Changelog
Every meaningful change to the TAA Vision platform — newest first.
Operations & console — a real deploy button, alarms, and recoverable tenants.
Deleting a tenant is now a soft delete — it moves to a Trash view, deactivated and hidden but fully recoverable. Restore brings it back with its API keys and enrollments intact; access is gated on tenant status so a trashed tenant can’t authenticate.
The console moved from a top nav to a persistent sidebar + topbar. Dashboard, Users, Trash, and Docs in the rail; edge config & QR generation live under tenant Settings.
The Deploy prod (API + Web) GitHub Actions workflow is a manual button with a stack selector (all / api / web / data). It validates, runs the CDK deploy, applies DB migrations in-VPC, and smoke-tests — authenticating via a repo-scoped OIDC role.
CloudWatch alarms wired to SNS now cover ALB 5xx, unhealthy hosts, p99 latency, CPU/memory, and a tenant-MQTT broker-flap detector — so silent failures page someone instead of hiding in the logs.
Each API/worker task connected to a tenant broker with the same client id, so autoscaled tasks kicked each other off in a loop. Each task now uses a unique per-instance client id; connections are stable.
Admins can pause/resume an edge’s stream (“system closed”); desired state is delivered on the device heartbeat and the device reports its actual state back.
Edge productionization — Dockerized processors and QR provisioning.
The console generates a provisioning bundle (tenant identity, scoped API key, MQTT settings); the edge device scans a QR — or imports the JSON — to configure itself. The key is named per location/device so it can be revoked independently.
Multi-stage Docker images for the headless processor across CPU, GPU, and Jetson, with health checks and a GHCR publish workflow. Capture (USB / RTSP / WebRTC + FPS) is driven from the console.
Node capture honors CAPTURE_WIDTH, downscaling RTSP sources via an ffmpeg scale filter before inference — lower load without touching the camera config.
Enrollment export tolerates the pgvector Vector fetch type across 0.4+ so embedding sync to the venue box no longer fails on newer extension versions.
Failover & resilience — survive a cloud outage and an event-weekend surge.
A sampled fraction of cloud identify reads are mirrored to the on-prem venue box so its index stays warm — the groundwork for AWS→on-prem failover.
Rate limits now bucket by API key (per tenant), falling back to client IP when no key is present — one noisy tenant can’t exhaust another’s budget.
The control-plane provisioning sync and the box’s inbound auth were reconciled so tenant/key/face-group state actually replicates to an offline box.
MVP — the multi-tenant API and cloud deployment.
Detect, extract, identify (1:N), and verify (1:1), plus face-group enrollment and plate watchlists — all multi-tenant with scoped API keys and per-tenant event logging.
ECS Fargate behind an ALB + WAF, RDS Postgres with pgvector, AWS IoT Core for MQTT, and the console on S3 + CloudFront, all provisioned with CDK.
A Capacitor iOS/Android capture app running face-api.js in-browser with vendored offline models, bridging fetch/WebSocket to the central API.
Looking for how something works? Read the manual →