Conflict Intelligence · Open-Source · Production-Grade

TREMOR: composite conflict intelligence at admin-2 resolution.

Detects when two or more distinct conflict sub-types converge in the same district × ISO-week on ACLED event data, then routes structured alerts through a hardened multi-channel pipeline.

Open-source. Reproducible. Built from open data. Not a forecast. A signal.

Sahel + Lake Chad Basin 13 countries v1.0
Operator Bulletin · Rendered from alert.json
2026-W16 · FROZEN SAMPLE

Composite escalation signal · Soum, Burkina Faso

District
Soum · Sahel · Burkina Faso (admin-2)
Trigger
5 sub-types converging · 4.2× regional baseline
Severity
CRITICAL · function_tag CONCURRENT
Verification
detected 2026-W16 · visible through 2026-04-26
alert.json · schema v1.0
row of alerts table
{
  "geo_key":             "BF-Sahel-Soum",
  "admin2":              "Soum",
  "admin1":              "Sahel",
  "country":             "Burkina Faso",
  "region":              "Central Sahel",
  "composite_types":     5,
  "baseline_multiplier": 4.2,
  "surprise_score":      0.87,
  "empirical_probability": 0.018,
  "is_novel":            true,
  "severity":            "critical",
  "function_tag":        "CONCURRENT",
  "detected_week":       "2026-W16",
  "status":              "active",
  "expires_at":          "2026-04-26T00:00:00Z"
}

Methodology

Detection performance, not forecasting.

TREMOR does not predict violence. It detects a specific, historically rare pattern: the convergence of two or more conflict sub-types in a single district-week. It measures how reliably that pattern precedes next-week escalation.

The estimator · Poisson PPML

attacksi,t+1 = exp( αi + γct
  + β · compositei,t
  + δ · L.non_outcomei,t )

αi            district fixed effects
γct           country × year-quarter fixed effects
composite       1 if ≥2 event sub-types in (district × ISO-week)
L.non_outcome   lagged count of non-outcome events (t-1)
SE clustering   district (geo_key)

Outcome is next week’s attack count, giving a T+1 ISO-week evaluation horizon. Fixed effects absorb time-invariant district characteristics and country-specific seasonality. District-clustered SEs correct for the serial correlation standard in conflict count data.

The detector · composite co-occurrence

A district-week fires when ≥2 distinct ACLED event sub-types are observed in the same admin2 × ISO-week cell. Severity scales with three signals on the alert payload:

composite_types
Count of distinct sub-types (higher → more severe).
surprise_score
Historical rarity of this exact type-combination at this location.
empirical_probability
Base-rate frequency of this composite across the panel.

Detection performance · robustness check at N=2

A spot-check at the minimum composite (N=2 sub-types) reproduces an 8.8× lift in next-week attack incidence versus district-weeks without composite co-occurrence. This is one point on the detection-performance curve, not a headline statistic, and is reported with the honest limitations below.

  • Lift reported as a sample-wide in-sample point estimate; bootstrapped 95% CI pending the forthcoming identification-robustness tab.
  • Evaluation horizon: T+1 ISO-week (next-week attack count).
  • Rare-events / class-imbalance context applies.
  • The regression tests signal rarity (robustness), not causal identification of violence.

Spot-check matrix · N=2

Attack t+1
No attack
Composite
TP
FP
No composite
FN
TN

Counts pending identification-robustness tab (Tab 9 of the workbench). Lift 8.8× corresponds to TP / (TP+FN) relative to base rate in no-composite cells.

Decision Layer

An alert without an owner is noise.

Every alert enters a structured five-step workflow from dispatch to dossier. No orphan alerts; every decision is captured in the audit log. The workflow is shipped in the TREMOR dashboard.

  1. 0
    Acknowledge & Assign

    Alert routes to on-duty operator. Timeout ladder: primary → secondary → escalation. No orphans.

  2. 1
    Exposure

    Operator confirms which programmes, assets, or staff intersect the flagged district-week.

  3. 2
    Outcome

    Structured capture of what happened: verified incidents, no incidents, access change, de-escalation. Ground truth generator.

  4. 3
    Response

    Structured capture of operator action: paused activity, rerouted logistics, issued sitrep, no action (with rationale).

  5. 4
    Dossier + Handover

    Longitudinal record per district, joining alert → exposure → outcome → response. Handover state flips ownership on operator rotation.

The workflow is not an add-on. It closes the loop between detection and action, and it generates the labelled outcome data needed to evaluate the detector itself over time.

Alert Infrastructure

Fail-closed. Silence is failure.

Five Supabase edge functions dispatch alerts across redundant channels. SMS via Africa’s Talking is the durability tier; push via ntfy.sh is best-effort; USSD is infrastructure-ready pending per-country MNO agreements. A dead-man-switch treats pipeline silence as an outage.

alert-processor Shipped

Dispatches per-user with severity threshold filtering. Enforces a 20/hr global rate limit.

Known: global rate-limit keying; per-sender keying is P2.

push-sender Shipped

Push notifications via ntfy.sh with priority tags and click-through to dashboard.

Tier: best-effort. No SLA. SMS is the durability fallback.

ussd-handler Sandbox-validated

Serves alerts over USSD menus for feature phones and low-bandwidth field staff.

Live dispatch contingent on per-country MNO aggregator agreements (shortcode + regulator).

dead-man-switch Shipped

Heartbeat: pipeline ETL completion. Timeout: 6 hours. Destination: SMS to maintainer.

Escalation: ntfy priority-5 if SMS fails. Silence = failure.

send-test-alert Shipped

Reproducible test harness: inserts canonical alert + dispatches + writes to audit_log.

No mocks. Real insert, real dispatch, real audit trail.

All dispatch outcomes (success, failure, partial) are recorded in notification_log with per-channel status. The audit_log table is append-only and mirrors every dispatch, form submission, and decision.

Architecture

Open data in. Structured alerts out. Every write audited.

ACLED API
    ↓ weekly pull · ISO-week cadence
pipeline.py
    ↓ admin-2 boundary join
    ↓ Poisson PPML + composite-type detector
Parquet / CSV staging
    ↓
Supabase (Postgres + RLS)
    tables: alerts, notification_log, audit_log
    ↓
5 edge functions
    ↓                ↓              ↓
ntfy.sh         Africa’s      USSD
(push)          Talking       (sandbox)
                (SMS)
    ↓
Dashboard (React + i18n, 9 stations)

admin-2 × ISO-week resolution. ACLED geocoding is consistent at admin-2; ISO-week matches the ACLED update cycle and avoids day-of-week noise.

Named RLS policies. alerts SELECT is scoped by country ∈ user.countries; all writes are via edge functions using SERVICE_ROLE_KEY; audit_log is append-only.

First-class audit. audit_log and notification_log are first-class tables, not side effects.

Integrity & Limits

What the system guarantees, and what it refuses to claim.

Integrity

Row-level security
alerts SELECT scoped by country ∈ user.countries. Writes via edge functions using service role. audit_log append-only.
Audit trail
Every dispatch, form submission, and decision recorded in audit_log. Append-only, retained for the operating lifetime of the deployment.
Internationalisation
English and French primary. Extensible to Arabic, Hausa. Monolingual tooling is a non-starter in the target region.
Multi-operator coordination
Alerts broadcast via Supabase Realtime. Concurrent-write reconciliation on the dossier is a known consistency gap, P2 on roadmap.
Data governance
ACLED licensing compliance for derivatives. RLS admin role held by maintainer. Data-steward responsibility named in CONTRIBUTING.md.

Limits · what TREMOR does not do

  • Not causal attribution. Detects co-occurrence; does not claim a specific event caused escalation.
  • Not incident-level. admin-2 × ISO-week resolution. Cannot answer “which village next Tuesday.”
  • Not ML. Detector is a rule; regression is for robustness. XGBoost / deep temporal on roadmap.
  • Not actor-aware. Does not identify which armed groups are co-present. Roadmap.
  • Not an intelligence product. No classified inputs. No indications-and-warning outputs. Civilian open-source.
  • Not an acknowledgement system of record. Integrates with organisational comms, does not replace them.
  • Not integrated with UNDSS / INSO / Humanitarian Access Working Group feeds. Roadmap.
  • Bound by ACLED. Coverage, lag, and known coding biases (urban, English-language, conflict-salience) propagate.
  • Rare-events context. Class-imbalance applies to all detection-performance metrics.