One telemetry plane from device to decision

Readings are validated against the tenant’s device registry before anything is stored: a reading naming a device that registry does not know is dropped and counted, never absorbed. How a device reaches the platform is ours to run, not yours to build.

Raw telemetry plus 1-minute, hourly and daily rollups computed on ingest, so a year-long chart costs the same as a day. A cardinality budget is enforced in code, not documented.

Boards of time series, gauges, status tiles, tables and maps, each widget bound to a device and metric. Bindings reference the asset model, so one board serves every site that shares a shape.

Ad-hoc queries across devices, metrics and time ranges, answered from the same rollups the dashboards use — so a number checked here and a number on a board can never disagree.

Drag-built chains of filter, switch, duration, transform and alarm nodes. Stateful timers survive a restart, and the editor and the executor share one JSON schema, so what you drew is what runs.

Severity, acknowledgement, shelving and de-duplication, with operator load measured against the EEMUA 191 target of six alarms per hour — read from the worst rolling hour, because a daily average hides exactly the floods that matter.

Sites, lines, machines and sensors in a hierarchy that dashboards, rules and alarms all reference. The vocabulary swaps per vertical: a line, a cleanroom, a pump station.

Tenant scope is a signed claim in the token, read on every call. A tenant id in a query, path or body is ignored, and a build-time test fails if any repository finder forgets its tenant.

Five roles from viewer to tenant admin, enforced server-side on every endpoint. Acknowledgements, rule saves and device requests are written to an audit trail with who, what and when.