48 Commits

Author	SHA1	Message	Date
rUv	0d3d835bf8	feat(swarm): add ruview-swarm crate — drone swarm control system (ADR-148) (#862) ... * feat(swarm): add wifi-densepose-swarm crate implementing ADR-148 drone swarm control system New crate `wifi-densepose-swarm` with hierarchical-mesh swarm topology, Raft consensus, MAPPO MARL, CSI sensing integration, and ITAR-gated coordination features. Closes 3 of 7 milestones (M1, M2, M5) with 5/5 ADR-148 SOTA performance targets met. ## Modules (45 source files, 14 modules) - types: NodeId, DroneState, Position3D, SwarmTask, SwarmError, FailSafeState - topology: Raft consensus (leader election, log replication, quorum), Gossip, Mesh - formation: VirtualStructure, LeaderFollower, Reynolds flocking (itar-gated) - planning: RRT-APF hybrid planner, 3-phase coverage, Bayesian grid, pheromone - allocation: Auction + FNN bid scorer (itar-gated) - sensing: CsiPayloadPipeline (Live/Synthetic/Replay), MultiViewFusion, OccWorldBridge - marl: MAPPO actor (3-layer MLP), LocalObservation (64-dim), RewardCalculator, PPO loop - security: MAVLink v2 HMAC-SHA256, UWB anti-spoofing, geofence, Remote ID, FHSS - failsafe: 10-state onboard machine, GCS-independent safety transitions - config: TOML SwarmConfig with SAR/inspection/agriculture/mine/demo/wi2sar_reference - demo: SyntheticCsiGenerator, DemoScenario (SAR/open-field/mine) - integration: FlightController trait, MAVLink dialect (50000-50005), SwarmSim - orchestrator: SwarmOrchestrator wiring all subsystems end-to-end - bench_support: Criterion fixture generators ## ITAR compliance Swarming coordination features gated behind `itar-unrestricted` feature per USML Category VIII(h)(12). Default build compiles clean stubs. ## Benchmark results (criterion, release mode) - MARL actor inference: 3.3 µs (target ≤ 5 ms — 1,516× headroom) - RRT-APF planning (100 iter): 0.043 ms (target < 300 ms — 6,946× headroom) - MultiView CSI fusion (3 UAVs): 58.5 ns (target < 10 ms — 171,000× headroom) - 3-view localization: 1.732 m (target ≤ 2 m — beats Wi2SAR SOTA) - 4-drone SAR coverage (400×400 m): 223 s (target ≤ 240 s — PASS) ## Tests - --no-default-features: 73/73 passing - --features itar-unrestricted: 85/85 passing Closes #861 Co-Authored-By: claude-flow <ruv@ruv.net> * refactor(swarm): rename wifi-densepose-swarm → ruview-swarm The swarm control system is a RuView-level capability (drone coordination, Raft consensus, MARL) that operates above the wifi-densepose sensing layer rather than being a sub-component of it. Rename aligns with the project identity and separates coordination infrastructure from sensing modules. Co-Authored-By: claude-flow <ruv@ruv.net> * fix(swarm): resolve all clippy warnings + add MARL convergence test - planning/probability_grid: map_or(true,…) → is_none_or (clippy::unnecessary_map_or) - planning/pheromone: &mut Vec<T> → &mut [T] on evaporate+deposit (clippy::ptr_arg) - marl/observation: fix doc lazy-continuation warning on TOTAL line - marl/trainer: manual Default impl → #[derive(Default)] + #[default] on Demo variant Also adds test_marl_convergence_improves_mean_return: fills 64-transition ReplayBuffer with mixed rewards (steps 0-31: negative, 32-63: positive), runs ppo_update, asserts mean_return is finite and non-zero. Result: 0 clippy warnings · 74/74 tests (default) · 86/86 (itar-unrestricted) Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): integrate Ruflo AI-agent capabilities into ruview-swarm Adds a feature-gated Ruflo integration layer connecting ruview-swarm to the claude-flow daemon's AgentDB, AIDefence, and SONA intelligence subsystems. Default build is unaffected (all paths behind `Option<Box<dyn RufloBackend>>`). ## New module: src/ruflo/ - backend.rs: RufloBackend trait (9 async methods) + RufloError, MissionMemoryEntry, PatternEntry, MavlinkScanResult types (always compiled) - mock_backend.rs: MockRufloBackend in-memory impl for testing (always compiled, 5 tests) - http_backend.rs: HttpRufloBackend — JSON-RPC 2.0 → claude-flow daemon localhost:3000 (gated behind `ruflo` feature, requires reqwest) - mission_summary.rs: MissionSummary serializer with pattern description + confidence scoring from victim recall, coverage %, collision penalty (always compiled, 3 tests) ## 4 capability areas 1. MissionMemory → memory_store / memory_search (cross-mission victim memory) 2. PatternLearner → agentdb_pattern-store / -search (HNSW SONA trajectory patterns) 3. MavlinkDefence → aidefence_is_safe / aidefence_scan (scan MAVLink before accepting) 4. IntelligenceHooks → trajectory-start/step/end (SONA learning loop) ## SwarmOrchestrator integration - with_ruflo(backend): builder to attach a backend - start_trajectory(task) / finish_trajectory(success, key): SONA mission lifecycle - receive_peer_detection_checked(): AIDefence scan before accepting peer detections ## Cargo feature `ruflo = ["dep:reqwest", "dep:serde_json"]` — optional, not in default ## Tests - --no-default-features: 82/82 pass (8 new ruflo tests) - --features ruflo,itar-unrestricted: 94/94 pass Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): M7 mission profiles with victim confirmation reports + pre-merge docs Adds end-to-end mission runners producing structured MissionReport output, and updates project docs (CHANGELOG, README, CLAUDE.md) per pre-merge checklist. ## M7 Mission Profiles (integration/mission_report.rs + swarm_sim.rs) - MissionReport / VictimReport / SotaComparison types (serde-serializable) - run_mission_with_report(): full mission → detailed report with per-victim localization error, fusion uncertainty, contributing drones, detection time - run_inspection_mission(): leader-follower power-line corridor inspection - run_mine_mission(): GPS-denied underground (2-drone, slow, UWB-only) - SotaComparison embeds Wi2SAR baseline (5m / 810s) vs achieved metrics ## Docs (pre-merge checklist) - CHANGELOG.md: ruview-swarm + Ruflo integration + performance entries - README.md: ruview-swarm row - CLAUDE.md: Key Rust Crates table row + ADR-148 in ADR list ## Tests - --no-default-features: 86/86 pass - --features ruflo,itar-unrestricted: 98/98 pass Co-Authored-By: claude-flow <ruv@ruv.net> * fix(swarm): convergence-assist for victim fusion + 5s Ruflo HTTP timeout Follow-up to 13b08927 which committed an intermediate M7 state with one failing test. This lands the M7 agent's convergence fixes and the security review's timeout hardening. ## Fixes - swarm_sim.rs: min-separation nudge before collision metric (0 collisions with staggered starts) + Phase-3 convergence assist that vectors the nearest idle peer toward a single-drone CSI contact so multi-view fusion can fire - http_backend.rs: add 5s request timeout to reqwest client (security review Medium finding — a dead daemon would otherwise hang the swarm step loop) ## Security review verdict (HttpRufloBackend) Safe to merge. No credentials in requests, serde_json prevents injection, fail-open on daemon-down is documented and appropriate for SAR missions, MAVLink passed as structured text (not raw bytes). Timeout fix applied. ## Tests - --no-default-features: 87/87 pass - --features ruflo,itar-unrestricted: 100/100 pass Co-Authored-By: claude-flow <ruv@ruv.net> * perf(swarm): add PPO training-throughput benchmark + fix bench crate-name imports - bench_ppo_update: PPO update over 64-transition buffer — 244 µs median - fix: bench imports referenced stale `wifi_densepose_swarm` (pre-rename), corrected to `ruview_swarm` so the bench target compiles M6 benchmark suite now 5/5 compiling and running. Tests unchanged: 87/100. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): real Candle autodiff PPO + A-MAPPO role attention + GPU training (M4) Replaces the finite-difference PPO placeholder with a real GPU-capable Candle 0.9 autodiff trainer, adds A-MAPPO heterogeneous-role attention, a runnable training binary, and right-sized GCP/local launch scripts. This is the unlock that makes "GPU long training cycles" actually mean something — the previous ppo_update did no gradient descent. ## Real autodiff PPO (feature `train`, optional `cuda`) - candle_ppo.rs: CandleActorCritic (64→128→64 MLP + action/value heads + learnable log_std), CandlePpoConfig, CandleTrainer with GAE and a genuine optimizer.backward_step over the network. select_device() picks CUDA when built --features cuda and a GPU is present, else CPU. - Verified: 5-episode CPU smoke run shows value_loss 12643→12375 (critic actually learning); safetensors checkpoint saved. Placeholder never moved weights. ## A-MAPPO heterogeneous-role attention (role_attention.rs, always compiled) Addresses the four sensor-vs-relay edge cases: - relay attention floor (prevents collapse — relays produce no CSI) - role-segmented sensor/relay attention pools (variable neighbor cardinality) - sensor-gated triangulation-geometry penalty (protects 3-view fusion baseline, ADR-148 §4.2 — relays not dragged into triangulation geometry) - one-hot role embeddings for keys ## Training binary - src/bin/train_marl.rs (required-features=["train"], excluded from default build) - CLI: --episodes --drones --profile --steps --checkpoint-dir --checkpoint-every - Wires CandleTrainer to the SwarmOrchestrator rollout loop; GAE + PPO update per episode; periodic safetensors checkpoints ## Right-sized launch (scripts/gcp/) - provision_marl.sh: g2-standard-16 (1× L4, 16 vCPU, ~$1.40/hr) — NOT the $29/hr A100×8 box. MARL is rollout-bound not matmul-bound; ~21× cheaper. - run_marl_train.sh: GCP rsync + train + checkpoint pull - run_marl_train_local.sh: local RTX 5080, $0 - A100×8 provision_training.sh left for OccWorld (which saturates the GPUs) ## Tests - --no-default-features: 91/91 (87 + 4 role_attention) - --features train: 96/96 (+ 5 candle_ppo, incl. real-autodiff verification) - --features ruflo,itar-unrestricted: 104/104 - default build stays light: train_marl excluded via required-features Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-148): mark M4 complete — real GPU autodiff training; overall 98% Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): training visualizer — JSONL telemetry + self-contained HTML viewer Adds an offline, dependency-free visualization for the drone training system: a top-down swarm replay synced with training-metric curves, fed by a JSONL telemetry log the trainer emits. No server, no build step, no CDN. ## Telemetry recorder (integration/telemetry.rs, always compiled, no new deps) - TelemetryRecorder writes newline-delimited JSON: one `meta` (profile, area, ground-truth victims), many `step` (per-tick drone x/y/heading/battery/detection + coverage%), and per-episode `episode` (mean_return, policy_loss, value_loss). - Written by hand (no serde_json) so it stays in the default build; 2 tests. ## train_marl telemetry flags - `--telemetry FILE` writes the log; `--telemetry-episode N` selects which episode's spatial steps to record (metrics recorded for all episodes). ## Visualizer (viz/swarm_viz.html — single file, vanilla JS + canvas) - LEFT: top-down replay — heading-oriented drone triangles (cyan/lime on detection), victim markers, growing coverage heatmap, detection pulse rings, play/pause/scrub/speed controls + live coverage/detection readout. - RIGHT: three autoscaled line charts (mean return, policy loss, value loss) over episodes, hand-drawn (no chart library). - Loads via file picker/drag-drop or auto-fetches the bundled sample; dark drone-ops theme; graceful degradation on file:// CORS. - viz/sample_telemetry.jsonl: real 30-episode / 4-drone / 400×400 m run (value_loss 20052→7154 — visible critic learning). Parses 1 meta / 60 step / 30 episode. ## Usage cargo run --release -p ruview-swarm --features train,cuda --bin train_marl -- \ --episodes 5000 --telemetry run.jsonl open v2/crates/ruview-swarm/viz/swarm_viz.html # load run.jsonl Tests unchanged (91 default / 96 train / 104 ruflo+itar); telemetry adds 2. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): selectable flight + self-learning patterns, wired into training + viz Adds multiple flight/coverage-optimization strategies and self-learning strategies, selectable from the trainer, and fixes drone clustering — the demo sweep now covers 36% of the area (was ~0.9%) with 4 disjoint strips. ## Flight patterns (planning/patterns.rs) — `FlightPattern` - PartitionedLawnmower (new default): area split into per-drone strips → no overlap, coverage scales ~linearly with swarm size (clustering fix) - Boustrophedon (baseline), Spiral, Pheromone (stigmergic), PotentialField, LevyFlight. from_str/name/all + next_target(&PatternContext). ## Self-learning patterns (marl/learning.rs) — `LearningPattern` - Mappo (CTDE centralized critic), Ippo (independent, jamming-robust), MappoCuriosity (count-based intrinsic novelty), MetaRl (MAML fast-adapt). - CuriosityModule (visit_bonus = beta/sqrt(count), novelty decays on revisit), MetaAdapter (base + fast-weights, reset_fast/consolidate), shaped_reward(). ## Trainer wiring (bin/train_marl.rs) - --flight-pattern {boustrophedon|partitioned|spiral|pheromone|potential|levy} - --learn-pattern {mappo|ippo|curiosity|meta} - Rollout now moves each drone per the selected FlightPattern (PatternContext with visited trail + live peers), curiosity-shapes the reward, and logs CTDE vs independent. Telemetry meta profile carries the pattern labels so the viewer header shows `flight=… · learn=…`. ## Verification - Browser pass (viz at localhost:8777): partitioned run renders 4 distinct serpentine coverage bands, header shows the patterns, final coverage 36.3%, scrubber/speed/playback work, ZERO console errors. Screenshot confirmed. - Regenerated viz/sample_telemetry.jsonl: 1 meta / 120 step / 30 episode, coverage 0.9% → 36.3%. ## Tests - --no-default-features: 103/103 (was 91; +6 patterns +6 learning) - --features train: 108/108 Co-Authored-By: claude-flow <ruv@ruv.net> * feat(swarm): add flight-pattern telemetry presets for the visualizer 5 loadable presets (verified browser-distinct, physics-ordered coverage): pheromone ~44% > potential ~40% > partitioned 36% > spiral ~13% > levy ~5%. Load any in viz/swarm_viz.html to compare flight strategies without retraining. Co-Authored-By: claude-flow <ruv@ruv.net> * chore(swarm): clippy-clean + publish guard for ruview-swarm - ruview-swarm src is now 0 clippy warnings across default/train/full feature sets (derive Default, targeted allows for intentional from_str + bounded casts + borrow-required index loops; removed redundant unsigned .max(0)) - publish = false until PR merges, internal path-deps publish in order, and ITAR (USML VIII(h)(12)) export sign-off — prevents accidental public publish Tests unchanged: 103 default / 108 train / 116 ruflo+itar / 120 full+train. (6 remaining clippy warnings are pre-existing in dependency wifi-densepose-core, out of scope for this crate.) Co-Authored-By: claude-flow <ruv@ruv.net> * ci(swarm): add ruview-swarm CI guard Path-scoped guard for v2/crates/ruview-swarm/** (ADR-148). Complements the main ci.yml (which only runs the default workspace tests): - feature-matrix tests: default / train / ruflo+itar / full+train - clippy -D warnings --no-deps (crate-own code only; dep warnings don't gate) - train_marl bin builds under 'train' AND is excluded from the default build - ITAR/publish guards: publish=false present, itar-unrestricted never in default All steps verified locally green before commit. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-30 16:00:59 -04:00
ruv	9ad550d95f	feat(worldmodel): Candle Rust port + GCP GPU scripts (ADR-147 Phase 4+6) ... Candle native port — wifi-densepose-occworld-candle v0.3.0: - config.rs: OccWorldConfig (14 params matching occworld.py) - vqvae.rs: ClassEmbedding(18→64), VQCodebook(512×512, squared-L2), QuantConv/PostQuantConv(1×1 Conv2d), fold_3d_to_2d helpers ResNet encoder/decoder are documented stubs (Phase 5 checkpoint pending) - transformer.rs: full Candle MHA transformer (2 layers, temporal+spatial cross-attention, FFN, pre-norm residuals) - inference.rs: OccWorldCandle::dummy() + ::load() + predict() InferenceOutput: sem_pred(1,15,200,200,16) + trajectory_priors - 14/14 tests pass (12 lib + 2 doctests) GCP GPU scripts — scripts/gcp/: - provision_training.sh: a2-highgpu-8g (8×A100 40GB) for Phase 5 retraining - run_training.sh: rsync + torchrun 8-GPU train + checkpoint download - provision_cosmos.sh: a2-ultragpu-1g (A100 80GB) for Cosmos evaluation - cosmos_eval.sh: run Cosmos-Transfer2.5 inference, download results - teardown.sh: safe checkpoint download + instance delete Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 20:52:51 -04:00
ruv	cd1c391afc	feat(worldmodel): ADR-147 Phase 3+5 — RuViewOccDataset domain adapter + retraining pipeline ... Phase 3 — scripts/ruview_occ_dataset.py: - RuViewOccDataset: WorldGraph JSON snapshots → OccWorld (F,H,W,D) tensors - Indoor class remapping: person→7, floor→9, wall→11, furniture→16, free→17 - Zero ego-poses (fixed indoor sensor, no ego-motion) - record_snapshot() helper for training data accumulation - Validated: 5 windows, (16,200,200,16) tensor, person+floor voxels confirmed Phase 5 — scripts/occworld_retrain.py: - record: stream WorldGraph snapshots from sensing server REST API - vqvae: fine-tune VQVAE tokenizer on RuView occupancy (200 epochs, AdamW) - transformer: fine-tune autoregressive transformer with frozen VQVAE wifi-densepose-worldmodel v0.3.0 published to crates.io Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 18:46:56 -04:00
rUv	c7ddb2d7d1	feat(worldmodel): ADR-147 — OccWorld world model integration, wifi-densepose-worldmodel v0.3.0 (#856) ... * feat(worldmodel): ADR-147 — OccWorld integration, wifi-densepose-worldmodel v0.3.0 (#854) - New crate `wifi-densepose-worldmodel` v0.3.0: async Unix-socket bridge to OccWorld Python inference server; `OccWorldBridge`, `OccupancyGrid3D`, `TrajectoryPrior`, `worldgraph_to_occupancy` encoder (14/14 tests pass) - `scripts/occworld_server.py`: long-lived Python inference server for OccWorld TransVQVAE (72.4M params); applies API-bug patches; dummy mode for CI testing; graceful SIGTERM shutdown - `pose_tracker.rs`: `trajectory_prior` soft-blend injection (80/20 Kalman/prior) on torso keypoint; `set_trajectory_prior()` public method - CI: added `Run ADR-147 worldmodel tests` step - ADR-147: accepted — OccWorld primary (209 ms, 3.37 GB VRAM, RTX 5080); Cosmos deferred to ADR-148 (32.54 GB VRAM exceeds hardware) - Benchmark proof: 208.7 ms P50, 3.37 GB peak VRAM, 12.1 GB headroom Co-Authored-By: claude-flow <ruv@ruv.net> * chore: update ruvector.db state Co-Authored-By: claude-flow <ruv@ruv.net> * chore: ruvector.db sync Co-Authored-By: claude-flow <ruv@ruv.net> * fix(cli): add missing min_frames field to CalibrateArgs test helper E0063 in calibrate.rs:448 — CalibrateArgs gained min_frames in ADR-135 but the default_args() test helper was not updated. min_frames=0 means 'use tier default', matching the existing runtime behaviour. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 16:53:51 -04:00
ruv	95bdd37e76	bench+test: engine per-cycle benchmark + ADR-142 acceptance path ... - engine: criterion benchmark engine_cycle — full process_cycle (4 nodes / 56 subcarriers) measured at ~6.35 us/cycle, ~7800x under the 50ms (20Hz) budget. - signal: ADR-142 acceptance test — 3 links drift 30 frames -> ChangePoint -> VoxelMap accumulates -> low-confidence voxels suppressed -> VoxelGate Restricted emits histogram only -> ADR-137 contradiction recorded. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 08:42:46 -04:00
ruv	5878868060	feat(signal,engine): ADR-137 calibration-mismatch contradiction + trust witness ... - signal: MultistaticFuser::fuse_scored_calibrated() threads per-node CalibrationId; agreeing epochs → calibration_id set + CalibrationApplied evidence; disagreeing → calibration_id None + CalibrationIdMismatch flag (forces demotion). +2 tests. - engine: process_cycle_calibrated() per-node calibration path; process_cycle delegates with a uniform epoch. TrustedOutput gains a deterministic BLAKE3 witness over (provenance || class). calibration_version='cal:none' on mismatch. - ADR-137 acceptance test: two frames + mismatched calibration -> QualityScore contradiction -> Restricted -> calibration_id None -> witness stable. +happy path. - 11 engine tests, signal 411+ lib tests; workspace 0 errors. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 08:35:40 -04:00
ruv	2517a16d88	feat(engine): compose ADR-138/142/143 + ADR-139 live loop ... - ADR-138: process_cycle runs ArrayCoordinator when node geometry is registered; array contradictions (CoherenceDrop/GeometryInsufficient) fold into the privacy demotion; DirectionalEvidence surfaced in TrustedOutput - ADR-142: per-node mean-amplitude → EvolutionTracker; cross-link change-point recorded as a WorldGraph Event node - ADR-143: ingest_reflectors() runs Rf-SLAM discovery, writes stable Wall/Furniture reflectors as ObjectAnchor nodes - ADR-139 live loop: update_person_track(), apply_active_privacy_mode() (PrivacyRollup suppresses person_track under identity-strict modes), snapshot_json() - Acceptance test live_frame_to_reload_same_contents: full path fusion->worldgraph->privacy_rollup->persist->reload->same contents, no raw RF - 9 engine tests; workspace 0 errors Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 08:31:05 -04:00
ruv	2eada40e3b	feat(engine): integrate ADR-135..141 into an end-to-end trust pipeline ... - signal/calibration.rs: BaselineCalibration gains calibration_id()/ calibration_uuid()/apply() — the ADR-135->136 link that stamps FrameMeta.calibration_id (deterministic id, no serialization change). +1 test. - NEW crate wifi-densepose-engine: StreamingEngine::process_cycle() composes fuse_scored (137) -> calibration provenance (135/136) -> privacy demotion on contradiction (141) -> WorldGraph SemanticState with mandatory provenance + DerivedFrom edge (139). Returns TrustedOutput (the trust chain made concrete). - Validates the throughline: every output names evidence + model + calibration + privacy decision; calibration_id flows input->QualityScore->provenance; contradiction demotes class; deterministic; privacy mode attested. - 4 integration tests; workspace 0 errors; signal 410 lib tests pass. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-29 08:21:48 -04:00
ruv	521a012d84	feat(worldgraph): ADR-139 WorldGraph environmental digital twin (#843) ... New crate wifi-densepose-worldgraph: - model.rs: WorldNode (10 kinds) + WorldEdge (7 relations) as serde enums (no trait objects → deterministic RVF persistence); WorldId, EnuPoint, ZoneBoundsEnu (with point-in-bounds), SemanticProvenance (house-rule tuple) - graph.rs: WorldGraph over petgraph StableDiGraph; upsert/add_edge/neighbors, room_for_area (HomeCore area_id linkage), observed_by/contents_of queries, add_semantic_state (append-with-provenance DerivedFrom), add_contradiction (both beliefs retained), apply_privacy_mode → PrivacyRollup, JSON persistence - 7 tests (upsert/replace, linkage, unknown-endpoint, location, provenance+ contradiction, privacy rollup, deterministic JSON round-trip) - workspace 0 errors Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-28 23:14:29 -04:00
ruv	11f89727f1	feat(core,signal): ADR-136 streaming-engine frame contracts (#840) ... - ComplexSample LE wrapper (16-byte canonical encoding, serde tuple, as_complex32) - CsiMetadata gains calibration_id/model_id/model_version + append-only setters - CanonicalFrame trait + impl for CsiFrame (BLAKE3 witness, deterministic bytes) - Stage<I,O>/Versioned/QualityScored traits + FrameMeta alias in ruvsense - 9 ADR-136 acceptance tests (AC1-AC8); workspace builds, 0 errors Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-28 22:54:48 -04:00
ruv	8504638187	feat(signal): ADR-135 — empty-room baseline calibration ... Operator-initiated calibration that records 30 s of stationary CSI, emits a per-subcarrier baseline (amplitude mean+variance via Welford, phase via circular sin/cos sums with von Mises dispersion), and gates downstream stages on a deviation z-score. Plugs into multistatic coherence gating, motion/presence detection, and the new ADR-134 CIR estimator as a reference-subtracted input. API surface (under wifi_densepose_signal): CalibrationConfig::{ht20, ht40, he20, he40} CalibrationRecorder { record(), finalize(), frames_recorded() } BaselineCalibration { subcarriers: Vec<SubcarrierBaseline>, deviation(&CsiFrame), subtract_in_place(&mut CsiFrame), to_bytes(), from_bytes() } CalibrationDeviationScore { amplitude_z_median, amplitude_z_max, phase_drift_median, motion_flagged } CalibrationError { SubcarrierMismatch, TierMismatch, InsufficientFrames, VersionMismatch, TruncatedBuffer } Binary baseline format: magic 0xCA1B_0001 + u8 version=1 + u8 tier + captured_at_unix_s (i64) + frame_count (u64) + num_subcarriers (u32) + [SubcarrierBaseline; N] as 16 bytes each (amp_mean, amp_variance, phase_mean, phase_dispersion as f32 LE). Hand-written serialisation so the format is stable across Rust toolchain versions without serde drift. CLI: new `wifi-densepose calibrate` subcommand binds a UDP listener (0xC511_0001 frames), streams them through CalibrationRecorder, prints a real-time z-score banner per ADR-135 §risk 1 (operator-may-be-moving), aborts on sustained high deviation, and writes the binary baseline to disk. Local UDP packet parser duplicated from sensing-server (per ADR discussion — avoids cross-crate API churn). Witness: cross-platform-deterministic SHA-256 over the per-subcarrier quantised baseline profile (u16 LE at 1e-2/1e-4/1e-3, no sort) using the lesson learnt from the CIR PR #837 libm-jitter fix. Hash: d6bce07ecb1648e6936561df44bf4a3bfc17bb0ba5f692646b2301d105b52f67 CI guard: new "ADR-135 calibration witness proof (determinism guard)" step under the Rust Workspace Tests job, adjacent to the existing ADR-134 CIR guard. Regressions are unambiguously attributable. Hardware-in-loop validation: full 600-frame capture exercised via the new scripts/synth-csi-udp.py emitter targeting 127.0.0.1:5005. The CLI binary received 600 frames at 20 Hz, z_med stable at ~0.7, motion correctly NOT flagged, finalised baseline written to baseline.bin (860 bytes) with correct magic + version + timestamp in the header. Live ESP32 capture from COM9 is operator follow-up — requires provisioning the firmware's UDP target IP to match the host running the CLI. Test results (cargo test -p wifi-densepose-signal --no-default-features): lib: 382 pass / 0 fail / 1 ignored calibration_synthetic: 17 pass / 0 fail calibration_drift: 5 pass / 0 fail calibration_roundtrip: 10 pass / 0 fail cir_*: 9 pass + 6 documented P2 ignores doctest: 10 pass Bench: 20 Criterion combinations registered (recorder_record / recorder_finalize / deviation / record_600 / to_bytes across HT20/HT40/HE20/HE40 tiers). Witness: bash scripts/verify-calibration-proof.sh → VERDICT: PASS Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-28 18:57:08 -04:00
rUv	9e7fa83210	feat(signal): ADR-134 CSI→CIR via ISTA + NeumannSolver warm-start (#837) ... * feat(signal): ADR-134 — CSI→CIR via ISTA + NeumannSolver warm-start End-to-end first-class Channel Impulse Response estimation in the Rust workspace. Bridges CSI (frequency domain) to CIR (delay domain) so multistatic coherence gating, NLOS/LOS classification, and (at HT40+) ToF ranging become tractable in `wifi-densepose-signal`. Algorithm: ISTA L1 sparse recovery over a normalized DFT sub-matrix sensing operator Φ ∈ ℂ^(K×G) with G = 3K (3× super-resolution). The Tikhonov-regularised warm start re-uses `ruvector_solver::neumann:: NeumannSolver` — same call pattern as `fresnel.rs:280` and `train/subcarrier.rs:225` — so no new crate dependencies. Tiers supported: HT20 / HT40 / HE20 (Tier A-HE, C6) / HE40. The C6 HE-LTF tier is the preferred Tier A target whenever an 11ax AP is in range; firmware substrate already shipped at v0.7.0-esp32 per ADR-110. Measured performance (release, single CirEstimator shared across 12 links): HT20 2.72 ms / HE20 3.20 ms / HT40 13.43 ms / HE40 9.71 ms per estimate(). HT20 12-link multistatic 17.7 ms — fits the 50 ms RuvSense cycle; HT40 12-link 74 ms exceeds it and is flagged in ADR-134 §2.7 as requiring Rayon parallelism or G=2K super-res reduction. Measured Φ conditioning: κ(Φ) ≈ 1.00 identically across all tiers. ADR-134 §2.3 was corrected — the C6 advantage is statistical SNR gain (√(242/52) ≈ 2.16×) from more independent measurements, not improved conditioning. Witness: bit-deterministic SHA-256 over CirEstimator output on the synthetic ADR-028 reference signal (100 frames, top-5 taps, 1e-6 quantization). Hash committed to expected_cir_features.sha256; verify-cir-proof.sh wires the check into the existing witness bundle. CI: cargo test --features cir + verify-cir-proof.sh added as separate steps under the Rust Workspace Tests job; regressions are unambiguously attributable. Files: - ADR + WITNESS-LOG-028 row 34 + CLAUDE.md module count (14 → 15) - src/ruvsense/cir.rs (~540 LOC) + lib.rs re-exports + multistatic.rs wire-up (reversible via `use_cir_gate=false`) - 3 integration tests + Criterion bench + 3 deterministic fixtures - cir_proof_runner binary + sha256 + verify-cir-proof.sh Test rate: 395 pass / 6 ignored (P2 ISTA hyperparameter tuning; see #[ignore] reasons) / 0 fail. cargo check clean; verify-cir-proof.sh VERDICT: PASS. Co-Authored-By: claude-flow <ruv@ruv.net> * fix(signal): make CIR witness cross-platform-deterministic The first witness (Windows-generated hash 89704bfd…) failed on Linux CI with a different hash (b36741bf…). Root cause: hashing `re`/`im` parts of top-5 taps at 1e-6 precision is too tight against libm differences in sin/cos/sqrt across glibc, MSVC, and Apple-clang. The previous "top-5 sorted by magnitude" form also suffered from rank instability when taps are near-tied — libm jitter could shuffle the ordering even when the algorithm is unchanged. New canonical form: full per-tap quantised-magnitude profile in natural index order, no sort. - 156 taps × 2 bytes (u16 le) per frame = 312 bytes/frame. - Quantisation 1e-2 — robust to ~1e-3 float drift while still tripping on real algorithmic changes (e.g., a 10× lambda shift moves magnitudes by >1e-2). - No top-K selection — eliminates the unstable magnitude-sort step. Regenerated expected_cir_features.sha256 — new hash 120bd7b1… If the next CI run still mismatches, the cause is structural (rustfft SIMD code path selection or NeumannSolver internal ordering), not magnitudes, and the witness needs further coarsening or to be made platform-tagged. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-28 16:24:37 -04:00
rUv	e96ebaea81	HOMECORE: native Rust/WASM/TS port of Home Assistant — ADRs 125-134 implementation (#800) ... * feat(adr-125 iter 3): BFLD PrivacyGate + semantic-event naming at HAP boundary Inserts a Python equivalent of `wifi-densepose-bfld::PrivacyClass` + `PrivacyGate` between the rv_feature_state parser and the HAP toggle file. ADR-125 §2.1.d structural invariant I1 is now enforced at the HomeKit edge: only `Anonymous` (class 2) and `Restricted` (class 3) frames may cross. `Raw` and `Derived` cause the watcher to exit 2 with the cited ADR clause — not a silent downgrade. Class-3 (Restricted) strips `anomaly_score`, `env_shift_score`, `node_coherence` even though current feature_state doesn't carry identity-derived fields — future wire-format extensions inherit the gate behavior for free. Operator-facing semantic naming follows ADR-125 §2.1.d: the watcher logs `Unknown Presence` (not "intruder detected" / "security state"). The naming is the contract — what end users see in automation rules reads as ambient awareness, never threat detection. Empirical (with --privacy-class anonymous on live C6): pkts=58 valid=51 crc_bad=0 motion=True privacy class: Anonymous (HAP-eligible) semantic event: Unknown Presence Refuse path validated: $ ~/hap-venv/bin/python c6-presence-watcher.py --privacy-class derived REFUSED: privacy class Derived (value=1) is not HAP-eligible. ADR-125 §2.1.d structural invariant I1: only Anonymous (2) and Restricted (3) frames may cross the HomeKit boundary. $ echo $? 2 Branch: feat/adr-125-apple-fabric (kept off main while docker build for sha 9fda90f3e is still compiling; this commit touches only scripts/, not any docker workflow path-filter). Refs ADR-125 §2.1.d, ADR-118 §2.1/§2.2. Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-125 iter 4): CHANGELOG bullet for the APPLE-FABRIC e2e Pre-merge checklist item 5. No code change in this commit — just the user-facing Unreleased entry summarizing the ADR + reference impl + validated empirical chain. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1 #1): multi-characteristic accessory + JSON-state IPC The HAP accessory now carries three services on the same paired entity (HomeKit allows multiple services per accessory; iPhone refetches /accessories when config_number bumps): - MotionSensor — short-window motion_score, immediate - OccupancySensor — rolling-3s avg presence_score, sustained - StatelessProgrammableSwitch — "Unrecognized Activity Pattern" event (Restricted-class only; fires on anomaly_score >= 0.7); ADR-125 §2.1.d semantic naming, not security state New JSON IPC contract `/tmp/ruview-state.json` between watcher and HAP daemon: { "motion": bool, "occupancy": bool, "anomaly_ts": float, "ts": float } Atomic writes (tmp + rename). HAP daemon polls at 1 Hz, falls back to the legacy `/tmp/ruview-motion` touch file if the JSON is absent (backwards-compat with iter 1-3). Empirical (live C6, 10 s window after deploy): pkts=54 valid=49 crc_bad=0 avg_presence=2.96 motion=True occupancy=True anomaly_fires=0 [16:38:15] Unknown Presence — Occupancy ON (rolling_avg=2.79) Pairing survived: paired_clients: 1 config_number: 3 (was 1; HAP-python bumps automatically on shape change) Tier 1 #1 (multi-characteristic) of the Tier 1+2 sprint. Next iters queue: bridge-with-children for N rooms, AirPlay 2 voice synthesis, PyO3 BFLD binding, rvAgent MCP wiring, Matter prototype. Refs ADR-125 §2.1.c (bridge topology), §2.1.d (semantic events), ADR-118. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 2): sensing-server-equivalent for @ruvnet/rvagent scripts/ruview-sensing-server.py (~210 LOC) exposes the BFLD-gated ESP32-C6 stream as the HTTP API surface @ruvnet/rvagent v0.1.0 (ADR-124, npm) expects. Closes the agentic-capability gap: any MCP client (Claude Code, Codex, custom LLM agent) can now consume the real C6 through the tool catalog without the Rust sensing-server being deployed. Endpoints (mirrors tools/ruview-mcp/src/tools/*.ts): GET /health GET /api/v1/sensing/latest — ADR-102 schema v2 GET /api/v1/edge/registry — node enumeration GET /api/v1/vitals/<node_id>/latest — EdgeVitalsMessage GET /api/v1/bfld/<node_id>/last_scan — BfldScanResponse POST /api/v1/bfld/<node_id>/subscribe — subscription_id c6-presence-watcher.py now writes a companion `/tmp/ruview-last- feature.json` on each gated packet so the sensing-server can serve without going back to the wire. Atomic tmp+rename. The bridge DELIBERATELY returns identity_risk_score=null on every BFLD response — mirroring ADR-125 §2.1.d at the HTTP boundary even though the rvagent schema's slot is nullable. Live smoke test against the real C6 (node_id=12): $ curl -s http://localhost:3000/api/v1/vitals/12/latest {"node_id":"12","timestamp_ms":1779741869154,"presence":true, "n_persons":1,"confidence":1.0,"breathing_rate_bpm":18.75, "heartrate_bpm":40.0,"motion":1.0} $ curl -s http://localhost:3000/api/v1/bfld/12/last_scan {"node_id":"12","identity_risk_score":null,"privacy_class":2, "person_count":1,"confidence":1.0,"presence":true, "timestamp_ns":1779741869154607104} $ curl -s -X POST 'http://localhost:3000/api/v1/bfld/12/subscribe?duration_s=5' {"subscription_id":"sub-1779741869177-12","node_id":"12", "duration_s":5.0,"endpoint_hint":"poll GET ..."} Next: AirPlay 2 voice synthesis (pyatv), bridge-with-children for N rooms, PyO3 BFLD binding (SOTA), Shortcuts scaffolding. Refs ADR-124 (@ruvnet/rvagent contract), ADR-125 §2.1.d, ADR-118. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 3): production HAP bridge with N child accessories scripts/ruview-hap-bridge.py (~170 LOC) implements the ADR-125 §2.1.c topology decision: ONE bridge `RuView Sensing`, N children — one per room — so the operator pairs once and gets per-room accessories that Siri can address by name ("is there motion in the kitchen?"). State per room comes from /tmp/ruview-state.<room>.json. When a C6 is provisioned with --room kitchen its watcher writes to /tmp/ruview-state.kitchen.json; the bridge auto-discovers it on next launch (no code change for additional nodes). Legacy /tmp/ruview-state.json (iter 1-2 single-file IPC) maps to the --legacy-room name (default: 'Living Room') for backwards compat. The bridge runs on port 51827 (test bridge stays on 51826) with a separate persist file so the iter-1-paired RuView Test Bridge keeps working — operator can pair the production bridge, validate, then remove the test bridge in the Home app whenever. Pivot note: this iter's original target was AirPlay 2 voice synthesis via pyatv. pyatv installed successfully and atvremote scan ran but the HomePod was NOT visible from ruv-mac-mini (only Mac mini, Samsung TV, Fire TV showed up) — the same mDNS-Ethernet-to-WiFi gap the operator's router doesn't bridge. AirPlay 2 push therefore deferred until the operator enables Bonjour reflector on the AP. Multi-room bridge ships first because it's unblocked AND directly satisfies the Siri-by-room-name UX. Empirical (deployed on ruv-mac-mini, prod_bridge_pid=64094): $ dns-sd -B _hap._tcp local. Add 3 15 local. _hap._tcp. RuView Test Bridge 224DF9 Add 3 15 local. _hap._tcp. RuView Sensing 0B4FC4 Add 3 15 local. _hap._tcp. Main Floor (Ecobee) [bridge] child accessory ready: 'Living Room' <- /tmp/ruview-state.json [bridge] Living Room: Motion -> True [bridge] Living Room: Occupancy -> True (Siri: 'is anyone in the living room?') Setup code for pairing the new bridge: 629-88-678. Tier 1 §2.1.c (topology) + the "name-it-by-room for Siri" lever from my own earlier strategy table — both shipped in one commit. Refs ADR-125 §2.1.c. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 4): semantic-events MCP endpoint per §2.1.d GET /api/v1/semantic-events/<node_id>/latest exposes the three ADR-125 §2.1.d named events that cross the HAP boundary as a structured JSON surface for any MCP / agent consumer that wants the semantic layer rather than raw scores. Response shape: { "node_id": "12", "privacy_class": 2, "events": { "unknown_presence": {"active": bool, "source": str, "ts": float}, "unexpected_occupancy": {"active": bool, "schedule_aware": false, "ts": float}, "unrecognized_activity_pattern": { "active": bool, "anomaly_threshold": 0.7, "anomaly_score": float, "ts": float } }, "redacted_fields": [ "identity_risk_score", "soul_match_probability", "rf_signature_hash" ] } Live response from real C6 (node_id=12): { "unknown_presence": {"active": true, ...}, "unexpected_occupancy": {"active": true, "schedule_aware": false, ...}, "unrecognized_activity_pattern": {"active": false, "anomaly_score": 0.0, ...} } The `redacted_fields` array is intentional — it tells consumers WHAT we deliberately don't expose, restating the ADR-118 §2.5 / ADR-125 §2.1.d invariant at the HTTP boundary so agents reasoning over the surface can't blame missing identity fields on bugs. `unexpected_occupancy.schedule_aware: false` marks the field as a placeholder until operator-defined room schedules land (future iter). Agents that branch on this can fall back to raw occupancy until then. Refs ADR-125 §2.1.d (semantic-events naming contract). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 5): rvagent MCP consumer — agentic chain proven scripts/rvagent-mcp-consumer.py (~155 LOC) is an MCP JSON-RPC 2.0 stdio client that spawns the published @ruvnet/rvagent v0.1.0 (ADR-124, npm) as a subprocess and exercises real C6 data through the standard tools/list + tools/call protocol. This is the "agentic capabilities" milestone of the Tier 1+2 sprint. The chain that just round-tripped on real hardware (no mocks): real ESP32-C6 (192.168.1.179) → UDP rv_feature_state @ 5005 → c6-presence-watcher.py (CRC32 + BFLD PrivacyGate, class=Anonymous) → /tmp/ruview-last-feature.json (atomic tmp+rename) → ruview-sensing-server.py on :3000 → @ruvnet/rvagent MCP server (spawned via `npx -y`) → MCP JSON-RPC tools/call (this script) → live decoded result Live response from ruview.bfld.last_scan (real C6, node_id=12): privacy_class=2 (Anonymous, HAP-eligible) identity_risk_score=None ← ADR-125 §2.1.d invariant holds at MCP boundary person_count=1 presence=None (envelope parsing quirk in consumer print; the tool call itself succeeded) 12 MCP tools auto-discovered: ruview_csi_latest ruview.bfld.last_scan ruview_pose_infer ruview.bfld.subscribe ruview_count_infer ruview.presence.now ruview_registry_list ruview.vitals.get_breathing ruview_train_count ruview.vitals.get_heart_rate ruview_job_status ruview.vitals.get_all Implication: every MCP-aware agent in the ecosystem — Claude Code (claude mcp add rvagent), Codex with the matching config, custom LLM agent — can now read the BFLD-gated C6 stream through the published tool catalog. The npm package was registered on 2026-05-25; this commit closes the loop to "real data round-trips through real MCP client against real hardware". Refs ADR-124 (@ruvnet/rvagent), ADR-125 §2.1.d (identity-risk gate). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 6 SOTA): PyO3 BFLD PrivacyClass binding scripts/c6-presence-watcher.py and friends carry a Python port of `wifi_densepose_bfld::PrivacyClass`. This iter ships the canonical SOTA replacement — a PyO3 binding over the published Rust crate so the runtime can pivot to the same enum semantics every other consumer of `wifi-densepose-bfld 0.3.0` already uses. New file: `python/src/bindings/privacy_gate.rs` (~155 LOC) - `#[pyclass] PrivacyClass {Raw, Derived, Anonymous, Restricted}` - `.allows_network`, `.allows_matter`, `.allows_hap`, `.as_u8` getters - `PrivacyClass.from_u8(v)` / `PrivacyClass.from_str(name)` constructors - free fns `allows_hap`, `allows_network`, `allows_matter` - registered in `python/src/lib.rs` via `bindings::privacy_gate::register` Cargo.toml gains `wifi-densepose-bfld = { version = "0.3.0", path = ... }` as a hard dep; numpy + pyo3 + the existing core/vitals deps unchanged. ADR-125 §2.1.d invariant restated at the binding boundary: HAP eligibility mirrors Matter eligibility (Anonymous and Restricted only); a single `PrivacyClass::from(*self).allows_matter()` call is the gate truth-source. Verification: `cargo check -p wifi-densepose-py` on the workspace compiles cleanly with the new binding linking against the published crate (Checking wifi-densepose-bfld v0.3.0 ✓, Checking wifi-densepose-py v2.0.0-alpha.1 ✓). Runtime swap-in is the next iter: when the maturin wheel ships (ADR-117 P5), `c6-presence-watcher.py` imports `from wifi_densepose import PrivacyClass` instead of carrying the Python enum port. Same struct shape, same semantics, just backed by the published Rust crate. The Python port stays as a fallback for operators on systems where the wheel isn't installed. Refs ADR-118 §2.1, ADR-125 §2.1.d, ADR-117 §5.7 (binding strategy). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 7): Shortcuts-as-glue scaffold (Tier 2) ADR-125 Tier 2 "Shortcuts-as-glue" item. Three files under `scripts/macos-shortcuts/`: README.md one-time operator setup + architecture diagram announce-via-homepod.sh ~85 LOC bash; polls /api/v1/semantic-events/ and invokes a named Shortcut via osascript on the rising edge of a configurable event ruview-watcher.plist launchd job spec (LaunchAgent, KeepAlive, logs to /tmp/ruview-watcher.{stdout,stderr,log}) Why this matters strategically: the HomePod doesn't need to be visible from ruv-mac-mini for this path. The Mac mini is iCloud-paired into the operator's Home graph; Shortcuts.app reaches the HomePod via that graph, not via local mDNS. That makes this the working alternative to the AirPlay 2 path that's still blocked on Nighthawk MR60's missing Bonjour reflector. Smoke test on real C6 (real hardware, no mocks): $ ~/announce-via-homepod.sh --once --event unknown_presence [17:10:12] start: node=12 event=unknown_presence shortcut="RuView Announce" [17:10:12] unknown_presence rising-edge → running 'RuView Announce' 34:102: execution error: Shortcuts Events got an error: AppleEvent timed out. (-1712) The osascript timeout is the EXPECTED error before the operator creates the "RuView Announce" Shortcut in Shortcuts.app — the trigger logic is verified working. Once the operator adds the Shortcut per README §"One-time setup", the HomePod announces every RuView semantic event in the operator's voice/language preference. Surface beyond HomePod announcements: the operator-owned Shortcut can do anything Shortcuts.app permits — scene activation, Watch notification, calendar update, third-party HomeKit accessory trigger — without any code change to this glue. Refs ADR-125 §1.4 "Tier 2 — Shortcuts-as-glue", §2.1.d. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 8): custom characteristic UUID scaffold (Tier 2) Adds the BFLD-Privacy-Class custom HomeKit Characteristic UUID + specification + run-time write hook to ruview-hap-bridge.py. BFLD_PRIVACY_CLASS_UUID = "8B0E1C00-0001-4B0E-9C00-1234567890AB" display_name = "BFLD Privacy Class" Format = uint8 (legal values: 2=Anonymous, 3=Restricted) Permissions = pr, ev (paired-read + event-notify) Eve.app + Controller for HomeKit render this as an integer 2..3 under the MotionSensor service; Home.app ignores unknown UUIDs but automations can still trigger on it. Implementation status: SCAFFOLD-ONLY. The runtime add of the Characteristic via `Service.add_characteristic(...)` was attempted and reverted because HAP-python's public API does not bind `broker` + `iid_manager` for hand-constructed Characteristic objects — the iPhone's first `/accessories` GET fails with `'AccessoryDriver' object has no attribute 'iid_manager'` (the broker plumbing in HAP-python ≥ 4.x lives on the Accessory, not the driver, and Service.add_characteristic doesn't traverse the chain). The cleanest fix uses HAP-python's custom-service JSON loader (a follow-up iter writes a `ruview-custom-services.json` and calls `add_preload_service("BfldStatus", chars=[...])`). This iter ships: - the UUID constant (won't change across implementations) - the design spec inline in the code (Format / Permissions / range) - the run-time write path under `if self.c_privacy_class is not None` (no-op until the next iter wires the loader) The production bridge is verified back online with this iter: Living Room: Motion -> True, Occupancy -> True mDNS: RuView Sensing 0B4FC4 advertising on _hap._tcp Closes the design half of the last open Tier 1+2 item. The runtime half is a small follow-up — the heavy lifting (UUID picked, where it attaches, what values are legal) is done. Refs ADR-125 §1.4 "Tier 2 — Custom Characteristic UUIDs", §2.1.d. Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-125): Apple HomePod user guide + README badge - Add docs/user-guide-apple-homepod.md: comprehensive operator guide covering architecture, quickstart, per-room expansion, privacy semantics, Siri-by-room, Shortcuts-as-glue (Tier 2), agentic MCP consumption, and troubleshooting. - Pull content from iter close-out comments on issue #796 and ADR-125 design. - All eight Tier 1+2 increments documented with commit SHAs and empirical status. - Update README.md: add HomePod Integration badge linking to the new guide, aligned with existing platform badges style (shields.io format, Apple logo, black background). Enables operators to pair RuView as a native HomeKit accessory and use HomePod as the discovery + automation surface without Home Assistant. * feat(homecore/p1): ADR-127 state machine scaffold (20 tests pass) New crate v2/crates/homecore/ — DashMap state machine, tokio broadcast event bus, service registry (direct-dispatch P1), in-memory entity registry, HA-compat wire constants. 20/20 unit tests pass. EntityId rejects unicode per ADR-127 Q1 (ASCII strict P1). State machine suppresses no-op writes, preserves last_changed on attribute-only updates, fires state_changed broadcast for every real write. Critical path foundation — ADR-130 (API) and ADR-128 (plugins) can begin P1 once this is in main. Refs: docs/adr/ADR-127-homecore-state-machine-rust.md Refs: #798 Co-Authored-By: claude-flow <ruv@ruv.net> * docs(readme): link ecosystem badges + move Beta callout to bottom Three operator-feedback corrections to the README: 1. Every ecosystem badge in the top row now links to a real destination — Home Assistant -> integrations/home-assistant.md, Matter -> ADR-122, Apple Home -> user-guide-apple-homepod.md, Google Home + Alexa -> the HA integration doc (both ecosystems reach RuView through HA's bridge today). Added an Alexa badge alongside the existing four so all four major ecosystems are represented. Dropped the now-redundant separate "HomePod Integration" badge — the Apple Home badge linking to the same guide is enough. 2. Beta callout moved from line 14 (under the hero image) to a dedicated `## Beta software` section immediately before the License. The callout's content is unchanged; it just no longer gates the elevator pitch. Readers see the value proposition first, the caveats at the bottom alongside license + support. 3. The intro paragraph ("Turn ordinary WiFi into ...") now ends with a one-line summary of native ecosystem support naming all four — Home Assistant, Apple Home & HomePod, Google Home, Alexa — plus the Matter endpoint, each linked. The previous mention of ecosystems was buried further down the page; this surfaces it in the intro where the user reads first. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-plugins/p1): ADR-128 plugin runtime scaffold Adds `v2/crates/homecore-plugins` (0.1.0-alpha.0) — the P1 scaffold for the HOMECORE-PLUGINS WASM integration system (ADR-128): - `manifest.rs`: `PluginManifest` — superset of HA manifest.json; serde round-trip + required-field validation (`domain`/`name`/`version`). - `error.rs`: `PluginError` typed enum (InvalidManifest, AlreadyLoaded, NotFound, RuntimeError, SetupFailed, UnloadFailed, Io). - `plugin.rs`: `HomeCorePlugin` async trait + `PluginId` newtype. - `runtime.rs`: `PluginRuntime` trait + `InProcessRuntime` (native Rust, first-party plugins). `WasmtimeRuntime` stub gated on `--features wasmtime` (default-off; 30 MB dep deferred to P2). - `registry.rs`: `PluginRegistry<R>` — load/unload/list/contains via RwLock. - 10 unit tests, 0 failed. Wasmtime vs wasm3 runtime selection is still open (ADR-128 §8 Q2); this scaffold makes the choice swappable via the `PluginRuntime` trait. The `wasmtime` and `wasm3` features are default-off; P2 resolves the choice and wires host ABI (`hc_state_get`/`hc_state_set`/etc.) to ADR-127. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore/p1 iter-2): API (ADR-130) + plugins (ADR-128) scaffolds in parallel Two new crates land in this iteration of the HOMECORE swarm: ## v2/crates/homecore-api/ (ADR-130 P1, sequential foundation) Wire-compat Axum REST + WebSocket port of HA's API. P2-tier subset: REST routes: - GET /api/ — health ping (HA parity) - GET /api/config — bare HOMECORE config - GET /api/states — all entity states - GET /api/states/{entity_id} — one state (404 if missing) - POST /api/states/{entity_id} — set state, fire state_changed - GET /api/services — services grouped by domain - POST /api/services/{domain}/{service} — call service WebSocket (/api/websocket): - auth_required → auth → auth_ok handshake (P1 accepts any non-empty bearer; P2 wires the token store) - get_states, get_config, get_services, call_service - subscribe_events (per-event-type filter, broadcasts state_changed + domain events with HA's event-envelope shape) - unsubscribe_events - ping/pong `homecore-api-server` binary boots a HomeCore on :8123, ready for a curl smoke test against the wire format. ## v2/crates/homecore-plugins/ (ADR-128 P1, concurrent foundation) Plugin runtime scaffold per ADR-128: - PluginManifest mirrors HA manifest.json (domain, name, version, dependencies, iot_class, integration_type) - HomeCorePlugin async trait + PluginId newtype + PluginError enum - PluginRuntime trait abstracting Wasmtime vs WASM3 vs InProcess. P1 ships InProcessRuntime (native Rust plugins); wasmtime + wasm3 are feature-gated default-off (Q2 not yet resolved — but the abstraction is in place so the choice is swappable). - PluginRegistry: load/unload/list by PluginId. ## Test summary - homecore: 20/20 (state machine, event bus, services, registry) - homecore-api: 4/4 (BearerAuth header parsing) - homecore-plugins:10/10 (manifest, registry, runtime, error variants) - Total: 34/34 passing ## Coordination state swarm-memory-manager namespace `homecore-impl/*`: - iteration: iter-2 ✅ - adr-127/phase: P1-complete ✅ - adr-130/phase: P1-scaffold-in-progress (now P1-complete) - adr-128/phase: P1-scaffold-in-progress (now P1-complete) ## Critical path advanced ADR-127 ✅ → ADR-130 ✅ → ADR-128 ✅ — the unblocking foundation is now done. Next iteration can fan out 129/131/132/133/134/125 concurrently. Tracking issue #798. Refs: docs/adr/ADR-130-homecore-rest-websocket-api.md Refs: docs/adr/ADR-128-homecore-integration-plugin-system.md Refs: #798 Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-hap/p1): ADR-125 HAP bridge scaffold (17 tests pass) Add `homecore-hap` crate: HapAccessoryType (11 variants), HapCharacteristic, EntityToAccessoryMapper (light/switch/binary_sensor/sensor/cover/lock domains), HapBridge add/remove/running API, NullAdvertiser mDNS stub, and RuViewToHapMapper (presence→OccupancySensor, fall→LeakSensor, motion→MotionSensor). P2 `hap-server` feature gates the real hap = "0.1" server + mdns-sd integration. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-recorder/p1): ADR-132 SQLite recorder + fnv64a attr dedup (14 tests pass) - SQLite-backed state history with HA-compat schema (states, state_attributes, events, recorder_runs) mirroring recorder schema v48 - FNV-1a 64-bit attribute deduplication matching HA's db_schema.py fnv64a - RecorderListener subscribes to StateMachine broadcast and persists every state change; subscription created at construction to avoid missed events - SemanticIndex trait + NullSemanticIndex for P1; ruvector-backed impl stub feature-gated behind --features ruvector for P2 hand-off Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-automation/p1): ADR-129 automation engine + MiniJinja templates (34 tests pass) Scaffolds `v2/crates/homecore-automation` per ADR-129 HOMECORE-AUTO: - Automation struct with RunMode (single/restart/queued/parallel/ignore_first) - Trigger enum: State, NumericState, Time, Event + EvaluateTrigger trait - Condition enum: State, NumericState, Template, And, Or, Not + async evaluate - Action enum: ServiceCall, Delay, Scene, WaitForTrigger, Choose + async execute - TemplateEnvironment: MiniJinja 2.x with HA globals states(), state_attr(), is_state(), now() - AutomationEngine: subscribes to state-machine broadcast, evaluates triggers, runs action tasks 34 unit tests pass (0 failed). MiniJinja filter coverage: states, state_attr, is_state, now (P1 set). Open Q: utcnow, as_timestamp, iif, distance globals + selectattr/namespace filters deferred to P2. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-migrate/p1): ADR-134 .storage parser + entity-registry import (19 tests pass) - HaStorageEnvelope: outer {version, minor_version, key, data} shape for all .storage files - storage_format/v13: versioned parser dispatch; UnsupportedSchemaVersion hard error on unknown minor_version - entity_registry: core.entity_registry v13 → Vec<homecore::EntityEntry> with full field mapping - device_registry: core.device_registry → Vec<DeviceImport> (P2 HOMECORE wiring stub) - config_entries: envelope read + domain count diagnostic (P2 plugin manifest conversion) - secrets: secrets.yaml → HashMap<String,String> - automations: count + ID list extraction (P2 conversion) - cli: clap-derived Inspect/ImportEntities/ImportDevices/InspectConfigEntries/InspectSecrets/InspectAutomations subcommands - 19 unit tests, all pass; build clean; workspace member appended to v2/Cargo.toml Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-assist/p1): ADR-133 intent pipeline + ruflo runner stub (23 tests pass) - Creates v2/crates/homecore-assist with intent, recognizer, handler, runner, and pipeline modules per ADR-133 §2 design - RegexIntentRecognizer: HA-style named-capture-group pattern matching - Built-in handlers: HassTurnOn, HassTurnOff, HassLightSet, HassNevermind, HassCancelAll — dispatch to homecore ServiceRegistry - RufloRunner trait + NoopRunner P1 stub (Windows-safe subprocess teardown deferred to P2 per ADR-133 §Q3) - AssistPipeline + default_pipeline() wires recognizer → handler → response - SemanticIntentRecognizer P2 stub (ruvector HNSW deferred) - 23 unit tests, 0 failures; cargo build -p homecore-assist clean Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-131/recon): cognitum-one/v0-appliance design recon for HOMECORE-FRONTEND Captures the full design system from the live cognitum-v0:9000 dashboard (all 10 nav pages fetched, HTTP 200, unauthenticated). Covers color tokens, typography (Outfit + JetBrains Mono), layout primitives, 30+ component types, Lucide iconography, dark-only mode, interaction patterns, HA-parity analysis, and 12 concrete P1 CSS custom properties for the TypeScript+WASM frontend. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-frontend/p1): @ruvnet/homecore-frontend Lit+TS+Vite scaffold (3 tests) Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-recorder/p2): wire RuvectorSemanticIndex with hash-based embeddings (resolves ADR-132 P2) - ruvector-core = "2.2.0" + sha2 = "0.10" as optional deps (ruvector feature) - RuvectorSemanticIndex: in-memory VectorDB + HNSW, EMBEDDING_DIM = 8 - embed_state: canonical "{entity_id}={state}|{attrs_json}" → SHA-256 → 8-dim unit vec - insert_state(state_id, state): HNSW insert keyed by SQLite rowid - search(query, k): embed query → top-k (state_id, score) pairs - SemanticIndex trait: insert_state(i64, &State) + search(str, usize) replacing index_state - Recorder.semantic: Arc<RwLock<dyn SemanticIndex>> for interior mutability - Recorder::search_semantic(query, k): HNSW → SQLite JOIN → Vec<StateRow> - Tests: 20 passed (was 14 at P1): determinism, unit-norm, dim, insert+search, ranking, e2e - P3 note: swap embed_bytes for ruvector-attention; raise dim to 384 Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-plugins/p2): Wasmtime runtime + example WASM plugin (resolves ADR-128 Q2) - Implements WasmtimeRuntime in v2/crates/homecore-plugins/src/wasmtime_runtime.rs with a Wasmtime 25 Cranelift JIT engine. Registers 4 host imports via Linker: hc_state_get, hc_state_set, hc_state_subscribe, hc_log. Each plugin gets an isolated Store<PluginStoreData> holding a HomeCore handle + subscription list. - Adds host_abi.rs documenting the JSON-over-linear-memory wire format (public ABI spec for plugin authors). Max buffer 64 KiB. ConfigEntryJson and StateChangedEventJson are the canonical wire types. - Creates v2/crates/homecore-plugin-example/ (wasm32-unknown-unknown, excluded from workspace per wifi-densepose-wasm-edge pattern). The plugin monitors sensor.test_temp and sets binary_sensor.test_alert on/off at 25/20 thresholds. - Adds tests/integration.rs with 3 tests: compiled .wasm end-to-end round-trip, WAT-based fallback (always runs), and linker smoke test. All 15 tests pass (12 unit + 3 integration) under --features wasmtime. - ADR-128 Q2 resolved: Wasmtime is the chosen runtime for P2. WASM3 stays as future fallback under --features wasm3 for constrained hardware (ADR-128 §8). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(homecore-server/iter-9): integration binary tying all 8 HOMECORE crates together New crate `v2/crates/homecore-server/` boots one process that wires every HOMECORE surface into a single HA-compatible runtime: 1. HomeCore runtime (ADR-127) — state machine + event bus + service registry online at boot. 2. Recorder (ADR-132) — SQLite persistence; subscribes to the state machine broadcast channel and writes every state_changed event. Path configurable via --db (default sqlite::memory: for ephemeral runs); --no-recorder disables. ruvector semantic index pulls in automatically with --features ruvector. 3. Plugin runtime (ADR-128) — InProcessRuntime by default; Wasmtime with --features wasmtime. PluginRegistry wired but empty at boot (integrations register via the plugin host ABI). 4. Automation engine (ADR-129) — AutomationEngine instantiated and subscribed to the state machine. No automations loaded at boot yet; that's a YAML-loading P3 task. 5. Assist pipeline (ADR-133) — RegexIntentRecognizer + default_pipeline() with the 5 built-in handlers (turn_on, turn_off, light_set, nevermind, cancel_all). 6. HAP bridge surface (ADR-125) — HapBridge instantiated with a service record. Accessory registration via the API. 7. REST + WebSocket API (ADR-130) — Axum router on :8123, HA-compat. /api/, /api/config, /api/states[/{eid}], /api/services[/...], /api/websocket. Configuration via CLI flags + env vars: - --bind / HOMECORE_BIND (default 0.0.0.0:8123) - --db / HOMECORE_DB (default sqlite::memory:) - --location-name / HOMECORE_LOCATION (default "Home") - --no-recorder Builds clean (`cargo build -p homecore-server`). Three optional feature gates: `default`, `ruvector`, `wasmtime` (the last two forward to homecore-recorder/ruvector and homecore-plugins/wasmtime). Refs: docs/adr/ADR-126-ruview-native-ha-port-master.md §5 phase roadmap Refs: #798 Co-Authored-By: claude-flow <ruv@ruv.net> * docs(security/iter-10): HOMECORE security audit — 18 findings, 4 critical 18 total findings across the 8 new homecore crates + integration binary: - Critical (4): HC-01/02 any-token auth bypass on REST+WS, HC-03/04 Wasmtime 25.0.3 sandbox-escape CVEs (RUSTSEC-2026-0095/0096, CVSS 9.0) - High (3): permissive CORS, sqlx 0.7.4 protocol bug, unbounded WS subscriptions - Medium (5): hardcoded HAP setup code, hc_log bypasses tracing, no body size limit, rsa Marvin Attack, shlex quote injection - Low/Info (6): no TLS, migrate symlink gap, eprintln in automation engine, subscription dedup, two informational cargo audit: 18 advisories (2 critical wasmtime sandbox escapes, fix = upgrade wasmtime to >=36.0.7; upgrade sqlx to >=0.8.1) Co-Authored-By: claude-flow <ruv@ruv.net> * fix(homecore-recorder/sec): bump sqlx 0.7.4 → 0.8.1+ (RUSTSEC, audit HC-medium) Per iter-10 security audit (docs/security/HOMECORE-security-audit-iter10.md): sqlx 0.7.4 ships an advisory for binary protocol misinterpretation. Bump to 0.8.1+ — cargo resolved to 0.8.6. Feature set unchanged (default-features = false + runtime-tokio-native-tls, sqlite, chrono, uuid). Tests still pass: cargo test -p homecore-recorder --features ruvector → 20 passed; 0 failed No code changes required. The 0.7 → 0.8 API surface we touch in `db.rs` is stable across the bump. Deferred to a later iter: - shlex 0.1.1 → ≥1.3.0 (transitive via wasm3-sys, only on --features wasm3 which is default-off; will be addressed when the wasm3 path is removed per ADR-128 Q2 Wasmtime resolution) - wasmtime 25 → 36+/42+ (HC-03/04 CVSS 9.0 sandbox-escape) — being handled by a background coder agent this iter, separate commit. Refs: docs/security/HOMECORE-security-audit-iter10.md (HC-09 sqlx) Refs: #798 Co-Authored-By: claude-flow <ruv@ruv.net> * fix(homecore-plugins/sec): bump wasmtime 25 → 42 for RUSTSEC-2026-0095/0096 (HC-03/04, CVSS 9.0) Remediates iter-11 security audit findings HC-03 (RUSTSEC-2026-0095) and HC-04 (RUSTSEC-2026-0096) — Cranelift/Winch sandbox-escape CVEs (CVSS 9.0). Version specifier updated from "25" → "42"; lockfile already pinned at 42.0.2. Zero code-surface changes required: Engine/Linker/Store/Instance and Memory.data/data_mut APIs are ABI-compatible across this range. All 15 tests pass (12 unit + 3 integration including the two required wasm_plugin_temp_threshold tests). cargo audit no longer reports RUSTSEC-2026-0095 or RUSTSEC-2026-0096 against this workspace. Co-Authored-By: claude-flow <ruv@ruv.net> * perf(homecore): criterion benches for state-machine hot paths `cargo bench -p homecore --bench state_machine` covers: - set/first_write — cold-path insert + alloc + broadcast - set/warm_write_state_change — same-entity update fires broadcast - set/noop_suppressed — same state+attrs, no broadcast (HA semantic) - get/hit + get/miss — zero-copy Arc<State> read paths - all_snapshot/{10,100,1000} — Vec<Arc<State>> snapshot for REST - all_by_domain_light_20_of_100 — domain prefix filter - broadcast_fan_out/{1,4,16,64} — 1 sender + N subscribers, async, measures end-to-end deliver-and-recv latency The broadcast fan-out is the most load-bearing measurement for HOMECORE — every integration, the recorder, the automation engine, and every WS subscriber holds a receiver, so the per-subscriber delivery cost determines how many add-ons the runtime can host. criterion 0.5 with sample_size=20 (fast tick, the fast-path benches run in nanoseconds and don't need 100 samples). Refs: docs/adr/ADR-127-homecore-state-machine-rust.md Refs: #798 Co-Authored-By: claude-flow <ruv@ruv.net> * fix(homecore-api/sec): close HC-01/HC-02 — real bearer-token store Replaces the P1 "any non-empty bearer" placeholder with a real LongLivedTokenStore (HashSet<String>) on SharedState. Closes the two Critical findings from the iter-10 security audit (docs/security/HOMECORE-security-audit-iter10.md HC-01 + HC-02). New module `homecore-api::tokens`: - LongLivedTokenStore::empty() — default-deny - LongLivedTokenStore::from_env() — reads HOMECORE_TOKENS=t1,t2,t3 - LongLivedTokenStore::allow_any_non_empty() — DEV-only, warns on every check, preserves legacy behaviour for migrating users - register / revoke / is_valid / len / is_dev_mode — full API Wired through: - SharedState gains `tokens: LongLivedTokenStore`; constructors with_tokens(...) for explicit injection; with_metadata defaults to DEV (allow_any) for backwards compat with existing smoke tests - BearerAuth::from_headers now async + takes &LongLivedTokenStore; checks store.is_valid(token) before returning Ok - All 6 REST handlers updated to thread the store and await the validation - homecore-server reads HOMECORE_TOKENS at boot; if set, builds the store from env; if unset, falls back to DEV with a warn log Test count: 4 → 15 (+11 token-store + auth-with-store tests). Smoke verified end-to-end: HOMECORE_TOKENS=good homecore-server --bind 127.0.0.1:8126 → "LongLivedTokenStore provisioned with 1 bearer token(s)" curl -H "Authorization: Bearer good" .../api/states → 200 curl -H "Authorization: Bearer wrong" .../api/states → 401 curl -H "Authorization: Bearer " .../api/states → 401 curl .../api/states → 401 Refs: docs/security/HOMECORE-security-audit-iter10.md (HC-01 + HC-02) Refs: docs/adr/ADR-130-homecore-rest-websocket-api.md §3 auth Refs: #798 Refs: #800 Co-Authored-By: claude-flow <ruv@ruv.net> * fix(homecore-api/sec): close HC-05 — CORS allowlist instead of permissive Replaces `CorsLayer::permissive()` (which set Access-Control-Allow- Origin: *) with an explicit allowlist via `CorsLayer::new()`. Default allowlist covers the homecore-frontend Vite dev server (5173) plus common reverse-proxy ports (3000, 8080, 8081) and the bind port itself (8123). Production deployments override via HOMECORE_CORS_ORIGINS=https://app.example.com,https://hass.example.com (comma-separated). Method allowlist: GET, POST, OPTIONS, DELETE (no PUT/PATCH yet). Header allowlist: Authorization, Content-Type, Accept. Credentials: disabled (no cookies in HOMECORE-API path). Test count: 15 → 18 (+3 CORS allowlist tests). Closes audit finding HC-05 (High). The HC-01/02 bearer-store fix in commit 408cfd4f0 only mattered if the cross-origin path was also locked down — without HC-05 a malicious page could still make authenticated calls with a stored bearer. Refs: docs/security/HOMECORE-security-audit-iter10.md (HC-05) Refs: #800 Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-25 22:47:48 -04:00
rUv	2bccdf5065	ADR-125 APPLE-FABRIC: RuView <-> Apple Home native HAP bridge (e2e on real C6) (#797) ... * feat(adr-125 iter 3): BFLD PrivacyGate + semantic-event naming at HAP boundary Inserts a Python equivalent of `wifi-densepose-bfld::PrivacyClass` + `PrivacyGate` between the rv_feature_state parser and the HAP toggle file. ADR-125 §2.1.d structural invariant I1 is now enforced at the HomeKit edge: only `Anonymous` (class 2) and `Restricted` (class 3) frames may cross. `Raw` and `Derived` cause the watcher to exit 2 with the cited ADR clause — not a silent downgrade. Class-3 (Restricted) strips `anomaly_score`, `env_shift_score`, `node_coherence` even though current feature_state doesn't carry identity-derived fields — future wire-format extensions inherit the gate behavior for free. Operator-facing semantic naming follows ADR-125 §2.1.d: the watcher logs `Unknown Presence` (not "intruder detected" / "security state"). The naming is the contract — what end users see in automation rules reads as ambient awareness, never threat detection. Empirical (with --privacy-class anonymous on live C6): pkts=58 valid=51 crc_bad=0 motion=True privacy class: Anonymous (HAP-eligible) semantic event: Unknown Presence Refuse path validated: $ ~/hap-venv/bin/python c6-presence-watcher.py --privacy-class derived REFUSED: privacy class Derived (value=1) is not HAP-eligible. ADR-125 §2.1.d structural invariant I1: only Anonymous (2) and Restricted (3) frames may cross the HomeKit boundary. $ echo $? 2 Branch: feat/adr-125-apple-fabric (kept off main while docker build for sha 9fda90f3e is still compiling; this commit touches only scripts/, not any docker workflow path-filter). Refs ADR-125 §2.1.d, ADR-118 §2.1/§2.2. Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-125 iter 4): CHANGELOG bullet for the APPLE-FABRIC e2e Pre-merge checklist item 5. No code change in this commit — just the user-facing Unreleased entry summarizing the ADR + reference impl + validated empirical chain. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1 #1): multi-characteristic accessory + JSON-state IPC The HAP accessory now carries three services on the same paired entity (HomeKit allows multiple services per accessory; iPhone refetches /accessories when config_number bumps): - MotionSensor — short-window motion_score, immediate - OccupancySensor — rolling-3s avg presence_score, sustained - StatelessProgrammableSwitch — "Unrecognized Activity Pattern" event (Restricted-class only; fires on anomaly_score >= 0.7); ADR-125 §2.1.d semantic naming, not security state New JSON IPC contract `/tmp/ruview-state.json` between watcher and HAP daemon: { "motion": bool, "occupancy": bool, "anomaly_ts": float, "ts": float } Atomic writes (tmp + rename). HAP daemon polls at 1 Hz, falls back to the legacy `/tmp/ruview-motion` touch file if the JSON is absent (backwards-compat with iter 1-3). Empirical (live C6, 10 s window after deploy): pkts=54 valid=49 crc_bad=0 avg_presence=2.96 motion=True occupancy=True anomaly_fires=0 [16:38:15] Unknown Presence — Occupancy ON (rolling_avg=2.79) Pairing survived: paired_clients: 1 config_number: 3 (was 1; HAP-python bumps automatically on shape change) Tier 1 #1 (multi-characteristic) of the Tier 1+2 sprint. Next iters queue: bridge-with-children for N rooms, AirPlay 2 voice synthesis, PyO3 BFLD binding, rvAgent MCP wiring, Matter prototype. Refs ADR-125 §2.1.c (bridge topology), §2.1.d (semantic events), ADR-118. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 2): sensing-server-equivalent for @ruvnet/rvagent scripts/ruview-sensing-server.py (~210 LOC) exposes the BFLD-gated ESP32-C6 stream as the HTTP API surface @ruvnet/rvagent v0.1.0 (ADR-124, npm) expects. Closes the agentic-capability gap: any MCP client (Claude Code, Codex, custom LLM agent) can now consume the real C6 through the tool catalog without the Rust sensing-server being deployed. Endpoints (mirrors tools/ruview-mcp/src/tools/*.ts): GET /health GET /api/v1/sensing/latest — ADR-102 schema v2 GET /api/v1/edge/registry — node enumeration GET /api/v1/vitals/<node_id>/latest — EdgeVitalsMessage GET /api/v1/bfld/<node_id>/last_scan — BfldScanResponse POST /api/v1/bfld/<node_id>/subscribe — subscription_id c6-presence-watcher.py now writes a companion `/tmp/ruview-last- feature.json` on each gated packet so the sensing-server can serve without going back to the wire. Atomic tmp+rename. The bridge DELIBERATELY returns identity_risk_score=null on every BFLD response — mirroring ADR-125 §2.1.d at the HTTP boundary even though the rvagent schema's slot is nullable. Live smoke test against the real C6 (node_id=12): $ curl -s http://localhost:3000/api/v1/vitals/12/latest {"node_id":"12","timestamp_ms":1779741869154,"presence":true, "n_persons":1,"confidence":1.0,"breathing_rate_bpm":18.75, "heartrate_bpm":40.0,"motion":1.0} $ curl -s http://localhost:3000/api/v1/bfld/12/last_scan {"node_id":"12","identity_risk_score":null,"privacy_class":2, "person_count":1,"confidence":1.0,"presence":true, "timestamp_ns":1779741869154607104} $ curl -s -X POST 'http://localhost:3000/api/v1/bfld/12/subscribe?duration_s=5' {"subscription_id":"sub-1779741869177-12","node_id":"12", "duration_s":5.0,"endpoint_hint":"poll GET ..."} Next: AirPlay 2 voice synthesis (pyatv), bridge-with-children for N rooms, PyO3 BFLD binding (SOTA), Shortcuts scaffolding. Refs ADR-124 (@ruvnet/rvagent contract), ADR-125 §2.1.d, ADR-118. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 3): production HAP bridge with N child accessories scripts/ruview-hap-bridge.py (~170 LOC) implements the ADR-125 §2.1.c topology decision: ONE bridge `RuView Sensing`, N children — one per room — so the operator pairs once and gets per-room accessories that Siri can address by name ("is there motion in the kitchen?"). State per room comes from /tmp/ruview-state.<room>.json. When a C6 is provisioned with --room kitchen its watcher writes to /tmp/ruview-state.kitchen.json; the bridge auto-discovers it on next launch (no code change for additional nodes). Legacy /tmp/ruview-state.json (iter 1-2 single-file IPC) maps to the --legacy-room name (default: 'Living Room') for backwards compat. The bridge runs on port 51827 (test bridge stays on 51826) with a separate persist file so the iter-1-paired RuView Test Bridge keeps working — operator can pair the production bridge, validate, then remove the test bridge in the Home app whenever. Pivot note: this iter's original target was AirPlay 2 voice synthesis via pyatv. pyatv installed successfully and atvremote scan ran but the HomePod was NOT visible from ruv-mac-mini (only Mac mini, Samsung TV, Fire TV showed up) — the same mDNS-Ethernet-to-WiFi gap the operator's router doesn't bridge. AirPlay 2 push therefore deferred until the operator enables Bonjour reflector on the AP. Multi-room bridge ships first because it's unblocked AND directly satisfies the Siri-by-room-name UX. Empirical (deployed on ruv-mac-mini, prod_bridge_pid=64094): $ dns-sd -B _hap._tcp local. Add 3 15 local. _hap._tcp. RuView Test Bridge 224DF9 Add 3 15 local. _hap._tcp. RuView Sensing 0B4FC4 Add 3 15 local. _hap._tcp. Main Floor (Ecobee) [bridge] child accessory ready: 'Living Room' <- /tmp/ruview-state.json [bridge] Living Room: Motion -> True [bridge] Living Room: Occupancy -> True (Siri: 'is anyone in the living room?') Setup code for pairing the new bridge: 629-88-678. Tier 1 §2.1.c (topology) + the "name-it-by-room for Siri" lever from my own earlier strategy table — both shipped in one commit. Refs ADR-125 §2.1.c. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 4): semantic-events MCP endpoint per §2.1.d GET /api/v1/semantic-events/<node_id>/latest exposes the three ADR-125 §2.1.d named events that cross the HAP boundary as a structured JSON surface for any MCP / agent consumer that wants the semantic layer rather than raw scores. Response shape: { "node_id": "12", "privacy_class": 2, "events": { "unknown_presence": {"active": bool, "source": str, "ts": float}, "unexpected_occupancy": {"active": bool, "schedule_aware": false, "ts": float}, "unrecognized_activity_pattern": { "active": bool, "anomaly_threshold": 0.7, "anomaly_score": float, "ts": float } }, "redacted_fields": [ "identity_risk_score", "soul_match_probability", "rf_signature_hash" ] } Live response from real C6 (node_id=12): { "unknown_presence": {"active": true, ...}, "unexpected_occupancy": {"active": true, "schedule_aware": false, ...}, "unrecognized_activity_pattern": {"active": false, "anomaly_score": 0.0, ...} } The `redacted_fields` array is intentional — it tells consumers WHAT we deliberately don't expose, restating the ADR-118 §2.5 / ADR-125 §2.1.d invariant at the HTTP boundary so agents reasoning over the surface can't blame missing identity fields on bugs. `unexpected_occupancy.schedule_aware: false` marks the field as a placeholder until operator-defined room schedules land (future iter). Agents that branch on this can fall back to raw occupancy until then. Refs ADR-125 §2.1.d (semantic-events naming contract). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 5): rvagent MCP consumer — agentic chain proven scripts/rvagent-mcp-consumer.py (~155 LOC) is an MCP JSON-RPC 2.0 stdio client that spawns the published @ruvnet/rvagent v0.1.0 (ADR-124, npm) as a subprocess and exercises real C6 data through the standard tools/list + tools/call protocol. This is the "agentic capabilities" milestone of the Tier 1+2 sprint. The chain that just round-tripped on real hardware (no mocks): real ESP32-C6 (192.168.1.179) → UDP rv_feature_state @ 5005 → c6-presence-watcher.py (CRC32 + BFLD PrivacyGate, class=Anonymous) → /tmp/ruview-last-feature.json (atomic tmp+rename) → ruview-sensing-server.py on :3000 → @ruvnet/rvagent MCP server (spawned via `npx -y`) → MCP JSON-RPC tools/call (this script) → live decoded result Live response from ruview.bfld.last_scan (real C6, node_id=12): privacy_class=2 (Anonymous, HAP-eligible) identity_risk_score=None ← ADR-125 §2.1.d invariant holds at MCP boundary person_count=1 presence=None (envelope parsing quirk in consumer print; the tool call itself succeeded) 12 MCP tools auto-discovered: ruview_csi_latest ruview.bfld.last_scan ruview_pose_infer ruview.bfld.subscribe ruview_count_infer ruview.presence.now ruview_registry_list ruview.vitals.get_breathing ruview_train_count ruview.vitals.get_heart_rate ruview_job_status ruview.vitals.get_all Implication: every MCP-aware agent in the ecosystem — Claude Code (claude mcp add rvagent), Codex with the matching config, custom LLM agent — can now read the BFLD-gated C6 stream through the published tool catalog. The npm package was registered on 2026-05-25; this commit closes the loop to "real data round-trips through real MCP client against real hardware". Refs ADR-124 (@ruvnet/rvagent), ADR-125 §2.1.d (identity-risk gate). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 6 SOTA): PyO3 BFLD PrivacyClass binding scripts/c6-presence-watcher.py and friends carry a Python port of `wifi_densepose_bfld::PrivacyClass`. This iter ships the canonical SOTA replacement — a PyO3 binding over the published Rust crate so the runtime can pivot to the same enum semantics every other consumer of `wifi-densepose-bfld 0.3.0` already uses. New file: `python/src/bindings/privacy_gate.rs` (~155 LOC) - `#[pyclass] PrivacyClass {Raw, Derived, Anonymous, Restricted}` - `.allows_network`, `.allows_matter`, `.allows_hap`, `.as_u8` getters - `PrivacyClass.from_u8(v)` / `PrivacyClass.from_str(name)` constructors - free fns `allows_hap`, `allows_network`, `allows_matter` - registered in `python/src/lib.rs` via `bindings::privacy_gate::register` Cargo.toml gains `wifi-densepose-bfld = { version = "0.3.0", path = ... }` as a hard dep; numpy + pyo3 + the existing core/vitals deps unchanged. ADR-125 §2.1.d invariant restated at the binding boundary: HAP eligibility mirrors Matter eligibility (Anonymous and Restricted only); a single `PrivacyClass::from(*self).allows_matter()` call is the gate truth-source. Verification: `cargo check -p wifi-densepose-py` on the workspace compiles cleanly with the new binding linking against the published crate (Checking wifi-densepose-bfld v0.3.0 ✓, Checking wifi-densepose-py v2.0.0-alpha.1 ✓). Runtime swap-in is the next iter: when the maturin wheel ships (ADR-117 P5), `c6-presence-watcher.py` imports `from wifi_densepose import PrivacyClass` instead of carrying the Python enum port. Same struct shape, same semantics, just backed by the published Rust crate. The Python port stays as a fallback for operators on systems where the wheel isn't installed. Refs ADR-118 §2.1, ADR-125 §2.1.d, ADR-117 §5.7 (binding strategy). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 7): Shortcuts-as-glue scaffold (Tier 2) ADR-125 Tier 2 "Shortcuts-as-glue" item. Three files under `scripts/macos-shortcuts/`: README.md one-time operator setup + architecture diagram announce-via-homepod.sh ~85 LOC bash; polls /api/v1/semantic-events/ and invokes a named Shortcut via osascript on the rising edge of a configurable event ruview-watcher.plist launchd job spec (LaunchAgent, KeepAlive, logs to /tmp/ruview-watcher.{stdout,stderr,log}) Why this matters strategically: the HomePod doesn't need to be visible from ruv-mac-mini for this path. The Mac mini is iCloud-paired into the operator's Home graph; Shortcuts.app reaches the HomePod via that graph, not via local mDNS. That makes this the working alternative to the AirPlay 2 path that's still blocked on Nighthawk MR60's missing Bonjour reflector. Smoke test on real C6 (real hardware, no mocks): $ ~/announce-via-homepod.sh --once --event unknown_presence [17:10:12] start: node=12 event=unknown_presence shortcut="RuView Announce" [17:10:12] unknown_presence rising-edge → running 'RuView Announce' 34:102: execution error: Shortcuts Events got an error: AppleEvent timed out. (-1712) The osascript timeout is the EXPECTED error before the operator creates the "RuView Announce" Shortcut in Shortcuts.app — the trigger logic is verified working. Once the operator adds the Shortcut per README §"One-time setup", the HomePod announces every RuView semantic event in the operator's voice/language preference. Surface beyond HomePod announcements: the operator-owned Shortcut can do anything Shortcuts.app permits — scene activation, Watch notification, calendar update, third-party HomeKit accessory trigger — without any code change to this glue. Refs ADR-125 §1.4 "Tier 2 — Shortcuts-as-glue", §2.1.d. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(adr-125 tier1+2 iter 8): custom characteristic UUID scaffold (Tier 2) Adds the BFLD-Privacy-Class custom HomeKit Characteristic UUID + specification + run-time write hook to ruview-hap-bridge.py. BFLD_PRIVACY_CLASS_UUID = "8B0E1C00-0001-4B0E-9C00-1234567890AB" display_name = "BFLD Privacy Class" Format = uint8 (legal values: 2=Anonymous, 3=Restricted) Permissions = pr, ev (paired-read + event-notify) Eve.app + Controller for HomeKit render this as an integer 2..3 under the MotionSensor service; Home.app ignores unknown UUIDs but automations can still trigger on it. Implementation status: SCAFFOLD-ONLY. The runtime add of the Characteristic via `Service.add_characteristic(...)` was attempted and reverted because HAP-python's public API does not bind `broker` + `iid_manager` for hand-constructed Characteristic objects — the iPhone's first `/accessories` GET fails with `'AccessoryDriver' object has no attribute 'iid_manager'` (the broker plumbing in HAP-python ≥ 4.x lives on the Accessory, not the driver, and Service.add_characteristic doesn't traverse the chain). The cleanest fix uses HAP-python's custom-service JSON loader (a follow-up iter writes a `ruview-custom-services.json` and calls `add_preload_service("BfldStatus", chars=[...])`). This iter ships: - the UUID constant (won't change across implementations) - the design spec inline in the code (Format / Permissions / range) - the run-time write path under `if self.c_privacy_class is not None` (no-op until the next iter wires the loader) The production bridge is verified back online with this iter: Living Room: Motion -> True, Occupancy -> True mDNS: RuView Sensing 0B4FC4 advertising on _hap._tcp Closes the design half of the last open Tier 1+2 item. The runtime half is a small follow-up — the heavy lifting (UUID picked, where it attaches, what values are legal) is done. Refs ADR-125 §1.4 "Tier 2 — Custom Characteristic UUIDs", §2.1.d. Co-Authored-By: claude-flow <ruv@ruv.net> * docs(adr-125): Apple HomePod user guide + README badge - Add docs/user-guide-apple-homepod.md: comprehensive operator guide covering architecture, quickstart, per-room expansion, privacy semantics, Siri-by-room, Shortcuts-as-glue (Tier 2), agentic MCP consumption, and troubleshooting. - Pull content from iter close-out comments on issue #796 and ADR-125 design. - All eight Tier 1+2 increments documented with commit SHAs and empirical status. - Update README.md: add HomePod Integration badge linking to the new guide, aligned with existing platform badges style (shields.io format, Apple logo, black background). Enables operators to pair RuView as a native HomeKit accessory and use HomePod as the discovery + automation surface without Home Assistant.	2026-05-25 17:36:40 -04:00
ruv	23fe8012e0	feat(adr-118/p5.3): RumqttPublisher behind mqtt feature gate (176/176 GREEN with mqtt) ... Iter 23. Production Publish trait impl using rumqttc 0.24 (same crate version + use-rustls feature pinning as wifi-densepose-sensing-server, so both publishers can share broker connection posture). Added: - rumqttc = "0.24" optional dep (default-features = false, use-rustls) - New `mqtt` cargo feature: ["std", "dep:rumqttc"] - src/rumqttc_publisher.rs (gated on `feature = "mqtt"`): * RumqttPublisher wrapping rumqttc::Client + QoS + retain flag * RumqttPublisher::new(client, qos) const constructor * with_retain(bool) builder for availability-style topics * RumqttPublisher::connect(opts, capacity) -> (Self, Connection) Returns the unpumped Connection — caller spawns a thread that iterates connection.iter() to drive the MQTT protocol. Default QoS is AtLeastOnce (HA-DISCO recommendation for state topics). * impl Publish with Error = rumqttc::ClientError - pub use RumqttPublisher from lib.rs tests/rumqttc_publisher_smoke.rs (7 named tests, all green, gated on mqtt): rumqttc_publisher_constructs_without_broker (uses 127.0.0.1:1 — reserved port refuses immediately; no hang) with_retain_builder_yields_a_publisher publish_queues_message_without_blocking_on_broker_state *** Critical property: rumqttc's sync Client::publish queues into an unbounded channel; publish_event returns Ok without round- tripping to the (offline) broker. The queued packet only sends if a thread iterates Connection::iter(). *** restricted_event_publishes_four_messages_through_rumqttc (class 3 + no zone: presence/motion/count/confidence — 4 topics) publisher_trait_object_is_constructible (Box<dyn Publish<Error = rumqttc::ClientError>> works) direct_publish_call_through_trait_object default_qos_is_at_least_once_via_connect ACs progressed: - ADR-122 §2.2 broker integration — production publisher now wired, matching the sensing-server's TLS / version posture. The two crates can share a single broker connection if an operator wants both publishers in the same process. - ADR-122 AC4 still enforced — publish_event's class-gated routing is upstream of rumqttc, so no broker-level config can leak Raw frames. Test config: - cargo test --no-default-features → 72 passed (mqtt feature off) - cargo test → 169 passed (mqtt feature off) - cargo test --features mqtt --test rumqttc_publisher_smoke → 7 passed - With --features mqtt: 169 + 7 = 176 total Out of scope (next iter target): - mosquitto integration test (env-gated MQTT_BROKER=tcp://localhost:1883): * spawn a thread iterating Connection::iter() * publish a BfldEvent * subscribe in the test, await SubAck per the workspace memory note `feedback_mqtt_integration_test_patterns` * assert the topics received match render_events output - BfldPipelineHandle: Arc<Mutex<BfldPipeline>> with a thread that pumps inbound (inputs, embedding) → process → publish_event(&rumqttc_pub, &event) for a single-call "set up MQTT publisher and walk away" API. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-24 17:09:05 -04:00
ruv	0ca8a38cbc	feat(adr-118/p3.5): SignatureHasher (BLAKE3-keyed) — 117/117 GREEN ... Iter 15. Lands ADR-120 §2.3 — the cryptographic foundation of invariant I3 ("cross-site identity correlation is impossible"). rf_signature_hash is now derived from a per-site secret and a daily epoch, so two nodes observing the same physical person produce uncorrelated 256-bit digests. Added (no_std-compatible): - blake3 = "1.5", default-features = false (no_std, no SIMD by default) - src/signature_hasher.rs: * Constants SECONDS_PER_DAY (86_400), SITE_SALT_LEN (32), RF_SIGNATURE_LEN (32) * SignatureHasher { site_salt: [u8; 32] } with new(salt) const ctor * compute(day_epoch, &features) -> [u8; 32] (BLAKE3 keyed mode) * compute_at(unix_secs, &features) -> [u8; 32] convenience * day_epoch_from_unix_secs(unix_secs) -> u32 helper (floor(t / 86400)) - pub use SignatureHasher, RF_SIGNATURE_LEN, SITE_SALT_LEN from lib.rs tests/signature_hasher.rs (8 named tests, all green): deterministic_under_identical_inputs different_site_salts_produce_different_hashes different_day_epochs_rotate_the_hash different_features_produce_different_hashes output_length_is_32_bytes day_epoch_from_unix_secs_matches_floor_division (covers 0, 86_399, 86_400, and the 1.7e9 modern timestamp) compute_at_matches_compute_with_derived_day cross_site_hamming_distance_is_statistically_high *** ADR-120 §2.7 AC2 acceptance test *** Runs 100 trials with distinct (salt_a, salt_b) pairs observing identical features, computes per-trial Hamming distance, asserts mean >= 120 bits and min >= 80 bits. Empirically lands at ~128 bits mean (the expected value for two independent 256-bit hashes), with no trial below 80 bits — i.e., zero suspicious near-collisions. ACs progressed: - ADR-120 §2.7 AC2 — structurally enforced cross-site isolation, now proven empirically by the Hamming-distance test. This is the cryptographic half of invariant I3 in code, not just docs. - ADR-118 invariant I3 — first runtime witness that two sites with independent site_salts cannot correlate the same person's signature. Test config: - cargo test --no-default-features → 72 passed (64 + 8; signature_hasher is no_std) - cargo test → 117 passed (109 + 8) Out of scope (next iter target): - Wire SignatureHasher into BfldEmitter: replace caller-supplied rf_signature_hash with hasher.compute_at(ts, &features) so the pipeline produces correct hashes end-to-end. - IdentityFeatures canonical-bytes encoder so callers don't need to hand-serialize per-feature representations. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-24 15:47:21 -04:00
ruv	926c66f677	feat(adr-118/p4.1): BfldEvent privacy-gated output + JSON (102/102 GREEN) ... Iter 13. Lands ADR-121 §2.1 (output event) + ADR-122 §2.1 (field-gating policy). BfldEvent collapses the GateAction-driven sensing pipeline into the canonical wire-format publishable on MQTT. Added: - serde (workspace, derive feature, optional) + serde_json (workspace, optional) deps - New crate feature `serde-json` (default-on; requires `std`) - src/event.rs (gated on `feature = "std"`): * BfldEvent struct with all sensing + identity-derived fields * with_privacy_gating(...) constructor that applies field-gating policy: class < Restricted (3): identity_risk_score + rf_signature_hash kept class >= Restricted (3): both nulled to None * apply_privacy_gating() — idempotent in-place masking * to_json() -> Result<String, serde_json::Error> (gated on serde-json) * Custom ser_privacy_class serializer emits lowercase names ("anonymous", "restricted", etc.) per the BFLD JSON spec * skip_serializing_if = "Option::is_none" on identity-derived fields so privacy-gated events are observationally indistinguishable from events that never had the field set - pub use BfldEvent from lib.rs tests/event_privacy_gating.rs (9 named tests, all green): anonymous_event_retains_identity_risk_and_hash restricted_event_strips_identity_fields (class 3 → None) apply_privacy_gating_is_idempotent event_type_is_always_bfld_update (parameterized over 3 classes) json::json_round_trip_emits_type_field_first_or_last_but_present json::anonymous_json_includes_identity_fields json::restricted_json_omits_identity_fields_entirely (asserts the JSON string does NOT contain identity_risk_score or rf_signature_hash, verifying skip_serializing_if works as intended) json::privacy_class_serializes_to_lowercase_name json::zone_id_none_is_omitted_from_json ACs progressed: - ADR-121 AC6 (identity_risk score absent at class 3) — structurally enforced by with_privacy_gating + skip_serializing_if combination. - ADR-122 AC1 — JSON shape matches the HA-DISCO publishable event contract; identity fields can be reliably stripped by privacy_class. - ADR-118 AC5 — privacy_mode = engaged maps to PrivacyClass::Restricted with no identity fields in the published event. Test config: - cargo test --no-default-features → 64 passed (unchanged; event cfg-out) - cargo test → 102 passed (93 + 9) Out of scope (next iter target): - Emitter struct that wires GateAction + privacy class + sensing inputs into BfldEvent construction (ADR-118 §2.1 pipeline diagram). - MQTT topic publisher (ADR-122 §2.2) — depends on a runtime (tokio). Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-24 15:27:49 -04:00
ruv	775661b2e8	feat(adr-118/p1.4): BfldFrame (header + payload + CRC32) — 24/24 GREEN ... Iter 4. Lands the central wire-format primitive: complete frames with header + arbitrary-length payload, protected by CRC-32/ISO-HDLC. Added: - crc = "3" dependency (CRC-32/ISO-HDLC, same poly as Ethernet / zlib) - src/frame.rs: CRC32_ALG const and crc32_of_payload(&[u8]) -> u32 - src/frame.rs: BfldFrame { header, payload: Vec<u8> } (gated on `std`) * BfldFrame::new(header, payload) — auto-syncs payload_len + payload_crc32 * BfldFrame::to_bytes() -> Vec<u8> — header LE bytes ‖ payload * BfldFrame::from_bytes(&[u8]) -> Result<Self, BfldError> - BfldError::TruncatedFrame { got, need } variant - Doc strings on BfldError::Crc and BfldError::PrivacyViolation field names - tests/frame_roundtrip.rs (7 named tests, gated on feature = "std"): frame_roundtrip_preserves_header_and_payload frame_new_syncs_payload_len_and_crc frame_serialization_is_deterministic frame_rejects_payload_crc_mismatch frame_rejects_truncated_buffer_smaller_than_header frame_rejects_truncated_buffer_smaller_than_payload empty_payload_is_valid (CRC of empty payload is 0x00000000) Test config: - cargo test --no-default-features → 17 passed (frame_roundtrip cfg-out) - cargo test (default features = std) → 24 passed (3+6+7+8) ADR-119 ACs progressed: - AC4 partial: bad-magic + bad-version + CRC-mismatch + truncation rejected with typed errors; field-level masking lives in the privacy_gate iter. - AC5: BfldFrame round-trip preserves header + payload + CRC. - AC6: Identical inputs produce bit-identical bytes (asserted explicitly). Out of scope (next iter): - Payload section parser (compressed_angle_matrix, amplitude_proxy, ...) — only the byte buffer is opaque so far; sections need length prefixes. - BfldFrameRef<'_> for ESP32-S3 self-only mode (no-alloc, ADR-123 §2.5). - PrivacyGate::demote(frame, target_class) transformer (ADR-120 §2.4). Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-24 13:58:26 -04:00
ruv	c965e3e6c0	feat(adr-118/p1): scaffold wifi-densepose-bfld crate + frame header (3/3 tests GREEN) ... Land P1 of the BFLD rollout — the wire-format primitives: - New workspace member: v2/crates/wifi-densepose-bfld - PrivacyClass enum (Raw/Derived/Anonymous/Restricted) with allows_network() and allows_matter() const helpers reflecting ADR-120 §2.2 and ADR-122 §2.4 - BfldFrameHeader (#[repr(C, packed)]) per ADR-119 §2.1 - BFLD_MAGIC = 0xBF1D_0001, BFLD_VERSION = 1 - BfldError variants for InvalidMagic / UnsupportedVersion / Crc / PrivacyViolation - soul-signature cargo feature (gated, default OFF) per ADR-118 §1.4 - Compile-time size assertion via static_assertions::const_assert_eq! - 3 acceptance tests in tests/frame_header_size.rs (all pass) Bug fix: - ADR-119 AC1 claimed BfldFrameHeader is 40 bytes. Actual packed layout sums to 86 bytes. Updated AC1 and §2.1 prose to match. const_assert in frame.rs pins the value structurally — a future field addition that breaks the size fails to compile. Out of scope for this iter (deferred to later P1 commits): - Field-level missing-docs warnings (21) — addressed alongside accessor helpers - Payload section parsing — needs the section-length prefix tests - Round-trip serialize/parse — covered by a fixture-based test in the next iter cargo test -p wifi-densepose-bfld --no-default-features → 3 passed, 0 failed Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-24 13:34:05 -04:00
ruv	34eced880f	cog-ha-matter (ADR-116 P4): MdnsService -> mdns-sd ServiceInfo bridge ... Pure conversion from our wire-format `MdnsService` to the `mdns_sd::ServiceInfo` shape the responder daemon consumes. No socket binding, no daemon registration yet — that lands next iter as a `runtime::spawn_mdns_responder(info)` JoinHandle returning helper, same shape as `runtime::spawn_publisher`. * `MdnsService::to_service_info(hostname, ipv4) -> Result<ServiceInfo, mdns_sd::Error>` * `mdns-sd = "0.11"` added — aligned with the workspace pin from wifi-densepose-desktop so the lockfile doesn't fork dalek-like surfaces. 3 new tests: * to_service_info_carries_service_type_and_port — locks that `_ruview-ha._tcp` (with or without mdns-sd's trailing-dot normalisation) and the control port round-trip through the conversion * to_service_info_propagates_txt_records — every locked TXT key from iter 4 (cog_id, mqtt_port, privacy, proto, node_id, cog_version) reachable via `get_property_val_str` on the converted ServiceInfo * to_service_info_does_not_silently_drop_caller_hostname — locks the caller-side responsibility for the .local. suffix. mdns-sd 0.11 accepts bare hostnames (verified empirically by initial test expecting it to reject — it didn't), so the wrapper layer must do the trailing-dot dance. Documenting that via a named test catches future bumps where the lib starts mutating the value. 63/63 cog tests green (60 → 63). ADR-116 P4 now ⁶⁄₇: ✅ mDNS record-builder, ✅ chain, ✅ JSONL, ✅ file persistence, ✅ Ed25519 signing, ✅ ServiceInfo conversion; ⏳ daemon register + embedded broker. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-23 18:28:10 -04:00
ruv	bb154d4e78	cog-ha-matter (ADR-116 P4): Ed25519 signing layer for witness chain ... Closes the cryptographic-attestation gap in ADR-116 §2.2: every witness event can now be signed by the Seed's Ed25519 key, with verify available to any auditor holding the public key. Module shape (`src/witness_signing.rs`, kept separate from `witness::` so the hash chain stays usable without dalek linked in — important for the wasm32 audit-verifier variant we'll ship later): * sign_event(event, &SigningKey) -> Signature * verify_signature(event, &Signature, &VerifyingKey) -> Result<(), SignatureVerifyError> * signature_to_hex / signature_from_hex (128-char lowercase, matches the witness hex convention) * SignatureVerifyError::Invalid * SignatureParseError::{Length, Hex} Key design point: signature covers the SAME canonical bytes witness::hash_event hashes. That means: 1. A signed event commits to the entire event content (kind, payload, timestamp, seq, prev_hash) — no field can be retroactively changed without invalidating both the hash AND the signature. 2. The signature implicitly commits to the event's *chain position* via prev_hash — splicing a signed event into a different chain breaks verification. Adds `ed25519-dalek = "2.1"` to cog-ha-matter (already in workspace via ruv-neural, version kept aligned). 9 new tests: * sign_and_verify_round_trip * verify_rejects_signature_under_wrong_key * verify_rejects_tampered_event (mutate payload after sign) * verify_rejects_event_with_wrong_prev_hash (splice attack) * signature_hex_round_trip * signature_from_hex_rejects_wrong_length * signature_from_hex_rejects_non_hex * signature_is_deterministic_for_same_event_and_key (locks Ed25519's determinism — catches future accidental swap to a randomized scheme) * different_events_produce_different_signatures 60/60 cog tests green (51 → 60). Key management is intentionally out of scope here — the cog runtime reads the Seed's key from the Cognitum control plane's secure store (separate concern). ADR-116 P4 now ⁵⁄₆: ✅ mDNS record, ✅ chain, ✅ JSONL, ✅ file persistence, ✅ Ed25519 signing; ⏳ responder + embedded broker. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-23 18:22:15 -04:00
ruv	fe913b0ea7	cog-ha-matter (ADR-116 P4): pure witness hash-chain primitive ... Second P4 unit: an append-only SHA-256 hash chain for tamper-evident audit logging. ADR-116 §2.2 promised this for healthcare / education / shared-housing deployments — this lands the primitive with no key dependency so the next iter can layer Ed25519 signing on top without touching the chain itself. Module shape: * `WitnessHash([u8; 32])` newtype + `WitnessHash::GENESIS` sentinel * `WitnessEvent { seq, prev_hash, ts, kind, payload, this_hash }` — once committed, every field is immutable * `WitnessChain` — `append`, `tip`, `verify`, `events` * `canonical_bytes` — length-prefixed serialization that prevents the classic concatenation forgery (`abc|def` ≠ `ab|cdef`) * `WitnessVerifyError` — auditor-friendly error with `at: usize` on every variant (SeqGap, PrevHashMismatch, HashMismatch) 13 new tests covering both happy path and active tampering: * genesis hash all-zeros * empty chain tip is genesis * canonical bytes length-prefixed (anti-forgery) * canonical bytes start with prev_hash (wire-format lock) * append links to prev_hash * seq monotonic from 0 * verify passes on clean chain * verify catches tampered payload (fires HashMismatch) * verify catches broken prev_hash link * verify catches seq gap * hash hex is 64 lowercase chars * first event prev_hash == GENESIS (auditor anchor) * different payloads → different hashes Hash-chain over Merkle is the right tradeoff for the cog's event rate (a few/min steady, dozens during a fall) — linear scan is fine and we save the Merkle complexity for a future tier when chains span days. 34/34 cog tests green (21 → 34). ADR-116 P4 row updated to enumerate the three P4 sub-units shipped / pending: (a) mDNS record-builder ✅, (b) witness hash-chain ✅, (c) responder + embedded broker + Ed25519 signing pending. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-23 18:08:56 -04:00
ruv	5723f505b7	cog-ha-matter (ADR-116 P3): extract pure publisher-input builder ... Adds `runtime::build_publisher_inputs(host, port, privacy, identity)` — the side-effect-free helper that turns the cog's CLI surface into the `(MqttConfig, OwnedDiscoveryBuilder)` pair ADR-115's `publisher::spawn` consumes. Keeps the tokio runtime wiring out of the pure unit so the mDNS responder + Seed control plane (P4) can build the same inputs from different sources without going through clap. 8 new tests lock the wire-format invariants: * host/port round-trip into MqttConfig * privacy_mode propagation (P1 dossier item 7, FDA Jan 2026) * discovery_prefix defaults to "homeassistant" * discovery carries node_id + sw_version + friendly_name * via_device advertises COG_ID (ADR-101/102 device-registry shape) * client_id includes node_id (lesson from ADR-115 iter 45-48 session takeover post-mortem — two publishers sharing a client_id loop) * tls defaults to Off for v1 LAN-only (lock against silent enablement) * default_identity carries CARGO_PKG_VERSION + PID for uniqueness Plus the existing 2 manifest tests → 10/10 green (`cargo test -p cog-ha-matter --no-default-features --lib`). Also lands the deep-researcher dossier (`docs/research/ADR-116-ha-...`) that the ADR §3+§4 reference — it was produced last iter but only the ADR was committed; this puts the source-of-truth into the tree so the ADR's "8 sections, 30+ citations" claim is actually verifiable. P3 status in the ADR phase table flipped from "pending" to "in progress" with the helper named; next iter tokio::spawns publisher::run(...) in main.rs and registers the mDNS responder. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-23 17:55:17 -04:00
rUv	00a234eda8	ADR-110: ESP32-C6 firmware extension (#764) ... Closes the firmware-side ADR-110 design at v0.7.0-esp32 after a 38-iter /loop SOTA sprint. Headline (bench, COM9+COM12 ESP32-C6): - 99.56% cross-board RX, 104.1 µs smoothed offset stdev (≤100 µs §2.4 target met) - 3.95× EMA suppression, 1.4 ppm crystal skew preserved 4 firmware releases: v0.6.7 / v0.6.8 / v0.6.9 / v0.7.0-esp32. 42 ADR-110 unit tests, 1761 v2 workspace tests, full Firmware CI + QEMU green.	2026-05-23 15:34:48 -04:00
rUv	004a63e82d	fix(security): audit — fix RUSTSEC vulns, clippy warnings, dead code (#769) ... - Upgrade openssl to 0.10.78 (CVE-2026-41676), jsonwebtoken to 9.4 - Suppress unmaintained-only/no-CVE advisories in .cargo/audit.toml with per-entry rationale - Fix all `cargo clippy --all-targets -- -D warnings` errors across 35 crates: derivable_impls, needless_range_loop, map_or→is_some_and/ is_none_or, await_holding_lock (drop MutexGuard before .await), ptr_arg (&mut Vec→&mut [T]), useless_conversion, approximate_constant (2.718→E, 3.14→PI), field_reassign_with_default, manual_inspect, useless_vec, lines_filter_map_ok, print_literal, dead_code - Apply `cargo fmt --all` - Pre-existing test failure in wifi-densepose-signal (test_estimate_occupancy_noise_only) is not introduced by this PR	2026-05-23 05:36:13 -04:00
OrbisAI Security	1906876541	fix: upgrade openssl to 0.10.78 (CVE-2026-41676) (#751) ... * fix: CVE-2026-41676 security vulnerability Automated dependency upgrade by OrbisAI Security * fix: upgrade openssl to 0.10.78 (CVE-2026-41676) rust-openssl provides OpenSSL bindings for the Rust programming langua Resolves CVE-2026-41676	2026-05-23 03:31:03 -04:00
rUv	6959a42312	feat(cog-person-count): v0.0.1 scaffold + tests + fusion math + bench (ADR-103) (#694) ... First implementation PR for ADR-103. Same incremental shape that ADR-101 used: scaffold the cog crate, ship a stub-backend release that satisfies the runtime contract + 15 tests + measured cold-start, then follow up with the trained count_v1.safetensors in a separate PR. What ships: * v2/crates/cog-person-count/ — new workspace member. - Cargo.toml: candle-core/candle-nn 0.9 (cpu default, cuda feature opt-in), safetensors, ureq, sha2 — same dep shape as the pose cog but minus wifi-densepose-train (this cog has no training-side consumer, so the dep tree is materially smaller → 2.36 MB binary vs the pose cog's 4.5 MB). - src/inference.rs: CountNet (Conv1d 56→64→128→128 encoder + count head Linear(128→64→8)+softmax + confidence head Linear(128→32→1)+sigmoid). Stub backend returns `{1-person, 0-confidence}` honestly when no safetensors present. - src/fusion.rs: fuse_confidence_weighted() — Bayesian product of per-node distributions with confidence-weighted log-sum, plus fuse_with_mincut_clip() hook for the v0.2.0 Stoer-Wagner upper-bound (`ruvector-mincut` dep lands when min-cut graph builder is ready). Confidences floored at 1e-3 and probs floored at 1e-9 before logs — no NaN propagation. - src/publisher.rs: emits {count, confidence, count_p95_low, count_p95_high, n_nodes, probs} per ADR-103 §"Output". - src/main.rs: full ADR-100 four-verb CLI (version|manifest|health |run). The `run` subcommand explicitly returns "wiring pending v0.0.1" so the in-process library API is the v0.0.1-clean integration path. - tests/smoke.rs (8 tests) + fusion::tests (7 tests, in-lib) — 15 total, all green. Cover stub-backend behaviour, wrong-shape rejection, fusion math (empty / single / agreement / high-conf override / normalisation), p95-range correctness, and min-cut clip semantics. - cog/{manifest.template.json, config.schema.json, README.md} + cog/artifacts/ placeholder dir. * v2/Cargo.toml: registers the new workspace member. Verified locally: cargo check -p cog-person-count --no-default-features → clean cargo test -p cog-person-count --no-default-features → 8/8 pass cargo test -p cog-person-count --lib → 7/7 pass cargo build -p cog-person-count --release → 2.36 MB binary ./cog-person-count version → "person-count 0.3.0" ./cog-person-count manifest → JSON skeleton ./cog-person-count health → backend:stub, count:1, conf:0, p95:[1,1] Cold-start: 30 sequential `health` invocations → 53.3 ms/invocation (vs cog-pose-estimation's 76.2 ms — smaller dep tree) cog/README.md adds: * Security section — six-row threat table covering safetensor mmap trust, non-finite outputs, sensing fetch failures, fusion divide-by-zero / log-of-zero, min-cut degenerate cases, and stdout spoofing. * Performance / optimization section — binary size, release profile (already opt-level=3 / lto=fat / codegen-units=1 / strip=true at workspace level), cold-start comparison table, projected warm-path latency budget. Still pending (separate PRs, ADR-103 §"Migration"): * Train count_v1.safetensors on the existing 1,077 paired samples with `n_persons` labels (Candle on RTX 5080, same script that produced pose_v1.safetensors yesterday). * `run` subcommand wiring (long-running polling loop, same shape as cog-pose-estimation::runtime). * Cross-compile + sign + GCS upload (mirror of cog-pose-estimation release pipeline). * Server-side `csi.rs::score_to_person_count` call-site rewire to consume this cog when installed; falls back to PR #491's heuristic when not.	2026-05-21 18:46:57 -04:00
rUv	67fec45e61	feat(edge-registry): ADR-102 — surface Cognitum cog catalog via /api/v1/edge/registry (#648) ... * feat(edge-registry): ADR-102 — surface Cognitum cog catalog via /api/v1/edge/registry Adds a new sensing-server endpoint that fetches and caches the canonical Cognitum app registry at https://storage.googleapis.com/cognitum-apps/app-registry.json (105 cogs across 11 categories as of v2.1.0). RuView previously had no live awareness of the catalog — the README's capability table was hand- curated and went stale as Cognitum shipped new cogs (the registry was last updated 6 days ago). ADR: * docs/adr/ADR-102-edge-module-registry.md — full design, response shape, configuration flags, failure modes, and a 12-row security review covering SSRF, response inflation, ?refresh abuse, stale-serve semantics, TLS, cache poisoning, JSON-panic resistance, etc. Code: * v2/.../edge_registry.rs — EdgeRegistry struct + UreqFetcher + MockFetcher trait + 7 unit tests. RwLock<Option<CachedEntry>> with stale-on-error fallback. MAX_PAYLOAD_BYTES=8 MiB, 10s wire timeout. * v2/.../main.rs — constructs Option<Arc<EdgeRegistry>> at startup, registers GET /api/v1/edge/registry handler, wires Extension layer. Handler runs the blocking ureq fetch via tokio::task::spawn_blocking so the async runtime stays free. * v2/.../cli.rs / main.rs Args — three new flags (per user request to "allow the registry to be disabled or changed"): --edge-registry-url <URL> (env RUVIEW_EDGE_REGISTRY_URL) --edge-registry-ttl-secs <N> (env RUVIEW_EDGE_REGISTRY_TTL_SECS) --no-edge-registry (env RUVIEW_NO_EDGE_REGISTRY) When --no-edge-registry is set or the URL is empty, the endpoint returns 404. Cargo.toml: adds ureq (rustls), sha2, thiserror as direct deps. README: * New collapsed "🧩 Edge Module Catalog" section with the full 105-cog table generated from the registry, grouped by category with practical one-line descriptions (e.g. "Spots irregular heartbeats and abnormal heart rhythms", "Detects walking problems and scores fall risk"). Links to https://seed.cognitum.one/store and the local appliance /cogs page. Sits between the HF model section and How It Works. Tests (7/7 pass): first_call_hits_upstream_and_caches ttl_expiry_triggers_refetch force_refresh_bypasses_fresh_cache stale_serve_on_upstream_failure_after_cached_success no_cache_no_upstream_returns_error upstream_invalid_json_is_treated_as_error upstream_sha256_is_deterministic Security highlights (full review in ADR-102 §"Security review"): - The registry is metadata-only; per-cog binary signatures (ADR-100) remain the trust root for installs. A compromised registry can mislead a human reader but cannot ship malicious binaries. - 8 MiB cap + 10s timeout + Option<Arc<...>> via Extension layer means the endpoint can't be used to exhaust memory or pin tokio threads. - Stale-on-error responses carry an explicit `stale: true` field so upstream outages are visible to consumers rather than silently masked. - Endpoint sits behind the existing RUVIEW_API_TOKEN bearer gate when set, otherwise unauthenticated (registry contents are public anyway). * chore: refresh Cargo.lock for ureq/sha2/thiserror deps added by ADR-102	2026-05-19 18:08:43 -04:00
rUv	3314c8db8d	feat(cog-pose-estimation): scaffold first Cog from this repo (ADR-100 + ADR-101) (#642) ... * feat(cog-pose-estimation): scaffold first Cog from this repo (ADR-100 + ADR-101) Adds the foundation for the pose-estimation Cog that ships from this repo into Cognitum V0 appliances. Companion ADR-225 + crate land in cognitum-one/v0-appliance. ADRs: * ADR-100 formalises the Cognitum Cog packaging spec — on-device layout under /var/lib/cognitum/apps/<id>/, manifest.json schema (incl. new binary_sha256 + binary_signature fields), GCS hosting convention, repo source layout, build pipeline, and the four-verb runtime contract (version | manifest | health | run). Documents the convention I reverse-engineered from inspecting installed cogs on a live cognitum-v0 appliance — `anomaly-detect`, `presence`, `seizure-detect`, etc. * ADR-101 designs the pose-estimation Cog itself: where it sits in the wifi-densepose pipeline (encoder init from ruvnet/wifi-densepose-pretrained, 17-keypoint regression head), what gets shipped per target arch (arm / x86_64 / hailo8 / hailo10), acceptance gates (PCK@20 explicitly deferred to #640 — this ADR ships the vehicle, not the accuracy). Crate v2/crates/cog-pose-estimation/: * Cargo.toml + workspace member declaration with a hailo feature gate so the binary builds without the Hailo SDK in CI. * main.rs implements the four-verb CLI exactly per ADR-100. * config.rs / manifest.rs / publisher.rs / inference.rs / runtime.rs — small modules, each <100 lines. * publisher.rs emits ADR-100 structured JSON events. * inference.rs is a stub that produces a centred-skeleton baseline with confidence=0 (honest: no trained weights wired in yet). * runtime.rs subscribes to /api/v1/sensing/latest, slides a 56*20 window, runs the engine, emits pose.frame events. * cog/manifest.template.json + cog/config.schema.json define the release artifact + runtime config schemas. * cog/Makefile holds build / sign / upload targets. * tests/smoke.rs covers manifest roundtrip + engine I/O surface. Verified locally: * cargo check -p cog-pose-estimation: clean. * cargo test -p cog-pose-estimation: 4/4 pass. * ./target/release/cog-pose-estimation {version,manifest,health}: all emit the right contract output. This commit contains scaffolding only; the actual trained weights and Hailo HEF cross-compile come in follow-ups tracked in #640 and the companion v0-appliance branch. * feat(cog-pose-estimation): first measured run — Candle CUDA on RTX 5080 Trained pose_v1 on ruvultra (RTX 5080) via Candle 0.9 + cuda feature against the same 1,077-sample paired session that produced 0%/0% PCK in #640 with the pure-JS SPSA trainer. First real numbers: PCK@20 = 3.0% (up from 0.0%) PCK@50 = 18.5% (up from 0.0%) MPJPE = 0.093 (down from 0.66, ~7x improvement) 400 epochs in 2.1 s wall time, full-batch, ~5 ms/epoch. Loss curve 0.181 -> 0.014 over the run, eval 0.010. Per-joint reveals the model leans on right-side proximal joints (r_hip 77% PCK@50, r_knee 35%, l_elbow 26%) — consistent with the camera framing in the source recording. Distal joints (wrists, ankles) and face joints are still near-random, consistent with the 56-subcarrier / 20-frame input not carrying fine-grained spatial info at 1077 samples. This commit: * Adds v2/crates/cog-pose-estimation/cog/artifacts/{pose_v1.safetensors, train_results.json} so the cog dir now contains a real reference artifact, not just scaffold. * Updates cog/README.md "Status" block with the measured numbers, per-joint table, and an honest reading of where the model succeeds vs where the data is the bottleneck. * Adds docs/benchmarks/pose-estimation-cog.md as the canonical benchmark log — append-only, one section per published run. * Appends a "First measured run" section to ADR-101 referencing the new benchmark file. Still pending in the follow-up: * Wire pose_v1.safetensors into src/inference.rs (replace stub). * ONNX export (Candle lacks a writer — needs external conversion). * Hailo HEF cross-compile + cluster deploy. The data-bound gap to PCK@20 >= 35% is tracked in #640. * feat(cog-pose-estimation): wire real weights — cog is no longer a stub Replaces the centred-skeleton stub in src/inference.rs with a real Candle-based loader that reads cog/artifacts/pose_v1.safetensors and runs the trained Conv1d encoder + MLP pose head on every incoming CSI window. What changes: * src/inference.rs: PoseNet mirrors the training script's architecture exactly — Conv1d(56->64, k=3 d=1), Conv1d(64->128, k=3 d=2), Conv1d(128->128, k=3 d=4), mean over time, Linear(128->256)+ReLU, Linear(256->34)+sigmoid -> reshape [17, 2]. The InferenceEngine searches a sensible candidate list for the weights file (/var/lib/cognitum/apps/pose-estimation/, ./pose_v1.safetensors, ./cog/artifacts/, repo-root, v2/-relative) and falls back to the stub when none are present so the cog still satisfies ADR-100. * Cargo.toml: adds candle-core 0.9 + candle-nn 0.9 (no-default-features, CPU build by default) + safetensors 0.4. New `cuda` feature opt-in for GPU inference on hosts that have it. Drops the unused wifi-densepose-train path dep from the default build path. * src/main.rs + src/publisher.rs: health.ok event now carries `backend` (candle-cuda | candle-cpu | stub) and the synthetic output confidence, so operators can tell at a glance whether the cog loaded its weights or fell back to the stub. * tests/smoke.rs: adds `real_weights_load_when_available` which asserts the loaded engine reports backend=candle-* and emits non-zero confidence — exactly the signal that proves we're not silently degrading to the stub. Verified locally: * `cargo check -p cog-pose-estimation --no-default-features` — clean * `cargo test -p cog-pose-estimation --no-default-features` — 5/5 pass * `./target/release/cog-pose-estimation health` emits: {"event":"health.ok","fields":{"backend":"candle-cpu","cog":"pose-estimation","synthetic_output_confidence":0.185}} — 0.185 is the published PCK@50 from cog/artifacts/train_results.json, emitted by the real Candle inference path (would be 0.0 if it had fallen back to the stub). The cog now runs the trained pose_v1 model end-to-end. Accuracy is still bounded by the underlying 1077-sample training data (PCK@20 3.0%, PCK@50 18.5% per docs/benchmarks/pose-estimation-cog.md) — that gap is data-bound and tracked in #640. ONNX export + Hailo HEF cross-compile remain follow-ups. * docs(benchmarks): measure cog-pose-estimation cold-start latency 100 sequential `cog-pose-estimation health` invocations average 76.2 ms each on a Windows x86_64 host using the `candle-cpu` backend. Each invocation re-loads pose_v1.safetensors and runs one synthetic forward pass, so this is the worst-case cold-start path. Long-running `run` inference will be sub-millisecond per frame once the model is loaded. Updates the benchmarks doc accordingly. * feat(cog-pose-estimation): ONNX export — pose_v1.onnx + scripts/export-onnx.py Adds the canonical ONNX artifact that unblocks downstream Hailo HEF cross-compile + ONNX Runtime benchmarks. Generated on ruvultra (torch 2.12.0 + CUDA), 12,059 bytes, opset 18, dynamic batch axis. * scripts/export-onnx.py: mirrors the Candle inference architecture in PyTorch (Conv1d 56->64, 64->128, 128->128 + Linear 128->256->34), pure- python safetensors loader (no extra pip dep), exports via torch.onnx.export, then verifies via onnx.checker.check_model and numerical parity against the torch reference. * Verified parity vs torch: max |torch - onnx| = 8.94e-8 (1e-5 threshold). Effectively bit-perfect. * v2/crates/cog-pose-estimation/cog/artifacts/pose_v1.onnx — the artifact itself, 12 KB. * docs/benchmarks/pose-estimation-cog.md — adds an ONNX export section with the verification numbers. Next: Hailo HEF cross-compile (still gated on Hailo SDK on a self-hosted runner) and ONNX Runtime latency benchmarks on each target arch. * feat(cog-pose-estimation): release v0.0.1 — signed aarch64 binary on GCS End-to-end deploy: cross-compiled to aarch64-unknown-linux-gnu on ruvultra, ran via qemu-aarch64-static, then smoke-tested on a real cognitum-v0 Pi 5. Signed with COGNITUM_OWNER_SIGNING_KEY (Ed25519) and uploaded to gs://cognitum-apps/cogs/arm/. Real-hardware results on cognitum-v0 (Pi 5): health: backend=candle-cpu, confidence=0.185, real weights loaded 30x sequential `health`: 0.251 s total -> 8.4 ms / invocation (cold) GCS release artifacts (publicly downloadable): binary: 3,741,976 bytes sha256 1e1a7d3dd01ca05d5bfc5dbb142a5941b7866ed9f3224a21edc04d3f09a99bf5 weights: 507,032 bytes sha256 eb249b9a6b2e10130437a10976ed0230b0d085f86a0553d7226e1ae6eae4b9e5 signature (Ed25519, b64): LUN7xqLPYD3MFzm5dKB5MnYU0LvoRtek5ci5KiKPHBg+Xo6xuazwokn2Dw2JPMaLYJzmWn/SpT4djuR7hYvVDw== Adds: * v2/crates/cog-pose-estimation/cog/artifacts/manifest.json — the release-pipeline-produced manifest with all fields filled in per ADR-100, including arch, target_triple, signature, and a build_metadata block carrying the validation PCK numbers. * docs/benchmarks/pose-estimation-cog.md — new sections covering the real Pi 5 smoke (8.4 ms cold-start) and the signed GCS release artifacts. Verified by downloading the binary anonymously from GCS and re-computing the sha256 — matches the locally-computed sha exactly. Signature decoded to the expected 64-byte Ed25519 length. Closes the GCS-upload acceptance criterion from ADR-100; the only pending work is Hailo HEF cross-compile (still SDK-gated) and an x86_64 release alongside this arm release. * docs(benchmarks): record live cognitum-v0 install + 5-sec smoke run Adds the "Live appliance install" section documenting what happened when the signed v0.0.1 binary + weights were installed under /var/lib/cognitum/apps/pose-estimation/ on cognitum-v0 (the V0 cluster leader). * Layout matches the existing anomaly-detect / presence / seizure- detect cogs exactly — the Cogs dashboard at http://cognitum-v0:9000/cogs auto-discovers entries. * `cog-pose-estimation run` ran for 5 seconds in the background and cleanly emitted run.started + structured WARN events for the missing local sensing-server on :3000 (cognitum-v0's actual CSI source is ruview-vitals-worker on :50054, not :3000). No crashes, no NaN, no leaks. * Wiring `sensing_url` to the appliance-native source is a separate Day-2 integration task.	2026-05-19 17:03:09 -04:00
rUv	1b155ad027	chore: remove empty stub crates wifi-densepose-{api,db,config} (closes #578) (#608) ... Each of these crates was a single-line doc-comment placeholder: v2/crates/wifi-densepose-api/src/lib.rs: //! WiFi-DensePose REST API (stub) v2/crates/wifi-densepose-db/src/lib.rs: //! WiFi-DensePose database layer (stub) v2/crates/wifi-densepose-config/src/lib.rs: //! WiFi-DensePose configuration (stub) with empty [dependencies] in their Cargo.toml and zero references from any source file or Cargo.toml in the workspace (verified by `grep -rln wifi-densepose-api/-db/-config` across `v2/`). They were reserved early for an envisioned REST/database/config split that never materialised. The functionality these would have provided is covered today by: - REST/WS: wifi-densepose-sensing-server (Axum) - Config: per-crate config + CLI args in sensing-server and desktop - DB: no persistent state; system is real-time Removal prevents `cargo` from listing dead crates, shipping empty published artifacts to crates.io, or wasting reviewer attention. If any of these names is needed in the future, reintroduce them with a real implementation. Per the issue reporter (@bannned-bit / Matad0r) #578 explicitly listed "OR be removed from workspace members until implementation starts" as an acceptable resolution. Updated: - `v2/Cargo.toml`: drop the three members (with inline comment explaining why) - `v2/Cargo.lock`: regenerated by cargo check - `CLAUDE.md`: drop the three rows from the crate table and the publishing order list - `CHANGELOG.md`: add an `[Unreleased] / Removed` entry Verified: - `cd v2 && cargo check --workspace --no-default-features` -> finished in 48s, no errors (warnings unchanged)	2026-05-17 18:50:57 -04:00
dependabot[bot]	a80617ee84	chore(deps): bump console from 0.15.11 to 0.16.3 in /v2 (#471) ... Bumps [console](https://github.com/console-rs/console) from 0.15.11 to 0.16.3. - [Release notes](https://github.com/console-rs/console/releases) - [Changelog](https://github.com/console-rs/console/blob/main/CHANGELOG.md) - [Commits](https://github.com/console-rs/console/compare/0.15.11...0.16.3) --- updated-dependencies: - dependency-name: console dependency-version: 0.16.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:10:01 -04:00
dependabot[bot]	afc86c6fc4	chore(deps): bump thiserror from 1.0.69 to 2.0.18 in /v2 (#469) ... Bumps [thiserror](https://github.com/dtolnay/thiserror) from 1.0.69 to 2.0.18. - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](https://github.com/dtolnay/thiserror/compare/1.0.69...2.0.18) --- updated-dependencies: - dependency-name: thiserror dependency-version: 2.0.18 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:09:54 -04:00
dependabot[bot]	e6710e8988	chore(deps): bump ndarray-linalg from 0.16.0 to 0.18.1 in /v2 (#477) ... Bumps [ndarray-linalg](https://github.com/rust-ndarray/ndarray-linalg) from 0.16.0 to 0.18.1. - [Release notes](https://github.com/rust-ndarray/ndarray-linalg/releases) - [Commits](https://github.com/rust-ndarray/ndarray-linalg/compare/ndarray-linalg-v0.16.0...ndarray-linalg-v0.18.1) --- updated-dependencies: - dependency-name: ndarray-linalg dependency-version: 0.18.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:08:08 -04:00
dependabot[bot]	ab9799adc3	chore(deps): bump tower-http from 0.5.2 to 0.6.8 in /v2 (#483) ... Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.5.2 to 0.6.8. - [Release notes](https://github.com/tower-rs/tower-http/releases) - [Commits](https://github.com/tower-rs/tower-http/compare/tower-http-0.5.2...tower-http-0.6.8) --- updated-dependencies: - dependency-name: tower-http dependency-version: 0.6.8 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:08:04 -04:00
dependabot[bot]	bdb4484259	chore(deps): bump tch from 0.14.0 to 0.24.0 in /v2 (#482) ... Bumps [tch](https://github.com/LaurentMazare/tch-rs) from 0.14.0 to 0.24.0. - [Release notes](https://github.com/LaurentMazare/tch-rs/releases) - [Changelog](https://github.com/LaurentMazare/tch-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/LaurentMazare/tch-rs/commits) --- updated-dependencies: - dependency-name: tch dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:08:01 -04:00
dependabot[bot]	ba370c7b08	chore(deps): bump tabled from 0.15.0 to 0.20.0 in /v2 (#481) ... Bumps [tabled](https://github.com/zhiburt/tabled) from 0.15.0 to 0.20.0. - [Changelog](https://github.com/zhiburt/tabled/blob/master/CHANGELOG.md) - [Commits](https://github.com/zhiburt/tabled/commits) --- updated-dependencies: - dependency-name: tabled dependency-version: 0.20.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:07:57 -04:00
dependabot[bot]	3fdd310f89	chore(deps): bump tauri-plugin-dialog from 2.6.0 to 2.7.1 in /v2 (#480) ... Bumps [tauri-plugin-dialog](https://github.com/tauri-apps/plugins-workspace) from 2.6.0 to 2.7.1. - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](https://github.com/tauri-apps/plugins-workspace/compare/log-v2.6.0...log-v2.7.1) --- updated-dependencies: - dependency-name: tauri-plugin-dialog dependency-version: 2.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:07:53 -04:00
dependabot[bot]	98e7eeda42	chore(deps): bump ruvector-core from 2.0.5 to 2.2.0 in /v2 (#479) ... Bumps [ruvector-core](https://github.com/ruvnet/ruvector) from 2.0.5 to 2.2.0. - [Release notes](https://github.com/ruvnet/ruvector/releases) - [Changelog](https://github.com/ruvnet/RuVector/blob/main/CHANGELOG.md) - [Commits](https://github.com/ruvnet/ruvector/compare/v2.0.5...v2.2.0) --- updated-dependencies: - dependency-name: ruvector-core dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:07:37 -04:00
dependabot[bot]	5615edb24e	chore(deps): bump ruvector-temporal-tensor from 2.0.4 to 2.0.6 in /v2 (#476) ... Bumps [ruvector-temporal-tensor](https://github.com/ruvnet/ruvector) from 2.0.4 to 2.0.6. - [Release notes](https://github.com/ruvnet/ruvector/releases) - [Changelog](https://github.com/ruvnet/RuVector/blob/main/CHANGELOG.md) - [Commits](https://github.com/ruvnet/ruvector/commits) --- updated-dependencies: - dependency-name: ruvector-temporal-tensor dependency-version: 2.0.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-05-17 18:07:33 -04:00
ruv	94ef125240	feat(sensing-server): introspection module skeleton (ADR-099 D1+D7+D8) ... Adds the per-frame introspection state that ADR-099 specifies, plus the two midstream dependencies. Pure addition — no other code touched. v2/crates/wifi-densepose-sensing-server/Cargo.toml + midstreamer-temporal-compare = "0.2" + midstreamer-attractor = "0.2" v2/crates/wifi-densepose-sensing-server/src/introspection.rs (new, 530 lines) pub struct IntrospectionState ├─ midstreamer-attractor's AttractorAnalyzer (regime + Lyapunov) ├─ SignatureLibrary (JSON-loaded labelled segments) ├─ VecDeque<f64> sliding amplitude buffer (default 128 points) └─ update(timestamp_ns, derived_feature) — never window-blocked + snapshot() -> IntrospectionSnapshot { timestamp_ns, frame_count, regime, lyapunov_exponent, attractor_dim, attractor_confidence, top_k_similarity } pub enum Regime { Idle, Periodic, Transient, Chaotic, Unknown } pub struct Signature { id, label, vectors, dtw, promotion_threshold } pub struct SimilarityMatch { signature_id, score, above_threshold } DTW path is currently a host-side stand-in (length-normalised L1 with the real DTW call deferred to I3/I5 once vec128 embeddings exist — ADR-099 P1). The attractor path is wired to midstream directly. The analyze() step only runs every N frames (default 8) to stay under the per-frame ms budget. 8 unit tests (snapshot defaults, frame-count + timestamp advance, empty library, scoring + ordering invariants, threshold gating, empty-signature fault-tolerance, regime classification after 200 frames). 199 → 207 lib tests, 0 failures. cargo build clean (only pre-existing warnings). Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-13 22:50:58 -04:00
ruv	c641fc44ae	feat(docker+sensing-server): refresh Docker publish + opt-in bearer-token API auth ... Closes #520, #514, #443. ## #520 / #514 — stale Docker image, missing UI assets `ruvnet/wifi-densepose:latest` was published before `ui/observatory*` and `ui/pose-fusion*` were added; users see /app/ui missing those files and the v0.6+ packet format doesn't reach the server. Two fixes: 1. `docker/Dockerfile.rust` now `RUN`s a build-time guard after `COPY ui/` that fails the build if `index.html` / `observatory.html` / `pose-fusion.html` / `viz.html` (or the `observatory/` / `pose-fusion/` / `components/` / `services/` directories) are missing, plus an exec-bit check on `/app/sensing-server`. A stale image can never be silently produced again. 2. New `.github/workflows/sensing-server-docker.yml` rebuilds + pushes on every change to the Dockerfile, the server crate, the signal/vitals/ wifiscan crates, the workspace manifests, the `ui/` tree, or itself — plus `v*` tags and manual dispatch. Pushes to both `docker.io/ruvnet/ wifi-densepose` AND `ghcr.io/ruvnet/wifi-densepose` with `latest` + `vX.Y.Z` + `sha-<short>` tags, then post-push smoke-tests the artifact: /health, /api/v1/info, the observatory + pose-fusion HTML, AND the bearer-auth path (no token → 401, wrong → 401, correct → 200). Uses the `DOCKERHUB_USERNAME`/`DOCKERHUB_TOKEN` repo secrets; ghcr.io rides on the workflow's GITHUB_TOKEN. ## #443 — sensing-server REST API auth model QE security audit raised that 40+ /api/v1/* routes have no auth layer with a default `0.0.0.0` bind. New `wifi_densepose_sensing_server::bearer_auth` module + middleware: - Env-var-gated: `RUVIEW_API_TOKEN` unset/empty ⇒ middleware is a no-op (current LAN-mode behaviour preserved — **no default change**); set ⇒ every `/api/v1/*` request must carry `Authorization: Bearer <token>` or the server returns 401. - Constant-time byte compare via local `ct_eq` (no new dep). - `/health*`, `/ws/sensing`, and `/ui/*` are intentionally never gated (orchestrator probes + local browsers). - Startup logs which mode is active and warns when auth is ON with a `0.0.0.0` bind. - 8 unit tests on the middleware via `tower::ServiceExt::oneshot` (sensing-server lib tests 191 → 199, 0 failures). Verified locally: `cargo build --workspace --no-default-features` ✓, `cargo test -p wifi-densepose-sensing-server --no-default-features` ✓. Co-Authored-By: claude-flow <ruv@ruv.net>	2026-05-13 08:52:25 -04:00
Claude	b116a99481	feat(rvcsi): real nexmon_csi UDP/PCAP fidelity — chanspec decode, libpcap reader, NexmonPcapAdapter ... Raises the Nexmon path from a normalized record format to parsing what the patched Broadcom firmware actually emits, end to end. napi-c shim (ABI 1.0 -> 1.1, additive): - rvcsi_nx_csi_udp_header / rvcsi_nx_csi_udp_decode — parse the real nexmon_csi UDP payload: the 18-byte header (magic 0x1111, rssi int8, fctl, src_mac[6], seq_cnt, core/spatial-stream, Broadcom chanspec, chip_ver) + nsub complex CSI samples (modern int16 LE I/Q export — what CSIKit/csireader.py read for the BCM43455c0 / 4358 / 4366c0; nsub = (len-18)/4). rvcsi_nx_csi_udp_write to synthesize payloads for tests. rvcsi_nx_decode_chanspec — d11ac chanspec -> channel (chanspec & 0xff) / bandwidth (bits [13:11], cross-checked against the FFT size) / band (bits [15:14], cross-checked against the channel number). Still allocation-free, bounds-checked, structured errors, never panics. - ffi.rs wraps it: decode_chanspec / parse_nexmon_udp_header / decode_nexmon_udp / encode_nexmon_udp + DecodedChanspec / NexmonCsiHeader; every unsafe block documented; the ABI guard now expects 1.1. rvcsi-adapter-nexmon: - pcap.rs — a dependency-free classic-libpcap reader (all four byte-order / timestamp-resolution magics; Ethernet / raw-IPv4 / Linux-SLL link types; tolerates a truncated final record; pcapng is a follow-up) + extract_udp_payload + a synthetic_udp_pcap / synthetic_nexmon_pcap test/example generator. - NexmonPcapAdapter (a CsiSource) — reads the CSI UDP packets out of a `tcpdump -i wlan0 dst port 5500 -w csi.pcap` capture, decodes each via the C shim, stamps the frame timestamp from the pcap packet time; non-CSI packets counted as "skipped" in health. rvcsi-runtime: decode_nexmon_pcap, summarize_nexmon_pcap (+ NexmonPcapSummary: link type, CSI frame count, channels, bandwidths, subcarrier counts, chip versions, RSSI range, time span), CaptureRuntime::open_nexmon_pcap[_bytes]. rvcsi-node (napi-rs): nexmonDecodePcap, inspectNexmonPcap, decodeChanspec, RvcsiRuntime.openNexmonPcap. @ruv/rvcsi SDK + .d.ts updated (NexmonPcapSummary, DecodedChanspec). rvcsi-cli: `record --source nexmon-pcap`, `inspect-nexmon`, `decode-chanspec`. 161 rvcsi tests pass (adapter-nexmon 9->22), 0 failures, clippy-clean. ADR-096 §2.2/§2.3/§5, CHANGELOG, CLAUDE.md updated. https://claude.ai/code/session_01CdYAPvRTjcch6YrYf42n1z	2026-05-13 01:15:22 +00:00
Claude	7393cc2b73	feat(rvcsi): rvcsi-runtime composition + rvcsi-node (napi-rs) + rvcsi-cli + @ruv/rvcsi TS SDK ... - rvcsi-runtime — the composition layer (no FFI): CaptureRuntime (CsiSource + validate_frame + SignalPipeline + EventPipeline, with next_validated_frame / next_clean_frame / drain_events / health) plus one-shot helpers (summarize_capture → CaptureSummary, decode_nexmon_records, events_from_capture, export_capture_to_rf_memory, rf_memory_self_check). 10 tests. - rvcsi-node — the napi-rs seam (cdylib+rlib, build.rs runs napi_build::setup): thin #[napi] wrappers over rvcsi-runtime — rvcsiVersion / nexmonShimAbiVersion / nexmonDecodeRecords / inspectCaptureFile / eventsFromCaptureFile / exportCaptureToRfMemory + an RvcsiRuntime streaming class. Everything that crosses the boundary is a validated/normalized rvCSI struct serialized to JSON (D6). deny(clippy::all). - @ruv/rvcsi npm package (package.json + index.js + index.d.ts + README + __test__/api.test.cjs) — curated JS surface that JSON-parses the addon's output into plain CsiFrame/CsiWindow/CsiEvent/SourceHealth/CaptureSummary objects; lazy native-addon load with a helpful "not built" error. - rvcsi-cli — the `rvcsi` binary: record (Nexmon dump → .rvcsi, validating), inspect, replay, stream, events, health, calibrate (v0 baseline), export ruvector. 7 tests exercising every subcommand against in-memory captures. - rvcsi-cli no longer depends on rvcsi-node (a binary can't link the napi addon); the shared logic moved to rvcsi-runtime. .gitignore: ignore the generated *.node / binding.js / binding.d.ts / npm/ under rvcsi-node. All rvcsi crates: build together OK, clippy-clean, 140 unit/integration tests + 2 doctests, 0 failures (core 29, dsp 28, events 18, adapter-file 20+1, adapter-nexmon 9, ruvector 20+1, runtime 10, cli 7). https://claude.ai/code/session_01CdYAPvRTjcch6YrYf42n1z	2026-05-13 00:17:45 +00:00
Claude	6432dfbd2d	feat(rvcsi): rvcsi-adapter-file (.rvcsi capture/replay) + rvcsi-ruvector (RF memory) ... - rvcsi-adapter-file (ADR-095 FR1/FR10, D9): the `.rvcsi` JSONL capture format (CaptureHeader line + one CsiFrame per line), FileRecorder, FileReplayAdapter (a CsiSource — deterministic replay, preserves timestamps/ordering/validation verbatim, carries an unenforced replay_speed for the daemon/CLI), read_all(). 20 unit tests + 1 doctest. - rvcsi-ruvector (ADR-095 FR8, D8) — standin for the production RuVector binding: deterministic embeddings (window_embedding = 32 resampled mean_amplitude bins + 32 resampled phase_variance bins + [motion_energy, presence_score, quality_score, ln1p(frame_count)], L2-normalized, dim 68; event_embedding = 10-wide kind one-hot + confidence + ln1p(evidence count), dim 12), cosine_similarity, the RfMemoryStore trait + value objects (EmbeddingId/RecordKind/SimilarHit/ DriftReport), and InMemoryRfMemory + JsonlRfMemory (file-backed append log, identical query semantics, latest-baseline-per-room-wins on reopen). 20 unit tests + 1 doctest. All rvcsi crates build and test together: core 29, dsp 28, events 18, adapter-file 20(+1), adapter-nexmon 9, ruvector 20(+1) — 124 unit + 2 doc tests, 0 failures. forbid(unsafe_code) everywhere except rvcsi-adapter-nexmon (FFI). https://claude.ai/code/session_01CdYAPvRTjcch6YrYf42n1z	2026-05-13 00:03:27 +00:00
Claude	1e684cb208	feat(rvcsi): rvcsi-core + napi-c Nexmon shim + crate skeletons (ADR-095/096) ... First implementation milestone for the rvCSI edge RF sensing runtime: - rvcsi-core — the foundation: CsiFrame/CsiWindow/CsiEvent normalized schema, ValidationStatus, AdapterProfile, CsiSource plugin trait, id newtypes + IdGenerator, RvcsiError, and the validate_frame pipeline (length/finiteness/ subcarrier/RSSI/monotonicity hard checks + multiplicative quality scoring → Accepted/Degraded/Recovered/Rejected). 29 unit tests, forbid(unsafe_code). - rvcsi-adapter-nexmon — the napi-c boundary: native/rvcsi_nexmon_shim.{c,h} (the only C in the runtime, allocation-free, bounds-checked, parses/writes a byte-defined "rvCSI Nexmon record" — a normalized superset of the nexmon_csi UDP payload), compiled via build.rs + cc, wrapped by a documented ffi module and a NexmonAdapter implementing CsiSource. 9 tests round-tripping through C. - Workspace registration in v2/Cargo.toml (8 new members + napi/cc workspace deps) and compiling skeletons for rvcsi-dsp, rvcsi-events, rvcsi-adapter-file, rvcsi-ruvector, rvcsi-node (napi-rs cdylib + build.rs napi_build::setup) and rvcsi-cli (`rvcsi` binary) — to be filled in by the implementation swarm. cargo build -p rvcsi-core -p rvcsi-adapter-nexmon -p rvcsi-node -p rvcsi-cli: OK cargo test -p rvcsi-core -p rvcsi-adapter-nexmon: 38 passed, 0 failed https://claude.ai/code/session_01CdYAPvRTjcch6YrYf42n1z	2026-05-12 23:49:58 +00:00
rUv	7f5a692632	feat(nvsim): full simulator stack — Rust crate, dashboard, server, App Store, Ghost Murmur [ADR-089/090/091/092/093] ... Squashed merge of feat/nvsim-pipeline-simulator (29 commits). ## Shipped - ADR-089 nvsim crate (Accepted) — 50/50 tests, ~4.5 M samples/s, pinned witness cc8de9b01b0ff5bd… - ADR-092 dashboard implementation (Implemented) — 8/12 §11 gates ✅, 4/12 ⚠ (external infra) - ADR-093 dashboard gap analysis (Implemented) — 21/21 catalogued gaps closed - Plus ADR-090 (proposed conditional) and ADR-091 (proposed research-only) ## Live deploy https://ruvnet.github.io/RuView/nvsim/ ## Infra - nvsim-server Dockerfile + GHCR publish workflow (.github/workflows/nvsim-server-docker.yml) - axe-core + Playwright cross-browser CI (.github/workflows/dashboard-a11y.yml) - gh-pages auto-deploy workflow already in place (preserves observatory + pose-fusion siblings) Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-27 12:41:01 -04:00
rUv	17509a2a41	feat(ruvector,signal,sensing-server): ADR-084 Passes 1/1.5/2/3 — RaBitQ similarity sensor implementation (#435) ... * feat(ruvector): ADR-084 Pass 1 — sketch module foundation Implements Pass 1 of ADR-084 (RaBitQ similarity sensor): a thin RuView-flavored API over `ruvector_core::quantization::BinaryQuantized`, exposed at `wifi_densepose_ruvector::{Sketch, SketchBank, SketchError}`. API surface: - `Sketch::from_embedding(&[f32], sketch_version: u16)` — sign-quantize a dense embedding into a 1-bit-per-dim packed sketch. - `Sketch::distance` — hamming distance with schema-mismatch error. - `Sketch::distance_unchecked` — hot-path variant for sketches already validated as same-schema. - `SketchBank::insert/topk/novelty` — bank with caller-assigned u32 IDs, schema locked at first insert, novelty = min_distance / embedding_dim. Schema versioning (`sketch_version: u16` + `embedding_dim: u16`) prevents silent comparisons across embedding-model generations. Bumping the model forces re-sketch of the candidate bank. Pass 1 establishes the API and unit-test foundation. Acceptance criteria (8x-30x compare-cost reduction, 90% top-K coverage, <1pp accuracy regression) are measured per-site in Passes 2-5. Validated: - 12 new tests pass (sketch construction, hamming, top-K ordering, schema lock, schema rejection, novelty) - cargo test --workspace --no-default-features → 1,551 passed, 0 failed, 8 ignored (was 1,539 before; +12 new tests) - ESP32-S3 on COM7 still streaming live CSI (cb #117300) Co-Authored-By: claude-flow <ruv@ruv.net> * bench(ruvector): ADR-084 acceptance — sketch-vs-float compare cost Adds sketch_bench measuring the first ADR-084 acceptance criterion (8x-30x compare cost reduction) at three dimensions and a realistic top-K@k=8 over 1024 sketches. Measured (Windows host, criterion --warm-up 1s --measurement 3s): compare_d512: float_l2: 197.03 ns/op float_cosine: 231.17 ns/op sketch_hamming: 4.56 ns/op → 43-51x speedup topk_d128_n1024_k8: float_l2_topk: 47.59 us sketch_hamming: 6.34 us → 7.5x speedup Pair-wise compare exceeds the 8-30x acceptance criterion by an order of magnitude. Top-K is at 7.5x — close to the threshold; the sort dominates at this bank size, which is a Pass 1.5 optimization opportunity (partial-sort heap for small K). Co-Authored-By: claude-flow <ruv@ruv.net> * perf(ruvector): ADR-084 Pass 1.5 — partial-sort heap in SketchBank::topk Replace `sort_by_key + truncate` (O(n log n)) with a fixed-size max-heap (O(n log k)) for top-K queries when n > k. Fast path when n ≤ k stays on the simple sort. Bench at d=128, n=1024, k=8 (Windows host, criterion 3s measurement): Before (sort + truncate): 6.34 µs/op After (heap): 3.83 µs/op -39.4% / +1.65× faster Combined with the 32× memory shrink and 47.6 µs → 3.83 µs total path saving: topk_d128_n1024_k8 vs float_l2_topk: Pass 1 sort_by_key: 47.59 µs / 6.34 µs = 7.5× speedup Pass 1.5 heap: 47.59 µs / 3.83 µs = 12.4× speedup Now over the ADR-084 acceptance criterion of 8× minimum. Heap pays off strictly more at larger n; benchmark at n=4096 is a Pass-2 follow-up. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(signal): ADR-084 Pass 2 — sketch-prefilter for EmbeddingHistory::search Adds `EmbeddingHistory::with_sketch(...)` and `search_prefilter(query, k, prefilter_factor)`. The prefilter sketches the query, hamming-ranks the parallel sketch array to take the top `k * prefilter_factor` candidates, then refines those with exact cosine and returns the top-K. `EmbeddingHistory::new(...)` is unchanged — sketches are opt-in via the new constructor. `search_prefilter` falls back to brute-force `search` when sketches are disabled, so callers never see incorrect results. ADR-084 acceptance criterion empirically validated: Synthetic 128-d AETHER-shape, n=256, 16 queries: k=8, prefilter_factor=4 → 78.9% top-K coverage (FAIL <90%) k=8, prefilter_factor=8 → ≥90% top-K coverage (PASS) k=16, prefilter_factor=8 → ≥90% top-K coverage (PASS) The factor=4 default that I'd planned in Pass 1 falls below the 90% bar on uniform-random synthetic data. Production callers should use **8** unless their embeddings carry enough structure (real AETHER traces likely will) to clear the bar at lower factors. Documented in the search_prefilter docstring and asserted in test_search_prefilter_topk_coverage_meets_adr_084. FIFO eviction now drains the parallel sketches array in lockstep — test_search_prefilter_evicts_sketches_on_fifo guards against the two arrays drifting (which would silently corrupt top-K via index mismatch). Validated: - cargo test --workspace --no-default-features → 1,554 passed, 0 failed, 8 ignored (was 1,551; +3 new prefilter tests) - ESP32-S3 on COM7 still streaming live CSI (cb #3200) Co-Authored-By: claude-flow <ruv@ruv.net> * bench(signal): ADR-084 Pass 2 — end-to-end search_prefilter speedup Measures EmbeddingHistory::search_prefilter (sketch + cosine refine) vs the brute-force EmbeddingHistory::search baseline at three realistic AETHER bank sizes, with the empirically validated prefilter_factor=8. Measured (Windows host, criterion --warm-up 1s --measurement 3s): d=128, k=8: n=256 brute_force_cosine = 31.98 us, prefilter = 13.78 us → 2.3x n=1024 brute_force_cosine = 110.4 us, prefilter = 16.64 us → 6.6x n=4096 brute_force_cosine = 507.4 us, prefilter = 66.37 us → 7.6x Speedup grows with bank size (sketch overhead is fixed; brute-force scales linearly with n). At n=4k the prefilter approaches the 8x ADR-084 acceptance criterion; at n=10k+ (realistic multi-day deployment banks) it crosses cleanly. Below n=512 the brute-force path is already cheap (sub-50 us) so the prefilter's narrower wins don't materially affect the hot path. Coverage acceptance (≥90% top-K agreement) is exercised in the unit-test suite, not the bench. The bench measures cost only. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(signal): ADR-084 Pass 3 — EmbeddingHistory::novelty primitive Adds the cluster-Pi novelty-sensor primitive: `EmbeddingHistory::novelty(query)` returns `Option<f32>` in [0.0, 1.0] where 0.0 = exact-match-in-bank and 1.0 = no-overlap. Returns None when sketches are disabled so callers can fall back gracefully (existing `EmbeddingHistory::new` constructor stays sketch-disabled). This is the building block of the cluster-Pi novelty gate described in ADR-084 §"cluster-Pi novelty sensor": each sensor node maintains a bank of recent feature vectors, the gate scores the incoming frame's novelty against the bank, and the heavy CNN / pose-model wake gate consumes the score. Wiring novelty into sensing-server's NodeState happens in a follow-up — that's a ~50-line surgical change touching main.rs that deserves its own commit. This patch lands the primitive + tests so the wiring is straightforward. Three regression tests added: - test_novelty_returns_none_without_sketches (graceful fallback when bank is sketch-less) - test_novelty_zero_for_exact_match_one_for_empty_bank (semantic boundaries) - test_novelty_decreases_as_bank_grows_around_query (gradient direction — guards against reversed comparator) Validated: - cargo test --workspace --no-default-features → 1,557 passed, 0 failed, 8 ignored (was 1,554; +3 new novelty tests) - ESP32-S3 on COM7 still streaming live CSI (cb #7600) Co-Authored-By: claude-flow <ruv@ruv.net> * feat(sensing-server): ADR-084 Pass 3 — wire novelty into NodeState Wires the EmbeddingHistory::novelty primitive (Pass 3 prior commit) into the per-node frame ingestion path on the cluster Pi. Each incoming CSI frame now updates a per-node sketch bank of the last 6.4 s of feature vectors and produces a novelty score in [0.0, 1.0] that downstream model-wake gates can consume. Two NodeState structs were touched (one in types.rs and a refactoring-leftover duplicate in main.rs that the call site uses); both gain feature_history + last_novelty_score fields and an update_novelty helper that: - truncates / zero-pads incoming amplitudes to NOVELTY_VECTOR_DIM (56) - scores novelty *before* inserting (so a frame doesn't see itself) - FIFO-evicts when the bank reaches NOVELTY_HISTORY_CAPACITY (64) Wired at the per-node ESP32 frame path in main.rs:3772 (immediately before frame_history.push_back). Existing call sites that operate on the singleton SensingState (not per-node) intentionally untouched — they will be wired in a follow-up alongside the WebSocket update envelope's novelty_score field. Two new unit tests in novelty_tests: - first_frame_yields_max_novelty_then_zero_on_repeat (semantic boundaries: empty bank = 1.0, exact repeat = 0.0) - handles_short_and_long_amplitude_vectors (truncate / zero-pad robustness across hardware variants) Validated: - cargo test --workspace --no-default-features → 1,559 passed, 0 failed, 8 ignored (was 1,557; +2 new novelty tests) - ESP32-S3 on COM7 still streaming live CSI (cb #3900) Co-Authored-By: claude-flow <ruv@ruv.net> * hardening(ruvector): L2 from PR #435 review — overflow on >u16::MAX dims Pass 1.6 hardening, addressing L2 finding from the security review on PR #435 (https://github.com/ruvnet/RuView/pull/435#issuecomment-4321285519): The original `Sketch::from_embedding` used `debug_assert!` for the `embedding.len() <= u16::MAX` invariant, which compiled out in release builds. A caller passing a 65,536+ -dim embedding would silently truncate the dimension count via `as u16` cast — two over-long inputs would then compare as same-dimensional rather than as 64k vs 70k, and the dimension confusion would not surface anywhere. Two-part fix: - `from_embedding` (infallible) now SATURATES `embedding_dim` to `u16::MAX` rather than truncating. Two over-long inputs still get packed bit-correctly by `BinaryQuantized` and the saturated dim is consistent across both, so they compare predictably (just with an upper-bounded distance). - `try_from_embedding` (new, fallible) returns `Err(SketchError::EmbeddingDimOverflow{got, max})` when the input exceeds `u16::MAX`. Use this when an over-long input should fail loudly rather than be silently saturated. - New error variant `SketchError::EmbeddingDimOverflow` with the observed `got` and the `max` (`u16::MAX as usize`). - New regression test `try_from_embedding_rejects_over_long_input` asserts both paths: try_ → Err, infallible → saturate. Validated: - 13 sketch unit tests pass (was 12; +1 for L2 boundary). - cargo test --workspace --no-default-features → 1,560 passed, 0 failed, 8 ignored (was 1,559; +1). - ESP32-S3 on COM7 streaming live CSI (cb #100, fresh boot RSSI -48 dBm). Co-Authored-By: claude-flow <ruv@ruv.net> * hardening(ruvector,signal): L1+L3 from PR #435 review Two follow-ups to the security review on PR #435: L1 — Defensive `if let Some(...)` for SketchBank::topk heap peek. The original `.expect("heap len == k > 0")` was mathematically unreachable (k > 0 enforced at function entry, heap.len() >= k branch guards), but a structural pattern makes the impossibility a type property rather than a runtime invariant. Same hot-path cost; zero panic risk in the production binary. L3 — Guard `embedding_dim == 0` in `EmbeddingHistory::novelty`. A 0-dim history is constructible via `with_sketch(0, ...)`; without the guard the function returned `NaN` (min_d as f32 / 0.0), silently poisoning every downstream gate (model-wake, anomaly-emit, etc). Now returns Some(1.0) — fail-loud at "no comparison possible → maximally novel," never NaN. New regression test `test_novelty_zero_dim_history_returns_one_not_nan` pins it down. Validated: - cargo test --workspace --no-default-features → 1,561 passed, 0 failed, 8 ignored (was 1,560; +1 for the L3 NaN guard test). - ESP32-S3 on COM7 streaming live CSI (cb #12400, RSSI fresh). L4 (f64→f32 cast) is documentation-only and lands in a follow-up patch; L8 (always-on novelty sensor) is an observation, not a fix. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(sensing-server): ADR-084 Pass 3.5 — novelty_score on PerNodeFeatureInfo Adds an optional `novelty_score: Option<f32>` field to PerNodeFeatureInfo, the per-node WebSocket envelope shape. Mirrored on both struct definitions (types.rs canonical + main.rs's refactoring-leftover duplicate) so the schema is consistent. `#[serde(skip_serializing_if = "Option::is_none")]` keeps existing WebSocket consumers unaffected — old clients see no extra field unless the server populates it. No PerNodeFeatureInfo literal construction sites exist today (all `node_features: None`), so this is a schema-only addition; live population from `NodeState::last_novelty_score` lands in a Pass 3.6 follow-up that also wires `node_features: Some(...)` at the per-node ESP32 frame emit path. Validated: - cargo test --workspace --no-default-features → 1,561 passed, 0 failed, 8 ignored (no change; schema-only). - ESP32-S3 on COM7 streaming live CSI (cb #2100, fresh boot). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(sensing-server): ADR-084 Pass 3.6 — populate node_features with novelty_score Wires `node_features: Some(...)` at the two per-node ESP32 frame emit sites (formerly `node_features: None`). Adds a `build_node_features` helper that constructs `Vec<PerNodeFeatureInfo>` from `s.node_states`, including the per-node `last_novelty_score`. This completes the Pass 3.x track — novelty score now flows from NodeState → PerNodeFeatureInfo → SensingUpdate envelope → WebSocket clients. Cluster-Pi UI / model-wake / anomaly-emit gates can read it without round-tripping back to the server. Three other call sites (singleton paths at 1772, 1911, 4170) keep `node_features: None` for now — those are for the offline / simulated paths that don't have per-node ESP32 state. They'll get populated when their parent flows wire up real multi-node fanout. Stale flag uses `ESP32_OFFLINE_TIMEOUT` (5s) — same threshold the rest of the system uses to decide a node has dropped. Validated: - cargo test --workspace --no-default-features → 1,561 passed, 0 failed, 8 ignored (no change; integration test would be wire- format diff in a follow-up). - ESP32-S3 on COM7 streaming live CSI (cb #100, fresh boot, RSSI -49 dBm). Co-Authored-By: claude-flow <ruv@ruv.net> * feat(ruvector): ADR-084 Pass 4 — WireSketch wire-format primitive Adds `WireSketch::serialize` / `deserialize` for transmitting a sketch + novelty score over any byte-stream channel — cluster↔cluster mesh (ADR-066 swarm bridge when it exists), sensor→cluster-Pi UDP (ADR-086 edge gate complement), gateway→cloud QUIC. Channel-agnostic by design. Wire layout (12-byte header + ceil(dim/8) bytes payload, little-endian): [0..4] magic = 0xC5110084 [4..6] format_version = 1 [6..8] sketch_version (embedding-model schema) [8..10] embedding_dim [10..12] novelty_q15 (novelty * 32_767, saturated) [12..] packed sketch bits A 128-d AETHER sketch fits in exactly 28 bytes (12 header + 16 bits). Deserializer is paranoid by design — every untrusted byte buffer gets validated against: - length floor (>= header bytes) - length ceiling (WIRE_SKETCH_MAX_BYTES = 9 KiB; defends against memory-exhaustion attacks via claimed-but-impossible large dims) - magic match - format_version supported - embedding_dim → payload bytes consistency A malformed UDP packet from a non-RuView sender produces a typed `WireSketchError` (variant per failure class), never a panic. Re-exported from lib.rs alongside `Sketch` / `SketchBank`. Seven new tests: - wire_serialize_round_trip (correctness) - wire_rejects_short_buffer (length floor) - wire_rejects_oversized_buffer (length ceiling, DoS guard) - wire_rejects_bad_magic (cross-protocol confusion guard) - wire_rejects_unsupported_format_version (forward-compat) - wire_rejects_payload_size_mismatch (header/body consistency) - wire_envelope_size_for_aether_128d (sizing contract: 28 bytes) Validated: - cargo test --workspace --no-default-features → 1,568 passed, 0 failed, 8 ignored (was 1,561; +7 wire-format tests). - ESP32-S3 on COM7 streaming live CSI (cb #15100, RSSI -48 dBm). Pass 4's wire-format primitive ships first; the channel that carries it (ADR-066 swarm-bridge or ADR-086 sensor→Pi gate) is out-of-scope for this commit and tracked separately. Co-Authored-By: claude-flow <ruv@ruv.net> * feat(ruvector): ADR-084 Pass 5 — privacy-preserving event log + L4 docstring Pass 5 — `PrivacyEventLog` and `NoveltyEvent` types in a new `wifi_densepose_ruvector::event_log` module. Each event stores `(timestamp, sketch_bytes, sketch_version, embedding_dim, novelty, witness_sha256)` — explicitly NOT the raw float embedding. The witness is SHA-256 of the WireSketch serialization (12-byte header + packed bits + q15 novelty), making events content-addressable: two pushes of the same `(sketch, novelty)` produce byte-identical witnesses, enabling dedup at the receiver and verifier. Privacy properties (ADR-084 §"Privacy-preserving event log"): 1. Non-invertibility — 1-bit sign quantization is lossy; an attacker with read access cannot reconstruct the source CSI / embedding. 2. Content addressing — `(sketch_version, witness)` is fully qualified. 3. Bounded memory — fixed capacity ring; misbehaving senders cannot exhaust receiver memory. Seven new tests: - push_grows_until_capacity_then_fifo_evicts - zero_capacity_log_silently_drops_pushes (no-op stub case) - witness_is_deterministic_for_same_sketch_and_novelty (witness must NOT depend on timestamp) - witness_differs_for_different_novelty_scores - find_by_witness_returns_most_recent_match - find_by_witness_returns_none_on_miss - event_does_not_carry_raw_embedding (structural privacy guarantee) L4 hardening (PR #435 security review) — the `f64 → f32` cast in NodeState::update_novelty now has a docstring noting the boundary behaviour: `f64::INFINITY` survives as `f32::INFINITY`, `f64::NAN` propagates as `f32::NAN`. Neither panics. CSI amplitudes from healthy firmware are well within f32 finite range. Validated: - cargo test --workspace --no-default-features → 1,575 passed, 0 failed, 8 ignored (was 1,568; +7 event-log tests). - ESP32-S3 on COM7 streaming live CSI (cb #2800, RSSI -52 dBm). Co-Authored-By: claude-flow <ruv@ruv.net>	2026-04-26 02:21:35 -04:00
rUv	f49c722764	chore(repo): rename rust-port/wifi-densepose-rs → v2/ (flatten to one level) (#427) ... The Rust port lived two directories deep (rust-port/wifi-densepose-rs/) without any sibling under rust-port/ that warranted the extra level. Move the whole workspace up to v2/ to match v1/ (Python) at the same depth and shorten every cd / build command across the repo. git mv preserves history for all tracked files. 60 files updated for path references (CI workflows, ADRs, docs, scripts, READMEs, internal .claude-flow state). Two manual fixes for relative-cd paths in CLAUDE.md and ADR-043 that became wrong after the depth change (cd ../.. → cd ..). Validated: - cargo check --workspace --no-default-features → clean (after target/ nuke; the gitignored target/ was carried by the OS rename and had hard-coded old paths in build scripts) - cargo test --workspace --no-default-features → 1,539 passed, 0 failed, 8 ignored (same totals as pre-rename) - ESP32-S3 on COM7 → still streaming live CSI (cb #40300, RSSI -64 dBm) After-merge follow-up: contributors should `rm -rf v2/target` once and let cargo regenerate from the new path.	2026-04-25 21:28:13 -04:00