chore: update vendor submodules to latest upstream

.claude/settings.json

@@ -126,7 +126,10 @@
       "Bash(node .claude/*)",
       "mcp__claude-flow__:*"
     ],
-    "deny": []
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)"
+    ]
   },
   "attribution": {
     "commit": "Co-Authored-By: claude-flow <ruv@ruv.net>",

plugins/ruview/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruview",
   "description": "End-to-end RuView (WiFi-DensePose) toolkit for Claude Code: onboarding, ESP32 hardware setup, configuration, sensing applications, model training, advanced multistatic sensing, witness verification, BFLD privacy layer, and rvAgent + RVF agentic flows — from practical to advanced.",
-  "version": "0.3.0",
+  "version": "0.2.0",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet/RuView"
@@ -19,14 +19,5 @@
     "edge-ai",
     "model-training",
     "onboarding"
-  ],
-  "mcpServers": {
-    "rvagent": {
-      "command": "npx",
-      "args": ["-y", "@ruvnet/rvagent"],
-      "env": {
-        "RVAGENT_SENSING_URL": "http://localhost:3000"
-      }
-    }
-  }
+  ]
 }

plugins/ruview/codex/prompts/ruview-rvagent.md

@@ -2,24 +2,6 @@
 
 You are helping the operator explore or prototype the integration of `vendor/ruvector/crates/rvAgent/` (a production Rust AI-agent framework) with RuView's existing sensing pipeline (`v2/crates/wifi-densepose-*`) and the RVF cognitive container format (`v2/crates/wifi-densepose-sensing-server/src/rvf_container.rs`).
 
-## Live MCP server: `@ruvnet/rvagent` v0.1.0
-
-The TypeScript MCP server (`tools/ruview-mcp/`, published as `@ruvnet/rvagent`) is live on npm and exposes `bfld_last_scan`, `bfld_subscribe`, `presence_now`, `vitals_get_breathing`, `vitals_get_heart_rate`, `vitals_get_all`, `vitals_fetch`. Add to a Codex MCP config:
-
-```json
-{
-  "mcpServers": {
-    "rvagent": {
-      "command": "npx",
-      "args": ["-y", "@ruvnet/rvagent"],
-      "env": { "RVAGENT_SENSING_URL": "http://localhost:3000" }
-    }
-  }
-}
-```
-
-This is the operator-facing tool surface; the Rust crate below remains the substrate for deeper RVF-aware agentic flows.
-
 ## Trigger phrasing
 
 - "wire rvAgent into RuView"

plugins/ruview/skills/ruview-rvagent/SKILL.md

@@ -7,24 +7,6 @@ description: Explore and prototype rvAgent + RVF integration for RuView agentic
 
 Surface area for wiring `vendor/ruvector/crates/rvAgent/` into RuView so the existing sensing pipeline becomes the substrate an agentic flow can read, reason about, and respond to.
 
-## Quickstart — published MCP server (`@ruvnet/rvagent` v0.1.0)
-
-Installing this plugin registers `@ruvnet/rvagent` as an MCP server. On activation, Claude Code spawns `npx -y @ruvnet/rvagent` and exposes its tools directly:
-
-| Tool | Purpose |
-|------|---------|
-| `bfld_last_scan` | Most recent BFLD event from the sensing server |
-| `bfld_subscribe` | Stream BFLD events for a window |
-| `presence_now` | Current room-level presence state |
-| `vitals_get_breathing` | Latest breathing-rate sample |
-| `vitals_get_heart_rate` | Latest heart-rate sample |
-| `vitals_get_all` | Composite vitals snapshot |
-| `vitals_fetch` | Historical vitals window |
-
-Override the sensing-server URL via the `RVAGENT_SENSING_URL` env var (default `http://localhost:3000`). Source lives at `tools/ruview-mcp/`; ADR-124 captures the design.
-
-Smoke-check the wiring: `npm view @ruvnet/rvagent version` should return `0.1.0` (or newer).
-
 ## When to use this skill
 
 - "I want an agent that reacts to BFLD presence in the kitchen and pages the carer."

scripts/rotate-npm-token.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-#
-# rotate-npm-token.sh — push NPM_TOKEN from .env into GCP Secret Manager
-# and (optionally) publish @ruvnet/rvagent.
-#
-# Usage:
-#   bash scripts/rotate-npm-token.sh             # rotate only
-#   bash scripts/rotate-npm-token.sh --publish   # rotate + npm publish
-#
-# Env overrides:
-#   GCP_PROJECT          (default: cognitum-20260110)
-#   NPM_TOKEN_SECRET     (default: NPM_TOKEN)
-#   ENV_FILE             (default: <repo-root>/.env)
-#   PUBLISH_PACKAGE_DIR  (default: <repo-root>/tools/ruview-mcp)
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-ENV_FILE="${ENV_FILE:-$REPO_ROOT/.env}"
-PROJECT="${GCP_PROJECT:-cognitum-20260110}"
-SECRET="${NPM_TOKEN_SECRET:-NPM_TOKEN}"
-PKG_DIR="${PUBLISH_PACKAGE_DIR:-$REPO_ROOT/tools/ruview-mcp}"
-
-[ -f "$ENV_FILE" ] || { echo "ERROR: .env not found at $ENV_FILE" >&2; exit 1; }
-
-TOKEN="$(awk -F= '
-  /^[[:space:]]*NPM_TOKEN[[:space:]]*=/ {
-    sub(/^[^=]*=[[:space:]]*/, "", $0)
-    sub(/^["'\'']/, "", $0)
-    sub(/["'\''][[:space:]]*$/, "", $0)
-    sub(/[[:space:]]+$/, "", $0)
-    print
-    exit
-  }
-' "$ENV_FILE")"
-
-if [ -z "${TOKEN:-}" ]; then
-  echo "ERROR: NPM_TOKEN not found in $ENV_FILE" >&2
-  exit 1
-fi
-
-LEN=${#TOKEN}
-echo "Found NPM_TOKEN in .env (length=$LEN)"
-
-echo "Pushing new version to gcloud secret '$SECRET' in project '$PROJECT'..."
-if ! gcloud secrets describe "$SECRET" --project="$PROJECT" >/dev/null 2>&1; then
-  echo "Secret '$SECRET' not found; creating..."
-  printf '%s' "$TOKEN" | gcloud secrets create "$SECRET" \
-    --project="$PROJECT" --replication-policy=automatic --data-file=-
-else
-  printf '%s' "$TOKEN" | gcloud secrets versions add "$SECRET" \
-    --project="$PROJECT" --data-file=-
-fi
-
-echo "Verifying secret round-trips..."
-RETRIEVED="$(gcloud secrets versions access latest --secret="$SECRET" --project="$PROJECT")"
-if [ "$RETRIEVED" != "$TOKEN" ]; then
-  echo "ERROR: retrieved token does not match the value written to .env" >&2
-  exit 1
-fi
-echo "OK — secret '$SECRET' updated and verified (length=${#RETRIEVED})."
-
-if [ "${1:-}" = "--publish" ]; then
-  [ -d "$PKG_DIR" ] || { echo "ERROR: package dir not found at $PKG_DIR" >&2; exit 1; }
-  echo "Publishing @ruvnet/rvagent from $PKG_DIR..."
-  (
-    cd "$PKG_DIR"
-    if [ -f package.json ] && grep -q '"build"' package.json; then
-      npm run build
-    fi
-    NODE_AUTH_TOKEN="$RETRIEVED" npm publish --access public
-  )
-fi
-
-echo "Done."

v2/crates/cog-ha-matter/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: Home Assistant + Matter integration for the Seed (ADR-116). Wraps ADR-115's HA-DISCO + HA-MIND publisher as a Seed-installable artifact with mDNS, embedded broker, RuVector-backed thresholds, and Ed25519 witness."
+publish = false
 
 [[bin]]
 name = "cog-ha-matter"
@@ -29,7 +30,7 @@ tokio = { workspace = true, features = ["full"] }
 
 # ADR-115 publisher is the heart of this cog — we wrap it.
 # default-features = false matches the sensing-server's pattern.
-wifi-densepose-sensing-server = { version = "0.3.1", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
+wifi-densepose-sensing-server = { version = "0.3.0", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
 
 # Hardware crate for SyncPacket + NodeState bridging (ADR-110 substrate).
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/cog-person-count/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: learned multi-person counter from WiFi CSI (ADR-103). Replaces the PR #491 slot heuristic with a Candle-based count head + Stoer-Wagner multi-node fusion."
+publish = false
 
 [[bin]]
 name = "cog-person-count"

v2/crates/cog-pose-estimation/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: 17-keypoint pose estimation from WiFi CSI. See ADR-100 (packaging) + ADR-101 (this Cog)."
+publish = false
 
 [[bin]]
 name = "cog-pose-estimation"
@@ -35,7 +36,7 @@ candle-nn = { version = "0.9", default-features = false }
 safetensors = "0.4"
 # wifi-densepose-train re-exports the model types we need; depend by path
 # inside the workspace.
-wifi-densepose-train = { version = "0.3.1", path = "../wifi-densepose-train", default-features = false }
+wifi-densepose-train = { path = "../wifi-densepose-train", default-features = false }
 
 [dev-dependencies]
 tempfile = "3"

v2/crates/wifi-densepose-sensing-server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-sensing-server"
-version = "0.3.1"
+version.workspace = true
 edition.workspace = true
 description = "Lightweight Axum server for WiFi sensing UI with RuVector signal processing"
 license.workspace = true
@@ -48,7 +48,7 @@ wifi-densepose-wifiscan = { version = "0.3.0", path = "../wifi-densepose-wifisca
 # default-features = false drops the optional ndarray-linalg/BLAS chain so that
 # `--no-default-features` at the workspace root can produce a Windows-friendly
 # build without vcpkg/openblas (issue #366, #415).
-wifi-densepose-signal = { version = "0.3.1", path = "../wifi-densepose-signal", default-features = false }
+wifi-densepose-signal = { version = "0.3.0", path = "../wifi-densepose-signal", default-features = false }
 
 # Hardware crate — SyncPacket decoder for ADR-110 §A0.12 mesh-aligned timestamps.
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/wifi-densepose-signal/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-signal"
-version = "0.3.1"
+version.workspace = true
 edition.workspace = true
 description = "WiFi CSI signal processing for DensePose estimation"
 license.workspace = true