AdminConsole
Stateful journeys/Coordinated incident response/Workshop
Advanced2 hr 10 min8 implementation labs5 hostile paths

Build Coordinated incident response

An eight-lab, source-bounded workshop for the complete incident lifecycle: exact commands and events, durable records, replay, concurrency, unknown outcomes, hostile fixtures, a maintained capstone, and production exit evidence.

Durable boundaryincident · 7 states · 8 transitions · 8 event identities
Application-owned workshop

Freeze the evidence boundary first

This curriculum teaches the durable host workflow around reviewed Mappls surfaces. It does not manufacture provider endpoints, callbacks, resource states, entitlement, or completion evidence.

The journey blueprint and application event contracts are implementation guidance, not Mappls provider payload specifications.Only linked normalized contracts and source guides may define provider request syntax; empty evidence is never backfilled.The simulator and maintained capstone operate in explicit fixture mode and make no entitlement claim.Credentials, precise production payloads, opaque native objects, and provider secrets stay outside workshop inputs and durable examples.
Lab 1 · 15 min

Model the lifecycle before the UI

Turn the incident blueprint into an explicit aggregate boundary owned by the application.

Build

reported: A stable CAD or operations identifier, incident type, severity, caller reference, required capability, and location intent are recorded.located: A provider-backed Mappls identity, coordinate, formatted address, confidence, and resolution method are committed.dispatched: A capable available unit is selected with matrix ETA, route identity, constraints, and attributable rationale.en_route: The assigned unit accepted and current event-time telemetry drives route progress and ETA.on_scene: Distance, speed, and dwell policy establish arrival; scene hazards and coordination remain active.resolved: Outcome, responsible responder, and external evidence references are committed.reviewed: A commander signs off the replay, disposition, response timings, telemetry count, hazards, and evidence completeness.

Prove before continuing

Every persisted state exists in the reviewed blueprint.Terminal states reject ordinary forward commands.Recovery text is operational guidance, not another hidden state.
Lab 2 · 20 min

Implement every command and event pair

Make intent, actor authority, allowed source state, committed state, and emitted fact reviewable together.

Build

report_incident by Call taker: new aggregate → reported; emit incident.reported.resolve_location by Dispatcher: reported → located; emit incident.located.dispatch by Dispatcher: located → dispatched; emit incident.dispatched.accept_dispatch by Responder: dispatched → en_route; emit dispatch.accepted.record_position by Telematics service: en_route → en_route; emit unit.position_recorded.confirm_arrival by Responder: en_route → on_scene; emit incident.arrived.resolve by Responder: on_scene → resolved; emit incident.resolved.review by Incident commander: resolved → reviewed; emit incident.reviewed.

Prove before continuing

report_incident resolves to emergency-incident-response-incident-reported without claiming a provider webhook payload.resolve_location resolves to emergency-incident-response-incident-located without claiming a provider webhook payload.dispatch resolves to emergency-incident-response-incident-dispatched without claiming a provider webhook payload.accept_dispatch resolves to emergency-incident-response-dispatch-accepted without claiming a provider webhook payload.record_position resolves to emergency-incident-response-unit-position-recorded without claiming a provider webhook payload.confirm_arrival resolves to emergency-incident-response-incident-arrived without claiming a provider webhook payload.resolve resolves to emergency-incident-response-incident-resolved without claiming a provider webhook payload.review resolves to emergency-incident-response-incident-reviewed without claiming a provider webhook payload.
Lab 3 · 15 min

Persist restart-safe records

Separate business identity, provider evidence, command receipts, immutable facts, audit, and downstream delivery.

Build

Incident aggregate: Business identity, lifecycle, location, assignment, hazards, outcome, and review. Keys: incidentId, externalIncidentId, state, version, severity, requiredCapability.Location decision: Provider-backed location and human confirmation evidence. Keys: mapplsPin, coordinate, formattedAddress, method, confidence.Assignment decision: Capability, availability, matrix, route, constraints, and selection rationale. Keys: unitId, routeId, capabilities, eta, selectedBy, reason.Telemetry envelope: Immutable responder position and vehicle evidence. Keys: providerEventId, unitId, eventTime, receivedTime, position, quality.Review record: Attributable disposition and metrics derived from committed events. Keys: reviewer, disposition, timings, positionCount, hazardCount.

Prove before continuing

Process restart restores the same aggregate version and command result.Opaque SDK or native UI objects are not durable records.Provider evidence and application decisions remain distinguishable.
Lab 4 · 15 min

Make concurrency and replay deterministic

Apply optimistic expected versions and aggregate-scoped idempotency before executing effects.

Build

One external report maps to one incident aggregate.Only available units with the required capability are eligible for ranking.A unit is assigned to at most one active incident in the same operational context.Only the assigned unit can accept dispatch and publish operational telemetry.Raw telemetry preserves event and receipt time; late evidence never regresses latest state.Arrival requires explicit distance, speed, and dwell evidence.Resolution cannot occur without external evidence references.

Prove before continuing

An exact replay returns the first result without another event or version.A reused key with different intent conflicts.A stale expected version changes no durable truth.
Lab 5 · 15 min

Control effects and unknown outcomes

Commit outbox intent atomically, execute effects outside the transaction, and reconcile ambiguous results.

Build

Caller location is ambiguous: detect with Search candidates are low-confidence, far apart, or conflict with caller/device context. Recover with Keep the report unresolved, ask a targeted confirmation question, and record the chosen candidate and reason.Two dispatchers select the same unit: detect with Unit reservation or incident expected version conflicts. Recover with Return the current assignments and require an intentional new selection from refreshed availability.Telemetry is late or out of order: detect with Event time is behind the incident position watermark. Recover with Store it, emit a late-evidence event, and do not replace latest route progress.Route becomes unsafe after dispatch: detect with A new hazard, closure, or restriction intersects the current route or approach policy. Recover with Record the hazard, calculate a versioned replacement route, and keep the last safe guidance until accepted.Resolution side effects fail: detect with Incident is resolved while notification or downstream outbox entries remain pending. Recover with Retry the outbox independently; never re-resolve the incident to trigger delivery.

Prove before continuing

A timeout remains an unknown outcome until identity-based reconciliation completes.Retries are bounded and preserve the original business and command identities.Dead-letter or manual review retains the entire attempt history.
Lab 6 · 15 min

Run all hostile fixture scenarios

Exercise the success path plus replay, concurrency, state, and response-loss failures without an account.

Build

Complete journey: Commit the shortest reviewed success path to the journey-specific operating target.Idempotent replay: Repeat one command identity and prove that version, event identity, and side effects do not duplicate.Stale version: Reject a command based on an outdated aggregate version without changing durable truth.Invalid transition: Reject a known command when the current state does not permit it.Unknown outcome recovery: Reconcile after a lost response, then replay the original command identity safely.

Prove before continuing

All fixture checks pass for all five scenarios.Rejected commands emit no event and do not increment version.The fixture makes zero provider calls and exposes no write tool.
Complete journeyIdempotent replayStale versionInvalid transitionUnknown outcome recovery
Lab 7 · 20 min

Trace the Incident Dispatch capstone

Follow the maintained source through domain rules, adapter seam, repository transaction, HTTP boundary, UI evidence, and restart test.

Build

Run the app's declared test suite (8 tests).Run fixture mode without a credential.Inspect audit and outbox evidence after each transition.Restart the process and continue the same aggregate.

Prove before continuing

The downloadable archive checksum verifies before execution.The capstone covers the journey target without inventing provider completion.Browser and HTTP surfaces report the same durable version.
Inspect Incident DispatchDownload sourceVerify SHA-256
Lab 8 · 15 min

Qualify the real integration boundary

Replace only reviewed adapter seams and collect independent production evidence without weakening application invariants.

Build

Report-to-location and call-to-dispatch timeEligible responder count and rejected capability reasonsMatrix ranking, selected unit, override, and route latencyTelemetry freshness, ordering lag, and route revisionHazard age and approach-policy changesArrival evidence pass/fail and override rateScene-to-resolution time and evidence completenessOutbox backlog and review completion

Prove before continuing

Exact product entitlement and regional behavior are validated separately.Provider contract tests cover success, rejection, throttling, timeout, and unknown outcome.Security, privacy, operations, rollback, and product owners approve exact evidence.Fixture completion is never presented as provider or production completion.
Copy, run, then adapt

Application-owned reliability scaffolds

The aggregate and SQL examples implement host truth; the fixture clients call the credential-free Journey Lab. Replace only the separately reviewed provider adapter seam.

Coordinated incident response workshop scaffolds
type State = "reported" | "located" | "dispatched" | "en_route" | "on_scene" | "resolved" | "reviewed";
type CommandName = "report_incident" | "resolve_location" | "dispatch" | "accept_dispatch" | "record_position" | "confirm_arrival" | "resolve" | "review";

type Command = {
  name: CommandName;
  aggregateId: string;
  expectedVersion: number;
  idempotencyKey: string;
};

const transitions = {
  "report_incident": { from: [null], to: "reported", event: "incident.reported" },
  "resolve_location": { from: ["reported"], to: "located", event: "incident.located" },
  "dispatch": { from: ["located"], to: "dispatched", event: "incident.dispatched" },
  "accept_dispatch": { from: ["dispatched"], to: "en_route", event: "dispatch.accepted" },
  "record_position": { from: ["en_route"], to: "en_route", event: "unit.position_recorded" },
  "confirm_arrival": { from: ["en_route"], to: "on_scene", event: "incident.arrived" },
  "resolve": { from: ["on_scene"], to: "resolved", event: "incident.resolved" },
  "review": { from: ["resolved"], to: "reviewed", event: "incident.reviewed" },
} as const;

export function decide(current: { state: State | null; version: number }, command: Command) {
  const rule = transitions[command.name];
  if (command.expectedVersion !== current.version) throw new Error("version_conflict");
  if (!rule.from.includes(current.state as never)) throw new Error("invalid_transition");
  return {
    state: rule.to as State,
    version: current.version + 1,
    event: rule.event,
    idempotencyKey: command.idempotencyKey,
  };
}

// Persist the result, immutable event, audit row, and outbox intent atomically.
// Store the first result by idempotencyKey before executing another effect.
Definition of done

Exit with reviewable evidence

All 8 reviewed transitions are implemented with actor and source-state checks.All 8 application event identities are immutable and versioned.Exact replay, idempotency conflict, stale version, invalid transition, and unknown outcome are tested.Aggregate, event, audit, command result, and outbox intent commit atomically.The Incident Dispatch capstone passes 8 declared tests after archive checksum verification.Provider entitlement, payload, callback, completion, and production behavior remain independently evidenced.
Workshop completion is not production authority

Workshop completion proves an application-owned reliability design only. Production still requires issued entitlement, exact adapter contract tests, regional and quota validation, security/privacy review, operational drills, and independent release approval.

Canonical evidence

Trace every external claim to an indexed source

Workshop evidence ready

Break the application before connecting the provider.

Run all five hostile scenarios and the maintained capstone test suite. Then qualify the exact provider seam under independently reviewed non-production entitlement.