FieldMatch

Compare maps, discover patterns. Intended URL: https://fieldmatch.w3ds-agro.eu.

Independent W3DS platform created through GitW3. Managed .w3ds/platform.json is its identity, never BMA's identity. Reuses BMA's eID signature verification, membership checks, field/year reads and geometry fixes.

Features

Two, three or four maps with linked centre, zoom and cursor. Unlink for independent exploration. Mouse, Mac trackpad, Safari gestures, touch, keyboard, zoom buttons and Fit field. Personal/company/project/group eVault selector rechecks current membership. A public explorer works before sign-in, with no fabricated fields or measurements.

30 contextual public layers sourced from the live NL Agro Map catalogue, including AHN, BRO, SoilGrids, imagery, land use, nature, vegetation and radar. Source legends and tile errors. Acquisition dates and resolution differ. Dynamic weather stations and RainViewer require adapters and are not included.

Import GeoJSON, CSV points with configurable coordinate columns, or north-up GeoTIFF. CRS 4326, 28992 and 3857. TIFF uses its first band, preserves NoData and resamples to at most 512 × 512 geographic cells. Rotated TIFFs, other CRSs and shapefiles need an export first. Connect credential-free HTTPS WMS or XYZ URLs. These external services receive the browser's tile requests.

Matching ranks loaded numeric layers over a common field grid using Pearson correlation. Reports inverse relationship, shared coverage and samples. Refuses constant layers, less than 35% coverage or fewer than 12 samples. Point interpolation is limited to 25 m. This is exploratory association, not causation or significance: grid samples are spatially dependent. Categorical zone IDs are not physical measurements. Render-only WMS colours are never scored as measurements. The match action automatically samples numeric AHN heights via verified GetFeatureInfo (bounded 11 × 11 grid, four concurrent requests, sample coverage reported). This is exploratory sampling, not the original 0.5 m raster. AHN acquisition date differs from crop year. Automatic SoilGrids retrieval and proprietary Scoutmaster integrations remain future adapters.

Data ownership

No database. User data is authoritative in its owner's eVault. Local imports are ephemeral browser state until Save to my eVault. LayerController.saveLayer directly appends Observation a9723f8c-9aa1-48ff-9698-9447353736c3 (resolved live 2026-10-26), type=fieldmatch-layer, arbitrary schema-valid result.fieldmatch dataset. Owner/observedBy/uploadedBy resolve to the authenticated personal eName; ACL [owner]. Legacy ACL is not a claim of cryptographic confidentiality. No CDN file uploads, deletes or existing record replacements. Company reads do not imply writes; this release saves to personal vaults only.

Reads recover saved FieldMatch layers and numeric agricultural Observation footprints; unrelated observations are unchanged. Unsupported linked file formats are not silently treated as viewable maps. Webhook acknowledges packets without storing a local projection.

Reconstructability: replacing the container loses no saved user data; replay the owner's eVault. Unsaved imports and login challenges are ephemeral. No server-local file cache.

Development and validation

Node 24: npm ci --prefix api --ignore-scripts, npm ci --prefix app --ignore-scripts, npm run build. For production copy app/dist to api/client and npm start. For development start API on localhost:3018 and Vite on localhost:5188. npm test covers backend ownership/append rules and frontend geometry/year/import/correlation.

Root Dockerfile is a non-root, multi-stage stateless GitW3 deployment listening on 0.0.0.0:$PORT. Health: /healthz and /api/health. docker build -t fieldmatch .; docker run --rm -p 3000:3000 -e PORT=3000 fieldmatch. .dockerignore excludes local secrets and build/dependency folders.

Server configuration

• PUBLIC_BASE_URL: exact public callback base, otherwise GITW3_URL or local 5188. Use requested custom domain only when DNS/HTTPS work.
• PUBLIC_REGISTRY_URL: official registry by default.
• JWT_SECRET: optional stable random session key. Otherwise generated in memory; restart invalidates sessions. Multiple replicas need shared challenge state and the same secret; first release assumes one instance.
• Deployment authentication: GitW3 provisions the deployment credential automatically. The eVault client calls the official SDK handshake using W3DS_DEPLOYMENT_KEY_JSON (or a server-only mounted key file) and signed deployment evidence, then sends the idiomatic GraphQL request with X-ENAME. No developer key or manually minted platform token is used. See docs/DEPLOYMENT_AUTH_SDK.md for runtime evidence inputs and verification limits.
• AWARENESS_AS_A_SERVICE_KEY / AWARENESS_URL: FieldMatch-approved GroupManifest feed for complete automatic vault discovery. UI reports degraded discovery without the feed.

FieldMatch uses approved AaaS polling (GET /api/packets) for field, profile, layer and discovery reads, not webhook subscriptions. Configure the consumer credential in server secrets as AWARENESS_AS_A_SERVICE_KEY; never commit it. Read results are reconstructed from the complete filtered stream, including updates and deletes, in request memory only. Direct GraphQL mutations still use deployment authentication. Deployment authentication and consumer subscription are separate. End-to-end verification is tracked separately from source tests.

New subdomain needs authorised DNS/hosting provisioning. Existing BMA SSH credentials cannot provision a new site. Do not modify BMA's configuration for FieldMatch.

Automatic deployment

The public map-comparison UI is live at https://fieldmatch.w3ds.dev. On 28 October 2026, “Deploy every push to main” was enabled in GitW3 and verified after a page reload. GitW3 automatically creates the next patch release and deploys each push to main; do not also create a manual patch tag for a routine push. Build and vulnerability gates remain active. See the operational record.

Deployment automation is separate from PPA decisions and eVault access policy. Do not claim that the live UI proves eID/eVault integration works, or that auto-deployment waives all future certification requirements. The custom fieldmatch.w3ds-agro.eu domain is still pending DNS/HTTPS setup.