Digital Concierge System

A state visit is a chain of tightly-coupled segments — arrival, motorcade, venue, bilateral, banquet, departure — each with its own personnel, vehicles, security clearance and timing, and any of them can shift at ten minutes' notice. Coordination was happening over phone calls and messaging groups, which meant the current version of the plan existed in nobody's hands. Post-visit reconstruction of who was where was effectively impossible.

A dual-backend architecture: Frappe handles the durable record — itineraries, personnel, clearances, vehicles, venues — while a separate real-time service pushes segment state over WebSockets to the field. Itineraries are modelled as segments with dependencies, so shifting one propagates the timing consequence to everything downstream and notifies exactly the people affected. Access is segment-scoped: a driver sees their leg, a venue lead sees theirs, protocol sees the whole picture. The entire surface sits behind VPN with IP allow-listing and per-device whitelisting, and every change is attributed and timestamped for the post-visit record.