Claude
a1a59baf72
One shared representation instead of another isolated RF classifier: new v2 leaf crate ruview-unified implementing all five ADR-273 pillars, plus six ADRs with measured, grade-labeled results. - Canonical RfTensor + fail-closed hardware adapter registry (802.11 CSI via wifi-densepose-core::CsiFrame, FMCW radar cubes, UWB CIR, 5G SRS); shared layout/gain/phase normalization proven by tests (ADR-274). - Universal RF foundation encoder: CFO-aligned, median-scaled tokenizer; masked-reconstruction pretraining with hand-derived backprop verified against central finite differences (max rel err 1.31e-5 over all 12 parameter groups); fusion contract z = Enc ⊙ σ(AgeEnc) + GeomEnc; task adapters under the 1% budget (129/268/387/2 params vs 40,856 backbone), enforced by test. - RF-aware Gaussian spatial memory: anisotropic primitives with per-band reflectivity, confidence-weighted fusion, decay, spatial-hash/semantic queries, closed-form Beer-Lambert channel gain (exact Friis on empty map), inverse gain updates (unseen 6.1 dB wall learned to <0.5 dB in 20 observations), task-gated scene graph (ADR-275). - Physics-guided synthetic RF worlds: image-method multipath (order ≤2), complex-permittivity Fresnel materials, emergent Doppler proven against the analytic phase rate, seeded ChaCha20 randomization of physics and hardware nuisances; byte-deterministic per seed (ADR-276). - Edge sensing control plane: 802.11bf/ETSI-ISAC-aligned purposes/zones, fail-closed authorization, double-gated identity, retention bounds; BoundedEvent-only trust boundary makes raw RF export unrepresentable (ADR-277). Radar inverse rendering stays a gated research program (ADR-278, no code by design). Anti-leakage acceptance pipeline (strict splits by room/day/person/ chipset/firmware/layout with independent disjointness verification): presence F1 1.00 on held-out rooms and held-out chipset, degradation 0.0, ECE 0.012, p95 latency 2.0 ms debug / 105 µs release — ALL SYNTHETIC until P2 real-data validation. Benchmarks + optimization pass: channel_gain 139→27 µs (O(1) in map size via segment-corridor AABB sweep), observe_link 305→74 µs, DFT twiddle plan 4.9x; hash/linear crossover (~4k Gaussians) reported honestly. Tests: ruview-unified 66 unit + 3 acceptance, 0 failed; workspace 3,771 passed 0 failed (--exclude wifi-densepose-desktop: GTK headers unavailable in this container). Python proof: VERDICT PASS. Also gitignore sensing-server test-run artifacts (incl. generated session-secret). Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01Q1R5zhz6sSfXGRXpgBwpFX
5.4 KiB
ADR-277: Edge sensing control plane — purposes, zones, retention, and a trust boundary raw RF cannot cross
| Field | Value |
|---|---|
| Status | Accepted — P1 implemented (ruview-unified/src/policy.rs; 5 unit tests + the acceptance-pipeline export test) |
| Date | 2026-07-26 |
| Parent | ADR-273 |
| Relates to | ADR-153 (802.11bf protocol model), ADR-141/120 (BFLD privacy control plane + privacy classes), ADR-262 §3.3 (RuField P0–P5 fail-closed mapping — the same philosophy, applied to sensing outputs), ADR-032 (mesh security hardening) |
0. PROOF discipline
Grades per ADR-273 §0. Standards status (EXTERNAL, checkable): IEEE 802.11bf-2025 published 2025-09; IEEE 802.11bk addresses ≤ 320 MHz positioning; ETSI published an ISAC architecture 2026-02 (monostatic/bistatic/multistatic/network/device sensing) followed by a security report identifying 19 privacy and security issue classes; 3GPP Release 20 sensing studies are active. The OpenAirInterface SRS-xApp demo (0.12 m MAE under a random split) is EXTERNAL-UNVERIFIED and its split methodology is exactly the leakage ADR-273 §4 rejects — we cite the implementation path, not the number.
1. Context
Sensing purposes and sensing zones are becoming first-class authorization objects in the standards (802.11bf sensing sessions; ETSI ISAC purposes/exposure). Meanwhile the ETSI security report's issue classes make one thing clear: a sensing stack without a policy plane is a liability. RuView already fails closed at other boundaries (ADR-262 §3.3 maps privacy by information content, never byte value); this ADR gives sensing outputs the same discipline, on-device, before any transport.
2. Decision — three structural rules
2.1 Raw RF never leaves the trust boundary
The only exportable type is BoundedEvent — typed verdicts only (Presence(bool), ActivityClass(u8), RespirationBpm(f64), Location([f64;3]), AnomalyScore(f64)). No variant can carry RF samples, so raw CSI/radar export is unrepresentable, not merely forbidden; TrustBoundary::export is the single egress and there is deliberately no API that serializes an RfTensor outward. External systems receive bounded events + uncertainty, never signal history.
2.2 Fail closed, everywhere
PolicyEngine::authorize: unknown zone ⇒ deny; purpose not granted in the zone ⇒ deny; identity recognition is double-gated — it must be in the zone's allowed_purposes and the zone must set identity_explicitly_enabled (either alone denies). Retention: an event older than the zone's retention_s at export time is dropped with a typed PolicyDenied. Tests cover every branch, including the manufactured cases (identity granted-but-not-enabled; enabled-but-not-granted; stale event).
2.3 Every output is accountable (ADR-273 acceptance item 8)
BoundedEvent::new is the only constructor and fails without: uncertainty ∈ [0,1], provenance (device + synthetic flag — the ADR-276 honest label survives export), a non-zero model version, timestamp, purpose, and zone. The acceptance test (outputs_leave_only_through_the_policy_boundary_fully_attributed) runs the full pipeline — synthetic world → encoder → presence head → event → export — and asserts the attribution and the denial of an ungranted purpose on the same zone.
3. Purpose taxonomy
SensingPurpose: Presence, Activity, Vitals, Localization, PoseTracking, IdentityRecognition, ChannelDiagnostics — deliberately aligned with the ETSI ISAC sensing-service classes and WLAN-sensing use cases so a future 802.11bf sensing-session negotiation or ISAC exposure API maps 1:1 onto zone grants. Person identity is additionally kept out of the ADR-275 scene graph by type (EntityKind::PersonClass, never a person id) — the graph cannot leak what it cannot store.
4. O-RAN / cellular path (roadmap, seams shipped)
The P1 control plane is transport-agnostic and already fronts the cellular seam:
CellularSrsAdapter(oai-srs-xapp, ADR-274 §2.3) normalizes comb-sampled SRS frequency responses into the canonical tensor — the data-plane contract an OAI xApp needs.- P4 (ADR-273 §7) places the sensing application beside the DU for sub-ms I/Q–CSI–SRS access, with the xApp performing wider-area fusion; every output of that path still exits through this ADR's
TrustBoundary, and its localization claims will be reported only under strict splits (the OAI demo's random split is the cautionary example, not the target).
5. Alternatives considered
- Reuse BFLD's privacy classes directly — rejected: BFLD (ADR-120) classifies captures; this plane authorizes outputs by purpose and zone. They compose (a BFLD-classified capture feeding a head still exits through
TrustBoundary), and ADR-262'smap_privacyremains the capture-side mapping. - Config-file allow-lists without types — rejected: the 19 ETSI issue classes are mostly "the code path existed" failures; unrepresentability beats configuration.
6. Consequences
- Enterprise/telecom conversations get a concrete artifact: a privacy manifest is a serialization of zones + purposes + retention (all types already
serde). - Every future surface (sensing-server WS, RuField bridge, SRS xApp, MCP tools) must route sensing outputs through
TrustBoundary— added to the pre-merge security-review checklist item 12. - Cost: purposes are coarse (no per-consumer grants yet); P3 adds consumer identity when the sensing-server wiring lands.