julian
8a8e74561d
Pivot from the hardware/integrity layer to the parking operation. All wiki-only; no code yet. Core principle throughout: business entities are projections over the signed append-only event log, never mutable tables. New concepts: parking-session, tariff (composable/versioned, FX-ready), shift (manned-only Z-report), capacity-occupancy, validation-discounts, reporting-analytics, clock-integrity, ticket-encoding, anti-passback. New entities: permit, opencv-anpr-service, blocklist. Decisions: session-model, vision-service (host-side ANPR + vehicle verification; scoped AGPL exception for the isolated service). Updates: append-only-event-chain (new event types + vision witness), local-jwt-auth (drop 8h expiry -> until logout; code change pending), lpr-camera (host-side recognition supersedes edge-AI), standing-decisions (AGPL exception), open-questions (+FX, +pay-station money corners, backup). Deferred + flagged: intercom/help-call, receipts/refunds/change, FX engine, lane topology (#1).
58 lines
2.3 KiB
Markdown
58 lines
2.3 KiB
Markdown
---
|
|
type: concept
|
|
tags: [parking, domain, business, anti-fraud, access-control]
|
|
sources: []
|
|
updated: 2026-06-15
|
|
status: open
|
|
---
|
|
|
|
# Anti-Passback
|
|
|
|
Stop one credential/ticket from getting **two cars in** without an exit between — the classic
|
|
"pass the card/ticket back over the fence" abuse. A control on the entry validation, leaning on the
|
|
session projection.
|
|
|
|
## The rule
|
|
|
|
An identity (ticket id, [[permit]] credential, or plate) **must not enter while it already has an
|
|
OPEN [[parking-session|session]].** At entry:
|
|
|
|
```
|
|
identify vehicle → is there already an OPEN session for this id?
|
|
no → proceed (mint vehicle_entry, open)
|
|
yes → passback violation → refuse or flag (see policy)
|
|
```
|
|
|
|
This is a **fold over the signed [[append-only-event-chain]]** ("does an entry for this id exist
|
|
with no matching exit?") — not a mutable in/out flag that could be edited. Same projection that
|
|
powers [[capacity-occupancy]] and [[permit]] `maxConcurrent`.
|
|
|
|
## Interaction with the limits already designed
|
|
|
|
- **Transient ticket** — a single ticket id is inherently one session; a second entry on the same
|
|
id is always a violation (or a re-print/duplication attempt).
|
|
- **Permit** — passback is the *per-car* case of the permit's `maxConcurrent` ([[permit]]): a
|
|
multi-car permit legitimately has several open sessions, but **the same car/credential** entering
|
|
twice is still a violation. So enforce per-identity, *under* the permit's concurrency allowance.
|
|
|
|
## Policy (operator choice)
|
|
|
|
- **Hard** — refuse the second entry (strict; risks stranding a legitimate car after a *missed
|
|
exit*, which is common — tailgated out, sensor missed).
|
|
- **Soft** — allow but **flag an `anomaly`** (the type exists) for review. Safer against
|
|
false-positives from missed exits, consistent with the append-only "record + flag, don't block"
|
|
ethos elsewhere.
|
|
- Likely **soft by default**, hard as an opt-in for high-control sites.
|
|
|
|
## Honest limits
|
|
|
|
- Depends on **reliable exit detection** — if exits are routinely missed (no exit loop/plate read),
|
|
passback produces false positives; tune to the site's exit fidelity.
|
|
- A spoofed/duplicated ticket QR is caught here (same id already open) — complements
|
|
[[ticket-encoding]]'s opaque-id requirement.
|
|
|
|
## Open
|
|
|
|
- Default policy (soft/hard) and per-site override.
|
|
- Grace for legitimate quick re-entry vs. the missed-exit false-positive.
|