chore: update vendor submodules to latest upstream

.claude/settings.json

@@ -126,7 +126,10 @@
       "Bash(node .claude/*)",
       "mcp__claude-flow__:*"
     ],
-    "deny": []
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)"
+    ]
   },
   "attribution": {
     "commit": "Co-Authored-By: claude-flow <ruv@ruv.net>",

.github/workflows/sensing-server-docker.yml

@@ -26,8 +26,6 @@ on:
       - 'v2/crates/wifi-densepose-signal/**'
       - 'v2/crates/wifi-densepose-vitals/**'
       - 'v2/crates/wifi-densepose-wifiscan/**'
-      - 'v2/crates/wifi-densepose-bfld/**'
-      - 'v2/crates/cog-ha-matter/**'
       - 'v2/Cargo.toml'
       - 'v2/Cargo.lock'
       - 'ui/**'
@@ -61,16 +59,11 @@ jobs:
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        # Bypassing docker/login-action@v3: the action kept emitting
-        # "malformed HTTP Authorization header" against a known-good
-        # dckr_pat_* token (verified by direct curl against the Hub API).
-        # `docker login --password-stdin` is the documented credential
-        # path and avoids whatever encoding step the action injects.
-        env:
-          DH_USER: ${{ secrets.DOCKERHUB_USERNAME }}
-          DH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
-        run: |
-          printf '%s' "$DH_TOKEN" | docker login docker.io -u "$DH_USER" --password-stdin
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log in to ghcr.io
         uses: docker/login-action@v3

docker/Dockerfile.rust

@@ -14,14 +14,9 @@ COPY v2/crates/ ./crates/
 # Copy vendored RuVector crates
 COPY vendor/ruvector/ /build/vendor/ruvector/
 
-# Build release binaries:
-#   - sensing-server with `mqtt` feature so the HA-DISCO MQTT publisher
-#     (ADR-115) is wired in (auto-discovery topics flow to Home Assistant)
-#   - cog-ha-matter, the ADR-116 Cognitum cog that wraps HA-DISCO +
-#     HA-MIND + mDNS + embedded broker for Home Assistant / Matter
-RUN cargo build --release -p wifi-densepose-sensing-server --features mqtt 2>&1 \
- && cargo build --release -p cog-ha-matter 2>&1 \
- && strip target/release/sensing-server target/release/cog-ha-matter
+# Build release binary
+RUN cargo build --release -p wifi-densepose-sensing-server 2>&1 \
+    && strip target/release/sensing-server
 
 # Stage 2: Runtime
 FROM debian:bookworm-slim
@@ -32,9 +27,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-# Copy binaries
+# Copy binary
 COPY --from=builder /build/target/release/sensing-server /app/sensing-server
-COPY --from=builder /build/target/release/cog-ha-matter /app/cog-ha-matter
 
 # Copy UI assets
 COPY ui/ /app/ui/
@@ -51,7 +45,6 @@ RUN set -e; \
         test -d "$d" || { echo "FATAL: missing UI directory $d"; exit 1; }; \
     done; \
     test -x /app/sensing-server || { echo "FATAL: /app/sensing-server is not executable"; exit 1; }; \
-    test -x /app/cog-ha-matter || { echo "FATAL: /app/cog-ha-matter is not executable"; exit 1; }; \
     echo "image assets OK"
 
 # Optional bearer-token auth on /api/v1/*: leave unset for LAN-mode (default),
@@ -65,8 +58,6 @@ EXPOSE 3000
 EXPOSE 3001
 # ESP32 UDP
 EXPOSE 5005/udp
-# MQTT broker (cog-ha-matter embedded broker — Home Assistant + Matter)
-EXPOSE 1883
 
 ENV RUST_LOG=info
 

docker/docker-entrypoint.sh

@@ -15,21 +15,6 @@
 #   MODELS_DIR   — directory to scan for .rvf model files (default: data/models)
 set -e
 
-# Route to cog-ha-matter (ADR-116) when invoked as:
-#   docker run <image> cog-ha-matter [--flags]
-# or via the short alias `ha-matter`. Strips the keyword and execs the
-# Home Assistant + Matter cog binary, defaulting --sensing-url to the
-# co-located sensing-server endpoint so docker-compose deployments work
-# out of the box.
-case "${1:-}" in
-    cog-ha-matter|ha-matter)
-        shift
-        exec /app/cog-ha-matter \
-            --sensing-url "${SENSING_URL:-http://127.0.0.1:3000}" \
-            "$@"
-        ;;
-esac
-
 # If the first argument looks like a flag (starts with -), prepend the
 # server binary so users can just pass flags:
 #   docker run <image> --source esp32 --tick-ms 500

plugins/ruview/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruview",
   "description": "End-to-end RuView (WiFi-DensePose) toolkit for Claude Code: onboarding, ESP32 hardware setup, configuration, sensing applications, model training, advanced multistatic sensing, witness verification, BFLD privacy layer, and rvAgent + RVF agentic flows — from practical to advanced.",
-  "version": "0.3.0",
+  "version": "0.2.0",
   "author": {
     "name": "ruvnet",
     "url": "https://github.com/ruvnet/RuView"
@@ -19,14 +19,5 @@
     "edge-ai",
     "model-training",
     "onboarding"
-  ],
-  "mcpServers": {
-    "rvagent": {
-      "command": "npx",
-      "args": ["-y", "@ruvnet/rvagent"],
-      "env": {
-        "RVAGENT_SENSING_URL": "http://localhost:3000"
-      }
-    }
-  }
+  ]
 }

plugins/ruview/codex/prompts/ruview-rvagent.md

@@ -2,24 +2,6 @@
 
 You are helping the operator explore or prototype the integration of `vendor/ruvector/crates/rvAgent/` (a production Rust AI-agent framework) with RuView's existing sensing pipeline (`v2/crates/wifi-densepose-*`) and the RVF cognitive container format (`v2/crates/wifi-densepose-sensing-server/src/rvf_container.rs`).
 
-## Live MCP server: `@ruvnet/rvagent` v0.1.0
-
-The TypeScript MCP server (`tools/ruview-mcp/`, published as `@ruvnet/rvagent`) is live on npm and exposes `bfld_last_scan`, `bfld_subscribe`, `presence_now`, `vitals_get_breathing`, `vitals_get_heart_rate`, `vitals_get_all`, `vitals_fetch`. Add to a Codex MCP config:
-
-```json
-{
-  "mcpServers": {
-    "rvagent": {
-      "command": "npx",
-      "args": ["-y", "@ruvnet/rvagent"],
-      "env": { "RVAGENT_SENSING_URL": "http://localhost:3000" }
-    }
-  }
-}
-```
-
-This is the operator-facing tool surface; the Rust crate below remains the substrate for deeper RVF-aware agentic flows.
-
 ## Trigger phrasing
 
 - "wire rvAgent into RuView"

plugins/ruview/skills/ruview-rvagent/SKILL.md

@@ -7,24 +7,6 @@ description: Explore and prototype rvAgent + RVF integration for RuView agentic
 
 Surface area for wiring `vendor/ruvector/crates/rvAgent/` into RuView so the existing sensing pipeline becomes the substrate an agentic flow can read, reason about, and respond to.
 
-## Quickstart — published MCP server (`@ruvnet/rvagent` v0.1.0)
-
-Installing this plugin registers `@ruvnet/rvagent` as an MCP server. On activation, Claude Code spawns `npx -y @ruvnet/rvagent` and exposes its tools directly:
-
-| Tool | Purpose |
-|------|---------|
-| `bfld_last_scan` | Most recent BFLD event from the sensing server |
-| `bfld_subscribe` | Stream BFLD events for a window |
-| `presence_now` | Current room-level presence state |
-| `vitals_get_breathing` | Latest breathing-rate sample |
-| `vitals_get_heart_rate` | Latest heart-rate sample |
-| `vitals_get_all` | Composite vitals snapshot |
-| `vitals_fetch` | Historical vitals window |
-
-Override the sensing-server URL via the `RVAGENT_SENSING_URL` env var (default `http://localhost:3000`). Source lives at `tools/ruview-mcp/`; ADR-124 captures the design.
-
-Smoke-check the wiring: `npm view @ruvnet/rvagent version` should return `0.1.0` (or newer).
-
 ## When to use this skill
 
 - "I want an agent that reacts to BFLD presence in the kitchen and pages the carer."

scripts/rotate-npm-token.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-#
-# rotate-npm-token.sh — push NPM_TOKEN from .env into GCP Secret Manager
-# and (optionally) publish @ruvnet/rvagent.
-#
-# Usage:
-#   bash scripts/rotate-npm-token.sh             # rotate only
-#   bash scripts/rotate-npm-token.sh --publish   # rotate + npm publish
-#
-# Env overrides:
-#   GCP_PROJECT          (default: cognitum-20260110)
-#   NPM_TOKEN_SECRET     (default: NPM_TOKEN)
-#   ENV_FILE             (default: <repo-root>/.env)
-#   PUBLISH_PACKAGE_DIR  (default: <repo-root>/tools/ruview-mcp)
-
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-ENV_FILE="${ENV_FILE:-$REPO_ROOT/.env}"
-PROJECT="${GCP_PROJECT:-cognitum-20260110}"
-SECRET="${NPM_TOKEN_SECRET:-NPM_TOKEN}"
-PKG_DIR="${PUBLISH_PACKAGE_DIR:-$REPO_ROOT/tools/ruview-mcp}"
-
-[ -f "$ENV_FILE" ] || { echo "ERROR: .env not found at $ENV_FILE" >&2; exit 1; }
-
-TOKEN="$(awk -F= '
-  /^[[:space:]]*NPM_TOKEN[[:space:]]*=/ {
-    sub(/^[^=]*=[[:space:]]*/, "", $0)
-    sub(/^["'\'']/, "", $0)
-    sub(/["'\''][[:space:]]*$/, "", $0)
-    sub(/[[:space:]]+$/, "", $0)
-    print
-    exit
-  }
-' "$ENV_FILE")"
-
-if [ -z "${TOKEN:-}" ]; then
-  echo "ERROR: NPM_TOKEN not found in $ENV_FILE" >&2
-  exit 1
-fi
-
-LEN=${#TOKEN}
-echo "Found NPM_TOKEN in .env (length=$LEN)"
-
-echo "Pushing new version to gcloud secret '$SECRET' in project '$PROJECT'..."
-if ! gcloud secrets describe "$SECRET" --project="$PROJECT" >/dev/null 2>&1; then
-  echo "Secret '$SECRET' not found; creating..."
-  printf '%s' "$TOKEN" | gcloud secrets create "$SECRET" \
-    --project="$PROJECT" --replication-policy=automatic --data-file=-
-else
-  printf '%s' "$TOKEN" | gcloud secrets versions add "$SECRET" \
-    --project="$PROJECT" --data-file=-
-fi
-
-echo "Verifying secret round-trips..."
-RETRIEVED="$(gcloud secrets versions access latest --secret="$SECRET" --project="$PROJECT")"
-if [ "$RETRIEVED" != "$TOKEN" ]; then
-  echo "ERROR: retrieved token does not match the value written to .env" >&2
-  exit 1
-fi
-echo "OK — secret '$SECRET' updated and verified (length=${#RETRIEVED})."
-
-if [ "${1:-}" = "--publish" ]; then
-  [ -d "$PKG_DIR" ] || { echo "ERROR: package dir not found at $PKG_DIR" >&2; exit 1; }
-  echo "Publishing @ruvnet/rvagent from $PKG_DIR..."
-  (
-    cd "$PKG_DIR"
-    if [ -f package.json ] && grep -q '"build"' package.json; then
-      npm run build
-    fi
-    NODE_AUTH_TOKEN="$RETRIEVED" npm publish --access public
-  )
-fi
-
-echo "Done."

v2/crates/cog-ha-matter/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: Home Assistant + Matter integration for the Seed (ADR-116). Wraps ADR-115's HA-DISCO + HA-MIND publisher as a Seed-installable artifact with mDNS, embedded broker, RuVector-backed thresholds, and Ed25519 witness."
+publish = false
 
 [[bin]]
 name = "cog-ha-matter"
@@ -29,7 +30,7 @@ tokio = { workspace = true, features = ["full"] }
 
 # ADR-115 publisher is the heart of this cog — we wrap it.
 # default-features = false matches the sensing-server's pattern.
-wifi-densepose-sensing-server = { version = "0.3.1", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
+wifi-densepose-sensing-server = { version = "0.3.0", path = "../wifi-densepose-sensing-server", default-features = false, features = ["mqtt"] }
 
 # Hardware crate for SyncPacket + NodeState bridging (ADR-110 substrate).
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/cog-person-count/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: learned multi-person counter from WiFi CSI (ADR-103). Replaces the PR #491 slot heuristic with a Candle-based count head + Stoer-Wagner multi-node fusion."
+publish = false
 
 [[bin]]
 name = "cog-person-count"

v2/crates/cog-pose-estimation/Cargo.toml

@@ -6,6 +6,7 @@ authors.workspace = true
 license.workspace = true
 repository.workspace = true
 description = "Cognitum Cog: 17-keypoint pose estimation from WiFi CSI. See ADR-100 (packaging) + ADR-101 (this Cog)."
+publish = false
 
 [[bin]]
 name = "cog-pose-estimation"
@@ -35,7 +36,7 @@ candle-nn = { version = "0.9", default-features = false }
 safetensors = "0.4"
 # wifi-densepose-train re-exports the model types we need; depend by path
 # inside the workspace.
-wifi-densepose-train = { version = "0.3.1", path = "../wifi-densepose-train", default-features = false }
+wifi-densepose-train = { path = "../wifi-densepose-train", default-features = false }
 
 [dev-dependencies]
 tempfile = "3"

v2/crates/wifi-densepose-sensing-server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-sensing-server"
-version = "0.3.1"
+version.workspace = true
 edition.workspace = true
 description = "Lightweight Axum server for WiFi sensing UI with RuVector signal processing"
 license.workspace = true
@@ -48,7 +48,7 @@ wifi-densepose-wifiscan = { version = "0.3.0", path = "../wifi-densepose-wifisca
 # default-features = false drops the optional ndarray-linalg/BLAS chain so that
 # `--no-default-features` at the workspace root can produce a Windows-friendly
 # build without vcpkg/openblas (issue #366, #415).
-wifi-densepose-signal = { version = "0.3.1", path = "../wifi-densepose-signal", default-features = false }
+wifi-densepose-signal = { version = "0.3.0", path = "../wifi-densepose-signal", default-features = false }
 
 # Hardware crate — SyncPacket decoder for ADR-110 §A0.12 mesh-aligned timestamps.
 wifi-densepose-hardware = { version = "0.3.0", path = "../wifi-densepose-hardware" }

v2/crates/wifi-densepose-signal/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "wifi-densepose-signal"
-version = "0.3.1"
+version.workspace = true
 edition.workspace = true
 description = "WiFi CSI signal processing for DensePose estimation"
 license.workspace = true