One round trip · Tier-2 command

From AI recommendation to a chilled-water setpoint, in 8 hops.

This is what happens between the moment AiTBMS's sequence engine notices an overcooling AHU and the moment the chiller actually accepts the new setpoint. Operator approval sits in the middle — Tier 2 is the most common production configuration.

6-second loop · CSS animation, no JS · brand-green = active hop

Step-by-step

1
AI sequence engine emits a recommendation
The cloud-side optimizer (Claude-based, prompt-cached) detects that AHU-2 has been overcooling at 52°F discharge for 90 minutes and generates a Tier-2 setpoint write: chilled-water-supply 44°F → 46°F.
2
Operator approves at /control
The pending command lands on the operator queue. A named user with role site_operator clicks Approve. Approval is signed with the user's Clerk session token and recorded in control_commands.
3
Cloud queues the command in control_commands
Postgres stores the command with status=approved, target_point_id, target_value, justification, and an HMAC signature derived from the org-scoped command key. RLS scopes everything to this Site.
4
Edge agent long-polls and picks it up
The Windows edge agent maintains an outbound HTTPS long-poll against /api/edge/commands. When the approved command appears, the response unblocks; the agent verifies the HMAC against its locally stored key.
5
Edge agent issues BACnet WriteProperty
The agent maps the canonical point ID to the discovered BACnet object (analog-value:7, presentValue) on the chiller controller and issues a WriteProperty over UDP 47808. Priority array slot 8 is used by convention.
6
Chiller acknowledges
The controller responds with a SimpleACK. The agent then ReadProperty's the same object back to confirm the value applied (write-and-verify pattern).
7
Edge agent reports result back to cloud
The agent POSTs the execution result (success / new value / verify timestamp) to /api/edge/commands/:id/result. The cloud updates control_commands.status to executed.
8
Audit log written, operator gets confirmation
An immutable row lands in audit_log (actor, action, target, before/after, signature). The operator sees a green check on /control and an entry on /faults if the value drifts back inside the post-action monitoring window.

See the queue + approval UI

/control is where operators approve, reject, or revoke pending AI commands.

Open Control Center →Back to architecture

From AI recommendation to a chilled-water setpoint, in 8 hops.

6-second loop · CSS animation, no JS · brand-green = active hop

Step-by-step

1
AI sequence engine emits a recommendation
The cloud-side optimizer (Claude-based, prompt-cached) detects that AHU-2 has been overcooling at 52°F discharge for 90 minutes and generates a Tier-2 setpoint write: chilled-water-supply 44°F → 46°F.
2
Operator approves at /control
The pending command lands on the operator queue. A named user with role site_operator clicks Approve. Approval is signed with the user's Clerk session token and recorded in control_commands.
3
Cloud queues the command in control_commands
Postgres stores the command with status=approved, target_point_id, target_value, justification, and an HMAC signature derived from the org-scoped command key. RLS scopes everything to this Site.
4
Edge agent long-polls and picks it up
The Windows edge agent maintains an outbound HTTPS long-poll against /api/edge/commands. When the approved command appears, the response unblocks; the agent verifies the HMAC against its locally stored key.
5
Edge agent issues BACnet WriteProperty
The agent maps the canonical point ID to the discovered BACnet object (analog-value:7, presentValue) on the chiller controller and issues a WriteProperty over UDP 47808. Priority array slot 8 is used by convention.
6
Chiller acknowledges
The controller responds with a SimpleACK. The agent then ReadProperty's the same object back to confirm the value applied (write-and-verify pattern).
7
Edge agent reports result back to cloud
The agent POSTs the execution result (success / new value / verify timestamp) to /api/edge/commands/:id/result. The cloud updates control_commands.status to executed.
8
Audit log written, operator gets confirmation
An immutable row lands in audit_log (actor, action, target, before/after, signature). The operator sees a green check on /control and an entry on /faults if the value drifts back inside the post-action monitoring window.

See the queue + approval UI

/control is where operators approve, reject, or revoke pending AI commands.

Open Control Center →Back to architecture