Nexus Synergy Engagement Package — E02 · EMSA (CISE Operational-Phase coordinator) + a Member-State maritime authority standing up a new CISE node — anchored on Ireland's Naval Service (Haulbowline, Co. Cork), approved to operate Ireland's CISE node (14 Apr 2025)

STANDING BANNER — read before using this package. (1) Status honesty. Nexus Synergy Ltd is pre-incorporation, pre-revenue, pre-pilot. EMSA, the Irish Naval Service, the Irish Coast Guard, EFCA and every other Member-State maritime authority named here are TARGETS, not customers, partners, or deployments. Our ~178-surface UI gallery is a gallery, not traction. Nothing here is a contract, an LOI, or a commitment. (2) Anti-cookie-cutter. The §8 mockups are generated by _build/archetypes/gen_emsa-cise-node.py and filled with this buyer's real entities (EMSA CISE Node v2 + adaptor, the four CISE operational services, SafeSeaNet/SEG, Haulbowline, the Irish EEZ, EMODnet/S-101). They are this buyer's screens, not a reused shell. (3) Every probability is [PRIOR] — a subjective pre-pilot estimate for prioritisation, never a forecast. Re-score after every real conversation.

---

§0 — Header + one-line thesis

EMSA CISE National Node — Sovereign Maritime Fusion & SAR-Dispatch COP. A sovereign, human-gated common operating picture that sits above a Member State's EMSA-provided CISE Node + adaptor: it consumes the cross-border CISE feed (the four operational services — Risk profile, Event Reporting, Area of Interest, Vessel of Interest), fuses it with the authority's own AIS / Sat-AIS / EMODnet layers, raises one anomaly, runs a human-gated Decision Room, and (only on sign-off) dispatches a coast-guard VHF challenge or SAR vector — detection-to-lawful-civil-action, not warfighting, not surveillance of people.

One line: "EMSA gives you the free CISE Node and the plumbing to share. Nobody gives you the sovereign decision layer that turns that shared feed into one human-gated, fully-audited anomaly→SAR-dispatch action loop. We sit above the node — we don't replace it."

---

§1 — Entity snapshot (cited)

The reference exercise this package is built on: SARex-2024 (1–2 October 2024, North Adriatic) — the first live operational demonstration of CISE, in which the Slovenian Maritime Administration, the Italian Coast Guard, EFCA and EMSA exchanged maritime information across the network for underwater-infrastructure protection, irregular-migration notification, and vessel-of-interest investigation, exercising all four operational services in a SAR context. [verified — EMSA, 2 Oct 2024]

---

§2 — The pain (web-verified, dated, cited)

CISE is a genuine, funded, live EU network — and exactly that maturity exposes the gap we fill: the network shares signals; it does not decide.

1. The Operational Phase is live, the node is free — and that is plumbing, not a brain. CISE entered its Operational Phase on 1 July 2024; the CISE Node v2 software and EMSA support are provided free of charge, and the build effort each Member State carries is the adaptor that maps its national legacy system to the CISE Data & Service Models — the CISE Generic Adaptor (JRC/EMSA) being open source under a BSD-3 licence. [verified — EMSA] A node that ingests and forwards messages is not a decision-support system; there is no human-gated, audited action loop in the box.

2. Ireland is joining now and has nowhere to run the picture. On 14 April 2025 the Tánaiste approved the Defence Forces formally joining CISE, with Ireland's node to be operated by the Naval Service from Haulbowline. [verified — RTÉ] Ireland's first-ever National Maritime Security Strategy (NMSS 2026-2030, Feb 2026) commits to a whole-of-government maritime picture, undersea-infrastructure protection and surveillance — while the Naval Service is crew-short and cannot continuously patrol an EEZ that is among the largest in the EU (~450,000 km²). [verified — gov.ie NMSS; Irish Times] A shared CISE feed without a sovereign decision layer above it is more inboxes, not more decisions.

3. The signals are arriving faster than the fusion. Anomaly-detection research projects (e.g. PROMENADE — AI/Big-Data vessel-behaviour anomaly detection) and the CISE-ALERT incident-alerting action are funded because raw CISE messages don't self-organise into one ranked, auditable picture; the alerting/fusion layer is the named open problem. [verified — EC Atlantic Strategy; PROMENADE]

4. Cross-authority sharing today is exercise-driven, not continuous. SARex-2024 proved CISE can fuse four authorities' inputs in a live exercise — but it remains a demonstration of plumbing reach, not a deployed product that closes the loop from a shared vessel-of-interest hit to a gated coast-guard or SAR action. [verified — EMSA]

5. The shadow-fleet / subsea-cable threat is concrete in Irish waters. ~75% of transatlantic cables transit or pass near Irish waters; shadow-fleet and AIS-dark vessels loiter over cable corridors in the EEZ — a fused-picture problem a Member State node can only partly see without a decision layer that correlates its own feeds with cross-node CISE vessel-of-interest hits. [verified — Irish Times / NMSS context]

The wedge in one sentence: Member States are getting the CISE Node (free) and the mandate (EUMSS, NMSS) faster than they are getting the sovereign decision layer that fuses the shared feed into one human-gated, cross-node, auditable anomaly→SAR-dispatch action loop.

---

§3 — Use-case & value (DECLINE-SAFE framing)

The loop we close: a Member State's CISE node receives a Vessel-of-Interest hit from a neighbouring node (e.g. FR + PT), while the authority's own layers show an AIS-dark gap and a cable-corridor loiter, and an EFCA fisheries cross-check flags the vessel outside any licensed area. Each signal is individually ambiguous; time-concurrent, they cross an anomaly threshold. Nexus Synergy fuses them, raises one alert above the CISE node, runs a human-gated Decision Room, and (only on sign-off) tasks a coast-guard VHF challenge or a SAR vector, and (where appropriate) shares the enriched picture back into CISE as an Event Report — closing the loop with a PROV-O audit chain.

Value:

• Time-to-decide collapses from messages in an inbox to one ranked anomaly with a recommended civil action — the layer the free CISE node does not provide.
• Above the node, not instead of it. We consume the EMSA Node + adaptor and the four operational services; we do not rip-and-replace EMSA's plumbing — the cheapest possible "above-the-incumbent" wedge (the incumbent is free and intended to be sat upon).
• Cross-node by design. Authority-to-authority sharing under a CISE covenant is a first-class feature, directly serving the Operational-Phase objective.

DECLINE-SAFE — explicitly out of scope (and contractually excluded):

• NO predictive policing, NO real-time biometric identification, NO emotion recognition, NO social scoring, NO untargeted scraping, NO psychometric profiling.
• This is maritime-domain awareness + infrastructure resilience + SAR: vessel tracks and infrastructure telemetry, not persons.
• The irregular-migration trap, handled explicitly. CISE can carry irregular-migration notifications between authorities. In this COP that channel stays a plain authority-to-authority notification feed — it is never turned into a person-level risk score, a profile, or a watch-list inside our layer. The disposition enum (§5) contains no value that targets persons; the escalation ceiling is a civil coast-guard challenge / SAR action against a vessel, gated by a human.
• ELINT/SIGINT and crew-identity resolution are structurally out of this COP (enforced in the data model, §5). Identity attribution is for a lawful acting authority, not for collection.

---

§4 — Ontology (this buyer's domain entities + relationships)

Entities
  CISE-Node          (EMSA Node v2; owner IE-NavalService-Haulbowline; node_id)
  CISE-Adaptor       (maps SafeSeaNet/SEG, MSSIS, Sat-AIS -> CISE Data/Service Model)
  CISE-Service-Msg   (one of: risk_profile | event_report | area_of_interest | vessel_of_interest)
  Peer-Node          (FR, PT, IT, SI, EFCA, EMSA ... the cross-border senders)
  AIS-Contact        (MMSI-keyed track; per-ping LatLon/heading/SOG; gap intervals)
  Vessel             (M/V Korall-9; flag PAN; IMO; declared manifest = transit-only)
  Cable-Corridor     (transatlantic/CELTIC cable protection polygon in the EEZ)
  Fisheries-Zone     (EFCA licensed-area polygon; licence status)
  Anomaly-Cluster    (the fused multi-signal correlation; confidence m)
  Decision           (human-gated verdict; 2-of-2 duty officers; disposition)
  Action             (coastguard_challenge | sar_vector | cise_event_share | monitor)
  Audit-Record       (PROV-O chain + Merkle seal; 7y retention)

Relationships
  CISE-Adaptor    --feeds-->          CISE-Node
  CISE-Service-Msg --received_by-->   CISE-Node   (from a Peer-Node)
  CISE-Service-Msg --references-->    Vessel       (vessel_of_interest)
  AIS-Contact     --emitted_by-->     Vessel
  AIS-Contact     --proximal_to-->    Cable-Corridor / Fisheries-Zone
  Anomaly-Cluster --fuses-->          {vessel_of_interest msg, AIS-dark gap,
                                       cable-loiter, EFCA fisheries flag}
  Anomaly-Cluster --gated_by-->       Decision (human; DB CHECK)
  Decision        --emits-->          Action (post-gate only)
  Action          --shared_via-->     CISE-Service-Msg (event_report back into CISE)
  Anomaly-Cluster --sealed_in-->      Audit-Record

The decisive entity is Anomaly-Cluster: it exists only as the fusion of a cross-node CISE vessel-of-interest hit with the authority's own AIS/cable/fisheries layers — a correlation the free CISE node forwards the parts of but never assembles. That intersection is the white space.

---

§5 — Data model (synergy.* tables, RLS + a load-bearing CHECK)

Org-scoped for the app.current_org_id RLS predicate. The load-bearing invariant enforces the decline-safe ceiling at the database layer: an anomaly cluster cannot record an action beyond passive monitoring without a recorded human gate, the disposition set is closed (no biometric / person_score / elint value exists), and any cross-node CISE share requires a registered covenant.

SQL
56 lines
Copy
-- One fused multi-source maritime anomaly above a national CISE node, org-scoped + RLS.
CREATE TABLE synergy.cise_anomaly (
    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id             uuid NOT NULL,                         -- RLS: app.current_org_id (the node owner)
    node_id            text NOT NULL,                         -- 'IE-NAVALSERVICE-HAULBOWLINE'
    detected_at        timestamptz NOT NULL,
    vessel_pseudo_id   text NOT NULL,                         -- pseudonymised MMSI; NEVER a person id
    -- the fused signals
    ais_dark_minutes   integer NOT NULL DEFAULT 0,            -- AIS-off interval (47)
    voi_peer_nodes     text[]  NOT NULL DEFAULT '{}',         -- {'FR','PT'} CISE Vessel-of-Interest senders
    cable_loiter_nm    numeric(5,1) NOT NULL DEFAULT 0,       -- distance to cable corridor (5.0)
    efca_outside_zone  boolean NOT NULL DEFAULT false,        -- EFCA fisheries cross-check
    signal_concurrence integer NOT NULL DEFAULT 0,            -- count of time-aligned signals (0..4)
    anomaly_confidence numeric(4,3) NOT NULL,                 -- 0.880 fused
    -- governance
    human_gate_by      text,                                  -- duty-officer id; NULL until signed
    human_gate_2_by    text,                                  -- second duty officer (2-of-2); NULL until signed
    human_gate_at      timestamptz,                           -- NULL until signed
    disposition        text NOT NULL DEFAULT 'monitor'
                       CHECK (disposition IN ('monitor','cise_event_share','coastguard_challenge','sar_vector')),
    obs_level          text NOT NULL DEFAULT 'inferred'
                       CHECK (obs_level IN ('asserted','reported','inferred','direct','confirmed')),
    prov_o             jsonb NOT NULL,                        -- per-signal PROV-O attribution
    -- LOAD-BEARING INVARIANT: any action beyond passive monitoring REQUIRES a recorded 2-of-2
    -- human gate; the disposition enum is closed (no biometric/person_score/elint value exists),
    -- so the decline-safe ceiling is STRUCTURAL, not an app-layer convention.
    CONSTRAINT human_gate_required CHECK (
        disposition = 'monitor'
        OR (human_gate_by IS NOT NULL AND human_gate_2_by IS NOT NULL
            AND human_gate_2_by <> human_gate_by AND human_gate_at IS NOT NULL)
    )
);
ALTER TABLE synergy.cise_anomaly ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.cise_anomaly
    USING (org_id = current_setting('app.current_org_id')::uuid);

-- A CISE message in/out of the node (the audit boundary for cross-node sharing).
CREATE TABLE synergy.cise_message (
    id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    org_id        uuid NOT NULL,
    anomaly_id    uuid REFERENCES synergy.cise_anomaly(id),  -- NULL for raw inbound
    direction     text NOT NULL CHECK (direction IN ('inbound','outbound')),
    service       text NOT NULL
                  CHECK (service IN ('risk_profile','event_report','area_of_interest','vessel_of_interest')),
    peer_node     text NOT NULL,                             -- 'FR','PT','EFCA','EMSA',...
    covenant_ref  text NOT NULL,                             -- CISE sharing covenant id (required)
    occurred_at   timestamptz NOT NULL DEFAULT now(),
    prov_o        jsonb NOT NULL,
    -- LOAD-BEARING: no outbound cross-node share without a registered covenant.
    CONSTRAINT covenant_present CHECK (
        direction = 'inbound' OR length(covenant_ref) > 0
    )
);
ALTER TABLE synergy.cise_message ENABLE ROW LEVEL SECURITY;
CREATE POLICY org_isolation ON synergy.cise_message
    USING (org_id = current_setting('app.current_org_id')::uuid);

---

§6 — Action-loop pseudocode (detect → enrich → triage → gate → task → execute → BDA → close)

Python
46 lines
Copy
def cise_node_loop(voi_msg, ais_window, cable_zones, efca_index, org):
    # 1. DETECT — a CISE Vessel-of-Interest message arrives at the national node.
    if voi_msg.service != 'vessel_of_interest':
        return Disposition.MONITOR                       # other CISE services pass to dashboards

    # 2. ENRICH — pull the authority's OWN layers (the node does not do this).
    ais = ais_track_for(voi_msg.vessel, ais_window)      # terrestrial + Sat-AIS
    dark = longest_ais_gap(ais)                          # 47 min off
    loiter = nearest_cable_corridor(ais, cable_zones)    # 5.0 nm N of a transatlantic cable
    efca = efca_outside_licensed_area(voi_msg.vessel, efca_index)  # cross-check

    # 3. TRIAGE — fuse. None alone escalates; concurrence does.
    concurrence = sum([
        dark.minutes >= AIS_DARK_FLOOR,
        len(voi_msg.peer_nodes) >= 1,                    # at least one peer CISE node flagged it
        loiter.nm <= CABLE_LOITER_FLOOR,
        efca is True,
    ])
    conf = bayes_fuse(dark, voi_msg, loiter, efca)       # ~0.88
    if concurrence < 2:
        return Disposition.MONITOR                       # ambiguous -> watch, re-poll

    cluster = persist_anomaly(org, voi_msg, dark, loiter, efca, conf, concurrence)

    # 4. GATE — HUMAN sign-off in the Decision Room (DB CHECK enforces 2-of-2, §5).
    verdict = decision_room(cluster, personas=[
        'maritime_ops', 'proportionality', 'civil_society_reviewer',
        'devils_advocate', 'fisheries_analyst', 'cise_data_steward'])
    if not verdict.signed:                               # 2-of-2 duty officers
        return refuse_and_log(cluster, verdict)          # logged refusal is a valid outcome

    # 5. TASK — civil action ONLY (no person targeting; not in the disposition enum).
    if verdict.disposition == 'sar_vector':
        task = ircg_sar_vector(cluster, mrcc='IRCG')     # nearest SAR asset
    else:
        cluster.disposition = 'coastguard_challenge'
        task = coastguard_vhf_query(ais.contact, authority='SOLAS-V')

    # 6. EXECUTE — share the enriched picture BACK into CISE (write-back, §11).
    share = cise_event_report(cluster, peers=voi_msg.peer_nodes, covenant_ref=org.covenant)

    # 7. BDA — did the loop change the outcome?
    bda = assess(task, share)                            # vessel challenged/diverted OR rescue effected

    # 8. CLOSE — seal the PROV-O chain; archive the Decision Room transcript to Audit.
    return close_loop(cluster, bda, prov_o=seal_provenance(cluster))

---

§7 — nexus-workflows YAML DAG (same loop, declarative, blocking human-gate node)

YAML
34 lines
Copy
# nexus-workflows: national CISE-node decision loop. NO cron — event-triggered by a CISE message.
workflow: cise_node_decision_loop
on:
  event: cise.vessel_of_interest        # inbound CISE 'Vessel of Interest' service message
concurrency: { group: "voi-${{ event.vessel_pseudo_id }}", cancel_in_progress: false }
jobs:
  enrich:
    run: skills/own_layers_enrich@1.0    # terrestrial+Sat-AIS gap, cable-loiter, EFCA cross-check
    out: { dark_min: $.ais_dark_minutes, loiter_nm: $.cable_loiter_nm, efca: $.efca_outside }
  triage:
    needs: [enrich]
    run: skills/anomaly_fuse@1.2          # concurrence + Bayes fuse -> confidence ~0.88
    out: { concurrence: \$.concurrence, confidence: \$.confidence }
  human_gate:                              # <-- BLOCKING. The loop cannot proceed without it.
    needs: [triage]
    if: ${{ jobs.triage.concurrence >= 2 }}
    type: manual_approval
    block: true
    approvers: { roles: [ie_naval_moc_duty, ircg_mrcc_duty], min: 2 }   # 2-of-2
    decision_room:
      personas: [maritime_ops, proportionality, civil_society_reviewer,
                 devils_advocate, fisheries_analyst, cise_data_steward]
    timeout: 30m
    on_timeout: refuse_and_log
  task:
    needs: [human_gate]
    if: ${{ jobs.human_gate.approved }}
    run: skills/civil_action_dispatch@1.0  # coastguard_challenge OR sar_vector (per verdict)
  execute:
    needs: [task]
    run: skills/cise_event_report@1.0      # share enriched picture back into CISE (needs covenant_ref)
  bda_close:
    needs: [execute]
    run: skills/bda_seal_provenance@1.0    # PROV-O chain sealed; transcript -> Audit ledger

---

§8 — UI/UX mockups (VERBATIM generated ASCII)

Generated by _build/archetypes/gen_emsa-cise-node.py (imports globe_rmp, settings_form from archetypes.py; each builder's _ck() asserts equal-length pure-ASCII). SVG twin of the primary screen: _build/figures/emsa-cise-node/uc-globe_rmp.svg.

Figure e02.1 — globe_rmp (PRIMARY). Components: ShellLayout + TopBar (with RendererChip = CesiumJS + PccPill in rightSlot) + LeftSidebar glyph-rail + MapConsole (CesiumJS-globe over EMODnet/S-101, the Irish EEZ, the transatlantic cable corridor, the AIS-dark KORALL-9 loiter, the cross-node CISE Vessel-of-Interest hits) + right-docked ChatTerminal TRACKS rail + Inspector + HistoryRail + BottomStatusBar + ClassificationBanner (top+bottom mirror).

Figure — Recognised maritime picture (globe_rmp). Production-fidelity React surface (buildable); the faithful ASCII follows.

+--------------------------------------------------------------------------------------------------+
| National CISE-Node RMP - Naval Service Haulbowline (above EMSA CISE node) (CesiumJS-globe)       |
+-------------------------------------------------------------------+------------------------------+
|      . - '' - .       IRISH EEZ + CISE cross-node area-of-interest| TRACKS (sorted: anomaly)     |
|   /     o ----._ \   self-report 50.9N 11.7W (broadcast AIS)      | M/V KORALL-9  PAN flag       |
|  |  [!] AIS dark |    EMODnet bathy -2210m :: IHO S-101 ENC       |   AIS dark 47min             |
|  |  Sat-AIS gap  |   M/V KORALL-9 (PAN flag, AIS off 47min)       |   CISE VoI: FR + PT node     |
|  |  47min over   |    -> dark-vessel candidate (anomaly 0.88)     |   loiter 5nm N cable         |
|   \ CELTIC cable /   CISE 'Vessel of Interest' hit: FR + PT node  | CISE services in use         |
|    \ '. VoI x2 .'/   loiters 5nm N of a transatlantic cable       |   [x] Vessel of Interest     |
|      ' - x__ - '     EFCA fisheries cross-check: no licence area  |   [x] Area of Interest       |
|  Camera {52.10N -13.80W alt 820km pitch -90} CesiumJS-globe       |   [x] Event Reporting        |
|  Fuse: AIS-dark + CISE VoI(FR,PT) + cable-loiter + EFCA flag      |   [x] Risk profile           |
|  -> ANOMALY 0.88 :: HUMAN GATE before any IRCG/Naval tasking      | [#] EFCA fisheries flag      |
|                                                                   | [#] IRCG SAR asset ready     |
|                                                                   | gate: VHF query / vector     |
|                                                                   |   no person-ID (civil COP)   |
+-------------------------------------------------------------------+------------------------------+
| EMSA CISE Node v2 + adaptor :: SafeSeaNet/SEG + Sat-AIS + EMODnet :: 15 nodes/30+ authorities    |
+--------------------------------------------------------------------------------------------------+

Figure e02.2 — settings_form (CISE node + adaptor integration). The integration/binding surface where the authority's node owner binds the sovereign COP above the EMSA CISE Node + adaptor: which legacy systems the adaptor maps, which of the four CISE operational services are consumed, and the decline-safe ceiling (closed disposition set, EU-sovereign AI Provider Router, PROV-O). Components: ShellLayout + settings_form inside the Settings surface; ClassificationBanner boundary.

Figure — Integration / binding form. Production-fidelity React surface (buildable); the faithful ASCII follows.

+--------------------------------------------------------------------------------------+
| CISE Node + Adaptor Integration - bind the sovereign COP above EMSA's node           |
+--------------------------------------------------------------------------------------+
| CISE Node Connection (EMSA-provided, free of charge)                                |
| ----------------------------------------------------                                |
|   Node software               EMSA CISE Node v2  (free of charge)                   |
|   Coordinator                 EMSA - Operational Phase 1 Jul 2024                    |
|   This node owner             IE Naval Service, Haulbowline                          |
|   Network reach               15 nodes / 30+ authorities                             |
|   Legal basis                 EUMSS (Oct 2023) + EMFAF fund                          |
|                                                                                      |
| Adaptor (national legacy -> CISE Data/Service Model)                                 |
| ----------------------------------------------------                                 |
|   Generic Adaptor             CISE Generic Adaptor (JRC/EMSA, BSD-3 OSS)             |
|   Legacy systems mapped       SafeSeaNet/SEG, MSSIS, Sat-AIS                         |
|   Data model                  CISE Data & Service Models v2                          |
|   Operational services        Risk / Event / Area / Vessel-of-Int                    |
|   Outbound share              authority->authority covenant only                     |
|   Pseudonymisation            ON  (identity stays with lawful auth)                  |
|                                                                                      |
| Decision / COP Layer (Nexus Synergy - ABOVE the node)                                |
| -----------------------------------------------------                                |
|   Fusion -> anomaly           AIS-dark + VoI + cable-loiter + EFCA                   |
|   Human gate                  REQUIRED (DB CHECK; 2-of-2 duty)                       |
|   AI Provider Router          EU-sovereign only; no US hyperscaler                   |
|   Disposition set             monitor/share/challenge/sar_vector                     |
|   Excluded (Declined List)    no biometric / predictive / scoring                    |
|                                                                                      |
| Provenance + Compliance                                                              |
| -----------------------                                                              |
|   PROV-O chain                per-signal attribution, sealed                         |
|   AI Act posture              human-in-loop Art.14; no Art.5                         |
|   Audit retention             Merkle ledger, 7y                                      |
|   FRIA                        run if buyer deems COP high-risk                       |
+--------------------------------------------------------------------------------------+

---

§8b — Field-unit (Pixel) surfaces

The same scenario on the Pixel 10 Pro Fold field unit (Nexus Field app), tightly coordinated with the dashboard COP above — command pushes the task, the unit accepts + ACKs, shares position and reports back to the COP. Built on the same synergy.field_unit / field_task / field_report contract; see §9 and the cluster coordination composite.

Figure §8b.1 — Folded cover · tasking glance (ground_glance): the incoming IMMEDIATE task, ACCEPT + ACK, alert chips, bearing-to-objective.

Figure §8b.2 — Unfolded inner display · field COP: two-pane mini-map + task list + teammate roster + air/command coordination + PTT, with the Material-3 NavigationBar + Report FAB.

§9 — UI/UX flow (literal click-path)

Click-path: node-owner duty officer opens C2 → National CISE-Node RMP → an inbound CISE Vessel-of-Interest message auto-pins KORALL-9 on the MapConsole globe → clicks the [!] KORALL-9 track in the TRACKS rail → Inspector shows the AIS-dark gap + manifest mismatch + the FR/PT peer-node VoI hits → clicks "Fuse" → the four-signal Anomaly-Cluster resolves (m=.88) → clicks "Open Decision Room" → six persona bubbles deliberate in ChatTerminal → /dual-control sign (IE Naval MOC + IRCG MRCC duty, 2-of-2) → /execute → sar_vector or /execute → coastguard challenge fans out the civil action + a CISE Event Report back to the peer nodes → HistoryRail logs each receipt → BDA bubble closes the loop. The settings_form surface is where the node owner first binds this COP above the EMSA node (which legacy systems the adaptor maps, which CISE services to consume).

[CISE VoI msg in] -> [globe pin + TRACKS] -> [Inspector: KORALL-9] -> [Fuse -> Anomaly 0.88]
        -> [Decision Room: 6 personas] -> [/dual-control sign 2/2 IE-Naval + IRCG]
        -> [/execute: SAR vector OR VHF challenge | CISE Event Report back] -> [HistoryRail] -> [BDA close]

---

§10 — Decision-Room transcript (the gated decision)

▣ EU-RESTRICTED · TLP:AMBER · CIVIL-SECURITY MARITIME COP ▣   National CISE-Node RMP — KORALL-9
┌───────────────────────────────────────────────────────────────────────────────────────────┐
│ ⊟ Maritime-ops persona [EU-sovereign LLM]                                                   │
│    Reco: CISE Vessel-of-Interest hit from FR + PT nodes + AIS-dark 47min + loiter 5nm N of  │
│    a transatlantic cable + EFCA "outside any licensed area". Fused anomaly 0.88. Propose:   │
│    coast-guard VHF challenge to M/V KORALL-9, place nearest IRCG SAR asset on alert.         │
│ ⊟ Proportionality persona                                                                    │
│    Necessity/proportionality satisfied for a CIVIL challenge: a VHF query is the least-      │
│    intrusive lawful step against a vessel loitering over critical cable. No boarding until    │
│    non-compliance (SOLAS-type authority).                                                     │
│ ⊟ Civil-society reviewer  [the dissent]                                                      │
│    OBJECTION: one peer node tagged this under an irregular-migration context. We do NOT      │
│    inherit that as a person-level concern. This stays a VESSEL anomaly. No migrant profiling, │
│    no person watch-list, no biometric step is permitted inside this COP — ever.              │
│ ⊟ Devil's advocate                                                                           │
│    Counter: a 47min AIS gap can be equipment failure, and PAN-flag transit is lawful. Don't  │
│    escalate to "intent" before a challenge-and-verify; consider it could be a distress case  │
│    (hence SAR, not enforcement).                                                              │
│ ⊟ Fisheries analyst (EFCA)                                                                    │
│    The vessel is outside every licensed fishing area but its track pattern is transit, not    │
│    fishing — so this is NOT an IUU-fishing case; treat the EFCA flag as a corroborating       │
│    location signal only, ObservationLevel = Inferred.                                          │
│ ⊟ CISE data-steward                                                                          │
│    Sharing the enriched picture back to FR/PT is permitted ONLY under the registered CISE    │
│    covenant (covenant_ref present). Pseudonymise vessel identity in the shared Event Report;  │
│    full identity stays with the lawful acting authority.                                       │
│                                                                                              │
│ GATE VERDICT: ACCEPT (narrowed). Civil-society + devil's-advocate inputs COLLAPSE the reco   │
│   from "enforcement on a person-tagged vessel" to "VHF challenge-and-verify, SAR if distress";│
│   migration person-profiling EXCLUDED; share-back pseudonymised. Disposition =               │
│   coastguard_challenge (escalate to sar_vector on a distress reply).                          │
│   [/dual-control sign — IE Naval MOC duty]   [/dual-control sign — IRCG MRCC duty]           │
│   [ /execute ]                               [ Refuse + log ]                                 │
▣ EU-RESTRICTED · TLP:AMBER · INFRASTRUCTURE RESILIENCE + SAR ONLY ▣

The materially decision-changing disagreement: the civil-society reviewer's refusal to inherit a peer node's irregular-migration tag as a person-level concern, plus the devil's advocate's distress alternative, narrowed an "enforcement-on-a-person-tagged-vessel" reco into a civil VHF challenge-and-verify (SAR if distress) — exactly the decline-safe ceiling the §5 CHECK constraint hard-codes (a closed disposition set with no person-targeting value).

---

§11 — Write-back + BDA + PROV-O + deltas-only regulatory traceback

Write-back (UNO actions):

• coastguard_vhf_query(KORALL-9, SOLAS-V) → maritime-authority tasking bus (Naval MOC).
• ircg_sar_vector(cluster, MRCC) → nearest SAR asset on a distress reply.
• cise_event_report(cluster, peers=[FR,PT], covenant_ref) → enriched picture shared back into CISE as an Event Report (the loop the free node alone never closes).

BDA (loop close): the challenge prompts KORALL-9 to re-illuminate AIS and clear the cable corridor (or, on a distress reply, a SAR asset is vectored); the BDA bubble records delta-to-baseline (one ranked, gated anomaly with a civil action vs. four un-correlated CISE messages sitting in a duty inbox).

PROV-O chain (per signal):

cise.voi_msg(FR,PT)  --wasGeneratedBy--> Activity[cise_inbound@node, peer=FR/PT]
ais.dark_gap         --wasGeneratedBy--> Activity[own_layers_enrich@1.0]
cable.loiter         --wasGeneratedBy--> Activity[cable_corridor_test@1.0]
efca.zone_flag       --wasGeneratedBy--> Activity[efca_crosscheck@1.0]
cise_anomaly         --wasDerivedFrom--> {voi_msg, dark_gap, loiter, efca_flag}
                     --wasAttributedTo--> Agent[ie_naval_moc_duty] + Agent[ircg_mrcc_duty] (2-of-2 gate)
civil_action         --wasGeneratedBy--> Activity[civil_action_dispatch@1.0]  (post-gate only)
cise_event_report    --wasGeneratedBy--> Activity[cise_event_report@1.0]      (covenant_ref present)

Deltas-only regulatory traceback (only what differs from the §4.0 defaults):

• EU AI Act: the fusion classifier is decision-support, human-in-the-loop (Art. 14); no Art. 5 prohibited practice (no biometric ID, no social scoring); the Art. 5 prohibitions have applied since 2 February 2025. A FRIA is run if the node owner deems the COP high-risk. [verified — AI Act Art. 5 applicable 2 Feb 2025]
• GDPR: vessel tracks/telemetry are not personal data; the only personal-data edge (a vessel master) is pseudonymised in the picture and handled under a DPA by the lawful acting authority — not by this COP. The irregular-migration CISE channel is not turned into a person profile here.
• CISE governance: cross-node Event-Report share requires a registered covenant (enforced by the §5 covenant_present CHECK); identity stays pseudonymised in the shared picture.

---

§12 — Buyer & stakeholders

---

§13 — Competition / incumbency + comparator (cited)

White space: nobody is selling a Member State a sovereign, cross-node, human-gated COP that fuses the CISE feed with the authority's own layers into one auditable anomaly→SAR-dispatch action loop, with the action shared back into CISE. The node is free, the mandate is live, the sensors exist; the decision brain above the node does not.

---

§14 — Readiness (honest, pre-pilot)

Reuse (real): the globe_rmp + settings_form surfaces exist in the gallery; the action-loop, Decision Room, AI Provider Router (EU-sovereign routing), PROV-O ledger and FRIA workflow are architecture we can demo on representative data. This package shares its maritime pillar and EEZ research with naval-service-mahi-mda (b01) — the MAHI edge feeds the same COP; the CISE node is the data-sharing fabric beneath the same picture. The CISE Node/adaptor model is fully documented — the node software is free of charge and the CISE Generic Adaptor is open-source (BSD-3) — so the integration target is concrete, not speculative.

Real gaps (no hand-waving):

• No live CISE-node integration — consuming the four operational services through a real adaptor is pilot-build, not shipping. [gap]
• No deployed reference anywhere — first-logo risk. [gap]
• No contracting vehicle — founder on Stamp 1G (see §20). [gap]
• Two buyers, one loop. EMSA (platform/standards owner) and a Member-State authority (node owner) have different procurement paths; the sellable contract is the Member-State node owner, not EMSA centrally. [gap — clarify the buying entity]
• Defence-adjacent sensitivity. The Irish CISE node sits with the Naval Service; framing must stay civil-security/MDA/SAR (it does, by construction). [managed]

---

§15 — ENGAGEMENT PLAYBOOK (first-contact → free discovery → demo → pilot → LOI → contract)

Warm-intro email (adapted draft #3, decline-safe):

Subject: A sovereign decision layer above your CISE node — discovery, not a pitch. [Name] — [MAHI/Patrick intro context]. We build an EU-sovereign common-operating-picture platform. EMSA gives you the CISE node and the plumbing to share — and now that Ireland's node is standing up at Haulbowline, the gap we keep hearing is what happens after a Vessel-of-Interest hit lands: it sits in a duty inbox alongside your own AIS and EFCA signals, un-fused, with no human-gated, audited path to a coast-guard challenge or a SAR vector. We run a free discovery session to map exactly that, with no cost and no obligation. We publicly refuse biometric ID, predictive policing and any migration person-profiling — this is maritime-domain awareness, infrastructure resilience and SAR, human-gated and fully audited. Could I show you 20 minutes? — [Founder]

60-min discovery agenda (adapted): 0–5 frame + decline-safe statement; 5–20 "walk me through what happens when a CISE Vessel-of-Interest message arrives — who sees it, what do they do, in what order?"; 20–35 lawful basis / CISE covenant / the irregular-migration channel boundary; 35–45 who owns SafeSeaNet/SEG, Sat-AIS, EFCA, the SAR-dispatch path + the funding route (EMFAF/EUDIS); 45–55 map their loop onto detect→…→close, find the decision gap above the node; 55–60 earn the demo.

1-page pilot proposal (filled): Title — "Sovereign decision layer above the Irish CISE node — fusion & SAR-dispatch pilot"; Sponsor — IE Naval Service node owner (+ IRCG SAR, EFCA cross-check); One thing we prove — "fuse a cross-node CISE Vessel-of-Interest hit with our own AIS/cable/fisheries layers into one human-gated alert and cut time-from-VoI-hit-to-gated-civil-action from X to Y" (X/Y baseline set week 1); Scope IN — globe_rmp + settings_form + Decision Room on representative EEZ data above a test CISE node; OUT — any biometric/migration person-profiling, live classified feeds; Data — representative AIS + synthetic cross-node CISE messages + EMODnet, EU-hosted; Funding — EMFAF CISE-ALERT line / EUDIS (pilot €0 to the buyer); Timeline — 8–12 wks; After — LOI.

LOI checklist (filled headers): Parties (IE Naval Service node owner + founder pre-incorp / partner vehicle); intent to proceed to next-phase conditional on success criteria + funding; scope carried from the pilot; named sponsor (node owner + budget owner); indicative timeline; indicative commercials ("to be scoped under EMFAF/national Defence vehicle"); Declined-List affirmation (no biometric / predictive / migration person-profiling); non-binding except confidentiality; Irish governing law; solicitor review confirmed before sending.

---

§16 — PM / timeline

                                Wk1-4   Wk5-8   Wk9-12  Wk13-16 Mo5-6   Mo7-9   Mo10-12
 First contact (warm)          [====]
 Free discovery                   [==]
 Scoped demo (SARex replay)          [===]
 Pilot (grant-funded)                    [==========]
 Stamp-1G / partner-vehicle gate     [================]  <-- CRITICAL PATH (paid pilot blocked until resolved)
 LOI                                                 [==]
 Procurement route (EMFAF/natl Def)                     [==============]
 Signed contract                                                     [=====]

Milestones: M1 named contact (Wk2); M2 discovery write-up (Wk4); M3 demo-exit yes (Wk8); M4 partner-vehicle confirmed (≤Mo3, gating); M5 pilot result (Wk12); M6 signed LOI (Wk14); M7 contract (Mo10–12).

Critical path: the Stamp-1G → partner-vehicle (MAHI or incorporated NewCo) gate is critical for a PAID pilot/contract; a free discovery + grant-funded pilot can run in parallel under a founder-signed (personally-liable) MOU, but no invoice can issue until the vehicle exists. The two-buyer structure (EMSA standards owner vs. Member-State node owner) adds a clarify-the-buyer step before any contract.

RACI:

---

§17 — Funding / procurement vehicle

• EMFAF 2021-2027 (CISE-ALERT, EMFAF-2021-PIA-CISE) — the headline route; CISE Operational-Phase and incident-alerting actions are EMFAF-financed, so a fusion/decision-layer pilot can ride an EMFAF-funded action with a public-entity lead (the Member-State node owner). [verified — EMSA / EC Atlantic Strategy]
• EUDIS / EDF 2026 maritime track (closes 29 Sep 2026) — consortium-only; an EU (Belgium-MAHI + Ireland) team fits the buy-European mandate; the COP decision-layer is a fundable module. [verified — discovery-playbook §8]
• National Defence / Naval-Service procurement — the direct buyer route once a reference exists; defence-security contracts may use a negotiated/exempt procedure under Dir. 2009/81/EC + Art. 346 TFEU.
• Innovation Voucher (€5k, CeADAR/UCD) + PSSF / HPSU Feasibility — to fund the founder-side discovery/feasibility itself. [verified — discovery-playbook §8]

---

§18 — TWO-STAGE FORMULA SCORECARD

Computed by the model in formula-worked-examples.md (P_LOI = 0.55/(1+exp(-1.15·(S1−2.6))); P_raw = 0.70/(1+exp(-1.1·(S2−2.8))); G = V·T; T = (30−t_resolve)/30, t_resolve = 12mo → T = 0.60). Every factor [PRIOR] with a dated rationale.

Stage-1 vector {mandate_pull, access_warmth, demonstrability, decline_safety, white_space, cycle_speed, pillar_fit} = {4,3,4,5,4,2,5}

S1 = 0.22·4 + 0.22·3 + 0.18·4 + 0.14·5 + 0.10·4 + 0.08·2 + 0.06·5 = 3.52 → P_LOI ≈ 0.55/(1+exp(-1.15·(3.52−2.6))) = 0.55/(1+exp(-1.058)) ≈ 0.405 (41%) · Score100 = S1·20 = 70.4 → 70

Stage-2 vector {contractability, funding_to_pay, procurement_clarity, incumbency_displacement, time_to_value, reference_leverage} = {1,4,2,5,3,2}

S2 = 0.24·1 + 0.22·4 + 0.18·2 + 0.16·5 + 0.12·3 + 0.08·2 = 2.80 → P_raw ≈ 0.70/(1+exp(-1.1·(2.80−2.8))) = 0.70/2 = 0.350

Legal gate G = V·T, t_resolve = 12mo → T = 0.60:

Board reconciliation: board_anchor.score100 = "[PRIOR-derive]", value med-high. Derived Score100 = 70 (Stage-1), P_LOI ≈ 41%, P(Contract) 0.85% today → 6–9% with a vehicle. This sits in the med-high band — below the most-acute Baltic-Sentry (76) on mandate-pull (a free node to sit above is a softer must-procure than a Christmas-Day cable cut), but with the purest non-displacement wedge in the portfolio (incumbency_displacement = 5). Consistent with the NEXT-EU tier. All probabilities [PRIOR].

---

§19 — Commercial

Terms: EU-hosted; annual subscription + integration SOW; pilot frequently €0 to the buyer (EMFAF/EUDIS grant-funded). Requirements: a contracting vehicle (§20), a CISE data-sharing covenant per authority-pair, an existing EMSA CISE Node + adaptor to bind above, and a named feed owner per signal (SafeSeaNet/SEG, Sat-AIS, EFCA). Cost advantage: open-source substrate + sovereign HPC + shared conformity file + no forward-deployed-engineer dependency; we never charge for the node itself — EMSA provides it free, and we are explicit about that.

---

§20 — Legal blockers

• Stamp-1G cap (X1) — hard. Founder cannot be director/shareholder/self-employed or sign a paid contract until Stamp 4. No paid pilot or contract is signable by the solo founder. Mitigation: MAHI or a brokered NewCo as contracting prime; EEA-resident director (Patrick/Manuel) for incorporation; pursue Stamp 4. ⚖️ CONFIRM (immigration solicitor).
• Two-buyer / defence-adjacency. The node sits with the Irish Naval Service; defence-security procurement may use a negotiated/exempt procedure under Dir. 2009/81/EC + Art. 346 TFEU (can help or exclude). Clarify whether the buying entity is the Member-State node owner or an EMSA-central vehicle before contracting. [verified regime; per-deal CONFIRM]
• NATO / DIANA exclusion (X6). Irish entity ineligible for NATO DIANA; use EU vehicles (EMFAF/EUDIS); not a blocker for the EU-civil route. [verified]
• Dual-use export (X4). AIS/vessel-monitoring fusion can classify as controlled cyber-surveillance tech under Reg. (EU) 2021/821 — export classification per integrated config + end-user due diligence. ⚖️ CONFIRM (export counsel).
• EU AI Act. No Art-5 prohibited practice (decline-safe by construction); human-in-the-loop (Art. 14); FRIA if the node owner deems the COP high-risk. Prohibitions apply since 2 Feb 2025. [verified]
• GDPR / CISE covenant. Vessel tracks ≠ personal data; the single personal-data edge (a master) is pseudonymised + handled by the lawful authority under a DPA; cross-node sharing needs a registered CISE covenant (enforced by the §5 CHECK); the irregular-migration channel must not become a person-profiling tool in our layer (enforced by the closed disposition set). ⚖️ CONFIRM (data-sharing agreement per authority-pair).
• Pre-incorporation contracting (X7). MOUs signed in founder's own name under Companies Act 2014 s.45 (personally liable until ratified). ⚖️ CONFIRM (solicitor).

---

§21 — Warm-intro contact + the specific ask

Route: MAHI (Pieter-Jan Note, mahi.be) → MAHI's EU maritime network, and in parallel Patrick Walsh (Dogpatch) → Defence Forces RTI Unit / DEC → the Irish Naval Service CISE node owner (Haulbowline); longer-term, an EMSA CISE Stakeholder-Group contact.

The specific ask to MAHI / Patrick: "Can you bridge one introduction into the Irish Naval Service's new CISE node at Haulbowline (or an EMSA CISE Operational-Phase contact)? I want a free discovery session on the decision gap above the free EMSA node — fusing a cross-node Vessel-of-Interest hit with their own AIS/cable/fisheries layers into one human-gated COP that dispatches a coast-guard challenge or a SAR vector and shares the result back into CISE. It's the same maritime picture the MAHI-edge play feeds, decline-safe by construction, and an all-EU Belgian+Irish team is exactly what EMFAF/EUDIS reward — which also helps us scope you as the contracting vehicle."

---

§22 — Open questions + consolidated Sources

Open questions (do not assert until resolved):

• Is the sellable contract the Member-State node owner (Irish Naval Service) or an EMSA-central vehicle — and which holds the budget? [TBD]
• Does Ireland's node go live with a national SI already building the adaptor, and is a decision layer above it in or out of that SI's scope? [TBD]
• Exact EMFAF / CISE-ALERT eligibility for a software decision-layer above the node (vs. node/adaptor build). [partially verified; CONFIRM]
• The precise CISE covenant mechanics for sharing an enriched Event Report back to peer nodes. [TBD]
• Will a defence-housed node owner accept a pre-incorporation/foreign-founder vendor without a partner vehicle? [TBD — gated by §20]

Sources (dated):

• EMSA, Common Information Sharing Environment (CISE) (operational phase from 1 Jul 2024; EMSA coordinator) — emsa.europa.eu ; emsa.europa.eu [verified]
• EMSA, What is the Operational Phase of CISE? — emsa.europa.eu [verified]
• EMSA, State of play on two years of CISE transition (node v2; up to 30 nodes) — emsa.europa.eu [verified]
• EMSA, How does CISE work technically? / Technical specifications (CISE Node + Adaptor; node software + support free of charge; the CISE Generic Adaptor is BSD-3 open source, hosted on code.europa.eu/jrc-cise) — emsa.europa.eu ; emsa.europa.eu [verified]
• EMSA, CISE Stakeholders / governance (CISE Stakeholder Group: EC, EDA, EFCA, EEAS, EMSA, Frontex, SatCen) — emsa.europa.eu ; emsa.europa.eu [verified]
• EMSA, Operational exercise with CISE during SARex 2024 (1–2 Oct 2024, North Adriatic; Slovenian Maritime Admin + Italian Coast Guard + EFCA + EMSA; four operational services) — emsa.europa.eu [verified]
• RTÉ News, Ireland to join European naval intelligence alliance (Tánaiste Simon Harris approval 14 Apr 2025; Naval Service to operate Ireland's node from Haulbowline; voluntary network) — rte.ie [verified]
• The Journal, Irish military to join EU naval intelligence alliance (Apr 2025) — thejournal.ie [verified]
• EC Atlantic Strategy, Action for a CISE incident alerting system (EMFAF-2021-PIA-CISE / CISE-ALERT) — atlantic-maritime-strategy.ec.europa.eu [verified]
• EC, Common Information Sharing Environment (CISE) (Oceans and fisheries; voluntary decentralised network) — oceans-and-fisheries.ec.europa.eu [verified]
• EUMSS revised + Action Plan (Council, Oct 2023) + Strategic Compass (Mar 2022) — cited via EMSA CISE Operational-Phase strategic context [verified]
• AI Act, Art. 5 prohibitions applicable 2 February 2025 (per MEMORY honour-list) [verified]
• Internal grounding: discovery-playbook.md, formula-worked-examples.md, legal-blockers-register.md, contact-register.md, outreach-drafts.md; sibling package naval-service-mahi-mda (b01) for the shared EEZ/MAHI maritime pillar; AW UC-37 (…-aw-t…) globe_rmp depth pattern.

---