# Data Rights Audit

> First run 2026-09-01, prompted by preparing for a federal-channel conversation.
> Every row was checked against the tree, not against a prior document.
>
> **This is an engineering audit, not legal advice.** Four findings below need
> counsel before a federal contract or an acquisition data room. They are ranked
> by how directly they sit under revenue.

`docs/data-lineage.md` already carries a License column and even records a
deliberate license decision (GEM vs USGS faults). That habit is good and is why
most of this audit came back clean. The gap is that the column was applied to
*derived geo datasets* and never to the ingested feeds — so of the ~25 sources in
production, the four carrying actual restrictions were the four with no license
recorded anywhere.

---

## F1 — Mapbox geocoding results are stored permanently (CONCRETE, FIXABLE) — FIXED 2026-09-01

**Status.** Closed. Every path that persists a coordinate now goes through the US
Census geocoder (`lib/geocode-for-storage.ts`) or the Census TIGERweb boundary
service (`lib/geo/resolve-area.ts`), both US federal works with no storage
restriction. Mapbox `places` is used only to show suggestions, which is what its
terms permit. `tests/lib/stored-coordinates-do-not-come-from-mapbox.test.ts`
enforces the split with an empty offender list. Rows stored before the change
were not re-geocoded and carry no provenance (known-debt #88). The text below is
the finding as written.

**What the code does.** `lib/geocoding.ts` calls
`https://api.mapbox.com/geocoding/v5/mapbox.places`.
`app/api/workers/portfolio-ingest/route.ts:260` geocodes a customer address and
then inserts the returned `lat, lng` into `portfolio_locations`.

**Why it matters.** `mapbox.places` is Mapbox's *temporary* geocoding endpoint.
Storing its results is not permitted; permanent storage is what
`mapbox.places-permanent` exists for, and that sits under a different commercial
agreement. This is not a gray area of interpretation — it is the distinction the
two endpoints exist to draw.

**Where it sits.** Directly under the paid portfolio feature. Portfolio upload is
sold from Analyst up (1,000 locations) to Agency (25,000) and ILS Team (100,000).

**Recommended fix — replace the provider, do not upgrade the plan.** The product
is US-only by design. The **US Census Geocoder** is free, public domain, has no
storage restriction, and is the more appropriate authority for US street
addresses in a product whose exposure model is already built on Census tracts.
Switching removes the restriction rather than paying to license it, and reduces a
commercial dependency at the same time.

Mapbox for *map rendering* is unaffected and stays — attribution is already
handled (`attributionControl: true`, required by their ToS and noted in CLAUDE.md).

Secondary note: geocoding v5 is a deprecated API version regardless of the terms
question.

---

## F2 — The cat bond catalog is scraped from a commercial publisher (NEEDS COUNSEL)

**What the code does.** `lib/ingestion/artemis-directory.ts` parses the Artemis Deal
Directory (`artemis.bm/deal-directory`) listing table into candidate rows.

**What is already right about it.** More than is usually the case. Rows are staged
into `cat_bond_candidates` and promoted by `cat-bond-enrich` behind an automated
promotion check (corrected 2026-10-07: this said "human review", and there is none); the module states
plainly that scraped directory data is a lead and not an authoritative catalog
entry; and the source URL is retained for attribution. Migration 108 shows the
provenance sentence is carried through to what a customer reads.

**Why it still needs counsel.** Artemis is a commercial publisher and the deal
directory is its product. 245 bonds derived from it form the catalog behind
ILS Team at $950/mo. The individual facts (sponsor, size, peril, issuance date)
are unlikely to be protectable in the US on their own — but the *compilation* may
be, Artemis is Bermuda-based, and their terms of use are the governing document
rather than general copyright principle.

**Interim measure (2026-09-01, PR 9).** The catalog is no longer republished to
the public: `/bonds` and `/bonds/[slug]` require a signed-in user, are
`noindex`, and are out of the sitemap; `cat_bonds`, `cat_bond_trigger_evaluations`
and `cat_bond_candidates` lost their `public_read` policies (migration 113).
The data is still served to paying and free signed-in customers, so this
narrows the exposure rather than closing the finding — known-debt #92 has the
reversal steps for when counsel answers.

**Ingest paused (2026-09-30).** `lib/ingestion/artemis-pause.ts`: nothing more
is fetched from Artemis while a license is discussed.

**Exit ready (2026-10-07).** The ILS product no longer depends on the catalog.
A customer's positions (`cat_bond_positions`) are their own terms, free text and
user-owned, with no foreign key to `cat_bonds`; their triggers link to those
positions; the account export now includes them. The catalog is a choice:

1. `CAT_BOND_CATALOG_ENABLED = false` in `lib/ils/catalog-switch.ts` hides every
   catalog surface (nav, footer, `/bonds`, the API, the dashboard name match,
   `/for-ils` figures, the Explorer plan line), held by
   `tests/lib/ils/catalog-switch.test.ts`.
2. `scripts/remove-artemis-data.ts` (dry run by default) then deletes
   `cat_bond_trigger_evaluations`, `cat_bond_candidates` and `cat_bonds` rows and
   verifies none remain and no customer position changed. It refuses while the
   switch is on. Dry run against production 2026-10-07: 238 bonds, 434
   candidates, 0 evaluations; 6 customer positions untouched.

If the license is refused, those two steps close F2 for the database; the repo
residue the script lists (a research note, real bond names in one test fixture,
a stale branch) goes in the same PR.

**This is the finding that sits closest to revenue.** It should be resolved
before an acquisition data room, not during one. Options worth pricing: a data
license or partnership with Artemis, sourcing from primary offering documents,
or a first-party catalog built from sponsor filings.

---

## F3 — Microsoft Building Footprints is ODbL, and share-alike (NEEDS COUNSEL)

**What is in production.** 84,044 tract rows in `tract_building_stats`
(`docs/data-lineage.md` records the count as complete), derived from
`microsoft/USBuildingFootprints` per `lib/property/msft-building-footprints.ts`.

**Why it matters.** That dataset is released under the **Open Data Commons Open
Database License (ODbL)**, which is share-alike: publicly using a derivative
database can carry an obligation to offer the derivative under ODbL too. Structure
counts and footprint areas aggregated to census tract are plausibly a derivative
database, and they feed exposure estimates sold in paid tiers.

The repo currently records the source as "Free download from GitHub" and does not
record the license at all — which is how a share-alike obligation goes unnoticed.

**Worth noting there may be no problem.** Aggregate statistics may fall outside
the derivative-database definition, and ODbL's obligations attach to distributing
the database rather than to serving conclusions drawn from it. That is exactly the
judgment counsel should make once, in writing.

**Interim measure (2026-09-01, PR 9).** Attribution — which ODbL requires on a
produced work whether or not share-alike attaches — is now rendered wherever a
count derived from the footprints can appear: "Building counts derived from
Microsoft Building Footprints (ODbL)" on both map attribution controls and on
every printed report footer (`lib/data-attribution.ts`). The share-alike
question is unchanged and still with counsel.

---

## F4 — HIFLD layers carry per-layer terms (RESOLVED 2026-09-01 — all four layers are CC BY 4.0, USGS-credited)

175,873 rows in `critical_infrastructure`, sold as the "Infrastructure overlay"
feature at Agency tier.

HIFLD Open is broadly public, but HIFLD is a *collection* and individual layers
carry their own distribution conditions — some are restricted to government use.
The repo did not record which layers were ingested or under what terms.

**Resolution.** `scripts/hifld-layer-licenses.ts` enumerates the layers from
`lib/data-sources/hifld-layers.ts` (the one list the ingest worker also reads)
and asks each ArcGIS service and its ArcGIS Online item for its own terms. Run
2026-09-01:

| Category | Rows | Service / layer | Item | License | Credit |
|---|---|---|---|---|---|
| hospital | 6,541 | `Structures_Medical_Emergency_Response_v1` / 0 `Hospitals_Medical_Centers` | `2c36dbb008844081b017da6fd3d0d28b` | CC BY 4.0 | USGS |
| ems | 7,045 | `Structures_Medical_Emergency_Response_v1` / 1 `Ambulance_Services` | `2c36dbb008844081b017da6fd3d0d28b` | CC BY 4.0 | USGS |
| fire_station | 52,032 | `Structures_Medical_Emergency_Response_v1` / 2 `Fire_Stations_EMS_Stations` | `2c36dbb008844081b017da6fd3d0d28b` | CC BY 4.0 | USGS |
| school | 110,255 | `Structures_Education_v1` / 2 `Schools` | `e559566d2c1e44a980c2e0be8a610ba1` | CC BY 4.0 | USGS |

All four are USGS National Map **National Structures Dataset** layers (a federal
work, public domain at source) republished by the `Esri_US_Federal_Data`
organization under CC BY 4.0 with "U.S. Geological Survey (USGS)" as the credit.
None is a commercial or official-use HIFLD layer, so nothing is excluded from
`/api/v1/infrastructure` and no `redistributable` column was needed. CC BY asks
for the credit wherever the data is shown: `INFRASTRUCTURE_ATTRIBUTION` in
`lib/data-attribution.ts` is on every printed report footer and on `/sources`.

**Standing rule:** run the script before adding another layer, and add its row here.

### 2026-09-13 — a fifth federal layer, and one rejected

| Category | Rows | Service / layer | Item | License | Credit |
|---|---|---|---|---|---|
| police | 18,223 upstream | `Structures_Law_Enforcement_v1` / 0 `Police_Stations` | `f380e7aad0864f4997d91c9425187077` | CC BY 4.0 | USGS |

Same National Structures Dataset, same organization, same terms as the four
above. `police` was already admitted by migration 027's CHECK.

**REJECTED: Power Plants in the U.S.** (`Power_Plants_in_the_US` / 0
`PowerPlants_US_EIA`, item `b063316fac7345dba4bae96eaa813b2f`, 13,446 rows,
EIA-sourced). It sits on the *same* `FiaPA4ga0iQKduv3` org as the layers above
and so looked like a fifth candidate — but the item's `licenseInfo` reads
**"This work is licensed under the Esri Master License Agreement"**, not CC BY.
`/api/v1/infrastructure` serves whatever is ingested to anyone, so ingesting it
would put non-redistributable data behind a public endpoint. This is the
failure mode the standing rule above exists to catch, and it caught it.

The `power_plant` category remains in the schema CHECK and remains unused. An
openly licensed national power-plant layer would fill it; EIA's own ArcGIS
service requires a token, and no federal alternative was found on 2026-09-13.

## F5 — lifeline infrastructure comes from OpenStreetMap, under ODbL (2026-09-13)

Jeff Merenkov's third ask from the 9 September walkthrough was "here is why we
care about *this* fire — it is close to that substation". The four federal
layers hold only responder and mass-care facilities, so the product could not
form that sentence.

**What was checked first, and why none of it worked:**

| Wanted | Federal status on 2026-09-13 |
|---|---|
| Electric substations | HIFLD moved them behind a token. Public ArcGIS copies are state or individual uploads with no provenance. |
| Water / wastewater treatment | No federal layer published publicly. |
| Communication towers | Same restriction as substations. FCC ASR is a bulk download, not a service. |
| Power plants | Available, but Esri Master License Agreement — see above. |

**Decision.** Ingest these three from OpenStreetMap via the Overpass API under
the **Open Database License (ODbL) 1.0**, recorded in
`lib/data-sources/registry.ts` as `openstreetmap`. ODbL is share-alike, the
same standing as `ms-building-footprints`, already in this register — whether a
derived product is itself a share-alike derivative is the open question in F3
and is unchanged by this addition.

**Conditions this was admitted under, all enforced in code:**

1. Rows carry `source = 'osm'`, distinct from `hifld`.
2. `confidence_score` is **0.75**, not the federal layers' 1.0. The 1.0 rests
   on the same basis `.gov` domains score 1.0 under the OSINT credibility
   rules; volunteer-contributed data cannot claim it.
3. The map popup on an OSM asset says so, on the asset, every time.
4. The ODbL credit is in `MAP_LAYER_SOURCES` and on every
   `/api/v1/infrastructure` response.

**The asymmetry, which is the whole caveat:** a facility *returned* is almost
always really there. A facility *absent* from OpenStreetMap is not evidence
that no facility is there. Measured coverage in Colorado on 2026-09-13: 1,174
substations, 289 water and wastewater plants. Nothing in the product may render
an empty area as "no substations here".

**If HIFLD restricted access is ever obtained** through a government sponsor —
a county pilot customer, or a partner agency — the authoritative rows replace
these by `source`, and this section is superseded rather than amended.

---

## Full source license register

Everything else came back clean. US federal government works are public domain
under 17 U.S.C. §105, which covers the large majority of this platform.

| Source | Used for | License | Status |
|---|---|---|---|
| USGS earthquakes / ShakeMap / Water Services | Live seismic, shaking intensity, river gauges | Public domain (US Gov) | Clear |
| USGS Quaternary Faults (DOI 10.5066/F7S75FJM) | Fault proximity scoring | Public domain (US Gov) | Clear, already recorded |
| USGS earthquake catalog | Historical seismicity, backtesting | Public domain (US Gov) | Clear |
| NOAA/AOML HRD US hurricane strikes | Frequency validation of the hurricane event set (`lib/modeling/validation/catalog/us-hurricane-strikes.ts`, fetched 2026-09-04) | Public domain (US Gov) | Clear |
| IEM ASOS archive (Iowa Environmental Mesonet, Iowa State University) | Wind field vs airport observations at every US hurricane landfall 2017–2024 (`lib/modeling/validation/catalog/us-landfall-airports.ts`, fetched 2026-10-10) | Public domain per the IEM disclaimer; attribution requested, given | Clear |
| MTBS fire occurrence | Frequency validation of the wildfire event set (`lib/modeling/validation/catalog/mtbs-large-fires.ts`, fetched 2026-09-04); since model 3.9 the local large-fire density the wildfire frequency component reads (`lib/geo/large-fire-density.ts`) | Public domain (US Gov) | Clear |
| NOAA SWDI NEXRAD hail | Model 4.2 hail frequency: NEXRAD Hail Detection Algorithm signatures 2005-2024 aggregated to significant-hail days per 0.25-degree cell (`lib/geo/hail-radar-days.ts`) | Public domain (US Gov) | Clear |
| USFS Wildfire Risk to Communities | Model 3.9 wildfire WUI component: share of homes in the Direct/Indirect exposure zones per Census place and county (`lib/geo/wildfire-exposure-grid.ts`, from RDS-2024-0030 supplements, 2026 summaries); model 4.0 flood: housing units per county, the denominator of the NFIP claim rate (`lib/geo/county-nfip-claim-rate.ts`) | US Government work; the archive states the data are "freely available without additional permissions or fees" and asks that the publication be cited (Scott et al., RDS-2024-0030) — cited in the grid header, the methodology and the score's sources | Clear (citation) |
| USGS 3DEP elevation (Elevation Point Query Service) | Ground elevation for surge and flood-elevation scoring — wired 2026-09-01 (audit 2.10) | Public domain (US Gov) | Clear |
| FEMA NFHL (National Flood Hazard Layer) | Flood zone at a point, and the base flood elevation the flood elevation component is scored on — wired 2026-09-02 (known-debt #94) | Public domain (US Gov) | Clear |
| NOAA VDatum | NGVD29 → NAVD88 offset at a point, so older-datum base flood elevations can be scored against NAVD88 ground — wired 2026-09-02 (known-debt #96) | Public domain (US Gov) | Clear |
| NOAA NHC — advisories, wind probabilities, ATCF radii, NHC forecast cone GIS bundle (`gis/forecast/archive`, migration 160), NHC wind swath from the best-track GIS bundle (`gis/best_track`, migration 203) | Live hurricane tracking, the 5-day forecast cone, and the observed cumulative 34/50/64 kt wind swath | Public domain (US Gov) | Clear |
| NWS Damage Assessment Toolkit (`services.dat.noaa.gov` DamageViewer FeatureServer, migration 203) | Observed tornado and wind damage footprints: survey tracks, damage points, EF-rated polygons | Public domain (US Gov; the service states the data are preliminary until NCEI Storm Data) | Clear |
| Bitcoin block headers (blockstream.info, fallback mempool.space; migration 222) | Confirming a digest anchor: the merkle root and time of the block an OpenTimestamps proof names — three fields of a public-ledger header per anchor, a few a day (`lib/determination/anchor/ots.ts`, `docs/digest-anchoring.md`). The OpenTimestamps calendars themselves receive only a hash of our own statement and are services, not sources | Public-ledger data (block headers) through free keyless APIs. Terms read 2026-11-06: Blockstream publishes its hosted explorer's terms only behind the Explorer API account sign-in (the open-source Esplora code is MIT; the hosted service's terms are not public), so Calchis reads three header fields per anchor from the public endpoint and keeps the proof verifiable against any Bitcoin node without it; mempool.space states non-commercial use for its public API, so it is the fallback only | Open (confirm Blockstream's hosted terms by creating an Explorer API account, or run the confirmation against a node) |
| USGS STN high-water marks (USGS Short-Term Network, `api.waterdata.usgs.gov/stnservices`, migration 207) | Observed flood and surge high-water marks: position, surveyed elevation and datum, mark type, quality class. Staff names and free-text location notes in the published records are NOT stored | Public domain (US Gov) | Clear |
| NWS flood alerts (worker `noaa_ahps`; api.weather.gov flood products, gauge stage parsed from alert text) | Flood warnings and watches | Public domain (US Gov) | Clear |
| NWC inundation extent (worker `noaa_ahps`; maps.water.noaa.gov National Water Model analysis and CREST FLASH inundation polygons, labeled EXPERIMENTAL by the NWC) | The innermost flood zone: modeled inundation inside the NWS warning polygon | Public domain (US Gov) | Clear |
| NOAA SPC | Severe convective outlooks | Public domain (US Gov) | Clear |
| NOAA SLOSH / MOM surge | Storm surge modeling | Public domain (US Gov) | Clear |
| NWS storm / winter / fire-weather alerts | Live alerting | Public domain (US Gov) | Clear |
| NWS tropical alerts (hurricane, tropical storm, storm surge watches and warnings) | Live alerting | Public domain (US Gov) | Clear |
| NWS heat wind alerts (extreme heat, heat advisory, high wind) | Live alerting | Public domain (US Gov) | Clear |
| NOAA Storm Events | Historical severe weather + damage | Public domain (US Gov) | Clear |
| NOAA MRMS hail — in fact the Storm Events hail extract (`run-mrms-hail.ts` reads the NCEI Storm Events CSVs, not MRMS) | Historical hail | Public domain (US Gov) | Clear |
| IBTrACS | Historical hurricane tracks | Public domain (NOAA/WMO) | Clear |
| NOAA NHC ATCF a-deck archive (the NHC adeck files; `scripts/historical-ingest/run-nhc-adeck.ts` → `historical_advisories`, migration 228) | The operational advisory record 1998 onward — CARQ positions/intensity/radii and OFCL forecasts — loaded as issued and marked backfilled, so the reference catalog's hurricane terms can be settled on the advisory they name (`docs/historical-advisories.md`) | Public domain (US Gov; NOAA NHC register entry, `ftp.nhc.noaa.gov`) | Clear |
| NASA FIRMS (VIIRS) | Live wildfire detections | Free; attribution requested | Clear — acknowledgement on both map attribution controls and every report footer since 2026-09-01 (`lib/data-attribution.ts`) |
| NIFC fire perimeters | Live + historical wildfire (WFIGS 2020-present with polygons; Interagency Fire Perimeter History 1984-2019 as centroids, `run-nifc-history.ts`) | Public domain (US interagency) | Clear |
| FEMA disaster declarations | Historical declarations | Public domain (US Gov) | Clear |
| FEMA NFIP claims | Flood loss history | Public domain (US Gov) | Clear |
| FEMA disaster declarations by county (designated areas, `run-fema-declaration-areas.ts`) | County-level declaration history on the public county hazard history pages (migration 154) | Public domain (US Gov) | Clear |
| US Census 2020 Gazetteer, counties (`scripts/derive-us-counties.ts` -> `lib/geo/us-counties.ts`) | County FIPS codes, names and URL slugs for the county hazard history pages | Public domain (US Gov) | Clear |
| US Census — TIGER, tracts, ACS | Geography, population, housing; TIGERweb 2020 tract housing counts (HU100) as the exposure for the Milton 2024 historical-loss benchmark (`lib/modeling/validation/catalog/fl-tract-housing.ts`, fetched 2026-09-04, sha256 recorded) | Public domain (US Gov) | Clear |
| Milton 2024 benchmark figures — NHC TCR AL142024, Munich Re | The benchmark event and the number it is scored against (`lib/modeling/validation/milton-2024-benchmark.ts`): landfall position, pressure and wind from the NHC Tropical Cyclone Report (public domain, sha256 of the PDF recorded); insured US$25bn and overall US$38bn from Munich Re's 9 Jan 2025 media release — seven hand-typed figures with citation, nothing redistributed | Public domain (NHC); publicly released press figures quoted with attribution (Munich Re) | Clear (quotation) |
| NWS public forecast zone → county correlation (NWS zone counties) | Which counties each NWS forecast zone covers, so a storm NCEI filed against a zone reaches its counties (`lib/historical/nws-zone-counties.ts`, `scripts/historical-ingest/run-nws-zone-counties.ts`, `nws_zone_counties`, migration 156) | Public domain (US Gov, NOAA/NWS) | Clear — published at https://www.weather.gov/gis/ZoneCounty for public use; the file actually loaded is recorded per row in `source_url` |
| NLCD land cover | Land-cover analytics; since model 2.3 also the Hazus terrain roughness per tract (`lib/geo/terrain-roughness-tracts.ts`, derived from `tract_land_cover` with the Census 2020 Gazetteer and the z0 per NLCD class of FEMA's Hazus Hurricane Model Technical Manual 5.1, July 2022, Tables 4-13/4-14, PDF sha256 recorded in `lib/geo/hazus-nlcd-roughness.ts`) | Public domain (US Gov) | Clear |
| USGS nshmp-lib BSSA14 — Boore, Stewart, Seyhan & Atkinson (2014) PGA coefficients and reference implementation | Active-crust earthquake site intensity since model 3.1 (`lib/modeling/gmm/bssa14.ts`; generated coefficients from `scripts/data/nshmp-lib-BSSA14.csv`; release 1.8.5, commit `44728a7d`, sha256 recorded) | Public domain — USGS software release (LICENSE.md read 2026-09-24); the paper is cited | Closed — no restriction; citation carried in the registry and on the methodology page |
| USGS NSHM 2023 fault system (nshm-conus 6.2.0) — western-US rupture set and section traces | Earthquake fault sources since model 3.0 (`lib/modeling/generated/nshm-2023-wus-*.ts`, generated by `scripts/fetch-nshm-fault-system.ts`; version 6.2.0, commit `a69e117b`, sha256 recorded) | Public domain — USGS work product (LICENSE.md read 2026-09-24); the repository asks for its citation, which the registry carries | Closed — no restriction; attribution carried on the methodology page and in the registry |
| USGS NSHM 2023 hazard values (doi:10.5066/P14VGAV4: CONUS 2023.R2, Alaska 2023.R1, Hawaii 2021.R2) — PGA 2% in 50 years, site class BC | The earthquake hazard score since model 3.6, Alaska and Hawaii since 3.7 (`lib/modeling/generated/nshm-2023-pga-2475*.ts`, generated by `scripts/generate-nshm-pga-grid.ts` from ScienceBase items `691dfb9ad4be02142cbce6d8`, `681bbdefd4be0260c2c45c80`, `6802a4fad4be0210cdcc996b`; sha256 recorded) | Public domain — USGS data release (FGDC metadata read 2026-10-11: no access constraints; acknowledgment of the USGS NSHMP requested) | Closed — no restriction; acknowledgment carried in the registry and on the methodology page |
| NHERI SimCenter Damage and Loss Model Library (DLML) — Hazus 5.1 hurricane wind loss functions; Hazus 6.1 earthquake equivalent-PGA fragilities | Hurricane building-loss curves since model 2.3 (`lib/modeling/generated/hazus-hurricane-wind-curves.ts`; a 40-row verbatim extract in `scripts/data/dlml-hurricane-loss-extract.csv`; commit `6629997`, sha256 recorded; migration 153) and earthquake fragilities since model 2.5 (`lib/modeling/generated/hazus-earthquake-pga-fragilities.ts`; 36-row extracts in `scripts/data/dlml-seismic-lf-*.csv`; commit `192d280`, sha256 recorded; migration 170) | BSD-3 for SimCenter's tabulation (terms read 2026-09-15); the FEMA Hazus values inside it are US Government work product, public domain in the United States (17 U.S.C. §105), no separate terms stated | **Closed 2026-09-24 (decision)** — written terms were requested from the FEMA Hazus help desk (FEMA-Hazus-Support@fema.dhs.gov) on 2026-09-15 and no reply arrived; Aaron decided on 2026-09-24 to rely on the public-domain basis with SimCenter's BSD-3 attribution rather than wait further. Registry `redistribution: yes`, attribution carried. The seeded curve values remain outside the anon read of `model_parameters` (migration 155, `public_read` excludes `hazus_wind_loss.%`; verify with `scripts/audit-curve-rows-not-public.ts`) as a product choice, not a rights requirement. Derived outputs — a modeled loss figure — were never affected |
| Natural Earth coastline | Coastal proximity | Public domain | Clear, already recorded |
| HIFLD (5 layers: hospitals, EMS, fire stations, schools, police) | Critical infrastructure overlay | CC BY 4.0 — USGS National Structures Dataset via Esri U.S. Federal Data | F4 resolved 2026-09-01; police added 2026-09-13; credit on report footers and `/sources` |
| OpenStreetMap via Overpass (substations, water treatment, communication towers) | Lifeline infrastructure overlay | ODbL 1.0 — © OpenStreetMap contributors | F5, 2026-09-13. Crowd-sourced: `source = 'osm'`, confidence 0.75, labeled in the UI. Admitted because every federal alternative is restricted or non-redistributable |
| **MS Building Footprints** | Structure counts per tract | **ODbL (share-alike)** | **F3** — attribution rendered on maps and report footers since 2026-09-01; share-alike question still with counsel |
| **Artemis Deal Directory** | Cat bond catalog | **Commercial publisher** | **F2** — `/bonds` behind login and noindex since 2026-09-01 (known-debt #92); counsel still needed |
| **Mapbox Geocoding v5 (`places`)** | Address → suggestion list, shown only | Display use permitted; nothing stored since 2026-09-01 | F1 (fixed) |
| Mapbox GL / tiles / Static Images | Map rendering, workbench satellite image | Commercial; attribution required | Clear — `attributionControl: true` on both maps; the `&attribution=false` on the Static Images call was removed 2026-09-01 |
| BEA Regional GDP (Data API, `lib/economic/bea.ts`) | County GDP for `/api/v1/economic/*` | Public domain (US Gov); API terms of service read 2026-09-04 | Clear — the required notice ("This product uses the Bureau of Economic Analysis (BEA) Data API but is not endorsed or certified by BEA.") is carried in the registry and shown on `/sources`; added to the register 2026-09-04 (credibility audit L-01) |
| BLS QCEW (`lib/economic/qcew.ts`) | County employment and wages for `/api/v1/economic/*` | Public domain (US Gov); BLS asks to be cited | Clear — citation carried in the registry; added 2026-09-04 (L-01) |
| FCC Area API (`geo.fcc.gov`, `lib/exposure/census-tract.ts`) | Census block lookup fallback | Public domain (US Gov) | Clear — added 2026-09-04 (L-01) |
| State DOT traffic cameras | Camera overlay (map layer, off by default) | Terms vary by state — per-system table below | Probed 2026-09-01: 12 of 13 snapshot URL families do not resolve; since 2026-09-04 no system is served until its terms are read and marked in `SYSTEM_TERMS` (`lib/data-sources/dot-cameras.ts`), so the layer returns nothing; see "State DOT cameras, per system" and known-debt #93 |
| ATTOM | Property values | Commercial | Not integrated; placeholder only |

### State DOT cameras, per system

`lib/data-sources/dot-cameras.ts` carries a hand-typed list of snapshot URLs
across 13 state systems, served by `/api/v1/cameras/nearby` to the map's
"cameras" layer (off by default; nothing is stored). One URL per system was
requested on 2026-09-01 (audit 6.6):

| System | Snapshot host | Response | Terms |
|---|---|---|---|
| Florida — FL511 | `fl511.com/map/Cctv/image/…` | **200 image/png** — live | fl511.com/terms is rendered client-side; text not captured. Not served (`SYSTEM_TERMS.fl511 = false`) until read. |
| California — Caltrans | `cwwp2.dot.ca.gov/data/…/cctv/image/…` | 500 | not applicable — URL pattern does not resolve |
| Texas — TxDOT | `its.txdot.gov/ITS_WEB/FrontEnd/snapshots/…` | 307 to HTML | not applicable — URL pattern does not resolve |
| Louisiana — 511LA | `511la.org/map/Cameras/…` | 302 to HTML | not applicable |
| Georgia — 511GA | `511ga.org/cameras/…` | 302 to HTML | not applicable |
| Virginia — 511Virginia | `511virginia.org/cameras/…` | 301 | not applicable |
| Oklahoma — OKTraffic | `oktraffic.org/cameras/…` | 200 text/html (not an image) | not applicable |
| Alabama — ALGO | `algotraffic.com/cameras/…` | 200 text/html (not an image) | not applicable |
| North Carolina — NCDOT TIMS | `tims.ncdot.gov/tims/cameras/…` | 404 | not applicable |
| South Carolina — 511SC | `511sc.org/cameras/…` | 404 | not applicable |
| Washington — WSDOT | `images.wsdot.wa.gov/…` | 404 | not applicable |
| Oregon — TripCheck | `tripcheck.com/roadcams/cams/…` | 404 | not applicable |
| Mississippi — MDOT | `mdottraffic.com/cameras/…` | 404 | not applicable |

So the "curated" list is one working system and twelve placeholder URL
patterns. There is no licensing exposure from a URL that returns 404, and the
Florida images are hot-linked rather than stored, which is the weakest form of
use — but the layer shows broken images in twelve states and the register
cannot record terms for feeds that do not exist. Known-debt #93 holds the
decision: integrate real 511 APIs (each with its terms read) or remove the
layer.

Infrastructure vendors (Supabase, Vercel, Resend, Sentry; Upstash until 2026-10-21) are
subprocessors rather than data sources, and belong in a DPA and subprocessor list
rather than here. A draft, for counsel, is `docs/subprocessors.md` (2026-10-21);
a federal or enterprise security review will ask for it.

## Data Calchis does not hold

Two names appear in model documentation as influences rather than inputs,
and the wording now says so. The hail damage curve in
`lib/modeling/financial-module.ts` is a piecewise line whose anchors are
seeded parameters marked ESTIMATED; it is *informed by* published IBHS
findings and holds no IBHS test data. No Verisk PCS or ISO claims data has
ever been licensed or ingested — the earlier "industry composite" citation
was removed on 2026-09-04. The SILVIS wildland-urban interface dataset is
the University of Wisconsin's, not USGS's.

---

## Guard

`tests/docs/every-data-source-has-a-license.test.ts` fails when a module is added
under `lib/data-sources/` or `scripts/historical-ingest/` that this register does
not name. The register can then only fall behind deliberately.

Since 2026-09-04 (credibility audit L-01) the register also lives as data:
every entry in `lib/data-sources/registry.ts` — live, historical, reference
and model — carries the same rights block (`license`, `licence_url`,
`commercial_use`, `redistribution`, `storage_permitted`,
`attribution_required`, `attribution_text`, `share_alike`, `terms_read_on`,
`rights_note`, `domains`). `tests/docs/source-rights-register.test.ts` checks
that the block is complete and consistent (an unread or conditional answer
must carry a `rights_note`; a required attribution must carry its sentence),
and that every external host reached from any file that fetches under `lib/`,
`app/` or `scripts/` (Python ingest scripts included) is claimed by some
entry's `domains`. That is how the four unregistered fetchers of the L-01
finding — BEA, BLS QCEW, the FCC block lookup and the dormant ATTOM client —
were caught, and how the next one will be.