Architecture

Every operational row is scoped by companyId. The signed-in plant session selects one factory. Ops viaOps can enter a factory as admin without becoming a plant user.

Pipeline

1. Device exists in the registry with an ingest token and a type/unit from the sensor taxonomy.
2. A reading arrives (HTTP or MQTT) with a finite numeric value.
3. ingestReading stores Reading, optional messageId, quality, source, gateway.
4. Alert rules, machine-state hints, energy deltas, and (on demo) ERP-shadow batch/bin/QC updates may run.
5. Command Center, OEE, energy, Executive read those facts. They do not invent production.

Processes on the VM

The app is a long-running Node process (not serverless): Postgres, MQTT (embedded Aedes or MQTT_URL), connector runtime, simulator (demo tenants only), offline alert scan, edge sync.

Isolation

A plant user cannot request another factory id. Ops aggregation uses authorized site lists. Paused factories reject plant login.