How this would actually run

Nothing in this prototype is connected to any government system. No live feed is polled, no official API is called, and no government database is read or written. The following is exhaustive.

This prototype approves nothing, dispatches nothing and decides nothing. No officer is bound by anything it displays.

India already generates these warnings. Five agencies issue them, each for its own hazard, and NDMA’s Sachet platform already aggregates and broadcasts them in CAP — the Common Alerting Protocol, an OASIS standard. The problem this prototype addresses is not that the warning does not exist. It is what happens to it in the last hundred metres.

Suno sits in the last box. It is a renderer of alerts that already exist, not a new source of them. That distinction matters legally as much as technically, and section 04 explains why.

The integration is a CAP subscriber: poll or receive the feed, parse identifier, sent, onset, expires, severity, urgency, certainty, areaDesc, instruction, and map severity × urgency onto the four-level citizen scale. The alerts in this build already carry those exact fields, which is what makes the claim testable rather than aspirational.

Sachet and IMD issue bulletins in English and Hindi. The Eighth Schedule of the Constitution recognises 22 languages.

That gap is not abstract. Every district in this prototype with an active warning is a district where it bites: Golaghat and Guwahati read Assamese, Puri reads Odia, Wayanad reads Malayalam, Nagpur reads Marathi. A flash-flood warning that reaches a Golaghat household in English is not a warning. It is a notification that something is wrong, in a language somebody in the house now has to go and find a translation for — during the two hours the warning was trying to buy them.

Two further things follow from designing for that reader rather than for a reviewer. The warning is spoken aloud, because reading and literacy are different problems and only one of them is solved by translation. And the language is chosen by the district, not by a menu — pick Golaghat and the interface is already in Assamese, because a person in a flood should not have to find a settings screen first.

Under the Disaster Management Act, 2005, the authority runs NDMA → State Disaster Management Authority → District Disaster Management Authority, chaired by the District Magistrate or Collector. In practice the instruction to leave is issued by the District Magistrate, executed by the district administration, and supported by NDRF and SDRF.

Suno never issues one. It renders an order that already exists in the feed, and the language model is explicitly forbidden from originating one — the rule is enforced in code, not in a prompt suggestion. If no evacuation order exists in the data, no evacuation instruction can appear on the screen, in any language, by any path.

The practical consequence for deployment: this would be operated by, or under, a District Disaster Management Authority, and the escalation path for a wrong or stale warning has to be the DDMA control room — which is why 1077, the district control room number, is in the helpline list and not just 112.

“Mark yourself safe” is four lines of code and a genuinely difficult institutional question. A national register of who is safe means a national register of verified mobile numbers and their status, which touches telecom operators licensed under the Department of Telecommunications, and it means holding location-adjacent personal data about people during the period they are most vulnerable.

Three things would have to be settled before this could exist for real:

• Who holds it. A register operated by an aggregator is a standing target. One operated per-district under a DDMA is fragmented exactly when families are searching across districts.
• How long it lives. A safety status is useful for days and dangerous for years. It needs a deletion clock written into the design, not into a policy document.
• What it is not. The moment it can be queried by anyone for anyone, it becomes a people-tracing tool. The honest design answer is that a status is only ever readable by someone who already knows the number they are searching for — which is what this prototype does.

In this build the register is your browser’s own storage, and nothing leaves the device. That is a limitation, and it is also the only version of this feature that can honestly be shipped in a prototype.

The interesting failures are not load. They are physical, and this build’s own data makes the first one concrete.

• The tower goes down first. Which is why this app is a service worker with an offline shell, why the rule table answers with no network, and why the language a person chose is cached rather than fetched. Offline it shows the last warning it received with its timestamp, and says it is stale — it never presents a cached warning as current.
• The phone is not a smartphone. Roughly a quarter of Indian mobile connections are still feature phones. The honest extension is an IVR line running the same rule table over a voice call, and a 160-character SMS mode. Neither is built here; both are named because pretending an app reaches everyone is the failure mode this whole page exists to avoid.
• Cell broadcast beats a subscriber list. Cell broadcast reaches every handset in a cell in seconds and needs no registration. Any real deployment should be a renderer for cell broadcast, with the subscribe flow as a fallback — not the other way round, which is how most app-shaped answers to this problem get it backwards.
• The battery is at 4%. The Level 4 screen is deliberately mostly flat colour, has no looping animation, and runs no timers it does not need.

“Use a language model” is a cheap thing to propose and an expensive thing to operate, so here is the arithmetic rather than an assurance. The figures below use OpenAI's published gpt-4o-mini rate at the time of writing — $0.15 per million input tokens and $0.60 per million output tokens — and are worked from this build's own behaviour.

The number that matters is not the total. It is what the total does not depend on. A translation is produced once per alert per language and then cached and served as static text. The cost therefore scales with how many alerts are issued, not with how many people read them. One flood warning for Golaghat costs the same ₹0.15 whether eleven people open it or eleven lakh do.

That is the property that makes this deployable rather than merely demonstrable. A design that called a model per reader would cost a multiple of the annual figure above during the exact hour a district was evacuating — which is to say it would fail at the only moment it was needed. The 500-alerts-a-day figure is an assumption and is labelled as one; the per-alert cost is not, and the per-alert cost is the one that has to hold.

Two costs are deliberately not in that table because they are the real ones, and pretending otherwise would be the kind of omission this page exists to avoid. Native-speaker review of every string in every language is a salaried, recurring obligation, not a one-off — a mistranslated “do not” is worse than no translation. And someone has to be accountable at 3 a.m. when the pipeline stalls mid-evacuation. Those are staffing questions, they dwarf the compute bill, and no amount of engineering removes them.

The model does exactly one job: it answers a question the rule table did not recognise, using only the warnings and guidance already on the page, in the language it was asked in.

Twenty questions — the ones people actually ask in the first ten minutes — are matched by a deterministic keyword table in every supported language and answered by assembling text that already exists in the data files. No generation happens on that path, so identical input always returns an identical answer, and every number in the answer came from the file it was quoted from. Only unmatched text reaches the model.

Whatever comes back is then validated before any person sees it. It is rejected outright if it:

• contains a phone number that is not one of the real helplines
• contains any quantity that does not appear in the source data it was given
• names a shelter, road or river that is not in the register
• tells the reader they are safe, or that they are not — it does not decide that
• claims help has been sent, dispatched or alerted — nothing it does sends anyone
• originates an evacuation order rather than relaying one already in the feed

A rejected answer is not repaired and shown anyway. The reader gets the rule table’s honest “I could not match that”, and the rejection reason is returned in the response so the failure is visible rather than smoothed over.

With no API key the app still works. It falls back to the rule table, and every answer carries a visible chip saying which of the two produced it — rule table, translated rule table, or model. You never have to guess.

The second job is narrower still: turning an agency bulletin written for a district magistrate into ordered actions, and translating grounded lines into the reader’s language. That translation is checked structurally — same number of lines out as in, and every helpline number identical — and the whole batch is discarded if either check fails.

Every decision in this build bought something and gave something up. Listing only the upside is how a design review turns into a sales pitch, so here is the other column.

The honest list of preconditions, none of which this prototype can satisfy on its own:

1. 1A CAP feed subscription from Sachet, with an availability commitment. A warning renderer is only as good as its access to warnings.
2. 2A district-level shelter register that is maintained, with live occupancy. Capacity that is not updated is worse than no number, because it sends people to a full building.
3. 3An agreement with a DDMA about who answers when the app is wrong, and how a bad warning is retracted within minutes.
4. 4A translation review process. Machine translation of an evacuation instruction needs a native speaker in the loop before first use, per language, and a way to correct it in production.
5. 5A cell broadcast path, so the warning does not depend on someone having installed anything.
6. 6A deletion clock on the safety register, agreed before it holds a single real number.

Rule sets are version-stamped so any answer can be traced to the revision that produced it. These identifiers appear on the answers themselves.