fix(ci): use docker login --password-stdin (bypass login-action@v3)

docker/login-action@v3 kept emitting "malformed HTTP Authorization
header" against a fresh, known-good dckr_pat_* token (verified by
direct curl against hub.docker.com/v2/users/login). Replacing with
`docker login --password-stdin` — Docker's documented credential
ingestion path — sidesteps whatever encoding the action injects.

Refs #794.

Co-Authored-By: claude-flow <ruv@ruv.net>

.github/workflows/sensing-server-docker.yml

@@ -26,6 +26,8 @@ on:
       - 'v2/crates/wifi-densepose-signal/**'
       - 'v2/crates/wifi-densepose-vitals/**'
       - 'v2/crates/wifi-densepose-wifiscan/**'
+      - 'v2/crates/wifi-densepose-bfld/**'
+      - 'v2/crates/cog-ha-matter/**'
       - 'v2/Cargo.toml'
       - 'v2/Cargo.lock'
       - 'ui/**'
@@ -59,11 +61,16 @@ jobs:
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        # Bypassing docker/login-action@v3: the action kept emitting
+        # "malformed HTTP Authorization header" against a known-good
+        # dckr_pat_* token (verified by direct curl against the Hub API).
+        # `docker login --password-stdin` is the documented credential
+        # path and avoids whatever encoding step the action injects.
+        env:
+          DH_USER: ${{ secrets.DOCKERHUB_USERNAME }}
+          DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          printf '%s' "$DH_TOKEN" | docker login docker.io -u "$DH_USER" --password-stdin
 
       - name: Log in to ghcr.io
         uses: docker/login-action@v3

docker/Dockerfile.rust

@@ -14,9 +14,14 @@ COPY v2/crates/ ./crates/
 # Copy vendored RuVector crates
 COPY vendor/ruvector/ /build/vendor/ruvector/
 
-# Build release binary
-RUN cargo build --release -p wifi-densepose-sensing-server 2>&1 \
-    && strip target/release/sensing-server
+# Build release binaries:
+#   - sensing-server with `mqtt` feature so the HA-DISCO MQTT publisher
+#     (ADR-115) is wired in (auto-discovery topics flow to Home Assistant)
+#   - cog-ha-matter, the ADR-116 Cognitum cog that wraps HA-DISCO +
+#     HA-MIND + mDNS + embedded broker for Home Assistant / Matter
+RUN cargo build --release -p wifi-densepose-sensing-server --features mqtt 2>&1 \
+ && cargo build --release -p cog-ha-matter 2>&1 \
+ && strip target/release/sensing-server target/release/cog-ha-matter
 
 # Stage 2: Runtime
 FROM debian:bookworm-slim
@@ -27,8 +32,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-# Copy binary
+# Copy binaries
 COPY --from=builder /build/target/release/sensing-server /app/sensing-server
+COPY --from=builder /build/target/release/cog-ha-matter /app/cog-ha-matter
 
 # Copy UI assets
 COPY ui/ /app/ui/
@@ -45,6 +51,7 @@ RUN set -e; \
         test -d "$d" || { echo "FATAL: missing UI directory $d"; exit 1; }; \
     done; \
     test -x /app/sensing-server || { echo "FATAL: /app/sensing-server is not executable"; exit 1; }; \
+    test -x /app/cog-ha-matter || { echo "FATAL: /app/cog-ha-matter is not executable"; exit 1; }; \
     echo "image assets OK"
 
 # Optional bearer-token auth on /api/v1/*: leave unset for LAN-mode (default),
@@ -58,6 +65,8 @@ EXPOSE 3000
 EXPOSE 3001
 # ESP32 UDP
 EXPOSE 5005/udp
+# MQTT broker (cog-ha-matter embedded broker — Home Assistant + Matter)
+EXPOSE 1883
 
 ENV RUST_LOG=info
 

docker/docker-entrypoint.sh

@@ -15,6 +15,21 @@
 #   MODELS_DIR   — directory to scan for .rvf model files (default: data/models)
 set -e
 
+# Route to cog-ha-matter (ADR-116) when invoked as:
+#   docker run <image> cog-ha-matter [--flags]
+# or via the short alias `ha-matter`. Strips the keyword and execs the
+# Home Assistant + Matter cog binary, defaulting --sensing-url to the
+# co-located sensing-server endpoint so docker-compose deployments work
+# out of the box.
+case "${1:-}" in
+    cog-ha-matter|ha-matter)
+        shift
+        exec /app/cog-ha-matter \
+            --sensing-url "${SENSING_URL:-http://127.0.0.1:3000}" \
+            "$@"
+        ;;
+esac
+
 # If the first argument looks like a flag (starts with -), prepend the
 # server binary so users can just pass flags:
 #   docker run <image> --source esp32 --tick-ms 500

v2/crates/cog-ha-matter/Cargo.toml

@@ -6,10 +6,6 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: Home Assistant + Matter integration for the Seed (ADR-116). Wraps ADR-115's HA-DISCO + HA-MIND publisher as a Seed-installable artifact with mDNS, embedded broker, RuVector-backed thresholds, and Ed25519 witness."
-# Blocked from crates.io: requires wifi-densepose-sensing-server feature
-# `mqtt` which is not present in the published 0.3.0. Republish sensing-server
-# with the mqtt feature exposed, then drop this flag.
-publish = false
 
 [[bin]]
 name = "cog-ha-matter"
@@ -33,7 +29,7 @@ tokio = { workspace = true, features = ["full"] }
 
 # ADR-115 publisher is the heart of this cog — we wrap it.
 # default-features = false matches the sensing-server's pattern.
-wifi-densepose-sensing-server = { version = "0.3.0", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
+wifi-densepose-sensing-server = { version = "0.3.1", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
 
 # Hardware crate for SyncPacket + NodeState bridging (ADR-110 substrate).
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/wifi-densepose-sensing-server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-sensing-server"
-version.workspace = true
+version = "0.3.1"
 edition.workspace = true
 description = "Lightweight Axum server for WiFi sensing UI with RuVector signal processing"
 license.workspace = true
@@ -48,7 +48,7 @@ wifi-densepose-wifiscan = { version = "0.3.0", path = "../wifi-densepose-wifisca
 # default-features = false drops the optional ndarray-linalg/BLAS chain so that
 # `--no-default-features` at the workspace root can produce a Windows-friendly
 # build without vcpkg/openblas (issue #366, #415).
-wifi-densepose-signal = { version = "0.3.0", path = "../wifi-densepose-signal", default-features = false }
+wifi-densepose-signal = { version = "0.3.1", path = "../wifi-densepose-signal", default-features = false }
 
 # Hardware crate — SyncPacket decoder for ADR-110 §A0.12 mesh-aligned timestamps.
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/wifi-densepose-signal/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-signal"
-version.workspace = true
+version = "0.3.1"
 edition.workspace = true
 description = "WiFi CSI signal processing for DensePose estimation"
 license.workspace = true