Methodology for explainable outage-risk intelligence

GeoGridIQ starts by defining a qualifying outage outcome, geography, issue time, and future window. It then gathers permitted evidence, checks provenance, freshness, and completeness, aligns sources in space and time, and freezes a versioned feature snapshot. Runtime controls resolve the exact region-and-horizon model or separately governed scoring, persist the intended prediction population, attach explanation and uncertainty, and apply trust, validity, and display gates. Fallback scoring may exist under its own contract, but public capability remains unavailable unless a separately implemented public-serving fallback contract is verified. Later outcomes are matched under a separate validation contract. No source, map, alert, or artifact becomes a public claim without these intermediate contracts and gates.

A forecast contract names the target outcome, scoring geography, issue time, valid-from and valid-to times, horizon, eligible observations, prediction population, decision use, scoring mode, and availability state. A number without that context is incomplete.

Observed outages describe events already reported; hazard forecasts describe expected conditions; vegetation signals describe screened context; separately authorized relative risk ranks eligible places; and calibrated probability estimates a declared event. Severity describes magnitude, consequence describes impact, and recommendations add policy and human judgment. These meanings do not substitute for one another. A regional or grid-cell score applies only to that unit and does not identify an exact line, pole, transformer, address, building, or customer.

The glossary is part of the methodology contract, not ornamental vocabulary. The same terms must retain the same meaning in page copy, status messages, tooltips, exports, schema, and related documentation. In particular, probability, confidence, severity, consequence, and relative risk are not interchangeable; missing is not zero; a promoted artifact is not a current forecast; and a top driver is not a cause. Essential definitions appear in the visible body and glossary rather than being available only on hover.

Observed outage

A provider-reported loss-of-service event with recorded observation or status times; it describes evidence about an event, not a forecast.

Qualifying outage

An observed event that satisfies the versioned label contract, including provider, planned or unplanned, spatial, temporal, coverage, and any documented threshold rules.

Forecast

A time-stamped estimate issued before a declared future valid window, for a stated outcome, geography, population, and prediction mode.

Issue time

The cutoff at which forecast inputs are frozen; only evidence genuinely available by this instant may be used.

valid_from

The beginning of the future interval to which a forecast applies.

valid_to

The end of the future interval to which a forecast applies.

Horizon

The forecast contract's lead-time interval, tied to issue time and/or the end of the valid window as defined by implementation.

Region

A canonical supported geographic scope; it is not automatically a utility service territory.

Grid cell

A bounded analysis unit used to align and score evidence; it does not identify an exact asset or address.

Feature snapshot

The frozen, versioned set of typed feature values, missingness and freshness flags, and identities for one issue time, region, horizon, and grid contract.

Source contract

The rules for a source's provider or product identity, timestamps, units, coverage, quality, freshness, and permitted use.

Feature contract

The ordered schema of feature names, types, units, transformations, requiredness, and compatibility used consistently in training and inference.

Label contract

The versioned rules that determine which observed events count as positive, negative, or unknown outcomes and how they match forecasts.

Model artifact

A serialized model file produced by a particular run; its existence alone does not make it trusted, promoted, loaded, or current.

Model registry

The authoritative record that binds a region, horizon, family, version, artifact, integrity metadata, trust state, and promotion state.

Model card

A reviewed evidence summary describing intended use, data and evaluation scope, metrics, limitations, and governance decisions for a model.

Prediction batch

A provenance-bound set of outputs generated together for a declared region, horizon, issue time, and valid window.

Probability

An estimated likelihood of the declared event for the declared geography and window, only for a track designed and calibrated to support that meaning.

Relative risk

A rank, score, or percentile comparing eligible units; it is not automatically a calibrated probability.

Risk level

A human-readable category assigned by current, verified thresholds and rules; it is not a universal utility standard.

Severity

The magnitude or extremity of relevant conditions or a verified classification; it is not automatically outage probability.

Confidence

The implemented assessment of evidence and prediction-path quality; it is not a statistical confidence interval or a second probability.

Data completeness

Whether all records or layers required by a contract are present, regardless of age.

Data freshness

Whether evidence is recent enough for its declared validity or use contract, regardless of completeness.

Consequence

The potential importance or impact if disruption occurs; it can affect priority without changing physical likelihood.

Critical infrastructure exposure

Generalized context indicating that important community functions may be affected; it is not proof of outage cause or increased likelihood.

Top driver

An input or feature family most associated with a particular score under the implemented explanation method; it is not proven causation.

Fallback

An explicitly authorized non-primary scoring path with its own source contract and labels; it is not a machine-learning probability unless independently validated as one.

Trusted

A status indicating that a specific model identity passed required evidence and governance gates; it does not guarantee a current batch.

Promoted

A human-reviewed decision making a trusted artifact eligible for the defined production scope; it does not prove successful runtime loading or current validity.

Display eligible

Allowed to appear in a current user interface after presentation gates; hidden rows may still be persisted for audit.

False positive

A flagged forecast with no matched qualifying outcome, only where observation coverage is sufficient to support that conclusion.

False negative

A qualifying observed outcome that was not covered by the declared forecast and evaluable population.

Calibration

The degree to which forecast probabilities align with observed event frequencies under a specified dataset and contract.

Temporal leakage

Use, direct or indirect, of information unavailable at issue time or reserved for later evaluation.

Concept drift

A change over time in relationships among inputs, outcomes, providers, infrastructure, or operations that can reduce model relevance.

The active feature manifest determines which source families participate in each region, horizon, and model. Every used source needs provider, time, spatial, transformation, and limitation records; current capability and freshness records remain authoritative.

Every signal retains provider and product, version or raw identity, checksum where applicable, issue, valid, observed, available, fetched, and processed times, transformation version, spatial reference and resolution, coverage, quality, completeness, and freshness.

Fresh is within contract; delayed arrived late but may remain usable; stale is too old; missing is absent; failed did not process; unsupported lacks an approved source; partial lacks required evidence; and valid zero is a successful current observation of no qualifying records. The interface labels each state and shows zero only with its establishing source and time. Completeness and freshness remain separate: complete data can be stale, and fresh data can be partial.

GeoGridIQ aligns weather grids, outage points or areas, vegetation rasters, terrain, and infrastructure context in a declared coordinate system using geometry-validity checks, versioned reprojection, containment or intersection, bounded distance, raster zonal summaries, and land-water handling. QA covers duplicate or overlapping geometry, cell area, coastal and partial cells, source resolution, and weather-to-analysis-grid mapping. Buffers must match source precision; a centroid is not a failure location.

Numerical checks and map review are complementary: correct SQL can encode the wrong geography, while a plausible map can show the wrong concept. A verified GeoSQL pilot supports upstream investigation and map-in-the-loop review, not outage modeling, legal territory truth, or direct production writing.

GeoGridIQ distinguishes source issue, valid, observation, available, retrieval, and processing times from forecast issue, valid-from, valid-to, and outcome times. Only evidence genuinely available by the issue-time cutoff may enter a forecast; later creations, revisions, and outcomes belong to validation or a later run.

Leakage includes using final observations as forecasts, valid-window outages in history, revisions without original availability, preprocessing fit on holdouts, random splits that mix related events or later periods, unarchived reconstructions, labels in features, and caches without source or feature time. A reproducible snapshot binds one issue time, region/horizon contract, bounded values and source versions, missingness/freshness flags, and source, feature, and grid fingerprints.

Feature engineering turns raw evidence into a bounded, typed snapshot through verified window summaries, maxima, means, totals, change rates, exceedance durations, lagged history, spatial aggregation, documented interactions, encoding, or scaling. Missingness and freshness stay explicit.

The feature contract fixes order, name, type, units, required, optional, or experimental status, transformation version, and exact region/horizon compatibility; training and inference must match it. Examples such as forecast gust, antecedent precipitation, dated vegetation, pre-cutoff outage history, terrain or exposure, and source-health flags must be labelled active, possible, conceptual, or planned. Schema presence alone does not prove current use.

The label contract defines qualifying positives, authoritative providers, planned-outage handling, deduplication and revisions, spatial and valid-window matching, event grouping, any verified customer threshold, approximate geometry, negatives, missing coverage, censoring, provider transitions, versioning, and reproducible rebuilds.

Unknown is not negative. An unmatched forecast is a false positive or true negative only when the relevant feed adequately observed that cell and window; post-event information never enters its original snapshot. Separately authorized probability and ranking tracks retain their different objectives and label semantics, with raw identities, checksums, and matching versions preserved.

GeoGridIQ separates local Docker training from production inference. Candidates undergo chronological or event-grouped holdout tests, imbalance and baseline diagnostics, and human-reviewed promotion. The exact artifact, metadata, manifest, checksum, size, and region/horizon identity enter the authorized model store; Railway loads only that identity. Production training, automatic promotion, and cross-scope substitution are not authorized. XGBoost applies to designated regional runs only; its name establishes neither trust nor probability semantics. Fallback scoring is separately governed and is not currently public-serving.

A candidate becomes eligible only after applicable data, label, feature, grid, leakage, holdout, calibration, segment, serialization, integrity, exact-scope, promotion, runtime-load, current-batch, and validity gates pass. Public states use canonical reason codes.

Trusted and promoted describe one artifact, not a current forecast. Missing integrity, identity mismatch, failed validation, absent promotion, load failure, incompatible features, no batch, or expiry prevents that claim. Rollback retains auditable rows but never substitutes another scope, stale output, or unlabelled fallback. Restore an exact approved identity or show unavailable.

Generation resolves region, horizon, sources, feature snapshot, freshness, and the exact trusted and promoted artifact; verifies identity, schema, manifest, checksum, and size; scores the complete population; attaches provenance, explanation, and confidence; persists rows; then applies display gates.

Artifact, load, batch, row, current validity, display, saved-location, and public visibility are distinct states. Hidden rows may persist for audit. Caches change with region, horizon, model, source, feature, grid, or validity; marker counts are not expected outages or total persisted rows.

Read an output as a validity- and provenance-bound bundle. Geography names the scored area, not an asset; horizon and valid times name its window; generated and source times describe batch age and evidence freshness. Mode distinguishes trusted probability, separately authorized ranking, fallback scoring, and unavailable semantics. Fallback scoring can exist under its own contract; public capability remains unavailable without a separately verified public-serving fallback contract.

Probability, authorized rank, risk level, severity, confidence, consequence, drivers, freshness, identity, missingness, and display eligibility differ. Confidence is not an interval, drivers are not causes, freshness is not completeness, and provenance is not current validity.

Probability estimates an event only when track and calibration support it. Relative risk ranks only on a separately authorized track. Confidence describes evidence quality, not probability; severity is magnitude, consequence is impact, and risk level is a display rule.

High probability with low confidence requires caution; moderate probability with high consequence may raise review priority; authorized rank means higher than peers, not a probability; and official alerts remain important. Fallback scoring is not currently public-serving and never inherits model-probability semantics. Authoritative bands never trigger dispatch by themselves.

An explanation answers why an area, window, and path received its score. Local explanations apply to one row; global explanations summarize an evaluated population. Name SHAP or numeric contributions only when method and denominator are verified. Rule-based fallback drivers are not learned importance, and those rows are not currently public-serving.

Explanations match region, horizon, cell, run, model, and batch; separate missing from zero; limit precision; and protect sensitive features. A driver is association, not cause; causation needs provider, field, or investigative evidence.

Confidence is separate from probability and identified by output track because GeoGridIQ has multiple evidence-quality contracts. Factors can include completeness, missing signals, freshness, model or calibration posture, timing, and boundary proximity. Fallback cannot receive the strongest model treatment and is not currently public-serving. A value such as 85 is neither correctness probability nor a confidence interval.

Uncertainty spans source coverage, spatial precision, timing, vegetation age, label sparsity or imbalance, calibration, transfer, drift, artifacts, batches, policy, and field conditions. Gates warn, hide but retain, govern scoring, mark unavailable, or require review.

Risk bands convert a verified score into a human-readable category. Their thresholds may vary by output mode, region, horizon, and decision use, so public values should come from one authoritative configuration when safe. A threshold does not change a relative rank into a probability, create a universal utility standard, or establish the right operational response for every user.

Display eligibility is a presentation decision layered on persistence. Low-confidence, untrusted, incomplete, invalid, or expired rows may remain stored for audit while being hidden from current views. Hidden is not deleted. A valid current run that explicitly reports no elevated result is different from missing, failed, or stale evidence; the latter states must be shown as unavailable or limited, never as zero. Display limits may also rank a complete population without making hidden rows statistically false.

Alerts, where implemented, add separate policy, authorization, account, and delivery gates. A probability or risk band does not automatically dispatch crews, trigger emergency action, or replace official warnings and utility procedures. Expired results lose current display eligibility even if their historical rows remain useful for audit and validation.

A public result requires an exact eligible model or scoring contract, compatible features, healthy required sources, a verified artifact, successful runtime load, and a valid current batch. Model absence, identity or checksum mismatch, incompatible features, stale or missing evidence, unsupported scope, validation or load failure, and missing or expired batches limit what may be claimed.

An authorized deterministic fallback scores only under its own source contract, never inherits calibrated probability, and is public only with separate verified serving approval. Protected paths may stop and retain earlier rows for audit. With no safe path, the result is unavailable.

GeoGridIQ never borrows another scope's model, serves expiry as current, or maps missing evidence to zero. Canonical reason codes distinguish current, valid no-elevated results, delayed or unavailable sources, validation, missing or expired batches, and unsupported scopes. A ranking appears only under its own verified public contract.

Validation stores a traceable forecast before outcomes, preserving issue and valid times, population, mode, and provenance. Later events match under declared spatial, temporal, label, and coverage rules; inadequate observation remains unknown.

Hits match flags; misses are uncovered qualifying outcomes; false positives and true negatives require observed absence. Precision measures matched flags, recall covered outcomes, F1 balances them, ROC-AUC ranks thresholds, PR-AUC emphasizes rare positives, and Brier score or reliability assesses probability calibration. Lead time, burden, and coverage also matter.

Every metric names region, horizon, run, data period, sample and event counts, definition, computation time, promotion state, segments, and limitations. Without a current public-safe package, show conceptual diagrams, not performance numbers.

When current and trustworthy, GeoGridIQ can support monitoring, storm briefings, area comparison, weather and vegetation review, preparedness, separately verified crew-readiness analysis, explanation, and post-event validation. It supplies reviewable evidence; it does not decide operations.

A responsible user checks source time and missingness, confirms the valid window and mode, separates confidence, probability, drivers, and consequence, and compares official weather and utility information. Procedures, safety rules, field evidence, access, and local authority determine action; recorded decisions and outcomes support evaluation.

GeoGridIQ is not an official outage source, alerting system, substitute for ECCC warnings, SCADA, OMS, utility GIS, field inspection, or emergency procedure. It is not autonomous dispatch, an outage guarantee, or an exact-asset detector without a separately validated target.

Availability is runtime state. The server table reads capability, source-freshness, artifact-safety, registry, feature, and current-prediction records for each region/horizon, returning source, model, batch, availability, reason, and UTC time. Unreadable or inconsistent state fails closed.

Rows remain independent: a trusted artifact without a present, unexpired batch is not a current forecast; unavailable outage data and missing vegetation are not zero; one scope cannot establish another. Artifact-only, validation, expiry, and unsupported remain distinct. Fallback scoring can exist under its own contract; public capability remains unavailable without a separately verified public-serving fallback contract. The table omits private identities and never treats configuration as proof of a current batch.

Public-source evidence is separated from account and utility data. Documentation covers least privilege, attribution and licensing, generalized sensitive infrastructure, public-safe evidence, audit trails, and human release approval. Incident and rollback ownership is public at an appropriate level; service and account boundaries govern access.

The page excludes secrets, protected endpoints, attack-enabling schema, protected-asset coordinates, addresses, crew locations, account data, private keys, topology, and identifiable logs. Saved-location and tenant records stay access-controlled; public maps generalize sensitive context.

Licensing and attribution are reviewed with technical fitness; viewable does not mean reusable. Security is ongoing risk management, not a zero-risk claim, and controls are described without increasing attack surface.

This methodology records version, publication, modification, fact-review and next-review dates, owner, and change history. Score-meaning changes receive dated versions; editorial, source, feature, label, model, threshold, and runtime-state changes remain distinguishable.

A reproducible result links source identities, spatial, grid, feature and label contracts, dataset fingerprint, training configuration, artifact checksum, evidence package, approval, batch, valid window, outcome matching, and validation. Reviewers can reconstruct what was known, transformed, approved, and shown.

Runtime status has its own timestamp and may change without a methodology release. Versioned methodology explains meaning; dynamic state explains availability. HTML and machine-readable Markdown share the same structured content.

Every value in these examples is a Conceptual illustration. None is a current forecast, model-performance result, protected asset location, or historical reconstruction. The examples demonstrate interpretation boundaries and the different actions that evidence quality and consequence can support.

The visible FAQ answers common interpretation and accountability questions in the same language used by the main methodology. Each answer opens with a direct response and is emitted into FAQ schema from this one visible source; structured data never contains hidden, expanded, or differently worded answers.

The source register identifies publisher, source type, title, date or version, review date, and relevance, while adjacent citations show which claims each source supports. Internal reading paths connect Data Sources, Model Validation, Limitations, Outage Prediction, the outage-prediction and Forecast Accountability articles, vegetation and Critical Infrastructure methodology, status-safe GeoSQL material, current coverage, and the Knowledge Hub.

The primary next step is to review current GeoGridIQ data and prediction availability. The secondary next step is to explore the outage-intelligence dashboard. These calls to action support verification and bounded use; they never promise an exact failure, prevention, savings, or guaranteed forecasting. Account and dashboard access continue to follow the product's existing authentication and authorization flow.