← All Projects/Production Operational Platform

MazingiraOps

Multi-ward environment operations platform

A multi-tenant operational platform engineered to digitize municipal sanitation and environmental management from Makina Ward to Kibra Subcounty and Nairobi City County. Features QR attendance, leave approval workflows, field work evidence, and immutable reporting.

Operational Scale & Deployment Hierarchy
Makina WardKibra SubcountyNairobi City County
The Administrative Crisis

Manual Records & Evidence Gaps

Municipal environmental operations across informal settlements previously depended on physical paper rosters. Sign-in sheets were prone to ghost worker entries, daily attendance lacked timestamp or GPS integrity, and work descriptions were lost in ad-hoc messaging apps.

Sick-offs and leave requests had no centralized approval state machine, causing administrative delays, while quarterly county performance appraisals required days of manual reconciliation.

The Engineering Solution

End-to-End Verified Workflow Platform

MazingiraOps digitizes the entire administrative lifecycle: bulk roster imports with 11-digit year-prefixed IDs, daily expiring QR sessions with anti-duplicate validation, and verified work logs with multi-photo evidence (Before, During, After).

Supervisors review and approve submissions through structured state transitions, feeding an automated reporting engine that outputs deterministic, immutable PDF and CSV reports.

Operational Lifecycle Workflow

From field roster ingestion to immutable municipal appraisal archives

STAGE 01 OF 05

Staff & Roster Ingestion

Imports and validates 11-digit year-prefixed Employee IDs via Excel/CSV rosters, updating records without deleting historical data.

Technical Components & Invariants:
Roster reconciliationUnique ID constraintsDeactivation/Reactivation
System Hardening

Security, Tenant Isolation & Privacy Invariants

Multi-Role RBAC & Tenants

Default-Deny Scoping

Roles include System Admin, Ward Officer, Subcounty Reviewer, HR Viewer, and Read-Only. Default-deny tenant isolation is enforced at database queries and service boundaries.

Private Object Storage

S3 & Scoped Evidence

Field photos, sick sheets, and medical certificates are stored in private S3 buckets and streamed exclusively via authorized signed routes. Medical files are restricted to HR viewers.

Immutable Reporting

Appraisal Snapshots

Finalized reports are frozen as immutable snapshots unaffected by subsequent record edits. Spreadsheets are sanitized against CSV formula injection vulnerabilities.

Monorepo Layout & Technologies

pnpm Monorepo Architecture

apps/web
Next.js App Router, React, Tailwind CSS
apps/api
NestJS + Fastify, TypeScript API Gateway
packages/database
PostgreSQL, Prisma schema & migrations
packages/contracts
Shared domain enums and API contracts
packages/validation
Shared Zod schemas for forms and APIs
infrastructure/
Docker containerization & Railway deployment