A full-stack, backend-linked civilian safety simulation for degraded infrastructure, bounded responder handoff, and public-safe evidence custody.
Counts below are read directly from the requirements, test, and scenario evidence on this page — not a separate hardcoded total.
All three modes read the same preserved evidence. No mode deletes or permanently hides a section.
Highlights the mission brief, dashboard, console, live result, what was built, requirements/test summary, limitations, and submission snapshot. Every other section remains fully present and reachable.
Embedded professor console — single-run review: run one of three professor scenarios on this page, inspect the returned result, download the exact receipt, and verify its integrity/signature state.
Proof Theater — full flagship demonstration: open Flood/Hurricane, capture a baseline receipt, apply blackout stress, rerun, and compare the two completed receipts.
Select Flood/Hurricane, Structure Fire/Muster, or Acoustic Emergency Recognition. Then choose Full Evidence Run at 5,000 trials or Quick Professor Review at 600 trials.
Check the simulation-only acknowledgement box. The Run button stays disabled until you do.
Run the simulation, review the result summary, download the exact official receipt, and optionally verify its integrity/signature state.
The following sections preserve the complete project objective, intended users, demonstration design, architecture, privacy boundary, emergency-management interpretation, and research alignment.
This capstone demonstrates a full-stack safety simulation prototype: public scenario controls, backend Monte Carlo execution, public-safe receipt generation, role-specific interpretation, consent-gated audio modeling, bounded responder handoff visualization, degraded-transport analysis, and stale-state protection.
Civilian safety software that watches continuously to be useful in an emergency becomes a permanent surveillance system the rest of the time. This project asks whether a safety architecture can stay bounded — minimizing what it collects and releases — while still behaving usefully when communications and power infrastructure degrade.
Flood, hurricane, and other large-area events routinely take out cell towers, cellular service, and home power at the same time a resident most needs a path out or a way to signal for help. A safety design that only works when the network is healthy is not tested against the conditions that matter most.
Designing for degraded infrastructure tends to push systems toward more collection "just in case" — more location history, more always-on audio, more centralized storage. This capstone treats that as a design failure to avoid, not a tradeoff to accept, and evaluates a bounded, consent-gated, custody-aware alternative instead.
The strongest evidence produced by the companion research is architecture-level and delivery/infrastructure-mediated: it shows up specifically when ordinary centralized transport is stressed, not in ordinary conditions. A capstone story built only around a calm-weather scenario would not exercise the part of the design doing the most work.
An isolated civilian, field-service worker, or community member operating during flood conditions and communications degradation — someone who needs a bounded, local-first safety layer when ordinary cellular, Wi-Fi, or cloud paths are unreliable.
This capstone does not present live 911 service, operational public deployment, or agency integration as the primary user or use case. Those are future-work pathways described in the Limitations and Future Work sections below, not claims about the current prototype.
The flagship demonstration runs the existing Flood / Hurricane preset through the real backend Monte Carlo twice, using only sliders that already exist in the Proof Theater, and compares the two completed public-safe receipts.
Only the sliders listed above. Everything else — the scenario's flood depth and rain intensity, BFB/TAB enablement, and every other control — stays at the same preset value across both runs, so the comparison isolates the effect of communications/infrastructure degradation.
The scenario, trial count, and every non-communications slider stay fixed. Both runs go through the same backend endpoint, the same trial cap, and the same receipt serialization path.
How the same modeled event's delivery-path, egress, and preservation reads change when ordinary transport is degraded and CivOS falls back to surviving permitted paths — the same architecture-level pattern the companion research reports under synthetic degraded-state stress.
This is not a controlled field experiment, an emergency-service validation, or a guarantee that a packet can leave when no physical transport path exists. When no route exists, SOS preserves the event locally and records non-delivery — it does not claim delivery happened anyway.
Every run follows one linear, auditable path. Nothing about the diagram below implies a production emergency deployment — it documents the current public capstone prototype.
The capstone uses a serverless backend to make the public simulation reviewable, rate-limited, and reproducible. The modeled production architecture remains local-first: local-first device state, local evidence custody, degraded-transport handling, and device/hardware-adjacent execution. The cloud-hosted simulation service is an evaluation implementation, not the claimed final safety execution substrate.
Every row reflects genuinely implemented behavior in the current production main build. Nothing here is marked complete unless it is real.
| ID | Requirement | Implementation | Evidence | Status | Boundary |
|---|---|---|---|---|---|
| FR-01 | Select one of exactly seven scenarios. | SCENARIOS array, live-run-engine | Preset dropdown renders 7 options | Implemented | Backend math unchanged across all seven |
| FR-02 | Mount scenario-specific controls. | slidersFor() / rebuildSliders() | Sliders swap on scenario change | Implemented | Real backend keys only, no invented sliders |
| FR-03 | Adjust public-safe shared controls. | Universal substrate + degraded-egress groups | Sliders visible, collapsible groups | Implemented | Public-safe estimates, not raw telemetry |
| FR-04 | Accept run-access agreement. | isAccessAccepted() / #v21Terms | Run button disabled until accepted | Implemented | Session-scoped, not a legal record |
| FR-05 | Execute backend Monte Carlo. | POST /api/sos/safety-simulation-lab | Real network request per run | Implemented | 5,000-trial public cap |
| FR-06 | Generate a receipt-backed result. | buildPublicSafeReceipt (backend) | Receipt object returned per run | Implemented | Protected internals withheld by design |
| FR-07 | Display backend counters. | publicAccessWindow | Hour/day/month/total usage shown | Implemented | Durable, atomic Upstash Redis enforcement using a privacy-preserving HMAC access identity; production fails closed if durable enforcement is unavailable |
| FR-08 | Mark results stale after control changes. | markRerunRequired() | #lkmcRerunFlag becomes visible | Implemented | No receipt mutation before rerun |
| FR-09 | Rerun through the same backend path. | runSimulation() | Same endpoint, same sanitizer | Implemented | No local fallback result |
| FR-10 | Download the latest completed receipt. | downloadReceipt() | Always the most recent completed run | Implemented | Not the capstone baseline/blackout snapshots |
| FR-11 | Request and decide TAB. | User tablet + TAB backend rerun bridge | Accept/deny dispatches real rerun | Implemented | No-interaction path injects no fake state |
| FR-12 | Show BFB bounded handoff. | BFB field console + receipt fields | Bounded responder packet rendered | Implemented | Route hint/welfare/validity/audit only |
| FR-13 | Generate receipt-derived sensitivity. | Quick Sensitivity Bands | Bands populate after a completed run | Implemented | Not protected Sobol/GSA validation |
| FR-14 | Render role-specific Reviewer Lens. | Reviewer Lens (6 lenses) | Deep-dive + questions per lens | Implemented | Interpretation only, not new metrics |
| FR-15 | Support baseline vs. blackout-stress capstone comparison. | Capstone Demonstration Mode | Two-run comparison table | Implemented | Compatible fields only, neutral for missing |
| FR-16 | Submit professor review feedback and produce a human-readable review report. | Professor review form, durable review API, receipt reader, Word export, and print/PDF output | Successful API submission receipt, DOC generation, print layout, and imported-receipt verification | Implemented | Academic review workflow only; not an official OSU-OKC grading-system replacement |
| ID | Requirement | Implementation | Evidence | Status | Boundary |
|---|---|---|---|---|---|
| NFR-01 | Privacy minimization. | Bounded release boundary, allow/deny lists | Receipt releaseBoundary field | Implemented | No raw audio/video/continuous location by default |
| NFR-02 | No raw trace exposure. | Backend withholds protected constants | rawTracesWithheld: true on receipt | Implemented | Reviewer-visible flag, not a formal audit |
| NFR-03 | Responsive mobile/tablet/desktop layout. | Breakpoints across engine + review CSS | Tested 390/768/1024/1280/1440 | Implemented | See Test Plan for viewport results |
| NFR-04 | Accessible keyboard operation. | Native buttons/inputs, visible focus styles | Manual keyboard pass on new pages | Partially verified | Not independently audited by a third party |
| NFR-05 | Backend-authoritative results. | No local fake Monte Carlo | Every result traces to a POST response | Implemented | Errors never fabricate a replacement result |
| NFR-06 | Duplicate-submit prevention. | runToken guard + button disable | Run button disabled while a request is in flight | Implemented | Rate limit still enforced backend-side |
| NFR-07 | Public claim boundary. | CLAIM_BOUNDARY_TEXT, claim-boundary sections | Rendered on Proof Theater and this page | Implemented | Repeated at every relevant section, not just once |
| NFR-08 | Honest error state. | errorMessageFor() | Rate-limit/terms/5xx-specific copy | Implemented | No stack traces or API internals shown |
| NFR-09 | Receipt integrity. | receiptHash field | Hash present on every completed receipt | Implemented | Integrity-style hash, not a cryptographic signature |
| NFR-10 | No dependency on continuous location display. | Route hint / bounded proximity only | No live map or continuous coordinate feed | Implemented | Modeled scene-edge/physical-access windows only |
| NFR-11 | Protect reviewer information and retain only bounded review evidence. | Sanitization, consent notice, HMAC access identity, durable fail-closed storage, one-year retention, no raw IP persistence | lib/sos/sos-capstone-review-store.js namespace/domain separation and review-record schema | Implemented | Not a FERPA-certified student-record system and not a replacement for the institution's official LMS |
/api/sos/safety-simulation-labsessionStorage for access-agreement/session stateNot used: React or another frontend framework, a database, WebRTC, native Android, a custom kernel, or deployed cryptographic hardware. If any of those are added later, this list should be updated alongside them.
window.LAKANA_SOS_SIM_STATE).sessionStoragesessionStorage is browser tab storage, not a database. It clears when the tab closes and is never queried across users.
Only the sanitized public-safe request body (scenario key, slider values, trial count, seed) sent to the backend endpoint on each run. No raw audio, video, continuous location, or device identifiers are sent.
Individual receipt payloads are not stored in a server-side run database after the response is returned. Public access counters are separately and atomically enforced through durable Upstash Redis using a privacy-preserving HMAC access identity; the production endpoint fails closed if durable enforcement is unavailable.
This prototype demonstrates system behavior, technical workflow, and evidence review. It is not live emergency dispatch, field validation, or guaranteed rescue.
For this capstone, I designed and implemented the public evaluation prototype, backend-linked simulation workflow, receipt review interface, and validation package for the LAKANA SOS architecture.
The underlying LAKANA SOS, CivOS, TSARO, NICOLE, BFB, and TAB architecture is pre-existing LAKANA background intellectual property. The capstone work is the public evaluation, implementation, review, and validation layer.
The allowed payload is limited to welfare state, route hint, validity, and audit fields. Denied-by-default fields — raw audio, raw video, continuous location — are named explicitly on every receipt's release boundary.
The Tactical Audio Bridge only enters an accepted state after an explicit user decision. Recording remains off by default, and no-interaction never injects a fake accepted/denied override.
The Blue Force Bridge responder packet is minimized to route hint, welfare, validity, and audit — never a continuous location feed or raw evidence vault access.
Protected constants, private thresholds, and raw traces are withheld by design. Denied or failed transport is not silently dropped — it is recorded in the event timeline.
Once any control changes after a completed run, the result is marked stale and a rerun is required before the receipt is treated as current — the interface never quietly keeps showing a result that no longer matches the visible controls.
The public demo does not request microphone, camera, or continuous geolocation permissions. TAB and BFB flows are modeled UI state, not live WebRTC sessions.
Not claimed: perfect privacy, "unhackable" or "surveillance-proof" status, formal certification, or legal compliance in any specific jurisdiction.
A responder reaching the general area (scene-edge arrival) is not the same as reaching the specific person (physical access). The gap between the two — the access gap — is the operationally decisive quantity under blocked roads, floodwater, debris, smoke, or crowd compression.
Route obstruction is modeled explicitly and feeds both the egress-path read and the modeled access-gap estimate, rather than being folded silently into a single opaque score.
Tower outage, RF degradation, and cellular degradation are modeled as independent, adjustable pressures, matching how large-area events typically fail: partially, unevenly, and often for the exact routes people are trying to use.
When no permitted path exists, the model's answer is to preserve the event locally, not to claim delivery anyway. Preservation and delivery are reported as separate scores for this reason.
When immediate egress is blocked, the model evaluates whether a nearby peer, relay, or store-and-forward path can carry the event once a route returns, rather than treating "no immediate delivery" as final failure.
The BFB packet a responder would see is deliberately minimized — this is dispatch-adjacent situational awareness, not a dispatch replacement, and not incident-command authority. It is designed to support incident response, not direct it.
Results below reflect the current production build's manual and scripted verification. Where independent testing has not occurred, that is stated directly rather than implied.
| Test ID | Description | Expected result | Current evidence | Result |
|---|---|---|---|---|
| T-01 | Build | npm run build completes without error | Static build log | Pass |
| T-02 | Preset count | Exactly seven presets in the scenario dropdown | scripts/validate-sos-capstone.js | Pass |
| T-03 | Backend request | Run dispatches a real POST to the safety-simulation-lab endpoint | Manual Playwright network capture | Pass |
| T-04 | Trial cap | Requested trials above 5,000 are rejected or clamped | Backend sanitizer code path | Not independently load-tested |
| T-05 | Duplicate submission | A second click while a run is in flight does not fire a second request | Run button disable + runToken guard | Pass |
| T-06 | Receipt generation | A completed run returns a full public-safe receipt object | assets/sos-sample-public-receipt.json | Pass |
| T-07 | Latest receipt download | Download always reflects the most recently completed run | Manual verification across reruns | Pass |
| T-08 | Counter source | Access counters come only from the backend response | publicAccessWindow field inspection | Pass |
| T-09 | Stale state | Any slider change after a completed run shows the stale/rerun indicator | Manual + scripted check | Pass |
| T-10 | TAB no interaction | No accepted/denied override is injected without a real user decision | Direct event-dispatch test | Pass |
| T-11 | TAB accepted | Accepting TAB and rerunning records an accepted state on the receipt | Direct event-dispatch test | Pass |
| T-12 | TAB denied | Denying TAB and rerunning records a denied state on the receipt | Direct event-dispatch test | Pass |
| T-13 | Sensitivity receipt connection | Sensitivity bands populate from the completed receipt, not a static preview | Manual verification | Pass |
| T-14 | Guided demo | The existing Guided Demo opens/closes and consumes no run | Scripted Playwright check | Pass |
| T-15 | Reset preset | Reset Preset restores real defaults and marks the run stale | Scripted Playwright check | Pass |
| T-16 | Changed-from-default indicators | Indicators reflect real slider deltas only | Scripted Playwright check | Pass |
| T-17 | Baseline / blackout comparison | Comparison table renders from two stored completed receipts, with neutral text for missing fields | Manual verification, this branch | Pass |
| T-18 | Error states | Rate-limit/terms/5xx errors show safe copy, no stack traces, no fake result | Manual + code review | Pass |
| T-19 | Copy/claim scan | No forbidden claim phrases appear in changed files | scripts/validate-sos-capstone.js | Pass |
| T-20 | Mobile layout | No horizontal overflow at 390×844 | Playwright viewport check | Pass |
| T-21 | Tablet layout | No horizontal overflow at 768×1024 | Playwright viewport check | Pass |
| T-22 | Desktop layout | No horizontal overflow at 1024–1920 widths | Playwright viewport check | Pass |
| T-23 | Keyboard navigation | All interactive controls reachable and operable by keyboard | Manual tab-order pass on new pages | Not yet independently tested |
| T-24 | 200% zoom | No lost content or broken layout at 200% browser zoom | Manual visual check on new pages | Not yet independently tested |
| T-25 | Console errors | No uncaught console errors during the flagship workflow | Playwright pageerror capture | Pass |
| T-26 | Professor review form submission | A valid submission returns a reviewId, timestamp, and integrity digest | Real POST to /api/sos/capstone-review against the local backend harness | Pass |
| T-27 | Review idempotency and rate limiting | Same key/body replays the same response; different body conflicts; excess submissions are rate-limited | Scripted retry/conflict/rate-limit harness | Pass |
| T-28 | Imported receipt verification | An unsigned valid receipt reports "Digest integrity verified; receipt unsigned." | Manual + scripted verification against importOfficialReceipt | Pass |
| T-29 | Human-readable DOC report | Downloaded .doc file contains readable review and receipt-summary text | Manual DOC content inspection | Pass |
| T-30 | Print / Save PDF layout | Print view shows the complete review report with no clipped sections | Manual print-preview inspection | Pass |
| T-31 | Zero simulation POST from review workflow | Opening the form, importing a receipt, and generating DOC/PDF never call the simulation endpoint | Playwright network capture | Pass |
| T-32 | Review privacy and retention boundary | Stored record excludes raw IP and the exact receipt JSON; retains only the bounded summary | Direct inspection of the stored review record schema | Pass |
| T-33 | Owner endpoint authentication | Missing/incorrect/query-string tokens are rejected; a valid bearer token succeeds | Scripted auth harness against api/sos/capstone-review-admin.js | Pass |
You do not need to read the companion research to understand this capstone. This section summarizes it conservatively for reference.
Monte Carlo evaluation of a civilian safety architecture under separated comparison suites and synthetic degraded-state stress. 250,000 nominal trials; 500,000 synthetic degraded-state trials. Simulation-only — no field validation, no emergency-service certification, no empirically calibrated human-safety claim, no real-world attacker-resistance claim, no clinical survival claim. "Survivability" is a simulator-defined protected-outcome variable, not mortality or percent alive.
The strongest evidence is architecture-level and delivery/infrastructure-mediated under the modeled degraded-state regime — the comparator's dependence on centralized transport is the dominant failure mechanism in that diagnostic.
Detector behavior is reported as a burden–sensitivity trade-space: higher raw recall can also raise false-positive and escalation burden. This research does not claim universal detector superiority or empirical calibration.
This project is at stages 2–3. Stages 4–6 are future work, not completed milestones.
"Implemented" means present in the current project. "Pass" means supported by the evidence listed in the table. "Partially verified" does not mean failed. Passing scripted tests does not establish field safety or certification.
modelBuildCommit field.No live receipt generated yet in this session.
This snapshot reads the professor console's own receipt and state directly. The public evaluation page is deployed, but the modeled emergency-service and local-first production system are not field deployed or certified.
Use this form to submit academic feedback on the LAKANA SOS Capstone. You may attach the current simulation receipt or import a previously downloaded official receipt JSON file. A human-readable copy can be downloaded after submission.
For a short review, complete the embedded single-run professor console first. For the full flagship workflow, continue to the Proof Theater baseline-versus-blackout comparison below.
No revenue projection, adoption claim, or agency endorsement is made here. These are potential controlled-validation contexts, not commitments.