Public proof for public problems.
Nagarik Signal preserves civic evidence as an inspectable public record. A report or checked public-source dossier receives a sanitized evidence artifact, explicit provenance, an approximate location commitment, and a Solana devnet proof account. Follow-up signals and steward updates remain attached to the same record.
Open Nagarik Signal | Explore public records | Inspect the program
Nepal does not lack grievance channels. Hello Sarkar, Kathmandu Gunaso, Connect KMC, and agency-specific portals already accept reports. Nagarik Signal does a different job: it creates a public evidence commitment that civic groups, residents, newsrooms, and institutions can inspect before, during, and after an official grievance process.
Observe -> sanitize -> hash -> anchor -> corroborate -> hand off -> track
The chain proves when a commitment was recorded and whether committed fields still match. It does not prove that every physical-world claim is true, that each signal is a unique person, or that a repair happened.
- Writable reporting: JPEG, PNG, and WebP evidence is decoded, resized, metadata-stripped, re-encoded, hashed, and stored privately.
- Durable hosted state: Vercel Blob stores the read model and media; fixed-path writes use ETag compare-and-swap with bounded retries.
- Server-owned identity: signed, HttpOnly civic-session cookies derive deterministic Solana signers without exposing private keys to the browser.
- Public proof: Issue, Verification, Steward, and StatusUpdate PDAs are deployed on Solana devnet.
- Delivered-byte verification: the proof panel fetches the evidence a visitor actually receives and recomputes its SHA-256 hash before comparing it with the read model and chain.
- Provenance classes: community reports, public-source dossiers, illustrative samples, and engineering fixtures are never mixed in public totals.
- Abuse controls: trusted-origin checks, upload receipts, rate limits, duplicate-evidence rejection, relayer circuit breakers, and constant-time steward authentication.
- Moderation: stewards can hide media while retaining proof, dispute a record, or remove a rejected record from discovery.
- Official follow-up ledger: stewards can record route preparation, channel delivery, a receipt-backed acknowledgement, follow-up, and closure without presenting those events as authority-authored updates.
The default public watchlist contains four checked source dossiers. Each one records its publisher, source date, check date, review expiry, evidence hash, and devnet receipt. It does not claim a live field inspection.
| Record | Source | Public proof |
|---|---|---|
| Nagdhunga-Mugling utility-pole obstruction | The Kathmandu Post | Issue 12 |
| Central Kathmandu drainage follow-up | Kathmandu Metropolitan City | Issue 13 |
| Bancharedanda landfill service-life pressure | Kathmandu Metropolitan City | Issue 14 |
| Dhangadhi and Kailari groundwater shortage | The Kathmandu Post | Issue 15 |
Thirty illustrative records are available under the separate Samples scope. Seven historical engineering fixtures remain addressable for audit work but are excluded from discovery, maps, dashboards, and public counts.
flowchart LR
A[Resident or source curator] --> B[Next.js API]
B --> C[Image safety pipeline]
C --> D[Private Blob evidence]
B --> E[Canonical metadata]
E --> F[Solana devnet]
F --> G[Issue PDA]
F --> H[Verification PDA]
F --> I[StatusUpdate PDA]
B --> J[Durable Blob read model]
B --> M[Steward handoff ledger]
D --> K[Public media proxy]
G --> L[Proof verifier]
H --> L
I --> L
M --> L
J --> L
K --> L
The read model stores searchable civic context. Solana stores compact commitments and lifecycle accounts. Neither is silently treated as the other: the proof verifier recomputes the record and compares both.
| Component | Location |
|---|---|
| Next.js application and API | apps/web |
| Anchor program | programs/nagarik_signal |
| Source and proof scripts | scripts |
| Public source manifest | data/public-sources |
| Database adapter target | apps/web/lib/db/schema.sql |
Devnet program: 76PwNDW9hANj3tiebTEUdAj4yHYHVMfjcVDPjUWLQmqY
Requirements: Node.js 22+, npm, and a modern browser.
git clone https://github.com/dantwoashim/Nagarik_Signals.git
cd Nagarik_Signals
npm ci
npm run seed:demo
npm run devOpen http://127.0.0.1:3001.
Local development uses an atomic JSON file by default. A writable hosted deployment sets NAGARIK_STORAGE_MODE=blob, a private BLOB_READ_WRITE_TOKEN, the relayer secret, and independent session/security secrets documented in .env.example.
npm run test:unit
npm run typecheck
npm run lint
npm run build
npm run test:e2e
npm run verify:deploymentfinal:preflight checks a running application. Start npm run dev in another terminal before running it locally, or set NAGARIK_PREFLIGHT_BASE_URL=https://nagarik-signal.vercel.app to check the stable deployment. anchor:build additionally requires the Solana and Anchor toolchains.
npm run final:preflight
npm run anchor:buildanchor:test:devnet, phase2:smoke, and phase5:smoke make funded devnet writes and require a configured relayer with devnet SOL.
verify:deployment checks the stable production release SHA, runtime write capabilities, trusted-origin boundary, secure session minting, public pages, detailed map provider, dashboard, and delivered-byte Solana proof. The production-smoke workflow runs it after every push to main and once daily without creating a public record.
| Claim | What is checked | What is not claimed |
|---|---|---|
| Evidence integrity | Delivered bytes match the stored and on-chain hash | The image depicts the claimed place or date |
| Record timestamp | A Solana transaction committed the issue | An authority accepted a legal complaint |
| Public signal | One rate-limited session created one Verification PDA | One signal equals one unique person |
| Status update | An authorized platform steward created a StatusUpdate PDA | A municipality authored or endorsed the update |
| Authority handoff | A steward appended a hash-chained event with the stated route, reference, or redacted receipt | The receiving authority authored, verified, or endorsed the event |
| Source dossier | The cited article and summary were checked on a stated date | The source remains current after its review window |
The program is on devnet and remains upgradeable by its authority. The relayer is a server-held hot key. Mainnet use requires an external program review, multisig governance, formal moderation operations, data-retention policy, and institutional agreements.
Read CONTRIBUTING.md before opening a pull request. Report vulnerabilities through the private process in SECURITY.md, not a public issue.
MIT. See LICENSE.