Two clients. One trusted backend.
The report's architecture keeps business rules and financial state on the server. Clients display and request changes; they do not decide the database state themselves.
Discovery, booking, wallet, navigation
Facilities, maps, tariffs, reports
JWT + RBAC → controllers/services → validated business operations
Facilities • Bays • Bookings • Sessions • Wallets • Events
Responses and authorised events travel back to the clients. AI tools use approved backend operations, with no arbitrary SQL or direct client database access.
What a driver request does
Flutter → HTTPS API / Socket.IO → Express → service logic → Prisma → PostgreSQL → response / event → Flutter.
Admin requests pass authenticated role middleware before services access the same database. An AI request returns a structured result from its baseline/tool layer and authoritative data.
This introduction website
This site uses React, TypeScript and TanStack Start, with Firebase/Firestore for its website CMS. The Flutter, Express and PostgreSQL architecture above is the ecosystem described in the supplied report.
Useful today. Ready to learn tomorrow.
The supplied technical audit separates working deterministic baselines from ML-ready architecture. No trained-model performance is claimed.
Parking recommendation
Multi-attribute utility ranking combines distance, capacity, price, EV suitability and rating. A ranking score is not an accuracy percentage.
Multilingual NLP
Rules and regex recognise intents and entities in English, Sinhala and Singlish. No annotated training corpus was found in the report's audit.
Occupancy prediction
Current bay state, daily patterns and queueing assumptions estimate occupancy at 15, 30 and 60 minutes, then 2 and 4 hours. No empirical trained model is reported.
Parking duration
Powertrain-aware rules and historical completed-session dwell averages support expected exit time and notification timing. Fixed assumptions are not a trained regression model.
Demand & pricing
Thresholds and peak-time rules classify demand as low, medium, high or very high. Tariff recommendations require administrator approval; prices are not changed automatically.
Anomaly & fraud flags
Rapid bookings, impossible transit times and unusual payment patterns produce review flags. They do not automatically penalise or accuse a driver.
Predictive maintenance
Telemetry, health thresholds and service-cycle rules assess equipment. Predicting real failures requires historical failures, maintenance records and sensor observations.
Feedback sentiment
Multilingual lexicons and keywords identify sentiment and topics such as price, availability, navigation, ANPR and payments. This is not a trained BERT or transformer model.
Admin AI copilot
A safe dispatcher maps recognised questions to predefined database aggregations. The copilot does not generate arbitrary SQL or bypass access controls.
AI report generator
Daily, weekly and monthly summaries use live operational PostgreSQL data. Data-driven report compilation is useful, but is not a trained ML model.
Camera parking-bay detection
An IoU spatial mapping pipeline is designed for YOLO-style vehicle detections. The report found no trained YOLO model; labelled camera images, bay annotations and real-camera validation are required.
Vehicle damage comparison
An entry/exit image comparison architecture targets scratches, dents and broken lights. A trained classifier and rigorous before/after evaluation remain future work.
An auditable model registry records each model's name, version, type, training status, dataset, training and evaluation methods, genuine metrics and timestamps. Statuses distinguish REAL_TRAINED_MODEL, BASELINE, ML_READY and NOT_IMPLEMENTED; fabricated performance metrics are excluded.
Intelligence with clear boundaries.
Access, payments and sensitive actions are enforced by the backend — with human approval where it matters.
Backend-enforced roles
JWT sessions protect requests. Unauthenticated access returns 401; authenticated drivers attempting admin operations are denied with 403. Admin sign-in is email-only and web-only.
Confirm before sensitive actions
AI booking, cancellation, wallet deductions and tariff changes require explicit confirmation and server validation. Informational questions can read approved backend services without inventing values.
One authoritative record
Clients and AI tools do not directly access PostgreSQL. Availability, prices, booking references, payment state and sessions come from approved backend operations.
Device & production safeguards
Secure session storage, local logout, HTTPS/WSS, CORS and production configuration support deployment. Files needing persistence require external or persistent storage rather than temporary server files.
A foundation with a clear path forward.
Verification below is recorded in the supplied technical report, rather than a new test of the Flutter/backend project performed by this website.
Backend tests, as reported
Flutter tests, as reported
Admin Web production build
Android release APK, as reported
The report also records zero backend TypeScript errors and no Flutter static-analysis issues.
- 01
Connect production services
The target is Vercel for Admin Web, Render for the Express backend, Neon for PostgreSQL and an Android APK using the production API. Replace localhost, apply Prisma migrations and configure HTTPS, WSS, CORS and persistent file storage.
- 02
Verify on real devices & cameras
The report did not connect physical Android hardware. Fingerprint, GPS, device-specific behaviour and push delivery need real-device checks; camera and gate paths need field verification.
- 03
Prove two-way synchronisation
An admin changes a bay state and Flutter sees the change. A driver books in Flutter and Admin Web sees the same booking. Verify entry, exit, financial reconciliation and receipts against one authoritative record.
- 04
Train the first real occupancy model
Inspect real historical occupancy records first. Engineer time, facility, booking and session features, split chronologically and evaluate on unseen data using genuine MAE, RMSE and R². Label synthetic development data explicitly, save the model artifact and retain the baseline fallback.