docs(harness): publish final Cognitum Spaces evidence (#1653)

docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md

@@ -1,6 +1,6 @@
 # ADR-325: Cognitum Spaces activation and governed spatial exchange
 
-- **Status**: Accepted — legacy read live; versioned hierarchy, local memory, and governed-action implementation validated on feature branches; deployment pending
+- **Status**: Accepted — legacy and versioned reads, OAuth activation, local spatial memory, governed-action policy, metaharness support, and npm distribution are implemented; HTTPS production evidence is complete
 - **Date**: 2026-08-17
 - **Deciders**: ruv
 - **Tags**: cognitum-spaces, oauth, spatial-state, privacy, ruvector, policy, autogenous
@@ -423,41 +423,56 @@ Identity metadata deliberately advertises `spaces:read` for RuView but not
 publisher surface. RuView therefore has no OAuth write, command, policy-approval,
 or actuator capability.
 
-This production evidence does not claim deployment of sites/buildings/floors/
+That receipt was for the initial flat Space slice. The following production
-zones, entities, semantic event or alert resources, tenant-scoped RuVector
+expansion supersedes only its hierarchy/event/alert deferral. MQTT, commands,
-spatial history, MQTT reconciliation, governed actions, commands, or actuators.
+actuators, real-hardware accuracy, and the long-duration operational trial
-The first three are implemented and locally validated in the 2026-08-19 feature
+remain outside the completed claim.
-branches described below, but remain non-production until their workflow and
-readback gates pass. Commands and actuators remain out of scope.
 
-## Feature-branch implementation evidence (2026-08-19)
+## Completed implementation and production expansion (2026-08-19)
 
-- Cognitum API ADR-101 implements all eight `/v1/spatial` collections, coherent
+- Cognitum API PRs #211 and #212 shipped the eight `/v1/spatial` collections,
-  transactional hierarchy checks, stable pagination, event/alert retention,
+  transactional hierarchy integrity, stable pagination, event/alert retention,
-  strict P2/P3 admission, API-key-only writes, and OAuth/API-key reads. The
+  strict P2/P3 admission, API-key-only writes, OAuth/API-key reads, and the
-  Firestore emulator passed both the legacy and versioned verification scripts,
+  additive-only Firestore release authority. Function run `32279092861`
-  including cross-resource message replay denial.
+  promoted active Node 22 revision `spacesapi-00005-kaf`.
-- `ruview-cognitum-spaces` adds a strictly decoded, paged, read-only client for
+- Edge PRs #214, #215, and #216 preserved canonical UUID routing, kept SQLi
-  every versioned collection. `wifi-densepose spaces --resource ...` exposes it
+  denial, and removed secret-valued API-key rate selection. Gateway run
-  while preserving the legacy flat command. The focused client suite and the
+  `32284410107` promoted the reviewed immutable digest to 100% production
-  CLI no-default-features test gate pass.
+  traffic. Every versioned collection returned HTTP 200 through the public
-- The contributor metaharness now accepts `resource`, `limit`, and opaque
+  edge; the hierarchy composite index is `READY` and both retention TTL fields
-  `cursor` on `ruview_spaces_list`, fixes the API origin, strips API-key
+  are `ACTIVE`.
-  compatibility authority, and revalidates hierarchy/event/alert contracts.
+- The dedicated RuView service credential was rotated to exactly
-  Full metaharness, security, brain, flywheel, manifest, audit, and pack gates
+  `spaces:read` and `spaces:write`; its predecessor returns 401. A non-mutating
-  pass for the `@ruvnet/ruview` 0.5.0 release candidate.
+  invalid-body probe reached write validation without persisting customer data.
-- ADR-326 adds `ruview-spatial-memory`: one RuVector HNSW index per authenticated
+  Other potentially affected owner keys and residual log retention remain
-  tenant/workspace, replay/derivation/retention gates, cascading erasure,
+  tracked in Cognitum API #217.
-  bounded explanations, and XChaCha20-Poly1305 snapshots with reload-verified
+- A live RuView Authorization Code + S256 PKCE consent requested exactly
-  key rotation. Its focused crate suite passes with `SYNTHETIC` evidence.
+  `sensing:read spaces:read`. Its in-memory token read versioned `sites` with
-- ADR-327 extends `ruview-policy` with typed observe/recommend/execute intents,
+  HTTP 200 and schema `1.0`; the verifier then revoked the temporary refresh
-  exact host grants, signed approvals, nonce/idempotency defense, the existing
+  credential and persisted no token.
-  ADR-321 assurance matrix, and signed hash-chained receipts. `spaces:read` is
+- RuView PR #1650 merged `ruview-cognitum-spaces`,
-  explicitly denied as execution authority. Its focused crate suite passes.
+  `ruview-spatial-memory`, the ADR-327 policy extension, CLI paging, and the
-- The required whole-workspace Rust command was attempted twice on Windows:
+  guarded `ruview_spaces_list` metaharness surface. PR #1651 removed stale
-  parallel compilation ended in a compiler-process stack-buffer-overrun and a
+  feature-branch guidance and refreshed the signed package manifest.
-  single-job retry reached the configured timeout without a source/test
+- The contributor metaharness fixes the API origin, accepts bounded resource,
-  diagnostic. This is not recorded as a green gate; Linux CI remains required.
+  limit, and opaque-cursor inputs, strips API-key compatibility authority over
+  MCP, invokes only the hardened OAuth CLI, and rejects raw sensing or malformed
+  hierarchy/event/alert output. Its test, security, reviewed-brain, flywheel,
+  manifest, audit, exact-tarball, and claim-check gates pass.
+- Release run `32286297277` rebuilt and smoke-tested the exact package and
+  provenance-published `@ruvnet/ruview` 0.5.0. The public npm registry resolves
+  0.5.0 as `latest`; no workstation publish was used.
+- `ruview-spatial-memory` keeps one RuVector HNSW index per authenticated
+  tenant/workspace with replay, derivation, retention, cascading-erasure,
+  bounded-explanation, encrypted-snapshot, and reload-verified rotation gates.
+  This is local `SYNTHETIC` evidence, not a production sensing claim.
+- `ruview-policy` keeps observe/recommend/execute intents distinct, requires
+  exact host grants plus signed approval for consequence, rejects nonce replay,
+  and emits signed hash-chained receipts. `spaces:read` is explicitly denied as
+  execution authority.
+- Focused Rust gates and the Linux workspace/CLI/security lanes pass. Earlier
+  Windows whole-workspace attempts ended in host compiler failure or timeout;
+  those attempts are not reclassified as green evidence.
 - No OAuth write/action scope, actuator callback, MQTT deployment claim, sensing
   accuracy claim, or real-hardware claim is introduced.
 
@@ -478,8 +493,9 @@ readback gates pass. Commands and actuators remain out of scope.
 
 - Two credential types coexist during migration and must stay visibly distinct.
 - OAuth depends on Identity JWKS availability and correct key rotation.
-- Production currently exposes the legacy spaces slice; the implemented full
+- Production exposes both the legacy Space twins and the versioned hierarchy,
-  hierarchy/events/alerts model remains staged until deployment/readback.
+  anonymous entities, semantic events, and alerts over HTTPS. MQTT remains a
+  design contract without deployment evidence.
 - OAuth workspace IDs will return only documents populated with `workspaceId`;
   legacy owner-only documents require an explicit migration, never a broad query.
 - The RuView client exposes no write, command, or agent execution surface. The

harness/ruview/.harness/manifest.json

@@ -3,7 +3,7 @@
   "generator": "RuView metaharness provenance v2",
   "template": "vertical:ruview",
   "name": "@ruvnet/ruview",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "hosts": [
     "claude-code",
     "codex"
@@ -31,7 +31,7 @@
     "flywheel/genome.json": "75db44a3cab70d9459fc8c07863f640ac1214bfaa243483939e1506d63f51214",
     "flywheel/replay.mjs": "0670ca0b03701f4afe0b4bca8a3d58d481676b61a94a5b98c6a425aefb1159ab",
     "flywheel/run.mjs": "6d4f97db16900c45367b6538848cbe1915af999e663720dfc51f2bb1698f1cd0",
-    "package.json": "e508476278467cbe63e836d2b42f24649393fb59ce4fe40925d4418da4e79acc",
+    "package.json": "5d29ef238f310c9ee5c57501ab651acc0f856f831b696ada187de71e4b5935a6",
     "scripts/sync-skills.mjs": "43715dab61e204dc91bbd61755810e8fdb2f66e2b0c0bd791b4bf48a2e293565",
     "scripts/update-manifest.mjs": "8f56764b8f70aed55da0c7e2417ae875b0d58d781d839b6db7f115f08af61e6b",
     "scripts/verify-manifest.mjs": "6491a221762efcfeb3e749ecab243b204f17fd5bc871f3d4025597f31b8f0f10",
@@ -43,7 +43,7 @@
     "skills/verify.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76",
     "src/brain.js": "0f16a75aea943acdacc430ff11d5df7ecdec9cca2ab497795ff6f33eaebdfab6",
     "src/guardrails.js": "aacc8fa6088f7f1ccea3a0b02171a5c516b95d3416ee3ba87add3879a1d6aaad",
-    "src/guidance.js": "beaa130b546fdb495ae8b17e52c46ca8bbe50c218f05705244922d3633125f4e",
+    "src/guidance.js": "583904c854eb17e98cb7d959330989c01990a71cff091515777aba8f345de1bf",
     "src/hosts/claude-code.js": "2212bc39b49822018800dfe33a471e56bbb4c5233d716bfa7aa4fff77aa23edb",
     "src/hosts/codex.js": "d41ecd132ce2db7b47aad9cebbc020d70e6810d48c3554858d099ff2e8f6608b",
     "src/hosts/index.js": "ab276c41ab722bcdf72c2d1649cecbb760ae05c41c1372aae4c2447aa7c11539",
@@ -55,7 +55,7 @@
     "src/spaces.js": "45ef786537cb2a446db5e926e5a1c10b73639d2767dec84611f914f78d4325eb",
     "src/tools.js": "55960c9a677661763e0317fd54ccc787c2edb39c87371c7fbc40cd55f0761c04"
   },
-  "filesDigest": "961357bd4458bd6fa759f0a8d5bf042c7b652dcea3700363ae25d03299aa5027",
+  "filesDigest": "28a3bbd9bbcf966df9fae8ec6ea5be3441f6ab535c1636bb1ce33f67b827d423",
   "brainDigest": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4",
   "gateFingerprint": "6e53c784eee38310188948fc75fb49e6b4ebc04e247d01b903fa8c8a92d67bdd",
   "developmentPins": {

harness/ruview/.harness/manifest.sha256

@@ -1 +1 @@
-8a4cb8b2a5766455acbf936826d499ec12432e77f9c17f90526ebcdfdc08485d  manifest.json
+478ccaff9aa249bc7ea6e20551ccc9ac88697a3cc91a7b55400337c5e939a19e  manifest.json

harness/ruview/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@ruvnet/ruview",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ruvnet/ruview",
-      "version": "0.5.0",
+      "version": "0.5.1",
       "license": "MIT",
       "bin": {
         "ruview": "bin/cli.js"

harness/ruview/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ruvnet/ruview",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "RuView WiFi-sensing operator harness — onboard, calibrate, verify, enforce evidence guardrails, and read Cognitum Spaces through explicitly granted OAuth.",
   "type": "module",
   "bin": {

harness/ruview/src/guidance.js

@@ -250,7 +250,7 @@ const CAPABILITIES = Object.freeze([
       'The projection is read-only and grants no write, pairing, command, policy-approval, or actuator authority.',
       'MCP requires the credential-use grant; bearer tokens and API keys are never accepted as tool arguments.',
       'OAuth refresh may rotate the local credential file before a read returns.',
-      'Production evidence covers the legacy flat Spaces read. Versioned collections, spatial memory, and governed actions remain staged until workflow deployment/readback.',
+      'Production evidence covers legacy and versioned HTTPS reads. Spatial memory remains tenant/workspace-local, while governed actions remain separately policy-gated; neither expands OAuth authority.',
       'Persistent memory is local tenant/workspace state and governed actions expose authorization receipts only; neither expands OAuth authority.',
     ],
   },