AdminConsole
Stateful journeys/GIS & Analytics
hybridanalysis run aggregate
mGIS & Insight · asynchronous resource graph

Governed spatial analysis

Ingest versioned data, validate and publish it, execute reproducible analysis, review lineage, and share a governed decision layer.

Open implementation workshop Run verified appExplore lifecycle
Lifecycle state machine

Every state means something operational

A state is not a UI label. It determines which actor may act, what evidence exists, what may be retried, and how recovery proceeds.

01
draft

Draft

Inputs, schema, coordinate system, ownership, and processing intent are declared but not accepted.

02
validating

Validating

Format, schema, geometry, coordinate reference, limits, and policy are being checked.

03
published

Published

An immutable dataset version is queryable with explicit workspace access and lineage.

04
processing

Processing

An analysis job references fixed input versions, parameters, runtime, and output ownership.

05
ready

Ready

Outputs, quality metrics, logs, lineage, and visualization metadata are complete.

06
shared

Shared

A governed audience can view or embed a selected output version under explicit policy.

07
failedterminal

Failed

Validation or processing stopped with typed, attributable diagnostics and retained inputs.

Command → decision → event

Transitions are attributable and retry-safe

Commands express intent. The aggregate validates current state and invariants, commits one new version, and emits a fact in the same transaction.

Command & actorAllowed fromResultIdempotency strategy
create_dataset_versionData engineer
new aggregate
draftdataset.version_created

Key by workspace, logical dataset, source hash, and intended version.

validateSpatial analyst
draft
validatingdataset.validation_started

Reuse the same validation attempt for identical content and policy.

publishWorkspace administrator
validating
publisheddataset.published

Commit immutable version and permissions atomically.

run_analysisSpatial analyst
publishedready
processinganalysis.started

Hash input versions, parameters, runtime, and output owner.

complete_analysisSpatial processing service
processing
readyanalysis.completed

One attempt identity can publish one immutable output manifest.

create_shareWorkspace administrator
ready
sharedshare.created

Key by output version, audience, policy, and expiry.

Durable records

Persist enough to recover and explain

Keep provider responses, business identity, state, events, and side-effect delivery distinct so each can be reconciled safely.

Dataset version

Immutable source or derived spatial asset.

datasetIdversioncontentHashcrsschemaowner

Analysis attempt

Reproducible execution and typed status.

analysisIdattemptinputsparametersruntimestatus

Lineage manifest

Auditable graph from source versions to outputs and shares.

outputVersioninputVersionsoperationgeneratedAtquality

Share policy

Audience, expiry, export, embedding, and revocation controls.

shareIdresourceVersionaudiencepermissionsexpiresAt
Non-negotiable rules

Protect truth at the aggregate boundary

  1. 1

    Published input and output versions are immutable.

  2. 2

    Every output records exact input versions, parameters, runtime, and actor.

  3. 3

    Workspace authorization applies separately to source, job, output, visualization, and share.

  4. 4

    A retry is linked to its previous attempt and never overwrites it.

  5. 5

    Revoking a share does not destroy dataset or analysis lineage.

Failure and recovery

Know what to do before it breaks

Recovery changes durable truth only through the same rules as normal operation. A timeout is an unknown outcome, not evidence that nothing happened.

Upload is interrupted

Detect

The client upload ID has incomplete acknowledged parts.

Recover

Resume only missing parts and verify the final content hash before validation.

Coordinate reference is missing or wrong

Detect

Extent, geometry validity, or known control points conflict with the declaration.

Recover

Fail validation with actionable diagnostics; require an explicit corrected version.

Analysis worker dies

Detect

Lease expires without a terminal attempt record.

Recover

Resume from supported checkpoint or create a linked retry under the same analysis identity.

Share is used after policy changes

Detect

Resource policy version or expiry no longer authorizes the audience.

Recover

Deny access immediately, record the decision, and require a newly authorized share.

Operational telemetry

Observe the journey, not merely HTTP status

Measure state age, event health, retries, reconciliation, and sensitive-data access alongside latency and error rate.

  • Upload completeness, validation failures, and feature-level error rate
  • Queue, execution, and total analysis time
  • Input/output size and spatial operation cost
  • Retry, cancellation, and orphaned-job rate
  • Lineage completeness and reproducibility checks
  • Share access, export, denial, expiry, and revocation
Grounded implementation

Contracts, repositories, workshops, tutorials, and runnable evidence

Only explicitly indexed evidence is linked. Empty sections are not backfilled with invented endpoints or package names.