A long-form walk through the protocol — every decision documented.

The UNDP brief asks for a digital tool that mobilises citizens and field volunteers to report damage rapidly after a sudden-onset crisis — conflict, earthquake, flood, wildfire, hurricane, or landslide — with strong AI-assisted validation, multi-language support, offline operation, and alignment with humanitarian information-management standards. Minimum technology-readiness level: TRL 4. Prize pool: $50,000 across three winners.

Sigil/Field treats the first 48 hours as the operating envelope and the brief as a floor, not a ceiling. Where the brief asks for “validation,” we ship eight signals plus reporter-trust continuity. Where it asks for “multi-language,” we ship Whisper voice intake. Where it asks for “offline,” we ship a PWA with an IndexedDB queue and Workbox sync.

And critically: we ship answers to seven problems the brief doesn't name — the differentiators.

Three product surfaces — citizen reporter, validator desk, mobile field app — share one protocol, one data model, one i18n string set, one open-source repository.

The eight signals

1. 01
   Vision match

   Wildfire-ViT for ground-level imagery; xView2-derived ResNet for aerial; BRIGHT for SAR fallback. Returns a confidence per damage class.

2. 02
   EXIF GPS proximity

   Strip and validate EXIF; flag missing, generated, or > 50 m offset from claimed pin.

3. 03
   Alert corroboration

   Check official feeds (alerts.in.ua, USGS, GDACS) for a window encompassing the capture timestamp.

4. 04
   News corroboration

   GDELT plus regional RSS scoring; reduce trust if no source mentions the affected region.

5. 05
   Duplicate hash

   Perceptual-hash search against the archive and the current submission queue.

6. 06
   Building footprint match

   Overture polygon containing or adjacent to GPS; require footprint match for any G3+ claim.

7. 07
   Timestamp sanity

   Sun azimuth, weather log and timezone-of-device must agree with claimed capture time.

8. 08
   Reporter trust ledger

   Continuity of pseudonymous device-bound key, validated-contribution count, NGO/enumerator tier endorsement.

Each entry below is anchored from the manifesto bento on the landing page. Linking conventions: /about#problem-3-N.

Every dependency is permissively licensed. The protocol itself ships under MIT.

Every signal is anchored to a public, persistent source. We prefer self-hostable services and back them with one paid fallback.

From the moment an event triggers, a fresh deployment reaches steady state inside 48 hours. The playbook is opinionated; every hour-by-hour milestone has a containerised step.

We don't ask for phone numbers, emails or national IDs. The trust ledger is built on a device-bound Ed25519 keypair and cryptographic continuity of contributions.

• k-anonymity threshold 5

  Public dashboards only surface reports when at least five independent reporters cover the polygon. Otherwise the reporter is statistically re-identifiable from neighbours.

• Burn-identity button

  In high-risk regions, a single confirmation wipes the local key. Past contributions remain anonymous; the device sheds its history.

• Differential-privacy noise

  Publicly exported counts have Laplace noise added with ε ≈ 1.2. UN analysts pulling from the OData feed receive raw counts under DPA.

• GDPR alignment

  Data minimisation, purpose limitation, right to erasure (via burn). No tracking cookies. No third-party analytics. EU-hosted fallback for sensitive deployments.

• Ethics review checkpoint

  Each deployment goes through a 12-item pre-flight: vulnerable populations, hostile state surveillance risk, language coverage, consent flows, and reporter safety briefings.

Sigil/Field aligns its damage grades with the European Macroseismic Scale (EMS-98) so output is interoperable with Copernicus EMS and other UN-affiliated assessment frameworks.

UNDP requires TRL 4 minimum (component-level lab validation). Sigil/Field is structured to ascend to TRL 7 within fourteen months, with a clear pilot path and audit gates.

Submission identities are pseudonymous for the UNDP intake stage, consistent with our own privacy stance. The full bench discloses under signed CLA after intake confirmation.

Contributors past 6 will be onboarded through the Standby Task Force volunteer network at TRL 5 pilot launch.