The charter: what the programme is, and what it stands on
This page owns the problem and the shape of the answer. Goals, boundaries, sequence, mechanism and people each have their own page — this one links to them rather than restating, because in draft these six artifacts overlapped badly and separating them by the question each answers is what fixed it.
The problem, stated narrowly enough to be wrong
Detection today is dominated by fixed cameras and human lookouts, and both share a limitation: they see smoke once it has cleared the canopy. The window in which a fire is still small — and therefore still cheap to stop — is measured in tens of minutes, and most of it is spent getting a human to look at something.
The programme's claim is deliberately narrow: an aircraft already overhead, scoring frames on board, can compress the time between ignition and a human decision to under five minutes — and can do it without a radio link, because inference happens where the photons land.
That is a testable claim rather than a vision, which matters more than it sounds. The goals page carries the measure that would falsify it.
The mental model: five bounded contexts
The design is organised around five questions rather than five components. Each context is defined by the question it answers, and that is what stops them collapsing into layers stacked on one another.
| Context | The question it answers |
|---|---|
| A — Detection | Is there a fire, where exactly, and how sure are we? |
| B — Airspace and flight | May this aircraft be in this volume right now — and what does it do when it cannot talk to anyone? |
| C — Suppression | May this release happen, and did it do what was intended? Specified as demand, unwritten as design. |
| D — Connectivity | What can be carried, over what, right now — and what is the honest degraded behaviour when the answer shrinks? |
| E — Authority and record | Who is responsible for this ground, who authorised this act, and can the organisation reconstruct it later without the supplier? |
Context D is the unusual promotion. Most programmes treat connectivity as infrastructure sitting inside another context. Here it is first-class, because in this terrain connectivity is the constraint rather than a detail of one — and treating it as infrastructure is precisely how a system acquires an undeclared dependency on a link it has no licence to use.
Context C is drawn as a gap on purpose. What suppression must do is fully specified. How it works is not written. That is the second-largest gap in the corpus and it is recorded as one rather than described as future work.
Ten invariants, and what actually enforces each
An invariant not attached to an enforcing artifact is an aspiration. All ten are attached — eight to business rules, two to non-functional standards. That split is itself a design decision: auditability and graceful degradation are properties of the whole system rather than decisions at a moment, so a rule is the wrong shape for them.
| # | Invariant | Enforced by |
|---|---|---|
| 1 | A human authorises every release. | Rule — no suppression release without human authorisation |
| 2 | Crewed aircraft have right of way. | Rule — crewed aircraft right of way |
| 3 | A detection is a claim, not a fact. | Rule — a detection carries its confidence and provenance |
| 4 | Two sources before suppression. | Rule — two-source confirmation |
| 5 | Lost link is a planned state. | Rule — lost link is a planned state |
| 6 | The agency of jurisdiction owns the order. | Rule — the agency of jurisdiction owns the order |
| 7 | Licensed spectrum, or it does not fly. | Rule — spectrum use is licensed |
| 8 | Every autonomous decision is reconstructable. | Standard — auditability |
| 9 | Degrade toward safety. | Standard — graceful descent |
| 10 | A known legal fire is not a detection. | Rule — a registered burn is not a detection |
An earlier internal version of this material asserted that “the four rules not mapped to a numbered invariant are exactly the four suppression safety rules.” That is false. Invariant 1 is enforced by the human-authorisation rule and invariant 4 by two-source confirmation — both suppression rules, both mapped, and the first of them is anchored to the first invariant in the set.
The claim had propagated to nine places across seven artifacts before anyone checked it against the source mapping. It is corrected rather than quietly fixed, because a library that silently repairs its own errors is teaching you the wrong thing about how much to trust it.
The real coverage gap is narrower and stranger. Four rules carry no numbered invariant: imagery and observation retention, no drop over unverified ground personnel, absolute retardant-avoidance areas, and water-source authorisation. Two are suppression rules and fit the late-milestone explanation. One is a privacy rule and one a water-source rule, and neither is late. Whatever drew that boundary, it was not simply the detection/suppression split — and the library does not know what it was. An open question is a better answer than the tidy one that turned out to be wrong.
The programme's relationship to its hosts
The programme owns no ground, holds no statutory protection responsibility, and cannot acquire either. It operates inside organisations that hold both. Three consequences run through every other page in this library.
- The system offers only what an instrument permits. A suppression order is blocked outright where jurisdiction is unresolved — not warned about, blocked. The screens page shows what that looks like: the control is absent rather than greyed out.
- Telling across a boundary can be automatic; acting across one never is. Notification crosses jurisdictional lines freely. Authority does not.
- The organisation must be able to audit the programme without the supplier. Treated as a precondition of the programme existing rather than as a feature — an investigation you cannot run yourself is one you do not control, and it cannot be retrofitted after an incident, because the uncaptured data is not recoverable.
Current state: nothing is built. No aircraft has flown, no software exists, no agency has been approached, and no authorisation is held or applied for. Every figure anywhere in this library is a design target or a declared placeholder. The plan says what would change that and in what order.