mirror of
https://github.com/ruvnet/RuView
synced 2026-07-31 18:51:42 +00:00
feat(ADR-262 P3): live /api/field + /ws/field — RuView sensing speaks RuField (fail-closed egress) (#1071)
* feat(ADR-262 P3): live RuField surface — RuView sensing speaks RuField on /api/field + /ws/field Wire the P1 `wifi-densepose-rufield` bridge into the live `wifi-densepose-sensing-server` so the governed sensing cycle emits real signed RuField `FieldEvent`s on two additive endpoints. - Cargo: add the `wifi-densepose-rufield` path dep (the single coupling point, ADR-262 §5.4 — no new RuView-internal coupling). - New `src/rufield_surface.rs` (kept out of the 8k-line main.rs): `FieldSurface` holds a dedicated ed25519 `Signer` + a bounded ring of recent events + the `/ws/field` broadcast topic; `GET /api/field` and `GET /ws/field` handlers; a standalone `router()` for isolated testing. - Signer (defers the P2 key decision, ADR-262 §8 Q1): a STANDALONE dev/sensing key from `WDP_RUFIELD_SIGNING_SEED`, else a deterministic dev default with a logged WARN. Reusing the `cog-ha-matter` Ed25519 key is the deferred P2 call — P3 does not pre-empt it. - Tap: at the ESP32 governed-trust cycle (`main.rs` ~5886 observe_cycle / ~5938 SensingUpdate build), `emit_rufield_event` joins the cycle's features/classification/signal_field with the engine's effective_class/demoted trust state into a `SensingSnapshot` and surfaces it via the bridge. Existing endpoints (`/ws/sensing` etc.) are unchanged — purely additive. - Privacy egress: `network_egress_allowed` is fail-closed for an unattended live surface — only P1/P2 leave the box; P0 raw and P3/P4/P5 (identity/biometric/aggregate) are held edge-local. A `Derived` cycle maps to P4/P5 and never surfaces. - No-phantom: `emit` drops no-presence cycles (no fabricated events). Gates (tests/rufield_surface_test.rs, tower::oneshot, 4/0): well-formed signed event (WifiCsi, P2 not P1, is_fusable, real timestamp); empty cycle → no phantom; Derived trust never surfaces; mixed stream surfaces only egress-safe events. Honesty (ADR-262 §0/§6): real plumbing on a live endpoint, NOT accuracy. Single-link CSI with its existing caveats (no validated room-coordinate accuracy); dedicated dev signing key pending the P2 ownership decision; no accuracy claim. Co-Authored-By: claude-flow <ruv@ruv.net> * docs(ADR-262 P3): mark P1+P3 implemented; document /api/field + /ws/field; CHANGELOG - ADR-262 Status → "P1 + P3 implemented"; add a P3 implementation-status block (tap site, endpoints, dedicated dev signer deferring the §8 Q1 key decision, fail-closed egress, gates). Keep the honesty framing: real plumbing on a live endpoint, not accuracy. - CHANGELOG [Unreleased]: add the ADR-262 P3 entry. - user-guide: add `/api/field` to the REST table + a "RuField surface (ADR-262 P3)" section covering `/api/field` + `/ws/field`, the fail-closed P1/P2-only egress, the WDP_RUFIELD_SIGNING_SEED dev key, and the no-accuracy honesty note. Co-Authored-By: claude-flow <ruv@ruv.net> * ci: checkout submodules everywhere + Dockerfile copies vendor/rufield Making wifi-densepose-rufield (ADR-262 bridge) a v2 workspace member means EVERY cargo-on-workspace context must have the vendor/rufield submodule present (cargo loads all member manifests). P1 only fixed the rust-tests job; this adds `submodules: recursive` to all workflow checkouts that run cargo (mqtt-integration was failing on the missing submodule manifest), and makes Dockerfile.rust COPY vendor/rufield/ to /vendor/rufield (matches the bridge's ../../../vendor/rufield path-dep under the collapsed Docker layout). update-submodules.yml left alone (it manages submodules itself). Co-Authored-By: claude-flow <ruv@ruv.net> --------- Co-authored-by: ruv <ruvnet@gmail.com>
This commit is contained in:
rUv
Generated
+1
@@ -11142,6 +11142,7 @@ dependencies = [
|
||||
"wifi-densepose-engine",
|
||||
"wifi-densepose-geo",
|
||||
"wifi-densepose-hardware",
|
||||
"wifi-densepose-rufield",
|
||||
"wifi-densepose-signal",
|
||||
"wifi-densepose-wifiscan",
|
||||
"wifi-densepose-worldgraph",
|
||||
|
||||
@@ -80,6 +80,44 @@ pub use snapshot::{
|
||||
|
||||
// Re-export the rufield surface a bridge consumer needs, so callers depend on
|
||||
// one crate.
|
||||
pub use rufield_core::{FieldEvent, Modality, PrivacyClass};
|
||||
pub use rufield_core::{Destination, FieldEvent, Modality, PrivacyClass, PrivacyDecision};
|
||||
pub use rufield_fusion::RuFieldFusion;
|
||||
pub use rufield_privacy::{DefaultPrivacyGuard, PrivacyPolicy};
|
||||
pub use rufield_provenance::{is_fusable, verify_event, Signer};
|
||||
|
||||
/// Whether a mapped [`PrivacyClass`] may be surfaced on a **network** egress
|
||||
/// (ADR-262 §4 P3 — the live `/api/field` / `/ws/field` surface must respect
|
||||
/// the same default §10 network policy `/ws/sensing` honours, never emitting
|
||||
/// above-policy data).
|
||||
///
|
||||
/// **Fail-closed for a live, unattended surface.** The live RuView surface has
|
||||
/// **no per-event consent or identity-binding ceremony** — so this is *stricter*
|
||||
/// than [`DefaultPrivacyGuard::authorize`]: it requires BOTH that the default
|
||||
/// guard would `Allow` the class onto [`Destination::Network`] with **no consent
|
||||
/// granted**, AND that the class is at or below the default network ceiling
|
||||
/// ([`PrivacyClass::P2`]). The second clause deliberately drops P4/P5 even
|
||||
/// though the guard's consent/identity *exceptions* would let an explicitly
|
||||
/// consented/identity-bound P4/P5 through — because the live surface cannot
|
||||
/// honestly assert that consent. Net effect: only **P1/P2** leave the box; P0
|
||||
/// (raw) and P3/P4/P5 are held edge-local.
|
||||
///
|
||||
/// This is the privacy-safety pin for the live surface: a `Derived` cycle maps
|
||||
/// to P4 (or P5 when identity-bound) via [`map_privacy`] and is therefore
|
||||
/// **never** surfaced as a network event — neither as a low-privacy P1 (the
|
||||
/// §3.3 mapping trap) nor at all.
|
||||
#[must_use]
|
||||
pub fn network_egress_allowed(class: PrivacyClass, identity_bound: bool) -> bool {
|
||||
use rufield_core::PrivacyGuard;
|
||||
let guard_allows = matches!(
|
||||
DefaultPrivacyGuard::default().authorize(
|
||||
class,
|
||||
Destination::Network,
|
||||
false, // no per-event consent on the live network surface (fail-closed)
|
||||
identity_bound,
|
||||
),
|
||||
PrivacyDecision::Allow
|
||||
);
|
||||
// Additionally cap at the default network ceiling: an unattended live
|
||||
// surface never asserts the P4-consent / P5-identity exception.
|
||||
guard_allows && class <= PrivacyClass::P2
|
||||
}
|
||||
|
||||
@@ -63,6 +63,13 @@ wifi-densepose-worldgraph = { version = "0.3.0", path = "../wifi-densepose-world
|
||||
wifi-densepose-bfld = { version = "0.3.1", path = "../wifi-densepose-bfld", default-features = false }
|
||||
wifi-densepose-geo = { version = "0.1.0", path = "../wifi-densepose-geo" }
|
||||
|
||||
# ADR-262 P3: live RuField surface. The thin anti-corruption bridge that turns
|
||||
# this server's governed sensing cycle into signed RuField `FieldEvent`s on
|
||||
# `/api/field` + `/ws/field`. It path-deps the standalone `vendor/rufield`
|
||||
# submodule (it is the single coupling point — ADR-262 §5.4) and pulls in no
|
||||
# RuView internal crate, so the dep surface added here is just the bridge.
|
||||
wifi-densepose-rufield = { version = "0.3.0", path = "../wifi-densepose-rufield" }
|
||||
|
||||
# midstream — real-time introspection / low-latency tap (ADR-099 D1).
|
||||
# Two crates only, on purpose: scheduler / neural-solver / strange-loop are
|
||||
# explicitly out of scope of ADR-099 (D5).
|
||||
|
||||
@@ -23,6 +23,10 @@ pub mod model_format;
|
||||
pub mod mqtt;
|
||||
pub mod path_safety;
|
||||
pub mod semantic;
|
||||
/// ADR-262 P3: the live RuField surface — turns the governed sensing cycle into
|
||||
/// signed RuField `FieldEvent`s on the additive `/api/field` + `/ws/field`
|
||||
/// endpoints, via the `wifi-densepose-rufield` anti-corruption bridge.
|
||||
pub mod rufield_surface;
|
||||
pub mod rvf_container;
|
||||
pub mod rvf_pipeline;
|
||||
pub mod sona;
|
||||
|
||||
@@ -26,7 +26,7 @@ mod vital_signs;
|
||||
|
||||
// Training pipeline modules (exposed via lib.rs)
|
||||
use wifi_densepose_sensing_server::{
|
||||
dataset, embedding, error_response, graph_transformer, trainer,
|
||||
dataset, embedding, error_response, graph_transformer, rufield_surface, trainer,
|
||||
};
|
||||
|
||||
use ruvector_mincut::{DynamicMinCut, MinCutBuilder};
|
||||
@@ -1093,6 +1093,14 @@ struct AppStateInner {
|
||||
pub(crate) dedup_factor: f64,
|
||||
/// Data directory for persisting runtime config (parent of `firmware_dir`).
|
||||
pub(crate) data_dir: std::path::PathBuf,
|
||||
/// ADR-262 P3: the live RuField surface. Holds the dedicated ed25519 signer
|
||||
/// + a bounded ring of recent signed `FieldEvent`s + the `/ws/field`
|
||||
/// broadcast topic. The governed sensing cycle calls `emit()` on it once per
|
||||
/// cycle (joining `SensingUpdate` features/classification/signal_field with
|
||||
/// the `TrustedOutput` trust class); `/api/field` + `/ws/field` read it.
|
||||
/// Held behind its own `Arc<RwLock<_>>` so the additive field router can
|
||||
/// take it as state without re-locking `AppStateInner`.
|
||||
field_surface: rufield_surface::FieldState,
|
||||
}
|
||||
|
||||
/// If no ESP32 frame arrives within this duration, source reverts to offline.
|
||||
@@ -4000,6 +4008,80 @@ fn derive_single_person_pose(
|
||||
/// the strongest peak so they remain co-located with real energy rather than at
|
||||
/// a fake origin; if the field has no peak above threshold the position stays at
|
||||
/// `[0,0,0]` and `motion_score` still reflects real motion power.
|
||||
/// ADR-262 P3: emit one signed RuField `FieldEvent` for this sensing cycle.
|
||||
///
|
||||
/// Joins the cycle's [`SensingUpdate`] (features / classification /
|
||||
/// signal_field) with the governed engine's trust state (`effective_class` /
|
||||
/// `demoted`, recorded on `engine_bridge` by `observe_cycle`) into a
|
||||
/// `SensingSnapshot`, then surfaces it via the P1 bridge on `/api/field` +
|
||||
/// `/ws/field`. The bridge maps privacy by information content and the surface
|
||||
/// applies the §10 network egress gate, so above-policy cycles never reach the
|
||||
/// wire.
|
||||
///
|
||||
/// **No phantom events:** an empty/no-presence cycle (`presence == false`)
|
||||
/// emits nothing — there is no person to describe, so no event is fabricated
|
||||
/// (ADR-262 §4 P3 / §6). Cycles before the governed engine has produced a trust
|
||||
/// class are likewise skipped (no class ⇒ nothing honest to stamp).
|
||||
///
|
||||
/// `identity_bound` is `false` on the live path: RuView's live cycle does not
|
||||
/// bind an enrolled identity to the surface yet (that is a per-room-calibration
|
||||
/// / AETHER concern, ADR-262 §8 Q4). This is conservative for egress — it only
|
||||
/// ever *lowers* a Derived cycle from P5 to P4, both of which are already held
|
||||
/// edge-local, so it cannot leak.
|
||||
fn emit_rufield_event(s: &AppStateInner, update: &SensingUpdate, node_id: u8) {
|
||||
// No-presence ⇒ no phantom event.
|
||||
if !update.classification.presence {
|
||||
return;
|
||||
}
|
||||
// Need a governed trust class before we can honestly stamp privacy.
|
||||
let Some(effective_class) = s.engine_bridge.effective_class() else {
|
||||
return;
|
||||
};
|
||||
|
||||
let timestamp_ns = if update.timestamp.is_finite() && update.timestamp > 0.0 {
|
||||
(update.timestamp * 1_000_000_000.0) as u64
|
||||
} else {
|
||||
std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.map(|d| d.as_nanos() as u64)
|
||||
.unwrap_or(0)
|
||||
};
|
||||
|
||||
let snap = rufield_surface::build_snapshot(
|
||||
timestamp_ns,
|
||||
format!("esp32_node_{node_id}"),
|
||||
rufield_surface::SensingFeatures {
|
||||
mean_rssi: update.features.mean_rssi,
|
||||
variance: update.features.variance,
|
||||
motion_band_power: update.features.motion_band_power,
|
||||
breathing_band_power: update.features.breathing_band_power,
|
||||
dominant_freq_hz: update.features.dominant_freq_hz,
|
||||
change_points: update.features.change_points,
|
||||
spectral_power: update.features.spectral_power,
|
||||
},
|
||||
rufield_surface::SensingClass {
|
||||
motion_level: update.classification.motion_level.clone(),
|
||||
presence: update.classification.presence,
|
||||
confidence: update.classification.confidence,
|
||||
},
|
||||
Some(rufield_surface::SignalField {
|
||||
grid_size: update.signal_field.grid_size,
|
||||
values: update.signal_field.values.clone(),
|
||||
}),
|
||||
rufield_surface::ruview_class_from_bfld(effective_class),
|
||||
s.engine_bridge.demoted(),
|
||||
false, // identity_bound — see fn-doc (conservative, cannot leak).
|
||||
);
|
||||
|
||||
// `field_surface` is its own Arc<RwLock<_>>; `try_write` is non-blocking and
|
||||
// never deadlocks against the `s` guard (a different lock). The only other
|
||||
// touchers are the read-only `/api/field` / `/ws/field` handlers, so
|
||||
// contention is negligible; a rare miss just drops one cycle's event.
|
||||
if let Ok(mut fs) = s.field_surface.try_write() {
|
||||
fs.emit(&snap);
|
||||
}
|
||||
}
|
||||
|
||||
fn attach_field_positions(update: &mut SensingUpdate) {
|
||||
let Some(persons) = update.persons.as_mut() else {
|
||||
return;
|
||||
@@ -5990,6 +6072,18 @@ async fn udp_receiver_task(state: SharedState, udp_port: u16) {
|
||||
if let Ok(json) = serde_json::to_string(&update) {
|
||||
let _ = s.tx.send(json);
|
||||
}
|
||||
|
||||
// ── ADR-262 P3: emit a signed RuField FieldEvent ────────
|
||||
// Join this cycle's SensingUpdate (features / classification
|
||||
// / signal_field) with the governed engine's trust state
|
||||
// (effective_class / demoted, recorded by `observe_cycle`
|
||||
// above) into a `SensingSnapshot`, and surface it on
|
||||
// `/api/field` + `/ws/field` via the P1 bridge. Only cycles
|
||||
// whose mapped privacy class clears the §10 network egress
|
||||
// gate are surfaced (P1/P2); a `Derived → P4/P5` cycle is
|
||||
// held edge-local. `presence == false` ⇒ no phantom event.
|
||||
emit_rufield_event(&s, &update, node_id);
|
||||
|
||||
s.latest_update = Some(update);
|
||||
|
||||
// Evict stale nodes every 100 ticks to prevent memory leak.
|
||||
@@ -7322,6 +7416,13 @@ async fn main() {
|
||||
);
|
||||
}
|
||||
|
||||
// ADR-262 P3: build the live RuField surface (dedicated ed25519 signer from
|
||||
// WDP_RUFIELD_SIGNING_SEED, else a logged dev default). The same Arc is
|
||||
// stored in AppStateInner (so the sensing loop can `emit()` per cycle) and
|
||||
// cloned into the additive `/api/field` + `/ws/field` router below.
|
||||
let field_surface: rufield_surface::FieldState =
|
||||
Arc::new(RwLock::new(rufield_surface::FieldSurface::from_env()));
|
||||
|
||||
let state: SharedState = Arc::new(RwLock::new(AppStateInner {
|
||||
latest_update: None,
|
||||
rssi_history: VecDeque::new(),
|
||||
@@ -7424,6 +7525,7 @@ async fn main() {
|
||||
// ADR-044 §5.3: runtime-configurable dedup factor (persisted).
|
||||
dedup_factor: runtime_config.dedup_factor,
|
||||
data_dir: data_dir.clone(),
|
||||
field_surface: field_surface.clone(),
|
||||
}));
|
||||
|
||||
// Start background tasks from the resolved plan (issue #1004).
|
||||
@@ -7497,11 +7599,15 @@ async fn main() {
|
||||
let ws_app = Router::new()
|
||||
.route("/ws/sensing", get(ws_sensing_handler))
|
||||
.route("/health", get(health))
|
||||
.with_state(ws_state)
|
||||
// ADR-262 P3: additive `/ws/field` (+ `/api/field`) on the WS port too,
|
||||
// so a client on :8765 can stream signed RuField FieldEvents alongside
|
||||
// `/ws/sensing`. Merged with its own FieldState (different state type).
|
||||
.merge(rufield_surface::router(field_surface.clone()))
|
||||
.layer(axum::middleware::from_fn_with_state(
|
||||
host_allowlist.clone(),
|
||||
wifi_densepose_sensing_server::host_validation::require_allowed_host,
|
||||
))
|
||||
.with_state(ws_state);
|
||||
));
|
||||
|
||||
let ws_addr = SocketAddr::from((bind_ip, args.ws_port));
|
||||
let ws_listener = tokio::net::TcpListener::bind(ws_addr)
|
||||
@@ -7615,15 +7721,24 @@ async fn main() {
|
||||
bearer_auth_state.clone(),
|
||||
wifi_densepose_sensing_server::bearer_auth::require_bearer,
|
||||
))
|
||||
.with_state(state.clone())
|
||||
// ADR-262 P3: additive RuField surface (`/api/field` + `/ws/field`).
|
||||
// Merged AFTER `.with_state` (so http_app is already `Router<()>` and
|
||||
// can absorb the field router's own `FieldState`). These routes sit
|
||||
// OUTSIDE `/api/v1/*` so they are not bearer-gated, but the
|
||||
// host-validation layer below still applies (it is added last, so it
|
||||
// runs first, over the whole merged router). The surface's own §10
|
||||
// egress gate is what keeps above-policy classes off the wire.
|
||||
.merge(rufield_surface::router(field_surface.clone()))
|
||||
// DNS-rebinding defense: applied last so it runs first on the request
|
||||
// path (axum layers run outermost-in). Rejects requests whose `Host`
|
||||
// header is not in the allowlist before any handler — including
|
||||
// `/health` and `/ws/*` — observes the body.
|
||||
// `/health`, `/ws/*`, and the merged `/api/field` + `/ws/field` —
|
||||
// observes the body.
|
||||
.layer(axum::middleware::from_fn_with_state(
|
||||
host_allowlist.clone(),
|
||||
wifi_densepose_sensing_server::host_validation::require_allowed_host,
|
||||
))
|
||||
.with_state(state.clone());
|
||||
));
|
||||
|
||||
let http_addr = SocketAddr::from((bind_ip, args.http_port));
|
||||
let http_listener = tokio::net::TcpListener::bind(http_addr)
|
||||
|
||||
@@ -0,0 +1,439 @@
|
||||
//! ADR-262 **P3** — the live RuField surface.
|
||||
//!
|
||||
//! This is the data-path wiring that turns RuView's governed sensing cycle into
|
||||
//! signed RuField [`FieldEvent`]s on two **additive** network endpoints:
|
||||
//!
|
||||
//! - `GET /api/field` — the most recent surfaced `FieldEvent`(s) as JSON;
|
||||
//! - `GET /ws/field` — a WebSocket that streams each cycle's `FieldEvent`
|
||||
//! (mirrors the `/ws/sensing` broadcast-subscribe pattern).
|
||||
//!
|
||||
//! It is purely additive: `/ws/sensing` and every existing endpoint are
|
||||
//! unchanged. The conversion itself lives entirely in the P1
|
||||
//! [`wifi_densepose_rufield`] anti-corruption bridge (ADR-262 §5.4 — the single
|
||||
//! coupling point); this module only (a) holds the dedicated signer + a bounded
|
||||
//! ring buffer of recent events in server state, (b) builds a
|
||||
//! [`SensingSnapshot`] from the **same real data** the cycle already produced
|
||||
//! (`SensingUpdate` features/classification/signal_field joined with the
|
||||
//! governed-engine [`TrustedOutput`] trust state at `main.rs:~5886`/`:~5938`),
|
||||
//! and (c) applies the §10 network egress gate so above-policy classes never
|
||||
//! reach the wire.
|
||||
//!
|
||||
//! ## Honesty (ADR-262 §0 / §6)
|
||||
//!
|
||||
//! This wires **real** RuView sensing into RuField events on a live endpoint,
|
||||
//! but: (a) it is the **single-link CSI** sensing with its existing caveats —
|
||||
//! there is **no validated room-coordinate accuracy** (`field_localize` says so;
|
||||
//! positions are "strongest field peak", not triangulation); (b) the signing
|
||||
//! key is a **dedicated dev/sensing key** pending the ADR-262 §8 Q1 ownership
|
||||
//! decision (reusing the `cog-ha-matter` Ed25519 key is the **deferred P2**
|
||||
//! call — P3 deliberately uses a standalone key so it does not pre-empt that);
|
||||
//! (c) **no accuracy is claimed.** The win is narrowly: "RuView's live sensing
|
||||
//! now speaks RuField on `/ws/field`."
|
||||
|
||||
use std::collections::VecDeque;
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::{
|
||||
extract::{
|
||||
ws::{Message, WebSocket, WebSocketUpgrade},
|
||||
State,
|
||||
},
|
||||
response::{IntoResponse, Json},
|
||||
};
|
||||
use tokio::sync::{broadcast, RwLock};
|
||||
|
||||
// Re-export the bridge input types `main.rs` needs to build a snapshot, so the
|
||||
// server-side call site depends only on `rufield_surface` (the server seam).
|
||||
pub use wifi_densepose_rufield::{
|
||||
network_egress_allowed, snapshot_to_field_event, FieldEvent, RuViewPrivacyClass,
|
||||
SensingClass, SensingFeatures, SensingSnapshot, Signer, SignalField,
|
||||
};
|
||||
|
||||
/// How many recent surfaced `FieldEvent`s the ring buffer retains. Small and
|
||||
/// bounded — this is a live tap, not a store (ADR-262 §4 P3 "small bounded ring
|
||||
/// buffer of recent events").
|
||||
pub const FIELD_RING_CAPACITY: usize = 64;
|
||||
|
||||
/// Broadcast channel depth for `/ws/field`. Matches the `/ws/sensing` `tx`
|
||||
/// channel size (256) so a slow field client drops messages rather than
|
||||
/// stalling the sensing loop.
|
||||
pub const FIELD_BROADCAST_CAPACITY: usize = 256;
|
||||
|
||||
/// Environment variable carrying the 32-byte hex/raw signing seed for the
|
||||
/// dedicated RuField sensing signer. When unset, a deterministic dev default is
|
||||
/// used (with a logged warning). See [`FieldSurface::from_env`].
|
||||
pub const SIGNING_SEED_ENV: &str = "WDP_RUFIELD_SIGNING_SEED";
|
||||
|
||||
/// Deterministic dev signing seed used when [`SIGNING_SEED_ENV`] is unset. This
|
||||
/// is a **dev/sensing key**, intentionally standalone (ADR-262 §8 Q1 — the
|
||||
/// `cog-ha-matter` key reuse is the deferred P2 decision, not pre-empted here).
|
||||
const DEV_SIGNING_SEED: &[u8; 32] = b"adr262-ruview-rufield-dev-seed!!";
|
||||
|
||||
/// The live RuField surface state held in `AppStateInner` (ADR-262 P3).
|
||||
///
|
||||
/// Owns the **dedicated** ed25519 [`Signer`], a bounded ring buffer of the most
|
||||
/// recent network-surfaced events, and the `/ws/field` broadcast sender.
|
||||
pub struct FieldSurface {
|
||||
signer: Signer,
|
||||
/// Bounded ring of recent **network-surfaced** events (most recent last).
|
||||
recent: VecDeque<FieldEvent>,
|
||||
/// Broadcast topic for `/ws/field` (JSON-serialized `FieldEvent`s).
|
||||
tx: broadcast::Sender<String>,
|
||||
/// True when the dev default seed is in use (drives a one-time warning and
|
||||
/// is surfaced in `/api/field` metadata so operators can see they are on a
|
||||
/// dev key).
|
||||
using_dev_key: bool,
|
||||
}
|
||||
|
||||
impl FieldSurface {
|
||||
/// Build a surface with an explicit 32-byte seed (deterministic signer).
|
||||
#[must_use]
|
||||
pub fn from_seed(seed: &[u8; 32], using_dev_key: bool) -> Self {
|
||||
let (tx, _rx) = broadcast::channel(FIELD_BROADCAST_CAPACITY);
|
||||
Self {
|
||||
signer: Signer::from_seed(seed),
|
||||
recent: VecDeque::with_capacity(FIELD_RING_CAPACITY),
|
||||
tx,
|
||||
using_dev_key,
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a surface from the environment (ADR-262 §4 P3 / open-question 1).
|
||||
///
|
||||
/// Reads [`SIGNING_SEED_ENV`] as either a 64-char hex string or a raw 32+
|
||||
/// byte UTF-8 value (first 32 bytes used). When unset/invalid it falls back
|
||||
/// to the deterministic [`DEV_SIGNING_SEED`] and logs a `WARN` — the key is
|
||||
/// a standalone **dev/sensing** key, NOT the deferred-P2 `cog-ha-matter`
|
||||
/// key.
|
||||
#[must_use]
|
||||
pub fn from_env() -> Self {
|
||||
match std::env::var(SIGNING_SEED_ENV).ok().and_then(|v| parse_seed(&v)) {
|
||||
Some(seed) => {
|
||||
tracing::info!(
|
||||
"ADR-262 P3: RuField surface using signing seed from {SIGNING_SEED_ENV} \
|
||||
(dedicated sensing key)"
|
||||
);
|
||||
Self::from_seed(&seed, false)
|
||||
}
|
||||
None => {
|
||||
tracing::warn!(
|
||||
"ADR-262 P3: {SIGNING_SEED_ENV} unset/invalid — RuField surface using the \
|
||||
DETERMINISTIC DEV signing key. This is a dev/sensing key pending the \
|
||||
ADR-262 §8 Q1 (P2) key-ownership decision; set {SIGNING_SEED_ENV} (64-hex \
|
||||
or 32-byte value) for a real deployment."
|
||||
);
|
||||
Self::from_seed(DEV_SIGNING_SEED, true)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// The public key of the dedicated signer (hex), so consumers can verify
|
||||
/// receipts without the private seed.
|
||||
#[must_use]
|
||||
pub fn signer_pubkey_hex(&self) -> String {
|
||||
self.signer.public_hex()
|
||||
}
|
||||
|
||||
/// Whether the dev default key is in use.
|
||||
#[must_use]
|
||||
pub fn using_dev_key(&self) -> bool {
|
||||
self.using_dev_key
|
||||
}
|
||||
|
||||
/// A `/ws/field` subscription.
|
||||
#[must_use]
|
||||
pub fn subscribe(&self) -> broadcast::Receiver<String> {
|
||||
self.tx.subscribe()
|
||||
}
|
||||
|
||||
/// The most recent surfaced events, oldest→newest.
|
||||
#[must_use]
|
||||
pub fn recent(&self) -> Vec<FieldEvent> {
|
||||
self.recent.iter().cloned().collect()
|
||||
}
|
||||
|
||||
/// Convert one cycle's [`SensingSnapshot`] into a signed [`FieldEvent`],
|
||||
/// apply the §10 network egress gate, and — **iff** the event may leave the
|
||||
/// box — push it into the ring + broadcast it on `/ws/field`.
|
||||
///
|
||||
/// Returns `Some(event)` when an event was surfaced, `None` when the cycle
|
||||
/// was held edge-local (above network policy — e.g. a `Derived → P4/P5`
|
||||
/// cycle) or carried no presence. Two structural guarantees live here, so
|
||||
/// they hold regardless of caller:
|
||||
///
|
||||
/// - **no phantom events** — a no-presence cycle (`presence == false`)
|
||||
/// surfaces nothing (ADR-262 §4 P3 / §6); there is no person to describe.
|
||||
/// - **privacy-safety pin** — above-policy classes (P0, P3–P5) are never
|
||||
/// placed on the network surface; only egress-safe P1/P2 events leave.
|
||||
pub fn emit(&mut self, snap: &SensingSnapshot) -> Option<FieldEvent> {
|
||||
// No-presence ⇒ no phantom event (fabricating one would be dishonest).
|
||||
if !snap.classification.presence {
|
||||
return None;
|
||||
}
|
||||
|
||||
let event = snapshot_to_field_event(snap, &self.signer);
|
||||
|
||||
// §10 network egress gate (ADR-262 §4 P3): only P1/P2 leave the box by
|
||||
// default; P0 raw and P3/P4/P5 (above the default P2 ceiling, or
|
||||
// identity/biometric) are held edge-local. A `Derived` cycle is P4/P5
|
||||
// ⇒ never surfaced as a low-privacy network event.
|
||||
if !network_egress_allowed(event.observation.privacy_class, snap.identity_bound) {
|
||||
tracing::trace!(
|
||||
privacy_class = ?event.observation.privacy_class,
|
||||
"ADR-262 P3: cycle held edge-local (above network policy), not surfaced on /api/field"
|
||||
);
|
||||
return None;
|
||||
}
|
||||
|
||||
if self.recent.len() == FIELD_RING_CAPACITY {
|
||||
self.recent.pop_front();
|
||||
}
|
||||
self.recent.push_back(event.clone());
|
||||
|
||||
if let Ok(json) = serde_json::to_string(&event) {
|
||||
let _ = self.tx.send(json);
|
||||
}
|
||||
Some(event)
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse [`SIGNING_SEED_ENV`] as 64-char hex or a raw 32+ byte UTF-8 value.
|
||||
fn parse_seed(v: &str) -> Option<[u8; 32]> {
|
||||
let v = v.trim();
|
||||
// 64 hex chars → 32 bytes.
|
||||
if v.len() == 64 && v.bytes().all(|b| b.is_ascii_hexdigit()) {
|
||||
let mut out = [0u8; 32];
|
||||
for (i, chunk) in v.as_bytes().chunks(2).enumerate() {
|
||||
let hi = (chunk[0] as char).to_digit(16)?;
|
||||
let lo = (chunk[1] as char).to_digit(16)?;
|
||||
out[i] = ((hi << 4) | lo) as u8;
|
||||
}
|
||||
return Some(out);
|
||||
}
|
||||
// Otherwise: first 32 bytes of the raw value (must be at least 32 long so a
|
||||
// short/typo'd value fails closed to the dev key rather than a weak key).
|
||||
let bytes = v.as_bytes();
|
||||
if bytes.len() >= 32 {
|
||||
let mut out = [0u8; 32];
|
||||
out.copy_from_slice(&bytes[..32]);
|
||||
return Some(out);
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
/// Build a [`SensingSnapshot`] from the real per-cycle values (ADR-262 P3 §4.2).
|
||||
///
|
||||
/// This is the join the ADR mandates: `SensingUpdate` features / classification
|
||||
/// / signal-field **plus** the governed engine's `effective_class` / `demoted`
|
||||
/// / `identity_bound` trust state. All inputs are the same real data the cycle
|
||||
/// already computed — nothing is fabricated. `signal_field` is passed through as
|
||||
/// the honest "strongest field peak" readout (no calibrated coordinates).
|
||||
#[allow(clippy::too_many_arguments)]
|
||||
#[must_use]
|
||||
pub fn build_snapshot(
|
||||
timestamp_ns: u64,
|
||||
node_id: String,
|
||||
features: SensingFeatures,
|
||||
classification: SensingClass,
|
||||
signal_field: Option<SignalField>,
|
||||
trust_class: RuViewPrivacyClass,
|
||||
demoted: bool,
|
||||
identity_bound: bool,
|
||||
) -> SensingSnapshot {
|
||||
SensingSnapshot {
|
||||
timestamp_ns,
|
||||
features,
|
||||
classification,
|
||||
signal_field,
|
||||
trust_class,
|
||||
demoted,
|
||||
identity_bound,
|
||||
node_id,
|
||||
}
|
||||
}
|
||||
|
||||
/// Map RuView's live governed-engine `bfld::PrivacyClass` (the `effective_class`
|
||||
/// on `TrustedOutput`) onto the bridge's [`RuViewPrivacyClass`] input.
|
||||
///
|
||||
/// This is a **lossless, same-meaning** re-encoding of the four byte-level
|
||||
/// classes — both enums are `Raw/Derived/Anonymous/Restricted` in the same
|
||||
/// order. It exists only so `main.rs` can pass the engine's class into the
|
||||
/// bridge without the bridge depending on `wifi-densepose-bfld` (keeping it an
|
||||
/// anti-corruption layer, ADR-262 §5.4). The information-content privacy
|
||||
/// mapping (the §3.3 correctness item) happens *inside* the bridge.
|
||||
#[must_use]
|
||||
pub fn ruview_class_from_bfld(class: wifi_densepose_bfld::PrivacyClass) -> RuViewPrivacyClass {
|
||||
use wifi_densepose_bfld::PrivacyClass as B;
|
||||
match class {
|
||||
B::Raw => RuViewPrivacyClass::Raw,
|
||||
B::Derived => RuViewPrivacyClass::Derived,
|
||||
B::Anonymous => RuViewPrivacyClass::Anonymous,
|
||||
B::Restricted => RuViewPrivacyClass::Restricted,
|
||||
}
|
||||
}
|
||||
|
||||
// ── Handlers ────────────────────────────────────────────────────────────────
|
||||
|
||||
/// Shared state for the field surface handlers. Generic over the lock guard so
|
||||
/// the module can be tested in isolation with a tiny state (ADR-262 P3 test
|
||||
/// gate) and wired into the full `AppStateInner` in `main.rs` via an adapter.
|
||||
pub type FieldState = Arc<RwLock<FieldSurface>>;
|
||||
|
||||
/// `GET /api/field` — the most recent network-surfaced `FieldEvent`s as JSON,
|
||||
/// plus surface metadata (the signer pubkey + whether a dev key is in use).
|
||||
///
|
||||
/// When no event has been surfaced yet (empty room / above-policy cycles only)
|
||||
/// the `events` array is empty — an **explicit empty payload**, never a
|
||||
/// fabricated event (ADR-262 §4 P3 / §6 honesty).
|
||||
pub async fn api_field(State(state): State<FieldState>) -> Json<serde_json::Value> {
|
||||
let s = state.read().await;
|
||||
Json(serde_json::json!({
|
||||
"spec": "rufield",
|
||||
"endpoint": "/api/field",
|
||||
"signer_pubkey_hex": s.signer_pubkey_hex(),
|
||||
"dev_signing_key": s.using_dev_key(),
|
||||
"events": s.recent(),
|
||||
}))
|
||||
}
|
||||
|
||||
/// `GET /ws/field` — upgrade to a WebSocket that streams each surfaced
|
||||
/// `FieldEvent` (JSON) as the sensing loop emits it. Mirrors `/ws/sensing`:
|
||||
/// subscribe to the broadcast topic and forward.
|
||||
pub async fn ws_field(ws: WebSocketUpgrade, State(state): State<FieldState>) -> impl IntoResponse {
|
||||
let rx = {
|
||||
let s = state.read().await;
|
||||
s.subscribe()
|
||||
};
|
||||
ws.on_upgrade(move |socket| handle_ws_field_client(socket, rx))
|
||||
}
|
||||
|
||||
async fn handle_ws_field_client(mut socket: WebSocket, mut rx: broadcast::Receiver<String>) {
|
||||
// Forward broadcast events; exit on client close or fatal lag.
|
||||
loop {
|
||||
match rx.recv().await {
|
||||
Ok(json) => {
|
||||
if socket.send(Message::Text(json)).await.is_err() {
|
||||
break; // client gone
|
||||
}
|
||||
}
|
||||
Err(broadcast::error::RecvError::Lagged(_)) => {
|
||||
// Slow client missed events — keep going from the latest.
|
||||
continue;
|
||||
}
|
||||
Err(broadcast::error::RecvError::Closed) => break,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Build the additive field-surface router. Mounted into the main HTTP router
|
||||
/// in `main.rs`; also used standalone by the integration tests (ADR-262 P3
|
||||
/// gate, `tower::oneshot`).
|
||||
#[must_use]
|
||||
pub fn router(state: FieldState) -> axum::Router {
|
||||
use axum::routing::get;
|
||||
axum::Router::new()
|
||||
.route("/api/field", get(api_field))
|
||||
.route("/ws/field", get(ws_field))
|
||||
.with_state(state)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use wifi_densepose_rufield::{is_fusable, PrivacyClass};
|
||||
|
||||
fn features() -> SensingFeatures {
|
||||
SensingFeatures {
|
||||
mean_rssi: -55.0,
|
||||
variance: 0.4,
|
||||
motion_band_power: 2.0,
|
||||
breathing_band_power: 0.3,
|
||||
dominant_freq_hz: 0.25,
|
||||
change_points: 1,
|
||||
spectral_power: 3.0,
|
||||
}
|
||||
}
|
||||
|
||||
fn present_class() -> SensingClass {
|
||||
SensingClass {
|
||||
motion_level: "low".into(),
|
||||
presence: true,
|
||||
confidence: 0.82,
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_seed_hex_and_raw_and_short() {
|
||||
// 64 hex chars → 32 bytes.
|
||||
let hex = "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
|
||||
let parsed = parse_seed(hex).expect("valid hex seed");
|
||||
assert_eq!(parsed[0], 0x00);
|
||||
assert_eq!(parsed[31], 0xff);
|
||||
// Raw 32-byte value.
|
||||
assert!(parse_seed("0123456789abcdef0123456789abcdef").is_some());
|
||||
// Too short → fail closed (None → dev key).
|
||||
assert!(parse_seed("short").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn anonymous_cycle_surfaces_fusable_event() {
|
||||
let mut surface = FieldSurface::from_seed(DEV_SIGNING_SEED, true);
|
||||
let snap = build_snapshot(
|
||||
1_791_986_400_000_000_000,
|
||||
"esp32_room_01".into(),
|
||||
features(),
|
||||
present_class(),
|
||||
None,
|
||||
RuViewPrivacyClass::Anonymous, // → P2, network-allowed
|
||||
false,
|
||||
false,
|
||||
);
|
||||
let ev = surface.emit(&snap).expect("anonymous P2 cycle is surfaced");
|
||||
assert_eq!(ev.observation.privacy_class, PrivacyClass::P2);
|
||||
assert!(is_fusable(&ev), "live event must be ed25519-signed & fusable");
|
||||
assert_eq!(surface.recent().len(), 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn derived_cycle_never_surfaces_low_privacy() {
|
||||
// The privacy-safety pin: a Derived (identity) cycle maps to P4/P5 and
|
||||
// is held edge-local — it must NEVER appear on the network surface.
|
||||
let mut surface = FieldSurface::from_seed(DEV_SIGNING_SEED, true);
|
||||
for identity_bound in [false, true] {
|
||||
let snap = build_snapshot(
|
||||
1_791_986_400_000_000_000,
|
||||
"esp32_room_01".into(),
|
||||
features(),
|
||||
present_class(),
|
||||
None,
|
||||
RuViewPrivacyClass::Derived,
|
||||
false,
|
||||
identity_bound,
|
||||
);
|
||||
assert!(
|
||||
surface.emit(&snap).is_none(),
|
||||
"Derived cycle (identity_bound={identity_bound}) must be held edge-local"
|
||||
);
|
||||
}
|
||||
assert!(surface.recent().is_empty(), "no Derived event may reach the surface");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ring_buffer_is_bounded() {
|
||||
let mut surface = FieldSurface::from_seed(DEV_SIGNING_SEED, true);
|
||||
for i in 0..(FIELD_RING_CAPACITY + 10) {
|
||||
let snap = build_snapshot(
|
||||
1_791_986_400_000_000_000 + i as u64,
|
||||
"esp32_room_01".into(),
|
||||
features(),
|
||||
present_class(),
|
||||
None,
|
||||
RuViewPrivacyClass::Anonymous,
|
||||
false,
|
||||
false,
|
||||
);
|
||||
surface.emit(&snap);
|
||||
}
|
||||
assert_eq!(surface.recent().len(), FIELD_RING_CAPACITY);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,178 @@
|
||||
//! ADR-262 **P3** acceptance gate — the live RuField surface.
|
||||
//!
|
||||
//! In-process integration test (mirrors the `/ws/sensing` / #1050 oneshot
|
||||
//! style with `tower::ServiceExt::oneshot`): drives synthetic sensing cycles
|
||||
//! through the real `FieldSurface` + the real `/api/field` router, and asserts:
|
||||
//!
|
||||
//! 1. an injected `Anonymous` (occupancy) cycle surfaces a **well-formed signed
|
||||
//! `FieldEvent`** — `Modality::WifiCsi`, privacy class consistent with the
|
||||
//! trust (P2, never P1), `is_fusable` (ed25519 receipt verifies), real
|
||||
//! timestamp;
|
||||
//! 2. an empty / no-presence cycle produces **no phantom event** (explicit
|
||||
//! empty payload);
|
||||
//! 3. the **privacy-safety pin** — an injected `Derived` (identity) trust state
|
||||
//! never surfaces as a low-privacy event on `/api/field` (held edge-local).
|
||||
//!
|
||||
//! These gates are plumbing + privacy-safety, NOT accuracy (ADR-262 §0 / §6).
|
||||
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::body::Body;
|
||||
use axum::http::{Request, StatusCode};
|
||||
use tokio::sync::RwLock;
|
||||
use tower::ServiceExt; // `oneshot`
|
||||
|
||||
use wifi_densepose_rufield::{is_fusable, verify_event, FieldEvent, Modality, PrivacyClass};
|
||||
use wifi_densepose_sensing_server::rufield_surface::{
|
||||
self, FieldState, FieldSurface, RuViewPrivacyClass, SensingClass, SensingFeatures, SignalField,
|
||||
};
|
||||
|
||||
/// A fixed dev seed for deterministic, signed events under test.
|
||||
const TEST_SEED: &[u8; 32] = b"adr262-p3-integration-test-seed!";
|
||||
|
||||
fn features() -> SensingFeatures {
|
||||
SensingFeatures {
|
||||
mean_rssi: -55.0,
|
||||
variance: 0.4,
|
||||
motion_band_power: 2.0,
|
||||
breathing_band_power: 0.3,
|
||||
dominant_freq_hz: 0.25,
|
||||
change_points: 1,
|
||||
spectral_power: 3.0,
|
||||
}
|
||||
}
|
||||
|
||||
fn class(presence: bool) -> SensingClass {
|
||||
SensingClass {
|
||||
motion_level: if presence { "low".into() } else { "none".into() },
|
||||
presence,
|
||||
confidence: if presence { 0.82 } else { 0.05 },
|
||||
}
|
||||
}
|
||||
|
||||
/// A small 2×1×2 signal field with a clear peak, so the bridge derives a real
|
||||
/// (non-fabricated) position from the strongest cell.
|
||||
fn signal_field() -> SignalField {
|
||||
SignalField {
|
||||
grid_size: [2, 1, 2],
|
||||
values: vec![0.1, 0.2, 0.9, 0.3], // peak at index 2
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a `FieldState` + the real `/api/field` + `/ws/field` router over it.
|
||||
fn surface_router() -> (FieldState, axum::Router) {
|
||||
let state: FieldState = Arc::new(RwLock::new(FieldSurface::from_seed(TEST_SEED, true)));
|
||||
let app = rufield_surface::router(state.clone());
|
||||
(state, app)
|
||||
}
|
||||
|
||||
/// Drive one cycle into the surface (the in-process equivalent of the live
|
||||
/// sensing loop calling `emit()` per cycle).
|
||||
async fn inject(state: &FieldState, trust: RuViewPrivacyClass, presence: bool, identity_bound: bool) {
|
||||
let snap = rufield_surface::build_snapshot(
|
||||
1_791_986_400_000_000_000,
|
||||
"esp32_node_7".into(),
|
||||
features(),
|
||||
class(presence),
|
||||
Some(signal_field()),
|
||||
trust,
|
||||
false, // demoted
|
||||
identity_bound,
|
||||
);
|
||||
state.write().await.emit(&snap);
|
||||
}
|
||||
|
||||
/// `GET /api/field` and parse the `events` array.
|
||||
async fn get_field_events(app: &axum::Router) -> Vec<FieldEvent> {
|
||||
let resp = app
|
||||
.clone()
|
||||
.oneshot(
|
||||
Request::builder()
|
||||
.uri("/api/field")
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK, "/api/field must return 200");
|
||||
let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX).await.unwrap();
|
||||
let v: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
|
||||
assert_eq!(v["spec"], "rufield");
|
||||
serde_json::from_value(v["events"].clone()).expect("events array deserializes to FieldEvents")
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn gate_anonymous_cycle_surfaces_wellformed_signed_event() {
|
||||
let (state, app) = surface_router();
|
||||
inject(&state, RuViewPrivacyClass::Anonymous, true, false).await;
|
||||
|
||||
let events = get_field_events(&app).await;
|
||||
assert_eq!(events.len(), 1, "one occupancy cycle ⇒ exactly one surfaced event");
|
||||
let ev = &events[0];
|
||||
|
||||
// Well-formed: WiFi-CSI modality, real timestamp.
|
||||
assert_eq!(ev.tensor.modality, Modality::WifiCsi);
|
||||
assert_eq!(ev.timestamp_ns, 1_791_986_400_000_000_000);
|
||||
assert!(ev.timestamp_ns > 0, "real (non-zero) timestamp");
|
||||
|
||||
// Privacy consistent with the injected trust: Anonymous → P2, NEVER P1.
|
||||
assert_eq!(ev.observation.privacy_class, PrivacyClass::P2);
|
||||
assert_ne!(ev.observation.privacy_class, PrivacyClass::P1);
|
||||
|
||||
// Signed + fusable: the ed25519 receipt verifies (real, non-synthetic).
|
||||
assert!(!ev.provenance.synthetic, "live event is non-synthetic");
|
||||
assert!(verify_event(ev).is_ok(), "ed25519 signature must verify");
|
||||
assert!(is_fusable(ev), "verified receipt ⇒ fusable");
|
||||
|
||||
// Real position derived from the signal-field peak (not fabricated).
|
||||
assert!(ev.observation.range_m.is_some(), "field peak ⇒ a real range readout");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn gate_empty_cycle_produces_no_phantom_event() {
|
||||
let (state, app) = surface_router();
|
||||
// A no-presence cycle: nothing to describe.
|
||||
inject(&state, RuViewPrivacyClass::Anonymous, false, false).await;
|
||||
|
||||
let events = get_field_events(&app).await;
|
||||
assert!(
|
||||
events.is_empty(),
|
||||
"no-presence cycle must surface no phantom event (explicit empty payload)"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn gate_derived_trust_never_surfaces_low_privacy() {
|
||||
// The privacy-safety pin (ADR-262 §3.3 / §6): a Derived (identity) trust
|
||||
// state maps to P4/P5 and is held edge-local — it must NEVER appear on the
|
||||
// network surface, and certainly never as a low-privacy (P1/P2) event.
|
||||
for identity_bound in [false, true] {
|
||||
let (state, app) = surface_router();
|
||||
inject(&state, RuViewPrivacyClass::Derived, true, identity_bound).await;
|
||||
|
||||
let events = get_field_events(&app).await;
|
||||
assert!(
|
||||
events.is_empty(),
|
||||
"Derived cycle (identity_bound={identity_bound}) must not surface on /api/field"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn gate_mixed_stream_surfaces_only_egress_safe_events() {
|
||||
// Determinism / privacy-safety over a stream: Anonymous cycles surface,
|
||||
// interleaved Derived cycles are dropped — the surface only ever carries
|
||||
// egress-safe (P1/P2) events.
|
||||
let (state, app) = surface_router();
|
||||
inject(&state, RuViewPrivacyClass::Anonymous, true, false).await; // P2 → surfaced
|
||||
inject(&state, RuViewPrivacyClass::Derived, true, false).await; // P4 → dropped
|
||||
inject(&state, RuViewPrivacyClass::Anonymous, true, false).await; // P2 → surfaced
|
||||
inject(&state, RuViewPrivacyClass::Derived, true, true).await; // P5 → dropped
|
||||
|
||||
let events = get_field_events(&app).await;
|
||||
assert_eq!(events.len(), 2, "only the two Anonymous cycles surface");
|
||||
for ev in &events {
|
||||
assert_eq!(ev.observation.privacy_class, PrivacyClass::P2);
|
||||
assert!(is_fusable(ev));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user