System Architecture

LIFELINE

A local, human-led operating system for coordinating a disaster incident — from the first field report to a sealed decision anyone can verify offline. It produces proposals, never dispatches.

The map is not the decision. The person is.

Deterministic core

Persistence & seals

Human authority boundary

Optional agent boundary (read-only)

Browser surfaces

Incident lifecycle

01 · EVIDENCE

Typed reports

requests · resources · shelters · routes, each with full provenance

02 · VALIDATE

Deterministic gates

freshness · contradiction · duplicate — downgrade only

03 · REVISE

Incident revisions

append-only, hash-linked ledger

04 · PLAN

Planning kernel

eligible proposals from hard constraints

05 · DECIDE

Human approval

authenticated coordinator approves / rejects

06 · SEAL

Audit + verify

hash-chained ledger · offline CLI checks

Browser surfaces · web/

index.html

Landing

Bilingual judge landing page

room.html

Incident room

Map, proposal states, Verification Graph, simulations

ops.html

Ops console

Authenticated: create incidents, append reports, record decisions

demo/

Sealed bundle

Static synthetic demo — no key, no backend

authenticated API ↓ reads sealed artifacts

Entrypoints

__main__.py

CLI

plan · verify · serve · operator · narrate

server.py

Loopback backend

Incident-room API, bound to localhost only

↓ deterministic pipeline

Deterministic core — reproducible, no floats in the decision path, SHA-256 sealed

Validators can only downgrade a claim, never upgrade it. Every finding is sealed inside the plan.

validators.py

Evidence gates

freshness · contradiction · input validation

core.py

Planning kernel

eligible proposals from hard safety constraints

verification.py

Verification Graph

supports · refutes · gaps · human actions per proposal

simulate.py

Simulations

declared what-if worlds — no score, no winner

alerts.py

Attention feed

what changed — dispatch_authority: none

briefing.py

Briefing

human-readable incident view

export.py

Export

plan.json · room.geojson · seals

trace.py

Trace

CRONOS-compatible event trace

Persistence & identity

incidents.py

Incident ledger

SQLite · append-only, hash-linked revision events. Corrections supersede but preserve history

auth.py

Local operator roles

reporter · coordinator · reader · admin — loopback-only

Human authority boundary

approvals.py

Hash-chained decision ledger

An authenticated coordinator approves or rejects an eligible proposal. Each decision is bound to the exact plan seal and appended to a tamper-evident chain — stale plans and duplicates are refused (HTTP 409). You can always answer: who decided, on what evidence, and when.

Optional agent boundary — engaged only after a plan is sealed AND verified

The deterministic lifecycle above works fully offline. This path is optional and read-only.

A · PACKET

Sealed, verified packet

closed · read-only · no raw report strings or credentials

B · SELECT

OpenAI Responses API

returns only opaque citation IDs · INTERPRETIVE_ONLY

C · RENDER

Local controlled rendering

every visible sentence from fixed templates + sealed values

D · READ

Human reading guide

shown only when its seal and input bindings hold

The provider cannot invent a family, route, resource or metric · change urgency, capacity or evidence status · write operational instructions · approve, reject, or dispatch anything.

Zero dispatch authority. No endpoint, button, or model call can send a boat, alert an external channel, or rank the value of human lives. The software proposes; a person decides.

Facts have sources

A report must be verified and fresh before it can shape a plan. Contradictions are downgraded, never averaged away.

Corrections preserve the past

Reports create revisions; a correction supersedes the snapshot while keeping the previous report in the hash-linked ledger. Old plans go stale, not silently actionable.

People stay accountable

Every proposed action waits for an authorized human, and every decision is written into a tamper-evident chain checkable offline.