Behavision: face recognition for retail, edge to head office

Five components that ship as one product:

- behavision/  the recognition engine. RTSP ingest, YuNet detection, IoU
               tracking, ArcFace embeddings, a FAISS/SQLite gallery, and a
               FastAPI dashboard. Identity is decided once per TRACK from an
               average of at least three embeddings, never per frame.
- agent/       the Go edge agent: supervises the engine, holds a durable
               spool, and drains it to MQTT. Nothing is acked before the
               broker confirms.
- desktop/     the shop PC application (Wails + React + tray).
- server/      the cloud API, MQTT consumer, reports and assistant.
- web/         platform.loyaly.ai, the head-office app, embedded in the
               server binary.

The gallery stores 512-float embeddings and timestamps - no images unless
`app.store_faces` is switched on. Those embeddings are biometric personal
data under GDPR and India's DPDP: template inversion reconstructs a
recognisable face from an ArcFace vector, so data/behavision.db is treated
as a biometric database and DELETE /api/visitors/{id} is a real erasure.

CLAUDE.md carries the reasoning behind every non-obvious decision here,
including the ones that were measured and the ones that were wrong first.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HViLj9gYNRtSr7YVZmW5sn

desktop/main.go

@@ -0,0 +1,66 @@
+// Command behavision-desktop is the store-facing application: a tray icon, a
+// window, and the supervisor for the recognition engine.
+//
+// It is one process rather than three because the tray, the window and the
+// supervisor all need the same state, and because a user who quits the tray
+// expects recognition to stop. It is deliberately NOT a Windows service: a
+// service runs in session 0 and cannot draw a tray icon, and spawning a child
+// process needs no elevation while controlling a service does.
+package main
+
+import (
+	"context"
+	"embed"
+	"log"
+
+	"github.com/wailsapp/wails/v2"
+	"github.com/wailsapp/wails/v2/pkg/options"
+	"github.com/wailsapp/wails/v2/pkg/options/assetserver"
+	"github.com/wailsapp/wails/v2/pkg/options/windows"
+	"github.com/wailsapp/wails/v2/pkg/runtime"
+)
+
+//go:embed all:frontend/dist
+var assets embed.FS
+
+func main() {
+	app := NewApp()
+	tray := newTray(app)
+
+	err := wails.Run(&options.App{
+		Title:  "Behavision",
+		Width:  1280,
+		Height: 820,
+		// Small enough to still be usable on a cramped shop-counter monitor.
+		MinWidth:    1024,
+		MinHeight:   640,
+		AssetServer: &assetserver.Options{Assets: assets},
+		// Closing the window hides it rather than quitting: the engine must
+		// keep recognising after a shop assistant clicks the X, and the tray
+		// is where they get the window back.
+		HideWindowOnClose: true,
+		OnStartup: func(ctx context.Context) {
+			app.startup(ctx)
+			tray.start(ctx)
+		},
+		OnBeforeClose: func(ctx context.Context) bool {
+			runtime.Hide(ctx)
+			return true // prevent the close
+		},
+		OnShutdown: func(ctx context.Context) {
+			tray.stop()
+			app.StopEngine()
+		},
+		Bind: []any{app},
+		Windows: &windows.Options{
+			WebviewIsTransparent: false,
+			WindowIsTranslucent:  false,
+			// A shop PC is not a developer machine; a stray right-click that
+			// opens devtools looks like the software is broken.
+			DisableWindowIcon: false,
+		},
+	})
+	if err != nil {
+		log.Fatalf("behavision-desktop: %v", err)
+	}
+}