Commit graph

1211 commits

Author SHA1 Message Date
ruv
5780c239e4 security: repair scanning and close stale alert sources
Some checks failed
ruview-swarm CI guard / tests (train) (push) Has been cancelled
ruview-swarm CI guard / tests (default) (push) Has been cancelled
Security Scanning / Container Security Scan (push) Has been cancelled
ruview-swarm CI guard / clippy (-D warnings, --no-deps) (push) Has been cancelled
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Has been cancelled
three.js demos → GitHub Pages / build-and-deploy (push) Has been cancelled
Verify Pipeline Determinism / Verify Pipeline Determinism (push) Has been cancelled
ruview-swarm CI guard / build train_marl bin (push) Has been cancelled
ruview-swarm CI guard / ITAR / publish guard (push) Has been cancelled
Security Scanning / Static Application Security Testing (push) Has been cancelled
Security Scanning / Dependency Vulnerability Scan (push) Has been cancelled
Security Scanning / Infrastructure Security Scan (push) Has been cancelled
Security Scanning / Secret Scanning (push) Has been cancelled
Security Scanning / License Compliance Scan (push) Has been cancelled
Security Scanning / Security Policy Compliance (push) Has been cancelled
semconv / semconv (weaver) (push) Has been cancelled
Continuous Integration / Performance Tests (push) Has been cancelled
Continuous Integration / Docker Build & Test (push) Has been cancelled
Continuous Integration / API Documentation (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (boundary-max) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (boundary-min) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (default) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (edge-tier0) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (edge-tier1) (push) Has been cancelled
Security Scanning / Security Report (push) Has been cancelled
Continuous Integration / Notify (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (full-adr060) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / QEMU Test (tdm-3node) (push) Has been cancelled
Firmware QEMU Tests (ADR-061) / Swarm Test (ADR-062) (push) Has been cancelled
2026-08-02 15:22:13 -04:00
ruv
42492e14a5 docs: collapse secondary README details 2026-08-02 10:56:08 -04:00
ruv
7309458b40 fix: load JSONL models and streamline README 2026-08-02 10:47:59 -04:00
ruv
b77b682a6b feature: promote RuCelium in README 2026-08-02 10:32:29 -04:00
rUv
53e1aaab69
Merge pull request #1489 from ruvnet/feat/sar-metaharness
Some checks failed
Bench Regression Guard / bench compile-verify (--no-run) (push) Has been cancelled
Continuous Integration / Code Quality & Security (push) Has been cancelled
Continuous Integration / Rust Workspace Tests (push) Has been cancelled
Continuous Integration / UI JavaScript Tests (push) Has been cancelled
Continuous Integration / Tests (push) Has been cancelled
Continuous Integration / Tests-1 (push) Has been cancelled
Continuous Integration / Tests-2 (push) Has been cancelled
Fix-Marker Regression Guard / Verify fix markers (push) Has been cancelled
nvsim-server → ghcr.io / build-and-publish (push) Has been cancelled
Security Scanning / Static Application Security Testing (push) Has been cancelled
Security Scanning / Dependency Vulnerability Scan (push) Has been cancelled
Security Scanning / Container Security Scan (push) Has been cancelled
Security Scanning / Infrastructure Security Scan (push) Has been cancelled
Security Scanning / Secret Scanning (push) Has been cancelled
Security Scanning / License Compliance Scan (push) Has been cancelled
Security Scanning / Security Policy Compliance (push) Has been cancelled
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
Continuous Integration / Performance Tests (push) Has been cancelled
Continuous Integration / Docker Build & Test (push) Has been cancelled
Continuous Integration / API Documentation (push) Has been cancelled
Continuous Integration / Notify (push) Has been cancelled
Security Scanning / Security Report (push) Has been cancelled
feat(harness): scaffold wifi-densepose-sar-harness with darwin, router, flywheel
2026-07-31 10:33:01 -04:00
rUv
2bfa60a462
Merge pull request #1487 from ruvnet/feat/sar-tomography-crate
feat(wifi-densepose-sar): coherent wideband RF tomography research crate (ADR-283)
2026-07-31 10:15:44 -04:00
rUv
fa397f5795
Merge pull request #1492 from ruvnet/fix/publish-manifest-metadata-gaps
fix: crates.io publish-blocking manifest gaps (pointcloud license, nvsim-server version req)
2026-07-31 10:15:18 -04:00
rUv
89e0b56464
Merge pull request #1484 from ruvnet/fix/1480-1481-safetensors-modelcard
fix: NUL-padded safetensors header + stale HF model card
2026-07-31 10:15:01 -04:00
rUv
686b255969
Merge pull request #1486 from ruvnet/chore/bump-rufield-submodule
chore: bump vendor/rufield submodule to upstream e65c90d
2026-07-31 10:14:48 -04:00
rUv
5a2e969122
Merge pull request #1488 from ruvnet/chore/vendor-metaharness-submodule
chore: vendor ruvnet/metaharness as a git submodule
2026-07-31 10:14:20 -04:00
ruv
bddc212c17 docs(user-guide): add wifi-densepose-sar, fix stale crate-version claim
Some checks failed
Bench Regression Guard / bench compile-verify (--no-run) (push) Has been cancelled
Continuous Integration / Rust Workspace Tests (push) Has been cancelled
Continuous Integration / UI JavaScript Tests (push) Has been cancelled
Continuous Integration / Tests (push) Has been cancelled
Continuous Integration / Tests-1 (push) Has been cancelled
Continuous Integration / Tests-2 (push) Has been cancelled
Security Scanning / Dependency Vulnerability Scan (push) Has been cancelled
Security Scanning / Container Security Scan (push) Has been cancelled
Security Scanning / Infrastructure Security Scan (push) Has been cancelled
Security Scanning / Secret Scanning (push) Has been cancelled
Continuous Integration / Code Quality & Security (push) Has been cancelled
Security Scanning / Static Application Security Testing (push) Has been cancelled
Security Scanning / License Compliance Scan (push) Has been cancelled
Security Scanning / Security Policy Compliance (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
Continuous Integration / Performance Tests (push) Has been cancelled
Continuous Integration / Docker Build & Test (push) Has been cancelled
Continuous Integration / API Documentation (push) Has been cancelled
Continuous Integration / Notify (push) Has been cancelled
Security Scanning / Security Report (push) Has been cancelled
The crates.io section claimed "All 16 crates are published at v0.3.0" --
stale even before this session (crates publish independently and had
already drifted to 0.3.1-0.3.6). Replaced with an accurate framing
(cargo add resolves each to its own latest) and added the new
wifi-densepose-sar crate (ADR-287) to the list.
2026-07-31 00:39:10 -04:00
ruv
739d3219e6 docs(harness): add route/flywheel command guidance, ADR-286, publish status
Some checks failed
Bench Regression Guard / bench compile-verify (--no-run) (push) Has been cancelled
Continuous Integration / Tests-1 (push) Has been cancelled
Continuous Integration / Tests-2 (push) Has been cancelled
Continuous Integration / Code Quality & Security (push) Has been cancelled
Security Scanning / Dependency Vulnerability Scan (push) Has been cancelled
Security Scanning / Container Security Scan (push) Has been cancelled
Security Scanning / Infrastructure Security Scan (push) Has been cancelled
Continuous Integration / Rust Workspace Tests (push) Has been cancelled
Continuous Integration / UI JavaScript Tests (push) Has been cancelled
Continuous Integration / Tests (push) Has been cancelled
Security Scanning / Static Application Security Testing (push) Has been cancelled
Security Scanning / License Compliance Scan (push) Has been cancelled
Security Scanning / Security Policy Compliance (push) Has been cancelled
Security Scanning / Secret Scanning (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
Continuous Integration / API Documentation (push) Has been cancelled
Continuous Integration / Notify (push) Has been cancelled
Security Scanning / Security Report (push) Has been cancelled
Continuous Integration / Performance Tests (push) Has been cancelled
Continuous Integration / Docker Build & Test (push) Has been cancelled
- .claude/commands/route.md and flywheel.md -- the two CLI subcommands
  added alongside darwin/router/flywheel wiring never got matching
  guidance files (unlike doctor/review-diff), so they weren't fully
  wired into the harness's own MCP tool listing. Added, following the
  existing pattern.
- CLAUDE.md: note the crate + harness are both published now (crates.io
  v0.3.1, npm v0.1.0).
- New ADR-286 documenting the harness's MetaHarness scaffold + the
  darwin/router/flywheel wiring decision, following the ADR-182/ADR-285
  precedent (every harness in this repo gets one).
- docs/adr/README.md: index rows for ADR-286 and the crate's ADR
  (287 -- see the next commit for the renumbering-from-283 story).
2026-07-31 00:36:38 -04:00
ruv
1b220c8d53 feat(harness): scaffold wifi-densepose-sar-harness with darwin, router, flywheel
Mints a real MetaHarness (via vendor/metaharness's published `npx
metaharness analyze --scaffold`, template vertical:coding, host
claude-code) for the wifi-densepose-sar crate: architect/implementer/
reviewer/test-writer agents, doctor/review-diff commands, MCP server,
Claude Code plugin -- following the same pattern as harness/ruview/
(ADR-182) and harness/homecore/ (ADR-285).

Adds real wiring for the three pieces this was scoped around:
- Darwin Mode (@metaharness/darwin) -- wired by the scaffold itself
  (npm run evolve / evolve:dry).
- Router (@metaharness/router) -- src/router.ts, a real k-NN
  cost-optimal Router over two example model tiers. Its labelled
  examples are illustrative seed data (see the file's honesty note),
  not measured eval-log observations; the routing mechanism itself is
  real and tested.
- Flywheel (@metaharness/flywheel) -- src/flywheel.ts, the real
  propose/evaluate/gate/promote loop wired with a SYNTHETIC proposer
  and evaluator (dataSource: 'SYNTHETIC', no model call). Proves the
  wiring end-to-end: a real signed, independently-replayable lineage,
  promoting each generation once the evaluator's noopRate actually
  moves (the default gate requires it to strictly improve -- a
  constant noopRate, even a "good" one, blocks every promotion
  forever, which the first version of this evaluator hit and the
  final version fixes).

14/14 tests pass (5 router + 5 flywheel + 4 install-smoke), `npm run
build` clean under strict TypeScript, CLI commands (route, flywheel)
verified manually. `.harness/manifest.json` is stale relative to the
router/flywheel additions -- this scaffold has no manifest:update
script (unlike harness/homecore/); documented as a known gap in the
harness's own README.
2026-07-31 00:36:38 -04:00
ruv
bb554ab7b4 chore: vendor ruvnet/metaharness as a git submodule
Adds vendor/metaharness (github.com/ruvnet/metaharness, pinned at
87b6c51 on main) -- the real MetaHarness generator: repo-aware CLI,
Rust/WASM+NAPI-RS kernel, host adapters, @metaharness/router
(cost-optimal model routing) and @metaharness/darwin ("Darwin Mode",
self-evolving harness config). ADR-285's harness/homecore/ already
depends on the real @metaharness/kernel@0.1.2 npm package; this
vendors the source repo alongside the other vendor/* submodules
(rufield, rvcsi, ruvector, sublinear-time-solver, midstream) for local
inspection and building.

No wiring into any harness/ or crate yet -- follow-up work.
2026-07-31 00:36:37 -04:00
ruv
e4695d8c68 fix: renumber wifi-densepose-sar's ADR from 283 to 287 (number collision)
ADR-283 was already taken by ADR-283-ruview-community-metaharness-flywheel.md,
merged to main before this branch's work started -- picked without checking
against main's actual current ADR list. Renumbered to ADR-287, the next free
slot after ADR-286 (the wifi-densepose-sar-harness ADR, no collision there).

Updated every reference across the crate (Cargo.toml description, lib.rs/
geometry.rs/measurement.rs/pointcloud.rs/reconstruct.rs/resolution.rs doc
comments, tests/physics_validation.rs), its README, the tutorial doc,
CHANGELOG.md, and the workspace Cargo.toml's member comment. 25 tests still
pass after the rename (doc-comment-only changes, no logic touched).
2026-07-31 00:34:35 -04:00
ruv
83b7cf0e05 docs(ADR-283): record the crates.io publish (v0.3.1) and ADR-286 harness link 2026-07-31 00:27:47 -04:00
ruv
155c476a7d fix: crates.io publish-blocking manifest gaps (pointcloud license, nvsim-server version req)
wifi-densepose-pointcloud's Cargo.toml had no license/authors/repository
fields at all (crates.io rejects a publish with "missing or empty
metadata fields: license") -- added the standard
authors.workspace/license.workspace/repository.workspace trio every
other crate in this workspace already uses.

nvsim-server's path dependency on nvsim had no version requirement
(crates.io rejects "all dependencies must have a version requirement
specified when publishing") -- pinned to nvsim = "0.3.1", the version
just published.

Found while publishing both crates for the first time; both now publish
cleanly (verified via cargo publish --dry-run before and after).
2026-07-31 00:14:31 -04:00
ruv
895c04747e perf(wifi-densepose-sar): incremental phasor rotation in backprojection (~4.4-4.5x, MEASURED)
focus_at_point called Complex64::from_polar (a sin/cos pair) once per
(pose, frequency) term. FrequencySweep::frequencies() produces evenly
spaced frequencies by construction, so the per-term phase is an
arithmetic progression in the frequency index -- the phasor can be
evaluated once per pose and advanced by a fixed complex-multiply step
per frequency instead, turning K trig evaluations into 2.

focus_at_point's signature changes from a raw &[f64] frequency slice
to &FrequencySweep, so the evenly-spaced-frequencies precondition
this optimization depends on is a type-level invariant rather than a
caller-observed one -- an arbitrary non-uniform frequency list is no
longer constructible through this API at all.

MEASURED (criterion regression detection, p < 0.001): ~4.4-4.5x
faster across 512/4096/32768-voxel grids (300us/1.97ms/14.5ms vs the
prior 1.47ms/10.4ms/73.5ms). Proven equivalent, not just faster: a new
test independently reimplements the direct per-frequency computation
as a reference and checks the optimized path against it across four
sweep sizes (incl. the n_steps=1 degenerate case) and both on-target
and off-target points, to <1e-9 relative error.

25 tests (22 unit + 3 integration), 0 failed, clippy-clean.
2026-07-30 21:09:57 -04:00
ruv
50edd0aec6 chore: vendor ruvnet/metaharness as a git submodule
Adds vendor/metaharness (github.com/ruvnet/metaharness, pinned at
87b6c51 on main) -- the real MetaHarness generator: repo-aware CLI,
Rust/WASM+NAPI-RS kernel, host adapters, @metaharness/router
(cost-optimal model routing) and @metaharness/darwin ("Darwin Mode",
self-evolving harness config). ADR-285's harness/homecore/ already
depends on the real @metaharness/kernel@0.1.2 npm package; this
vendors the source repo alongside the other vendor/* submodules
(rufield, rvcsi, ruvector, sublinear-time-solver, midstream) for local
inspection and building.

No wiring into any harness/ or crate yet -- follow-up work.
2026-07-30 18:00:03 -04:00
ruv
d781f20e1a feat(wifi-densepose-sar): coherent wideband RF tomography research crate (ADR-283)
New standalone leaf crate implementing the synthetic-aperture-radar
reconstruction primitive a handheld through-wall RF imaging device
would need: a stepped-frequency multi-position complex forward
measurement simulator, delay-and-sum backprojection reconstruction,
point-cloud extraction, and closed-form range/cross-range resolution
+ antenna-pose coherence-budget formulas checked against the
reconstruction's actual behavior in tests/physics_validation.rs.

Motivated by comparing this repo against Applied Electrodynamics'
"WaveSight" launch. Scoped explicitly below ADR-278's RISE/DiffRadar/
GeRaF reproduction gates: this is the bare measurement-model +
backprojection primitive, not a reproduction of any published system
or a claim about real hardware capability. Every number is
SYNTHETIC/L0 (ADR-282) -- no wideband RF hardware backs this crate.

24 tests (21 unit + 3 integration), 0 failed, clippy-clean. Adds a
tutorial walkthrough and MEASURED backprojection benchmark numbers.
2026-07-30 17:52:31 -04:00
ruv
5a96a69f1c chore: bump vendor/rufield submodule to upstream e65c90d
Picks up a cargo-fmt pass on the rufield MFS reference stack
(github.com/ruvnet/rufield): whitespace/line-wrap only, no logic
changes. 98 tests, 0 failed.
2026-07-30 17:10:03 -04:00
ruv
3b529bd3ed fix: NUL-padded safetensors header + stale HF model card (#1480, #1481)
--convert-model rejected the published model.safetensors because its
JSON header is padded to an 8-byte boundary with trailing NUL bytes,
which a strict serde_json::from_slice parse treats as trailing
characters. Trim the padding before parsing, with a regression test
that reproduces the exact boundary-padded shape of the real HF file.

docs/huggingface/MODEL_CARD.md had drifted from the card actually
published on the Hub: every file in its "Files in this repo" table
(pretrained-encoder.onnx, pretrained-heads.onnx, pretrained.rvf,
room-profiles.json) does not exist in ruvnet/wifi-densepose-pretrained.
Replaced it with the content live on the Hub and added a section
documenting the --convert-model / --model RVF conversion path, which
neither card mentioned.
2026-07-30 12:02:53 -04:00
rUv
90b29595fb
feat(homecore): add WASM-first developer metaharness (#1477)
Some checks failed
npm packages / harness/homecore (node 20) (push) Has been cancelled
npm packages / harness/ruview (node 20) (push) Has been cancelled
npm packages / tools/ruview-cli (node 20) (push) Has been cancelled
npm packages / tools/ruview-mcp (node 20) (push) Has been cancelled
npm packages / harness/homecore (node 22) (push) Has been cancelled
npm packages / harness/ruview (node 22) (push) Has been cancelled
npm packages / tools/ruview-cli (node 22) (push) Has been cancelled
npm packages / tools/ruview-mcp (node 22) (push) Has been cancelled
Continuous Integration / Performance Tests (push) Has been cancelled
Continuous Integration / Docker Build & Test (push) Has been cancelled
Continuous Integration / API Documentation (push) Has been cancelled
Continuous Integration / Notify (push) Has been cancelled
Security Scanning / Security Report (push) Has been cancelled
Continuous Integration / Code Quality & Security (push) Has been cancelled
Continuous Integration / Rust Workspace Tests (push) Has been cancelled
Continuous Integration / UI JavaScript Tests (push) Has been cancelled
Continuous Integration / Tests (push) Has been cancelled
Continuous Integration / Tests-1 (push) Has been cancelled
Continuous Integration / Tests-2 (push) Has been cancelled
Fix-Marker Regression Guard / Verify fix markers (push) Has been cancelled
Security Scanning / Static Application Security Testing (push) Has been cancelled
Security Scanning / Dependency Vulnerability Scan (push) Has been cancelled
Security Scanning / Container Security Scan (push) Has been cancelled
Security Scanning / Infrastructure Security Scan (push) Has been cancelled
Security Scanning / Secret Scanning (push) Has been cancelled
Security Scanning / License Compliance Scan (push) Has been cancelled
Security Scanning / Security Policy Compliance (push) Has been cancelled
Adds the accepted ADR-285 Homecore metaharness, WASM-first kernel, read-only MCP guidance, guarded local host adapters, reviewed memory, and provenance-only npm release gates.
2026-07-29 19:51:21 -04:00
rUv
c798cc913c
fix: move nightly automation off deprecated Node 20 actions (#1476)
Pins maintained action revisions that execute on Node 24, moves the project runtime to Node 22, and adds regression coverage so the deprecated Node 20 action runtime cannot silently return.
2026-07-29 16:45:30 -04:00
ruv
ff5e91d82c fix: update nightly actions to Node 24 runtime 2026-07-29 16:33:52 -04:00
rUv
e8e645d731
feat: add bounded nightly SOTA research agent (#1475)
Add a fail-closed nightly Cognitum research pipeline with frozen Darwin policy, an honest-null Flywheel canary, bounded issue/PR automation, and declarative offline prototypes.
2026-07-29 16:28:47 -04:00
ruv
dc03d174ee feat: add bounded nightly SOTA research agent 2026-07-29 16:13:28 -04:00
rUv
a34bfc246e
feat: add source-cited RuView guidance MCP tool (#1469)
Some checks failed
Continuous Integration / Code Quality & Security (push) Waiting to run
npm packages / tools/ruview-mcp (node 22) (push) Waiting to run
Continuous Integration / Rust Workspace Tests (push) Waiting to run
Continuous Integration / UI JavaScript Tests (push) Waiting to run
Continuous Integration / Tests (push) Waiting to run
Continuous Integration / Tests-1 (push) Waiting to run
Continuous Integration / Tests-2 (push) Waiting to run
Continuous Integration / Performance Tests (push) Blocked by required conditions
Continuous Integration / Docker Build & Test (push) Blocked by required conditions
Continuous Integration / API Documentation (push) Blocked by required conditions
Continuous Integration / Notify (push) Blocked by required conditions
Fix-Marker Regression Guard / Verify fix markers (push) Waiting to run
npm packages / harness/ruview (node 20) (push) Waiting to run
npm packages / tools/ruview-cli (node 20) (push) Waiting to run
npm packages / tools/ruview-mcp (node 20) (push) Waiting to run
npm packages / harness/ruview (node 22) (push) Waiting to run
npm packages / tools/ruview-cli (node 22) (push) Waiting to run
Security Scanning / Static Application Security Testing (push) Waiting to run
Security Scanning / Dependency Vulnerability Scan (push) Waiting to run
Security Scanning / Container Security Scan (push) Waiting to run
Security Scanning / Infrastructure Security Scan (push) Waiting to run
Security Scanning / Secret Scanning (push) Waiting to run
Security Scanning / License Compliance Scan (push) Waiting to run
Security Scanning / Security Policy Compliance (push) Waiting to run
Security Scanning / Security Report (push) Blocked by required conditions
Bench Regression Guard / bench compile-verify (--no-run) (push) Has been cancelled
ADR-115 MQTT integration tests / mqtt-integration (push) Has been cancelled
semconv / semconv (weaver) (push) Has been cancelled
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
Add a read-only guidance CLI/MCP surface with reviewed capability maturity, repository citations, validation commands, limitations, and shared-brain evidence. Bump @ruvnet/ruview to 0.3.1 and add release-tarball smoke coverage.
2026-07-29 01:32:45 -04:00
rUv
1ae8583441
docs: optimize Claude and Codex repository guidance (#1468) 2026-07-29 00:41:29 -04:00
rUv
2b7853b18f
feat(ruview): secure community metaharness flywheel (#1467)
* feat(ruview): add secure community metaharness flywheel

* fix(ruview): canonicalize manifest line endings
2026-07-28 23:57:16 -04:00
rUv
e78252a575
feat(sensing-server): secure opt-in OpenTelemetry log export (#1465)
Imports and hardens #1382 with opt-in OTLP logging, registry-validated semantic conventions, a published schema, TLS roots, digest-pinned demo images, and corrected first-CSI lifecycle reporting. Co-authored by Jens Holdgaard Pedersen.
2026-07-28 23:16:46 -04:00
ruv
9fb5af7cf2 feat(sensing-server): add secure opt-in OTLP log export
Import and harden the OpenTelemetry logging work from #1382. Preserve default stderr behavior, register and validate RuView semantic conventions, attach a published schema, enable TLS roots, pin demo images, and fix first-CSI node lifecycle reporting.

Supersedes #1382
Closes #1460

Co-authored-by: Jens Holdgaard Pedersen <jens@holdgaard.org>
2026-07-28 22:42:18 -04:00
rUv
a70ca90525
fix(ui): pose stream WebSocket 401s when RUVIEW_API_TOKEN is set (#1461) (#1462)
Some checks are pending
Continuous Integration / Code Quality & Security (push) Waiting to run
Continuous Integration / Rust Workspace Tests (push) Waiting to run
Continuous Integration / UI JavaScript Tests (push) Waiting to run
Continuous Integration / Tests (push) Waiting to run
Continuous Integration / Tests-1 (push) Waiting to run
Continuous Integration / Tests-2 (push) Waiting to run
Continuous Integration / Performance Tests (push) Blocked by required conditions
Continuous Integration / Docker Build & Test (push) Blocked by required conditions
Continuous Integration / API Documentation (push) Blocked by required conditions
Continuous Integration / Notify (push) Blocked by required conditions
Fix-Marker Regression Guard / Verify fix markers (push) Waiting to run
Security Scanning / Static Application Security Testing (push) Waiting to run
Security Scanning / Dependency Vulnerability Scan (push) Waiting to run
Security Scanning / Container Security Scan (push) Waiting to run
Security Scanning / Infrastructure Security Scan (push) Waiting to run
Security Scanning / Secret Scanning (push) Waiting to run
Security Scanning / License Compliance Scan (push) Waiting to run
Security Scanning / Security Policy Compliance (push) Waiting to run
Security Scanning / Security Report (push) Blocked by required conditions
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Waiting to run
websocket.service.js (used by the pose/event streams) opened a bare
`new WebSocket(url)` with no ADR-272 ticket exchange, unlike
sensing.service.js which already mints a ticket per connect. Since a
browser cannot set an Authorization header on a WebSocket upgrade, and
the server rejects a long-lived bearer passed as a query string
(CWE-598), the pose stream 401'd whenever auth was on — visible in the
Live Demo tab as "Failed to create WebSocket connection".

Fix: createWebSocketWithTimeout() now strips any `token` query param a
caller put on the URL (pose.service.js does this) and exchanges the
stored bearer for a single-use `?ticket=` via withWsTicket(), done at
this one choke point so every consumer (pose, events, training) and
every reconnect attempt gets a fresh ticket.

Second, smaller bug: pose-fusion/js/main.js auto-connected to a
hardcoded `ws://localhost:8765/ws/sensing`, but the Docker image serves
the sensing WebSocket on :3001 (the same 3000->3001 mapping
sensing.service.js already encodes) — the auto-connect dialed a port
nothing listens on. Reuses that port mapping and tickets both the
auto-connect and the manual "Connect" button.

Bumped the pose-fusion.html cache-buster (v=13 -> v=14) so browsers
actually fetch the updated main.js.

Adds ui/services/websocket.service.test.mjs (4 executed Node tests,
stubbed WebSocket/fetch/localStorage) covering: no-auth passthrough,
ticket exchange + bearer-never-in-URL, stray ?token= stripping, and the
pre-ADR-272 404 fallback. Wired into the CI "Run UI unit tests" step.

Reported with a verified fix in #1461 by wsc7r4zcj4-collab; this PR
implements the same fix against current main with an added regression
test.

Closes #1461
2026-07-28 10:59:00 -04:00
rUv
e6062977c9
docs: add calibration guide and trust/engine-error diagnostics (#1456) (#1457)
Some checks are pending
Continuous Integration / Code Quality & Security (push) Waiting to run
Continuous Integration / Rust Workspace Tests (push) Waiting to run
Continuous Integration / UI JavaScript Tests (push) Waiting to run
Continuous Integration / Tests (push) Waiting to run
Continuous Integration / Tests-1 (push) Waiting to run
Continuous Integration / Tests-2 (push) Waiting to run
Continuous Integration / Performance Tests (push) Blocked by required conditions
Continuous Integration / Docker Build & Test (push) Blocked by required conditions
Continuous Integration / API Documentation (push) Blocked by required conditions
Continuous Integration / Notify (push) Blocked by required conditions
Fix-Marker Regression Guard / Verify fix markers (push) Waiting to run
Security Scanning / Static Application Security Testing (push) Waiting to run
Security Scanning / Dependency Vulnerability Scan (push) Waiting to run
Security Scanning / Container Security Scan (push) Waiting to run
Security Scanning / Infrastructure Security Scan (push) Waiting to run
Security Scanning / Secret Scanning (push) Waiting to run
Security Scanning / License Compliance Scan (push) Waiting to run
Security Scanning / Security Policy Compliance (push) Waiting to run
Security Scanning / Security Report (push) Blocked by required conditions
Closes the two documentation gaps from #1456 (follow-up to #1401):

- docs/calibration-guide.md: what calibrate/enroll/train-room actually
  enforce, grounded in v2/crates/wifi-densepose-calibration and
  wifi-densepose-cli source (not just ADR-135/151 aspirational prose).
  Covers the hard 600-frame baseline minimum, per-anchor quality gate
  thresholds, the unsolved pet/small-motion presence-detection gap, and
  what the empty-room baseline capture actually needs (steady vs silent).
  Flags that ADR-135's drift_score/BaselineDrift staleness system is not
  implemented in code — only bank.rs's baseline_id STALE check is real.

- docs/trust-and-engine-errors.md: exact trigger conditions for
  engine_error_count vs the separate, non-sticky `demoted` privacy-class
  flag, where both are exposed (/health/ready and /api/v1/status share a
  handler), the real diagnostic gap (no per-cause breakdown, log line is
  the closest thing), the WDP_GUARD_INTERVAL_US recovery path for
  persistent clock-drift demotion, and an honest "no code path found"
  answer on whether a converted HuggingFace model explains engine errors.

Also adds both docs to the README documentation table. No code changes.
2026-07-28 00:16:17 -04:00
rUv
535043731c
fix(homecore): review findings from PR #1451 — HAP secret redaction, REST cap, event_type, migration --force (#1452)
Some checks failed
Continuous Integration / Code Quality & Security (push) Waiting to run
Continuous Integration / Rust Workspace Tests (push) Waiting to run
Continuous Integration / UI JavaScript Tests (push) Waiting to run
Continuous Integration / Tests (push) Waiting to run
Continuous Integration / Tests-1 (push) Waiting to run
Continuous Integration / Tests-2 (push) Waiting to run
Continuous Integration / Performance Tests (push) Blocked by required conditions
Continuous Integration / Docker Build & Test (push) Blocked by required conditions
Security Scanning / Dependency Vulnerability Scan (push) Waiting to run
Security Scanning / Container Security Scan (push) Waiting to run
Security Scanning / Infrastructure Security Scan (push) Waiting to run
Continuous Integration / API Documentation (push) Blocked by required conditions
Continuous Integration / Notify (push) Blocked by required conditions
Fix-Marker Regression Guard / Verify fix markers (push) Waiting to run
Security Scanning / Static Application Security Testing (push) Waiting to run
Security Scanning / Secret Scanning (push) Waiting to run
Security Scanning / License Compliance Scan (push) Waiting to run
Security Scanning / Security Policy Compliance (push) Waiting to run
Security Scanning / Security Report (push) Blocked by required conditions
wifi-densepose sensing-server → Docker Hub + ghcr.io / build · push · smoke-test (push) Waiting to run
Bench Regression Guard / bench compile-verify (--no-run) (push) Has been cancelled
Bench Regression Guard / bench fast-run (informational, non-gating) (push) Has been cancelled
HAP accessory signing seed no longer reachable via derived Debug. /api/history/period and /api/logbook no longer break the default (unfiltered) call shape above 32 entities. fire_event's event_type validation relaxed to match real HA's contract. homecore-migrate gained a --force flag for re-running imports. Public v2051 release notes corrected. 110 tests across the 3 touched crates, 0 failed, clippy clean.
2026-07-27 17:01:25 -07:00
rUv
42d56fc1a5
Merge pull request #1451 from ruvnet/feat/homecore-platform-parity
feat(homecore): complete platform runtime capabilities
2026-07-27 12:37:42 -07:00
ruv
5bf820700c fix(homecore-plugins): use patched Wasmtime runtime 2026-07-27 15:23:33 -04:00
ruv
546081e628 docs(homecore): record platform runtime completion 2026-07-27 15:11:03 -04:00
ruv
e7c598e64c fix(homecore-server): provision stable HAP identity securely 2026-07-27 15:08:52 -04:00
ruv
42684a7a1e feat(hap): implement authenticated pairing and transport 2026-07-27 15:06:26 -04:00
ruv
b41b8c8a82 fix(homecore-api): bound multi-entity history responses 2026-07-27 14:47:04 -04:00
ruv
e47d40c5c4 feat(homecore-api): add logbook and integration REST routes 2026-07-27 14:45:35 -04:00
ruv
bc690ff309 feat(homecore-api): serve bounded recorder history 2026-07-27 14:43:48 -04:00
ruv
fbd5cfa242 feat(homecore-server): wire HAP runtime and registry APIs 2026-07-27 14:41:25 -04:00
ruv
5b5c7f323d fix(homecore): wire plugin lifecycle and preserve MSRV 2026-07-27 14:30:51 -04:00
ruv
d8dcccda28 feat(homecore): load signed native and Wasmtime plugins 2026-07-27 14:23:01 -04:00
ruv
ec2c64cb62 fix(homecore-server): separate HA and dashboard event routes 2026-07-27 14:19:51 -04:00
ruv
c2abe53e92 feat(homecore-hap): add fail-closed network foundation 2026-07-27 14:15:59 -04:00
ruv
0a8e72e762 feat(homecore): complete migration and startup restore 2026-07-27 14:14:56 -04:00
ruv
3136f1305b feat(homecore-api): negotiate modern websocket clients 2026-07-27 14:09:17 -04:00