From d284c702a69dc66985b4de84bfb7f7a184ba03b7 Mon Sep 17 00:00:00 2001 From: ruvnet Date: Wed, 19 Aug 2026 19:29:05 +0000 Subject: [PATCH] deploy: a3b6e1d500df784b9ad1846dd39deb07e2c69a34 --- ...ctivation-and-governed-spatial-exchange.md | 88 +++++++++++-------- 1 file changed, 52 insertions(+), 36 deletions(-) diff --git a/api-docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md b/api-docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md index 2d34690d..2a3fd423 100644 --- a/api-docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md +++ b/api-docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md @@ -1,6 +1,6 @@ # ADR-325: Cognitum Spaces activation and governed spatial exchange -- **Status**: Accepted — legacy read live; versioned hierarchy, local memory, and governed-action implementation validated on feature branches; deployment pending +- **Status**: Accepted — legacy and versioned reads, OAuth activation, local spatial memory, governed-action policy, metaharness support, and npm distribution are implemented; HTTPS production evidence is complete - **Date**: 2026-08-17 - **Deciders**: ruv - **Tags**: cognitum-spaces, oauth, spatial-state, privacy, ruvector, policy, autogenous @@ -423,41 +423,56 @@ Identity metadata deliberately advertises `spaces:read` for RuView but not publisher surface. RuView therefore has no OAuth write, command, policy-approval, or actuator capability. -This production evidence does not claim deployment of sites/buildings/floors/ -zones, entities, semantic event or alert resources, tenant-scoped RuVector -spatial history, MQTT reconciliation, governed actions, commands, or actuators. -The first three are implemented and locally validated in the 2026-08-19 feature -branches described below, but remain non-production until their workflow and -readback gates pass. Commands and actuators remain out of scope. +That receipt was for the initial flat Space slice. The following production +expansion supersedes only its hierarchy/event/alert deferral. MQTT, commands, +actuators, real-hardware accuracy, and the long-duration operational trial +remain outside the completed claim. -## Feature-branch implementation evidence (2026-08-19) +## Completed implementation and production expansion (2026-08-19) -- Cognitum API ADR-101 implements all eight `/v1/spatial` collections, coherent - transactional hierarchy checks, stable pagination, event/alert retention, - strict P2/P3 admission, API-key-only writes, and OAuth/API-key reads. The - Firestore emulator passed both the legacy and versioned verification scripts, - including cross-resource message replay denial. -- `ruview-cognitum-spaces` adds a strictly decoded, paged, read-only client for - every versioned collection. `wifi-densepose spaces --resource ...` exposes it - while preserving the legacy flat command. The focused client suite and the - CLI no-default-features test gate pass. -- The contributor metaharness now accepts `resource`, `limit`, and opaque - `cursor` on `ruview_spaces_list`, fixes the API origin, strips API-key - compatibility authority, and revalidates hierarchy/event/alert contracts. - Full metaharness, security, brain, flywheel, manifest, audit, and pack gates - pass for the `@ruvnet/ruview` 0.5.0 release candidate. -- ADR-326 adds `ruview-spatial-memory`: one RuVector HNSW index per authenticated - tenant/workspace, replay/derivation/retention gates, cascading erasure, - bounded explanations, and XChaCha20-Poly1305 snapshots with reload-verified - key rotation. Its focused crate suite passes with `SYNTHETIC` evidence. -- ADR-327 extends `ruview-policy` with typed observe/recommend/execute intents, - exact host grants, signed approvals, nonce/idempotency defense, the existing - ADR-321 assurance matrix, and signed hash-chained receipts. `spaces:read` is - explicitly denied as execution authority. Its focused crate suite passes. -- The required whole-workspace Rust command was attempted twice on Windows: - parallel compilation ended in a compiler-process stack-buffer-overrun and a - single-job retry reached the configured timeout without a source/test - diagnostic. This is not recorded as a green gate; Linux CI remains required. +- Cognitum API PRs #211 and #212 shipped the eight `/v1/spatial` collections, + transactional hierarchy integrity, stable pagination, event/alert retention, + strict P2/P3 admission, API-key-only writes, OAuth/API-key reads, and the + additive-only Firestore release authority. Function run `32279092861` + promoted active Node 22 revision `spacesapi-00005-kaf`. +- Edge PRs #214, #215, and #216 preserved canonical UUID routing, kept SQLi + denial, and removed secret-valued API-key rate selection. Gateway run + `32284410107` promoted the reviewed immutable digest to 100% production + traffic. Every versioned collection returned HTTP 200 through the public + edge; the hierarchy composite index is `READY` and both retention TTL fields + are `ACTIVE`. +- The dedicated RuView service credential was rotated to exactly + `spaces:read` and `spaces:write`; its predecessor returns 401. A non-mutating + invalid-body probe reached write validation without persisting customer data. + Other potentially affected owner keys and residual log retention remain + tracked in Cognitum API #217. +- A live RuView Authorization Code + S256 PKCE consent requested exactly + `sensing:read spaces:read`. Its in-memory token read versioned `sites` with + HTTP 200 and schema `1.0`; the verifier then revoked the temporary refresh + credential and persisted no token. +- RuView PR #1650 merged `ruview-cognitum-spaces`, + `ruview-spatial-memory`, the ADR-327 policy extension, CLI paging, and the + guarded `ruview_spaces_list` metaharness surface. PR #1651 removed stale + feature-branch guidance and refreshed the signed package manifest. +- The contributor metaharness fixes the API origin, accepts bounded resource, + limit, and opaque-cursor inputs, strips API-key compatibility authority over + MCP, invokes only the hardened OAuth CLI, and rejects raw sensing or malformed + hierarchy/event/alert output. Its test, security, reviewed-brain, flywheel, + manifest, audit, exact-tarball, and claim-check gates pass. +- Release run `32286297277` rebuilt and smoke-tested the exact package and + provenance-published `@ruvnet/ruview` 0.5.0. The public npm registry resolves + 0.5.0 as `latest`; no workstation publish was used. +- `ruview-spatial-memory` keeps one RuVector HNSW index per authenticated + tenant/workspace with replay, derivation, retention, cascading-erasure, + bounded-explanation, encrypted-snapshot, and reload-verified rotation gates. + This is local `SYNTHETIC` evidence, not a production sensing claim. +- `ruview-policy` keeps observe/recommend/execute intents distinct, requires + exact host grants plus signed approval for consequence, rejects nonce replay, + and emits signed hash-chained receipts. `spaces:read` is explicitly denied as + execution authority. +- Focused Rust gates and the Linux workspace/CLI/security lanes pass. Earlier + Windows whole-workspace attempts ended in host compiler failure or timeout; + those attempts are not reclassified as green evidence. - No OAuth write/action scope, actuator callback, MQTT deployment claim, sensing accuracy claim, or real-hardware claim is introduced. @@ -478,8 +493,9 @@ readback gates pass. Commands and actuators remain out of scope. - Two credential types coexist during migration and must stay visibly distinct. - OAuth depends on Identity JWKS availability and correct key rotation. -- Production currently exposes the legacy spaces slice; the implemented full - hierarchy/events/alerts model remains staged until deployment/readback. +- Production exposes both the legacy Space twins and the versioned hierarchy, + anonymous entities, semantic events, and alerts over HTTPS. MQTT remains a + design contract without deployment evidence. - OAuth workspace IDs will return only documents populated with `workspaceId`; legacy owner-only documents require an explicit migration, never a broad query. - The RuView client exposes no write, command, or agent execution surface. The