One council, one catchment, zero joins
AnBanjir is what the local-authority doctrine looks like as a shipped product: a single-PBT deployment fed by licensed federal radar, the council's own gauges and an accountable crowd, isolated from every other council by construction rather than promise.
The air-gap is the product
A council product, not a national platform
AnBanjir is sold, contracted and deployed to one PBT at a time — its own instance, its own thresholds, its own console. The fiefdom doctrine applied where flood money is actually spent: no other council can read a single street-state row.
The engine is shared; the data never is
Offline state mutation, crowd-report resolution and alert fan-out run on the same internal engine as AnKampung's gatehouses. That reuse is invisible to buyers by design — a council signs with a flood product, never with a platform.
Zero cross-council joins
There is no foreign key from an MPJ waterline to an MBSA gauge or a DBKL shelter count. Not prohibited by contract — absent by construction. A state-wide view is a read-only overlay, licensed separately, that never writes back.
Four edges, each one lawful
A flood console is only as honest as its supply network: federal radar stays federal, the council's gauges stay the council's, the crowd is accountable, and a resident's data crosses only when they move it.
MetMalaysia radar — the nowcast ceiling
National radar gives the hour-ahead cell — the direction and intensity of the rain about to fall on a catchment. It is a licensed input the council already has rights to use; AnBanjir fuses it with ground truth rather than re-inventing the science.
Integrate-downstream, never-duplicate: the federal radar stays federal.
JPS hazard + council gauges — the ground layer
JPS flood-hazard layers and the council's own water-level gauges anchor the radar to a specific nullah, a specific underpass. Thresholds are set by the council engineer on this layer — never by a vendor guessing where the kerb dips.
The difference between 'heavy rain' and 'Lorong Sepuh floods in eleven minutes'.
The crowd — residents as the last sensor
Ten-second photos of a rising kerb, resolved against gauge telemetry and neighbouring sightings before they move a map state. Reporters carry a pseudonymous confidence history; an uncorroborated sighting shows as unconfirmed — visible, honest, zero-weight.
The street-level truth no gauge network is dense enough to catch.
AnKampung — the portable flood report
A resident's community flood report can be a consented, one-time contribution to their council's instance if they choose to bring it across. The choice is theirs; the councils themselves remain air-gapped from each other and from every other agency.
Data moves only when a person moves it — the rest is code.
The refusals written into schema
Portfolio primitives, not portfolio data
AnBanjir reuses the offline sync layer, the report-resolver and the credentials rails — code, never rows. The only outbound data path is the one the signing council publishes about its own catchment.
Aggregation is a product, never a join
A state or NADMA wanting the cross-council picture buys a read-only overlay under a separate licence. It sees confidence-banded status; it never writes into a council instance and never touches a resident's report.
One family, one spine
The offline engine that keeps this console alive through an outage is the same one a kampung's gate runs on, and the accountability is the same spine the rest of the portfolio runs on. Several of them already have their own homes on the web.
Warn the street. Route the rescue. Keep the map alive when the tower dies.
AnBanjir is designed, and it is built to be adopted one council at a time — a single PBT owns its catchment, its thresholds, and its console; nothing joins across councils. The opening offer is a reference deployment: one flood-prone catchment, one control room, one offline-capable state engine. Council enquiries are welcome today.