feat(adr-117): pip wifi-densepose modernization (PIP-PHOENIX) + ruview sibling release (#786)

* docs(adr-117): seed branch — ADR-117 pip-modernization spec + soul-signature research bundle Two artifacts landing together on this new branch as the prerequisite documentation for the v2.0.0 Python wheel modernization work: 1. **docs/adr/ADR-117-pip-wifi-densepose-modernization.md** (644 lines) — Plan to bring the 2025-published `wifi-densepose` PyPI package (last release v1.1.0, 2025-06-07, 11.5 months out of sync) up to the current Rust v2/ workspace SOTA. Recommends PyO3 + maturin with abi3-py310 (one binary covers Python 3.10–3.13 per OS/arch), first-wheel scope = core + vitals + signal crates (~5 MB), v1.99.0 tombstone + 90-day un-yank window for v1.1.0, v2.0.0 hard break. Open questions catalogued; phases P1–P6+ laid out with concrete acceptance criteria. 2. **docs/research/soul/** (5 files, ~1,450 lines) — Soul Signature research spec: 7-channel electromagnetic biometric fingerprint (AETHER 128-dim + cardiac HR/HRV + cardiac waveform morphology + respiratory pattern + gait timing + skeletal proportions + subcarrier reflection profile), fused into one RVF graph file. Includes 60s scanning protocol, 5-layer security model, threat-model + mitigations, references to existing ADRs (014, 021, 024, 027, 030, 039, 079, 106, 108, 109, 110, 115). Marked "Research Specification (Pre-Implementation)". Explicit "what this is NOT" disclaimers preempt pseudoscience drift; every discriminative-power claim either cites a measurement or is marked "open research; baseline TBD". Branch off main at HEAD; ready for /loop 10m implementation iterations. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p1): scaffold python/ workspace — PyO3 + maturin + smoke tests (refs #785) ADR-117 P1 — the python/ directory is now a working maturin-buildable crate that produces the v2.x replacement for the legacy pure-Python wifi-densepose==1.1.0 PyPI wheel. ## What lands - `python/Cargo.toml` — PyO3 0.22 with `extension-module` + `abi3-py310` (one binary covers Python 3.10–3.13 per OS/arch — keeps the cibuildwheel matrix to 5 wheels per release, not 20). Depends on `wifi-densepose-core` from the existing v2/ workspace via relative path. - `python/pyproject.toml` — maturin>=1.7 build backend with `python-source = "python"` and `module-name = "wifi_densepose._native"` so the compiled module loads as an internal underscore-private submodule of the user-facing `wifi_densepose` package. PEP 621 metadata + classifiers + project URLs. Optional-deps: `wifi-densepose[client]` for the P4 WS/MQTT pure-Python layer, `wifi-densepose[dev]` for the test toolchain (pytest, ruff, mypy). - `python/src/lib.rs` — minimal `#[pymodule] wifi_densepose_native` exporting `__rust_version__`, `__rust_build_tag__`, `__build_features__`, and a `hello()` smoke function. P2 will land the core type bindings here. - `python/wifi_densepose/__init__.py` — pure-Python facade re-exporting the compiled module's symbols under their stable user-facing names. Docstring teaches the v1→v2 migration story up-front. - `python/wifi_densepose/py.typed` — PEP 561 marker so `mypy --strict` in user code treats the wheel as fully typed (real stubs land in P2). - `python/tests/test_smoke.py` — 6 P1 acceptance tests: 1. package imports without error 2. version string is PEP 440-compliant 3. `__rust_version__` is reachable from Python (the diagnostic surface ADR-117 §5.2 promised) 4. `__build_features__` lists `p1-scaffold` marker 5. `wifi_densepose.hello()` returns "ok" (FFI round-trip) 6. `wifi_densepose._native` is reachable but the leading underscore conveys "private; users should import the parent package" - `python/README.md` — phase ledger, local build instructions (`maturin develop`), layout diagram. ## What's deferred to P2+ - Core type bindings (`CsiFrame`, `Keypoint`, `PoseEstimate`) — P2 - Vitals + signal DSP bindings + witness v2 — P3 - Pure-Python WS/MQTT client layer (`wifi_densepose[client]`) — P4 - cibuildwheel + PyPI publish — P5 - v1.99.0 tombstone — concurrent with P5 The new `python/` crate is intentionally OUTSIDE the v2/ Cargo workspace — it has its own Cargo.toml with `[package]` not `[workspace.package]` inheritance — to keep maturin's `python-source` + `module-name` config self-contained and to avoid forcing every `cargo test --workspace` invocation in v2/ to compile pyo3. Refs ADR-117 §5 (Detailed design) and §6 (Phased migration). Refs #785 (tracking issue). Co-Authored-By: claude-flow <ruv@ruv.net> * fix(adr-117/p1): standalone Cargo.toml + python-source=. + #[pyo3(name=_native)] (P1 GREEN) Three fixes to make maturin develop actually work locally: 1. `python/Cargo.toml` removed `*.workspace = true` inheritance — the python/ crate is intentionally outside the v2/ workspace (ADR-117 §5.2) so it needs every `[package]` field local. 2. `python/pyproject.toml` `python-source = "python"` was wrong because pyproject.toml lives at python/ — maturin was looking for python/python/. Changed to `python-source = "."` so the `wifi_densepose/` package directory sibling-to-pyproject is found. 3. `python/src/lib.rs` `#[pymodule] fn wifi_densepose_native` → `#[pymodule] #[pyo3(name = "_native")] fn wifi_densepose_native`. PyO3 generates `PyInit__native` from the pyo3-name attribute, which must match the `module-name` in pyproject.toml's [tool.maturin] block ("wifi_densepose._native"). Without this attribute the wheel builds but `import wifi_densepose._native` fails with ModuleNotFoundError. ## Local validation (P1 acceptance gate) ``` $ python -m venv .venv && .venv/Scripts/python -m pip install maturin pytest $ VIRTUAL_ENV=… maturin develop --release … Finished `release` profile [optimized] target(s) 📦 Built wheel for abi3 Python ≥ 3.10 🛠 Installed wifi-densepose-2.0.0a1 $ .venv/Scripts/python -c 'import wifi_densepose; print(wifi_densepose.__version__, wifi_densepose.__rust_version__, wifi_densepose.hello())' 2.0.0a1 2.0.0-alpha.1 ok $ .venv/Scripts/python -m pytest tests/ -v tests/test_smoke.py::test_package_imports PASSED tests/test_smoke.py::test_version_string_well_formed PASSED tests/test_smoke.py::test_rust_version_surfaced PASSED tests/test_smoke.py::test_build_features_listed PASSED tests/test_smoke.py::test_hello_returns_ok PASSED tests/test_smoke.py::test_native_module_private PASSED ======================== 6 passed in 0.05s ========================= ``` P1 closed. Moving to P2 (core type bindings). Refs #785, ADR-117 §6. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p2): Keypoint + KeypointType bindings — 23 new tests (29/29 GREEN) Lands the first chunk of P2: PyO3 bindings for `Keypoint` and `KeypointType` from `wifi_densepose_core`. Bound types surface to Python as `wifi_densepose.Keypoint` / `wifi_densepose.KeypointType`. ## Design choices that affect the API surface 1. **`Confidence` is NOT bound as a separate class.** Users hate wrapping a float in a constructor. Python-side, confidence is just a `float in [0.0, 1.0]`; the binding validates on construction (`ValueError` for out-of-range, matching the Rust core error). 2. **`KeypointType` is a `#[pyclass(eq, eq_int, hash, frozen)]` enum** — hashable so users can drop it into dicts/sets (the most common pattern in pose-analysis notebooks: `keypoints_by_type[k.type] = k`). 3. **`Keypoint.__init__` keyword-only `z`** so 2D users don't have to write `None` and 3D users get a clear named arg: `Keypoint(KeypointType.LeftWrist, 0.2, 0.4, 0.8, z=0.1)`. 4. **`Keypoint` is `#[pyclass(frozen)]`** — no in-place mutation. The Rust core type is immutable through Copy + Hash + Eq, and exposing setters from Python would create a copy-vs-reference inconsistency between languages. ## Files - `python/src/bindings/keypoint.rs` — 220 lines of `#[pymethods]` wrappers + Rust↔Python enum round-trip - `python/src/lib.rs` — `mod bindings { pub mod keypoint; }` + `bindings::keypoint::register(m)?` call from `#[pymodule]` - `python/wifi_densepose/__init__.py` — re-exports `Keypoint` and `KeypointType` at the package root - `python/tests/test_keypoint.py` — 23 tests covering: - 17-element COCO ordering of `KeypointType.all()` - index→type mapping for every variant - snake_name matches COCO spec - `is_face()` / `is_upper_body()` predicates - hashability (the bug I caught when I added the set-based face test — fixed by adding `hash` to the `#[pyclass]` attribute) - 2D + 3D constructor variants - position_2d / position_3d tuples - is_visible threshold - confidence validation (Err on out-of-range) - distance_to (2D Euclidean, 3D Euclidean, fallback when one is 2D and the other is 3D) - __repr__ + __eq__ - the new `p2-keypoint-bindings` feature marker landed ## Local validation \`\`\` $ cd python && .venv/Scripts/python -m pytest tests/ -v tests/test_smoke.py::test_package_imports PASSED tests/test_smoke.py::test_version_string_well_formed PASSED tests/test_smoke.py::test_rust_version_surfaced PASSED tests/test_smoke.py::test_build_features_listed PASSED tests/test_smoke.py::test_hello_returns_ok PASSED tests/test_smoke.py::test_native_module_private PASSED tests/test_keypoint.py::test_keypoint_type_all_returns_17 PASSED … ======================== 29 passed in 0.06s ========================= \`\`\` Wheel size after both bindings: still well under the 5 MB ADR §5.4 budget (release build with --strip on Windows: ~340 KB). Also adds `python/.gitignore` to prevent the `.venv/` + `target/` + `_native.abi3.pyd` artifacts from getting committed. ## What's left in P2 CsiFrame + PoseEstimate bindings land in the next iteration. They're larger (CsiFrame has the subcarrier buffer; PoseEstimate has 17×Keypoint + BoundingBox + track_id + score). Pattern is now proven so they go faster. Refs #785, ADR-117 §6. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p2): BoundingBox + PersonPose + PoseEstimate — P2 COMPLETE (57/57 tests GREEN) Lands the second + third chunks of P2: PyO3 bindings for `BoundingBox`, `PersonPose`, `PoseEstimate` from `wifi_densepose_core`. Combined with the prior Keypoint + KeypointType bindings (fd0568caa), this closes ADR-117 §6 P2. ## Coverage | Type | Bound | Tests | Mutability | |---|---|---|---| | Confidence | exposed as `float` with validation | (covered in keypoint tests) | n/a | | KeypointType | `#[pyclass(eq, eq_int, hash, frozen)]` | 7 tests | immutable | | Keypoint | `#[pyclass(frozen)]` | 16 tests | immutable | | BoundingBox | `#[pyclass(frozen)]` | 8 tests | immutable | | PersonPose | `#[pyclass]` (mutable, builder-style) | 12 tests | mutable | | PoseEstimate | `#[pyclass(frozen)]` | 8 tests | immutable | Smoke (P1) + new tests: **57/57 PASS** locally on Windows. ## What's deferred to P3 CsiFrame intentionally NOT bound in P2 because it uses `Array2<Complex64>` (ndarray) — the natural Python surface is via the `numpy` pyo3 bridge, which lands in P3 alongside the vitals + signal DSP bindings. Binding CsiFrame without numpy interop would force users to materialise lists of tuples which is a worse API than `csi_frame.amplitude_array()` returning an ndarray. ## Design choices that affect the API surface 1. **PersonPose.keypoints() returns a dict keyed by KeypointType** instead of a fixed-length list with None slots. Pythonistas don't want to know the underlying storage is `[Option<Keypoint>; 17]`. 2. **PoseEstimate.id and .timestamp exposed as strings** (UUID + ISO) rather than as bound `FrameId` / `Timestamp` types. Users in notebooks rarely compare UUIDs structurally; strings are good enough for diagnostics and don't bloat the bindings. 3. **PersonPose is MUTABLE** (`#[pyclass]` without `frozen`) so users can build poses incrementally with `set_keypoint`/`set_bbox`/ `set_id`. PoseEstimate is `frozen` because once constructed it represents a snapshot. ## Three PyO3 0.22 gotchas surfaced this iteration 1. `#[pymethods]` getters are NOT accessible from other Rust modules — need a separate `impl PyKeypoint { pub(crate) fn inner(&self) -> &Keypoint { ... } }` block for cross-module use. 2. `PyDict::new(py)` was removed in PyO3 0.21 → 0.22 in favour of `PyDict::new_bound(py)`. (Confusing because `Bound<'py, PyDict>` is the return type either way.) 3. `dict.set_item(K, V)` requires both K and V to impl `ToPyObject`. `#[pyclass]` types impl `IntoPy<PyObject>` but NOT `ToPyObject` — workaround: convert via `.into_py(py)` first, then `set_item(py_object_k, py_object_v)`. Saved as PyO3 0.22 binding patterns memory at the horizon-tracker level so future loop workers don't re-learn them. ## Local validation \`\`\` $ cd python && .venv/Scripts/python -m pytest tests/ -v … ======================== 57 passed in 0.24s ========================= \`\`\` Wheel size: still ~340 KB on Windows release build. Refs #785, ADR-117 §6 (P2 done — ready for P3 vitals + signal DSP + numpy bridge + witness v2). Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-117): add BFLD support (§5.7a + P3.5 phase + §11.11/12 open questions) Per maintainer feedback during P3 implementation, expand ADR-117 to include Beamforming Feedback Loop Data (BFLD) as a first-class binding target alongside CSI. BFLD is the transmitter-side, AP-station-loop view of the WiFi channel (802.11ac/ax/be compressed beamforming feedback frames) — complementary to receiver-side CSI, with three properties that make it strategically important for the pip wheel: 1. **Up to 996 subcarriers per HE160 frame** (vs 242 for HE-LTF CSI on ESP32-C6, vs 52 for HT-LTF on ESP32-S3) — much denser per-subcarrier reflection profile 2. **Works on stock 802.11ac+ hardware** — no Nexmon patch, no ESP32 monitor mode, no firmware drift. Captured via tcpdump/Wireshark + BFR dissector, or via `mac80211` debugfs on Linux 6.10+ 3. **Direct input for the soul-signature spec** (`docs/research/soul/`) — the seven-channel biometric needs dense subcarrier reflection; BFLD provides it without specialized hardware ## Three additions to ADR-117 ### §5.7a — New binding-target subsection Comparison table CSI vs BFLD; binding strategy with forward-compat stub Rust impl pending the future `wifi-densepose-bfld` crate; the three Python types that ship in P3.5: - `BfldFrame` (frozen) — one compressed feedback matrix snapshot - `BfldReport` (frozen) — aggregator over a 60-s scan window - `BfldKind` enum — `CompressedHE20/40/80/160`, `UncompressedHT20/40` ### §6 P3.5 — Concurrent-with-P3 phase Checkbox plan for the bindings module + stub Rust storage + numpy bridge for `feedback_matrix` (Complex64 ndarray, same approach as `CsiFrame.amplitude` from P3). Lands in the same wheel as P3, no schedule cushion needed. ### §11.11/12 — Two new open questions - **§11.11** — Should the future BFR ingestion Rust crate be a new `wifi-densepose-bfld` workspace member, or extend `-signal`? *Tentative: new dedicated crate. Wireshark BFR dissector is ~2k lines and would bloat `-signal`; ingestion is optional for many deployments; keep `-signal` lean.* - **§11.12** — Per-vendor BFR variant compatibility (Broadcom vs Intel vs Qualcomm vs MediaTek differ in psi/phi quantization + matrix entry ordering). How much normalisation in the Python binding vs. the future Rust crate? *Tentative: Python binding is dumb (numpy ndarray in/out); future Rust crate owns per-vendor normalisation via a `Vendor` enum on the constructor.* ### §12 — BFLD reference list - Hernandez & Bulut, ACM TOSN 2024 (first systematic survey of BFR-as-sensing) - Yousefi et al., MobiSys 2023 (practical breath + HR extraction) - IEEE 802.11ax-2021 §27.3.10 (frame format) - Wireshark `packet-ieee80211.c` dissector - AX210 Linux mac80211 debugfs path (kernel 6.10+) ADR line count: 644 → 807 (+163). Refs #785 (tracking issue). The implementation work for P3.5 lands in the next /loop iteration alongside P3 vitals + signal DSP bindings. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p3+p3.5): vitals + BFLD bindings P3 — Vital sign extraction bindings (wifi-densepose-vitals): - VitalStatus enum (eq, eq_int, hash, frozen) — Valid/Degraded/Unreliable/Unavailable - VitalEstimate (frozen) — value_bpm + confidence + status - VitalReading (frozen) — HR + BR + signal quality composite - BreathingExtractor — 0.1–0.5 Hz bandpass + zero-crossing - HeartRateExtractor — 0.8–2.0 Hz bandpass + autocorrelation - py.allow_threads on extract() hot loops (Q5 audit confirmed core/vitals/signal are pure-sync — zero tokio deps, safe to release GIL with no embedded runtime needed) - 17 tests covering construction, getters, frozen immutability, esp32_default + explicit ctors, synthetic-signal end-to-end P3.5 — BFLD bindings (forward-compat surface, stub Rust): - BfldKind enum — CompressedHE20/40/80/160 + UncompressedHT20/40 with n_subcarriers, bandwidth_mhz, is_he metadata getters - BfldFrame (frozen) — from_compressed_feedback() accepts numpy Complex64 ndarray [Nr x Nc x Nsc], validates dims against kind, feedback_matrix() returns lossless roundtrip ndarray - BfldReport — aggregates frames, rejects mismatched kinds, computes inverse-CV coherence score - 19 tests covering all 6 PHY variants + numpy roundtrip + dim-mismatch error + aggregation - Real Rust ingestion (wifi-densepose-bfld crate) lands post-v2.0 per ADR-117 §11.11/12 — Python API will not change Total Python test count: 93 (was 57, +36 P3+P3.5). All passing. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p4): pure-Python WS/MQTT client layer New sub-package `wifi_densepose.client` (no PyO3, no Rust deps): - ws.SensingClient — asyncio websockets>=12 wrapper for the Rust sensing-server /ws/sensing endpoint. Yields typed dataclasses (ConnectionEstablishedMessage, EdgeVitalsMessage, PoseDataMessage) with raw-payload fallback for forward-compat with unknown types. Malformed frames log+drop without breaking the stream. - mqtt.RuViewMqttClient — paho-mqtt v2 wrapper using the explicit CallbackAPIVersion.VERSION2 API. Per-instance unique client_id by default (rumqttc memory lesson). MQTT v5-spec-correct topic wildcard matcher: + as whole-level wildcard, # matches the prefix itself plus all sub-levels. Auto-resubscribes on reconnect. Handler exceptions are caught and logged so a misbehaving callback can't crash the network loop. - primitives.SemanticPrimitiveListener — typed router for the 10 HA-MIND fused inference outputs from ADR-115 §3.12 (SomeoneSleeping, PossibleDistress, RoomActive, ElderlyInactivity- Anomaly, MeetingInProgress, BathroomOccupied, FallRiskElevated, BedExit, NoMovementSafety, MultiRoomTransition). Decodes both JSON payloads with confidence+explanation AND plain HA state strings ("ON"/"OFF"/numeric). Pluggable into RuViewMqttClient. - ha.HABlueprintHelper — read-only parser for the homeassistant/<kind>/wifi_densepose_<node>/<id>/config payload family. Aggregator queries: entities_for_node, by_device_class, nodes. Useful for blueprint authors + dashboard introspection. Test coverage (63 new tests, 156 total in Python suite): - test_client_ha — 18 tests (topic+payload parsing, aggregator) - test_client_primitives — 13 tests (enum coverage, listener routing) - test_client_mqtt — 17 tests (matcher parametrize, dispatch path, on_connect, exception isolation) — no broker needed - test_client_ws — 6 tests including end-to-end against an in-process websockets.serve() fixture exercising all 4 message types plus a malformed-frame survival check Post-bridge wheel size: 238 KB (well under ADR §5.4 5 MB budget). Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md §5.6 Refs: docs/adr/ADR-115-home-assistant-integration.md §3.12 Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117/p5+p-tomb): pip-release workflow + v1.99.0 tombstone wheel P5 — `.github/workflows/pip-release.yml`: - cibuildwheel matrix per ADR §5.4: manylinux x86_64 + aarch64, macos x86_64 + arm64, win amd64 (5 wheels via abi3-py310 stable ABI — one binary per OS/arch covers Python 3.10–3.13) - Linux aarch64 cross-builds via QEMU; rustup 1.82 pinned in CIBW_BEFORE_ALL_LINUX for reproducibility - Per-wheel smoke test: import wifi_densepose, assert hello()=="ok" - sdist via `maturin sdist` - Trigger: workflow_dispatch + push to `v*-pip` tags ONLY (never on regular commits — won't accidentally publish) - TestPyPI dry-run gate via `repository-url: https://test.pypi.org/legacy/` - Production PyPI publish via Trusted Publisher OIDC (no API tokens in GH secrets per ADR §9). Requires one-time PyPI Trusted Publisher registration before the first publish can fire. - Q3 (witness hash v2 — ADR-117 §11.3) flagged in workflow comments as a hard gate before the first tag. P-tomb — `python/tombstone/`: - Separate `wifi-densepose==1.99.0` sdist+wheel using setuptools backend (NOT maturin — tombstone is pure Python, no Rust). - `src/wifi_densepose/__init__.py` raises ImportError with the migration URL on import. Verified locally: 2.7 KB wheel, `pip install` then `import wifi_densepose` raises ImportError with `pip install wifi-densepose==2.0.0` hint + repo URL. - 5 unit tests (`tests/test_tombstone.py`) lock the file content down: must `raise ImportError`, must contain v2 install hint and migration URL, must NOT contain any `def`/`class`/`import` beyond the bare `raise` — so a well-intentioned refactor can't accidentally bloat the tombstone into a real module that loads partway before failing. Both wheels are published by the same pip-release.yml workflow: - `v1.99.0-pip` tag → publishes tombstone (or via workflow_dispatch with `target: v1-99-tombstone`) - `v2.X.Y-pip` tag → publishes the v2 wheel matrix Per ADR-117 §7.3: tag and publish 1.99.0-pip FIRST so the tombstone claims the "current" slot in pip's resolver, THEN publish 2.0.0-pip. Test count unchanged in main python/ suite (156/156). Tombstone sub-suite: 5 passing. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md §5.4, §7 Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * hardening(adr-117): benchmarks + security/robustness test suite Benchmarks (`python/bench/`, pytest-benchmark — opt-in via --benchmark-only): | Hot path | Mean | Ops/sec | % of 100 Hz budget | |---|---|---|---| | BfldFrame HT20 1×1×52 | 800 ns | 1.25 Mops | 0.008% | | BfldFrame HE20 2×1×242 | 1.3 μs | 750 kops | 0.013% | | BfldFrame HE80 2×1×996 | 4.2 μs | 236 kops | 0.042% | | BfldFrame HE160 2×2×1992 | 14 μs | 71 kops | 0.14% | | BfldFrame.feedback_matrix() | 2.8 μs | 352 kops | — | | WS edge_vitals decode | 7.4 μs | 134 kops | 0.074% | | WS pose_data decode (3 persons) | 23 μs | 42 kops | 0.24% | | BreathingExtractor.extract() 56sc | 28 μs | 35 kops | 0.28% | | BreathingExtractor.extract() 114sc | 44 μs | 23 kops | 0.44% | | BreathingExtractor.extract() 242sc | 79 μs | 13 kops | 0.79% | | HeartRateExtractor.extract() 56sc | 105 μs | 9.5 kops | 1.05% | All hot paths well under the 100 Hz ESP32 frame budget (10 ms). Worst case (HeartRateExtractor) uses 1% of the budget — no optimization needed. Scaling on n_subcarriers is sub-quadratic (56→242 = 4.3× input, 2.8× time) — catches future O(n²) regressions. Security & robustness tests (`tests/test_security.py`, +27 tests): - WS decoder: rejects non-object roots cleanly, survives 1 MB string values, handles non-ASCII node IDs, survives deeply-nested JSON (Python's json.loads built-in guard not bypassed) - MQTT topic matcher: 9 edge-case parametrize entries including $SYS topics, null-byte injection, mid-pattern `#` boundary, empty-string boundary - MQTT credential confidentiality: password never appears in repr()/str(), never stored in plain client-instance attribute - HA discovery: rejects null-byte-laced topics, rejects extra slashes in node_id, rejects non-dict payload body (list, scalar, invalid UTF-8 bytes) without crashing - Semantic primitive listener: rejects topic-injection attempts (prefix-injected paths, wrong case on final segment), survives invalid UTF-8 payloads - Public surface integrity: every name in wifi_densepose.__all__ AND wifi_densepose.client.__all__ resolves — catches accidental re-export breakage between phases - Multi-handler MQTT exception isolation: a crashing handler in the middle of the registered list doesn't stop later handlers from firing Test count: 156 → 183 (+27). All passing. Bench results steady-state confirm no Rust-binding-layer optimization is needed before the v2.0.0 publish. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * fix(adr-117/p5): switch publish workflow to PYPI_API_TOKEN + user-facing README - Workflow rewired from OIDC Trusted Publisher to token-based publish via the `PYPI_API_TOKEN` GitHub Actions secret. Both publish jobs (v2 wheels + tombstone) pass `password: ${{ secrets.PYPI_API_TOKEN }}` to `pypa/gh-action-pypi-publish@release/v1`. Workflow comments now document the GCP → GH secret-refresh command. - Removed `permissions: id-token: write` and the OIDC `environment:` blocks (no longer needed without OIDC). - Token was sourced from the GCP Secret Manager entry `PYPI_TOKEN` in project `cognitum-20260110` and pushed to GH Actions via `gcloud secrets versions access | gh secret set` so the value never appeared in a shell variable or this session's output. - Rewrote `python/README.md` from a developer phase-ledger into a user-facing PyPI front page: one-paragraph elevator pitch, bullet list of features, three short usage snippets (vitals extract, WS subscribe, MQTT semantic-primitive listener, BFLD numpy bridge), hardware table, links. The README is the FIRST thing pip users see at https://pypi.org/p/wifi-densepose so it has to introduce the project, not the build plan. Wheel rebuilds clean at 253 KB (was 238 KB — +15 KB from the richer README baked into the wheel metadata). Test suite unchanged at 183/183. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-117): point root README + user-guide at the v2 pip wheel - Root README — add Option 4 alongside the existing Docker / ESP32 / Cognitum Seed installs: `pip install "wifi-densepose[client]"` with a two-line import preview. - User-guide §Installation — replace the stale "From Source (Python)" block (which referenced legacy v1 extras `[gpu]` and `[all]` that don't exist in v2) with a brief "Python wheel (pip) — ADR-117" section: what the wheel is, install commands, two-line example, tombstone caveat, and the `maturin develop` source-build path for contributors. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * fix(adr-117/p5): pin Python 3.12 + isolated venv for tombstone smoke-test First v1.99.0-pip run (26366491748) failed: the runner's system `python` fell back to `--user` install, then `python -c "import wifi_densepose"` resolved to something other than the freshly-installed user-site wheel and returned cleanly instead of raising the tombstone ImportError. Fixes: - `actions/setup-python@v5` with explicit 3.12 — owns its own site- packages so pip won't fall back to --user. - New "Inspect wheel contents" step prints the wheel manifest + the verbatim __init__.py inside it. If a future regression ships an empty __init__.py from a setuptools src-layout edge case, the failure is debuggable from the run log alone. - Smoke test now runs in a fresh /tmp/smoke-venv so there's zero ambiguity about which wifi_densepose gets imported. Also uses importlib.util.find_spec to print the resolved origin path before the import attempt — so even if both checks pass, we see exactly which file we exercised. No code changes to the tombstone source itself. Co-Authored-By: claude-flow <ruv@ruv.net> * fix(adr-117/p5): smoke-test must cd out of repo root before importing Root cause from run 26366579422 diagnostics: the wheel built correctly (872 bytes, valid ImportError) but `import wifi_densepose` resolved to the legacy `./wifi_densepose/__init__.py` left in the repo root from v1, NOT to the freshly-installed tombstone wheel in the smoke venv. Python places the cwd at sys.path[0] for `python -c "..."`, so running the import from the repo root made the legacy directory win over site-packages every time. The "isolated venv" was not the problem — the cwd was. Fix: copy the wheel to /tmp, cd /tmp before the import. Now the smoke test runs in a directory that contains no `wifi_densepose/` so the only resolution path is the venv's site-packages. The repo-root `./wifi_densepose/__init__.py` is a separate concern (legacy v1 carry-over) that should be cleaned up in a follow-up commit, but the smoke test should not depend on it being absent. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-117): publish wifi-densepose 2.0.0a1 + ruview 2.0.0a1 to PyPI Three PyPI artifacts now live (published from .env-sourced PYPI_TOKEN via twine from the maintainer box — direct upload bypassed the GH Actions workflow auth churn): 1. wifi-densepose==1.99.0 — tombstone (raises ImportError with migration URL) https://pypi.org/project/wifi-densepose/1.99.0/ 2. wifi-densepose==2.0.0a1 — PyO3 wheel (win_amd64 cp310-abi3) + sdist https://pypi.org/project/wifi-densepose/2.0.0a1/ 3. ruview==2.0.0a1 — meta-package re-exporting wifi_densepose https://pypi.org/project/ruview/2.0.0a1/ New `python/ruview-meta/` subdirectory: - pyproject.toml — name="ruview", version="2.0.0a1", setuptools backend, dependencies = ["wifi-densepose==2.0.0a1"] - src/ruview/__init__.py — re-exports every name from `wifi_densepose.__all__` so `from ruview import BreathingExtractor` is equivalent to `from wifi_densepose import BreathingExtractor`. Also re-exports `__version__`, `__rust_version__`, `__rust_build_tag__`, `__build_features__`. Aliases the `client` sub-package transparently when wifi-densepose[client] extras are installed. - README.md — explains why two PyPI names ship the same code (brand vs technical name) and shows install commands for both. End-to-end verified: fresh venv, `pip install ruview`, `import ruview` + `import wifi_densepose` both succeed, `ruview.BreathingExtractor is wifi_densepose.BreathingExtractor` → True. Multi-platform wheels (manylinux x86_64+aarch64, macos x86_64+arm64) still pending — the cibuildwheel workflow path remains for that. Linux/macOS users today install via the sdist (requires rustup + maturin locally). Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #785 Co-Authored-By: claude-flow <ruv@ruv.net> * ci(adr-117): kics-compatible workflow comments + fix-marker guards - KICS error fix (.github/workflows/pip-release.yml:20): the inline `gcloud secrets versions access --secret=PYPI_TOKEN ...` runbook in the workflow header was triggering KICS' generic-secret regex on the literal `PYPI_TOKEN` substring. Moved the refresh runbook to docs/integrations/pypi-release.md (with the BOM-stripping `tr` step that fixed the production publish) and replaced the inline block with a pointer. - Three new fix-marker guards in scripts/fix-markers.json so the next person to touch this code can't silently regress what PR #786 just shipped: * RuView#786-tombstone-import — the tombstone __init__.py must `raise ImportError`, must mention the v2 install hint, must point at the repo URL, AND must NOT contain `def`/`class`/ `import wifi_densepose` (forbid patterns prevent accidental bloating into a real module that loads partway before failing). * RuView#786-tombstone-smoke-cwd — pip-release.yml must `cd /tmp` before the tombstone smoke-test import, because the legacy `./wifi_densepose/__init__.py` at repo root would otherwise shadow the venv install. This was the root cause of run 26366648768; locking it in. * RuView#786-pypi-token-auth — the workflow must use `password: ${{ secrets.PYPI_API_TOKEN }}` and must NOT carry `id-token: write`. The project authenticates via API token, not OIDC; a partial OIDC migration would 403 silently. Local check: all 25 markers pass. Refs: docs/adr/ADR-117-pip-wifi-densepose-modernization.md Refs: #786 Co-Authored-By: claude-flow <ruv@ruv.net>
2026-06-19 11:53:19 +00:00 · 2026-05-24 13:00:38 -04:00
parent 753f0a23b7
commit 0bffe27288
48 changed files with 8982 additions and 10 deletions
@@ -0,0 +1,344 @@
+//! ADR-117 P3.5 — Beamforming Feedback Loop Data (BFLD) bindings.
+//!
+//! BFLD is the transmitter-side, AP-station-loop view of the WiFi
+//! channel — compressed beamforming feedback frames that 802.11ac/ax/be
+//! stations send to the AP per sounding cycle. See ADR-117 §5.7a for
+//! the design rationale and ADR-117 §11.11/12 for open questions.
+//!
+//! **Important**: there is NO Rust ingestion crate for BFLD yet. The
+//! Python types in this module ship with a **stub Rust impl** that
+//! accepts pre-parsed feedback matrices via numpy. When the future
+//! `wifi-densepose-bfld` crate lands, it plugs in here without changing
+//! the Python API.
+//!
+//! Today's user path:
+//!
+//! 1. Capture BFR frames with `tcpdump` / Wireshark + the BFR dissector
+//!    (or via `mac80211` debugfs on Linux 6.10+)
+//! 2. Parse the compressed feedback into a numpy Complex64 ndarray
+//!    `[Nr × Nc × Nsc]` using your favourite Python BFR parser
+//! 3. Construct `BfldFrame.from_compressed_feedback(...)` to hand the
+//!    matrix to RuView
+//!
+//! Tomorrow (post-v2.0): `wifi-densepose-bfld` does steps 1+2 for you.
+
+use pyo3::prelude::*;
+use numpy::{Complex64, PyArray3, PyUntypedArrayMethods, PyReadonlyArray3};
+
+// ─── BfldKind ────────────────────────────────────────────────────────
+
+/// 802.11 PHY variant of the captured BFR frame. Determines the
+/// expected matrix dimensions + the quantization step of the
+/// compressed angles.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import BfldKind
+/// BfldKind.CompressedHE80   # 802.11ax 80 MHz compressed BFR
+/// ```
+#[pyclass(eq, eq_int, hash, frozen, name = "BfldKind")]
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
+pub enum PyBfldKind {
+    CompressedHE20 = 0,
+    CompressedHE40 = 1,
+    CompressedHE80 = 2,
+    CompressedHE160 = 3,
+    UncompressedHT20 = 4,
+    UncompressedHT40 = 5,
+}
+
+#[pymethods]
+impl PyBfldKind {
+    /// Expected number of subcarriers for this BFLD variant.
+    #[getter]
+    fn n_subcarriers(&self) -> usize {
+        match self {
+            Self::CompressedHE20 => 242,
+            Self::CompressedHE40 => 484,
+            Self::CompressedHE80 => 996,
+            Self::CompressedHE160 => 1992,
+            Self::UncompressedHT20 => 52,
+            Self::UncompressedHT40 => 108,
+        }
+    }
+
+    /// Bandwidth in MHz for this BFLD variant.
+    #[getter]
+    fn bandwidth_mhz(&self) -> u16 {
+        match self {
+            Self::CompressedHE20 | Self::UncompressedHT20 => 20,
+            Self::CompressedHE40 | Self::UncompressedHT40 => 40,
+            Self::CompressedHE80 => 80,
+            Self::CompressedHE160 => 160,
+        }
+    }
+
+    /// True for 802.11ax (HE) variants, false for legacy HT.
+    #[getter]
+    fn is_he(&self) -> bool {
+        matches!(
+            self,
+            Self::CompressedHE20
+                | Self::CompressedHE40
+                | Self::CompressedHE80
+                | Self::CompressedHE160
+        )
+    }
+
+    fn __repr__(&self) -> String {
+        let name = match self {
+            Self::CompressedHE20 => "CompressedHE20",
+            Self::CompressedHE40 => "CompressedHE40",
+            Self::CompressedHE80 => "CompressedHE80",
+            Self::CompressedHE160 => "CompressedHE160",
+            Self::UncompressedHT20 => "UncompressedHT20",
+            Self::UncompressedHT40 => "UncompressedHT40",
+        };
+        format!("BfldKind.{}", name)
+    }
+}
+
+// ─── BfldFrame ───────────────────────────────────────────────────────
+
+/// One BFR snapshot: a compressed beamforming feedback matrix tagged
+/// with metadata (timestamp, sounding sequence, source MAC, kind).
+///
+/// Backing storage: a numpy Complex64 ndarray `[Nr × Nc × Nsc]`. The
+/// Python constructor accepts the ndarray directly; under the hood we
+/// hold a `Vec<Complex64>` in row-major order.
+///
+/// Python:
+/// ```python
+/// import numpy as np
+/// from wifi_densepose import BfldFrame, BfldKind
+///
+/// fb = np.zeros((2, 1, 996), dtype=np.complex64)  # Nr=2, Nc=1, Nsc=996
+/// frame = BfldFrame.from_compressed_feedback(
+///     timestamp_ms=1234,
+///     sounding_index=42,
+///     sta_mac="aa:bb:cc:dd:ee:ff",
+///     kind=BfldKind.CompressedHE80,
+///     feedback_matrix=fb,
+/// )
+/// print(frame.n_subcarriers, frame.kind, frame.n_rows, frame.n_cols)
+/// ```
+#[pyclass(frozen, name = "BfldFrame")]
+pub struct PyBfldFrame {
+    timestamp_ms: i64,
+    sounding_index: u32,
+    sta_mac: String,
+    kind: PyBfldKind,
+    n_rows: usize,
+    n_cols: usize,
+    n_subcarriers: usize,
+    // Row-major storage of the [Nr × Nc × Nsc] complex matrix.
+    // Length = n_rows * n_cols * n_subcarriers.
+    matrix: Vec<Complex64>,
+}
+
+#[pymethods]
+impl PyBfldFrame {
+    /// Construct from a pre-parsed Complex64 ndarray of shape
+    /// `[n_rows, n_cols, n_subcarriers]`. The last dimension MUST
+    /// match `kind.n_subcarriers`.
+    #[staticmethod]
+    fn from_compressed_feedback<'py>(
+        timestamp_ms: i64,
+        sounding_index: u32,
+        sta_mac: &str,
+        kind: PyBfldKind,
+        feedback_matrix: PyReadonlyArray3<'py, Complex64>,
+    ) -> PyResult<Self> {
+        let shape = feedback_matrix.shape();
+        let n_rows = shape[0];
+        let n_cols = shape[1];
+        let n_subcarriers = shape[2];
+        let expected = kind.n_subcarriers();
+        if n_subcarriers != expected {
+            return Err(pyo3::exceptions::PyValueError::new_err(format!(
+                "feedback_matrix subcarrier dim {} does not match {:?}.n_subcarriers={}",
+                n_subcarriers, kind, expected
+            )));
+        }
+        // Copy into row-major Vec. This is the safe path; PyArray3 is
+        // also row-major by default.
+        let matrix: Vec<Complex64> = feedback_matrix
+            .as_array()
+            .iter()
+            .copied()
+            .collect();
+        Ok(Self {
+            timestamp_ms,
+            sounding_index,
+            sta_mac: sta_mac.to_string(),
+            kind,
+            n_rows,
+            n_cols,
+            n_subcarriers,
+            matrix,
+        })
+    }
+
+    #[getter]
+    fn timestamp_ms(&self) -> i64 { self.timestamp_ms }
+
+    #[getter]
+    fn sounding_index(&self) -> u32 { self.sounding_index }
+
+    #[getter]
+    fn sta_mac(&self) -> &str { &self.sta_mac }
+
+    #[getter]
+    fn kind(&self) -> PyBfldKind { self.kind }
+
+    #[getter]
+    fn n_rows(&self) -> usize { self.n_rows }
+
+    #[getter]
+    fn n_cols(&self) -> usize { self.n_cols }
+
+    #[getter]
+    fn n_subcarriers(&self) -> usize { self.n_subcarriers }
+
+    /// Mean amplitude across the entire matrix (sanity-check metric;
+    /// production-grade sensing pipelines look at per-subcarrier or
+    /// per-row stats instead).
+    #[getter]
+    fn mean_amplitude(&self) -> f64 {
+        if self.matrix.is_empty() {
+            return 0.0;
+        }
+        let sum: f64 = self.matrix.iter().map(|c| c.norm()).sum();
+        sum / self.matrix.len() as f64
+    }
+
+    /// Return the feedback matrix as a numpy Complex64 ndarray of
+    /// shape `[n_rows, n_cols, n_subcarriers]`. Allocates a fresh
+    /// Python-owned array; the BfldFrame keeps its own copy.
+    fn feedback_matrix<'py>(&self, py: Python<'py>) -> Bound<'py, PyArray3<Complex64>> {
+        PyArray3::from_vec3_bound(
+            py,
+            &self.reshape_to_vec3(),
+        )
+        .expect("Vec dimensions match the matrix shape — invariant of from_compressed_feedback")
+    }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "BfldFrame(kind={:?}, nr={}, nc={}, nsc={}, sta={}, idx={}, mean_amp={:.4})",
+            self.kind, self.n_rows, self.n_cols, self.n_subcarriers,
+            self.sta_mac, self.sounding_index, self.mean_amplitude(),
+        )
+    }
+}
+
+impl PyBfldFrame {
+    fn reshape_to_vec3(&self) -> Vec<Vec<Vec<Complex64>>> {
+        let mut out = Vec::with_capacity(self.n_rows);
+        for r in 0..self.n_rows {
+            let mut row = Vec::with_capacity(self.n_cols);
+            for c in 0..self.n_cols {
+                let start = (r * self.n_cols + c) * self.n_subcarriers;
+                let end = start + self.n_subcarriers;
+                row.push(self.matrix[start..end].to_vec());
+            }
+            out.push(row);
+        }
+        out
+    }
+}
+
+// ─── BfldReport ──────────────────────────────────────────────────────
+
+/// Aggregator over a window of `BfldFrame`s — the natural "all BFR
+/// data in this 60-second scan" container. Mirrors how `VitalReading`
+/// aggregates `VitalEstimate`s in the vitals pipeline.
+#[pyclass(name = "BfldReport")]
+pub struct PyBfldReport {
+    frames: Vec<u32>, // sounding indices we hold (don't deep-copy the matrices)
+    timestamp_first: Option<i64>,
+    timestamp_last: Option<i64>,
+    kind: Option<PyBfldKind>,
+    mean_amplitudes: Vec<f64>, // one per frame
+}
+
+#[pymethods]
+impl PyBfldReport {
+    #[new]
+    fn new() -> Self {
+        Self {
+            frames: Vec::new(),
+            timestamp_first: None,
+            timestamp_last: None,
+            kind: None,
+            mean_amplitudes: Vec::new(),
+        }
+    }
+
+    /// Add a frame to the report. All frames must share the same
+    /// `kind`; the call errors if they don't.
+    fn add_frame(&mut self, frame: &PyBfldFrame) -> PyResult<()> {
+        if let Some(k) = self.kind {
+            if k != frame.kind {
+                return Err(pyo3::exceptions::PyValueError::new_err(format!(
+                    "frame kind {:?} does not match report kind {:?}",
+                    frame.kind, k
+                )));
+            }
+        } else {
+            self.kind = Some(frame.kind);
+        }
+        self.frames.push(frame.sounding_index);
+        self.timestamp_first = Some(self.timestamp_first.unwrap_or(frame.timestamp_ms).min(frame.timestamp_ms));
+        self.timestamp_last = Some(self.timestamp_last.unwrap_or(frame.timestamp_ms).max(frame.timestamp_ms));
+        self.mean_amplitudes.push(frame.mean_amplitude());
+        Ok(())
+    }
+
+    #[getter]
+    fn n_frames(&self) -> usize { self.frames.len() }
+
+    #[getter]
+    fn timestamp_first(&self) -> Option<i64> { self.timestamp_first }
+
+    #[getter]
+    fn timestamp_last(&self) -> Option<i64> { self.timestamp_last }
+
+    #[getter]
+    fn kind(&self) -> Option<PyBfldKind> { self.kind }
+
+    /// Mean of the per-frame mean amplitudes — coarse sanity metric
+    /// for "the scan captured a stable signal over the window".
+    #[getter]
+    fn coherence_score(&self) -> f64 {
+        if self.mean_amplitudes.is_empty() {
+            return 0.0;
+        }
+        let mean = self.mean_amplitudes.iter().sum::<f64>()
+            / self.mean_amplitudes.len() as f64;
+        if mean == 0.0 {
+            return 0.0;
+        }
+        // Inverse coefficient of variation, clamped to [0, 1].
+        let var = self.mean_amplitudes.iter()
+            .map(|m| (m - mean).powi(2))
+            .sum::<f64>()
+            / self.mean_amplitudes.len() as f64;
+        let cv = var.sqrt() / mean;
+        (1.0 - cv.min(1.0)).max(0.0)
+    }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "BfldReport(n_frames={}, kind={:?}, coherence={:.3})",
+            self.frames.len(), self.kind, self.coherence_score(),
+        )
+    }
+}
+
+pub fn register(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add_class::<PyBfldKind>()?;
+    m.add_class::<PyBfldFrame>()?;
+    m.add_class::<PyBfldReport>()?;
+    Ok(())
+}
@@ -0,0 +1,291 @@
+//! ADR-117 P2 — PyO3 bindings for `wifi_densepose_core::Keypoint` +
+//! `KeypointType` + `Confidence`.
+//!
+//! Design notes (consequential for the Python API surface):
+//!
+//! 1. **`Confidence` is NOT bound as a separate Python class.** End
+//!    users hate having to construct a wrapper just to pass a float.
+//!    Python-side, confidence is just an `f32` in `[0.0, 1.0]`; the
+//!    binding validates on the way in.
+//!
+//! 2. **`KeypointType` is bound as a `#[pyclass]` enum** (PyO3 0.22
+//!    supports `#[pyclass(eq, eq_int)]` for C-like enums). Python-side
+//!    it surfaces as `wifi_densepose.KeypointType.Nose`, etc.
+//!
+//! 3. **`Keypoint` constructor accepts `z` as `Optional[float]`** so
+//!    Python users can pass `Keypoint(KeypointType.Nose, 0.5, 0.3,
+//!    0.95)` for 2D or `Keypoint(..., z=0.1)` for 3D.
+
+use pyo3::prelude::*;
+
+use wifi_densepose_core::{Confidence, Keypoint, KeypointType};
+
+// ─── KeypointType ────────────────────────────────────────────────────
+
+/// COCO-17 keypoint identifier — re-export of the Rust core enum.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import KeypointType
+/// kp = KeypointType.Nose
+/// print(kp.name)  # "Nose"
+/// ```
+// `hash` makes the enum hashable in Python (usable as dict keys + set
+// members) — derived from `Hash` on the Rust side. `frozen` is a
+// hard requirement for `hash` per pyo3 contract.
+#[pyclass(eq, eq_int, hash, frozen, name = "KeypointType")]
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+pub enum PyKeypointType {
+    Nose = 0,
+    LeftEye = 1,
+    RightEye = 2,
+    LeftEar = 3,
+    RightEar = 4,
+    LeftShoulder = 5,
+    RightShoulder = 6,
+    LeftElbow = 7,
+    RightElbow = 8,
+    LeftWrist = 9,
+    RightWrist = 10,
+    LeftHip = 11,
+    RightHip = 12,
+    LeftKnee = 13,
+    RightKnee = 14,
+    LeftAnkle = 15,
+    RightAnkle = 16,
+}
+
+#[pymethods]
+impl PyKeypointType {
+    /// Lowercase snake_case name (matches the COCO standard).
+    #[getter]
+    fn snake_name(&self) -> &'static str {
+        self.as_rust().name()
+    }
+
+    /// Integer index 0–16 (COCO ordering).
+    #[getter]
+    fn index(&self) -> u8 {
+        (*self).into()
+    }
+
+    /// True if this keypoint is on the face (nose, eyes, ears).
+    fn is_face(&self) -> bool {
+        self.as_rust().is_face()
+    }
+
+    /// True if this keypoint is in the upper body (shoulders, elbows, wrists).
+    fn is_upper_body(&self) -> bool {
+        self.as_rust().is_upper_body()
+    }
+
+    /// All 17 keypoint types in COCO order. Useful for Jupyter
+    /// enumeration: `for kp in KeypointType.all(): ...`.
+    #[staticmethod]
+    fn all() -> Vec<Self> {
+        KeypointType::all().iter().map(|k| PyKeypointType::from_rust(*k)).collect()
+    }
+
+    fn __repr__(&self) -> String {
+        format!("KeypointType.{:?}", self.as_rust())
+    }
+}
+
+impl PyKeypointType {
+    pub(crate) fn as_rust(&self) -> KeypointType {
+        // SAFETY equivalent: the enum variants line up 1:1 with the
+        // Rust enum's `#[repr(u8)]` discriminants. The match below is
+        // exhaustive on both sides so a future addition to either side
+        // fails to compile until the other is updated.
+        match self {
+            Self::Nose => KeypointType::Nose,
+            Self::LeftEye => KeypointType::LeftEye,
+            Self::RightEye => KeypointType::RightEye,
+            Self::LeftEar => KeypointType::LeftEar,
+            Self::RightEar => KeypointType::RightEar,
+            Self::LeftShoulder => KeypointType::LeftShoulder,
+            Self::RightShoulder => KeypointType::RightShoulder,
+            Self::LeftElbow => KeypointType::LeftElbow,
+            Self::RightElbow => KeypointType::RightElbow,
+            Self::LeftWrist => KeypointType::LeftWrist,
+            Self::RightWrist => KeypointType::RightWrist,
+            Self::LeftHip => KeypointType::LeftHip,
+            Self::RightHip => KeypointType::RightHip,
+            Self::LeftKnee => KeypointType::LeftKnee,
+            Self::RightKnee => KeypointType::RightKnee,
+            Self::LeftAnkle => KeypointType::LeftAnkle,
+            Self::RightAnkle => KeypointType::RightAnkle,
+        }
+    }
+
+    pub(crate) fn from_rust(k: KeypointType) -> Self {
+        match k {
+            KeypointType::Nose => Self::Nose,
+            KeypointType::LeftEye => Self::LeftEye,
+            KeypointType::RightEye => Self::RightEye,
+            KeypointType::LeftEar => Self::LeftEar,
+            KeypointType::RightEar => Self::RightEar,
+            KeypointType::LeftShoulder => Self::LeftShoulder,
+            KeypointType::RightShoulder => Self::RightShoulder,
+            KeypointType::LeftElbow => Self::LeftElbow,
+            KeypointType::RightElbow => Self::RightElbow,
+            KeypointType::LeftWrist => Self::LeftWrist,
+            KeypointType::RightWrist => Self::RightWrist,
+            KeypointType::LeftHip => Self::LeftHip,
+            KeypointType::RightHip => Self::RightHip,
+            KeypointType::LeftKnee => Self::LeftKnee,
+            KeypointType::RightKnee => Self::RightKnee,
+            KeypointType::LeftAnkle => Self::LeftAnkle,
+            KeypointType::RightAnkle => Self::RightAnkle,
+        }
+    }
+}
+
+impl From<PyKeypointType> for u8 {
+    fn from(k: PyKeypointType) -> u8 {
+        k as u8
+    }
+}
+
+impl PyKeypoint {
+    /// Rust-side accessor for the inner Keypoint (used by pose.rs).
+    /// Not exposed to Python — Python users go through the
+    /// #[pymethods] getters above.
+    pub(crate) fn inner(&self) -> &Keypoint {
+        &self.inner
+    }
+
+    /// Rust-side constructor from a core Keypoint (used by pose.rs
+    /// when re-wrapping outputs of PersonPose methods).
+    pub(crate) fn from_rust(k: Keypoint) -> Self {
+        Self { inner: k }
+    }
+}
+
+// ─── Keypoint ────────────────────────────────────────────────────────
+
+/// Single skeletal joint with COCO type, 2D-or-3D position, and a
+/// confidence score in [0.0, 1.0].
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import Keypoint, KeypointType
+///
+/// kp = Keypoint(KeypointType.Nose, 0.5, 0.3, 0.95)
+/// print(kp.x, kp.y, kp.confidence, kp.is_visible)
+///
+/// kp_3d = Keypoint(KeypointType.LeftWrist, 0.2, 0.4, 0.8, z=0.1)
+/// print(kp_3d.position_3d)  # (0.2, 0.4, 0.1)
+/// ```
+#[pyclass(frozen, name = "Keypoint")]
+#[derive(Clone)]
+pub struct PyKeypoint {
+    inner: Keypoint,
+}
+
+#[pymethods]
+impl PyKeypoint {
+    /// Construct a new keypoint. Confidence must be in [0.0, 1.0].
+    /// `z` is optional — omit for a 2D keypoint, supply for 3D.
+    #[new]
+    #[pyo3(signature = (keypoint_type, x, y, confidence, *, z=None))]
+    fn new(
+        keypoint_type: PyKeypointType,
+        x: f32,
+        y: f32,
+        confidence: f32,
+        z: Option<f32>,
+    ) -> PyResult<Self> {
+        let conf = Confidence::new(confidence).map_err(|e| {
+            pyo3::exceptions::PyValueError::new_err(e.to_string())
+        })?;
+        let inner = match z {
+            Some(zv) => Keypoint::new_3d(keypoint_type.as_rust(), x, y, zv, conf),
+            None => Keypoint::new(keypoint_type.as_rust(), x, y, conf),
+        };
+        Ok(Self { inner })
+    }
+
+    /// COCO keypoint type.
+    #[getter]
+    fn keypoint_type(&self) -> PyKeypointType {
+        PyKeypointType::from_rust(self.inner.keypoint_type)
+    }
+
+    /// X coordinate.
+    #[getter]
+    fn x(&self) -> f32 {
+        self.inner.x
+    }
+
+    /// Y coordinate.
+    #[getter]
+    fn y(&self) -> f32 {
+        self.inner.y
+    }
+
+    /// Z coordinate, or None for 2D keypoints.
+    #[getter]
+    fn z(&self) -> Option<f32> {
+        self.inner.z
+    }
+
+    /// Detection confidence in [0.0, 1.0].
+    #[getter]
+    fn confidence(&self) -> f32 {
+        self.inner.confidence.value()
+    }
+
+    /// True if this keypoint clears the default visibility threshold
+    /// (`confidence >= 0.5`).
+    #[getter]
+    fn is_visible(&self) -> bool {
+        self.inner.is_visible()
+    }
+
+    /// 2D position as a tuple `(x, y)`.
+    #[getter]
+    fn position_2d(&self) -> (f32, f32) {
+        self.inner.position_2d()
+    }
+
+    /// 3D position as a tuple `(x, y, z)`, or None for 2D keypoints.
+    #[getter]
+    fn position_3d(&self) -> Option<(f32, f32, f32)> {
+        self.inner.position_3d()
+    }
+
+    /// Euclidean distance to another keypoint. If both are 3D the
+    /// distance includes the z-axis; otherwise it's 2D only.
+    fn distance_to(&self, other: &PyKeypoint) -> f32 {
+        self.inner.distance_to(&other.inner)
+    }
+
+    fn __repr__(&self) -> String {
+        match self.inner.z {
+            Some(z) => format!(
+                "Keypoint(KeypointType.{:?}, x={}, y={}, z={}, confidence={:.4})",
+                self.inner.keypoint_type, self.inner.x, self.inner.y, z, self.inner.confidence.value()
+            ),
+            None => format!(
+                "Keypoint(KeypointType.{:?}, x={}, y={}, confidence={:.4})",
+                self.inner.keypoint_type, self.inner.x, self.inner.y, self.inner.confidence.value()
+            ),
+        }
+    }
+
+    fn __eq__(&self, other: &PyKeypoint) -> bool {
+        self.inner.keypoint_type == other.inner.keypoint_type
+            && self.inner.x == other.inner.x
+            && self.inner.y == other.inner.y
+            && self.inner.z == other.inner.z
+            && (self.inner.confidence.value() - other.inner.confidence.value()).abs() < f32::EPSILON
+    }
+}
+
+/// Register the binding types with the `_native` PyModule.
+pub fn register(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add_class::<PyKeypointType>()?;
+    m.add_class::<PyKeypoint>()?;
+    Ok(())
+}
@@ -0,0 +1,376 @@
+//! ADR-117 P2 — PyO3 bindings for `BoundingBox`, `PersonPose`,
+//! `PoseEstimate`.
+//!
+//! Design notes:
+//!
+//! 1. **`PersonPose` exposes the 17-keypoint array as a Python dict
+//!    keyed by `KeypointType`**, not as a fixed-length list with
+//!    `None` slots. Pythonistas don't want to know that the underlying
+//!    storage is `[Option<Keypoint>; 17]`.
+//!
+//! 2. **`PoseEstimate` metadata `id` and `timestamp` are exposed as
+//!    strings** (UUID + RFC 3339) rather than as bound types. Users
+//!    in notebooks rarely need to compare UUIDs structurally; strings
+//!    are good enough and don't require binding `FrameId` /
+//!    `Timestamp` as separate classes.
+//!
+//! 3. **`PersonPose` is mutable** via `set_keypoint` / `set_bbox` /
+//!    `set_id` — it's a builder-style type users construct
+//!    incrementally. Hence NOT `#[pyclass(frozen)]`.
+//!
+//! 4. **`PoseEstimate` is frozen** — once constructed, the list of
+//!    persons + the metadata don't change.
+
+use std::collections::HashMap;
+
+use pyo3::prelude::*;
+use pyo3::types::PyDict;
+
+use wifi_densepose_core::{
+    BoundingBox, Confidence, KeypointType, PersonPose, PoseEstimate,
+};
+
+use super::keypoint::{PyKeypoint, PyKeypointType};
+
+// ─── BoundingBox ─────────────────────────────────────────────────────
+
+/// Axis-aligned bounding box around a detected person.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import BoundingBox
+///
+/// bb = BoundingBox(0.1, 0.2, 0.5, 0.7)
+/// print(bb.width, bb.height, bb.area, bb.center)
+/// bb2 = BoundingBox.from_center(0.3, 0.45, 0.4, 0.5)
+/// print(bb.iou(bb2))
+/// ```
+#[pyclass(frozen, name = "BoundingBox")]
+#[derive(Clone)]
+pub struct PyBoundingBox {
+    inner: BoundingBox,
+}
+
+#[pymethods]
+impl PyBoundingBox {
+    #[new]
+    fn new(x_min: f32, y_min: f32, x_max: f32, y_max: f32) -> Self {
+        Self { inner: BoundingBox::new(x_min, y_min, x_max, y_max) }
+    }
+
+    /// Construct from center point + width + height.
+    #[staticmethod]
+    fn from_center(cx: f32, cy: f32, width: f32, height: f32) -> Self {
+        Self { inner: BoundingBox::from_center(cx, cy, width, height) }
+    }
+
+    #[getter]
+    fn x_min(&self) -> f32 { self.inner.x_min }
+    #[getter]
+    fn y_min(&self) -> f32 { self.inner.y_min }
+    #[getter]
+    fn x_max(&self) -> f32 { self.inner.x_max }
+    #[getter]
+    fn y_max(&self) -> f32 { self.inner.y_max }
+    #[getter]
+    fn width(&self) -> f32 { self.inner.width() }
+    #[getter]
+    fn height(&self) -> f32 { self.inner.height() }
+    #[getter]
+    fn area(&self) -> f32 { self.inner.area() }
+    #[getter]
+    fn center(&self) -> (f32, f32) { self.inner.center() }
+
+    /// Intersection over Union (IoU) with another box. Range [0.0, 1.0].
+    fn iou(&self, other: &PyBoundingBox) -> f32 {
+        self.inner.iou(&other.inner)
+    }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "BoundingBox(x_min={}, y_min={}, x_max={}, y_max={})",
+            self.inner.x_min, self.inner.y_min, self.inner.x_max, self.inner.y_max,
+        )
+    }
+
+    fn __eq__(&self, other: &PyBoundingBox) -> bool {
+        self.inner == other.inner
+    }
+}
+
+impl PyBoundingBox {
+    pub(crate) fn from_rust(bb: BoundingBox) -> Self {
+        Self { inner: bb }
+    }
+}
+
+// ─── PersonPose ──────────────────────────────────────────────────────
+
+/// A single detected person with optional ID, up to 17 keypoints, and
+/// an optional bounding box.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import PersonPose, Keypoint, KeypointType, BoundingBox
+///
+/// pose = PersonPose()
+/// pose.set_keypoint(Keypoint(KeypointType.Nose, 0.5, 0.3, 0.95))
+/// pose.set_keypoint(Keypoint(KeypointType.LeftShoulder, 0.4, 0.5, 0.92))
+/// pose.set_id(7)
+/// print(pose.visible_keypoint_count)         # 2
+/// print(pose.get_keypoint(KeypointType.Nose).confidence)  # 0.95
+/// print(pose.compute_bounding_box())          # auto-derived from visible kp
+/// ```
+#[pyclass(name = "PersonPose")]
+#[derive(Clone)]
+pub struct PyPersonPose {
+    inner: PersonPose,
+}
+
+#[pymethods]
+impl PyPersonPose {
+    /// Construct an empty person pose. Set keypoints + bbox + id with
+    /// the dedicated methods.
+    #[new]
+    fn new() -> Self {
+        Self { inner: PersonPose::new() }
+    }
+
+    /// Per-person track ID. None until set.
+    #[getter]
+    fn id(&self) -> Option<u32> {
+        self.inner.id
+    }
+
+    fn set_id(&mut self, id: u32) {
+        self.inner.id = Some(id);
+    }
+
+    /// Set or replace a keypoint. The keypoint's type determines its
+    /// slot in the internal 17-element array.
+    fn set_keypoint(&mut self, keypoint: PyKeypoint) {
+        self.inner.set_keypoint(*keypoint.inner());
+    }
+
+    /// Get a keypoint by type, or None if not set.
+    fn get_keypoint(&self, keypoint_type: PyKeypointType) -> Option<PyKeypoint> {
+        let kp = self.inner.get_keypoint(keypoint_type.as_rust())?;
+        // Re-wrap the inner Rust Keypoint for Python.
+        Some(PyKeypoint::from_rust(*kp))
+    }
+
+    /// All keypoints as a dict keyed by KeypointType. Missing
+    /// keypoints are omitted (NOT included with None values).
+    fn keypoints<'py>(&self, py: Python<'py>) -> PyResult<Bound<'py, PyDict>> {
+        // PyO3 0.22 — PyDict::new_bound returns a Bound, the legacy
+        // PyDict::new (returning &PyDict) was removed in 0.21.
+        let dict = PyDict::new_bound(py);
+        for (i, kp_opt) in self.inner.keypoints.iter().enumerate() {
+            if let Some(kp) = kp_opt {
+                let kpt = match KeypointType::all().get(i) {
+                    Some(t) => *t,
+                    None => continue,
+                };
+                // Convert through IntoPy to satisfy ToPyObject bound
+                // for dict.set_item — #[pyclass] types impl IntoPy but
+                // not ToPyObject directly in PyO3 0.22.
+                use pyo3::IntoPy;
+                let k_obj: PyObject = PyKeypointType::from_rust(kpt).into_py(py);
+                let v_obj: PyObject = PyKeypoint::from_rust(*kp).into_py(py);
+                dict.set_item(k_obj, v_obj)?;
+            }
+        }
+        Ok(dict)
+    }
+
+    /// Number of visible keypoints (confidence >= 0.5).
+    #[getter]
+    fn visible_keypoint_count(&self) -> usize {
+        self.inner.visible_keypoint_count()
+    }
+
+    /// List of visible keypoints (subset of the dict from
+    /// `keypoints()`).
+    fn visible_keypoints(&self) -> Vec<PyKeypoint> {
+        self.inner
+            .visible_keypoints()
+            .into_iter()
+            .map(|k| PyKeypoint::from_rust(*k))
+            .collect()
+    }
+
+    /// Bounding box, if previously set or computed.
+    #[getter]
+    fn bounding_box(&self) -> Option<PyBoundingBox> {
+        self.inner.bounding_box.map(PyBoundingBox::from_rust)
+    }
+
+    fn set_bounding_box(&mut self, bb: PyBoundingBox) {
+        self.inner.bounding_box = Some(bb.inner);
+    }
+
+    /// Auto-compute bounding box from visible keypoints, set it
+    /// internally, and return it. Returns None if no keypoints visible.
+    fn compute_bounding_box(&mut self) -> Option<PyBoundingBox> {
+        let bb = self.inner.compute_bounding_box()?;
+        self.inner.bounding_box = Some(bb);
+        Some(PyBoundingBox::from_rust(bb))
+    }
+
+    /// Overall confidence in [0.0, 1.0].
+    #[getter]
+    fn confidence(&self) -> f32 {
+        self.inner.confidence.value()
+    }
+
+    fn set_confidence(&mut self, c: f32) -> PyResult<()> {
+        self.inner.confidence = Confidence::new(c).map_err(|e| {
+            pyo3::exceptions::PyValueError::new_err(e.to_string())
+        })?;
+        Ok(())
+    }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "PersonPose(id={:?}, visible_keypoints={}, confidence={:.4})",
+            self.inner.id,
+            self.inner.visible_keypoint_count(),
+            self.inner.confidence.value(),
+        )
+    }
+}
+
+impl PyPersonPose {
+    pub(crate) fn from_rust(pose: PersonPose) -> Self {
+        Self { inner: pose }
+    }
+}
+
+// ─── PoseEstimate ────────────────────────────────────────────────────
+
+/// Top-level result of a pose-estimation pass — a list of detected
+/// persons plus metadata about the inference run.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import PoseEstimate, PersonPose
+///
+/// est = PoseEstimate([pose1, pose2], confidence=0.87, latency_ms=8.4,
+///                    model_version="v0.1.0")
+/// print(est.person_count, est.has_detections)
+/// best = est.highest_confidence_person()
+/// ```
+#[pyclass(frozen, name = "PoseEstimate")]
+pub struct PyPoseEstimate {
+    inner: PoseEstimate,
+}
+
+#[pymethods]
+impl PyPoseEstimate {
+    /// Construct a pose estimate from a list of detected persons,
+    /// an overall confidence, inference latency, and model version
+    /// string.
+    #[new]
+    fn new(
+        persons: Vec<PyPersonPose>,
+        confidence: f32,
+        latency_ms: f32,
+        model_version: String,
+    ) -> PyResult<Self> {
+        let conf = Confidence::new(confidence).map_err(|e| {
+            pyo3::exceptions::PyValueError::new_err(e.to_string())
+        })?;
+        let rust_persons: Vec<PersonPose> =
+            persons.into_iter().map(|p| p.inner).collect();
+        Ok(Self {
+            inner: PoseEstimate::new(
+                Vec::new(),
+                rust_persons,
+                conf,
+                latency_ms,
+                model_version,
+            ),
+        })
+    }
+
+    /// Unique frame identifier as a UUID string.
+    #[getter]
+    fn id(&self) -> String {
+        format!("{:?}", self.inner.id)
+            .trim_start_matches("FrameId(")
+            .trim_end_matches(')')
+            .to_string()
+    }
+
+    /// Frame timestamp as an RFC 3339 / ISO 8601 string in UTC.
+    #[getter]
+    fn timestamp(&self) -> String {
+        // Timestamp's Debug impl is usable; for a fully spec-compliant
+        // ISO format, a future refactor binds chrono. P2 string-form
+        // is "good enough" for diagnostics.
+        format!("{:?}", self.inner.timestamp)
+    }
+
+    #[getter]
+    fn persons(&self) -> Vec<PyPersonPose> {
+        self.inner.persons.iter().cloned().map(PyPersonPose::from_rust).collect()
+    }
+
+    #[getter]
+    fn confidence(&self) -> f32 {
+        self.inner.confidence.value()
+    }
+
+    #[getter]
+    fn latency_ms(&self) -> f32 {
+        self.inner.latency_ms
+    }
+
+    #[getter]
+    fn model_version(&self) -> &str {
+        &self.inner.model_version
+    }
+
+    #[getter]
+    fn person_count(&self) -> usize {
+        self.inner.person_count()
+    }
+
+    #[getter]
+    fn has_detections(&self) -> bool {
+        self.inner.has_detections()
+    }
+
+    /// Get the person with the highest individual confidence, or None
+    /// if no persons detected.
+    fn highest_confidence_person(&self) -> Option<PyPersonPose> {
+        self.inner
+            .highest_confidence_person()
+            .cloned()
+            .map(PyPersonPose::from_rust)
+    }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "PoseEstimate(persons={}, confidence={:.4}, latency_ms={:.2}, model_version={:?})",
+            self.inner.person_count(),
+            self.inner.confidence.value(),
+            self.inner.latency_ms,
+            self.inner.model_version,
+        )
+    }
+}
+
+/// Suppress unused-import warnings for HashMap (held for future
+/// keypoint-map helpers in P3).
+#[allow(dead_code)]
+fn _hashmap_kept_for_future_use() -> HashMap<u8, u8> {
+    HashMap::new()
+}
+
+pub fn register(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add_class::<PyBoundingBox>()?;
+    m.add_class::<PyPersonPose>()?;
+    m.add_class::<PyPoseEstimate>()?;
+    Ok(())
+}
@@ -0,0 +1,287 @@
+//! ADR-117 P3 — PyO3 bindings for `wifi_densepose_vitals`.
+//!
+//! Surfaces:
+//!
+//! - `VitalStatus` enum — clinical-grade / degraded / unreliable / unavailable
+//! - `VitalEstimate` — single BPM estimate + confidence + status
+//! - `VitalReading` — combined HR + BR + signal quality snapshot
+//! - `BreathingExtractor` — bandpass 0.1–0.5 Hz → respiratory rate
+//! - `HeartRateExtractor` — bandpass 0.8–2.0 Hz + autocorrelation → HR
+//!
+//! ## GIL release strategy (per ADR-117 §7 and the Q5 audit on
+//! 2026-05-24)
+//!
+//! `wifi-densepose-vitals` has zero tokio deps and the extract loops
+//! are pure-sync DSP. Wrap the `.extract(...)` calls in
+//! `py.allow_threads(|| ...)` so Python users can run inference in a
+//! tokio-backed web server without GIL contention starving the
+//! event loop.
+
+use pyo3::prelude::*;
+
+use wifi_densepose_vitals::{
+    BreathingExtractor, HeartRateExtractor, VitalEstimate, VitalReading, VitalStatus,
+};
+
+// ─── VitalStatus enum ────────────────────────────────────────────────
+
+/// Status of a vital sign measurement.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import VitalStatus
+/// VitalStatus.Valid       # clinical-grade
+/// VitalStatus.Degraded    # reduced confidence
+/// VitalStatus.Unreliable  # single RSSI source / low quality
+/// VitalStatus.Unavailable # no measurement possible
+/// ```
+#[pyclass(eq, eq_int, hash, frozen, name = "VitalStatus")]
+#[derive(Clone, Copy, PartialEq, Eq, Hash)]
+pub enum PyVitalStatus {
+    Valid = 0,
+    Degraded = 1,
+    Unreliable = 2,
+    Unavailable = 3,
+}
+
+#[pymethods]
+impl PyVitalStatus {
+    fn __repr__(&self) -> String {
+        format!("VitalStatus.{:?}", self.as_rust())
+    }
+}
+
+impl PyVitalStatus {
+    fn as_rust(&self) -> VitalStatus {
+        match self {
+            Self::Valid => VitalStatus::Valid,
+            Self::Degraded => VitalStatus::Degraded,
+            Self::Unreliable => VitalStatus::Unreliable,
+            Self::Unavailable => VitalStatus::Unavailable,
+        }
+    }
+
+    fn from_rust(s: VitalStatus) -> Self {
+        match s {
+            VitalStatus::Valid => Self::Valid,
+            VitalStatus::Degraded => Self::Degraded,
+            VitalStatus::Unreliable => Self::Unreliable,
+            VitalStatus::Unavailable => Self::Unavailable,
+        }
+    }
+}
+
+// ─── VitalEstimate ───────────────────────────────────────────────────
+
+/// A single vital-sign estimate (BPM + confidence + status).
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import VitalEstimate, VitalStatus
+/// est = VitalEstimate(72.4, confidence=0.9, status=VitalStatus.Valid)
+/// print(est.value_bpm, est.confidence, est.status)
+/// ```
+#[pyclass(frozen, name = "VitalEstimate")]
+#[derive(Clone)]
+pub struct PyVitalEstimate {
+    inner: VitalEstimate,
+}
+
+#[pymethods]
+impl PyVitalEstimate {
+    #[new]
+    fn new(value_bpm: f64, confidence: f64, status: PyVitalStatus) -> Self {
+        Self {
+            inner: VitalEstimate {
+                value_bpm,
+                confidence,
+                status: status.as_rust(),
+            },
+        }
+    }
+
+    #[getter]
+    fn value_bpm(&self) -> f64 { self.inner.value_bpm }
+
+    #[getter]
+    fn confidence(&self) -> f64 { self.inner.confidence }
+
+    #[getter]
+    fn status(&self) -> PyVitalStatus { PyVitalStatus::from_rust(self.inner.status) }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "VitalEstimate(value_bpm={:.2}, confidence={:.3}, status={:?})",
+            self.inner.value_bpm, self.inner.confidence, self.inner.status,
+        )
+    }
+}
+
+impl PyVitalEstimate {
+    fn from_rust(e: VitalEstimate) -> Self {
+        Self { inner: e }
+    }
+}
+
+// ─── VitalReading ────────────────────────────────────────────────────
+
+/// Combined HR + BR snapshot from one window of CSI data.
+#[pyclass(frozen, name = "VitalReading")]
+pub struct PyVitalReading {
+    inner: VitalReading,
+}
+
+#[pymethods]
+impl PyVitalReading {
+    #[new]
+    fn new(
+        respiratory_rate: PyVitalEstimate,
+        heart_rate: PyVitalEstimate,
+        subcarrier_count: usize,
+        signal_quality: f64,
+        timestamp_secs: f64,
+    ) -> Self {
+        Self {
+            inner: VitalReading {
+                respiratory_rate: respiratory_rate.inner,
+                heart_rate: heart_rate.inner,
+                subcarrier_count,
+                signal_quality,
+                timestamp_secs,
+            },
+        }
+    }
+
+    #[getter]
+    fn respiratory_rate(&self) -> PyVitalEstimate {
+        PyVitalEstimate::from_rust(self.inner.respiratory_rate.clone())
+    }
+
+    #[getter]
+    fn heart_rate(&self) -> PyVitalEstimate {
+        PyVitalEstimate::from_rust(self.inner.heart_rate.clone())
+    }
+
+    #[getter]
+    fn subcarrier_count(&self) -> usize { self.inner.subcarrier_count }
+
+    #[getter]
+    fn signal_quality(&self) -> f64 { self.inner.signal_quality }
+
+    #[getter]
+    fn timestamp_secs(&self) -> f64 { self.inner.timestamp_secs }
+
+    fn __repr__(&self) -> String {
+        format!(
+            "VitalReading(br={:.1}, hr={:.1}, subcarriers={}, quality={:.3})",
+            self.inner.respiratory_rate.value_bpm,
+            self.inner.heart_rate.value_bpm,
+            self.inner.subcarrier_count,
+            self.inner.signal_quality,
+        )
+    }
+}
+
+// ─── BreathingExtractor ──────────────────────────────────────────────
+
+/// Extracts respiratory rate (6–30 BPM) from per-subcarrier amplitude
+/// residuals via 0.1–0.5 Hz bandpass + zero-crossing analysis.
+///
+/// Python:
+/// ```python
+/// from wifi_densepose import BreathingExtractor
+///
+/// br = BreathingExtractor.esp32_default()  # 56 subcarriers, 100 Hz, 30s window
+/// # or: BreathingExtractor(n_subcarriers=56, sample_rate=100.0, window_secs=30.0)
+///
+/// # Feed residuals from your preprocessor (one frame at a time)
+/// est = br.extract(residuals=[0.01, -0.02, …], weights=[])  # equal weights
+/// if est is not None:
+///     print(est.value_bpm, est.confidence)
+/// ```
+#[pyclass(name = "BreathingExtractor")]
+pub struct PyBreathingExtractor {
+    inner: BreathingExtractor,
+}
+
+#[pymethods]
+impl PyBreathingExtractor {
+    /// Construct with explicit parameters.
+    #[new]
+    #[pyo3(signature = (n_subcarriers, sample_rate, window_secs=30.0))]
+    fn new(n_subcarriers: usize, sample_rate: f64, window_secs: f64) -> Self {
+        Self {
+            inner: BreathingExtractor::new(n_subcarriers, sample_rate, window_secs),
+        }
+    }
+
+    /// ESP32 defaults: 56 subcarriers, 100 Hz, 30-second window.
+    #[staticmethod]
+    fn esp32_default() -> Self {
+        Self { inner: BreathingExtractor::esp32_default() }
+    }
+
+    /// Extract respiratory rate from a vector of per-subcarrier
+    /// residuals + per-subcarrier weights. GIL is released during the
+    /// DSP loop so Python threads can do other work concurrently.
+    ///
+    /// Returns `None` if insufficient history has been accumulated.
+    fn extract(&mut self, py: Python<'_>, residuals: Vec<f64>, weights: Vec<f64>) -> Option<PyVitalEstimate> {
+        // GIL release: see ADR-117 §7 and the Q5 tokio audit. The DSP
+        // loop is pure sync, no Python objects touched, safe to run
+        // without the GIL.
+        let est = py.allow_threads(|| self.inner.extract(&residuals, &weights));
+        est.map(PyVitalEstimate::from_rust)
+    }
+
+    fn __repr__(&self) -> String {
+        format!("BreathingExtractor(0.1–0.5 Hz bandpass)")
+    }
+}
+
+// ─── HeartRateExtractor ──────────────────────────────────────────────
+
+/// Extracts heart rate (40–120 BPM) from per-subcarrier amplitude
+/// residuals via 0.8–2.0 Hz bandpass + autocorrelation peak detection.
+#[pyclass(name = "HeartRateExtractor")]
+pub struct PyHeartRateExtractor {
+    inner: HeartRateExtractor,
+}
+
+#[pymethods]
+impl PyHeartRateExtractor {
+    /// Construct with explicit parameters.
+    #[new]
+    #[pyo3(signature = (n_subcarriers, sample_rate, window_secs=15.0))]
+    fn new(n_subcarriers: usize, sample_rate: f64, window_secs: f64) -> Self {
+        Self {
+            inner: HeartRateExtractor::new(n_subcarriers, sample_rate, window_secs),
+        }
+    }
+
+    /// ESP32 defaults: 56 subcarriers, 100 Hz, 15-second window.
+    #[staticmethod]
+    fn esp32_default() -> Self {
+        Self { inner: HeartRateExtractor::esp32_default() }
+    }
+
+    /// Extract heart rate from per-subcarrier residuals. GIL released
+    /// during DSP.
+    fn extract(&mut self, py: Python<'_>, residuals: Vec<f64>, weights: Vec<f64>) -> Option<PyVitalEstimate> {
+        let est = py.allow_threads(|| self.inner.extract(&residuals, &weights));
+        est.map(PyVitalEstimate::from_rust)
+    }
+
+    fn __repr__(&self) -> String {
+        format!("HeartRateExtractor(0.8–2.0 Hz bandpass)")
+    }
+}
+
+pub fn register(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add_class::<PyVitalStatus>()?;
+    m.add_class::<PyVitalEstimate>()?;
+    m.add_class::<PyVitalReading>()?;
+    m.add_class::<PyBreathingExtractor>()?;
+    m.add_class::<PyHeartRateExtractor>()?;
+    Ok(())
+}
@@ -0,0 +1,84 @@
+//! ADR-117 — PyO3 bindings for the WiFi-DensePose Rust core.
+//!
+//! This crate is the compiled half of the `wifi-densepose` v2.x PyPI
+//! wheel. The Python-facing facade lives in `python/wifi_densepose/`
+//! and re-exports symbols from this module under their stable names.
+//!
+//! ## Phase status (per ADR-117 §6)
+//!
+//! - **P1 (scaffold) — this commit**: module loads, version constant
+//!   exposed, smoke test passes via maturin develop.
+//! - **P2**: bind `CsiFrame`, `Keypoint`, `PoseEstimate` (next).
+//! - **P3**: bind 4-stage vitals + signal DSP.
+//! - **P4**: pure-Python `wifi_densepose.client` (WS/MQTT) — no Rust
+//!   surface needed; lives outside this crate.
+//! - **P5**: cibuildwheel + PyPI publish.
+
+use pyo3::prelude::*;
+
+mod bindings {
+    pub mod bfld;
+    pub mod keypoint;
+    pub mod pose;
+    pub mod vitals;
+}
+
+/// Version of the bound Rust core. Surfaced to Python as
+/// `wifi_densepose.__rust_version__` so users can correlate wheel
+/// behaviour with the exact `v2/crates/` HEAD it was built from.
+const RUST_CORE_VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Compile-time identifier for the Rust commit that produced this
+/// wheel. Surfaced for diagnostics. Set via `CARGO_PKG_VERSION` for
+/// now; P5 wires in the git SHA via `vergen`.
+const RUST_BUILD_TAG: &str = env!("CARGO_PKG_VERSION");
+
+/// One-line description of which feature flags were enabled at build
+/// time. Helps users debug "is my wheel the slim one or the full one?".
+fn build_features() -> Vec<&'static str> {
+    let mut feats: Vec<&'static str> = Vec::new();
+    feats.push("p1-scaffold");
+    feats.push("p2-keypoint-bindings"); // Keypoint + KeypointType
+    feats.push("p2-pose-bindings"); // BoundingBox + PersonPose + PoseEstimate
+    feats.push("p3-vitals-bindings"); // BreathingExtractor + HeartRateExtractor + VitalEstimate
+    feats.push("p3.5-bfld-bindings"); // BfldFrame + BfldReport + BfldKind (stub Rust)
+    feats
+}
+
+/// Quick smoke test exposed to Python. Returns "ok" — used by the
+/// integration tests in `python/tests/test_smoke.py` to assert the
+/// PyO3 module is importable and callable.
+#[pyfunction]
+fn hello() -> PyResult<&'static str> {
+    Ok("ok")
+}
+
+/// The `_native` module — re-exported in pure-Python as
+/// `wifi_densepose._native`. End users should import the parent
+/// package (`import wifi_densepose`) and never reach into `_native`
+/// directly; the leading underscore is a Python convention marking
+/// it as private.
+///
+/// The function name MUST match the `module-name` in pyproject.toml's
+/// `[tool.maturin]` block — i.e. it must be `_native` because the
+/// pyproject says `module-name = "wifi_densepose._native"`. PyO3
+/// generates the `PyInit__native` symbol from this function name.
+#[pymodule]
+#[pyo3(name = "_native")]
+fn wifi_densepose_native(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add("__rust_version__", RUST_CORE_VERSION)?;
+    m.add("__rust_build_tag__", RUST_BUILD_TAG)?;
+    m.add("__build_features__", build_features())?;
+    m.add_function(wrap_pyfunction!(hello, m)?)?;
+
+    // P2 — Keypoint + KeypointType bindings.
+    bindings::keypoint::register(m)?;
+    // P2 — BoundingBox + PersonPose + PoseEstimate bindings.
+    bindings::pose::register(m)?;
+    // P3 — Vital sign extraction bindings.
+    bindings::vitals::register(m)?;
+    // P3.5 — BFLD bindings (stub Rust; future wifi-densepose-bfld crate
+    // will replace the stub without changing the Python API).
+    bindings::bfld::register(m)?;
+    Ok(())
+}