parking_solution/wiki/index.md

type, tags, updated

type	tags	updated
overview	parking index	2026-07-02

Index

Content catalog for the wiki. Start at overview. Maintained on every ingest. Counts: 4 sources · 19 entities · 47 concepts · 8 decision records.

Overview & navigation

• overview — the top-level synthesis and entry point.
• index — this catalog.
• log.md — chronological record of ingests/queries/lints.

Sources

• parking-system-architecture — design notes: stack, threat model, devices, UHPPOTE, ESP32, readers, BOM, open decisions.
• dingtian-dt008 — Dingtian DT-008 product page: QR/RFID access reader (QR/barcode + ID/IC/NFC; Wiegand/TCP-IP/USB/RS485; HTTP-GET push).
• qrcode-sdk — QRCode SDK v1.6.5: the reader's HTTP-GET-poll protocol + JSON verdict (beep/output).
• parksql2017-legacy-schema — predecessor SQL Server schema (Albanian market): legacy tariff/discount/membership/shift/fiscal model; confirms blocks, adds time-windows + categories, lacks postpaid sponsors.
• ds-2cd1047g3h-liu — HIKVISION DS-2CD1047G3H-LIU-F datasheet: 4MP, main stream has no MJPEG option (sub does) — likely explains the model's persistent ISAPI snapshot 503 on main; confirms ISAPI/RTSP both fully in-spec.

Entities — technology stack

• technology-stack — the full stack table; all MIT/Apache/BSD, chosen to avoid lock-in.
• fastify — Node backend; hosts device-driver plugins + auth; serves the SPA.
• sqlite — local single-writer DB (WAL); limits & why it fits.
• drizzle-orm — ORM; schemas port to PostgreSQL for remote sync.
• turborepo — monorepo tool.
• react-vite-spa — React/Vite frontend served by Fastify.
• local-jwt-auth — fully local auth (JWT + bcrypt + role guard); forced by offline-first.

Entities — rejected alternatives

• payload-cms — strong, but rejected over BSL license shift (the rug-pull cautionary case).
• refine — dropped for plain React; UI too simple to justify a framework.
• logto-zitadel-oidc — OIDC providers ruled out by offline-first.

Entities — hardware & devices

• uhppote-controller — ❌ rejected/historical; firmware auto-open blocker drove the switch to Dingtian.
• esp32-custom-controller — prevention-grade upgrade; device-level auth.
• atecc608 — secure element; non-extractable signing key (host events + controller auth).
• wiegand — reader standard feeding the controller directly (autonomous permit-holder path).
• lpr-camera — edge-AI plate recognition; host-side casual-identity source; DS-2CD1047G3H-LIU main-stream ISAPI snapshot 503 is a firmware bug (only channel 102 ever works, ALL other IDs incl. garbage 503 identically) — firmware update tested, no fix; owner decided to replace the camera line rather than build an RTSP workaround.
• dingtian-dt008-reader — Dingtian DT-008 QR/RFID reader on hand; host-side serial → read bus (the QR-ticket scanner).
• zkteco-controller — ❌ rejected/historical; aux-input path was a contender, not pursued.
• dingtian-relay — ✅ CHOSEN access controller; decoupled inputs solve the button blocker (driver verified on hardware); spare relays drive aux outputs (setAux).
• hikvision-radar — vehicle-presence radar on a Dingtian input; the entry presence gate (per-input active-level caveat).
• rongta-printer — ✅ CHOSEN 80mm thermal printer; ESC/POS over raw TCP 9100 (or local USB, see printer-usb-transport); driver written, one unit reachable at 10.0.10.6.
• bom — reference bill of materials (barrier, loops, controller, readers, payment, host, network).

Concepts — foundational forces

• offline-first — no network dependency in core operation; what it forces (and doesn't).
• threat-model — the operator-at-the-booth reframing; why encryption defends the wrong threat.
• tpm — TPM 2.0 hardening: how it works, sealed-LUKS auto-unlock + non-extractable signing key; limits (live-root, bus-sniff) + TPM-vs-ATECC608 by platform; complements, not replaces, reconciliation.

Concepts — integrity & anti-fraud

• append-only-event-chain — append-only + hash chain + signing = unforgeable log (signing is software today; hardware signer pending — see below).
• hardware-signer-options — where the ledger signing key should live (TPM interim → USB-HSM target; ATECC608 upcoming, not on-site) so a host-owner can't forge the chain.
• reconciliation — the real anti-fraud control; what remote sync actually is.
• vision-review-outbox — the wash operator's category choice is a hypothesis: the booth queues a plate-blurred vehicle crop + the choice for a trusted remote reviewer over Netbird (one-way, offline-first, no site identity leaves); the verdict = training label + per-operator error/fraud rate.
• disk-os-hardening — the why of host hardening: LUKS FDE + TPM-sealed auto-unlock (PCR 7) + Secure Boot + GRUB edit-lock + unprivileged operator + firmware/dbx lockdown; secondary control (reconciliation is the main event). Commands → appliance-provisioning.
• backup-recovery — admin-driven encrypted full-DB backup (local/SMB/SFTP) + DR; signing key escrowed & decoupled from TPM so the ledger survives total hardware loss; restore is admin-only; last-success/error status + schedule are now restart-durable (migration 0025, fixed a "shows Never despite valid backups" bug).

Concepts — device architecture & safety

• device-adapter-pattern — business logic talks to interfaces; swap hardware → new adapter.
• device-registry — catalog of selectable drivers per category (admin-configurable).
• first-run-setup — admin adds controllers + binds readers/cameras to relays from the catalog at install.
• device-input-flow — button → device push → backend decides → relay; backend is source of truth.
• device-discovery — optional driver capability to scan the LAN (no current driver uses it; UHPPOTE was the example).
• barrier-not-a-door — never timed-close a barrier; safety lives in barrier firmware.
• printer-roles-failover — ≥2 printers by role; entry ticket falls back outside→booth.
• printer-status-monitoring — live poll of paper/cover/cutter/offline via the device's status page; SSE to the booth UI.
• printer-usb-transport — ESC/POS drivers drive TCP (9100) OR local USB (/dev/usb/lp0) behind one render layer; USB = usblp char device, reachability-only status; provisioning open (oq#14); park-buzi cover-open-wedges-USB-status bug (docker restart-only fix) under investigation.
• device-status-monitoring — unified live status across ALL device categories (healthCheck + printer readStatus) → the booth footer over /api/ws.
• trust-boundary — the core fork: network vs. device; auditable vs. unforgeable.
• fail-state-safety — entry fails closed, exit fails open; manual override; watchdog.

Concepts — access control

• uhppote-udp-protocol — open UDP weakness + the unauthenticated commands that undermine the log.
• network-isolation — mandatory VLAN isolation; the network as security boundary.
• event-log-ingestion — host-side index tracking that makes the UHPPOTE log trustworthy.
• challenge-response-auth — asymmetric nonce scheme for the ESP32 (auth + anti-replay).
• entry-exit-readers — two populations, two integration paths; both can share a relay.
• entry-exit-points — pool-of-spaces model (no lane); per-relay direction, reader→relay binding, camera snapshots.
• entry-double-press — one car = one ticket: per-relay presence gate (loop OR radar) preferred, cooldown fallback (a real backstop since 2026-07-04); camera press-gate + post-hoc duplicate-plate anomaly (2026-07-04).
• entry-presence-bypass — admin drops a FAULTY presence signal (radar/camera, granular) until support fixes it; every flip is a signed config_change; tickets minted under bypass are stamped (2026-07-02).
• setup-relay-test — admin-only per-relay Test button in Setup; signs a barrier_open_command BEFORE the pulse so a test open never reads as fraud (2026-07-01).
• button-light-indicator — entry button lamp on a spare relay: radar × camera 3-state (blink/solid/off); aux-output; fails OFF. The press gate enforces its SOLID state since 2026-07-04.
• uhppote-vs-esp32 — comparison: detection vs. prevention.

Concepts — business domain

• parking-session — the core domain entity; a projection over the signed log, never a mutable table.
• tariff — fee model; pure, data-driven, offline; pay-on-foot adds a walk-back grace window.
• tariff-time-tiers — BUILT (V2 tariff): happy-hour/off-peak/weekend/seasonal + vehicle category + flat rate via wall-clock windowed cards; tz frozen per version.
• tariff-industry-survey — 2026-07 web survey of industry tariff structures: coverage map vs our engine; gaps = early bird (pick-table-by-entry-time) + merchant validations; per-minute & dynamic pricing ruled out.
• booth-exit-flow — manned booth: pay → voucher (self-exit later) or immediate exit; active sessions; audited barrier re-open.
• operator-issued-entry — operator mints an entry ticket when the physical button is broken; presence-gated (radar AND camera, both sides), flagged (source=manual + operatorInitiated + anomaly), capacity-override allowed; needs session:create (2026-07-01).
• plate-reconciliation — ANPR plate-as-invariant catches the ticket-swap fraud (paid car let out on a fresh $0 ticket, original lingers "inside"); exact/high-conf match vs open sessions; booth = flag + operator override, reader = log-only fail-open (2026-07-01).
• shift — manned-only accountability period; explicit Start/End; End → signed + printed Z-report; drawer float carries across shifts. Drawer cash movements (operator records, admin reviews via signed cash_review — a flag, not a reversal) live at the /drawer route (2026-07-01).
• card-payments — card tender DISABLED (no P2PE POS on-site yet, 2026-07-01); cash-only UI gate (CARD_PAYMENTS_ENABLED); future POS keeps PCI scope out of the app; how to re-enable.
• capacity-occupancy — live count = open sessions; refuse entry + FULL sign when full (soft policy); exit never blocked.
• site-metadata — optional park identity (name, operator, VAT, address, contact) in site_config; feeds the ticket header.
• valet-overcapacity — "full" is soft: operator may valet-accept over capacity (keys handed over, custody). Manned, deferred.
• validation-discounts — BUILT (2026-07-13): in-park merchant (bar/lavazh) users scan-and-validate on their device (signed event, program↔user binding); booth settles NET + prints gross/discount/net; comp/time-credit/fixed/percent, caps, /setup/site panel, /validate screen.
• validation-sponsorship — design: sponsor accounts + postpaid B2B (customers park free, business billed monthly); not a permit.
• reporting-analytics — revenue/occupancy/stay reports + plate-search, all projections over the signed log.
• clock-integrity — fees depend on the host clock; detect/flag backdating on an offline box.
• ticket-encoding — transient ticket id (11-digit numeric + Luhn) as Code128; printed at entry, scanned at pay station + exit; barcode geometry must fit paper width (KP-300H overflow); plate-as-ticket alt.
• anti-passback — block/flag one id entering twice without an exit; fold over open sessions.
• device-events — unsigned hardware telemetry (relay/printer/camera/reader/input); separate from the signed ledger.
• app-logs — the third stream: diagnostic logs (backend warn+ pino sink + frontend errors) → app_logs; log:read viewer; pruned by age+row cap.
• soft-delete — BUILT: accidental admin deletes of master data (users/roles/subs/plans/tariffs) are soft (deleted_at) + recoverable from a recycle bin; auto-purge after N days; signed ledger out of scope.
• subscription — recurring plan (e.g. 10,000 ALL/month); RF/QR or plate identity, car-count + max-concurrent, host-in-loop; short-circuits payment. (Renamed from "permit"; time-of-day windows noted, deferred.)
• opencv-anpr-service — host-side vision microservice: ANPR (plate identity) + vehicle verification (anti-plate-spoofing witness); fast-alpr (MIT, YOLOv9+CCT/ONNX) the evaluated recognizer baseline.
• lane-presence-and-anpr-entry — camera vehicle detection → (BUILT) advisory lane busy/free booth lights + (BUILT) the ANPR "bridge" (anpr-entry.ts): a subscriber's plate read at the lane admits them via the existing gated subscription flow (match-before-emit; subscriber-only). Measured camera limits; rejected the queue-tracking/livestream ideas.
• vision-service-hardening — fix/hardening backlog for apps/vision/ (2026-07-02 reviews): DoS (body-cap, pixel-bomb, event-loop-blocking inference), unauthenticated + operator-writable model weights, 0.0.0.0 default bind, + correctness/hygiene items. Not yet fixed — the to-do list.
• blocklist — barred plates/cards refused at entry (never at exit); signed, attributed.

Concepts — frontend / operator UI

• booth-console — operator-UI architecture: TanStack Query/Router + Zustand + Tailwind terminal theme; one /api/ws live feed (anti-CSWSH); shift control + device-status footer.
• i18n — Albanian default + English; per-user server-stored language preference (users.language), loaded on login; tickets stay Albanian.

Dev environment (reference)

• local-dev-workflow — running the stack locally; setup, the dev-hang gotchas, seed:admin, the gated db:reset training/demo tool.
• wsl-dev-networking — WSL2 NAT blocks device broadcast; use mirrored mode + the gotchas after.

Decisions

• standing-decisions — settled decisions (stack, platform, integrity, access control, readers).
• open-questions — 9 open items (procurement + JWT key + FX + pay-station money corners); ESP32 device auth deferred.
• access-controller-button-flow — ✅ RESOLVED: Dingtian decoupled inputs enable ticket-first entry (was a UHPPOTE/ZKTeco blocker).
• autonomous-direction — roadmap: toward fully unmanned (no booth); reshapes threat model + fail-state.
• cloud-service-saas — 📌 POSTPONED: multi-tenant SaaS for fleet monitoring/control; productises the NetBird/Komodo control plane. Four tensions (offline-first vs real-time, verifiable-ledger-in-cloud, secrets custody, two-level tenancy); signing key stays on the booth; NetBird already solves isolation; remote barrier-open is pulseOpen+signed (the unmanned driver).
• dingtian-vs-mqtt — transport choice: direct HTTP/UDP now, MQTT parked until multi-lane scale.
• session-model — business layer start: session = projection; transient-first; pay-on-foot. New event types.
• vision-service — build a host-side ANPR + vehicle-verification service; replaces edge-LPR; scoped AGPL exception.
• bodytype-classifier-training — phase B (SUV vs sedan): apps/trainer trains on the collector host (time split, floor, features/finetune modes, feature cache) → report → publish to the Gitea generic package → models/bodytype.version pin bakes it into the vision image → TAG bump; sidecar = the preprocessing contract; CPU-only torch on the Xeon E3-1225 v5, Quadro FX 3800 unusable, cloud GPU rejected. Built 2026-09-07; first run waits for labels.
• vision-service-packaging — the vision service lives in this monorepo (apps/vision/), separate process, wired into Turbo via a package.json shim; uv-managed Python.
• event-streams-split — split the signed business ledger (ledger_events) from unsigned device telemetry (device_events).
• desktop-shell-tauri — ✅ Tauri v2 chosen over Electron for the desktop kiosk shell; thin wrapper, server keeps all logic. Best case Ubuntu 26.04 LTS (resolves WebKitGTK); worst case Windows+WSL → kiosk browser, no native shell. Auto-updater mirrors signed releases to public mca/public_releases (source repo is private — field appliances have no Gitea creds).
• venue-modules — 🟡 OPEN: optional per-site modules (Car Wash, Bar/Restaurant) with Parking as a peer module on a venue POS/audit core; manifest registry, entitled ∩ activated enablement (vendor env + site-admin config), validation kept for the Bar (Lavazh station retires with Car Wash), name stays parking-system, vision vehicle-category as an advisory anomaly flag.
• container-deployment — Docker images for the non-desktop apps: parking-server (Fastify API + bundled SPA via @fastify/static) + parking-vision (Python/uv ANPR); branch+SHA tags, per-env compose, Gitea registry, build-images.yml CI; pnpm deploy (not prune) for native better-sqlite3; migrate-at-boot.
• fleet-deployment-komodo — fleet control plane: Komodo Periphery on each booth, driven by Komodo Core over a NetBird mesh, running the same compose files. Deploys manual + pinned to dev- (no webhook); secrets Komodo-managed per-booth+unique; booth.sh demoted to break-glass. Threat-model caveats: Periphery is a root agent (mesh-bound only), EVENT_SIGNING_KEY-in-Core is a fraud-root blast radius until ATECC608 signs. komodo/ is infra-as-code.
• appliance-provisioning — booth-PC provisioning runbook (Dell 7070, i5-8500, discrete Nuvoton TPM): BIOS/Secure-Boot → direct-flash Ubuntu 26.04 USB (not Ventoy) → passphrase-LUKS install → manual PCR-7 TPM seal (workaround for the installer's dbt PCR_UNUSABLE error) → Docker. Verified on hardware 2026-06-23; TPM auto-unlock works.