Replay production event logs through model projections for incident analysis.

When a production incident occurs, you can use Forensics to replay the actual events through your test projections. This reuses all your invariant checks and state tracking to pinpoint exactly when and how something went wrong.

Why Forensics?

Instead of manually tracing through logs, let the same models and projections that verify correctness during testing analyze production behavior:

1. Same invariant checks - Production events are verified against the same assertions used in property tests
2. State reconstruction - See exactly what state the system was in at each step
3. Failure localization - Pinpoint the exact event that violated an invariant
4. Reusable models - No need to write separate incident analysis code

Usage

# Fetch events from your observability system
{:ok, events} = ProductionLogs.fetch(trace_id: "abc123")

# Replay through model projections
result = PropertyDamage.Forensics.analyze(
  events: events,
  model: OrderModel,
  event_mapping: MyEventMapping  # Optional: translate production format
)

case result do
  {:ok, %{final_state: state}} ->
    IO.puts("No invariant violations detected")

  {:error, failure} ->
    IO.puts("Found violation at step #{failure.failure_step}")
    IO.puts(PropertyDamage.Forensics.format_report(failure))
end

Event Mapping

Production events often have different field names or structures. Implement an event mapping module to translate them:

defmodule MyEventMapping do
  @behaviour PropertyDamage.Forensics.EventMapping

  @impl true
  def map(%{"type" => "order.created", "payload" => p}) do
    {:ok, %OrderCreated{order_ref: p["order_id"], amount: p["total"]}}
  end

  def map(_), do: :skip
end

Limitations

• Events must be self-describing (contain enough context to reconstruct state)
• Assertions using every: :command won't trigger (forensics has no commands)
• Event ordering must match production ordering