Map: geofenced watch zones / protected sites — alert rules with geometry, evaluated on incidents #241

New Issue

2026-10-05T02:08:37-04:00

logan commented

2026-10-05 02:08:37 -04:00

Problem

Alert rules match talkgroup, tags and transcript keywords only (alerter.py:133-158; AlertRule in types.ts:266 has no geometry). Nobody can say 'page me for any fire/hazmat/barricade within 500 m of this site/ROW/school'. Keyword rules both miss ('brush fire behind the Scarborough lot') and over-fire ('train of thought').

Who asked

TOC, NOC, RCC, GSOC, NEWS, FD, HOBBY (7 of 8). GSOC: 'the single feature that decides whether my team buys this.'

Proposal

Org-scoped watch_zones (polygon or point+radius, name, tier) with CRUD via c2-core only; GeoJSON/KML/CSV upload.
Predicate evaluated at incident create/link commit: incident location (or any path stop) inside zone AND type/severity floor. Alert names the zone, distance and location confidence (depends on the confidence-styling issue).
Map draws zones; rail gets a 'near my zones' sort.
Delivery: existing webhook first; PWA/Web Push later (no manifest or service worker exists in drb-frontend today).

Data source and terms

Customer-supplied geometry. Turf.js / Shapely (MIT/BSD).

Effort

L

Acceptance criteria

An incident pinned inside a zone fires exactly one alert naming the zone; one outside does not.
Zone geometry is never readable directly from the browser via Firestore.
CISO ruling recorded before customer asset upload ships.

Notes

Blockers: #13 (Firestore rules undeployed — zones must be served only through c2-core), #4 (admin reads not org-scoped), CISO sign-off (utility asset geometry is CEII-adjacent), #85 precedent and #43 for alert payload redaction. BUSINESS_MODEL.md: alerts are not in the Scanner tier. Alert accuracy is capped by #28/#160 geocode quality.

Reviewed against Server origin/main c4e1f9a (2026-10-05), from code only. Source: map persona panel 2026-10-05 (tracking issue lists all items).
Persona key: TOC = county PD real-time crime center supervisor; NOC = Con Ed electric ops NOC; RCC = MTA rail/bus control desk; GSOC = corporate security operations analyst; OEM = county emergency management duty officer; NEWS = TV newsroom assignment editor; FD = volunteer fire chief / county fire dispatcher; HOBBY = scanner power user / local journalist.

## Problem Alert rules match talkgroup, tags and transcript keywords only (`alerter.py:133-158`; `AlertRule` in `types.ts:266` has no geometry). Nobody can say 'page me for any fire/hazmat/barricade within 500 m of this site/ROW/school'. Keyword rules both miss ('brush fire behind the Scarborough lot') and over-fire ('train of thought'). ## Who asked TOC, NOC, RCC, GSOC, NEWS, FD, HOBBY (7 of 8). GSOC: 'the single feature that decides whether my team buys this.' ## Proposal - Org-scoped `watch_zones` (polygon or point+radius, name, tier) with CRUD via c2-core only; GeoJSON/KML/CSV upload. - Predicate evaluated at incident create/link commit: incident location (or any path stop) inside zone AND type/severity floor. Alert names the zone, distance and location confidence (depends on the confidence-styling issue). - Map draws zones; rail gets a 'near my zones' sort. - Delivery: existing webhook first; PWA/Web Push later (no manifest or service worker exists in drb-frontend today). ## Data source and terms Customer-supplied geometry. Turf.js / Shapely (MIT/BSD). ## Effort L ## Acceptance criteria - An incident pinned inside a zone fires exactly one alert naming the zone; one outside does not. - Zone geometry is never readable directly from the browser via Firestore. - CISO ruling recorded before customer asset upload ships. ## Notes Blockers: #13 (Firestore rules undeployed — zones must be served only through c2-core), #4 (admin reads not org-scoped), CISO sign-off (utility asset geometry is CEII-adjacent), #85 precedent and #43 for alert payload redaction. BUSINESS_MODEL.md: alerts are not in the Scanner tier. Alert accuracy is capped by #28/#160 geocode quality. --- Reviewed against Server origin/main c4e1f9a (2026-10-05), from code only. Source: map persona panel 2026-10-05 (tracking issue lists all items). Persona key: TOC = county PD real-time crime center supervisor; NOC = Con Ed electric ops NOC; RCC = MTA rail/bus control desk; GSOC = corporate security operations analyst; OEM = county emergency management duty officer; NEWS = TV newsroom assignment editor; FD = volunteer fire chief / county fire dispatcher; HOBBY = scanner power user / local journalist.

logan added the

type

feature

area/map area/frontend

labels 2026-10-05 02:08:37 -04:00

logan referenced this issue

2026-10-05 02:09:11 -04:00

Map roadmap — persona panel 2026-10-05 #247