📋 MVP Technical Master Plan — v1.0

Building the World's First
Autonomous SOC Platform

NexVigil AI fuses computer vision, audio sensing, GPS telemetry, and behavioral analytics into a unified edge-to-cloud threat-detection pipeline — deployed on Cloudflare Workers with zero cold starts and sub-10ms global latency.

6
Edge Devices
14
Live Alerts
<10ms
API Latency
275+
Edge Locations
🏗️ System Overview

What We're Building

An end-to-end autonomous security operations center that never sleeps, never misses a threat, and scales globally in seconds.

📹

Computer Vision Pipeline

YOLOv8n runs directly on Jetson Nano/Orin edge hardware at up to 30 FPS. Every frame is analyzed for persons, vehicles, weapons, and anomalies. Detections with confidence scores are batched and sent over HTTPS to the Cloudflare Worker API. On-device NMS suppresses duplicate alerts within a 2-second window. The pipeline supports 6 simultaneous camera streams per device with automatic reconnection on network failure.

YOLOv8n · ONNX Runtime · TensorRT
🎙️

Audio Intelligence

YAMNet classifies audio clips in real-time across 521 sound events. Critical triggers include gunshot, glass break, screaming, vehicle horn, and general anomaly. The audio pipeline uses a sliding 3-second window with 50% overlap for seamless detection. Anomalies below the trigger threshold are logged for pattern analysis — building a baseline of ambient noise per zone over 14 days.

YAMNet · Sliding Window · Pattern Baseline
📍

GPS Patrol Telemetry

Patrol vehicles stream lat/lng/speed/heading at 1Hz. Geofence zones are defined as polygons with configurable restricted hours. Entry and exit events are computed on-device using the Ray Casting algorithm, with only the event sent to the cloud — not raw GPS.

Geofencing · Polygon Ray Casting · 1Hz
🧠

Compound Threat Engine

The fusion engine combines four weighted signal channels (vision 35%, audio 25%, zone 20%, behavior 20%) into a 0.0–1.0 threat score. Compound rules like "weapon + stationary >5min + elevated audio" fire immediately with a critical alert tier.

Weighted Fusion · Compound Rules · 5 Tiers

Real-Time SSE Feed

Server-Sent Events push alert data to the React dashboard with sub-100ms latency from edge to browser. Automatic reconnection with exponential backoff. Event categories include: new_alert, alert_resolved, device_offline, device_online, zone_breach.

SSE · HTTP/2 · Auto-Reconnect
🗄️

D1 Edge SQLite

275+ Cloudflare edge locations each run a full SQLite instance via D1. Reads are served from the nearest node with zero cross-region latency. Writes are replicated asynchronously to the primary. The schema is optimized for high-frequency INSERT with covering indexes on (device_id, timestamp).

SQLite @ Edge · 275+ Nodes · Zero Latency
🔄

Device Simulator — MVP Validation

Before connecting real hardware, a Node.js simulator generates realistic multi-modal security events every 3–12 seconds across 6 virtual devices. The simulator models day/night patrol cycles, random threat injection, device state transitions (online/offline), and compound multi-signal alerts — giving a fully operational SOC demo without any physical hardware. Currently running with 14 active alerts across 6 simulated agents.

Node.js Simulator · Day/Night Cycles · 6 Devices
🔗

React Dashboard — Real-Time SOC Interface

A full-featured React SPA connects to the SSE stream and polls dashboard REST endpoints. Features include: live alert feed with severity color coding, device status grid with heartbeat indicators, zone threat heatmap, time-series charts for alert frequency (last 24h, 7d), alert acknowledgment and resolution workflow, and a shift-change summary modal. The dashboard is fully mobile-responsive with a collapsible sidebar.

React 18 · SSE · Recharts · Tailwind CSS · PWA-ready
⚙️ Architecture

Edge-to-Cloud Data Pipeline

Physical security events are captured by edge agents and streamed to globally distributed Cloudflare Workers, persisted to D1, and broadcast in real-time.

📹
YOLOv8n Camera
Jetson Nano/Orin
🎙️
YAMNet Audio
MEMS Microphone Array
📍
GPS + IMU
Patrol Vehicle Unit
☁️
CF Worker
TypeScript / V8 Isolates
🔒
Auth Middleware
JWT + Device HMAC
Rule Engine
Compound Threat Scorer
🗄️
D1 SQLite
275+ Edge Nodes
📦
R2 Blob Storage
Images / Audio Clips
🔑
KV Sessions
JWT Blacklist / Rate Limit
🖥️
React SPA
Dashboard + Mobile
🚨
SSE Stream
Live Alert Push
📧
Email / SMS
Titan SMTP + Twilio
Edge Layer
YOLOv8n object detection — 30 FPS
YAMNet audio classification — 521 classes
Ray-casting geofence on-device
MQTT → HTTPS bridge
Local alert caching (offline buffer)
Cloud Layer
Cloudflare Workers — TypeScript
JWT auth with device-level HMAC
Rate limiting via KV counter
Compound rule evaluation
R2 signed URLs for blob access
Data Layer
D1 SQLite — globally distributed
R2 — images, audio clips, clips
Covering indexes on (device_id, ts)
TTL-based auto-purge (30 days)
SSE fan-out per session
🔌 API Reference

All 15 Endpoints

Base URL: https://nxv-worker.cadev.workers.dev/api/

MethodPath + DescriptionPayload / ResponseSource
{{ ep.method }} {{ ep.path }} {{ ep.desc }} {{ ep.source }}

Sample Payloads — Edge → API

POST /api/vision — YOLOv8n Detection Event
// YOLOv8n detection from edge camera { "device_id": "dev-001", "zone_id": "zone-001", "objects": ["person", "vehicle"], "scores": [0.94, 0.87], "image_id": "img-abc123", "timestamp": 1718901234567 }
POST /api/audio — YAMNet Classification Event
// YAMNet audio classification from edge { "device_id": "dev-003", "zone_id": "zone-002", "class_name": "gunshot", "confidence": 0.91, "duration": 0.5, "audio_id": "aud-xyz789" }
POST /api/gps — GPS Telemetry Event
// GPS telemetry from patrol vehicle { "device_id": "dev-004", "zone_id": "zone-003", "lat": 37.7749, "lng": -122.4194, "speed": 5.2, "heading": 45.0, "timestamp": 1718901234567 }
POST /api/alerts — Compound Rule Alert
// Alert triggered by fusion rule engine { "device_id": "dev-001", "zone_id": "zone-001", "type": "intrusion", "severity": "critical", "threat_score": 0.89, "title": "Perimeter breach", "description": "Unauthorized person in restricted zone", "metadata": { "object": "person", "behavior": "breach" } }
📡 Simulated Devices

6 Edge Agents in Operation

The MVP simulator runs 6 virtual devices generating realistic multi-modal security events every 3–12 seconds with full day/night patrol modeling.

{{ dev.icon }}
{{ dev.name }}
{{ dev.id }}
{{ dev.sensors }} · {{ dev.zone }}
Online {{ dev.alerts }} alerts
🗄️ Data Model

D1 SQLite Schema

8 tables optimized for high-frequency edge ingestion with covering indexes and TTL-based auto-purge policies.

{{ tbl.name }}
🧠 Threat Intelligence

Compound Rule Engine

Weighted multi-signal fusion with compound cross-signal rules and 5-tier escalation.

Threat Score — Weighted Fusion Formula
score = (vision_weight × vision_confidence) × 0.35
  + (audio_weight × audio_confidence) × 0.25
  + (zone_weight × zone_base_score) × 0.20
  + (behavior_weight × behavior_confidence) × 0.20
{{ tier.label }}
{{ tier.range }}
{{ tier.action }}
{{ tier.examples }}

Compound Rule Examples

{{ rule.name }}

{{ rule.condition }}

{{ rule.desc }}

🗺️ Implementation Roadmap

5 Phases to Autonomous SOC

From MVP simulator to enterprise-grade autonomous threat response platform.

{{ phase.phase }}

{{ phase.title }}

{{ phase.desc }}

{{ tag }}
💻 Code Samples

Integration Examples

Ready-to-use snippets for connecting real hardware to the NexVigil API.

TypeScript Device Registration
// Register a new edge device const res = await fetch( '/api/device/heartbeat', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ "device_id": "dev-001", "name": "Perimeter Camera N", "type": "camera", "zone_id": "zone-001", "metadata": { "model": "Jetson Nano" } }) } ); const data = await res.json(); console.log(data);
Python YOLOv8n Integration
# YOLOv8n detection loop → NexVigil API import cv2, requests, time, json model = cv2.dnn.readNet("yolov8n.onnx") cam = cv2.VideoCapture(0) while True: ret, frame = cam.read() blob = cv2.dnn.blobFromImage(frame, 1/255, (640,640)) model.setInput(blob) outputs = model.forward() for det in outputs[0]: conf = det[4] if conf > 0.5: cls = int(det[1]) label = CLASSES[cls] if label in ['person','vehicle','knife']: requests.post( 'https://nxv-worker.../api/vision', json={'device_id':'dev-001', 'zone_id':'zone-001', 'objects':[label], 'scores':[float(conf)]}) time.sleep(0.033) # ~30 FPS
Shell Simulate Alert Event
# Send a test alert via curl curl -X POST \ https://nxv-worker.cadev.workers.dev/api/alerts \ -H "Content-Type: application/json" \ -d '{ "device_id": "dev-001", "zone_id": "zone-001", "type": "intrusion", "severity": "critical", "title": "Test Alert", "description": "Perimeter breach", "metadata": {"test": true} }' # Check API health curl \ https://nxv-worker.cadev.workers.dev/api/health