The Compact — Disaster Data Exchange

The worst time to agree on data
is after the declaration.

When a declaration lands, which agencies' data can we use under terms signed in advance? Is it arriving as fast as the provider agreed? And what is still missing? One number answers all three: COVERED UNDER AGREEMENT n of 10.

California reference implementation · live federal declaration record · nine real public endpoints · 771 assertions green Keyless · no keyed provider · grants, activates and revokes nothing

The decisions this drives

Activate what was agreed. Request what is missing. Stand down cleanly.

Activate. Which pre-agreed packages are now in force for the declared area, so the GIS unit can stop phoning around and start using them.
Request. Which gaps to request, from which provider, with what justification, by when, approved by whom.
Stand down. Which access each provider must now withdraw, and what the record of sharing says.

The app makes none of these happen. It moves no data and mints or revokes no access. It tells the coordinator what the agreements say should now be true, checks whether it is, and drafts what to send.

Buyer: the state GIO and the emergency-management data officer Way in: the paper DSAs they already hold

19 yearssince the National Academies wrote Successful Response Starts with a Map (2007), and it is still a recommendation rather than a product

“Develop agreements between geospatial professional teams at the municipal, state, and federal levels to predetermine the data and products to be used, generated, and shared during a disaster.”

NIMS (2017) asks for agreements “in place … at the time of an incident”, including data format standards, and publishes no format for one. Partners not knowing what they may share is a GAO finding on the record (GAO-20-396).

The finding that shaped the app

No standard governs the agreement itself.

NIMS demands it

Doctrine asks for agreements made in advance, covering “connection of networks, data format standards, and cybersecurity”. It gives no form, schema or register for one. EMAC shows the pattern, agreeing the package in advance so that activation becomes selection, but EMAC covers personnel and equipment only.

DCAT describes the package

DCAT-US 3.0 describes a dataset, its distributions and its access and use restrictions. It has no field for an agreement, a named recipient, an activation condition or an agreed refresh cadence. Everything DCAT leaves out goes into the compact.

EDXL-RM has no data message

Its 16 messages cover “emergency equipment, supplies, people and teams”. None of them requests a dataset. The app exports a data request in an EDXL-RM envelope, labels the envelope as borrowed, and never claims conformance.

So the app holds the missing record as a register, with one field for each piece of doctrine: provider and subscriber, the package in DCAT terms, the activation condition, the agreed cadence, the access and use restrictions, and the recovery tail. Then it checks real endpoints against that register.

Fourteen products and artefacts, read on 2026-10-21

Discovery is solved. Plumbing is solved. The agreement is still paper.

Benchmark	What it does	Ties a standing agreement to a declaration, and measures delivery against the agreed cadence?
HDX (Data Grids · Connect)	completeness per humanitarian crisis; freshness against the publisher's own frequency	Partly: freshness for anyone, with no agreement and no declaration
Copernicus EMS Rapid Mapping	activates products made for you by pre-registered users	No: these are not partners' datasets
FEMA GeoPlatform · CA Geoportal · Cal OES hub	discovery by event, name and place	No: it shows that data exists, not that you may use it
Juvare WebEOC · Veoci · Intterra	share boards and incidents; “activate your EOC in one click”	No: they activate the EOC, not the data
Esri collaborations · Delta Sharing	trust between organisations; revocable, audited shares	No: plumbing that is not aware of emergencies
Oregon OEM sample GIS DSA	activation, “periodic updates”, termination: “discontinue use… destroy”	Written down, but nothing checks it
The Compact	the register, the declaration trigger and measured freshness against what was agreed	Yes, and every input is public

HDX can say available and up to date. It cannot say “as agreed, for this declaration.” A portal can say exists. It cannot say “we may use it now, and it is late.”

Why this is buildable at all

The trigger is federal and live. The packages are real endpoints.

The trigger

OpenFEMA's declarations record, read and never interpreted. Since January 2025, every California declaration has been FM or EM, and the last major disaster was DR-4856 on 2025-01-08. So “the declaration” cannot mean a DR only. Each agreement names its own condition, and state or local proclamations are entered by hand and labelled MANUAL.

The geography

The record holds county rows and no geometry. It is joined by FIPS to the California Geoportal's county polygons. “In the declared area” means a polygon intersection, sent by POST, never a radius or a bounding box. The SEMS operational area is the natural boundary for a compact.

The packages

9 packages from 7 real providers, with 31 grants: CAL FIRE perimeters and DINS, NIFC WFIGS, Cal OES evacuations and outages, LA County alert areas, CHHS open shelters, Caltrans lane closures and HCAI facilities. Each one is that agency's own public endpoint, probed, with its fields and cadence quoted.

Measured freshness differs from what the records claim

The open-shelter layer is rebuilt daily at about 07:00 PT and lags a day, and its licence says “not to be aggregated”, so the package carries that restriction. The evacuation layer advertises a five-minute rebuild but only writes when something changes. The federal declarations dataset's own refresh stamp is a year older than its newest row.

And the record caps itself without saying so

Without $top, OpenFEMA returned 1,000 California rows with metadata.count 0. Nothing in the response said that 691 rows were missing. Only $count=true reports the real total of 1,691. The app sends both and prints capped when they disagree. Its CDN cache can also surface a new declaration up to ~12 minutes late, so the app prints the rundate beside the fetch time.

The application, first screen

Members, a coverage map, a grant matrix, and one number.

The Compact at first screen on FM-5662-CA, GANN FIRE in Calaveras County: members panel left, the declared county drawn in orange on the coverage map, the grant matrix right, and the data grid below reading COVERED UNDER AGREEMENT 3 of 10.

Shipped build, 2026-10-22. This is a browser screenshot taken by the automated driver, not a mock-up.

Auto-selected, and it says so. The newest federal declaration is FM-5662-CA, GANN FIRE, Calaveras, labelled “auto-selected: newest federal declaration — pick any”.
Three phases, one map. Blue sky · Activation · Stand-down. All three share the coverage map, which carries the standard controls.
The grant matrix. Packages × subscriber roles (OA · REG · SOC · JFO), not organisations. 23 of 31 grants are in force.
The FEEDS strip. Every polled source shows its delivery stamp, its time of record, its fetch time and its polling cadence.
A standing notice bar. It reads: not the agreement of record, not an access-control system, not the declaration of record. Every export repeats it word for word.

The signature loop

Pick a declaration, and the agreements answer.

A covered need clicked: the WFIGS incident is previewed in place on the map inside Calaveras County, and the right panel shows the PK-02 package passport with its endpoint, activation condition, agreed cadence, delivery evidence, access terms and measured state.

Click a need and its data is read in place, by POST with a polygon (“1 of 1 drawn, read in place from NIFC”). The package passport opens with the provider's terms beside the measured state. Click it again to release it.

Data grid · FM-5662-CACalaveras

COVERED UNDER AGREEMENT 3 of 10

✓Incident locations · NIFCCOVERED agreed every 5 min · refresh stamp 24 min old · stale after 30

✓Open shelters · CHHSCOVERED 0 open in Calaveras: empty, not a gap

◌Fire perimeters · CAL FIRECADENCE NOT VERIFIABLE writes only on change, so “on time” can't be told from “nothing happened”

○Power outages · Cal OESNOT TRIGGERED activates on DR or EM declarations; this is FM

⊘Shelter capacityNO AGREEMENT no California feed publishes capacity or occupancy

The denominator is always 10. A gap is counted, never dropped, and the breakdown always sums to ten.

How honesty is rendered

Six states, and only one of them counts.

✓ Covered

The package is in force for this declaration and its delivery stamp is younger than its staleAfter. This is the only state counted in n.

◌ In force · cadence not verifiable

The endpoint writes only on change, so “arrived on time” cannot be told from “nothing happened” from outside. The app prints the time of record and does not count the need.

◷ Stale against agreement

It is in force and verifiable, but older than agreed. The agreed cadence and the measured age are printed side by side.

✕ Not answering

The last poll failed. The last good reading is kept and dated, and only that package's indicator degrades.

○ Not triggered

A package exists, but this declaration does not meet its condition. The failing clause is printed, and Draft request asks the provider to share anyway.

⊘ No agreement

No package serves the need. The reason and the likely holder are printed, and a request is offered. This is never drawn as zero and never as covered.

Colour is never the only channel. Every state has a glyph and a word on screen, in the annex and in the JSON. Every state ink clears 4.5:1 on every surface in both modes, and the lowest is 4.72:1. Each figure was computed, not eyeballed.

Gaps become requests

A gap stays a gap until a real endpoint fills it.

The data request form in ICS 213RR discipline, pre-filled for N5 Shelter capacity and occupancy from CHHS with its justification, a needed-by date, priority, requested-by initials and an empty approved-by field; the save button reads Save draft — LOCAL — NOT SHARED.

Draft request on a ⊘ or ○ need opens the form pre-filled, with the justification taken from the gap's own reason.

ICS 213RR discipline. What is needed, why, by when, at what priority, approved by whom. There is no quantity, no order line, no reporting location and no route. It asks one holder for data.
Fulfilled is verified. A request counts as fulfilled only when the endpoint answers ?f=json with an OID. Otherwise the gap stays.
No synthetic fulfilment. The old build closed a request with a made-up “DEMO” debris layer. This one cannot.
⤓ request XML in an EDXL-RM envelope that is labelled borrowed. The live suite fetches the OASIS text and finds every element name the app emits.
LOCAL — NOT SHARED Nothing is sent. The request leaves only as the file you download.

The mirror image

Stand-down: access to withdraw, provider by provider.

EM-3646-CA · Chemical release · Orange County
incident end 2026-05-29 (published in the federal record)
5 packages put in force under the compact
+ each package's recovery tail (14 or 30 days)
= 17 grants across 4 providers to withdraw, all past their tail

◻dormant

◼in force

◼✓access confirmed (local)

◩past tail, withdraw

▨✓withdrawal confirmed (local)

—not granted

FM declarations carry no end date in the federal record, so for those the stand-down date is entered by hand and labelled MANUAL. The app produces a checklist for the providers to act on. It revokes nothing.

Stand-down for EM-3646-CA over Orange County: the withdrawal checklist grouped by provider, each grant with its in-force window and a Confirm withdrawal button, the grant matrix showing past-tail cells, and the annex preview listing its five sections.

The withdrawal checklist, grouped by provider. One withdrawal has been confirmed locally.

The after-action data annex print sheet for EM-3646-CA: a banner on every page, the declared county map, the declaration section, and the who-shared-what-with-whom table with access and withdrawal confirmations.

The after-action data annex: who shared what with whom, when, and how fresh it was. It is offered as an annex to the AAR/IP, never as one.

Proof, not promises

Built, driven and measured on 2026-10-22.

771assertions green: 164 live · 386 offline · 221 in real headless Chrome

55interactions specified, each exercised by a named suite

16 minbetween the live suite's two stamp reads, so “fresh” is observed moving rather than assumed

12corrections found while building it, each written back into the recipe with its mechanism

The standard the sketch misquoted

The recipe's XML used SenderID and DateTimeSent. Those are EDXL-DE envelope names, and EDXL-RM has neither. It also makes OriginatingMessageID and ContactInformation mandatory. The live suite now fetches the OASIS text and checks every emitted name against it.

The stamp that sleeps overnight

WFIGS's refresh stamp sat still across two reads 13 minutes apart, early in the morning. So nothing hard-codes the first-screen n. The suites assert the relations, and at another hour N2 correctly reads ◷ STALE. The same probe found NIFC's own line: refreshed from IRWIN every 5 minutes.

The county with a hole in it

The offline suite caught the Esri-to-GeoJSON converter treating a county's second outer ring as a hole, because the sign test was backwards. A browser run found Undo unreachable after a confirmation, and a phone screenshot showed Calaveras overflowing its 40 % map. All three are fixed and asserted.

Reading the figures: the declarations, county geometry and nine endpoints are real, public and measured. The compact is ILLUSTRATIVE: no agreement exists. The terms are seeded and labelled on every card, cell and export. Seeded terms never enter a measured figure, because freshness is always measured and only its threshold comes from the register.

Stated as boundaries, not caveats

What this application will not do.

It is not the agreement of record. The signed agreement is. No member carries a “verified” badge, because nothing here verifies an organisation.
It is not an access-control system. Each provider grants and withdraws access in its own platform (an ArcGIS collaboration, a Strata Serve token, a share). The app never claims “flips live in seconds” or “auto-revokes”.
It is not the declaration of record. The federal feed is read, not interpreted. A proclamation entered by hand is labelled MANUAL everywhere.
It is not a resource-ordering system. People, teams and equipment belong to the mutual-aid board. This app requests data from the one provider an agreement names.

Four of the nine packages cannot be checked for cadence from outside. Their endpoints write only on change, and the app says so rather than calling them on time.
Freshness history exists only for the times this browser was open. The annex says so and never interpolates.
Confirmations, drills and requests belong to one operator in one browser until exported as compact JSON, request XML, an incident layers.json or the annex PDF.
Write-back is off. The dialog runs its read-only checks against your own ArcGIS tables and posts nothing.

Every one of these is written into the delivered application's README, and most are printed on its face. A data-sharing tool that overstates its reach is the incident's next problem.

Point it at your agreements

The drawer of DSAs you already hold.
Checked the moment it matters.

Import your own compact (members, packages, terms and grants) and the illustrative one is replaced. The import is local and validated, and every endpoint is probed. The next declaration then reads against your agreements and your providers' measured delivery.

Swappable by configuration, not by code: the ten core needs, the packages, the activation conditions, the cadences and the recovery tails are all one JSON register. No agency's terms are hardcoded. The compact is a shape the app renders, not a list of Californian agreements it ships. Run Blue sky drills before the season, so that on the day, activation is selection.

tabaqat.net → Solutions → Emergency Management info@tabaqat.net

© 2026 Tabaqat · Built on Strata. Reference implementation over California, with the declarations record and endpoints verified 2026-10-22. Not the agreement of record, not an access-control system, not the declaration of record. Esri and ArcGIS are named nominatively; this product is not affiliated with or endorsed by Esri.

The worst time to agree on datais after the declaration.