Architecture overview

[Boiler + sensors + relay] --RS-485 / wired--> [Controller + edge agent]
   --HTTPS over LTE/Ethernet--> [FastAPI + PostgreSQL backend] --HTTPS-->
      [Operator web app]   and   [Public marketing site]

Defining property. The control loop and safety interlocks run on the controller. If the cloud or internet is unreachable, the building keeps heating on its last known good config. The cloud is for visibility, history, configuration, operator commands, and the business layer — it is never in the safety loop.

Components

• agent/ — Python edge agent. Talks only to the IODriver interface, so it runs against a software SimulatedDriver in development and on a real ModBerryDriver/RevPiDriver in the field by changing one config line. Owns the control loop, interlocks, watchdog, local SQLite buffer, telemetry store-and-forward, and command validation.
• backend/ — FastAPI + PostgreSQL. Device-facing API (API key) for register/telemetry/ commands/config/ota; operator-facing API (session/JWT) for the platform. Postgres from day one.
• web/ — Next.js operator app (Phase 6).
• marketing/ — Astro public site (Phase 7).
• infra/ — hosting, IaC, CI/CD (Phase 10).

Safety posture

Six inviolable invariants (see the build prompt §5), each backed by a passing test under agent/tests/safety/ exercised with SimulatedDriver fault injection. Safe state means the boiler reverts to its own native controls with heat still available; it is the default on startup, clean shutdown, and any fault.