Nexus Synergy Engagement Package — C04 · HSE / National Ambulance Service (NEOC) — multi-agency major-incident coordination (entry via NDFEM/NECG)

STATUS HONESTY. Nexus Synergy Ltd is pre-incorporation, pre-revenue, pre-pilot. The HSE / National Ambulance Service (and NDFEM/NECG as the multi-agency front door) is a TARGET, not a customer; nothing here is deployed and there is no confirmed warm intro to an HSE Emergency-Management buyer today. The ~178 product UI surfaces exist as a gallery, not a live system; the major-incident COP over live NAS/agency feeds is not built or proven. ANTI-COOKIE-CUTTER. The two mockups in §8 are programmatically generated ASCII (_build/archetypes/gen_hse-nas-major-incident.py, alignment-guarded by _ck()), filled with this buyer's real entities, sites, framework, feeds and the synthetic comms-failure decision — not a reused shell. PROBABILITIES. Every probability in this file is a [PRIOR] — a subjective pre-pilot estimate for prioritisation, not a forecast. Re-score after every real conversation.

---

§0 — Header & one-line thesis

Nexus Synergy for the HSE / National Ambulance Service NEOC: a sovereign, multi-agency Major-Incident Common Operating Picture that sits above NAS's existing CAD/AMPDS/GPS dispatch — fusing agency assets, sites, hazards, weather, road/rail status, comms state and a coarse hospital-ED operational traffic-light into one human-gated, fully-audited shared picture across the three Principal Response Agencies, and that keeps working when TETRA and telecoms fail (the exact gap Storm Éowyn and the 2021 Conti attack both exposed).

Wedge: a major-incident multi-agency coordination COP above the dispatch layer. Durable expansion: national emergency-medical / civil-protection coordination. The decline-safe slice is the whole product here: coordination and operating-picture only — never clinical triage automation, patient profiling, or Art.9 health data. Demo: a storm-replay variant — a major-incident comms-failure scenario on synthetic, non-clinical data, mirroring the Éowyn mandate.

---

§1 — Entity snapshot (cited from the target card)

• Health Service Executive (HSE) — Ireland's national public health service — and its pre-hospital operational arm, the National Ambulance Service (NAS). (target card §1) [verified]
• National Emergency Operations Centre (NEOC) — NAS's 24/7 single call-and-dispatch operation across two sites: Tallaght (Co. Dublin) and Ballyshannon (Co. Donegal); ~240 staff handling ~435,000 calls/yr. It runs advanced Computer-Aided Dispatch (CAD), GPS vehicle tracking, the Advanced Medical Priority Dispatch System (AMPDS) and an integrated statewide TETRA radio network; NEOC is an IAED Accredited Centre of Excellence (ACE) (top ~10% of control rooms worldwide). (neoc.ie; HSE NAS / Wikipedia; Health Manager 2022) [verified]
• Major-incident role: Under the national Framework for Major Emergency Management (MEM) (developed 2005; adopted by Government decision 2006), the HSE is one of three Principal Response Agencies (PRAs) alongside An Garda Síochána and the local authorities. NAS "normally provides the first HSE response to a Major Emergency." The Framework mandates a co-ordinated response at three levels — on-site, local, and regional — and establishes eight MEM Regions, each with a Regional Steering Group (RSG) of senior PRA personnel. (gov.ie MEM Framework; gov.ie "Major emergency management: your questions answered"; citizensinformation.ie) [verified]
• National-level structure: Whole-of-government severe-weather / national emergencies run through the National Emergency Co-ordination Group (NECG), chaired via the National Directorate for Fire and Emergency Management (NDFEM) in the Dept of Housing, Local Government & Heritage, with the HSE/NAS a standing participant. (gov.ie NECG / Storm Éowyn) [verified]
• Why NDFEM/NECG is the cleaner door: a pilot scoped at the multi-agency level (NDFEM/NECG/Regional Steering Group) spans all three PRAs without entering the HSE clinical-data estate — which is exactly what keeps this opportunity off the Art.9 / DPC trap (see §3, §20). We sell the coordination layer, not a health-IT system. (target card §4) [verified]

---

§2 — The pain (web-verified, dated, cited)

Two dated, well-documented traumas plus a structural gap make this a latent buying situation — held back only by procurement speed and the absence of a warm buyer.

(a) The 2021 Conti ransomware attack — the defining trauma.

• On 14 May 2021 the Conti group encrypted >80% of HSE data, hit ~70,000 devices across ~4,000 locations and 52 hospitals, forced a full IT shutdown, and pushed hospitals back to pen and paper; NAS and hospital coordination ran on whiteboards and phones. Recovery-cost estimates run from >$100m to ~$600m; the HSE is offering €750 + €650 legal costs to 90,000+ affected individuals (potential payout >€100m). (bankinfosecurity.com; krebsonsecurity.com 2021-12; scworld.com) [verified]
• The institutional lesson is architectural: operational coordination cannot depend on a single fragile IT estate, and must degrade gracefully. It is also a permanent decline-tripwire — see §20.

(b) Storm Éowyn (24 Jan 2025) exposed live multi-agency coordination gaps.

• One of the most destructive storms on record: 184 km/h peak gusts, 768,000 electricity customers cut off (some for ~3 weeks), the largest telecoms outage in ComReg's recording history, ~380 emergency response hubs stood up. (gov.ie Review of Storm Éowyn; rte.ie 2025-10-21) [verified]
• The radio collapse is the load-bearing finding for us. During Éowyn, all the emergency services suffered a radio-communications collapse: An Garda Síochána and some Fire Brigade units across the west/north-west lost TETRA cover, the HSE suffered nationwide comms difficulties including for ambulances, and the Coast Guard had to replace ~30 VHF radio aerials. The official NDFEM review (published 21 Oct 2025) found the response protected public safety but flagged communication and coordination weaknesses — people were "confused about who to contact" — and recommends satellite-based backup communications for fire brigades, the National Ambulance Service, and the Coast Guard. (thejournal.ie 2025-01 "all emergency services suffered a radio communications collapse"; donegaldaily.com 2025-10-22; rte.ie 2025-10-21; gov.ie Review of Storm Éowyn) [verified]
• The review also pushes toward better situational awareness, comms resilience, advising the public to survive 72 hours without services, and faster humanitarian-hub activation — the precise COP + degraded-comms gap. (irishtimes.com 2025-10-21; agriland.ie) [verified]

(c) Structural fragmentation — no shared live picture.

• Three PRAs (HSE/NAS, Gardaí, local authorities) plus utilities (ESB, Uisce Éireann), the Coast Guard, Defence Forces and Met Éireann each hold their own operational picture. The MEM Framework standardises process but there is no shared, live, multi-agency common operating picture all parties see in real time during a mass-casualty or severe-weather surge. (gov.ie Review of Storm Éowyn; target card §2.3) [verified]

The gap our software fills: the agencies, the dispatch system and the framework all exist. What's missing is the shared, live, human-gated, audited coordination picture that survives a comms/IT failure — exactly what Éowyn's radio collapse and the 2021 pen-and-paper fallback proved is absent.

---

§3 — Use-case & value (decline-safe framing)

What we sell: a sovereign, multi-agency Major-Incident Common Operating Picture — the shared coordination, decision and task-and-assess layer that sits on top of NAS's existing CAD/AMPDS/GPS dispatch. Not a clinical system, not a CAD replacement. The ontology models agencies, assets, sites, hazards, weather, road/rail status, comms-status, logistics and tasks — never patients as data subjects.

Concrete, decline-safe capabilities mapped to the verified pain:

• Shared live COP across the PRAs. One operating picture showing NAS vehicle locations (already GPS-tracked in NEOC), hospital-ED capacity as a coarse traffic-light (green / amber / black — operational status, not patient data), staging areas, casualty clearing stations, road/rail closures, ESB outage polygons, Met Éireann warning zones, and reception-hub status — the intersection no single agency's tool surfaces today.
• EM-denied / degraded-mode operation (directly answers the Éowyn TETRA-failure finding): offline-first sync ladder, mesh/LoRa + satellite fallback, content-hash dedup — the COP keeps working when two-way radio and telecoms fail.
• Resilience to a 2021-class failure: classification-aware, on-prem / sovereign-EU deploy option; degrades to a read-only cached picture rather than collapsing to pen-and-paper.
• Closed action loop for logistics, not clinical decisions: detect (incident/surge) → enrich (weather, asset availability, ED operational status) → triage of resources/sites/routes → human-gated sign-off by a named controller → task an asset → assess → close. Conformity-by-construction: FRIA, provenance ledger, transparency portal.
• Reception-hub activation support (the Éowyn "Community Support Centre Activation Guide" recommendation): geospatial siting + status board for the 380-hub class of event.

Hard decline boundaries — stated in every conversation, and explicitly NOT any of the following:

• NOT clinical triage automation, patient-level data, or individual health-status analytics (Art.9 special category — fatal; see §20).
• NOT predictive policing, real-time biometric identification, emotion recognition, social scoring, untargeted scraping, or psychometric profiling (the Declined List — these never enter scope).
• NOT automated dispatch decisions over people; the existing CAD/AMPDS clinical path stays untouched inside HSE systems under its own legal basis.
• Hospital capacity is exposed only as a coarse, non-identifying aggregate operational status; vulnerable-person outreach (where in scope) uses consented / registered LA data only — never inference.

Value: faster, shared decision-making in the first golden hour of a mass-casualty or storm surge; resilience to comms/IT failure; and an auditable, GDPR-defensible coordination record that the DPC and an inquiry can inspect — the very thing both Conti and Éowyn showed was missing.

---

§4 — Ontology (this buyer's domain entities + relationships)

Entity types: MajorIncident (MEM-keyed; declared on-site / local / regional), ResponseAgency (the PRAs + Coast Guard + Defence Forces + utilities), Asset (NAS vehicle, Garda unit, LA crew, generator, helicopter), Site (scene, casualty-clearing station, staging area, HospitalED, reception/humanitarian hub), Hazard (RTC, flood cell, fallen-tree job, structural collapse), WeatherWarning (Met Éireann colour-coded zone), CommsLink (TETRA site, satellite-backup link, mesh node — with a state), EDStatus (a coarse green/amber/black operational signal per HospitalED), RoadRailSegment (status open/closed/diversion), CoordinationDecision (a human-gated tasking), ReceptionHub, AfterActionRecord.

Relationships: MajorIncident —coordinatedBy→ ResponseAgency (many; the multi-agency seam); MajorIncident —affects→ Site; Asset —assignedTo→ MajorIncident; Asset —tracks→ CommsLink.state; HospitalED —reports→ EDStatus (coarse only); Site —served-via→ RoadRailSegment; WeatherWarning —overlays→ Site; CoordinationDecision —authorisedBy→ namedController + —tasks→ Asset + —opens→ ReceptionHub; AfterActionRecord —reconstructs→ MajorIncident.

Temporal versioning: CommsLink.state and EDStatus are valid_from/valid_to envelopes (a status changes through the incident); MajorIncident is bitemporal (operational time of the event vs system time of the record) so the HistoryRail can replay who knew what, when, and who authorised what — the auditable reconstruction the Éowyn review asked for. The ontology has no Patient entity by construction; a HospitalED relates to the COP only through a coarse EDStatus, never a record.

---

§5 — Data model (synergy.* tables, RLS + load-bearing CHECK)

Every table carries org_id for the app.current_org_id RLS predicate (multi-tenant by agency). The load-bearing invariants enforce the two things that keep this decline-safe and human-gated: (a) a hospital-ED row can only ever carry a coarse status, never a patient field; and (b) a coordination decision cannot be marked executed without a recorded human signer.

SQL
50 lines
Copy
-- A declared major incident; the multi-agency anchor. RLS per agency tenant.
CREATE TABLE synergy.major_incident (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,                              -- RLS: app.current_org_id
    mem_region      text NOT NULL,                             -- one of the 8 MEM Regions
    declared_level  text NOT NULL CHECK (declared_level IN
                    ('on-site','local','regional','national')),-- MEM coordination levels
    declared_at     timestamptz NOT NULL,
    op_valid_from   timestamptz NOT NULL,                      -- bitemporal: operational time
    sys_recorded_at timestamptz NOT NULL DEFAULT now()         -- bitemporal: system time
);
ALTER TABLE synergy.major_incident ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.major_incident
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- Hospital-ED operational status: COARSE traffic-light ONLY. The DECLINE-SAFE invariant.
CREATE TABLE synergy.ed_status (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,
    hospital_code   text NOT NULL,                             -- e.g. 'MUH','UHG','SUH' (facility, not person)
    coarse_status   text NOT NULL CHECK (coarse_status IN      -- the ONLY clinical-adjacent field allowed
                    ('green','amber','black')),                -- operational capacity, NOT patient data
    patient_payload jsonb,                                     -- MUST stay null: no Art.9 data ever lands here
    valid_from      timestamptz NOT NULL,
    valid_to        timestamptz,
    -- LOAD-BEARING INVARIANT #1: the COP may never carry patient-level / Art.9 data.
    CHECK (patient_payload IS NULL)
);
ALTER TABLE synergy.ed_status ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.ed_status
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- A human-gated coordination decision (re-route, open hub, task asset). Cannot execute unsigned.
CREATE TABLE synergy.coordination_decision (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id          uuid NOT NULL,
    incident_id     uuid NOT NULL REFERENCES synergy.major_incident(id),
    action_kind     text NOT NULL CHECK (action_kind IN
                    ('re-route','open-reception-hub','task-asset','issue-local-alert')),
    proportionality numeric(4,3) NOT NULL CHECK (proportionality BETWEEN 0 AND 1),  -- 0.930
    signer_controller text,                                    -- named human controller (NEOC / RSG)
    signer_second   text,                                      -- 2-of-2 dual-control for regional level
    executed_at     timestamptz,
    merkle_leaf     bytea NOT NULL,
    -- LOAD-BEARING INVARIANT #2: no execution without a recorded human signer (human-gated decision).
    CHECK (executed_at IS NULL OR signer_controller IS NOT NULL)
);
ALTER TABLE synergy.coordination_decision ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.coordination_decision
    USING (org_id = current_setting('app.current_org_id')::uuid);

The ed_status.patient_payload IS NULL CHECK is the schema-level expression of the decline boundary: even if an upstream HSE feed tried to push patient-derived fields, the database rejects the row. The coordination_decision CHECK makes a controller signature a precondition of execution, not a courtesy — the human gate is enforced in the data layer, not just the UI.

---

§6 — Action-loop pseudocode (detect → enrich → triage → gate → task → execute → BDA → close)

Python
46 lines
Copy
def coordinate_major_incident(incident, requesting_org):
    # 1. DETECT — a declared Major Emergency lands from NAS/NEOC + agency feeds (no clinical pull).
    if incident.declared_level not in ("on-site", "local", "regional", "national"):
        return Disposition.NOT_A_MAJOR_INCIDENT

    # 2. ENRICH — fuse the multi-agency picture: NAS GPS vehicles, Garda cordon, LA road/rail status,
    #    Met warnings, ESB outage polygons, TETRA/sat comms state, and COARSE hospital-ED traffic-lights.
    cop = fuse_cop(
        nas_vehicles   = nas_gps_feed(incident),               # already GPS-tracked in NEOC
        garda          = garda_liaison_feed(incident),
        la_roads       = la_road_rail_status(incident),
        weather        = met_eireann_warnings(incident.mem_region),
        comms          = tetra_and_satbackup_state(incident),  # Eowyn radio-failure signal
        ed_status      = coarse_ed_traffic_lights(incident))   # green/amber/black ONLY, never patient data

    # 3. TRIAGE — of RESOURCES/SITES/ROUTES, never of people. Surface the cross-agency intersection.
    cluster = triage_cluster(cop, predicate=lambda s:
        s.scene_comms_dark and s.nearest_ed == "black" and s.casualty_count >= MAJOR_THRESHOLD)
    if cluster is None:
        return Disposition.MONITOR

    # 4. GATE — proportionality + a human controller; multi-persona Decision Room incl. civil-society.
    P = proportionality(necessity=0.96, proportionality=0.91, least_intrusive=0.92)   # = 0.93
    gate = decision_room(
        proposal  = ReRouteAndOpenCCS(cluster, to="UHG-amber", open_hub="Tuam-Town-Hall"),
        personas  = [OP_TASKING_NEOC, PROPORTIONALITY, CIVIL_SOCIETY("ICCL"),
                     DEVILS_ADVOCATE, DOMAIN_EXPERT("nas-controller")],
        threshold = P_MIN_REGIONAL,
        scope_guard = COARSE_ED_STATUS_ONLY)                   # asserts no Art.9 field in the bundle
    if not gate.passed:
        return Disposition.REFUSED(gate.rationale)

    # 5. TASK + EXECUTE — DB CHECK forbids execute without a named signer; 2-of-2 at regional level.
    signers = human_sign(controller="neoc.duty.controller", second="rsg.chair")
    task_assets(cluster.nas_units, route="N84", destination="UHG")  # re-route, not a clinical decision
    drop_reception_hub_pin("Tuam-Town-Hall", generator_backed=True)
    geofence_staging_area(cluster.scene)
    # comms-resilient delivery: if TETRA is down, fall back to satellite + mesh (Eowyn finding).
    dispatch_over_resilient_link(cop, prefer="tetra", fallback=["satellite", "lora-mesh"])

    # 6. BDA — operational outcome, counts only (casualties accounted, link held). No patient analytics.
    bda = capture_bda(casualties_accounted="22/22", satlink_held=True, ed_reroute_confirmed=True)

    # 7. CLOSE — seal the bitemporal HistoryRail audit (who knew what, when, who authorised what).
    seal_after_action_record(incident, gate, signers, bda)     # PROV-O chain, Merkle-anchored
    return Disposition.CLOSED(incident, bda)

---

§7 — nexus-workflows YAML DAG (same loop, declarative, blocking human-gate)

YAML
45 lines
Copy
# nexus-workflows DAG: hse_nas_major_incident_cop_v1  (NO cron — event-triggered only)
name: hse_nas_major_incident_cop_v1
trigger:
  event: major_emergency_declared          # from NAS/NEOC + agency feeds; never a clinical event
on_error: hold_and_alert_controller
nodes:
  - id: detect
    run: synergy.cop.ingest_major_incident
    out: incident
  - id: enrich
    run: synergy.cop.fuse_multiagency_picture
    needs: [detect]
    with:
      sources: [nas_gps, garda_liaison, la_road_rail, met_warnings, esb_outage,
                tetra_satbackup_state, coarse_ed_status]   # ed_status is traffic-light only
    out: cop
  - id: triage
    run: synergy.cop.triage_resource_cluster              # of sites/routes/assets, NOT people
    needs: [enrich]
    out: cluster
  - id: human_gate                                        # <<< BLOCKING human-gate node >>>
    type: manual_decision
    blocking: true
    needs: [triage]
    assignee_role: neoc_duty_controller
    second_signer_role: rsg_chair                         # 2-of-2 at regional level
    decision_room:
      personas: [op_tasking_neoc, proportionality, civil_society_iccl,
                 devils_advocate, domain_expert_nas]
      threshold: P_MIN_REGIONAL
      scope_guard: coarse_ed_status_only                  # rejects any Art.9 field
    on_reject: { run: synergy.cop.log_refusal, out: closed }
  - id: task_execute
    run: synergy.cop.task_assets_and_open_hub
    needs: [human_gate]
    with:
      delivery: { prefer: tetra, fallback: [satellite, lora_mesh] }   # Eowyn comms-resilience
    out: tasked
  - id: bda
    run: synergy.cop.capture_bda                          # counts only; no patient analytics
    needs: [task_execute]
    out: bda
  - id: close
    run: synergy.cop.seal_after_action_record            # bitemporal PROV-O audit, Merkle-anchored
    needs: [bda]

---

§8 — UI/UX mockups (verbatim generated ASCII)

The two blocks below are the exact stdout of python3 _build/archetypes/gen_hse-nas-major-incident.py — generated, alignment-guarded, never hand-typed.

Figure C04.1 — command_dashboard (PRIMARY). The NEOC multi-agency coordination surface: ShellLayout + TopBar with PccPill in rightSlot + LeftSidebar over a KPI-tile row (agencies-on-COP · comms-dark/TETRA-down · coarse ED status) above a per-agency incident timeline and a right-column LIVE ALERT FEED, with HistoryRail, BottomStatusBar and ClassificationBanner. The RendererChip reads CommandDashboard (no map-bearing primary); ChromeChip toggles to the Map surface.

Figure — Command dashboard (KPI + live feed). Production-fidelity React surface (buildable); the faithful ASCII follows.

+--------------------------------------------------------------------------------------------------+
| NEOC Major-Incident Coordination COP - Storm-comms-failure replay (command_dashboard)            |
+--------------------------------------------------------------------------------------------------+
| AGENCIES ON COP                | COMMS-DARK AREAS               | ED STATUS (coarse)             |
| HSE/NAS + Garda + 3 LAs        | TETRA down: 4 sites            | 1 BLACK / 2 AMBER              |
| + CG + ESB + Met live          | sat-backup: 2 of 4 up          | operational not clinical       |
+--------------------------------------------------------------------------------------------------+
| LIVE ALERT FEED                                                                                  |
|  07:02  NEOC: bus + HGV RTC N17 Tuam, ~22 casualties; Major Emergency declared (regional)        |
|  07:05  TETRA secure-comms DOWN: Tuam/Claremorris masts; NAS+Garda on sat-backup fallback        |
|  07:08  COP fuses: NAS GPS vehicles + Garda cordon + LA road-closure + Met orange wind           |
|  07:11  Triage cluster: scene comms-dark AND nearest ED (Mayo Univ Hosp) status=BLACK            |
|  07:14  Decision Room: re-route 6 casualties Galway(UHG, AMBER) + stand up CCS - SIGNED 2/2      |
|  07:16  Write-back: CCS pin dropped, staging area geofenced; NAS+CG tasking acknowledged         |
|  07:22  Reception/humanitarian hub Tuam Town Hall OPEN (gen-backed); welfare desk live           |
|  07:31  BDA: 22/22 casualties accounted; sat-backup link held; HistoryRail audit sealed          |
+--------------------------------------------------------------------------------------------------+

Figure C04.2 — map_ops (SECONDARY). The on-site / local field picture the on-scene Controller and NEOC share: MapConsole + MapLibre-2D with a LAYERS registry (NAS vehicles, Garda cordon, LA road status, coarse ED status, TETRA coverage, sat-backup links, Met/ESB overlays, reception hubs), the storm-replay scrubber, and an INCIDENTS ticker — Inspector opens on a selected site. ED status is a coarse traffic-light, never patient data.

Figure — Operational picture (map_ops · live MapLibre). Production-fidelity React surface (buildable); the faithful ASCII follows.

+------------------------------------------------------------------------------------------------------+
| West/NW On-Site Major-Emergency Picture - comms-failure replay (MapConsole + MapLibre-2D)            |
+--------------------+---------------------------------------------------------------------------------+
| LAYERS             | MAP  ========================================================================== |
| [x] NAS vehicles   |   West / North-West Region (MEM Region) - Regional Steering Group lead          |
| [x] Garda cordon   |   |   ### MET ORANGE wind 06:00-14:00 ### TETRA secure-comms: 4 sites DOWN      |
| [x] LA road status |   |                                                                             |
| [x] ED coarse stat |   X SCENE N17 Tuam: bus+HGV RTC ~22 casualties | COMMS DARK <!>                 |
| [x] TETRA coverage |   |   NAS x4 on scene (GPS) | Garda cordon set | CCS staging                    |
| [x] Sat-backup     |   o MAYO UNIV HOSP (Castlebar)  ED status = BLACK (no new arrivals)             |
| [x] Met warnings   |   |   >> nearest ED BLACK + scene comms-dark = re-route decision                |
| [x] ESB outage     |   o UNIV HOSP GALWAY (UHG)      ED status = AMBER (accepting)                   |
| [~] Reception hubs |   |   re-route 6 priority casualties UHG via N84 (LA road OPEN)                 |
| [ ] Casualty stns  |   o SLIGO UNIV HOSP             ED status = GREEN (reserve)                     |
|                    |   |   N17 blocked at scene: LA diversion via R332 (crews tasked)                |
| REPLAY             |   o TUAM TOWN HALL  Reception/humanitarian hub OPEN (gen-backed)                |
| comms-failure var  |                                                                                 |
| [<<] t+07:14 [>>]  |   TRIAGE: scene comms-dark n nearest-ED BLACK n 22 casualties                   |
|                    |   ED status is COARSE operational traffic-light - NOT patient data              |
| SOURCES            |   Proportionality P=0.93 | HUMAN SIGN-OFF required before re-route              |
| NAS CAD/GPS feed   |   [ Open Decision Room ]  [ Hold + re-poll 10m ]  [ Drop CCS pin ]              |
| Garda liaison      |                                                                                 |
| Met Eireann WX     |                                                                                 |
| ESB PowerCheck     |                                                                                 |
+--------------------+---------------------------------------------------------------------------------+
| INCIDENTS: 07:14 MUH ED BLACK | TETRA 4 sites down (sat-backup 2 up) | re-route 6 -> UHG | CCS stage |
+------------------------------------------------------------------------------------------------------+

Bespoke SVG of the primary surface: _build/figures/hse-nas-major-incident/uc-command_dashboard.svg.

---

§8b — Field-unit (Pixel) surfaces

The same scenario on the Pixel 10 Pro Fold field unit (Nexus Field app), tightly coordinated with the dashboard COP above — command pushes the task, the unit accepts + ACKs, shares position and reports back to the COP. Built on the same synergy.field_unit / field_task / field_report contract; see §9 and the cluster coordination composite.

Figure §8b.1 — Folded cover · tasking glance (ground_glance): the incoming IMMEDIATE task, ACCEPT + ACK, alert chips, bearing-to-objective.

Figure §8b.2 — Unfolded inner display · field COP: two-pane mini-map + task list + teammate roster + air/command coordination + PTT, with the Material-3 NavigationBar + Report FAB.

§9 — UI/UX flow (the literal click-path)

Click-path (one human-gated decision): on the CommandDashboard, the COMMS-DARK AREAS tile flips red as the TETRA-down feed lands → the controller clicks the TRIAGE row in the LIVE ALERT FEED (comms-dark ∩ nearest-ED BLACK ∩ 22 casualties) → ChromeChip toggles to the map_ops on-site picture, the controller selects the SCENE N17 Tuam marker, Inspector shows the nearest-ED traffic-light (MUH = BLACK, UHG = AMBER) → [ Open Decision Room ] docks the ChatTerminal persona transcript on the right → the controller reads dissent, then [ /dual-control sign 2/2 ] (NEOC duty controller + RSG chair) arms the re-route → [ /execute ] tasks 6 NAS units to UHG via N84, [ Drop CCS pin ] opens the Tuam Town Hall reception hub → the action lands on the HistoryRail with a sealed PROV-O audit entry the operator can scrub back through.

CommandDashboard ──(TETRA-down tile red)──> LIVE ALERT FEED [TRIAGE row]
        │
        ▼ ChromeChip: Dashboard ⇄ Map
   map_ops on-site picture ──select SCENE──> Inspector (coarse ED traffic-light)
        │
        ▼ [ Open Decision Room ]
   ChatTerminal Decision Room ──[ /dual-control sign 2/2 ]──> [ /execute ]
        │
        ▼ task re-route + drop CCS pin + resilient-link dispatch
   HistoryRail (sealed PROV-O audit · bitemporal replay)

---

§10 — Decision-Room transcript (the gated decision)

The Decision Room convenes once the triage cluster lands (scene comms-dark ∩ nearest-ED BLACK ∩ 22 casualties). Hosted in the right-docked ChatTerminal of the NEOC duty controller's session. The civil-society reviewer is seated inside the decision, not consulted afterward.

> EU-RESTRICTED · OFFICIAL-SENSITIVE · multi-agency COORDINATION COP — no patient data <
[ Decision Room — MAJ-INC West/NW · re-route + reception-hub · t+07:14 ]

* Op-tasking (NEOC controller)  [L3 Mistral-Large · sovereign-EU]
  Re-route 6 priority casualties from scene to UHG (AMBER); Mayo Univ Hosp ED is
  BLACK (no new arrivals). Stand up reception hub at Tuam Town Hall (gen-backed).
  Task 6 NAS units via N84 (LA confirms OPEN). [ObsLvl 4 / DialLvl 4]

* Proportionality  [L3 EuroLLM]
  P = 0.93 [N 0.96 · P 0.91 · L 0.92]. Necessity: live multi-casualty + TETRA failure.
  Least-intrusive: COP carries coarse ED traffic-light only — no patient data crosses.
  Proportionate: re-route is a logistics decision, not a clinical one.

* Civil-society reviewer [ICCL]
  Confirm scope guard: ED status must stay coarse green/amber/black. No Art.9 health
  field may enter the COP or the audit bundle. Vulnerable-person outreach, if used,
  must run on CONSENTED LA registers only — no inference. ObsLvl 3. Logged.

* Devil's advocate  [L2 Mistral-7B · local]
  DISSENT: what if UHG flips AMBER->BLACK before the convoy arrives? Then we have
  re-routed into a closing ED. Counter: hold a 10-min re-poll trigger on UHG status
  and pre-stage SUH (GREEN, reserve) as fallback. Adopted into the plan.

* Domain expert (NAS controller)
  Confirm: TETRA is down at 4 sites; dispatch the tasking over SATELLITE-BACKUP +
  mesh, not radio. The Éowyn review's exact failure mode — we are testing the fix.

[ GATE VERDICT: ACCEPT — P=0.93 >= P_min(regional) · 2-of-2 dual-control armed ]
[ /dual-control sign: NEOC-Duty-Controller + RSG-Chair ]   [ /execute ]   [ Refuse + log ]

The devil's advocate's UHG-flip objection changed the plan (added the 10-minute re-poll + SUH fallback); the civil-society reviewer's scope guard pins the coarse-status boundary into the audit record. Both are load-bearing, not theatre.

---

§11 — Write-back + BDA + PROV-O + deltas-only regulatory traceback

Write-backs (three, all logistics — never clinical): (a) asset tasking → 6 NAS units re-routed to UHG via N84, acknowledged over satellite-backup link (TETRA down); (b) reception-hub activation → Tuam Town Hall pin dropped, generator-backed, welfare desk live (the Éowyn Community-Support-Centre recommendation); (c) staging-area geofence → casualty-clearing station boundary written to the COP for all PRAs to see. Lawful basis = GDPR Art.6(1)(e) public-interest task; no Art.9 data in any write-back (the ed_status.patient_payload IS NULL CHECK enforces it).

BDA (loop close): counts only — 22/22 casualties accounted, satellite-backup link held through the incident, ED re-route confirmed by UHG operational status. ObservationLevel = 4 (controller-confirmed). ProspectiveItem registered: prospective.mem.after_action_W_NW_followup — re-poll agency feeds at +24h for the regional debrief, auto-close at +14d.

PROV-O attribution chain: detect(MajorIncident-N17-Tuam) wasGeneratedBy NAS-NEOC-feed → enrich(fuse-COP) wasAssociatedWith synergy.cop.fuse_multiagency_picture → triage(comms-dark∩ED-BLACK cluster) wasAssociatedWith L3-Mistral-Large-Op-tasking → triage(proportionality) wasAssociatedWith L3-EuroLLM → triage(civil-society) wasAssociatedWith L3-ICCL-reviewer → gate-signature(2-of-2) wasAttributedTo NEOC-Duty-Controller + RSG-Chair → execute(re-route + CCS-open) wasAssociatedWith nexus-workflows.cop.task_assets_and_open_hub → execute(resilient-dispatch) wasAssociatedWith satellite-backup-link → BDA(22/22 accounted) wasGeneratedBy NAS-NEOC + UHG-status → close(after-action-seal) wasAttributedTo RSG-Chair. Merkle-anchored; bitemporal so the HistoryRail replays who knew what, when.

Regulatory traceback (deltas only — what differs from the §4.0 civilian-COP default):

• GDPR Art.9 — deliberately not engaged: the COP carries no special-category health data by construction (the CHECK). This is the single most important delta vs a clinical system, and the reason the opportunity is decline-safe.
• EU AI Act — the major-incident COP is a coordination/resilience tool; AI Act Article 5 prohibitions (applicable 2 February 2025) are not in play because the Declined-List capabilities never enter scope; FRIA + Art.14 human-oversight (the dual-control gate) carried as conformity-by-construction. (Honour: AI Act Art.5 applicable 2 Feb 2025, NOT 2 Aug 2025.)
• NIS2 — relevant only to the platform's own security posture and any critical-infrastructure classification, not to the coordination decision itself.
• MEM Framework — the on-site/local/regional declaration levels and the Regional Steering Group sign-off map directly onto the declared_level + dual-control gate; the COP is an instrument of the existing framework, not a substitute for it.

---

§12 — Buyer & stakeholders

• Economic buyer / sponsor (likely): HSE National Director / Assistant National Director for Emergency Management; NAS Director / NEOC operations for the ambulance-coordination slice. [Named contact TBD — do not invent; verify current post-holders before outreach.]
• Cross-agency convener (the cleaner door): NDFEM (Dept of Housing, Local Government & Heritage) — owns the MEM Framework, chairs the NECG; the natural home for a multi-agency COP spanning all three PRAs, and the route that avoids the HSE clinical-data trap entirely. The Government Task Force on Emergency Planning progresses the Éowyn-review recommendations. [Named contact TBD.]
• Influencers / gatekeepers: HSE DPO and Office of the CIO / cyber (post-2021, security and data-protection sign-off is heavy and non-negotiable); NCSC-IE for any critical-infrastructure classification.
• End users: NEOC controllers, on-site incident commanders, local-authority emergency managers, Garda and Coast Guard liaisons, RSG chairs.

---

§13 — Competition / incumbency + comparator

• NAS dispatch is already tooled — advanced CAD + AMPDS + GPS, IAED ACE-accredited. We do not touch dispatch; we sit above it as the multi-agency picture. Framing as a CAD replacement would lose the deal. (neoc.ie) [verified]
• Esri Ireland is the EM-mapping incumbent in Irish emergency management, and Dublin Fire Brigade signed a new Esri deal in Jan 2026 (per the sibling DCC/LGMA package), so an Esri ArcGIS-based situational-awareness baseline is present in the ecosystem. (dcc-lgma target card; package spec decline_note) [likely] Our differentiator is not a basemap — it is the human-gated action loop + degraded-comms resilience + conformity-by-construction audit above whatever basemap exists.
• Comparator — Esri ArcGIS for Emergency Management vs Nexus Synergy. Esri wins on map depth, install base and integrator ecosystem. Honest delta — Wins: sovereign-EU / on-prem-capable deploy (the post-2021 cyber-sensitivity edge); a Decision Room with a seated civil-society reviewer is a category Esri does not have; EM-denied / satellite-backup degraded-mode operation answers the Éowyn radio-failure finding directly; bitemporal PROV-O audit for inquiry-grade reconstruction. Losses: Esri's basemap/GIS maturity and a decade of EM-operational references; our pre-pilot status. Ties: open-standard map layers — neither party has a moat there. We integrate above the GIS, we do not rip-and-replace it.
• Incumbency risk: big-SI inertia (existing HSE IT vendors) and "we already have process under the MEM Framework" complacency. Counter: process ≠ a live shared picture; Éowyn proved the gap, and the radio collapse proved the resilience gap.

---

§14 — Readiness (honest, pre-pilot)

• Pre-incorporation, pre-revenue, pre-pilot. ~178 UI surfaces exist as a gallery; the COP map, ontology, action-loop and degraded-comms architecture are designed and partially built, not field-proven.
• Reuse (real): the storm-replay COP on /synergy-console — MapConsole triple-renderer, the COP entity model + /api/v1/cop/picture, the HistoryRail bitemporal playback/audit, dropped-pin/map-object CRUD (CCS + generator drops), ChatTerminal Decision Room, PccPill, the EM/COP route work. The command_dashboard and map_ops archetypes are the two surfaces this case actually uses. (storm-replay-cop-demo.md) [verified design intent]
• Real gaps: (1) the multi-agency feed adapters (NAS GPS, Garda liaison, LA road/rail, coarse ED status) are not built; (2) the satellite-backup / mesh degraded-comms path is architected, not demonstrated end-to-end; (3) post-2021 the HSE will demand serious security assurance (pen-test, ISO 27001-class controls, NCSC posture) before any environment access — we are not there yet; (4) no confirmed warm intro to an HSE EM or NDFEM buyer — the single biggest weakness.
• Decline-safety is a readiness asset, not just a constraint: the multi-agency-only scoping removes the Art.9 blocker that would otherwise stall us in DPC review for months.

---

§15 — ENGAGEMENT PLAYBOOK (first-contact → signed contract)

Stage 1 — First contact.

• Trigger: the storm-replay demo is built (the comms-failure variant) AND a route to NDFEM/NECG or the Government Task Force on Emergency Planning is identified. Owner: Founder.
• Activity: approach via the multi-agency door, not HSE-clinical. Test Patrick Walsh's state/semi-state network for a Dept official or Dogpatch govtech connection; in parallel, approach NDFEM via the Emergency-Planning Task Force angle.
• Script (warm-intro email, adapted from outreach-drafts §3): "We build an EU-sovereign common-operating-picture and decision platform, and we run a free discovery session: we map your current multi-agency operating picture and where decisions stall when comms fail, no cost, no obligation. If useful, we show a faithful Storm-Éowyn-style comms-failure replay with a single human-gated, fully-audited decision. We publicly refuse predictive policing, biometric ID and individual risk-scoring — this is operational coordination and resilience, human-gated and auditable, with no patient data. Could I show you 20 minutes?"
• Exit criterion: a named NDFEM / HSE-EM / RSG contact agrees to a discovery call. Deliverable: a logged contact + agreed date.

Stage 2 — Free discovery (60-min agenda, adapted).

• Trigger: discovery call scheduled. Owner: Founder. Activity (no slides):
  • 0:00–0:05 frame + permission; confirm we stay at unclassified abstraction and multi-agency, no-Art.9 scope.
  • 0:05–0:20 the current operating picture: "Walk me through Éowyn from the moment the radios failed — how many systems did you check to get one picture? Where did coordination stall?"
  • 0:20–0:35 governance + lawful basis: "Confirm the COP touches no patient data — coarse ED status only. Where must the data and AI run for your mandate?"
  • 0:35–0:45 stakeholders/budget/timing: "Who owns this — NDFEM, HSE-EM, the RSG? Is there an Éowyn-remediation or Emergency-Planning Task Force programme this sits under?"
  • 0:45–0:55 map their loop onto detect→enrich→triage→gate→task→execute→assess→close; find the comms-failure + shared-picture gap.
  • 0:55–1:00 reflect top 3 pains; ask for a scoped demo date. Do not ask for money/contract here.
• Exit criterion: sponsor agrees there is a problem worth solving + Declined-List check PASS. Deliverable: a same-day discovery write-up (sponsor, top-3 pains, lawful basis, the action-loop gap, funding hint).

Stage 3 — Scoped demo.

• Trigger: sponsor asks to see it on their kind of event. Owner: Founder. Activity: the storm-replay comms-failure variant on synthetic, non-clinical data — show the cross-agency triage cluster, the Decision Room with the seated ICCL reviewer, the satellite-backup degraded-comms fallback, and the sealed HistoryRail audit. Lead with the differentiators that match their qualification answers (sovereignty at the model-call boundary; conformity-by-construction; the coarse-ED scope guard).
• Exit criterion: "could we try this on a narrow, real slice as a short pilot?" Deliverable: the one-page pilot proposal (Stage 4).

Stage 4 — Pilot (one-page proposal, filled for this buyer).

• Title & sponsor: "Multi-Agency Major-Incident COP — comms-resilience pilot" · sponsor: NDFEM/HSE-EM lead + RSG chair [named TBD].
• The one thing we prove: "A shared, human-gated multi-agency operating picture remains usable and auditable through a simulated TETRA/telecoms failure, and surfaces the comms-dark ∩ ED-status cross-agency cluster faster than the current per-agency tools." (baseline X→Y TBD, set in pilot week 1).
• Scope in: the command_dashboard + map_ops surfaces, synthetic Éowyn-class data, coarse ED status, the satellite-backup fallback, one human-gated decision + audit. Scope OUT (explicit): any clinical/patient data, dispatch automation, biometrics, predictive scoring — and every Declined-List item.
• Data & lawful basis: synthetic / open data only; GDPR Art.6(1)(e); EU-hosted; coarse-status-only scope guard. Success criteria: convene-to-decision time, comms-failure continuity, audit completeness (2–4 metrics, sponsor-agreed). Timeline: 6–12 weeks, mid-point checkpoint. Commercials: €0 to the institution if grant-funded; else TBD. Funding vehicle: Éowyn-remediation / Emergency-Planning Task Force innovation-procurement, or an EU civil-protection co-fund (verify live calls). After: an LOI/MOU if criteria met.
• Exit criterion: success criteria met or credibly trending. Deliverable: pilot results pack.

Stage 5 — LOI / pilot MOU (the milestone — triggers the Patrick check).

• Trigger: pilot criteria met. Owner: Founder + solicitor. Activity: capture documented intent using the non-binding MOU template (outreach-drafts §4) with the Declined-List affirmation and no-Art.9 clause. LOI checklist: parties (founder in own name pending NewCo, s.45 ratification) · statement of intent · scope · success criteria referenced · named sponsor · indicative timeline · indicative commercials ("to be scoped under [OGP/eTenders / innovation-procurement]") · conditions (security accreditation, DPA, funding) · binding vs non-binding (default non-binding except confidentiality) · Irish governing law · Declined-List + no-Art.9 affirmation · signatures · solicitor review confirmed.
• Exit criterion: signed MOU naming a sponsor + next step. Deliverable: the signed LOI/MOU.

Stage 6 — Signed contract.

• Trigger: funded route confirmed (Éowyn-remediation programme or OGP/eTenders framework) AND a partner contracting vehicle is in place (Stamp-1G means the solo founder cannot sign a paid contract — §16, §20). Owner: partner vehicle + buyer procurement. Activity: contract under the agreed procurement route; security accreditation runs in parallel. Exit criterion: executed contract. Deliverable: signed contract + production scope.

---

§16 — PM / timeline (Gantt, milestones, critical path, RACI)

                         2026                              2027
            Q3        Q4            Q1        Q2        Q3        Q4
Stage    | Jul Aug Sep|Oct Nov Dec |Jan Feb Mar|Apr May Jun|Jul Aug Sep|Oct...
---------+-----------+------------+-----------+-----------+-----------+------
S1 first | ####      |            |           |           |           |
 contact |           |            |           |           |           |
S2 disc. |   ####    |            |           |           |           |
S3 demo  |     ######|##          |           |           |           |
S4 pilot |           |   #########|#####      |           |           |
S5 LOI   |           |            |     ######|##         |           |  <- LOI milestone (Patrick check)
*VEHICLE*|========(partner-vehicle / Stamp-4 gate -- CRITICAL PATH for PAID pilot)========|
S6 ctrct |           |            |           |       ####|##########|######

• Milestones: M1 storm-replay comms-failure demo built (Q3 2026); M2 named NDFEM/HSE-EM contact (Q3–Q4 2026); M3 discovery PASS (Q4 2026); M4 pilot scoped + funded (Q1 2027); M5 signed LOI/MOU — the Patrick-check trigger (Q2 2027); M6 signed contract (Q4 2027–2028, ~16-mo resolve horizon per spec).
• Critical path: the Stamp-1G / partner-vehicle gate is critical for any PAID pilot or contract — a solo founder on Stamp 1G cannot sign or invoice (§20). The non-dilutive free-discovery → MOU motion proceeds without it, but the paid contract cannot. This gate, not the buyer's interest, is the binding constraint on revenue.
• RACI:

---

§17 — Funding / procurement vehicle

• Production buy: Irish public-sector ICT flows through the Office of Government Procurement (OGP) and eTenders, typically via pre-qualified framework agreements (ICT + Health portfolios); above-threshold buys trigger full OJEU-style tenders — slow (12–24+ months). (ogp.gov.ie; etenders.gov.ie) [verified]
• Faster wedge: a funded pilot / proof-of-concept under the Éowyn-remediation programme (driven by the Government Task Force on Emergency Planning) or an innovation-procurement / pre-commercial route — small-value, below tender threshold, framed as resilience R&D. This is where an LOI/MOU is realistic.
• EU co-fund angle: EU civil-protection / resilience instruments could co-fund a cross-border-relevant COP — verify specific live calls; do not assume. (Note: EUDIS/EDF is consortium-only; not a solo route for this civilian buyer.)
• Near-term non-dilutive for the pilot itself (not the buyer's budget): Innovation Voucher (€5k, CeADAR/UCD), HPSU Feasibility (up to €30k) to fund the free-discovery phase, PSSF (up to €100k convertible). (discovery-playbook §8) [verified]
• No confirmed budget line for this exact capability today. [value: TBD]

---

§18 — Two-stage formula scorecard

All factor cells are [PRIOR] — dated pre-pilot estimates off the target card + web-verified facts (2026-06-05). Re-score after every real conversation.

Stage 1 — P(LOI). Vector {mandate_pull, access_warmth, demonstrability, decline_safety, white_space, cycle_speed, pillar_fit}:

S1 = 4(.22)+2(.22)+4(.18)+4(.14)+3(.10)+2(.08)+5(.06) = 0.88+0.44+0.72+0.56+0.30+0.16+0.30 = 3.36. P_LOI = 0.55 / (1 + exp(−1.15·(3.36 − 2.6))) = 0.55 / (1 + exp(−0.874)) = 0.55 / 1.417 ≈ 0.388 → ~30–39% [PRIOR].

Stage 2 — P(Contract | LOI). Vector {contractability, funding_to_pay, procurement_clarity, incumbency_displacement, time_to_value, reference_leverage}:

S2 = 1(.24)+2(.22)+2(.18)+4(.16)+3(.12)+2(.08) = 0.24+0.44+0.36+0.64+0.36+0.16 = 2.20. P_raw = 0.70 / (1 + exp(−1.1·(2.20 − 2.8))) = 0.70 / (1 + exp(0.66)) = 0.70 / 2.935 ≈ 0.239.

Legal gate G = V·T. V = 0.10 today (solo, Stamp 1G); T = min(1, max(0, (30 − 16)/30)) = 14/30 ≈ 0.467 (t_resolve ≈ 16 mo per spec). G_today = 0.10·0.467 ≈ 0.047.

• P(Contract|LOI)_today = G·P_raw = 0.047·0.239 ≈ 1.1%.
• At V=0.45 (Dogpatch-brokered entity): G = 0.45·0.467 ≈ 0.210 → P(Contract|LOI) ≈ 5.0%.
• At V=0.75 (partner confirmed contracting prime): G = 0.75·0.467 ≈ 0.350 → P(Contract|LOI) ≈ 8.4%.
• At V=1.0 (Stamp 4 + incorporated & trading): G = 1.0·0.467 ≈ 0.467 → P(Contract|LOI) ≈ 11.2%.

Joint P(Contract) = P_LOI · G · P_raw: today ≈ 0.388·0.047·... → ≈ 0.4%; at V=1.0 ≈ 0.388·0.112 ≈ 4.3% [PRIOR]. The decisive lever is the legal V-gate, not Stage-1 interest.

Score100 = S1·20 = 3.36·20 = 67.2. Reconciliation: the existing board anchor is 56.1 (target-card weighted 60.6; package-spec board_anchor 56). My S1·20 lands ~7–11 pts above both because the rubric rewards the strong demonstrability/pillar-fit of the reused storm-replay; I defer to the board band and report Score100 ≈ 56–60 (NEXT), flagging the gap as driven by demonstrability optimism that the access-warmth=2 reality should temper. The honest headline figures track the target card: to-LOI ~22–35%, to-purchase ~12–22% [PRIOR].

---

§19 — Commercial

• Tiering (platform bands): Tier-1 €120–240k/yr (a single coordination-centre seat / pilot-to-framework) → Tier-3 €2.4–4.8m/yr (national multi-agency emergency-coordination COP across all 8 MEM Regions + the PRAs).
• This opportunity's value band: high — a multi-agency national COP pilot → framework sits well above a single Tier-1 seat; realistic ACV path €500k–2.4m as it expands from one region/PRA to national. [PRIOR]
• ACV (illustrative): pilot €0–€150k (grant-funded preferred) → first paid framework call €250–600k/yr → national expansion toward Tier-3. [value: confirm with sponsor]
• Terms: annual SaaS / sovereign-deploy licence; EU-hosted or on-prem option; conformity file (FRIA + provenance ledger + transparency portal) included; cost advantage from open-source substrate + shared conformity file + no forward-deployed-engineer dependency.
• Requirements before a paid contract: (1) partner contracting vehicle (Stamp-1G); (2) security accreditation roadmap (ISO 27001-class, NCSC posture, pen-test); (3) a documented multi-agency-only / no-Art.9 scope + DPA; (4) a funded procurement route (Éowyn-remediation or OGP framework).

---

§20 — Legal blockers

• X1 — Stamp 1G (CRITICAL). The solo founder on Stamp 1G cannot be a director/shareholder, be self-employed, or operate a business until Stamp 4 ⇒ no paid contract signable by the solo founder. Mitigation: a partner/Dogpatch-brokered contracting vehicle now; EEA-resident director (Patrick/Manuel) or €25k s.137 bond for incorporation; pursue Stamp 4. ⚖️ CONFIRM (immigration solicitor).
• Buyer-specific — Art.9 health-data tripwire (CONDITIONAL decline-safety, FATAL if breached). The HSE is still litigating the 2021 Conti breach (€750+€650 offers to 90,000+ people). Any drift into Art.9 clinical / patient data is a DPC magnet and ends the engagement. Mitigation: the multi-agency-coordination-only scope + the ed_status.patient_payload IS NULL CHECK (coarse green/amber/black status only); get the no-Art.9 / multi-agency-only scope documented in writing up front (target-card open-question #7) so the DPO/DPC conversation is short. ⚖️ CONFIRM (Irish solicitor + DPO).
• X2 — EU AI Act. Art.5 prohibitions (applicable 2 February 2025) are avoided by the Declined-List filter; the COP is a coordination/resilience tool with FRIA + Art.14 human oversight (the dual-control gate). Per-use-case high-risk classification ⚖️ CONFIRM.
• X3 — GDPR / residency. Personal data (any vulnerable-person outreach) → consented/registered LA data only, no inference; EU-hosted; DPA per buyer. Lawful basis Art.6(1)(e). [verified regime]
• Security accreditation bar. Post-2021, environment access requires ISO 27001-class controls + NCSC posture + pen-test — a roadmap commitment, not yet met. [honest gap]
• X7 — Pre-incorporation contracting. Founder personally liable until NewCo formed; sign MOUs in own name under Companies Act 2014 s.45 (ratifiable). ⚖️ CONFIRM.
• Procurement. OGP/eTenders framework or sub-threshold innovation-procurement; OJEU above threshold. [verified]

---

§21 — Warm-intro contact + the specific ask

• Primary route — Patrick Walsh (Founder & CEO, Dogpatch Labs; patrick@dogpatchlabs.com [verified]). He is the warm-intro broker and offered a conditional cheque on a first LOI. Honest caveat: HSE/NDFEM is not obviously in his network — treat as a warm-cold hybrid.
  • The specific ask: "Patrick — does your state/semi-state or Dogpatch govtech network reach anyone in NDFEM, the Government Task Force on Emergency Planning, or HSE Emergency Management? I want one introduction to run a free discovery on the multi-agency major-incident COP — the Storm-Éowyn comms-failure replay that answers the review's situational-awareness and satellite-backup findings. Coordination only, no patient data, no cost to them."
• Secondary route: approach NDFEM / NECG directly via the Emergency-Planning Task Force angle (decline-safer than HSE-clinical, and it matches the published review's own recommendations).
• The honest gap to fix first: there is no confirmed warm intro to the actual buyer — closing that is the single highest-value next action.

---

§22 — Open questions + consolidated Sources

Open questions (verify; do not assert until resolved):

1. Named buyer: who currently leads HSE Emergency Management, and the NAS Director? [TBD — do not invent.]
2. Entry door: is NDFEM/NECG the cleaner multi-agency entry vs HSE-clinical? (Likely yes — confirm.)
3. Éowyn review specifics: pull the full NDFEM report and extract the exact COP / situational-awareness / satellite-backup recommendation wording to mirror in the pitch.
4. Funding call: is there a live funded-PoC or EU civil-protection call to attach a resilience pilot to? [TBD — do not assume.]
5. Intro reality: does Patrick/Dogpatch actually have a line into HSE-EM or a Dept official? Test early; dominates access_warmth.
6. Security bar: what assurance level (ISO 27001 / NCSC posture / pen-test) will HSE demand before any environment access?
7. Data boundary in writing: can the multi-agency-only / no-Art.9 scope be documented up front so the DPO/DPC conversation is short?

Sources (consolidated, dated 2026-06-05):

• NEOC / NAS: neoc.ie ; neoc.ie ; en.wikipedia.org ; healthmanager.ie (NEOC two sites, ~240 staff, ~435k calls, CAD/AMPDS/GPS/TETRA, IAED ACE) [verified]
• MEM Framework / PRAs: gov.ie ; gov.ie ; citizensinformation.ie (3 PRAs; on-site/local/regional; 8 MEM Regions + Regional Steering Groups) [verified]
• NECG / Storm Éowyn coordination: gov.ie [verified]
• Storm Éowyn review (NDFEM, 21 Oct 2025): gov.ie ; gov.ie ; rte.ie ; irishtimes.com [verified]
• Radio-comms collapse + satellite backup: thejournal.ie ; donegaldaily.com (all emergency services suffered a radio collapse; HSE/NAS comms difficulties; Coast Guard ~30 VHF aerials; satellite backup recommended for fire/NAS/Coast Guard) [verified]
• 2021 Conti attack: bankinfosecurity.com ; krebsonsecurity.com ; scworld.com [verified]
• Procurement: ogp.gov.ie ; etenders.gov.ie [verified]
• EU AI Act Art.5 applicable 2 February 2025 (honoured per legal-blockers register) [verified]
• Internal grounding (not external facts): target card 03-gtm/target-packages/hse-major-incident.md; storm-replay demo 03-gtm/demos/storm-replay-cop-demo.md; discovery-playbook; outreach-drafts; legal-blockers-register; contact-register; formula-worked-examples; AW theme W-31 (nexus-synergy-ei-sovereign-v2-aw-t07.md).

---