140 Commits

Author	SHA1	Message	Date
julian	5287be5278	docs(wiki): catch-up sweep — five pages lagging the log ... rongta-printer still named the cashino driver id (→ escpos + migration 0023 note); tariff-time-tiers listed the composer price preview as deferred (→ delivered by the lab fee breakdown); tariff.md lab section gained the breakdown + composer increment-guard paragraph; i18n.md now records the "25 Qer 14:30" date standard + never-toLocaleString-for- dates rule; fleet-deployment-komodo gained the park-lab stack + tier table (the park-lab addition had also slipped the log — both fixed). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 13:08:55 +02:00
julian	6ceaadfbf2	feat(devices): camera clock sync via ISAPI — heal the 1970 power-cut reset ... park-buzi field observation: after a power cut the Hikvision cameras reboot at the 1970 epoch (no/dead RTC battery, no NTP) and stay there until a human logs into the web UI (which silently pushes the browser clock) — corrupting the snapshot OSD timestamps (the evidence trail) and ANPR push times meanwhile. The host is the site's time authority (offline-first, no NTP infra): - Device monitor triggers a sync at each camera's offline→ready edge — exactly the power-restored moment — plus a 24h backstop; the attempt is stamped before the async call so a failing camera retries at backstop cadence, never every poll. - HikvisionCamera.syncClock: GET /ISAPI/System/time; drift ≤60s → leave alone; beyond (or unparseable = infinite drift) → PUT timeMode=manual with the site wall-clock now WITH explicit utc offset (localIsoWithOffset), echoing the camera's timeZone verbatim — correct the clock, never fight its tz/DST config. - Jumps >1h (the power-cut signature) log warn (persisted to app_logs); small corrections info. Capability-guarded (isClockSyncable) — hikvision only; dahua's CGI has no such endpoint. - http-digest generalised to digestRequest (GET/PUT/POST + body); the handshake was already method-aware. digestGet delegates unchanged. 8 new tests: in-sync no-op, 1970 PUT shape (manual + host instant + echoed tz), unparseable→sync, failed-set surfaces, dahua non-capability, DST-both-sides pins on the offset formatter. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 12:56:51 +02:00
julian	cd3b534e51	feat(setup): USB printer discovery — pick a real /dev/usb device ... The kernel numbers usblp nodes by plug/boot order (park-buzi's printer is lp1); the wizard hardcoded lp0 in labels/default and the admin had to shell in and `ls /dev/usb`. Now: - GET /api/setup/usb-printers enumerates /dev/usb/lpN (visible via the compose bind-mount) and enriches each with the printer's self-reported make/model from sysfs ieee1284_id (readable through Docker's ro /sys). - The wizard's devicePath becomes a SELECT of printers actually present ("/dev/usb/lp1 — Xprinter XP-K200L"): a fresh form preselects the first real device; a saved-but-unplugged path stays selectable, flagged "saved — not present now"; zero found falls back to free text + a check-the-cable hint. - Transport option label no longer hardcodes lp0. Wiki: printer-usb-transport marked HARDWARE-VERIFIED (lab 2026-07-07: full slip + feed + cut over USB — parity with TCP). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 11:35:25 +02:00
julian	011fe5a4c4	fix(devices): USB truncation mode 2 — close() kills the in-flight usblp URB ... The chunked-write fix (81bc2e3) still truncated on hardware: the lab test slip stopped mid-sentence with no feed and no cut (text hidden until the feed button). Verified against drivers/usb/class/usblp.c: - write() returns at URB SUBMISSION, not completion; - only ONE write URB is in flight (the next write EAGAINs until it completes); - usblp_release() — our close() — KILLS in-flight URBs. The printer drains bulk data at PRINT speed (tiny internal buffer on these clones), so closing right after the last accepted write cancels the still-transferring tail — exactly where the feed + GS V cut bytes live. Kernel-accepted ≠ printer-received. Fix: the one-URB rule makes acceptance of write N a completion certificate for write N−1. writeAllUsb now writes the payload's FINAL BYTE alone — its acceptance proves everything before it is physically in the printer — then drains 300 ms for that single packet before the caller closes. New test pins the final-byte-alone chunking; wiki printer-usb-transport.md carries the kernel-level account. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 10:50:47 +02:00
julian	a02957034d	fix(web): setup allows adding a printer with no controller configured ... Second half of the printer/relay decoupling: the category section's add-button gate ("add a controller first — a printer points at one of its relays") blocked every non-access category while zero controllers existed — hit on the lab bench (USB printer test, no relays on hand). Printers don't bind (role + failoverRank route jobs), so the gate now exempts them like the form's requirement already does. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 09:54:59 +02:00
julian	ee61c24bb9	docs(wiki): Periphery v2.2.0 --user installer defaults root_directory=/etc/komodo ... Lab box (park-test) crash-looped: panic writing the agent key to /etc/komodo/keys/periphery.key (Permission denied). Gotcha #9 was framed as a hand-config hazard; v2.2.0's installer now writes the system-style default even with --user. §7a: verify root_directory after every install + sed fix + reset-failed/restart; user-unit vs sudo note; the onboarding key survives a pre-connect crash. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 09:34:00 +02:00
julian	3a186d29df	docs(wiki): runbook §5c uses gpasswd -d — deluser rejects hyphenated users ... Demoting the operator on park-buzi failed with "sanitize_string: invalid characters in 'park-operator'" — Ubuntu's perl adduser/deluser tooling rejects the hyphenated username. §5c now prescribes gpasswd -d for sudo/lxd/lpadmin (shadow-suite, no perl sanitize) and documents that group removal lands at NEXT login: the auto-login operator session keeps its old memberships until reboot/relog, so verify `groups` from inside the session afterwards. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-07 08:55:51 +02:00
julian	f9887c2a76	fix(server): seed-admin self-heals the admin role + signs a ledger event ... Field failure on park-buzi: reset-db --users wipes the roles table and points to seed-admin — which inserted the user with roleId "admin" without recreating the role row (migration 0007 never re-runs), dying on the role_id FOREIGN KEY. The script now upserts the built-in admin role first (the row alone suffices — admin permissions resolve in code). It also appends a SIGNED config_change (admin.passwordReset / admin.seeded, operator console:seed-admin) via the server's compiled EventLog + signer: a console seed/reset by the Linux admin can't be gated by the app, but it stays attributable in the chain. Best-effort — no build/signing key warns loudly and proceeds (locking an admin out to protect an audit line would invert the priority). Both paths verified against a scratch DB reproducing the post-reset state. Runbook: appliance-provisioning §7e — lost app-admin password reset via FORCE=1 (interactive preferred; sessions not revoked → rotate JWT_SECRET if theft suspected); §7d notes the FK failure + self-heal. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-06 15:41:40 +02:00
julian	ffe8c13a1c	fix(web): setup wizard no longer forces printers to bind to a barrier ... "Cilën barrierë shërben kjo pajisje?" is load-bearing for readers and cameras (which barrier a scan opens + inherited direction) but nothing consumes it on a printer — print routing is role + failoverRank (printer-routing.ts). The wizard applied the requirement to every non-controller device, so adding a printer demanded a meaningless relay pick that got stored as dead config. Printers are now exempt: no requirement, the binding panel is hidden, the binding is not persisted (a stale pre-fix one drops off on next edit), and the device list shows the printer's ROLE instead of a bogus amber "unbound". Server never validated it — no API change. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-06 12:36:14 +02:00
julian	14638c2e13	docs(wiki): industry survey of parking tariff systems + session log ... New reference page tariff-industry-survey.md (2026-07 web research): field taxonomy — per-started-increment hourly (per-minute tried and rolled back in practice), degressive ladders, day caps, up-to matrices, day tickets, evening/overnight packages, event rates, early bird (entry-time-conditioned), day/night + weekend/holiday/seasonal windows, category pricing, contracts, merchant validations (amount/percent/ time-credit/re-rate), SFpark-style dynamic pricing. Coverage map: our engine expresses everything a staffed single lot advertises; real gaps = early bird (the pick-table-by-entry-time future design, same mechanism as weekend menus) and validation overlays; anti-features = per-minute billing + dynamic pricing. Indexed + logged. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-05 16:37:53 +02:00
julian	c5ed3f1308	feat(drawer): drawer hub — balance now, this-shift figure, daily activity, shift history; busy spinners ... /drawer was record + review only: no current balance, no sight of the open shift's incomings, no daily activity, no shift history. Rebuilt as a hub: - Drawer now: the till's running balance (new GET /api/drawer/balance, shift:read — exposes the service's existing drawerBalance(); the drawer is one site-wide till, same exposure the X-report already had) with the open shift's X-report breakdown alongside (float + takings + vouchers = expected = balance) and a "This shift: ±X" figure (expected − opening float — the shift's own contribution vs what it inherited). - Today's cash activity: every cash payment + voucher since local midnight from the signed chain, live, with day totals (card never enters the till). - Record + movements/review: the 2026-07-01 flow, unchanged. - Closed shifts: drawer-focused history via the scope-aware /api/shifts (float → takings ± vouchers → expected per shift). Also: every shift open/close button (header, /shifts, pay modal, end- shift confirm) now shows an animated spinner + dims while busy — the old label-swap-only feedback read as a dead click when a shift open ran slow. The slowness itself (drawer/shift reads fold the WHOLE chain, O(chain)) is recorded as an open item in wiki/concepts/shift.md with the fix sketch: fold from the last z-report's signed expectedDrawerMinor forward. No new ledger surface — one read-only endpoint; RBAC test added. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-05 15:56:30 +02:00
julian	fd9885e9ec	feat(tariff-lab): DB-backed draft tariffs + named published versions ... Experimenting used to mean publishing — churning the immutable version history and risking real tickets pricing against a half-baked card while the admin iterated. The lab is now a true sandbox: - tariff_drafts table (migration 0021): MUTABLE by design — the one exception to "editing publishes a version"; a draft prices nothing and signs nothing. Drafts are validated + tz-stamped on save exactly like a publish, so a saved draft always simulates and never fails at publish. - CRUD under /api/tariff/drafts (list tariff:read, mutations tariff:update); publishing a draft goes through the normal immutable POST /api/tariff/versions path. - Lab UI rebuilt: sidebar lists lab drafts AND the full published history (click any to price against it); main pane cut to pure entry/exit (ticket loader, payment, category inputs dropped); the composer form is extracted to TariffEditorForm.tsx and reused in a modal (new drafts prefill from the active card); per-draft Publish with confirm. - tariff_versions.name (migration 0022): optional label stamped at publish — carried from the lab draft, or typed in the composer's new optional field — so history reads "Winter 2027", not UUID prefixes. - Includes the composer UI + sq/en labels for the package mode (engine landed in d9e6c13) and the "Flat price / hour" relabel. 5 new server integration tests (RBAC, roundtrip, validation, tz-stamp + simulate + publish w/ name); server suite 288 green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-05 14:31:42 +02:00
julian	c21babf293	feat(logging): ~2-month container rotation, ISO timestamps, level names ... Operator asked for bounded container logs (~2 months of history), human- readable timestamps, and clarity on levels. Levels already existed (LOG_LEVEL env → pino, default info; warn+ teed into app_logs, queryable at /setup/logs) — the "level":30 / epoch-ms "time" in docker logs were pino defaults. - server.ts logger: stamp ISO-8601 UTC time (timestamp fn) and level NAMES (formatters.level) so `docker logs` reads human. - log-service.ts pinoDbStream: accept BOTH level encodings (name + numeric) — the label switch would otherwise have silently stopped warn+ persistence into app_logs. New log-service-stream.test.ts pins both encodings, the info-stays-stdout-only rule, and the never-throws fallback. - docker-compose.prod.yml: json-file caps resized from 10m×3 (≈30 MB — days, not months) to ≈2 months by volume: server 20m×30, vision 20m×10, proxy 10m×5. json-file rotates by SIZE; time-based isn't a driver feature — comment says to revisit if `docker logs` holds under ~60 days. - app_logs retention default aligned 30→60 days (LOG_RETENTION_DAYS still overrides). Wiki: app-logs.md gains the container-log store section (rotation, format, LOG_LEVEL knob) + retention update; log.md entry. Suite 282 green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-04 19:47:53 +02:00
julian	43c1f45e29	feat(reader): channel tagging (clone defense) + structural filter for phantom scans ... Two reader-hardening changes born from the park-buzi phantom-scan investigation (empty pre-opening site, exit reader pushing sun-decoded garbage codes). 1. CHANNEL TAGGING — closes the printed-card-clone hole. The DT-008 push is channel-blind (one opaque cardid from either engine) and SubscriptionFlow matched by value only, so printing an RF card's UID (often written on the card face, e.g. 86A158) as a barcode cloned the card. Now: - Vendor tool sets output prefixes (QRCode "Q:", Card "K:"; server env overrides READER_QR_PREFIX / READER_CARD_PREFIX). - routes/qr-reader.ts strips the prefix and tags the read's confirmed channel (DeviceReadEvent.channel optical|rf; kind qr|card). Enrollment capture stores the BARE value. READ log lines carry ch=… (permanent phantom attribution). - SubscriptionFlow.match requires channel agreement: an optical decode may not claim an rf credential (and vice versa) — refused + signed sub.refused.channelMismatch anomaly (a clone attempt is a fraud signal). - Unprefixed reads keep the legacy untagged shape and match as before, so enforcement only bites where prefixes are deployed. Deploy server FIRST, then set prefixes in the vendor tool. 2. STRUCTURAL FILTER — phantom decodes out of the signed feed (operator- requested, reverses the earlier "record every probe" position — red "who is exiting?" rows for NOBODY train the operator to ignore the feed). read-dispatch.ts drops a no-match reader value that cannot possibly be a credential we issue (no ticket Luhn shape, no SUB-/SUBSESS- prefix, not confirmed-RF, not a plate) to UNSIGNED device_events telemetry (unrecognizedRead:true). Deliberately WIDE plausibility: forged ticket shapes, unknown physical cards, unknown SUB- codes all still sign the normal refusal anomaly; enrolled credentials match before the filter and can never be hidden. Works for legacy unprefixed reads too — the feed cleans up on deploy, before any vendor-tool change. Wiki: dingtian-dt008-reader.md records the clone hole + fix, the filter (as a recorded position reversal), and the two device-side settings now part of the credential contract (output prefixes + Card Input format, moving 6H→8H at the next vendor-tool session; both live ON the device — re-apply after any factory reset/swap). Tests: qr-reader-channel.test.ts (prefix split, route tagging, bare-value capture), subscription-channel.test.ts (channel agreement matrix + anomaly), read-dispatch-filter.test.ts (filter boundary: phantoms dropped, probes kept, enrolled never hidden). Suite 278 green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-04 19:34:48 +02:00
julian	35e593ab63	docs(wiki): DT-008 phantom-scan diagnosis + backfill bypass/relay-test concept pages ... Two independent wiki updates bundled (all docs): 1. dingtian-dt008-reader.md: phantom optical decodes on the park-buzi EXIT reader (empty pre-opening site, low-sun afternoons). Chain of evidence: READ log lines carry the reader's own serial (H05MA5B0) → physical device, not a network source; snapshot shows nobody present; code shapes are the giveaway (6-digit numerics = checksum-less Interleaved 2-of-5, lone "C" = Code39/Codabar artifact) → 1D engine decoding sun-made stripe patterns (striped arm, fence shadows, glare). No fraud exposure (11-digit Luhn ids can't match); noise only. Fix on the entity page: vendor-tool symbology cut to QR+Code128 + min decode length, BOTH readers; config lives ON the device → re-apply after any factory reset/swap. Deliberately NOT filtering impossible codes server-side — probe recording is the anomaly path's job. 2. Backfilled two shipped-but-undocumented features (six code files already linked the first page as if it existed): - concepts/entry-presence-bypass.md — admin drops a FAULTY presence signal (granular radar/camera by decision, not a master switch); every flip is a signed config_change; persists till off; tickets stamped presenceBypassed; radar-bypass cooldown tradeoff; "the admin is not the adversary, but trusted never means invisible". - concepts/setup-relay-test.md — admin-only commissioning pulse, signed barrier_open_command BEFORE the fire so a test open never reads as the out-of-band-open fraud signal; saved controllers/declared relays only; radarAlert lamps excluded; pulseOpen only. Cross-linked from operator-issued-entry.md, cataloged in index.md, logged. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-04 19:00:49 +02:00
julian	b4f1418858	fix(entry): enforce the camera press-gate + duplicate-ticket defenses ... Field report (park-buzi): a BLINKING entry button still printed — the lamp encoded blink-vs-solid (radar-only vs radar+camera) but #suppressReason only checked the radar, so a radar false-positive (rain, pedestrian) minted a real signed ticket. Three layered fixes: 1. CAMERA gate on the physical press: with an entry camera configured, a press is live only in the lamp's SOLID state (LaneStatus.entry busy, mirrored into EntryFlow via onLaneStatus). Suppress-only — the camera stays advisory (never opens, never traps). Camera-less sites keep the radar-only gate; a faulty camera is dropped via the existing bypassPresenceCamera admin toggle. 2. Cooldown as a REAL backstop behind presence: the presence branch returned early, so entryCooldownSec was dead wherever a loop was wired. Now it bounds the stationary-car double-ticket (a motion radar drops a motionless car → spurious loop-clear re-arms one-car-one-ticket → same car reprints). 3. Post-hoc duplicate-plate anomaly (entry-side twin of plateSwapSuspected): when entry ANPR recognizes a plate already OPEN under another session entered within ENTRY_DUP_PLATE_WINDOW_MIN (default 15 min), sign ONE entry.duplicatePlate anomaly naming both tickets for the operator to void. ANPR stays non-blocking (rides the post-open snapshot as before). REJECTED: camera-vetoed re-arm (defer re-arm until the lane flips free). The camera has no leave events — "free" is a ~30s silence timeout that never lapses inside a queue, so every queued car after the first would be suppressed until an operator intervened. Blocking legit entry at peak beats nothing; the proper preventive fix is a pass-through sensor (passedInput) — recorded as open in wiki/concepts/entry-double-press.md. Also: setup.relayTest reason was missing from both web catalogs (parity is only enforced sq<->en, so the build passed) — added. Tests: entry-press-gate.test.ts (blink suppresses / solid prints / camera-less unaffected / bypass honored / cooldown catches the dropout re-press / residual risk documented / still-present re-press stays suppressed) + entry-duplicate-plate.test.ts (flags open dup, ignores closed/stale/self/other plates). Suite 258 green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-04 18:41:06 +02:00
julian	c142166972	docs(wiki): ATECC608 is upcoming — retag ledger signing to the on-host reality ... No secure element is on-site: event signing runs on the software HMAC (EVENT_SIGNING_KEY, an env var on the host disk), so the ledger is tamper-EVIDENT but forgeable by anyone who owns the host. Several pages overstated it as present-tense "ATECC608-signed / unforgeable"; correct them. - NEW concepts/hardware-signer-options.md: four options for a non-extractable signing key (USB HSM / YubiKey / reuse the TPM / plain-dongle trap) + the recommendation (TPM interim → USB-HSM target; ATECC608 stays for the embedded ESP32, wrong part for a PC host). - entities/atecc608.md: UPCOMING-not-present status banner + PC-vs-embedded. - disk-os-hardening.md: fix the live-USB row (BIOS boot-order password is load-bearing, not Secure Boot — a signed live USB runs); add a physical-tamper chain (Dell 7070 CMOS-reset → live-USB → PCR-7 same-signer unseal) + accepted risks (that unseal, unsigned-initramfs evil-maid, operator-USB read TODO). - open-questions #6 reframed; standing-decisions / overview / threat-model / index de-overstated; log query entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-04 13:41:11 +02:00
julian	33c4ea1e91	feat(entry): operator-issued entry + exit plate-swap reconciliation ... Two halves of one anti-fraud design. (A) Operator-issued entry — when the physical entry button is broken, an operator can issue an entry ticket so a real car isn't blocked out of the lot. This hands the operator-adversary a mint, so it is: - PRESENCE-GATED like the physical button: a real car must be present (radar/ loop AND camera busy). Enforced BOTH sides — the server re-checks current presence so a direct POST can't bypass a disabled button; no presence loop => feature unavailable; a no-presence attempt signs an anomaly. - FLAGGED: vehicle_entry source=manual + operatorInitiated + operator, PLUS a companion entry.operatorIssued anomaly (the adversary path always leaves a red-flag row). - capacity-OVERRIDE allowed but stamped lotFull (a broken button mustn't trap a legit car). New session:create permission (migration 0019 -> operator role, admin- revocable), POST /api/entry/issue (open-shift gated), EntryFlow. issueForOperator; the fraud-critical print->sign->open->snapshot sequence is factored into one shared #issueTicket (button + operator). UI: the entry BarrierLight becomes a clickable issue-control when presence+permission+shift meet (confirm -> issue). (B) Exit plate-swap reconciliation — defends the ticket-swap fraud the mint enables (paid car let out on a fresh $0 ticket, original ticket lingers "inside", occupancy drifts up by phantom cars). The plate is the invariant: ExitFlow.#reconcilePlateAtExit compares the exiting plate against all OPEN sessions' entry plates, EXACT + HIGH-CONFIDENCE only (>=0.85; a fuzzy read never gates — ANPR is advisory). On a match under a DIFFERENT ticket: - BOOTH path: returns swap_suspected + signs exit.plateSwapSuspected; the pay/exit modal shows a red warning + "Override & release" (override signs an attributed exit.plateSwapOverride). Flag+override, never a silent hard block (exit fails-open; a plate is never the sole gate). - READER path (no operator): log-only anomaly + fail-open. Extended BoothExitResult + /api/exit (override); boothExit client returns a structured swap result. Verified: full monorepo build/lint/test green (229 server tests incl. 4 new: hold-on-swap, override-releases-with-attribution, low-confidence-no-warning, own-plate-no-warning). New wiki: operator-issued-entry.md + plate-reconciliation.md; cross-linked from entry-exit-points, capacity- occupancy, index. Preserves "a plate never OPENS a barrier alone — and now never TRAPS a car alone either." Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-01 12:17:52 +02:00
julian	114a32e6f2	feat(drawer): operator records cash movements, admin reviews after (own /drawer route) ... Rework drawer cash movements from synchronous admin-authorization-at-creation (operator typed an admin's password inline for every receipt/disbursement) to operator-records-freely -> admin-reviews-after. - New `drawer` resource: drawer:create (operator records; admin-revocable per role) + drawer:review (admin authorizes/denies). Migration 0018 grants the default operator role drawer:create; admin gets all in code. - New signed `cash_review` ledger event { refId, decision, reviewedBy, note? }. A DENIAL is a FLAG, not a reversal: it never appends reversing cash and never touches the drawer balance (the correction is settled outside the app). This is what keeps a late review from leaking into the next operator's inherited drawer — a denial that lands after the reviewed shift closed moves no cash. Regression test: op1 disburses -> closes -> op2 inherits -> admin denies -> op2 drawer unchanged. - Move the feature OFF the polluted /shifts route to a top-level /drawer (operator: record + own; admin: review queue + all). routes/drawer.ts lifted from routes/shift.ts (retired the authorizer-password gate; kept shift:cash for its other job = admin-sees-all-shifts). New DrawerManager.tsx. Display fixes bundled: - Render cash_review in the event-detail modal (decision / reviewed-by / note / movement ref) — previously showed nothing. - Relabel the shift drawer figures for clarity: Daily takings / Receipts / Disbursements (was Cash payments / Cash added / Cash removed). - Hide the Card figure everywhere when CARD_PAYMENTS_ENABLED is false (no POS on-site), matching the card-tender gate. shared/db/server/web all typecheck; 225 server tests pass (incl. the drawer review + cross-shift-leak regression); web build + i18n parity green. Verified end-to-end via Playwright. Recorded in wiki/concepts/shift.md. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-01 11:17:20 +02:00
julian	018328a877	feat(booth): disable card tender until a P2PE POS is on-site (cash-only) ... No card processor / POS terminal on any site yet. Offering "Card" would let an operator record a card payment that never cleared a terminal, corrupting the till reconciliation — a fraud/error surface on an operator-adversary system. Add apps/web/src/lib/features.ts → CARD_PAYMENTS_ENABLED=false, gating both tender pickers (BoothPayModal, SubscriptionManager). With card off there's nothing to choose, so the tender row is suppressed and payment defaults to cash. UI-only gate: the Tender type, payment events, shift accounting, and reports still understand `card`, so historical card events and a future re-enable stay coherent. Verified via Playwright: an unpaid-ticket modal shows Total + "Pay + open barrier" with no tender/cash/card row. Wiki: new concepts/card-payments.md records the current cash-only state, the PCI-scope-out-of-app constraint, the future-POS device requirements, and the re-enable path (flip the flag once a bank-certified P2PE terminal is provisioned). Linked from index, parking-session, open-questions #3. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-07-01 09:57:03 +02:00
julian	266e9b0027	docs(wiki): record session findings — snapshot fix, booth rework, db reset ... - entry-exit-points.md: the snapshot content-type bug + serve-side cleanType fix (Hikvision image/jpeg; charset="UTF-8" broke every legacy render). - booth-exit-flow.md: the Active-Sessions/modal rework — inline barrier button removed -> modal; closed-within-grace view; live grace countdown; actual paid amount; read-only snapshot review in the closed-session view. - local-dev-workflow.md: the gated `pnpm db:reset` training tool + flag table + the booth (docker exec, no pnpm) note. - appliance-provisioning.md: new §7d — reset on the booth via docker exec into the server container (script ships in the deploy bundle; DATABASE_URL= /data/parking.sqlite), ledger-truncation warning + the two safety gates. - index.md catalog line; log.md entries. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-30 17:58:43 +02:00
julian	1b86750b0d	docs(wiki): firmware/dbx-vs-TPM hardening + create disk-os-hardening page ... Real-world park-buzi episode: a UEFI dbx update (delivered via fwupd/LVFS, NOT apt) revoked a stale GRUB -> panic, and moved PCR 7 -> broke TPM-sealed LUKS auto-unlock -> passphrase prompt. Recovered by re-sealing PCR 7. - appliance-provisioning.md: extend the §4 re-seal runbook to name dbx; new §4a (fwupd-not-apt, GRUB-panic ordering, PCR-7 re-seal, operator lockdown: mask fwupd + remove firmware-updater snap + BIOS-password + passphrase escrow) incl. the --test-passphrase-silently-passes-via-TPM trap (--disable-external-tokens); gotchas #12/#13. - disk-os-hardening.md: NEW — resolves a long-dangling wikilink referenced from ~18 pages. The *why* of host hardening (5 controls + firmware lockdown); commands stay in appliance-provisioning; reconciliation remains the primary anti-fraud control. - index.md: expand the disk-os-hardening catalog line. - log.md: two note entries. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-30 15:21:32 +02:00
julian	9c6741a485	docs(wiki): record backup deploy gotchas (compose allowlist + host mount) ... Two lessons from the first park-buzi staging deploy, both in backup-recovery.md: - A new server env var (BACKUP_KEY) must be added to docker-compose.yml's server.environment: allowlist, not just the Komodo secret/Stack env — otherwise the container never receives it (inspect shows it absent, not empty). - The backup target must be a host path bind-mounted into the container; a desktop- automounted USB (/run/media/...) is invisible inside the container, so Test target reports 'does not exist'. Destinations are admin-provisioned (fstab + compose bind- mount), not operator-pluggable — partly a threat-model feature. Acknowledged as a flexibility limitation; USB-automount-to-container flow deferred. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 17:38:24 +02:00
julian	381046190b	feat(deploy): add stage tier — park-buzi as the staging booth ... Model the staging-vs-production split that fleet-deployment-komodo flagged as open. Three tiers: dev (working, no booth) -> stage (staging booth park-buzi, real-world test) -> main (production, manual + pinned). - build-images.yml: trigger on [dev, stage, main]. The tag computation is already branch-derived, so :stage / :stage-<sha> build with no other change. - komodo/resources.toml: park-buzi now branch=stage + TAG=stage-<sha> (pinned; no webhook even on staging). BACKUP_KEY already wired as a per-booth secret. - komodo/README.md: a Promotion (dev->stage->main) section; per-booth secret list now includes backup_key; hard-rule #1 generalised to pinned <branch>-<sha>. - wiki: fleet-deployment-komodo open-item resolved + a Promotion-tiers table; deploy-trigger choice generalised; container-deployment tag list gains :stage. Promotion is a merge: when dev is ready, merge dev->stage, CI builds the image, bump TAG=stage-<sha> in resources.toml, deploy from Core. stage is branched from dev HEAD so the first real-world test carries the full current app. Per-booth secrets must pre-exist in Core; migrations run at boot so a promotion auto-migrates the staging ledger (where a bad migration is caught before production). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 13:11:35 +02:00
julian	84f00db48b	feat(backup): admin-tunable retention + BACKUP_KEY as a Komodo secret ... Retention (keep-last / keep-daily-days) is operational policy the on-site admin should tune, not a server env var requiring a redeploy -- same reasoning that moved the target directory to the UI. - Migration 0017: site_config.backup_keep_last + backup_keep_daily_days (nullable; null = code default 7 / 30 per field). - BackupService reads retention fresh each run; status() exposes keepLast + keepDailyDays. DEFAULT_BACKUP_RETENTION is now a pure code default (env reads gone). - PUT /api/backup/config accepts keepLast / keepDailyDays (non-negative int, or null to reset to default; 400 on negative). - UI: two retention fields on the Backup config card; one Save covers target + retention. i18n sq + en. BACKUP_KEY wired into Komodo: - komodo/resources.toml: BACKUP_KEY=[[park_buzi_backup_key]] (per-booth secret, alongside JWT / signing keys). - komodo/.env.komodo.example: documents it as the ONLY backup env var -- escrow it offsite alongside EVENT_SIGNING_KEY (recovery needs both); target + retention are admin-chosen in the UI / DB, not env. Server .env.example trimmed to just BACKUP_KEY. Also carries the small in-progress setup-intro i18n copy trim. Tests: 218 server tests green, incl. retention persist / reset-to-default / reject- negative and the updated status shape. Migration applies cleanly (needed a statement-breakpoint between the two ALTERs). Wiki backup-recovery updated. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 12:52:18 +02:00
julian	d5e41500a8	feat(backup): admin UI with admin-chosen target directory ... The backup destination is now chosen by the on-site admin in the UI (Setup -> Backup), not a server env var. An env-pinned target defeats the purpose: the admin can't point backups at a freshly-plugged USB or a NAS mount without editing .env and restarting. The encryption key stays a server secret. Target storage: - New site_config.backup_target_dir (migration 0016, nullable; null = not configured). BackupService reads it fresh each run, so a UI change takes effect with no restart. Only BACKUP_KEY stays env -- a key must never live in the DB it backs up. Routes: - PUT /api/backup/config -- set/clear the target (backup:update; upserts id=1). - POST /api/backup/test -- probe a candidate path server-side (exists / is a directory / writable) so the admin gets feedback before relying on it. - status() now exposes targetDir + keyPresent, so the UI distinguishes 'no target set' from 'BACKUP_KEY missing'. UI (apps/web/src/BackupSettings.tsx): - A Setup -> Backup tab (gated backup:read): an editable target-path field with a Test-target probe (localized ok/missing/not-a-dir/not-writable), Save, the status panel (config state, last-run size/pruned/error, a distinct amber missing-key warning), a Back up now button, and the restore-is-out-of-band note. Full i18n (sq + en); nav.backup. - API client: fetchBackupStatus / setBackupTarget / testBackupTarget / runBackup. Also includes a small in-progress copy trim to the setup-intro i18n strings. Verified live with Playwright: typed a path -> Test reported writable -> Save persisted it -> status reflected it and showed the key-missing warning. Whole monorepo build/lint/test green. Wiki backup-recovery + open-question #5 updated. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 12:21:26 +02:00
julian	0c218179c4	feat(backup): encrypted on-site DB backup engine + local target ... The SQLite DB is the signed append-only ledger, so a disk failure / stolen or destroyed PC means total revenue-history loss (open-question #5). This is the first slice of the backup-recovery design: the engine + a local/mounted target + a daily timer + a manual route. Engine (apps/server/src/backup.ts): - Consistent online copy of the live WAL DB via better-sqlite3's native .backup() (not a raw file copy, which can capture a torn WAL) — the restored copy is a byte-identical, queryable DB. - AES-256-GCM with a scrypt-derived key from BACKUP_KEY; self-describing header (magic|version|salt|iv|...|authTag) so a restore tool needs only the key + file. Zero new dependencies (Node crypto). - The plaintext intermediate is kept in scratch (not the removable/network target) and wiped in a finally, success or fail. - Retention: keep-last-N + one-per-day within N days. Wiring: - BackupService (env config, single in-flight guard, last-success/last-error). - routes/backup.ts: GET /api/backup/status (backup:read), POST /api/backup/run (backup:create), 409 when unconfigured. No restore route — restore is an out-of-band runbook action on a fresh appliance, not a console call. - New permission resource in @parking/shared. - server.ts: an unref'd daily timer, a no-op until BACKUP_TARGET_DIR + BACKUP_KEY are set, deliberately not run at startup (a just-power-cut booth shouldn't write to a possibly-unmounted disk). - openRawDb() added to @parking/db/testing (open a file without migrating, for restore-verification tests). BACKUP_KEY is deliberately SEPARATE from EVENT_SIGNING_KEY (independent rotation; backups travel, the signing key shouldn't). SMB/NFS work as mount paths; SFTP + admin UI + restore runbook are deferred slices. Tests: round-trip byte-identical, GCM tamper/wrong-key fail, short-key rejected, scratch cleaned, route auth/RBAC + 409. build/lint/test green (212 server tests). Wiki + open-question #5 updated. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 11:59:45 +02:00
julian	9e442586af	docs(wiki): settle on-site encrypted backup + disaster-recovery design ... New concept page backup-recovery.md resolving the design half of open-question #5. Driving scenario: a stolen/destroyed PC whose LUKS+TPM disk is unrecoverable by design — recovery stands up a NEW PC, restores a backup, and keeps signing the SAME chain. Settled: admin-driven encrypted full-DB backup (SQLite online-backup/VACUUM INTO, snapshots included) to local/USB, SMB/NFS, or SFTP targets; manual button + an in-process daily timer; keep-last-N + dailies retention; restore is admin-only / out-of-band (operator-adversary surface). A restored copy must still verifyChain. Key custody (the load-bearing decision, bears on #6): three independent keys — EVENT_SIGNING_KEY kept an extractable, escrowed software key DECOUPLED from the TPM so the ledger survives total hardware loss (the conscious trade: a TPM-sealed signing key would be unforgeable but permanently unverifiable after the machine dies); a NEW dedicated park_buzi_backup_key in Komodo for backup encryption, separate from the signing key; the LUKS/TPM disk key, appliance-only and deliberately non-recoverable. Keys are never inside the backup they unlock. Updated open-questions #5 (design SETTLED) + #10 note; disk-os-hardening deploy runbook (why the signing key is not sealed + park_buzi_backup_key); index catalog + concept count. Design only — not yet built. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-29 11:43:23 +02:00
julian	f6e35bbebf	fix(reader): correct the QR reader's identity — Dingtian DT-008, not "GEE" ... An early wrong assumption named the QR/RFID access reader "GEE" / "GEE/Fondvision" / "GEE-QR-ER80" (and summarized a raw GEE PDF as its datasheet). There is no GEE device — it's the Dingtian DT-008 (dingtian-tech.com/en_us/qr_code_reader.html), the same vendor as the relay board, which is why it integrates the identical HTTP-GET-push way. Code: - Driver symbol geeQrReaderDriver → dingtianQrReaderDriver; label → "Dingtian DT-008 QR/RFID reader (HTTP push)"; comments/description rewritten to the real DT-008 facts (Wiegand 26/34, TCP/IP, USB, RS485 — not RS-232; QR/barcode + ID/IC/NFC — not DataMatrix/1D). - Persisted driverId "gee-qr-reader" → "dingtian-qr-reader" (the registry lookup key + the row created on assign in qr-reader.ts). - Migration 0015 rewrites existing devices.driver_id rows so configured readers keep resolving (applied to the dev DB — 2 rows; the booth applies it on boot). Behaviour is unchanged: naming + the persisted id only. Wiki + memory: - Renamed entities/gee-qr-er80.md → dingtian-dt008-reader.md and sources/gee-qr-er80.md → dingtian-dt008.md; rewrote both to the real DT-008 product-page specs while KEEPING all the verified-on-hardware protocol facts (cjihao serial, .jsp path, Connection: close). Fixed every cross-reference + "GEE" mention in 6 other pages. Memory gee-reader-serial-binding → dingtian-reader-serial-binding. The only surviving "GEE" mentions are deliberate naming-correction notes, the raw PDF filename, and the append-only log history. Full workspace build/lint/test green; dev DB readers verified resolving to the registered dingtian-qr-reader driver. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 17:39:15 +02:00
julian	96acd6b662	feat(snapshot): re-encode captures + disk-pressure retention ... Camera snapshots were stored RAW — the camera's full-res JPEG straight into the BLOB, no resize/recompress. Measured on the dev DB: 300 snapshots = 81.7 MB = ~72% of the 114 MB SQLite file (the big ones 2688×1520 / ~600 KB, Hikvision main stream). They dominated the appliance's single backed-up DB file. Re-encode on capture (snapshot.ts): - Downscale each frame to SNAPSHOT_MAX_EDGE (1280px long edge) + recompress at SNAPSHOT_JPEG_QUALITY (80) via sharp (libvips, Apache-2.0) before storage — ~6-10× smaller (verified 2688×1520 → 1280×724, ~8×), plate still readable, clean image/jpeg (drops the camera's charset cruft). STORAGE-ONLY: recognition keeps the ORIGINAL full-res bytes (downscaling hurts OCR). Fail-soft — a re-encode error stores the original, never drops the snapshot or blocks the (already-open) path. sharp lives in apps/server (owns the capture path), where bcrypt already establishes the native-dep pattern. Disk-pressure retention (snapshot-retention.ts) — a SAFETY VALVE, not the daily mechanism (the re-encode does that). Daily check reads the DB filesystem used% (statfs on db.$client.name); no-op unless ≥ SNAPSHOT_DISK_HIGH_PCT (70). Over the mark: delete the OLDEST until an estimated SNAPSHOT_DISK_FREE_TARGET_PCT (10%) of disk is freed — never below SNAPSHOT_MIN_KEEP (500) — then VACUUM once to return space to the OS. A DELETE only frees SQLite pages (disk doesn't drop until VACUUM), so the loop is driven by estimated freed bytes (SUM(length(bytes))), not a live disk re-read; the prune owns the DB-locking VACUUM, run daily off-peak. diskUsage is injectable for tests. None of this touches the signed ledger — snapshots are unsigned/advisory, referenced only by id. Tests: encodeForStorage (downscale / clean-type / no-enlarge / fail-soft) + pruneSnapshots (no-op below mark / delete-oldest-to-target + VACUUM / MIN_KEEP floor / skip-VACUUM-when-empty). All four snapshot env knobs documented in the komodo env reference. Full workspace build/lint/test green; the prune smoke-verified on a scratch DB copy (file shrank after VACUUM). Existing ~81.7 MB of raw snapshots are unchanged (a one-off re-encode backfill is a separate optional follow-up). Updated entry-exit-points + technology-stack wiki. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 17:15:15 +02:00
julian	cce99aadfd	fix(web): booth UI/UX pass — readable font scaling + booth layout/report clarity ... A round of operator-facing fixes on the booth screen, shift views, and the font-scale control. (Follows the font-scale feature in f706726, which used CSS `zoom` — reverted here for the rem approach below.) Font scaling (the A−/A+ control now actually works without breaking layout): - The control scaled via CSS `zoom`, which also scaled viewport-locked containers (h-screen frame, max-h-[90vh] modals) so at 130% modal headers/footers were pushed off-screen. Reworked to scale TEXT only: converted every `text-[Npx]` font utility to rem across the web app (~230 sites in 25 files + the .label/.hint/.btn component classes + body in index.css; 16px root, so 100% is visually identical), and applyFontScale now sets the ROOT font-size. vh/h-screen layout stays put, so chrome never clips; tall content scrolls its own container. Verified at 130%: text 12px→15.6px while the frame stayed viewport-height. Live feed (event rows): - Plate, badges and reason now flow inline after the identity and wrap only when the row runs out of width — no more forced second line when there's empty space. - Dropped the redundant TARGË via-badge (the plate chip already conveys it). - Removed the Direction filter group (Hyrje/Dalje) — it duplicated the entry/exit options already in the Type filter. Active sessions: - Rebuilt as a real table (Ticket/subscriber · Plate · Entry · Elapsed) so columns align and long values (subscriber names, ticket ids) no longer truncate. - Dropped the status column (an unpaid transient is normal; a subscriber shows ★ + name; overstay keeps a row tint). Removed the now-redundant status filter; only the Transient/Subscriber filter remains. Plate is now searchable (uses s.plate). Shift report (close-shift modal + Shift History + printed Z-report slip): - Removed the confusing `shitje` (subscription-sales) sub-line — Abonime is the total; only the out-of-window part is broken out. subscriptionSalesMinor stays in the signed payload (audit data), just not displayed/printed. - Show the inherited opening cash ("Arka fillestare") above the expected drawer, so opening + cash-taken = expected reads clearly. Money values no longer line-wrap. Subscription edit modal: - Fixed the 2-col grid alignment: a lone "only one version" cell was shifting every following row by one column — it now emits a full label+value pair. Removed orphaned i18n keys (fStatus*, fDir*, srcSubSales) from sq+en (parity kept). Full workspace build/lint/test green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 15:15:09 +02:00
julian	f706726eeb	feat(prefs): per-user UI font scale (A−/A+), saved to the profile ... A header A−/value/A+ control scales the whole UI, persisted per user and restored on login from any booth — cloning the theme-pref pattern end to end. - DB: users.font_scale (migration 0014; percent, 100 = base, NOT NULL default). - Server: PUT /api/auth/font-scale (auth-guarded; clamps to 80–160, snaps to a 10-step); fontScale flows through sessionView → login + /me. - Client: setFontScalePref + applyFontScale; applied in App alongside theme; FontScaleToggle in the header; i18n sq+en. Scaling uses CSS `zoom` on the root, NOT root font-size: the app's type is pinned in px (text-[12px] etc., ~230 spots), which a font-size change would not scale — so the dense Active-sessions / Live-feed logs stayed tiny. `zoom` scales everything uniformly (text, spacing, icons) like the browser's Ctrl+/−, which is the readability win for operators who need larger text. Tests: 4 font-scale auth-route cases (persist + /me, clamp/snap, 400, default-100). Full workspace build/lint/test green. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 12:25:04 +02:00
julian	38481f105f	feat(booth): blink the Entry/Exit lights on radar presence (mirror relay 3) ... The on-screen Hyrje/Dalje barrier lights were 2-state (green=free / red=busy) off the camera lane-status only — they couldn't show the radar-only "detected, not yet confirmed" state that makes the physical button lamp (relay 3) blink. Now they mirror the lamp's 3-state rule per lane: radar present + camera not busy → BLINK green↔red (~1 Hz) camera busy → SOLID red otherwise → SOLID green End-to-end: - LanePresence (lane-presence.ts): subscribes to deviceEvents.onInput, resolves each presence edge to its lane via the new direction-agnostic presenceLaneOf() (device-resolve.ts) — entry AND exit, unlike the entry-gated relayForPresence the one-car-one-ticket gate uses — and emits a lane-presence {entry,exit} bus event on change. Wired in server.ts (start + onClose). - WS forwards it (hello snapshot + push) into live-store.radar. - BarrierLight (BoothScreen.tsx) is now 3-state; blinks via the .lane-blink keyframe (index.css), which holds solid-red under prefers-reduced-motion. Same input + same rule as the lamp, so the screen and the post never disagree. A new test (lane-presence.test.ts) caught a real bug: the first cut reused relayForPresence, so the EXIT lane never resolved (it's entry-gated) and never blinked — presenceLaneOf fixes it. Covers entry/exit independence, de-dupe across several radars on one lane, and ignoring non-presence inputs. Full workspace build/lint/test green (185 server tests). Updated the button-light-indicator wiki page ("On-screen twin"). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 11:48:12 +02:00
julian	4418594af0	refactor(setup): unify controller I/O — event-driven relays[] + generic inputs[] ... The controller new/edit modal hardcoded both its outputs and its inputs, so an operator could neither add a generic event-driven relay nor a free-standing input (e.g. a second radar at the exit). This unifies both into symmetric, first-class lists. Behaviour for existing booths is unchanged (back-compat, no DB migration). Outputs — one event→action relays[] list: - A relay is "when EVENT X happens, do its action": entry/exit/both pulse a barrier; a new `radarAlert` event drives a non-barrier alert lamp (blink while its trigger input is active, SOLID once the camera confirms a car). - Dropped the separate config.buttonLight block — the lamp is just a relays[] row with direction:"radarAlert" (triggerInput + blink cadence). `alertRelaysOf()` replaces `buttonLightOf()`; ButtonLightController keeps its proven 3-state machine (serialized UDP, fail-OFF, hot-reload), now keyed per controllerId:relay so several alert lamps on one controller run independently. Every barrier resolver skips radarAlert rows (no auto-open; barrier-not-a-door intact). Inputs — one first-class config.inputs[] list (the twin of relays[]): - Each row is { input, role, relay?, kind?, activeLow?, cooldownSec? } with a "+ Add input" button. role ∈ button | presence | alertTrigger; button/presence name the relay they serve. An exit radar is just another presence row. - Keystone `inputsOf(row)`: returns config.inputs[] or SYNTHESIZES it from the legacy relays[].button/presenceInput/... fields, so relayForButton / relayForPresence resolve identically from either shape — zero-downtime, no migration. entry-flow.ts is unchanged (resolves through the same functions). - Fixed a latent bug this exposed: the alert lamp's camera lock was hardcoded to the ENTRY camera. Added relays[].lockLane ("entry"|"exit", default entry); the lamp now locks on its own lane's camera, so an exit radar's lamp tracks the exit camera. button-light tracks both #entryBusy/#exitBusy. - Driver: extracted activeLowFrom(config) — merges inputs[] activeLow, legacy relays[].presenceActiveLow, and the inputActiveLow escape hatch. UI: the relay dropdown gained a "Radar alert" option (reveals trigger/lock/blink inputs); InputEditor is rewritten to a generic list (role select folds loop/radar); i18n sq+en kept at type-parity. Tests: new device-resolve.test.ts (inputs[] resolution + legacy fallback identical + exit-radar resolves to the exit relay); button-light gains a two-independent- alert-relays case and an exit-lamp lockLane case; access-dingtian gains activeLowFrom cases. Full workspace build/lint/test green (i18n parity included). Wiki + memory updated (button-light-indicator, entry-double-press, dingtian-relay). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-28 11:23:15 +02:00
julian	f77ed11782	feat(anpr): poll snapshots until a confident plate, so auto-exit works ... The ANPR bridge took ONE snapshot at the camera's vehicle-alarm instant — but the alarm fires as the car APPROACHES, so that frame's plate is small/blurry/half-in- frame and ANPR returns a low-confidence misread ('111'@0.20). The manual test reads the SAME car at ~100% because by then it's STOPPED at the barrier, well-framed. So subscriber auto-exit silently never fired (read below the 0.85 floor → ignored). Fix (the car-stops-at-the-barrier insight): the bridge now PULLS A FRESH FRAME every ANPR_POLL_MS (1000) and re-runs ANPR until one clears VISION_ENTRY_MIN_CONFIDENCE, or ANPR_POLL_WINDOW_MS (8000) elapses (drove off / non-subscriber → give up cleanly). - One loop per camera (#polling set) — the camera's ~1Hz alarm re-fires JOIN the running loop instead of spawning N concurrent loops. - Fresh camera.captureSnapshot each tick, NOT captureSnapshotShared (its 1.5s TTL would re-serve the same bad approach frame). - Camera-level debounce stamp moved to AFTER a successful emit (suppresses re-fires for ANPR_DEBOUNCE_MS once we've acted), not before the loop. VERIFIED on hardware (DS-2CD1047G3H-LIU exit lane): 7 garbage approach frames → AA890XX@0.999 at the barrier → signed vehicle_exit. Still advisory + fail-soft; a barrier never opens on a low-confidence read. anpr-entry.test.ts +1 (poll escalation low→low→high); 169 server tests green. Documented in lane-presence-and-anpr-entry + the lpr-camera camera-fault writeup. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-27 22:54:49 +02:00
julian	7eadf71a0b	docs(wiki): appliance-provisioning — Komodo deploy is now the primary flow ... §6 split: §6 = Docker engine only; new §7 = the Komodo Periphery deploy (PRIMARY, verified end-to-end on park-buzi 2026-06-27): - 7a install Periphery (onboarding key, user-mode/outbound, runs as admin, no inbound port; core_address = Core's proxy URL) - 7b deploy the Stack in Core (registry+git accounts, per-booth [[..]] secrets, env incl. COOKIE_SECURE=0; seed admin via Komodo's container terminal — no SSH) - 7b-bis fleet-as-code via komodo/resources.toml + ResourceSync (empty diff = in sync) - 7c break-glass: manual booth.sh when mesh/Core is down Added Komodo deploy gotchas 7-11 (core_address is the proxy URL not :9120; git-auth ≠ registry-auth; user-mode vs /etc/komodo root_directory; core_address singular; empty-diff/disabled-Execute = success). §5b SSH TODO reframed (Komodo removes SSH from routine ops). Header + date updated; log entry added. Fixed a stale [[atecc608-secure-element]] alias in the prior log entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-27 12:30:08 +02:00
julian	9918f278b2	feat(deploy): Komodo fleet deployment — resources.toml + decision ... Adopt Komodo Periphery (over the NetBird mesh) as the booth fleet control plane, superseding SSH-and-booth.sh. The booth runs the SAME compose files; Komodo Core drives them remotely. booth.sh is demoted to a break-glass local fallback. - komodo/resources.toml mirrors the working park-buzi Stack (built by hand in the Core UI, then exported to TOML — field names match the running v2.2). Stack-only: servers are created by the agent onboarding OUTBOUND (one-time onboarding key → Periphery self-registers, auto-rotating keys, booth opens no inbound port), so there is no [[server]] block. Per-booth secrets via [[...]] refs to Core's store. - komodo/README.md + .env.komodo.example document the flow and the hard rules (no webhook; onboarding/outbound/mesh-only; per-booth unique secrets; never down -v the ledger volume). - wiki/decisions/fleet-deployment-komodo.md records the decision + threat-model analysis (Periphery is a root agent → mesh-bound; EVENT_SIGNING_KEY-in-Core is a fraud-root blast radius until ATECC608 signs; Core is now Tier-0; GPL-3.0 is fine as external ops tooling). container-deployment reframed (booth.sh = fallback); index + log updated. Verified end-to-end against a real booth (park-buzi): onboarded OK, Stack deployed, all containers green, admin seeded. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-27 12:14:04 +02:00
julian	898cf1953a	docs(wiki): camera 503/stream, alarm URL helper, reader ICMP liveness ... - lpr-camera.md: "503 Device Busy" can be PERSISTENT (main-stream saturation on the G3H) — the real fix is sub-stream selection, not just retry. - device-status-monitoring.md: QR reader health was false-healthy (hardcoded "ready") until the ICMP-ping fix; document the push-device monitoring model. - log entries for both 2026-06-26 sessions. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-26 16:47:19 +02:00
julian	40ffa90dac	fix(vision): self-heal local real ANPR — dev scripts sync the alpr extra ... The dev box runs vision as bare `uv run uvicorn`, and a plain uv run/uv sync re-resolves the venv to the lockfile DEFAULTS, stripping fast-alpr/onnxruntime. So after any `pnpm dev` real ANPR silently degraded to "snapshot, no plate" (diagnosed 2026-06-25: real reads through 06-22, venv frozen lean since 06-19, no other env with fast_alpr). The BOOTH was never affected — it runs the Docker image, which bakes `uv sync --frozen --extra alpr` at build (immutable, weights pre-warmed); a booth ModuleNotFoundError is a STALE image (fix: booth.sh update). Vision package.json dev/start/recognize now run `uv sync --extra alpr &&` first so pnpm dev is self-healing; added a dev:stub escape hatch for a lean run. Documented in wiki/decisions/vision-service-packaging.md ("Two runtimes, one fragile") + a log entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-26 08:11:17 +02:00
julian	b1c4109045	docs(wiki): document scripts/booth.sh in container-deployment ... Add a "Booth operator wrapper" section (commands, the update flow, env handling, the volume/ledger safety notes) + a log entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-24 20:38:44 +02:00
julian	6d7682ab4a	docs(wiki): printer USB transport + open-question for the provisioning ... New concepts/printer-usb-transport.md (the seam, usblp char device, reachability-only status, threat model). open-questions #14: confirm the on-site printer is USB and bake the usblp + udev write-access rule into the appliance image (provisioning, not app code; unverified on hardware). Updated rongta-printer.md (USB transport note), index.md, log.md. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-24 20:32:24 +02:00
julian	5a5fedf4f4	docs(wiki): booth bring-up fixes — relay password, secret re-merge, lamp concurrency ... - dingtian-relay: the "offline despite ping" gotcha (relay_pw in every binary frame, missing form field → Test connection sent 0 → timeout) + the identity-gated secret re-merge that stops a redirected probe exfiltrating the password. - button-light-indicator: serialized desired-state worker (UDP is unordered → the lamp stuck on/off) and hot-reload of the lamp config (no restart). - log entry for the three fixes (commits 420542c / fd15988 / 830993b). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-24 19:11:49 +02:00
julian	2915d141aa	feat(devices): radar presence input + button-light output on the controller ... Model the entry button (I1) and a Hikvision radar (I2) as named children of the access controller, and drive the button's 12V lamp on a spare relay. - Radar = the existing relays[].presenceInput one-car-one-ticket gate, now labelled presenceKind: loop|radar. A radar may idle opposite the button, so add a per-input active-level override: relays[].presenceActiveLow -> driver inputActiveLow set, inverting just that terminal (pure helper inputActive()). The Dingtian has one board-wide resting level otherwise. - AuxOutputDevice.setAux(channel,on) capability on the device interface (Dingtian latch) so business logic drives a NON-barrier lamp through the interface. Barriers still only pulseOpen — barrier-not-a-door preserved. - ButtonLightController: subscribes to the radar input edge + the camera lane status and drives a 3-state lamp — radar+car=solid, radar-only=blink (~1Hz), else off. Fails OFF on host loss/error; de-duped. A radar detection never opens a barrier on its own (advisory; threat model). - SetupWizard: presence kind + active-low + a button-light relay picker; sq+en i18n. Tests: button-light.test.ts (truth table + blink + fail-OFF + de-dupe), access-dingtian.test.ts (active-level inversion). Workspace build+lint+test green (158 server tests). Wiki: hikvision-radar, button-light-indicator + updates. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-24 11:45:22 +02:00
julian	8129b63a8c	feat(profile): self-service name/email/password + desktop installers in CI ... Self-service profile: any signed-in user edits their OWN fullName/email and changes their OWN password (proving the current one), without any user:* permission. New routes PUT /api/auth/profile + /api/auth/password act only on req.user.sub (cannot touch username/role), CSRF-guarded; SPA screen at /profile reachable from the header username chip. email added to the session view + SessionUser. 7 tests (routes/profile.test.ts); 148 server tests green. Desktop in CI: new .gitea/workflows/build-desktop.yml builds .deb + .AppImage on every push to dev/main and uploads them as unsigned workflow artifacts (per-commit test build). Signed/versioned release stays on release.yml (tag v*). Wiki: local-jwt-auth (self-service routes), desktop-shell-tauri (two-workflow CI split), log entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-24 10:15:34 +02:00
julian	f9bd586265	docs(wiki): session context — first booth go-live (user split, Docker deploy, web access) ... appliance-provisioning.md: new §5c (admin/operator OS user split — verified; strip lxd/lpadmin/docker from the operator) + fleshed-out §6 runtime (resolute codename caveat, the standalone deploy dir + .env, the deploy commands, seed-admin, healthy-startup signal, and the web-access gotchas). log.md: the [2026-06-23] go-live entry (CI uv fix, compose env passthrough, relative /api, Caddy proxy). Container-deployment "Web access" section already landed last commit. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-23 19:29:36 +02:00
julian	9d65099d9b	docs(wiki): appliance provisioning runbook — booth unit 1 hardened (LUKS+TPM+SecureBoot+GRUB) ... New wiki/decisions/appliance-provisioning.md: the hardware-verified step-by-step for provisioning a booth PC (Dell OptiPlex 7070, i5-8500, discrete Nuvoton TPM 2.0) from factory Windows to a hardened Ubuntu 26.04 LTS appliance. Every command was run on the first real unit (2026-06-23). Captures the firmware-specific gotchas: Ventoy → 0x1A under Secure Boot (flash ISO directly); the 7070 BIOS can't view db (verify via live USB); the installer's hardware-backed encryption fails with PCR_UNUSABLE/dbt (use passphrase LUKS + manual systemd-cryptenroll PCR-7 seal); GRUB password must be edit-only (--unrestricted) to keep unattended boot. OS hardening on unit 1 is COMPLETE + verified: LUKS FDE + TPM auto-unlock (PCR 7, unattended) + Secure Boot (Deployed) + GRUB edit-lock (closes the init=/bin/bash root-shell hole that PCR-7 sealing does not cover). Resolves the implementation half of open-questions #12 for unit 1. Cross-linked from disk-os-hardening; index + log updated. Still TODO on the box: Docker + run the stack. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-23 15:53:56 +02:00
julian	8155ff456b	feat(deploy): Docker images for server (API+SPA) and vision + branch-aware build pipeline ... Containerize the two non-desktop apps for the booth appliance. The desktop app stays on its own tag-only release.yml. - apps/server/Dockerfile: multi-stage node:22-alpine. `pnpm deploy --legacy --prod` (NOT prune — the monorepo native better-sqlite3 won't resolve under a root prune) yields a self-contained bundle; build stage adds node-gyp toolchain, runtime adds libstdc++; non-root, healthcheck. Migrates the mounted DB on boot via a drizzle-kit- free runtime migrator (packages/db/scripts/migrate-runtime.mjs) — drizzle-kit is a devDep, pruned from prod. - apps/server/src/static-spa.ts: Fastify serves the built React SPA (one container serves API + UI). GET-only fallback to index.html, excludes /api + /health so it never shadows the backend; a no-op in dev (no dist). Registered last in server.ts. - apps/vision/Dockerfile: uv base, --extra alpr, model weights PRE-WARMED into the image as the runtime user so fast_alpr boots offline (0 downloads at runtime). Engine env- selected (VISION_RECOGNIZER stub|fast_alpr). - Branch-aware: docker-compose.yml (base) + .dev.yml (build local, stub, ports) + .prod.yml (pull pinned, fast_alpr, vision internal, restart always); REGISTRY/TAG from env so a branch deploy pulls that branch's image. - .gitea/workflows/build-images.yml: on push to dev/main, run the full turbo build+lint+ test gate, then buildx push both images to git.infra.msai.al/mca/parking_solution with branch + branch-<sha> tags (registry cache; optional Komodo webhook behind KOMODO_ENABLED). - .dockerignore excludes **/parking.sqlite* so the signed ledger is NEVER baked. Verified locally (Docker 29): server image migrates + serves API+SPA (/health 200, / + /booth HTML, /api/nope JSON 404, no sqlite outside /data); vision image boots fast_alpr with 0 runtime downloads; compose stack healthy with server→vision over the private network. Wiki: new container-deployment.md; vision-service-packaging open Qs resolved; index + log. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-23 15:07:52 +02:00
julian	8a437d0c4b	feat(booth): cancel wrongly-printed ticket (signed void) + refused-vs-anomaly display; fix CI uv ... Cancel a misprinted/test/wrong-vehicle ticket via a SIGNED `void` event — the vehicle_entry is never edited/deleted (append-only). VoidFlow appends void{ voidedEntryRef, voidReason, operator, reasonCode:"void.ticketCancelled" }; route POST /api/tickets/void gated event:void + open shift; reason REQUIRED. Refuses a subscription / already-exited / already-voided / paid ticket (refund out of scope). The void folds the session CLOSED everywhere it's counted — occupancy (count + reserved spots), pay-station (lookup/activeSessions), exit-flow (#sessionFor), and reports (excluded from entries) — so a voided car stops occupying a spot, can't be paid/exited, and doesn't inflate "cars entered". No barrier action. Booth UI: a "Cancel ticket" action in the pay/exit lookup modal (transient + unpaid + open; gated on event:void) with a preset-or-free reason prompt. Reclassify the Live feed: refused-action events (exitRefused/entryRefused/ permitRefused — e.g. a double card-scan, at-capacity subscriber, exit on a closed session) are benign warnings, not red anomalies. event-detail.tsx now shows them as amber REFUZUAR/REFUSED, reserving red ANOMALI for genuine red-flags. Display-only — no ledger change, so historical events reclassify too. CI: install uv + sync vision deps before the Turbo run. @parking/vision's lint/ typecheck/test shell to `uv run …`, but CI set up only Node+pnpm, so `uv run ruff` failed ("uv not found") and broke the whole Turbo run. The Python checks pass once uv provisions the toolchain. - new: void-flow.ts (+ tests, 8) ; occupancy void-fold test - shared: reason code void.ticketCancelled ; both web catalogs (sq/en parity) - wiki: parking-session (ticket-void folds + guards, refused/anomaly split), log Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-22 20:13:21 +02:00
julian	65328b8c11	feat(anpr): subscriber-entry bridge + admin disable toggle ... Wire the lane camera's vehicle event into the gated subscription flow: on a vehicle/active push from an opt-in (config.anpr) camera, AnprBridge pulls a fresh snapshot, runs ANPR, applies a stricter entry confidence floor, debounces, and — matching the plate to a subscription BEFORE emitting — emits a kind:"plate" read. The existing ReadDispatcher -> SubscriptionFlow then signs the entry/exit and opens the barrier. A plate is never the sole authority: it routes through the same gate (active/window/blocklist/car-count) as any credential. Fail-soft, fire-and-forget, subscriber-only by construction. Field-verified end to end (plate AA504LX opened the entry barrier and appended a signed vehicle_entry). Add an admin master switch (site_config.anpr_entry_enabled, default ON) in Site Settings that disables ONLY the barrier-driving bridge; advisory snapshot-ANPR and lane busy/free are unaffected. Read live per event, so toggling takes effect with no restart. Migration 0013 (additive ALTER ADD COLUMN, default 1). - New: apps/server/src/anpr-entry.ts (AnprBridge) + tests (9) - hikvision-alarm.ts hands vehicle detections to the bridge (fire-and-forget) + wiring tests (3) - server.ts reorders the read flows above the hik-alarm registration - snapshot.ts exports buildCamera for reuse - env: VISION_ENTRY_MIN_CONFIDENCE (0.85), ANPR_DEBOUNCE_MS (12000) - site route + SiteSettings checkbox + i18n (sq/en parity) - wiki: lane-presence-and-anpr-entry / lpr-camera / index / log -> BUILT Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-22 19:49:18 +02:00
julian	411572511d	docs(camera): lane presence + ANPR subscriber-entry bridge design ... Captures this session's back-and-forth as a new concept page [[lane-presence-and-anpr-entry]] and cross-links it: - BUILT: advisory lane busy/free booth lights (LaneStatus + WS), with the measured camera limits behind the 30s timeout (no leave signal; movement- driven re-fire; notificationRecurrence locked to "beginning" — ISAPI flip silently reverts). - PLANNED: the ANPR "bridge" — explicitly a small apps/server HANDLER (~40 lines), NOT a new service/container. On a camera vehicle event: snapshot -> ANPR -> high-confidence match -> debounce -> emitRead{kind:"plate"}, then the existing subscription match/dispatch/gate admits the subscriber. Both directions, opt-in (config.anpr), plate never the sole authority. - Records the decisions (high confidence floor, debounce-for-correctness) and the REJECTED ideas (continuous livestream / per-car queue tracking / make-model) with why, plus the open hardware question (booth-PC test). Updates subscription.md (plate matching is built; the live source is this bridge) and lpr-camera.md (the two consumers of the vehicle event). Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V	2026-06-22 19:12:49 +02:00