| Step | What happens | Who acts | Tool | State of that tool |
|---|---|---|---|---|
| Step 1Plan | The window is set for the season, and lines are drawn against last season's coverage so ground nobody reached gets priority. | Comune sets the schedule. Island Lab plans the lines. The fleet is consulted on what is workable. | Portolan | partial Splits the ground across boats, routes around land, and exports GPX and GeoJSON. Nothing on the boat reads a plan back in, so the handover from plan to run is currently a person with a file. |
| Step 2Survey | A working boat runs its assigned line on a day it was already out. Coverage accumulates across the season instead of arriving as one campaign. | The fleet operator runs it and holds the raw data. Island Lab trains. | Periplus · Triton | partial Periplus simulates a full working day and, since v0.8 on 2026-08-02, writes a validated session document per finished day and reads one back. Triton shows the fleet. No real outing has produced a session yet. |
| Step 3Sign off | A named reviewer checks each run and signs it, or sends it back. Doubtful readings are down-weighted, never silently discarded. | unresolved Nobody formally holds this. See section 03. | no tool | absent The scoring underneath is built and works: every reading carries where, when and how well, and a bad one collapses toward zero rather than poisoning its average. There is no sign-off object, no permission, and no signature. The operator is a hardcoded provenance string. |
| Step 4Publish | The season's sessions are versioned and frozen. Once published, a record cannot be quietly altered. | Island Lab supplies the published version. The comune receives it. | no tool | absent The persistence migration is written and has never been applied. Nothing today makes any record immutable, and nothing produces a versioned season object. |
| Step 5Archive | The comune takes custody as the official record and can produce it on request without asking us. | comune owns Island Lab supplies. | no tool | absent No custody transfer exists in any form: no handover artifact, no checksum, no place the comune controls. See section 06 for what this means today. |
| Step 6Compare | This season against last, with uncertainty stated. A cell that changed because the weather was worse stays distinguishable from one where the meadow moved. | Island Lab supplies the surface. The comune and the community read it. | Tessera | built Runs today on synthetic cells against the real ISPRA extent surveyed 29 November 2017. A cell outside the old polygon renders as disagreement and is counted as disagreement, and an unsurveyed cell never renders like an agreeing one. |
| Step 7Act | What the comparison found is routed to whoever can act on it: an anchoring proposal, a restoration priority, a practice change, a budget line. | comune owns The community and fleet are consulted. | Kairos · Helm | partial An action can be created, displayed and approved by a human. Routing to a named owner who accepts, declines or lets it lapse is thin. No decision record ties a rule to the evidence version it rested on. |
Table scrolls sideways
Between the survey and the sign-off, a person opens a spreadsheet and types two columns for every reading: label (water, air, bad) and in_meadow. Nothing is scored until that happens. It is the specialist that the whole arrangement exists to remove from the middle, and it is still there, which means today an untrained operator's data still passes through trained hands before it becomes anything. Replacing the typing with inference, and giving every reading a confidence instead of a silent verdict, is the single hardest blocker in the plan and is named as such in the survey design.
The cadence above says what happens in a season. This says who carries each function whether or not a season is running. It is the same eleven-row matrix as the operating model, reproduced here so the operations picture is complete in one document.
| Function → who is accountable | Community and fleet |
Comune | Island Lab | FFI | External verifier |
|---|---|---|---|---|---|
| Set the survey scheduleHow often the coast is re-surveyed, and when in the season. | consulted | owns | advises | · | · |
| Plan the linesWhich ground gets covered, at what spacing, in what order. | advises | · | does | · | · |
| Run the surveyA working boat runs the line on a day it was already out. | owns | · | trains | · | · |
| Sign off a runThe quality layer that makes an untrained operator's data defensible. The director role. | · | unresolved | unresolved | · | · |
| Hold the raw dataCustody of the readings as collected, before any derivation. | owns | copy | processes | · | · |
| Archive the recordThe dated, published, immutable version a decision can be defended against. | · | owns | supplies | · | · |
| Method, tooling, quality controlThe protocol, the software, and the trust layer that scores every reading. | · | · | owns | · | · |
| Teach the methodBootcamp, schools, the Paideia Campus layer that makes it survive the grant. | does | hosts | does | owns | · |
| Convene and brokerThe relationship with region, university and investor. | · | party | · | owns | · |
| Verify a credit claimIndependent confirmation that the measurement supports the claim. | · | · | · | · | owns |
| Decide and actAnchoring zones, restoration priority, fishing practice, budget lines. | consulted | owns | · | · | · |
Two rows deserve a note rather than a footnote. Plan the lines and set the survey schedule are split on purpose: the comune decides when and where the effort goes, and the line geometry is a technical job. Step 1 of the cadence therefore has two actors, not one. Hold the raw data is marked owns for the fleet and processes for Island Lab, and that word carries weight: our materials elsewhere say Island Lab is not in the custody chain, which is a stronger claim than this row supports. Section 06 states what is true today.
The premise is that an untrained operator produces defensible data because a named reviewer checks the run and signs it. That role carries authority in the schema and does not exist in the data model: there is no signature field, no permission, and no person named to it. The operator is a hardcoded provenance string. Until someone real sits in that row, the quality claim rests on the scoring alone, and the scoring measures how a reading was taken rather than whether anyone stood behind it.
The decision is who the director is, formally, and it changes the data model, the training and the liability when a run is wrong. It is a governance question before it is a technical one, which is why we are putting it to the partner rather than answering it ourselves.
Our own documents propose two different candidate lists, and we have merged neither. The survey design describes the role by profession: a school director, a survey lead, or a marine biologist. The operating model describes it by employer: a comune employee, an Island Lab role, or a university secondment. Those are different questions (what the person knows, and who pays them) and both have to be answered. Printed here unmerged, because merging them in a document would look like a decision that has not been made.
Build state, layer by layer, read from the platform registry rather than from ambition. Two layers are drawn absent rather than left off, because a reader who finds them later stops believing the rest of the page.
What is physically measured on the water. The fleet carries three sensors: water temperature, light, and GPS position. That is the honest list, and it is what makes today's outing a temperature and position survey.
Side-scan or single-beam returns, which is what turns position and temperature into a map of what is on the seabed. Nothing is built. No echosounder, no ingest, no log reader for any sonar format anywhere in the system. Every depth on every surface is either an open bathymetry grid or a synthetic distance-to-coast stand-in, labelled as such where it is displayed. Getting there is a hardware purchase plus a reader that does not exist.
Device to cloud, with a store-and-forward buffer so a reading taken out of coverage survives, and a versioned transform into database columns. Deployed in a fixed order every time: columns first, mapping second, and only then the app that reads the new fields.
Every reading carries where, when and how well it was taken, combined into one score. A weak reading is down-weighted rather than deleted, a lone weak reading is flagged as needing replication, and a bad reading collapses toward zero instead of poisoning its average. Provenance is a fixed vocabulary, so a modelled number cannot be displayed as a measured one.
Planning the lines and running them. The simulator models a working day honestly: quality degrading with speed, depth and sea state, coverage accumulating, fuel and time draining against the day. A finished day now writes a validated session document that can be read back in. The plan and the run still do not read each other's files.
The per-cell surface and the comparison against the 2017 extent. One known defect: two grid systems are in play on one map, an H3 hex grid and an equal-angle grid, visible only because one layer is off by default. Converging on one is open work.
Version a season's result, freeze it so it cannot be silently altered, and transfer custody to the municipality. This is the difference between a record and a report, and it is the hinge of the sovereignty claim. Nothing is built. The persistence migration is written and has never been applied. No versioned season object, no checksum, no handover artifact, and nothing downstream that depends on a held record can be built against anything.
What the meadow does next under a given plan. The Posidonia model is a single-box model, not a per-cell simulation, and it does not yet take survey quality as an input, so better surveying does not visibly narrow a result. The honest interim product is a per-cell surface of observations rather than predictions.
Routing what the monitoring found to whoever can act on it, and recording what they did. The action object exists and a human approval is logged against it. What is missing is the record that ties a rule to the evidence version behind it, so that a rule can be looked at in two years and the survey under it found.
The whole argument is that the record survives our absence, so this section has to be exact rather than aspirational. It is the weakest part of the system today and it is where the next build goes.
Nothing produced by this system. No file, no login, no archive. Every artifact that exists sits in infrastructure Island Lab administers, and everything a municipal officer could show an auditor tomorrow would have been sent to them by us.
What exists as a file, and could be handed over by email this week: a session document per finished simulated day, a route file per planned survey as GPX or GeoJSON, and a per-cell comparison rendered from synthetic readings. None of them is frozen, versioned or checksummed, so none is yet a record.
The 2017 ISPRA extent is open data, published through EMODnet, and a comune can hold and republish it today without us and without a licence conversation. It is the base every argument currently rests on. It is also the thing being checked, which is why holding it is not the same as holding a record.
What the community owns has never been written down. Raw logs, derived maps, or both, and under what licence. Sovereignty is claimed in our materials and defined in no document. Until it is drafted, custody is a design intention rather than an arrangement anyone could enforce.
| Link | Who holds it in the design | Who holds it today | The gap |
|---|---|---|---|
| The raw readings | The community and the fleet, as collected, before any derivation. The comune keeps a copy. | Rows in the platform database that Island Lab administers, each stamped with its provenance. | No copy sits anywhere the comune controls, so owns in the matrix is an intention and processes is the operative word. |
| The signature | A named director, per run, with the authority to send a run back. | nobody | No signature field, no permission, no person. Section 03. |
| The published record | A frozen, versioned season, checksummed, that cannot be silently altered. | Nothing is frozen. Every surface renders live from the current state of the data. | The persistence migration is written and unapplied. This is the first thing to build. |
| The archive | The comune, as the official record, on its own infrastructure or a holder it names. | No archive exists, and no handover artifact exists to put in one. | Depends entirely on the published record above, so it cannot start first. |
| Production to an auditor | The comune produces the dated record and the method behind it, without asking us. | Only Island Lab can produce anything. | That dependency is the exact thing the design removes, and it is still fully in place. Naming it is cheaper than being caught by it. |
Table scrolls sideways
Assembling three surfaces into one document surfaced five conflicts. Each is printed with the version this brief takes and why. The registry is authoritative on tool status; a rendered page is not.