How Muster works

One binary, every device

Muster runs as a single application across iOS phone, iOS tablet, Android phone, Android tablet, macOS, Windows, and a web admin console. No separate "command vehicle edition" or "firefighter edition" — every role is built into the same binary, and the user sees the right interface for their current role.

A chief switches from Incident Commander to Safety Officer by tapping a role button. The interface changes; the underlying data does not.

Offline-first peer mesh

During an incident, devices on scene form a peer-to-peer mesh on the local Wi-Fi network. There is no central server required, no cell tower required, no internet required. Each device holds the complete incident state and can run the incident independently if every other device is destroyed.

Discovery happens via mDNS on the local network. New devices join by scanning a QR code from any device already on the incident. Events propagate via WebSocket to every peer, with ChaCha20-Poly1305 encryption and Ed25519 signatures.

When the incident wraps, the after-action archive is generated locally on every device. If the department has a cloud subscription (Tier 2 or Tier 3), the archive synchronizes to the cloud. If not, it stays on the device that authored it.

Event-sourced architecture

Everything that happens during an incident is an immutable, HLC-ordered, signed event. UnitArrived. MaydayDeclared. HazardFlagged. EvacuationOrdered. The state of the incident is a projection over the event log.

This means:

• Nothing is ever modified after the fact. Corrections are additive events that supersede prior ones, with both the original and the correction preserved in the audit trail.
• The complete history of every decision is visible in the after-action review.
• Disputes about "when did we declare evacuation" become unambiguous — there is one signed, ordered, timestamped record.

Roles and authority

Muster has seven first-class roles, each with its own interface and authority scope:

• Incident Commander. Holds command authority for the agency. Issues strategy changes, formal evacuation orders, and incident-termination decisions. Only one IC per agency at any time.
• Safety Officer (ISO). Flags hazards, monitors crew fatigue, raises safety concerns, and orders evacuation in imminent-danger conditions. Authority scope is distinct from command — explicitly per NFPA 1550 Chapter 5.
• Division Supervisor. Manages a tactical division or group. Receives assignments from IC, requests resources, and reports back on PAR.
• Check-in Officer. Tracks arriving units, manages staging, records off-scene transitions. The roster authority for the incident.
• Rehab Officer. Runs the rehab cycle per NFPA 1580 Chapter 22. Captures vitals, makes return-to-duty decisions, escalates to medical when warranted.
• Arriving Unit. A unit en route to or arriving at the scene. Reports en-route status and accepts assignment on arrival.
• Crew Member. A firefighter on a unit. Personal Mayday authority, responds to PAR requests, captures their own exposure events.

Authority is explicit and tracked. Only one device per agency can hold "command holder" status, and command transfer is a deliberate two-step gesture (current holder taps "transfer," receiver accepts, both peers sign). The Safety Officer's authority to order evacuation in imminent danger bypasses the normal command structure — this is an explicit architectural commitment per NFPA 1550 Chapter 5.

Mutual aid and Unified Command

When multiple departments respond to an incident, each department retains sovereignty over its own data. Mutual aid trust is established either by token (per-incident QR scan) or by pre-registered partnership (Tier 2+ administrative relationship).

Under Unified Command (NFPA 1550 Chapter 18.5), each participating agency has its own command holder simultaneously. Decisions made jointly are logged in every participating department's audit trail with cross-references.

Area Command coordinates multiple separate incidents under a common strategic umbrella. Each child incident retains its own command structure; Area Command provides resource allocation and strategic guidance.

After-action and compliance

When an incident terminates, Muster automatically generates:

• After-action review PDF with timeline, decisions, assignments, and outcomes
• NFPA 1550 program documentation (chapter mapping available)
• NFPA 1580 rehab and exposure documentation (Chapters 20-22)
• OSHA 1910.1020 occupational exposure records (30+ year retention for Tier 2+)
• NERIS submission payload (when integration ships, Phase 7)

Want to read the chapter-level mapping? Request the NFPA 1550 mapping or the NFPA 1580 mapping.