Fire Services Capital Programme 2026–2030 (€328.5m, NDFEM-administered) — a discrete COP/situational-awareness procurement can be argued alongside its €10.5m National Mobilisation and Communications System line. [verified]
2. LA severe-weather / resilience capital + Community Support Centre funding (Dept of Rural & Community Development) — funds a sub-OJEU LA pilot directly. [verified — directionally]
3. Solo-accessible non-dilutive de-risk (post-incorporation only): 35% R&D Tax Credit (refundable even loss-making). Blocked pre-incorporation — Stamp-1G. EI Agile/HPSU/PSSF require EI-client/incorporated status — not solo-accessible now. [verified — eligibility]
4. Procurement route: below-OJEU-threshold scoped pilot first; OGP framework / eTenders for scale.

§18 — TWO-STAGE FORMULA SCORECARD

Stage-1 (P_LOI) — S1 = Σ wᵢ·fᵢ; P_LOI = 0.55/(1+exp(-1.15·(S1-2.6))). Every factor [PRIOR], dated 2026-06-05.

S1 = 5(.22)+3(.22)+5(.18)+5(.14)+3(.10)+2(.08)+5(.06) = 4.02 → P_LOI ≈ 0.46 (band 38–50%). ✓

Stage-2 (P_raw) — S2 = Σ vⱼ·gⱼ; P_raw = 0.70/(1+exp(-1.1·(S2-2.8))).

S2 = 1(.24)+4(.22)+2(.18)+4(.16)+4(.12)+3(.08) = 2.84 → P_raw ≈ 0.36.

Legal gate G = V·T (H_conv=30mo, t_resolve=12mo ⇒ T = (30-12)/30 = 0.60):

• V=0.10 (solo Stamp-1G, today): G=0.06 → P(Contract|LOI) ≈ 0.36×0.06 = 2.2% ; P(Contract) = P_LOI·G·P_raw ≈ 0.46×0.06×0.36 ≈ 1.0%.
• V=0.45 (Dogpatch-brokered vehicle): G=0.27 → P(Contract|LOI) ≈ 9.7%.
• V=0.75 (MAHI/partner prime): G=0.45 → P(Contract|LOI) ≈ 16.2%.
• V=1.00 (Stamp-4, incorporated, T→1.0): G=1.0 → P(Contract|LOI) ≈ 36%.

Score100 = S1·20 = 80.4. Board anchor = 77 (to-LOI 35–50%, to-buy 30–39%, value high). Reconciliation: Score100 80.4 is ~3.4 pts above the 77 anchor — within the ~5-pt tolerance; P_LOI 0.46 sits squarely in the board's 35–50% to-LOI band. No null required; reconciled. (The board's to-buy 30–39% is the V→1.0 horizon; today's V=0.10 gives the ~1% raw — the gate, not the opportunity, is the constraint.)

§19 — Commercial

• Tier-1 (one MEM region LCC COP): €120–240k/yr ACV; sub-OJEU pilot route; annual, EU-hosted, R&D-tax-credit-eligible post-incorporation.
• Tier-2 (multi-region / national NECG roll-up): €600k–1.2m/yr.
• Tier-3 (national civil-protection COP + CER resilience picture across LAs): €2.4–4.8m/yr.
• Terms: annual SaaS + sovereign-hosting; cost advantage from open-source substrate + sovereign HPC + shared conformity file + no forward-deployed-engineer dependency. Requirements: incorporated Irish trading entity (or partner vehicle) to sign; DPA per LA; data-sharing agreement for the consented register; OGP framework for scale.

§20 — Legal blockers

• X1 — Stamp-1G cap (applied): the founder cannot be a company director, operate/establish a business, or be self-employed (passive shareholding is not barred) and so cannot sign a paid contract until Stamp-4 (~t_resolve 12 mo). Mitigation: discovery + non-binding MOU now; paid pilot via a Dogpatch-brokered / partner vehicle or an EEA-resident director (Patrick/Manuel) + €25k s.137 bond for incorporation. ⚖️ CONFIRM (immigration solicitor). [verified — irishimmigration.ie]
• Buyer-specific — vulnerable-person data governance + OGP multi-body procurement: enter via a storm-hit LA (faster than central NDFEM); consented/registered data only — no inference, no individual scoring (also enforced by the person_identifier IS NULL schema CHECK). DPA + data-sharing agreement required. ⚖️ CONFIRM (data-protection solicitor).
• X2 — EU AI Act: emergency-response AI = Annex III §5(d) high-risk (emergency-call evaluation / dispatch of emergency first-response) ⇒ FRIA (Art 27), human-oversight (Art 14), Art 50 transparency on AI-composed alerts. Honour: Article 5 prohibitions applied 2 February 2025. Conformity-by-construction is the answer. [verified]
• X3 — GDPR/residency: EU-hosted; consented register count-only; DPA per buyer. [verified]
• X7 — pre-incorporation contracting: sign MOUs/NDAs in founder's own name (s.45 ratifiable). ⚖️ CONFIRM.
• Dual-use / procurement: civil-protection is not dual-use export-controlled; standard public-procurement rules apply (no Art-346 defence exemption needed — this is a civil buyer).

§21 — Warm-intro contact + the specific ask

Contact: Patrick Walsh, Founder & CEO, Dogpatch Labs — patrick@dogpatchlabs.com [verified]. The specific ask (outreach-drafts §1, ask 1): an introduction to a Severe Weather Coordinator in a storm-hit Local Authority (Galway, Mayo or Roscommon) so I can show the Storm-Éowyn replay as a responder operating picture answering Recs 3.11.6 and 3.11.7 — free discovery, no cost — and, in parallel, a line into Keith Leonard's NDFEM office. Offer to walk Patrick through the demo first so he's comfortable putting his name to it. (Patrick's conditional cheque-on-first-LOI is a genuine but conditional signal, not a commitment — confirm in writing.)

§22 — Open questions + Sources

Open questions: (1) Named NDFEM/OEP and LA-Coordinator contacts — TBD. (2) ESB PowerCheck permitted-use for a live adapter vs recorded snapshot — TBD, confirm. (3) Whether a COP procurement can ride the €10.5m ICT line or needs a separate vote — TBD. (4) Which LA has the cleanest consented vulnerable register + DPA appetite — TBD. (5) Patrick's written terms on the conditional support — TBD [unverified]. (6) Pilot baselines X/Y — TBD, set in pilot week 1.

Sources (dated 2026-06-05):

• Review of Storm Éowyn response published 21 Oct 2025 — gov.ie/.../review-of-storm-éowyn-response-published [verified]
• Fire Services Capital Programme 2026–2030 €328.5m incl. €10.5m National Mobilisation and Communications System — fireireland.ie; localauthoritynews.ie (13 Apr 2026) [verified]
• NDFEM role + National Director Keith Leonard — gov.ie NDFEM organisation page [verified]
• Ireland disaster-management system (OEP, Government Task Force, NECG) — civil-protection-humanitarian-aid.ec.europa.eu/.../ireland_en [verified]
• MapAlerter is a public-alerting tool across 23 LAs; no responder COP / cross-agency fusion in its published feature set (our assessment) — mapalerter.ie [verified — usage count; COP gap is our assessment]
• National Strategy on the Resilience of Critical Entities 2026–2029 (published 19 March 2026, Dept of Defence) — gov.ie OEP CER page [verified]
• ESB peak 768,000 customers / "unprecedented" — Review of Storm Éowyn; ESB statements [verified]
• EU AI Act Art-5 applied 2 Feb 2025; Annex III §5(d) emergency-call evaluation / dispatch high-risk [verified]

---