Developer notes

IncySpeak machines coordinate with the cloud over outbound HTTPS. The device API is authenticated with a per-machine bearer token issued at pairing. The control plane stores only credential hashes.

Device API

Method	Endpoint	Purpose
POST	/api/device/pair	Exchange a one-time pairing code for a device credential
POST	/api/device/heartbeat	Report machine status and metrics
GET	/api/device/jobs	Poll for queued jobs
POST	/api/device/jobs/ack	Acknowledge / update job status
POST	/api/device/observations	Synchronize observations
POST	/api/device/beliefs	Synchronize public-safe belief summaries

Method

Endpoint

Purpose

POST

/api/device/pair

Exchange a one-time pairing code for a device credential

POST

/api/device/heartbeat

Report machine status and metrics

GET

/api/device/jobs

Poll for queued jobs

POST

/api/device/jobs/ack

Acknowledge / update job status

POST

/api/device/observations

Synchronize observations

POST

/api/device/beliefs

Synchronize public-safe belief summaries

Full request/response contracts are documented in docs/DEVICE_PROTOCOL.md. Security model: docs/SECURITY.md. Architecture: docs/ARCHITECTURE.md.

Backend mode

This deployment is connected to Supabase. Pairing codes and heartbeats persist when the server-only service role is configured. Job, observation, and belief sync remain validated stubs.

Control plane

The authenticated control plane lives at /app.