Behavision Architecture

Three tiers, one direction of trust: the shop initiates every connection it has.

One server binary carries ingest, the API and the head-office web app.

One API for the console, the mobile app and the shop app alike.

Offline is a delay, not a loss: visits queue on disk until the broker confirms them.

Python where the recognition ecosystem is — ONNX, OpenCV, FAISS are first-class.

Go for lifecycle and delivery — static binaries, cross-compiled to Windows from anywhere.

Wails for the UI — window, tray and supervisor in one process; a service cannot draw a tray icon.

Exact search: 100,000 identities in 21.9 ms. Identity is decided once per track, so this is queries per minute, not per frame.

Never per frame. Single-frame decisions turned one walk-past into three or four "people"; averaging fixed it.

Model-tagged embeddings. Only same-model vectors share an index; swapping encoders can never mix spaces.

Quality is per camera, match is shared. Every camera writes into one gallery.

Measured: 103 tracks → 7 people, 44 correct re-recognitions, in five minutes on the office camera.

QoS 1, clean session. QoS 0 could delete an event the wire dropped; QoS 2 buys nothing the derived id doesn't already give.

Ordered. A failed publish stops the batch — a customer's visits are a timeline.

Bounded and honest. The spool has a cap and reports what it dropped; a corrupt entry is quarantined, never retried forever.

Measured: 120 simultaneous visits published, 120 delivered; end to end in ~3 s.

Video, frames and raw images never cross. A template and a timestamp do.

Tenancy is a column and a rule, and the two agree: the tenant comes from the session, never from the request.

References are immutable — slugs, camera ids, customer numbers — because other systems store them. Display names are free to change.

Feed by seq, never by the camera's clock: lossless under bursts and backlogs; cursors are opaque.

Login is boring on purpose. Unknown address and wrong password are byte-identical and cost the same time.

Another tenant's data is 404, never 403 — nothing to enumerate.

Live video at head office: the agent pushes ~13 fps only while someone watches. 259 KB/s measured.

The assistant answers from the same report tools, as the signed-in user; it has no tenant parameter to misuse.

Direct or by invitation. A manager can hand over a generated password, or let the salesperson choose their own via a code.

Reset signs the lost phone out in the same transaction as the new password.

Standalone is a first-class answer on the setup screen: a single-till shop with no head office runs the full product locally.

Demo build: cameras ship sealed (AES-256-GCM); the unlock code travels separately from the zip.