Prepared for Michael Smorenburg · Two-Town Pilot Scope
The scrumhalf, not the ball-carrier. It does not carry the ball, it puts it in play and makes sure the right player catches it.
A town already has responders: private ambulance, armed response, neighbourhood watch, police, fire. They are just disconnected. CrisisNexus is the intelligent control room that ties them together. For the pilot it runs in parallel with the town's existing setup, logging and recommending, while the town's current operators stay the live safety net.
CrisisNexus takes the call in any language, works out what is happening and where, routes it to the right existing responder, and confirms they actually have it. It never presents as the ambulance. That positioning is also what keeps the pilot on the right side of the law: we orchestrate, we do not respond. The scope is deliberately tight: emergency intake, structured incidents, routing, and acknowledgment.
The gap is not a lack of ambulances or armed response or watch volunteers. The gap is that they are disconnected, and a panicked caller has to know which one to phone. CrisisNexus closes that gap without replacing anyone.
The whole pilot is a single loop, and the loop is the product. Every step is designed for the bad day first: the AI unsure, the network down, nobody answering.
A call we "sent" that nobody caught is the failure that hurts someone. So the acknowledgment loop is built into every responder adapter, not bolted on after.
Every dispatch requires a positive "received, we have got it" back from the responder. No acknowledgment within the set time triggers a retry, then escalation to a human or an alternate responder. The loop must never falsely believe a call was caught.
Core is the safe minimum that proves the loop, and nothing more. We classify by risk on the live path, not by how cheap a feature is to build.
Voice and WhatsApp as the primary channels, SMS as the fallback. The lowest-tech channel must always work, because data and signal fail first in a real crisis.
The caller speaks their own language. The system structures it into an incident, keeps the original words as the authoritative record, and presents English to the operator. Languages start with the two towns' actual languages and expand by config.
Structured incidents with a severity score, a confidence level, and an explicit "unsure" branch. Low confidence or high severity forces escalation to a human. The system escalates the moment it is uncertain.
A web console where the supervisor sees the live queue, the AI's recommendation and its confidence, and confirms or overrides. In a parallel run this is where trust is earned, by comparing what the system would do with what the operator actually does.
Match the channel to the responder's reality: a control room gets an interface, armed response gets the app or a structured push, a watch volunteer gets an SMS. For statutory services with no agreement, the system recommends and the human relays.
No dispatch is complete until a positive "got it" returns. No acknowledgment in time means retry, then escalate to a human or alternate responder. Built into the responder adapter, attacked in testing until it is boringly reliable.
Every event logged with the caller's own words and the English, plus time, location and identity. Append-only and complete, even under load. This is both the safety audit and the evidence base for the parallel run.
One internal incident format, with every channel and responder a thin adapter that translates to it. Adding the next town, sensor or control room is one adapter, never a change to the core. This is the defensible engine.
These are hard requirements engineered into the loop, not features that can be traded away.
The system escalates to a human the moment it is unsure or the situation is serious. The escalate-to-human path is built to be more reliable than the AI it backs up.
Routing is not finished until the responder sends back a positive "got it". No acknowledgment in time means retry, then escalate. A call nobody caught is the failure we refuse to ship.
The AI is unsure, the network drops, nobody answers. The pilot is hardened against these before it is shown off on the easy ones.
The caller's own words and the English are both recorded. The original language is the authoritative record.
The town's current operators stay the live safety net. CrisisNexus logs and recommends until it earns the right to do more, step by measured step.
CrisisNexus never presents as the ambulance. It puts the ball in play and makes sure the right player catches it. That is the product, and the legal posture.
The pilot is light on partner deals by design. Most of the core loop needs no external agreement; the items that do are clearly marked as fast-follow.
In a system people's lives touch, the testing and hardening is the larger half of the work, and it is the actual product. The demo is the happy path. The job is everything that is not: the AI unsure, no location, a responder who never answers, a dropped network, a malformed acknowledgment, a prank, an accent the model struggles with. Each one is a written scenario with a defined correct behaviour, tested adversarially.
The line is crossed the moment a caller's life depends on CrisisNexus instead of on the human whose job it has always been. As long as the existing number stays primary, a human sees every live dispatch, no message goes to the public on its own, and the existing operators remain the safety net, the pilot is both impressive and safe. The testing is the bridge across that line, one measured gate at a time.
It is not a call centre, a dispatch app or a chatbot. It is an orchestration core that speaks one canonical incident format, with a thin adapter for every channel and every responder. The core never knows the specifics of any outside system, so the next town, sensor or control room is one adapter, never a rebuild.
That is what lets a single-town pilot grow into municipalities, regions, provinces and a national grid without repainting the engine. Build the loop right for two towns, and scale becomes configuration.
The parallel run is itself the risk control. Each step up is earned with evidence: structured-correctly rate, routed-correctly rate, acknowledgment success, time-to-escalate, and above all the missed-emergency rate.
Ingests real incidents, structures, recommends, logs. Sends nothing. The town works exactly as today. Pure evidence, zero risk.
Sends to responders with the acknowledgment loop live, but a human approves every dispatch. Existing number still primary.
Runs the loop on a narrow, defined slice while the operator handles exceptions. The existing net stays one step behind.
Telegram and web chat, USSD, panic and tracker feeds, controlled public alerts. Added once the core loop is boringly reliable.
Town into municipality, municipality into region, region into province, province into a national grid. Configuration, not a rebuild.
Stages describe sequence and dependency, not a calendar. Going beyond Stage 02 is a separate, evidence-gated decision.