From a3b6e1d500df784b9ad1846dd39deb07e2c69a34 Mon Sep 17 00:00:00 2001 From: rUv Date: Wed, 19 Aug 2026 14:52:09 -0400 Subject: [PATCH] docs(harness): publish final Cognitum Spaces evidence (#1653) --- ...ctivation-and-governed-spatial-exchange.md | 88 +++++++++++-------- harness/ruview/.harness/manifest.json | 8 +- harness/ruview/.harness/manifest.sha256 | 2 +- harness/ruview/package-lock.json | 4 +- harness/ruview/package.json | 2 +- harness/ruview/src/guidance.js | 2 +- 6 files changed, 61 insertions(+), 45 deletions(-) diff --git a/docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md b/docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md index 2d34690d..2a3fd423 100644 --- a/docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md +++ b/docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md @@ -1,6 +1,6 @@ # ADR-325: Cognitum Spaces activation and governed spatial exchange -- **Status**: Accepted — legacy read live; versioned hierarchy, local memory, and governed-action implementation validated on feature branches; deployment pending +- **Status**: Accepted — legacy and versioned reads, OAuth activation, local spatial memory, governed-action policy, metaharness support, and npm distribution are implemented; HTTPS production evidence is complete - **Date**: 2026-08-17 - **Deciders**: ruv - **Tags**: cognitum-spaces, oauth, spatial-state, privacy, ruvector, policy, autogenous @@ -423,41 +423,56 @@ Identity metadata deliberately advertises `spaces:read` for RuView but not publisher surface. RuView therefore has no OAuth write, command, policy-approval, or actuator capability. -This production evidence does not claim deployment of sites/buildings/floors/ -zones, entities, semantic event or alert resources, tenant-scoped RuVector -spatial history, MQTT reconciliation, governed actions, commands, or actuators. -The first three are implemented and locally validated in the 2026-08-19 feature -branches described below, but remain non-production until their workflow and -readback gates pass. Commands and actuators remain out of scope. +That receipt was for the initial flat Space slice. The following production +expansion supersedes only its hierarchy/event/alert deferral. MQTT, commands, +actuators, real-hardware accuracy, and the long-duration operational trial +remain outside the completed claim. -## Feature-branch implementation evidence (2026-08-19) +## Completed implementation and production expansion (2026-08-19) -- Cognitum API ADR-101 implements all eight `/v1/spatial` collections, coherent - transactional hierarchy checks, stable pagination, event/alert retention, - strict P2/P3 admission, API-key-only writes, and OAuth/API-key reads. The - Firestore emulator passed both the legacy and versioned verification scripts, - including cross-resource message replay denial. -- `ruview-cognitum-spaces` adds a strictly decoded, paged, read-only client for - every versioned collection. `wifi-densepose spaces --resource ...` exposes it - while preserving the legacy flat command. The focused client suite and the - CLI no-default-features test gate pass. -- The contributor metaharness now accepts `resource`, `limit`, and opaque - `cursor` on `ruview_spaces_list`, fixes the API origin, strips API-key - compatibility authority, and revalidates hierarchy/event/alert contracts. - Full metaharness, security, brain, flywheel, manifest, audit, and pack gates - pass for the `@ruvnet/ruview` 0.5.0 release candidate. -- ADR-326 adds `ruview-spatial-memory`: one RuVector HNSW index per authenticated - tenant/workspace, replay/derivation/retention gates, cascading erasure, - bounded explanations, and XChaCha20-Poly1305 snapshots with reload-verified - key rotation. Its focused crate suite passes with `SYNTHETIC` evidence. -- ADR-327 extends `ruview-policy` with typed observe/recommend/execute intents, - exact host grants, signed approvals, nonce/idempotency defense, the existing - ADR-321 assurance matrix, and signed hash-chained receipts. `spaces:read` is - explicitly denied as execution authority. Its focused crate suite passes. -- The required whole-workspace Rust command was attempted twice on Windows: - parallel compilation ended in a compiler-process stack-buffer-overrun and a - single-job retry reached the configured timeout without a source/test - diagnostic. This is not recorded as a green gate; Linux CI remains required. +- Cognitum API PRs #211 and #212 shipped the eight `/v1/spatial` collections, + transactional hierarchy integrity, stable pagination, event/alert retention, + strict P2/P3 admission, API-key-only writes, OAuth/API-key reads, and the + additive-only Firestore release authority. Function run `32279092861` + promoted active Node 22 revision `spacesapi-00005-kaf`. +- Edge PRs #214, #215, and #216 preserved canonical UUID routing, kept SQLi + denial, and removed secret-valued API-key rate selection. Gateway run + `32284410107` promoted the reviewed immutable digest to 100% production + traffic. Every versioned collection returned HTTP 200 through the public + edge; the hierarchy composite index is `READY` and both retention TTL fields + are `ACTIVE`. +- The dedicated RuView service credential was rotated to exactly + `spaces:read` and `spaces:write`; its predecessor returns 401. A non-mutating + invalid-body probe reached write validation without persisting customer data. + Other potentially affected owner keys and residual log retention remain + tracked in Cognitum API #217. +- A live RuView Authorization Code + S256 PKCE consent requested exactly + `sensing:read spaces:read`. Its in-memory token read versioned `sites` with + HTTP 200 and schema `1.0`; the verifier then revoked the temporary refresh + credential and persisted no token. +- RuView PR #1650 merged `ruview-cognitum-spaces`, + `ruview-spatial-memory`, the ADR-327 policy extension, CLI paging, and the + guarded `ruview_spaces_list` metaharness surface. PR #1651 removed stale + feature-branch guidance and refreshed the signed package manifest. +- The contributor metaharness fixes the API origin, accepts bounded resource, + limit, and opaque-cursor inputs, strips API-key compatibility authority over + MCP, invokes only the hardened OAuth CLI, and rejects raw sensing or malformed + hierarchy/event/alert output. Its test, security, reviewed-brain, flywheel, + manifest, audit, exact-tarball, and claim-check gates pass. +- Release run `32286297277` rebuilt and smoke-tested the exact package and + provenance-published `@ruvnet/ruview` 0.5.0. The public npm registry resolves + 0.5.0 as `latest`; no workstation publish was used. +- `ruview-spatial-memory` keeps one RuVector HNSW index per authenticated + tenant/workspace with replay, derivation, retention, cascading-erasure, + bounded-explanation, encrypted-snapshot, and reload-verified rotation gates. + This is local `SYNTHETIC` evidence, not a production sensing claim. +- `ruview-policy` keeps observe/recommend/execute intents distinct, requires + exact host grants plus signed approval for consequence, rejects nonce replay, + and emits signed hash-chained receipts. `spaces:read` is explicitly denied as + execution authority. +- Focused Rust gates and the Linux workspace/CLI/security lanes pass. Earlier + Windows whole-workspace attempts ended in host compiler failure or timeout; + those attempts are not reclassified as green evidence. - No OAuth write/action scope, actuator callback, MQTT deployment claim, sensing accuracy claim, or real-hardware claim is introduced. @@ -478,8 +493,9 @@ readback gates pass. Commands and actuators remain out of scope. - Two credential types coexist during migration and must stay visibly distinct. - OAuth depends on Identity JWKS availability and correct key rotation. -- Production currently exposes the legacy spaces slice; the implemented full - hierarchy/events/alerts model remains staged until deployment/readback. +- Production exposes both the legacy Space twins and the versioned hierarchy, + anonymous entities, semantic events, and alerts over HTTPS. MQTT remains a + design contract without deployment evidence. - OAuth workspace IDs will return only documents populated with `workspaceId`; legacy owner-only documents require an explicit migration, never a broad query. - The RuView client exposes no write, command, or agent execution surface. The diff --git a/harness/ruview/.harness/manifest.json b/harness/ruview/.harness/manifest.json index 4113a05d..ece03ea4 100644 --- a/harness/ruview/.harness/manifest.json +++ b/harness/ruview/.harness/manifest.json @@ -3,7 +3,7 @@ "generator": "RuView metaharness provenance v2", "template": "vertical:ruview", "name": "@ruvnet/ruview", - "version": "0.5.0", + "version": "0.5.1", "hosts": [ "claude-code", "codex" @@ -31,7 +31,7 @@ "flywheel/genome.json": "75db44a3cab70d9459fc8c07863f640ac1214bfaa243483939e1506d63f51214", "flywheel/replay.mjs": "0670ca0b03701f4afe0b4bca8a3d58d481676b61a94a5b98c6a425aefb1159ab", "flywheel/run.mjs": "6d4f97db16900c45367b6538848cbe1915af999e663720dfc51f2bb1698f1cd0", - "package.json": "e508476278467cbe63e836d2b42f24649393fb59ce4fe40925d4418da4e79acc", + "package.json": "5d29ef238f310c9ee5c57501ab651acc0f856f831b696ada187de71e4b5935a6", "scripts/sync-skills.mjs": "43715dab61e204dc91bbd61755810e8fdb2f66e2b0c0bd791b4bf48a2e293565", "scripts/update-manifest.mjs": "8f56764b8f70aed55da0c7e2417ae875b0d58d781d839b6db7f115f08af61e6b", "scripts/verify-manifest.mjs": "6491a221762efcfeb3e749ecab243b204f17fd5bc871f3d4025597f31b8f0f10", @@ -43,7 +43,7 @@ "skills/verify.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76", "src/brain.js": "0f16a75aea943acdacc430ff11d5df7ecdec9cca2ab497795ff6f33eaebdfab6", "src/guardrails.js": "aacc8fa6088f7f1ccea3a0b02171a5c516b95d3416ee3ba87add3879a1d6aaad", - "src/guidance.js": "beaa130b546fdb495ae8b17e52c46ca8bbe50c218f05705244922d3633125f4e", + "src/guidance.js": "583904c854eb17e98cb7d959330989c01990a71cff091515777aba8f345de1bf", "src/hosts/claude-code.js": "2212bc39b49822018800dfe33a471e56bbb4c5233d716bfa7aa4fff77aa23edb", "src/hosts/codex.js": "d41ecd132ce2db7b47aad9cebbc020d70e6810d48c3554858d099ff2e8f6608b", "src/hosts/index.js": "ab276c41ab722bcdf72c2d1649cecbb760ae05c41c1372aae4c2447aa7c11539", @@ -55,7 +55,7 @@ "src/spaces.js": "45ef786537cb2a446db5e926e5a1c10b73639d2767dec84611f914f78d4325eb", "src/tools.js": "55960c9a677661763e0317fd54ccc787c2edb39c87371c7fbc40cd55f0761c04" }, - "filesDigest": "961357bd4458bd6fa759f0a8d5bf042c7b652dcea3700363ae25d03299aa5027", + "filesDigest": "28a3bbd9bbcf966df9fae8ec6ea5be3441f6ab535c1636bb1ce33f67b827d423", "brainDigest": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4", "gateFingerprint": "6e53c784eee38310188948fc75fb49e6b4ebc04e247d01b903fa8c8a92d67bdd", "developmentPins": { diff --git a/harness/ruview/.harness/manifest.sha256 b/harness/ruview/.harness/manifest.sha256 index ef9dcb96..bbc2afef 100644 --- a/harness/ruview/.harness/manifest.sha256 +++ b/harness/ruview/.harness/manifest.sha256 @@ -1 +1 @@ -8a4cb8b2a5766455acbf936826d499ec12432e77f9c17f90526ebcdfdc08485d manifest.json +478ccaff9aa249bc7ea6e20551ccc9ac88697a3cc91a7b55400337c5e939a19e manifest.json diff --git a/harness/ruview/package-lock.json b/harness/ruview/package-lock.json index 2e320e75..8efe3aa8 100644 --- a/harness/ruview/package-lock.json +++ b/harness/ruview/package-lock.json @@ -1,12 +1,12 @@ { "name": "@ruvnet/ruview", - "version": "0.5.0", + "version": "0.5.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@ruvnet/ruview", - "version": "0.5.0", + "version": "0.5.1", "license": "MIT", "bin": { "ruview": "bin/cli.js" diff --git a/harness/ruview/package.json b/harness/ruview/package.json index f79d1ca4..75938192 100644 --- a/harness/ruview/package.json +++ b/harness/ruview/package.json @@ -1,6 +1,6 @@ { "name": "@ruvnet/ruview", - "version": "0.5.0", + "version": "0.5.1", "description": "RuView WiFi-sensing operator harness — onboard, calibrate, verify, enforce evidence guardrails, and read Cognitum Spaces through explicitly granted OAuth.", "type": "module", "bin": { diff --git a/harness/ruview/src/guidance.js b/harness/ruview/src/guidance.js index fd32d908..ca23ab58 100644 --- a/harness/ruview/src/guidance.js +++ b/harness/ruview/src/guidance.js @@ -250,7 +250,7 @@ const CAPABILITIES = Object.freeze([ 'The projection is read-only and grants no write, pairing, command, policy-approval, or actuator authority.', 'MCP requires the credential-use grant; bearer tokens and API keys are never accepted as tool arguments.', 'OAuth refresh may rotate the local credential file before a read returns.', - 'Production evidence covers the legacy flat Spaces read. Versioned collections, spatial memory, and governed actions remain staged until workflow deployment/readback.', + 'Production evidence covers legacy and versioned HTTPS reads. Spatial memory remains tenant/workspace-local, while governed actions remain separately policy-gated; neither expands OAuth authority.', 'Persistent memory is local tenant/workspace state and governed actions expose authorization receipts only; neither expands OAuth authority.', ], },