Merge pull request #1762 from ruvnet/codex/zone-aware-calibration

firmware: fail closed occupancy and stabilize C6 temporal sensing

.github/workflows/firmware-ci.yml

@@ -162,10 +162,14 @@ jobs:
           mkdir -p release-staging
           cp build/esp32-csi-node.bin                      release-staging/${{ matrix.artifact_app }}
           cp build/partition_table/partition-table.bin     release-staging/${{ matrix.artifact_pt }}
-          if [ "${{ matrix.variant }}" = "8mb" ]; then
-            cp build/bootloader/bootloader.bin             release-staging/bootloader.bin
-            cp build/ota_data_initial.bin                  release-staging/ota_data_initial.bin
-          fi
+          cp build/bootloader/bootloader.bin               release-staging/bootloader.bin
+          cp build/ota_data_initial.bin                    release-staging/ota_data_initial.bin
+          cp version.txt                                   release-staging/version.txt
+          (cd release-staging && sha256sum \
+            "${{ matrix.artifact_app }}" \
+            "${{ matrix.artifact_pt }}" \
+            bootloader.bin ota_data_initial.bin version.txt \
+            > SHA256SUMS.txt)
           ls -la release-staging/
 
       - name: Check QEMU ESP32-S3 support status

.github/workflows/iphone-lidar.yml

@@ -0,0 +1,70 @@
+name: iPhone LiDAR integration
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'integrations/iphone-lidar/**'
+      - 'docs/adr/ADR-340-iphone-lidar-sensor-bridge.md'
+      - '.github/workflows/iphone-lidar.yml'
+  pull_request:
+    paths:
+      - 'integrations/iphone-lidar/**'
+      - 'docs/adr/ADR-340-iphone-lidar-sensor-bridge.md'
+      - '.github/workflows/iphone-lidar.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  web:
+    name: Node relay and codec
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: integrations/iphone-lidar/web
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: integrations/iphone-lidar/web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run tests
+        run: npm test
+
+      - name: Audit runtime dependencies
+        run: npm audit --omit=optional --audit-level=high
+
+  ios:
+    name: iOS 17 compile
+    runs-on: macos-15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Compile native sources with strict concurrency
+        shell: bash
+        run: |
+          set -euo pipefail
+          sdk="$(xcrun --sdk iphoneos --show-sdk-path)"
+          build_dir="$RUNNER_TEMP/ruview-lidar-build"
+          mkdir -p "$build_dir"
+          cd "$build_dir"
+          xcrun swiftc \
+            -parse-as-library \
+            -target arm64-apple-ios17.0 \
+            -sdk "$sdk" \
+            -module-name RuViewLiDAR \
+            -strict-concurrency=complete \
+            -warnings-as-errors \
+            -emit-module \
+            -emit-module-path "$build_dir/RuViewLiDAR.swiftmodule" \
+            -c "$GITHUB_WORKSPACE"/integrations/iphone-lidar/native/RuViewLiDAR/*.swift

.github/workflows/npm-packages.yml

@@ -40,8 +40,9 @@ jobs:
           - dir: harness/ruview
             build: false
             publishable: true
-            # ADR-283: brain + local hosts + replay assets; still runtime-dependency-free.
-            unpacked_budget: 131072
+            # ADR-283/325: brain + local hosts + replay assets + guarded Spaces OAuth adapter;
+            # still runtime-dependency-free. 160 KiB is the reviewed hard ceiling.
+            unpacked_budget: 163840
           - dir: harness/homecore
             build: false
             publishable: true

.github/workflows/ruview-npm-release.yml

@@ -104,8 +104,8 @@ jobs:
         run: |
           set -euo pipefail
           case "${{ inputs.package }}" in
-            # ADR-283: brain + local hosts + replay assets; no runtime deps.
-            harness/ruview) export UNPACKED_BUDGET=131072 ;;
+            # ADR-283/325: brain + hosts + replay + guarded Spaces OAuth; no runtime deps.
+            harness/ruview) export UNPACKED_BUDGET=163840 ;;
             # ADR-285: CLI + MCP + reviewed brain + WASM-kernel adapter.
             harness/homecore) export UNPACKED_BUDGET=180000 ;;
             # ADR-264 O2: map-free tarball (was 188 kB with maps).

.github/workflows/security-scan.yml

@@ -14,6 +14,33 @@ env:
   PYTHON_VERSION: '3.11'
 
 jobs:
+  # Rust dependency advisories are deterministic for the checked-in lockfile,
+  # so this job gates the PR and retains the exact machine-readable report.
+  rust-audit:
+    name: Rust Dependency Audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+    - name: Install cargo-audit
+      run: cargo install cargo-audit --locked --version 0.22.2
+
+    - name: Audit the checked-in Rust lockfile
+      run: |
+        set -o pipefail
+        cargo audit --file v2/Cargo.lock --json | tee v2/cargo-audit.json
+
+    - name: Upload Rust advisory report
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      if: always()
+      with:
+        name: cargo-audit-report
+        path: v2/cargo-audit.json
+        if-no-files-found: error
+
   # Static Application Security Testing (SAST)
   sast:
     name: Static Application Security Testing

.github/workflows/sensing-server-docker.yml

@@ -28,6 +28,7 @@ on:
       - 'v2/crates/wifi-densepose-wifiscan/**'
       - 'v2/crates/wifi-densepose-bfld/**'
       - 'v2/crates/cog-ha-matter/**'
+      - 'v2/crates/homecore*/**'
       - 'v2/Cargo.toml'
       - 'v2/Cargo.lock'
       - 'ui/**'

AGENTS.md

@@ -47,17 +47,18 @@ from the current tree when needed.
 
 ## RuView contributor harness
 
-`@ruvnet/ruview@0.3.1` is the runtime-dependency-free contributor interface
+`@ruvnet/ruview@0.5.0` is the runtime-dependency-free contributor interface
 defined by ADR-283.
 
 ```bash
-npx @ruvnet/ruview@0.3.1 doctor
-npx @ruvnet/ruview@0.3.1 guidance --topic homecore --query "restore and plugins"
-npx @ruvnet/ruview@0.3.1 agent run \
+npx @ruvnet/ruview@0.5.0 doctor
+npx @ruvnet/ruview@0.5.0 guidance --topic homecore --query "restore and plugins"
+npx @ruvnet/ruview@0.5.0 agent run \
   --host codex --repo . --prompt "Find the nearest tests and cite files"
-npx @ruvnet/ruview@0.3.1 brain search --query "community memory"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.5.0 brain search --query "community memory"
+npx @ruvnet/ruview@0.5.0 brain verify --repo .
+npx @ruvnet/ruview@0.5.0 spaces
+npx @ruvnet/ruview@0.5.0 mcp start
 ```
 
 Start unfamiliar repository work with `ruview_guidance`. It returns reviewed

CLAUDE.md

@@ -45,7 +45,7 @@ retrieved memories, generated proposals, and old test counts are not.
 Do not hardcode crate, ADR, or test counts in instructions; derive them when a
 task needs them.
 
-## Contributor metaharness (`@ruvnet/ruview@0.3.1`)
+## Contributor metaharness (`@ruvnet/ruview@0.4.0`)
 
 ADR-283 defines the current community metaharness. It adds secure local
 Claude/Codex execution, a reviewed shared brain, default-deny MCP mutation
@@ -54,21 +54,24 @@ free of runtime dependencies.
 
 ```bash
 # Diagnose the installed harness
-npx @ruvnet/ruview@0.3.1 doctor
+npx @ruvnet/ruview@0.4.0 doctor
 
 # Get a source-cited capability map before unfamiliar work
-npx @ruvnet/ruview@0.3.1 guidance --topic homecore --query "restore and plugins"
+npx @ruvnet/ruview@0.4.0 guidance --topic homecore --query "restore and plugins"
 
 # Explore this trusted checkout through Claude Code (stdin, plan/safe mode)
-npx @ruvnet/ruview@0.3.1 agent run \
+npx @ruvnet/ruview@0.4.0 agent run \
   --host claude-code --repo . --prompt "Map the relevant subsystem and cite files"
 
 # Search reviewed, source-cited repository knowledge
-npx @ruvnet/ruview@0.3.1 brain search --query "community memory"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
+npx @ruvnet/ruview@0.4.0 brain search --query "community memory"
+npx @ruvnet/ruview@0.4.0 brain verify --repo .
+
+# Read the OAuth-bound Cognitum Spaces projection
+npx @ruvnet/ruview@0.4.0 spaces
 
 # Run the dependency-free RuView MCP server
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.4.0 mcp start
 ```
 
 `ruview_guidance` returns reviewed capability maturity, repository citations,

README.md

@@ -5,16 +5,7 @@
     <img src="assets/ruview-seed.png" alt="RuView - WiFi DensePose" width="100%">
   </a>
 </p>
-<p align="center">
-  <a href="https://cognitum.one/marketplace">
-    <img src="assets/musica-promo.png" alt="Cognitum Musica" width="100%">
-  </a>
-</p>
-<p align="center">
-  <a href="https://github.com/ruvnet/RuCelium">
-    <img src="assets/rucelium-hero.png" alt="RuCelium — environmental intelligence" width="100%">
-  </a>
-</p>
+
 
 ## **See through walls with WiFi** ##
 
@@ -49,25 +40,26 @@ Every WiFi router already fills your space with radio waves. When people move, b
 <details>
 <summary><strong>RuView MetaHarness</strong> — guided operation for humans and AI agents</summary>
 
-The RuView-specific metaharness we created is published as [`@ruvnet/ruview`](harness/ruview/README.md). It provides source-cited guidance, guarded Claude Code/Codex agents, deterministic verification, and an honesty check for accuracy claims.
+The RuView-specific metaharness we created is published as [`@ruvnet/ruview`](harness/ruview/README.md). It provides source-cited guidance, guarded Claude Code/Codex agents, deterministic verification, an honesty check for accuracy claims, and an explicitly granted OAuth-only Cognitum Spaces read.
 
 ```bash
 # Check the local setup and get source-cited guidance
-npx @ruvnet/ruview@0.3.1 doctor
-npx @ruvnet/ruview@0.3.1 guidance --topic sensing --query "model loading"
+npx @ruvnet/ruview@0.4.0 doctor
+npx @ruvnet/ruview@0.4.0 guidance --topic sensing --query "model loading"
 
 # Run a read-only RuView agent through Codex
-npx @ruvnet/ruview@0.3.1 agent run --host codex --repo . \
+npx @ruvnet/ruview@0.4.0 agent run --host codex --repo . \
   --prompt "Find the nearest tests and cite the source files"
 
 # Search or verify the reviewed contributor brain
-npx @ruvnet/ruview@0.3.1 brain search --query "calibration"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
+npx @ruvnet/ruview@0.4.0 brain search --query "calibration"
+npx @ruvnet/ruview@0.4.0 brain verify --repo .
 
 # Check claims, replay the deterministic proof, or expose the MCP server
-npx @ruvnet/ruview@0.3.1 claim-check --file REPORT.md
-npx @ruvnet/ruview@0.3.1 verify
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.4.0 claim-check --file REPORT.md
+npx @ruvnet/ruview@0.4.0 verify
+npx @ruvnet/ruview@0.4.0 spaces
+npx @ruvnet/ruview@0.4.0 mcp start
 ```
 
 Agent runs are read-only by default. Workspace writes require both `--allow-write` and `--confirm`; retrieved brain content is evidence, not authority.
@@ -244,8 +236,8 @@ See the measured benchmarks, witness records, and one-command reproducibility ch
 |------|-------|---------|
 | **MM-Fi pose model (SOTA)** | [`ruvnet/wifi-densepose-mmfi-pose`](https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose) | 82.69% torso-PCK@20 (single) · 83.59% (ensemble+TTA) · 75K-param micro variant 74.30% |
 | **AetherArena benchmark Space** | [`ruvnet/aether-arena`](https://huggingface.co/spaces/ruvnet/aether-arena) | self-correcting, auditable MM-Fi leaderboard |
-| **Full MM-Fi study (honest picture)** | [`docs/benchmarks/mmfi-wifi-sensing-study.md`](docs/benchmarks/mmfi-wifi-sensing-study.md) | pose + action; zero-shot cross-subject ~64%, +~30 s in-room calibration → 72.2% |
-| **Efficiency frontier** | [`docs/benchmarks/wifi-pose-efficiency-frontier.md`](docs/benchmarks/wifi-pose-efficiency-frontier.md) | SOTA-beating WiFi pose in a 20 KB int4 edge model |
+| **Full MM-Fi study (honest picture)** | [`docs/benchmarks/mmfi-wifi-sensing-study.md`](docs/benchmarks/mmfi-wifi-sensing-study.md) | pose + action; zero-shot cross-subject ~64%, labeled in-room calibration → 72.2% |
+| **Efficiency frontier** | [`docs/benchmarks/wifi-pose-efficiency-frontier.md`](docs/benchmarks/wifi-pose-efficiency-frontier.md) | SOTA-beating MM-Fi pose in a ~37 KB int4 model; live ESP32 compatibility not established |
 | **Pretrained encoder** | [`ruvnet/wifi-densepose-pretrained`](https://huggingface.co/ruvnet/wifi-densepose-pretrained) | 82.3% held-out temporal-triplet, 8 KB int4 |
 | **Reproducible proof (Trust Kill Switch)** | [`archive/v1/data/proof/verify.py`](archive/v1/data/proof/verify.py) + [`expected_features.sha256`](archive/v1/data/proof/expected_features.sha256) | one-command deterministic pipeline replay (SHA-256 of output vs published hash) |
 | **Benchmark-proof ADR** | [ADR-168](docs/adr/ADR-168-benchmark-proof.md) | how the numbers are produced and verified |
@@ -487,12 +479,20 @@ Neural Network: processed signals → 17 body keypoints + vital signs + room mod
 Output: real-time pose, breathing, heart rate, room fingerprint, drift alerts
 ```
 
-No training cameras required — the [Self-Learning system (ADR-024)](docs/adr/ADR-024-contrastive-csi-embedding-model.md) bootstraps from raw WiFi data alone. [MERIDIAN (ADR-027)](docs/adr/ADR-027-cross-environment-domain-generalization.md) ensures the model works in any room, not just the one it trained in.
+The [Self-Learning system (ADR-024)](docs/adr/ADR-024-contrastive-csi-embedding-model.md) provides
+camera-free representation-learning components. Cross-room pose remains a separate, data-gated
+problem: [MERIDIAN (ADR-027)](docs/adr/ADR-027-cross-environment-domain-generalization.md) is
+**Proposed**, while the measured calibration reference requires labeled CSI/keypoint pairs and
+model-specific adapters. See the [model compatibility boundary](docs/user-guide.md#model-and-capture-compatibility).
 
 ---
 
 ## 🏢 Use Cases & Applications
 
+> **Safety boundary:** these are research and prototype applications, not medical devices,
+> emergency systems, or safety-certified controls. Vital-sign and pose outputs require independent
+> validation on the exact hardware, room, subjects, and failure conditions before operational use.
+
 WiFi sensing works anywhere WiFi exists. No new hardware in most cases — just software on existing access points or a $8 ESP32 add-on. Because there are no cameras, deployments avoid privacy regulations (GDPR video, HIPAA imaging) by design.
 
 **Scaling:** Each AP distinguishes ~3-5 people (56 subcarriers). Multi-AP multiplies linearly — a 4-AP retail mesh covers ~15-20 occupants. No hard software limit; the practical ceiling is signal physics.
@@ -527,7 +527,7 @@ WiFi sensing works anywhere WiFi exists. No new hardware in most cases — just
 | Use Case | What It Does | Hardware | Key Metric | Edge Module |
 |----------|-------------|----------|------------|-------------|
 | **Smart home automation** | Room-level presence triggers (lights, HVAC, music) that work through walls — no dead zones, no motion-sensor timeouts | 2-3 ESP32-S3 nodes ($24) | Through-wall range ~5m | [HVAC Presence](docs/edge-modules/building.md), [Lighting Zones](docs/edge-modules/building.md) |
-| **Fitness & sports** | Rep counting, posture correction, breathing cadence during exercise — no wearable, no camera in locker rooms | 3+ ESP32-S3 mesh | Pose: 17 keypoints | [Breathing Sync](docs/edge-modules/exotic.md), [Gait Analysis](docs/edge-modules/medical.md) |
+| **Fitness & sports research** | Explore motion and breathing cadence without a wearable or camera; reliable posture correction requires a validated compatible pose model | 3+ ESP32-S3 mesh + edge host | Prototype; no live S3 pose accuracy claim | [Breathing Sync](docs/edge-modules/exotic.md), [Gait Analysis](docs/edge-modules/medical.md) |
 | **Childcare & schools** | Naptime breathing monitoring, playground headcount, restricted-area alerts — privacy-safe for minors | 2-4 ESP32-S3 per zone | Breathing: ±1 BPM | [Sleep Apnea](docs/edge-modules/medical.md), [Perimeter Breach](docs/edge-modules/security.md) |
 | **Event venues & concerts** | Crowd density mapping, crush-risk detection via breathing compression, emergency evacuation flow tracking | Multi-AP mesh (4-8 APs) | Density per m² | [Customer Flow](docs/edge-modules/retail.md), [Panic Motion](docs/edge-modules/security.md) |
 | **Stadiums & arenas** | Section-level occupancy for dynamic pricing, concession staffing, emergency egress flow modeling | Enterprise AP grid | 15-20 per AP mesh | [Dwell Heatmap](docs/edge-modules/retail.md), [Queue Length](docs/edge-modules/retail.md) |
@@ -694,7 +694,7 @@ claude --plugin-dir ./plugins/ruview
 
 Verify the plugin structure: `bash plugins/ruview/scripts/smoke.sh`. Full details: [`plugins/ruview/README.md`](plugins/ruview/README.md).
 
-For the portable RuView MetaHarness, use `npx @ruvnet/ruview@0.3.1`; the quick commands and fuller explanation are in the collapsed MetaHarness section near the top of this README and in [`harness/ruview/`](harness/ruview/README.md).
+For the portable RuView MetaHarness, use `npx @ruvnet/ruview@0.4.0`; the quick commands and fuller explanation are in the collapsed MetaHarness section near the top of this README and in [`harness/ruview/`](harness/ruview/README.md).
 
 </details>
 

aether-arena/calibration/README.md

@@ -1,8 +1,14 @@
 # RuView Calibration Service (reference implementation)
 
-Turn a **shared WiFi-CSI pose base model** into a room-specific one with a **30-second labeled
-calibration** and a **~11 KB per-room LoRA adapter**. This is the deployable resolution of the
-cross-subject / cross-environment generalization problem (full study: [ADR-150 §3.3–3.6](../../docs/adr/ADR-150-rf-foundation-encoder.md)).
+Fit a room-specific **~11 KB LoRA adapter** for a shared WiFi-CSI pose base from a short **labeled
+capture**. This is a measured MM-Fi reference path for cross-subject / cross-environment adaptation
+(full study: [ADR-150 §3.3–3.6](../../docs/adr/ADR-150-rf-foundation-encoder.md)); it is not proof of
+plug-and-play adaptation from a live ESP32 stream.
+
+> **Not the proposed MERIDIAN fast path.** Both producers below require paired CSI and keypoint
+> labels, and their tensor shapes and adapter files are model-specific. ADR-027's automatic,
+> unlabeled 10-second MERIDIAN calibration remains **Proposed** and is not implemented as an
+> end-to-end deployment command.
 
 ## Why
 
@@ -66,8 +72,8 @@ Adapters are **model-specific**. There are two calibration producers here:
 | `cog_calibrate.py` | cog **conv+MLP** (`pose_v1.safetensors`, 56×20) | `[N,56,20]` | `.safetensors` (`fc1.a`/`fc1.b`/`fc2.a`/`fc2.b`) | Rust `cog-pose-estimation run --adapter` |
 
 ```bash
-# Produce a cog-format per-room adapter for the deployed Rust pose engine:
-python cog_calibrate.py --base pose_v1.safetensors --data calib.npz --out room.safetensors
+# Produce a cog-format per-room adapter from X:[N,56,20], Y:[N,17,2]:
+python cog_calibrate.py --base pose_v1.safetensors --data cog-calib.npz --out room.safetensors
 # then in the cog runtime:
 cog-pose-estimation run --config <cfg> --adapter room.safetensors
 ```

docs/adr/ADR-262-rufield-ruview-integration.md

@@ -139,6 +139,32 @@ Implement the §3.3 mapping: `effective_class → PrivacyClass`, `cog-ha-matter`
 Add an opt-in `/ws/field` endpoint (or a `field_events` array on `SensingUpdate` behind a flag) carrying the signed `FieldEvent` + a privacy badge. Add an ingest route to `rufield-viewer` (it has none today — `server.rs:63-72`) so it can replay RuView's live feed instead of only `SyntheticSim`. **Gate:** a WS integration test asserting a connected client receives a privacy-badged, signature-verifiable `FieldEvent`; a viewer test asserting the new ingest route renders a live event. The `cognitum` appliance can speak RuField by consuming this endpoint (it already runs `ruview-vitals-worker`); deferred to its own ADR.
 
 **P4 — fusion composition + multi-modality (ARCHITECTURE, optional).**
+
+> **Update — second modality landed as a library.** Open question 5 below asked
+> whether the second modality should be `rvcsi`. It is **ultrasonic**, because
+> the cost collapsed: `rufield-adapters` now ships `UltrasonicReplayAdapter`,
+> the first adapter for `Modality::Ultrasonic` (registry code 7, empty since
+> v0.1), which parses, validates and signs [BatVu](https://github.com/ruvnet/batvu)
+> range profiles upstream. RuView only has to decide what it will put on a wire.
+>
+> `wifi-densepose-rufield::ultrasonic` is that decision, and it is expressed
+> structurally: the adapter is configured for its 32-bin coarse output (`P1`,
+> egress-safe) rather than its full per-bin frame (`P0`, edge-local), because a
+> consumer cannot un-coarsen a coarse profile whereas a runtime check can be
+> reordered. The `network_egress_allowed` gate still runs and is asserted to
+> drop nothing.
+>
+> Gates: `tests/ultrasonic_gates.rs`, 12 tests — round-trip, signature-verify,
+> fusion ingest, P1 on **both** tensor and observation, structural unreachability
+> of P4/P5, trust-tier refusal in both directions, determinism, whole-file
+> rejection of a malformed recording. Plus one asserting the honest negative
+> result: **an ultrasonic scan produces no fused inferences at all**, because the
+> adapter declines to populate `presence` (one transducer pair cannot tell a
+> person from a coat on a chair) and the engine's feature vocabulary is entirely
+> statements about a body. RuField v0.1 has no predicate for static geometry.
+>
+> Not wired into the running server. P1 shipped as a library before P3 wired it
+> in; this follows the same staging.
 Wire a second modality (cheapest: an `rvcsi`-sourced event, or recorded mmWave) into `RuFieldFusion` alongside the WiFi event, proving cross-modality fusion above ruvsense. **Gate:** a fusion test with two modalities producing ≥1 cross-modal inference, with provenance coverage 100%.
 
 ---

docs/adr/ADR-263-ruview-npm-harness-deep-review.md

@@ -2,7 +2,7 @@
 
 | Field | Value |
 |-------|-------|
-| **Status** | Accepted — **implemented** (O1–O9 in `@ruvnet/ruview@0.2.0`; security/community extension in `0.3.0`, ADR-283; source-cited guidance in `0.3.1`): fail-closed schemas and MCP policy, async dispatch, zero runtime dependencies, bounded/redacted local Claude/Codex adapters, reviewed shared brain, source-checked capability guidance, and replay-verified Darwin/Flywheel gate. CI gate: `ruview-harness-flywheel.yml` |
+| **Status** | Accepted — **implemented** (O1–O9 in `@ruvnet/ruview@0.2.0`; security/community extension in `0.3.0`, ADR-283; source-cited guidance in `0.3.1`; guarded Cognitum Spaces OAuth read in `0.4.0`, ADR-325): fail-closed schemas and MCP policy, async dispatch, zero runtime dependencies, bounded/redacted local Claude/Codex adapters, reviewed shared brain, source-checked capability guidance, credential-gated external reads, and replay-verified Darwin/Flywheel gate. CI gate: `ruview-harness-flywheel.yml` |
 | **Date** | 2026-07-02 |
 | **Deciders** | ruv |
 | **Codename** | **RUVIEW-NPM-REVIEW-1** |

docs/adr/ADR-283-ruview-community-metaharness-flywheel.md

@@ -31,6 +31,26 @@ bounded output/time, secret redaction and realpath-based RuView checkout
 validation. Write mode requires two explicit flags and never uses permission or
 sandbox bypasses.
 
+## Credentialed external reads
+
+Read-only cloud access is not equivalent to an uncredentialed local read. The
+Cognitum Spaces adapter therefore delegates OAuth and response validation to
+the Rust `wifi-densepose` client, never accepts bearer tokens or API keys, and
+removes the API-key compatibility environment from the child process. Its MCP
+tool is denied unless the server operator grants `credential-use`; MCP callers
+cannot select a credential path or API origin. The adapter uses only an
+installed `wifi-densepose` binary; it never executes Cargo build scripts from
+an auto-detected checkout while holding credential authority. The tool is
+marked open-world and independently rechecks response size, structure, privacy
+class, and prohibited raw fields.
+
+An expiring access token may rotate the stored refresh credential. The MCP
+annotation is therefore non-read-only and non-idempotent even though the cloud
+data operation is read-only. That bounded authentication side effect is
+disclosed in the schema and result. It does not change the cloud operation from
+read-only and confers no write or action authority. ADR-325 remains authoritative
+for the Spaces data and policy boundary.
+
 ## Shared brain
 
 The public brain is committed JSONL, not a shared mutable database. Canonical
@@ -67,5 +87,6 @@ autonomously promotes or publishes an evolved candidate.
 Contributors can explore RuView with either major local CLI and share durable
 findings without sharing secrets. Improvements become reproducible proposals
 with frozen evaluation evidence. The cost is a larger development-only npm
-lockfile, a 128 KiB unpacked-package budget (the current tarball is below that
-bound), and explicit maintenance of the corpus, genome and gate.
+lockfile, a 160 KiB unpacked-package budget after adding the duplicated host
+playbook and bounded OAuth adapter (the package remains runtime-dependency-free),
+and explicit maintenance of the corpus, genome and gate.

docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md

@@ -1,6 +1,6 @@
 # ADR-325: Cognitum Spaces activation and governed spatial exchange
 
-- **Status**: Accepted — read path implemented; write path remains policy-gated
+- **Status**: Accepted — legacy and versioned reads, OAuth activation, local spatial memory, governed-action policy, metaharness support, and npm distribution are implemented; HTTPS production evidence is complete
 - **Date**: 2026-08-17
 - **Deciders**: ruv
 - **Tags**: cognitum-spaces, oauth, spatial-state, privacy, ruvector, policy, autogenous
@@ -112,6 +112,17 @@ OAuth consent grants identity-bound read access. It does **not** grant device
 pairing, data publication, deployment, billing, spending, leases, learning
 promotion, automation installation, commands, or actuator authority.
 
+The contributor metaharness exposes this as CLI verb `spaces` and MCP tool
+`ruview_spaces_list`. It delegates to the same Rust client rather than parsing
+or refreshing OAuth independently. The tool never accepts a bearer token or API
+key. MCP use requires an operator-provided `credential-use` grant, and MCP calls
+cannot select the credential path or API origin. The adapter requires an
+installed `wifi-densepose` binary rather than executing Cargo build scripts
+from an auto-detected checkout while holding credential authority. Because
+refresh tokens rotate, a read may atomically update the local OAuth credential
+before contacting Spaces; this authentication side effect is disclosed and
+does not add cloud write authority.
+
 ### 2. The gateway owns the private credential relay
 
 The public gateway strips inbound `X-Cognitum-User-Authorization` and
@@ -271,6 +282,11 @@ action. This ADR adds no actuator method to the Spaces client.
   persist-before-return mechanism, verifies that the stored grant contains
   `spaces:read`, and lists validated state. `COGNITUM_SPACES_API` remains an
   explicit compatibility path.
+- the dependency-free contributor metaharness adds `spaces` /
+  `ruview_spaces_list`, invokes only the OAuth branch, bounds and revalidates
+  child output, fixes the production API origin, strips the API-key compatibility
+  environment, requires an installed binary, and default-denies MCP access
+  without `credential-use`.
 
 ### Cognitum Identity
 
@@ -285,6 +301,8 @@ action. This ADR adds no actuator method to the Spaces client.
   relay while authenticating the private Function hop;
 - Spaces verifies the signed OAuth principal and queries by tenant + workspace;
 - legacy API-key behavior remains available;
+- bounded semantic-state `PUT` is available only to an explicitly scoped API-key
+  publisher and is not exposed by the RuView OAuth client;
 - OpenAPI documents both alternatives and RFC 9728 metadata supports discovery;
 - the Function remains gateway-only at Cloud Run IAM.
 
@@ -323,8 +341,8 @@ Rollout order is dependency-safe:
 2. deploy the Spaces Function with OAuth verification while API-key behavior
    remains unchanged;
 3. deploy the gateway relay and protected-resource metadata;
-4. verify gateway API-key access, OAuth denial matrices, direct-URL `403`, and
-   tenant isolation;
+4. verify gateway API-key access, OAuth denial matrices, direct-origin platform
+   denial (`401` or `403` before application code), and tenant isolation;
 5. merge/release the RuView client and CLI activation;
 6. enable Autogenous consumption only after its strict validation/lineage gates
    pass.
@@ -357,7 +375,8 @@ Production readback must prove:
 - valid RuView OAuth returns only its workspace;
 - wrong client, missing `spaces:read`, setup/workload token, and second-tenant
   token are denied;
-- direct Function URL returns `403` even with a valid application credential;
+- the direct Function origin is rejected by the Google platform with `401` or
+  `403` before application code, even with a valid application credential;
 - response remains `no-store` and excludes P0/P1;
 - no secret appears in logs, diffs, artifacts, or issue/PR text.
 
@@ -366,6 +385,97 @@ this decision. Any such number requires a named reproducer and the repository's
 evidence labels. An empty production tenant is a successful isolation/read-path
 test, not sensing-quality evidence.
 
+## Production evidence (2026-08-18)
+
+The bounded Spaces read slice and RuView activation path are deployed. The exact
+production release chain is:
+
+- Spaces run `32148530629`, revision `spacesapi-00003-xij`, source
+  `fc333e634cd918b9d6fdde4eecbe7beac1043ab8`, Node 22, runtime service account
+  `spacesapi-runtime@cognitum-20260110.iam.gserviceaccount.com`, with
+  `apigateway-sa@cognitum-20260110.iam.gserviceaccount.com` as sole invoker;
+- gateway run `32151485401`, revision `apigateway-00180-peh`, source
+  `c4e99ebb4ce0d4e1407f435f905621476c1f0166`, image digest
+  `sha256:bacb81281a54256ff6fdaac253175e76ce6fc225f399163ca0a807a2839bd6a3`;
+- Identity run `32163542502`, revision `identity-00052-fid`, source
+  `fb6320827b879e481cad6caf184d3cbccd8279c4`, image digest
+  `sha256:0cd5896518bd8ecf042d2f3e9aea58a32e65a68dbddaab1e54f8ae6da2bfab06`,
+  and runtime service account
+  `identity-runtime-prod@cognitum-20260110.iam.gserviceaccount.com`.
+
+The live API-key matrix returned `200` with an empty bounded list,
+`Cache-Control: private, no-store`, and no prohibited P0/P1 projection fields.
+No credential returned `401`. A direct-origin request received a Google
+Frontend Bearer challenge (`401`) before application code.
+
+Two independent RuView Authorization Code + PKCE principals also passed the
+live matrix. Each token used ES256, exact issuer/audience/client checks,
+`sensing:read spaces:read`, signed UUID organization/workspace claims, refresh
+rotation, and revocation. Each gateway read returned `200`, an empty bounded
+list, and `private, no-store`; a corrupted signature returned `401`; and the
+principals had distinct pseudonymous tenant/workspace fingerprints. This proves
+the production empty-tenant behavior and independent claim binding. Non-empty
+cross-tenant isolation remains emulator/staging evidence because production was
+not mutated to manufacture a fixture.
+
+Identity metadata deliberately advertises `spaces:read` for RuView but not
+`spaces:write`. The deployed semantic-state `PUT` remains an API-key-only
+publisher surface. RuView therefore has no OAuth write, command, policy-approval,
+or actuator capability.
+
+That receipt was for the initial flat Space slice. The following production
+expansion supersedes only its hierarchy/event/alert deferral. MQTT, commands,
+actuators, real-hardware accuracy, and the long-duration operational trial
+remain outside the completed claim.
+
+## Completed implementation and production expansion (2026-08-19)
+
+- Cognitum API PRs #211 and #212 shipped the eight `/v1/spatial` collections,
+  transactional hierarchy integrity, stable pagination, event/alert retention,
+  strict P2/P3 admission, API-key-only writes, OAuth/API-key reads, and the
+  additive-only Firestore release authority. Function run `32279092861`
+  promoted active Node 22 revision `spacesapi-00005-kaf`.
+- Edge PRs #214, #215, and #216 preserved canonical UUID routing, kept SQLi
+  denial, and removed secret-valued API-key rate selection. Gateway run
+  `32284410107` promoted the reviewed immutable digest to 100% production
+  traffic. Every versioned collection returned HTTP 200 through the public
+  edge; the hierarchy composite index is `READY` and both retention TTL fields
+  are `ACTIVE`.
+- The dedicated RuView service credential was rotated to exactly
+  `spaces:read` and `spaces:write`; its predecessor returns 401. A non-mutating
+  invalid-body probe reached write validation without persisting customer data.
+  Other potentially affected owner keys and residual log retention remain
+  tracked in Cognitum API #217.
+- A live RuView Authorization Code + S256 PKCE consent requested exactly
+  `sensing:read spaces:read`. Its in-memory token read versioned `sites` with
+  HTTP 200 and schema `1.0`; the verifier then revoked the temporary refresh
+  credential and persisted no token.
+- RuView PR #1650 merged `ruview-cognitum-spaces`,
+  `ruview-spatial-memory`, the ADR-327 policy extension, CLI paging, and the
+  guarded `ruview_spaces_list` metaharness surface. PR #1651 removed stale
+  feature-branch guidance and refreshed the signed package manifest.
+- The contributor metaharness fixes the API origin, accepts bounded resource,
+  limit, and opaque-cursor inputs, strips API-key compatibility authority over
+  MCP, invokes only the hardened OAuth CLI, and rejects raw sensing or malformed
+  hierarchy/event/alert output. Its test, security, reviewed-brain, flywheel,
+  manifest, audit, exact-tarball, and claim-check gates pass.
+- Release run `32286297277` rebuilt and smoke-tested the exact package and
+  provenance-published `@ruvnet/ruview` 0.5.0. The public npm registry resolves
+  0.5.0 as `latest`; no workstation publish was used.
+- `ruview-spatial-memory` keeps one RuVector HNSW index per authenticated
+  tenant/workspace with replay, derivation, retention, cascading-erasure,
+  bounded-explanation, encrypted-snapshot, and reload-verified rotation gates.
+  This is local `SYNTHETIC` evidence, not a production sensing claim.
+- `ruview-policy` keeps observe/recommend/execute intents distinct, requires
+  exact host grants plus signed approval for consequence, rejects nonce replay,
+  and emits signed hash-chained receipts. `spaces:read` is explicitly denied as
+  execution authority.
+- Focused Rust gates and the Linux workspace/CLI/security lanes pass. Earlier
+  Windows whole-workspace attempts ended in host compiler failure or timeout;
+  those attempts are not reclassified as green evidence.
+- No OAuth write/action scope, actuator callback, MQTT deployment claim, sensing
+  accuracy claim, or real-hardware claim is introduced.
+
 ## Consequences
 
 ### Positive
@@ -375,19 +485,22 @@ test, not sensing-quality evidence.
 - Tenant and workspace become cryptographically bound inputs to the data query.
 - RuView and Autogenous gain useful spatial context without importing raw RF or
   inventing independent evidence.
-- RuVector can ground explanations in local/tenant history while action remains
-  separately governed.
+- The design keeps a path for RuVector-grounded explanations and separately
+  governed action without treating either as part of the deployed read slice.
 - The direct-origin bypass is closed permanently, independent of OAuth rollout.
 
 ### Costs and limitations
 
 - Two credential types coexist during migration and must stay visibly distinct.
 - OAuth depends on Identity JWKS availability and correct key rotation.
-- The current API exposes spaces only; the full hierarchy/events/alerts model
-  remains staged work.
+- Production exposes both the legacy Space twins and the versioned hierarchy,
+  anonymous entities, semantic events, and alerts over HTTPS. MQTT remains a
+  design contract without deployment evidence.
 - OAuth workspace IDs will return only documents populated with `workspaceId`;
   legacy owner-only documents require an explicit migration, never a broad query.
-- No write, command, or agent execution surface is implemented by this ADR.
+- The RuView client exposes no write, command, or agent execution surface. The
+  separate API-key semantic-state ingress is neither OAuth activation nor
+  actuator authority.
 
 ## Alternatives considered
 
@@ -416,6 +529,14 @@ the edge privacy boundary and is unnecessary for the semantic product.
 
 - Autogenous ADR-402, `docs/adr/ADR-402-ruview-cognitum-spaces-spatial-intelligence.md`
 - Cognitum API ADR-094, `docs/adr/ADR-094-cognitum-spaces-homecore-edge-boundary.md`
+- Cognitum API hierarchy/events/alerts follow-up,
+  `https://github.com/cognitum-one/api/issues/206`
+- RuView metaharness OAuth surface,
+  `https://github.com/ruvnet/RuView/issues/1643`
+- RuVector spatial-history follow-up,
+  `https://github.com/ruvnet/RuView/issues/1640`
+- governed-action and witness-receipt follow-up,
+  `https://github.com/ruvnet/RuView/issues/1641`
 - RFC 7636, Proof Key for Code Exchange
 - RFC 8414, OAuth 2.0 Authorization Server Metadata
 - RFC 9700, OAuth 2.0 Security Best Current Practice

docs/adr/ADR-326-tenant-scoped-ruvector-spatial-memory.md

@@ -0,0 +1,137 @@
+# ADR-326: Tenant-scoped RuVector spatial memory and anomaly explanations
+
+- **Status**: Accepted — implementation complete; repository-wide and deployment gates pending
+- **Date**: 2026-08-19
+- **Decision owners**: RuView maintainers
+- **Extends**: ADR-312, ADR-319, ADR-325
+- **Implements**: ruvnet/RuView#1640
+- **Tags**: cognitum-spaces, ruvector, memory, tenant-isolation, explanation, privacy
+
+## Context
+
+ADR-325 requires anomaly explanations grounded in tenant-local spatial history,
+but the deployed client only returns a current list. A global vector index would
+be unsafe: filtering nearest-neighbor results after the search can reveal that a
+different tenant has a close match, even when identifiers are removed. A memory
+record can also launder returned RuView-derived state into a second independent
+observation, reset freshness, or form circular evidence.
+
+Spatial memory must be useful without storing OAuth/API credentials, raw CSI/CIR,
+RF tensors, pose frames, vital waveforms, recordings, identity observations, or
+unbounded agent transcripts. Persistence also needs explicit retention,
+deletion, provenance, and key-rotation behavior.
+
+## Decision
+
+### 1. Partition before similarity
+
+`ruview-spatial-memory` owns a `SpatialMemory` map keyed by the exact authenticated
+`(tenant_id, workspace_id)` pair. Each partition owns its own RuVector HNSW index.
+Ingest and search resolve the partition first; no global ANN query exists. Site,
+space, schema version, and time-window constraints narrow within the selected
+partition before results are returned.
+
+### 2. Bounded semantic records
+
+An accepted record contains:
+
+- tenant/workspace/site/space and stable record identity;
+- source ID, message ID, record ID, monotonic event sequence, schema version;
+- original `observed_at`/`expires_at` and a retention deadline;
+- a bounded finite semantic feature vector, uncertainty, and evidence label;
+- provenance and witness digests, plus bounded derivation references;
+- explicit observation/inference classification.
+
+Credentials and P0/P1 fields have no representation in the type. Strings,
+features, references, record counts, and query `k` are bounded. Non-finite
+features and uncertainty fail closed.
+
+### 3. Lineage and replay
+
+The partition rejects:
+
+- changed reuse of `(source_id, message_id)`;
+- a non-increasing sequence for the same source;
+- duplicate derivation references;
+- self-reference, missing/forward parents, and therefore every cycle;
+- expired input or a provenance/witness substitution.
+
+A recollection keeps its original lineage, timestamp, uncertainty, and evidence
+label. It cannot increment corroborating-source count or become independent
+support for its own ancestor.
+
+### 4. Persistent encrypted storage
+
+Snapshots are encrypted with XChaCha20-Poly1305 under a caller-supplied 256-bit
+key and a non-secret key ID. The authenticated associated data binds the storage
+format and key ID. The envelope is bounded and versioned; plaintext spatial
+records are never written to disk. Loading requires a keyring containing the
+named key. Rotation decrypts with the old key, atomically creates a new
+generation under the new key ID, reload-verifies that generation, and leaves
+the source intact. Snapshots never overwrite an existing path implicitly.
+
+Deletion supports a tenant/workspace partition, a record, and retention cutoff.
+Every deletion rebuilds that partition's HNSW index so removed records cannot be
+returned from stale graph nodes.
+
+### 5. Explanations
+
+`explain` compares a bounded query vector with nearest tenant-local history and
+returns the exact authenticated partition, generation time, ordered record IDs,
+RuVector distances, original uncertainty/evidence labels, and provenance/witness
+digests. Its basis explicitly says that similarity is not causation. The API
+does not expose the vectors or invent a causal explanation.
+
+History provides context, not authority. An explanation cannot authorize an
+action, increase certificate class, or replace a policy decision.
+
+## Consequences
+
+### Positive
+
+- Cross-tenant ANN leakage is structurally unavailable.
+- Explanations cite the exact tenant-local records used.
+- Replay/cycle/provenance substitution are rejected before indexing.
+- Encrypted persistence has explicit key IDs and rotation behavior.
+
+### Costs and limitations
+
+- Partition-local HNSW uses more indexes than a global graph.
+- Deletes and key rotation rebuild indexes.
+- No detection-quality or latency claim is made; tests are `SYNTHETIC` unless a
+  reproducer explicitly marks a measurement.
+- Cloud Cognitum does not receive the local encrypted memory file.
+
+## Validation
+
+- cross-tenant and cross-workspace nearest-neighbor denial;
+- duplicate record/message, stale-sequence, self/duplicate/missing-parent, and
+  provenance-substitution tests;
+- expiry, retention deletion, whole-partition deletion, sealed round-trip,
+  tamper rejection, wrong-key rejection, and key-rotation tests;
+- explanation citations and retained evidence/provenance labels;
+- no forbidden raw-field or credential representation;
+- the focused `ruview-spatial-memory` crate suite passes with `SYNTHETIC`
+  evidence on 2026-08-19;
+- the whole-workspace Windows gate was non-terminal (compiler crash in parallel,
+  timeout when serialized), so Linux CI, a RustSec advisory scan, and package
+  review remain release gates.
+
+## Alternatives considered
+
+**One global HNSW followed by filtering.** Rejected: ranking itself crosses the
+tenant boundary.
+
+**Cloud vector memory.** Rejected as the default: it expands the privacy and
+credential boundary without being needed for local explanations.
+
+**Plain JSONL persistence.** Rejected because tenant spatial history is sensitive
+even when raw sensing is excluded.
+
+## References
+
+- ADR-312: Long-term spatial memory
+- ADR-319: Witness chain
+- ADR-325: Cognitum Spaces activation and governed exchange
+- Cognitum API ADR-101
+- ruvnet/RuView#1640

docs/adr/ADR-327-governed-action-intents-and-witness-receipts.md

@@ -0,0 +1,133 @@
+# ADR-327: Governed action intents, approvals, replay protection, and witness receipts
+
+- **Status**: Accepted — implementation complete; repository-wide and deployment gates pending
+- **Date**: 2026-08-19
+- **Decision owners**: RuView maintainers
+- **Extends**: ADR-318, ADR-319, ADR-321, ADR-325
+- **Implements**: ruvnet/RuView#1641
+- **Tags**: policy, governed-action, approval, idempotency, witness, cognitum-spaces
+
+## Context
+
+The current `ruview-policy` crate evaluates assurance for an action class, but it
+does not define a complete action intent, tenant/workspace binding, policy
+version, approval, nonce/idempotency replay behavior, or signed terminal receipt.
+An agent recommendation can therefore be mistaken for execution authority, and
+`spaces:read` could be accidentally treated as a general capability.
+
+The system needs a framework that can prove why an action was allowed or denied
+without adding any actuator. Real actuation remains a separate integration and
+requires its own threat model and device evidence.
+
+## Decision
+
+### 1. Typed intent and registered policy
+
+A governed `ActionIntent` binds:
+
+- intent ID, tenant, workspace, action name/class, and exact target;
+- requested policy version and parameter/evidence digests;
+- creation/expiry, replay nonce, and requesting principal;
+- the recommendation/explanation that motivated review, never a hidden command.
+
+The gate accepts only a registered action policy. Unknown action, action-class
+mismatch, policy-version mismatch, target mismatch, invalid timestamps, and
+missing exact host authority deny before assurance is evaluated. Tenant and
+workspace are part of the signed intent/receipt and nonce key. `spaces:read` is
+explicitly tested as insufficient for an `alerts:execute` rule.
+
+### 2. Assurance and approval
+
+The existing ADR-321 certificate/domain/uncertainty/evidence gate remains the
+assurance authority. The registered policy declares a bounded minimum of
+distinct enrolled approvers. An absent, rejected, duplicated, expired,
+wrong-intent, wrong-policy-version, or unverifiable approval denies. Approval
+resolution fails closed.
+
+Agents observe, explain, or recommend by default. `evaluate` returns a decision
+receipt; it does not call an actuator. An executor may consume an `allow` receipt
+only if a separate adapter verifies the receipt, target, expiry, and its own
+device-specific authority.
+
+### 3. Replay and idempotency
+
+The bounded in-memory gate stores terminal receipts by intent ID and tracks
+nonces by `(tenant, workspace, nonce)`.
+
+- exact intent replay returns the original terminal receipt;
+- changed reuse of an intent ID returns a fail-closed idempotency error;
+- reuse of a nonce by another intent returns a fail-closed replay error;
+- expired intents and approvals deny;
+- failed or denied attempts are terminal and auditable.
+
+The current state store is bounded and in-memory, intended for local/runtime use
+rather than cross-process replay protection. A production executor must place
+the same intent/nonce/receipt invariants behind a transactional durable store;
+this ADR does not claim that adapter exists.
+
+### 4. Witnessed terminal receipt
+
+Every evaluated observe/recommend/execute request produces a canonical receipt
+containing the intent digest, decision/reason, policy version, tenant/workspace,
+decision/expiry time, intent ID and nonce, approval count, and previous receipt
+digest. The receipt is signed through the `ruview-attest` signer interface and
+can be independently verified. Hash chaining makes removal/reordering visible.
+Malformed input, ID conflict, nonce replay, capacity exhaustion, and sequence
+exhaustion are errors before receipt creation and must be audited by the host.
+
+The reference keyed-BLAKE3 signer remains `SYNTHETIC` evidence only, as documented
+by ADR-319. Production asymmetric signing and key custody must be supplied by the
+deployment adapter; no symmetric test MAC is represented as hardware identity.
+
+## Consequences
+
+### Positive
+
+- Recommendation, authorization, and execution are distinct typed stages.
+- Default-deny covers missing policy, stale evidence, unavailable approval, and replay.
+- Every decision has a terminal, verifiable explanation.
+- `spaces:read` cannot silently expand into consequence.
+
+### Costs and limitations
+
+- Executors must implement a separate receipt-verifying adapter.
+- Distributed replay protection needs a transactional durable store.
+- This ADR implements no actuator, command transport, pairing mutation, or device control.
+- Simulator tests are not hardware validation.
+
+## Validation
+
+- unknown/missing policy, stale intent, policy-version/target mismatch,
+  insufficient authority, and `spaces:read`-only denial;
+- certificate/domain/uncertainty/evidence denial matrix from ADR-321;
+- missing/rejected/expired/duplicate/wrong-intent approval tests;
+- exact idempotent replay, changed reuse, nonce replay, and bounded-store tests;
+- receipt signature, canonical digest, chain linkage, and tamper rejection;
+- tests proving evaluation exposes no actuator callback or network/file side effect.
+
+The focused `ruview-policy` suite passes on 2026-08-19. The reference signer
+tests are `SYNTHETIC`; they are not hardware-identity evidence. The non-terminal
+whole-workspace Windows gate still requires authoritative Linux CI evidence.
+
+Any future actuator adds a separate ADR, credential boundary, failure/rollback
+plan, allow/deny integration tests, and captured target-device evidence.
+
+## Alternatives considered
+
+**Let agents call actuators after a recommendation.** Rejected: recommendation
+quality is not authorization.
+
+**Treat OAuth scopes as action policy.** Rejected: `spaces:read` expresses read
+consent only and carries no target-specific assurance or approval.
+
+**Emit receipts only for successful actions.** Rejected: denial and unavailable
+approval are security-relevant terminal facts.
+
+## References
+
+- ADR-318: Capability certificates
+- ADR-319: Witness chain
+- ADR-321: Decision policy action authorization
+- ADR-325: Cognitum Spaces activation and governed exchange
+- ADR-326: Tenant-scoped RuVector spatial memory
+- ruvnet/RuView#1641

docs/adr/ADR-340-iphone-lidar-sensor-bridge.md

@@ -0,0 +1,59 @@
+# ADR 340: iPhone LiDAR Sensor Bridge
+
+Status: Proposed
+
+## Context
+
+RuView needs a low cost mobile geometry sensor that can contribute calibrated spatial observations without coupling the perception substrate to Apple frameworks.
+
+ARKit exposes rear LiDAR scene depth through `ARFrame.sceneDepth` and `smoothedSceneDepth` on supported devices. Ordinary mobile web pages do not receive this ARKit depth surface directly, so native capture and web visualization must be separated.
+
+## Decision
+
+Use a two layer architecture.
+
+1. Native Swift and ARKit perform acquisition.
+2. A modality neutral wire frame transports geometry into browser tools and, next, the RuView HAL.
+
+The native client will capture depth, confidence, camera intrinsics, and world tracking pose. RGB imagery is excluded from the default transport.
+
+The protocol identifier is `ruview.lidar.depth.v1`.
+
+Depth samples are quantized to UInt16 millimeters for transport. Confidence remains UInt8. The default sender downsamples by two spatially and caps transmission at 15 FPS. Full fidelity depth remains available locally for future on device inference.
+
+## RuView integration boundary
+
+The transport must not become a second world model. The production receiver converts each packet into the canonical `ruview-hal::Observation`, then passes it through authenticated sensor identity, provenance, OOD gating, uncertainty aware fusion, spatial memory, and WorldGraph adapters.
+
+Rules:
+
+1. `source=live` is valid only for frames produced by an active ARKit session.
+2. Sequence numbers are monotonic per sensor session.
+3. Wall clock timestamp is separate from ARKit monotonic frame timing.
+4. RGB is off by default and requires an explicit higher privacy capability.
+5. Browser clients consume geometry but are not treated as authoritative sensors.
+6. Unsupported devices fail closed rather than substituting simulated depth.
+
+## Performance target
+
+`[SYNTHETIC]` A 256 x 192 Float32 depth map is about 196 KB before confidence and metadata. Downsampling to 128 x 96 and encoding each sample as two byte depth plus one byte confidence yields about 36.9 KB raw. At 15 FPS the raw sensor payload is about 553 KB/s. Base64 raises this to roughly 737 KB/s before JSON metadata. These values are arithmetic sizing estimates, not device measurements.
+
+The `[CLAIMED target]` for local network latency is below 150 ms p95. A later binary WebSocket or QUIC transport can remove base64 overhead; the exact end-to-end reduction must be measured before it is claimed.
+
+## Security
+
+The development relay is LAN-facing, requires a random per-run bearer token, bounds message size, and restricts the files it serves. Its default `ws://` transport is not encrypted, so it is not a production trust boundary.
+
+Production requires WSS, authenticated sensor identity, replay protection, message size limits, per tenant authorization, provenance receipts, and explicit retention policy before persistence.
+
+## Consequences
+
+Benefits include commodity hardware, metric depth, tracked camera pose, rapid room scanning, calibration support for RF sensing, and a practical ground truth source for RuView experiments.
+
+The main limitation is that Apple provides processed scene depth rather than the underlying raw transient LiDAR waveform. Therefore this implementation supports direct geometry and sensor fusion now, but does not reproduce research systems that require raw multipath time of flight transients for non line of sight reconstruction.
+
+## Acceptance criteria
+
+A physical LiDAR capable iPhone must stream live geometry to the browser viewer with monotonically increasing sequence numbers, no RGB payload, valid confidence maps, and below 150 ms p95 local network latency over a 60 second run.
+
+CI type-checking and simulator runs do not satisfy this criterion. Until a captured physical-device run records the environment and results, the hardware behavior and latency remain unverified.

docs/adr/ADR-344-adaptive-local-installation-discovery.md

@@ -0,0 +1,93 @@
+# ADR-344: Adaptive local installation discovery
+
+## Status
+
+Accepted — local advertisement and mobile discovery implemented; physical
+peer-link and hosted-relay qualification pending.
+
+## Context
+
+RuView installations previously depended on a manually stored IP address.
+DHCP changes, access-point changes, and client isolation could therefore leave
+a healthy sensing installation unreachable from the mobile app. Repeated
+authentication-policy log entries did not prove that the selected endpoint was
+reachable.
+
+Discovery must make commissioning recoverable without turning a service name
+into authentication, leaking sensor data, scanning arbitrary subnets, or
+silently moving private spatial data to a hosted service.
+
+## Decision
+
+The sensing server advertises one bounded `_ruview._tcp.local.` service when it
+is bound to a routable interface. Loopback-only instances do not advertise,
+and operators can disable advertisement with `--no-mdns`.
+
+The TXT contract is deliberately small:
+
+| Key | Required | Meaning |
+|---|---:|---|
+| `schema=ruview.installation.v1` | yes | Fail-closed protocol discriminator |
+| `tls=0|1` | yes | HTTP or HTTPS origin construction |
+| `installation=<opaque id>` | no | Bounded routing hint, never authentication |
+
+The advertisement contains no node inventory, room identifier, SSID,
+credentials, CSI, vital estimates, pose, identity, or learning data. The
+hostname is bounded and sanitized before registration. Advertisement failure
+is recoverable and does not stop sensing.
+
+RuView Mobile resolves only the matching service and schema, validates the
+resulting origin under its private-LAN/HTTPS policy, and requires an application
+health probe before selection. Its adaptive broker retains the configured
+origin preference and requires two failed configured probes plus two healthy
+fallback probes before switching. Credentials remain scoped to their saved
+origin.
+
+The recovery ladder is:
+
+1. configured private-LAN or HTTPS origin;
+2. verified Bonjour local origin;
+3. physically qualified Apple peer-to-peer local path;
+4. explicit, authenticated HTTPS relay for bounded derived frames only;
+5. optional administrator-managed WireGuard/Tailscale access.
+
+Only levels 1 and 2 are implemented and software-validated by this decision.
+Peer-to-peer browsing is enabled on Apple platforms, but it is not a qualified
+peer-link data plane. This repository does not provide a hosted relay and must
+fail closed when no local endpoint is healthy.
+
+## Security and privacy consequences
+
+- Service discovery is routing evidence, not installation authentication.
+- Public HTTP origins, credentials in URLs, malformed records, and records with
+  the wrong schema are rejected before use.
+- Raw CSI, RSSI streams, camera/LiDAR frames, room geometry, pose labels,
+  identity data, and training examples remain local.
+- Future relay work requires a separate consent, authentication, revocation,
+  minimization, and physical evidence review.
+- ESP32-S3/C6 nodes remain provisioned to the sensing installation. This ADR
+  does not claim direct phone-to-node discovery or invent a firmware protocol.
+
+## Validation
+
+Software acceptance requires:
+
+- unit tests for bounded advertisement construction and hostname sanitation;
+- mobile parser rejection, route scoring, anti-flapping, and Settings UI tests;
+- Rust, TypeScript, lint, security, metaharness, Expo, and native compile gates;
+- a real Bonjour resolve of the TXT contract followed by a successful
+  `/api/v1/status` probe.
+
+Physical qualification additionally requires installation discovery on an
+iPhone, live frame and node-inventory receipt, DHCP-change recovery without
+flapping, and a five-to-ten-minute zero-fusion-error burn-in. Simulator and
+host-only results remain `MEASURED_SOFTWARE`; peer-link, relay, and physical
+reconnection claims remain `NOT_MEASURED` until those captures exist.
+
+## Implementation references
+
+- `v2/crates/wifi-densepose-sensing-server/src/discovery.rs`
+- `v2/crates/wifi-densepose-sensing-server/src/main.rs`
+- Mobile companion decision: `cognitum-one/ruview-mobile`,
+  `docs/adr/ADR-026-adaptive-local-installation-discovery-and-transport-recovery.md`
+- Related decisions: ADR-034, ADR-054, ADR-296

docs/adr/ADR-346-fail-closed-edge-occupancy-evidence.md

@@ -0,0 +1,52 @@
+# ADR 346: Fail closed ESP32 occupancy evidence
+
+## Status
+
+Accepted and implemented. Physical qualification is required after each firmware build.
+
+## Date
+
+2026 08 31
+
+## Context
+
+The ESP32 Tier 2 pipeline produces two different signals. Presence is a debounced room level decision. Person count is a bounded subcarrier diversity heuristic. A live four node installation emitted packets with `presence=false` and `n_persons=3` or `4`. The server eventually gated the aggregate room count, but raw WebSocket consumers and diagnostics could still treat the contradictory count as occupancy evidence.
+
+That contradiction is more dangerous than a missed optional count. It can contaminate empty room calibration, train a room model on false labels, and encourage a product claim that the firmware cannot support. The count is not identity, pose, or a validated multi person estimator.
+
+## Decision
+
+1. Firmware person slots are subordinate to the debounced presence gate.
+2. When presence is false, the firmware clears slot activity, slot history, candidate count, persistence streak, and stable count.
+3. The serialized person count is always zero when presence is false and is clamped to `EDGE_MAX_PERSONS` when presence is true.
+4. The sensing server repeats the invariant for older firmware. A contradictory or out of range count becomes zero and carries `person_count_valid=false`.
+5. Fused CSI plus mmWave packets use either CSI presence or mmWave presence as the supporting presence condition.
+6. The node inventory and WebSocket diagnostics expose person count validity. Consumers must not infer a person from an invalid count.
+7. No count accuracy claim is created by this change. The firmware output remains a heuristic until a leakage free, held out physical dataset demonstrates otherwise.
+8. OTA admission uses the selected update partition size rather than a stale fixed 900 KB ceiling. The status endpoint reports that same hardware bound, while image validation and authenticated OTA remain mandatory.
+
+## Security and privacy
+
+The change retains no raw CSI or personal data. It reduces authority by preventing a secondary heuristic from asserting occupancy after the primary gate has closed. The host validates packet length, magic, range, and logical consistency before using count evidence.
+
+## Consequences
+
+Older firmware remains wire compatible. Invalid count evidence becomes visibly unavailable instead of silently affecting calibration. A true multi person event can still be undercounted when the presence gate is false, which is the intended fail closed behavior. Current C6 images larger than 900 KB can use the installed 1,900,544 byte OTA slots after one serial upgrade, without weakening the OTA authentication gate.
+
+The largest uncertainty is whether the current presence gate itself generalizes across the installed rooms. The fix path is a room bound empty baseline plus the fixed room selective held out protocol, not a global threshold reduction.
+
+## Evidence and acceptance
+
+MEASURED before implementation on 2026 08 31: four live nodes streamed for 86 seconds with zero transport errors, while edge packets repeatedly contradicted `presence=false` with counts of three or four.
+
+Software acceptance requires:
+
+1. Host firmware tests prove absent plus four active slots serializes zero.
+2. Rust parser tests prove contradictory and out of range counts fail closed.
+3. The node API exposes count validity without breaking older firmware.
+
+Physical acceptance requires the updated firmware on a confirmed board, a captured boot log, five minutes of live packets, zero logical count contradictions, and no increase in transport errors. Accuracy remains unmeasured until labelled held out sequences are recorded.
+
+Physical occupancy qualification completed for ESP32 C6 node 4 on 2026 08 31. The five minute run observed 242 edge packets, including 61 absent packets, with zero logical count contradictions and zero parse errors. See `docs/validation/2026-08-31-esp32-c6-occupancy-integrity.md`.
+
+ESP32 C6 node 7 was subsequently identified, upgraded to firmware 0.8.8, and transport qualified for five minutes with zero fused presence count contradictions and zero steady state transport errors. Its controlled empty room sequence remains required before occupancy qualification. See `docs/validation/2026-08-31-esp32-c6-node7-rate-aware-sensing.md`. Other nodes remain unqualified until separately identified and upgraded.

docs/adr/ADR-347-rate-aware-esp32-temporal-sensing.md

@@ -0,0 +1,85 @@
+# ADR 347: Rate aware ESP32 temporal sensing
+
+## Status
+
+Accepted. Implemented in firmware 0.8.8. The timing and transport path is
+physically qualified on ESP32 C6. The independent raw transport path is also
+physically qualified on an ESP32 S3 running Tier 0. Held out inference accuracy
+remains required.
+
+## Context
+
+The ESP32 firmware creates CSI opportunities by sending one byte ICMP probes to
+the connected access point. The traffic source is configured for 50 Hz, but the
+delivered CSI cadence varies with channel contention and callback safety gates.
+A physical ESP32 C6 produced 28 to 37 callbacks per second during the baseline
+capture. Firmware 0.8.5 then exposed that the old per-interval estimator saw
+only 12 to 16 Hz because WiFi replies arrived in short bursts separated by
+longer gaps. The filters still consumed those burst frames, so excluding them
+from the clock estimate was incorrect.
+
+The edge DSP estimates its sample rate from timestamps so that breathing,
+heartbeat, motion, and future Doppler features stay in physical Hertz. That
+estimator was capped at 30 Hz. Once the actual cadence exceeded the cap, every
+temporal feature was scaled against the wrong clock.
+
+Physical firmware 0.8.5 validation corrected that initial diagnosis. Although
+the callback path received 26 to 40 frames per second, Tier 2 on the unicore C6
+processed an irregular subset that converged toward the 8 Hz estimator floor.
+The right design is not to force the edge DSP to match raw capture. The paths
+need independent, explicit cadence contracts.
+
+The device free gesture preprint at
+`https://www.preprints.org/manuscript/202602.0018` reinforces the importance of
+timestamp correct Doppler features, but its 100 Hz controlled link is not a
+safe firmware default for RuView. Existing S3 and C6 evidence records WiFi ISR
+and packet buffer failures under sustained callback pressure above 50 Hz.
+
+## Decision
+
+1. Make the connected STA probe rate a build time setting from 10 through 50
+   Hz, with a default and hard ceiling of 50 Hz.
+
+2. Track the delivered DSP cadence by counting every processed frame interval
+   over one second timestamp windows, then smooth successive windows in an 8
+   through 60 Hz estimator range. The 60 Hz estimator ceiling accommodates
+   timestamp jitter; it does not authorize more than 50 Hz callback processing.
+
+3. Reject incomplete windows below one second and stalled windows above three
+   seconds. Do not discard valid burst frames from the estimated clock.
+
+4. Surface the DSP rate in the one second controller diagnostic so hardware
+   validation can compare callback yield with the clock used by temporal
+   filters.
+
+5. Keep raw CSI on the wire at the independent network cadence. Rate-limit the
+   C6 on-device Tier 1 and Tier 2 DSP input to a uniform 8 Hz. Physical 0.8.7
+   evidence showed that a requested 10 Hz input still converged to 8.0 through
+   8.4 Hz under Tier 2 load, while raw delivery remained 30 through 40 pps.
+   Eight hertz retains a 4 Hz Nyquist limit for the 0.1 through 2.0 Hz vital
+   bands without creating a backlog. The S3 default remains 20 Hz.
+
+6. STFT, spectrogram gating, and learned temporal
+   classification remain host or iPhone responsibilities where memory,
+   rollback, and held out evaluation are stronger.
+
+## Consequences
+
+Heartbeat, respiration, and motion features receive a stable timestamped clock
+instead of an accidental subset determined by C6 backlog. Operators can lower
+the probe or DSP load for constrained networks without editing source. The host
+still receives the higher-rate raw stream for richer Doppler processing.
+
+This does not prove vital sign accuracy or gesture recognition. Higher temporal
+fidelity only improves the representation available to a separately validated
+model. The 50 Hz ceiling also means the paper's 100 Hz results are not directly
+transferable.
+
+## Acceptance test
+
+On a physical C6, run at least five minutes after flashing. Pass when the boot
+log reports the configured probe and DSP rates, the controller converges within
+one hertz of the configured DSP cadence, raw callback yield remains at least 20
+pps, no steady-state ENOMEM, watchdog, panic, or reboot occurs, and the fail
+closed occupancy invariant remains zero contradictions for at least 30 absent
+packets.

docs/adr/README.md

@@ -105,6 +105,9 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-035](ADR-035-live-sensing-ui-accuracy.md) | Live Sensing UI Accuracy and Data Transparency | Accepted |
 | [ADR-036](ADR-036-rvf-training-pipeline-ui.md) | Training Pipeline UI Integration | Proposed |
 | [ADR-043](ADR-043-sensing-server-ui-api-completion.md) | Sensing Server UI API Completion (14 endpoints) | Accepted |
+| [ADR-344](ADR-344-adaptive-local-installation-discovery.md) | Adaptive Local Installation Discovery | Accepted (local software path) |
+| [ADR-346](ADR-346-fail-closed-edge-occupancy-evidence.md) | Fail closed ESP32 occupancy evidence | Accepted (C6 occupancy integrity qualified) |
+| [ADR-347](ADR-347-rate-aware-esp32-temporal-sensing.md) | Rate aware ESP32 temporal sensing | Accepted (C6 timing and transport qualified) |
 | [ADR-115](ADR-115-home-assistant-integration.md) | Home Assistant integration via MQTT auto-discovery + Matter bridge (HA-DISCO + HA-FABRIC + HA-MIND) | Accepted (MQTT track) / Proposed (Matter SDK P8b) |
 | [ADR-169](ADR-169-adam-mode-light-theme.md) | adam-mode — light theme toggle for the three.js realtime demo | Proposed |
 | [ADR-170](ADR-170-yoga-mode-pose-system.md) | yoga-mode — yoga pose detection, classification, and scoring for the three.js realtime demo | Proposed |

docs/benchmarks/wifi-pose-efficiency-frontier.md

@@ -5,10 +5,15 @@ PCK@20 (MultiFormer Table VII metric: `‖pred−gt‖ ≤ 0.2·‖R-shoulder
 
 The flagship [`ruvnet/wifi-densepose-mmfi-pose`](https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose)
 reaches **83.59%** torso-PCK@20 (vs MultiFormer 72.25%, CSI2Pose 68.41%). But the headline number
-isn't the whole story for **edge deployment** — on a Raspberry Pi / ESP32-class target, *params and
+isn't the whole story for **edge deployment** — on a Raspberry Pi-class edge host, *params and
 latency* matter as much as accuracy. So we swept model size to map the **accuracy-per-parameter
 frontier**: how small can a WiFi-CSI pose model be and still beat the prior published SOTA?
 
+> **Hardware compatibility boundary.** These models consume MM-Fi tensors shaped
+> `[3,114,10]`. Parameter size alone does not make that input, model architecture, or runtime
+> compatible with an ESP32-S3/C6 capture node. The measurements below are dataset and x86/GPU
+> measurements; no ESP32 inference latency or live ESP32-to-MM-Fi adapter is claimed.
+
 ## The frontier
 
 | Model | Params | Latency (batch=1) | torso-PCK@20 | vs SOTA (72.25%) |
@@ -38,8 +43,10 @@ Size alone isn't the claim — what matters is **accuracy at the deployed precis
 
 **The honest edge result:** `micro` is **lossless at int8 (73.5 KB, 74.70%)**, and at **int4 (36.7 KB)
 naïve post-training quantization falls below SOTA (70.21%) — but quantization-aware training fully
-recovers it to 74.46%**, still beating MultiFormer. So a **SOTA-beating WiFi-pose model genuinely runs
-in ~37 KB int4** (with QAT) or **~73 KB int8** (no retraining) — deployable on the sensing node itself.
+recovers it to 74.46%**, still beating MultiFormer. So a **SOTA-beating WiFi-pose model fits in
+~37 KB int4** (with QAT) or **~73 KB int8** (no retraining). That is a model-footprint result, not
+evidence that it runs on an ESP32 sensing node; a compatible capture adapter and embedded runtime
+still need to be implemented and measured.
 `nano` (40K params) sits at the SOTA line in fp32 and is best treated as int8.
 
 (We also tested flagship→tiny **knowledge distillation**: it did *not* help — the tiny students reach

docs/releases/v0.8.8-esp32.md

@@ -0,0 +1,111 @@
+# RuView ESP32 firmware 0.8.8
+
+Firmware 0.8.8 is a reliability and correctness release for ESP32-S3 and
+ESP32-C6 RuView nodes. It makes the timing used by signal processing explicit,
+prevents contradictory occupancy output, and improves update diagnostics.
+
+## What changed
+
+### Empty means zero people
+
+Older firmware could report `presence=false` and a nonzero person count in the
+same edge packet. That was internally contradictory and could contaminate an
+empty-room calibration. Firmware 0.8.8 clears the count whenever the presence
+gate is closed. The sensing server repeats the same check when it receives data
+from older nodes.
+
+This is a consistency fix, not proof that the heuristic can count multiple
+people accurately. See
+[ADR 346](../adr/ADR-346-fail-closed-edge-occupancy-evidence.md).
+
+### Stable time scale on ESP32-C6
+
+Raw CSI and on-device signal processing now have separate clocks. The C6 keeps
+raw CSI moving over the network while its Tier 2 filters process a stable 8 Hz
+sample stream. The S3 retains its 20 Hz DSP default. A phase-preserving sampler
+keeps callback jitter from shifting those clocks.
+
+The result is a correct time base for motion and vital-band features. It does
+not by itself prove that heartbeat, respiration, gesture, or pose estimates are
+more accurate. See
+[ADR 347](../adr/ADR-347-rate-aware-esp32-temporal-sensing.md).
+
+### Better diagnostics and safer updates
+
+The one-second controller log now shows both raw callback yield and DSP rate.
+The OTA status endpoint reports the actual selected application partition size
+instead of a fixed 900 KB assumption. Firmware upload remains fail closed when
+the node has no provisioned OTA signing secret.
+
+## Measured hardware validation
+
+All results below are physical measurements from 2026-08-31. They are not
+simulator claims.
+
+| Board | Duration | Raw CSI mean | DSP clock | Live coverage | Steady-state transport errors |
+|-------|---------:|-------------:|----------:|--------------:|------------------------------:|
+| ESP32-C6 node 4 | 300.64 s | 34.92 pps | 8.00 Hz | 97.62% | 0 |
+| ESP32-C6 node 7 | 300.70 s | 36.32 pps | 8.00 Hz | 97.40% | 0 |
+| ESP32-S3 node 1 | 300 s | 28.03 pps | Tier 0 | 100.00% | 0 |
+
+The first C6 empty-room qualification observed 61 absent packets with zero
+nonzero counts. The second C6 was transport-qualified in an occupied room and
+still needs its own controlled empty-room sequence. Full evidence is recorded
+in:
+
+1. [C6 timing and transport](../validation/2026-08-31-esp32-c6-rate-aware-sensing.md)
+2. [C6 occupancy integrity](../validation/2026-08-31-esp32-c6-occupancy-integrity.md)
+3. [Second C6 timing and transport](../validation/2026-08-31-esp32-c6-node7-rate-aware-sensing.md)
+4. [S3 transport](../validation/2026-08-31-esp32-s3-rate-aware-transport.md)
+
+## Choose the correct download
+
+| Release file | Target |
+|--------------|--------|
+| `esp32-csi-node-v0.8.8-s3-8mb-flash-bundle.zip` | ESP32-S3 with 8 MB flash |
+| `esp32-csi-node-v0.8.8-s3-4mb-flash-bundle.zip` | ESP32-S3 with 4 MB flash |
+| `esp32-csi-node-v0.8.8-c6-4mb-flash-bundle.zip` | ESP32-C6 using the supported 4 MB partition layout |
+| `esp32-csi-node-v0.8.8-s3-8mb.bin` | S3 8 MB application only |
+| `esp32-csi-node-v0.8.8-s3-4mb.bin` | S3 4 MB application only |
+| `esp32-csi-node-v0.8.8-c6-4mb.bin` | C6 application only |
+
+Never mix S3 and C6 images. Confirm the chip and physical flash before writing.
+
+## Install or update
+
+For a fresh installation, extract the matching bundle and follow its included
+`FLASHING.md`. The standard offsets are:
+
+| Image | Offset |
+|-------|-------:|
+| Bootloader | `0x0000` |
+| Partition table | `0x8000` |
+| OTA metadata | `0xf000` |
+| Application | `0x20000` |
+
+For an existing provisioned node:
+
+1. Back up the current application partition.
+2. Confirm the exact chip, flash layout, logical node, and serial port.
+3. Read `http://DEVICE_IP:8032/ota/status`.
+4. Use an application-only serial update at `0x20000` only when the running
+   partition is `ota_0` and the image matches the board.
+5. Reboot and confirm version 0.8.8, the preserved node identity, channel, and
+   sensing-server target.
+6. Run a five-minute burn-in before returning the node to calibration duty.
+
+The full bundle does not contain an NVS image. A four-offset install therefore
+preserves the existing WiFi and node settings, but operators should still keep
+a backup before changing firmware.
+
+## What this release does not prove
+
+Firmware 0.8.8 does not prove medical-grade vital signs, accurate person
+counting, identity, dense pose, through-wall video, or room separation. Those
+claims require synchronized references and leakage-free held-out sequences.
+
+The practical next acceptance test is a controlled empty-room capture with at
+least 30 absent edge packets per updated node, zero absent packets carrying a
+nonzero count, and zero transport or parser errors. Accuracy evaluation then
+needs held-out occupied, movement, heartbeat-reference, and adjacent-room
+sequences.

docs/user-guide.md

@@ -22,6 +22,7 @@ WiFi DensePose turns commodity WiFi signals into real-time human pose estimation
    - [ESP32-S3 (Full CSI)](#esp32-s3-full-csi)
    - [ESP32 Multistatic Mesh (Advanced)](#esp32-multistatic-mesh-advanced)
    - [Connect Mesh Data to the Dashboard and Observatory](#connect-mesh-data-to-the-dashboard-and-observatory)
+   - [Cognitum Spaces activation](#cognitum-spaces-activation)
    - [Cognitum Seed Integration (ADR-069)](#cognitum-seed-integration-adr-069)
 5. [REST API Reference](#rest-api-reference)
 6. [WebSocket Streaming](#websocket-streaming)
@@ -74,7 +75,7 @@ WiFi DensePose turns commodity WiFi signals into real-time human pose estimation
 
 | Option | Cost | Capabilities |
 |--------|------|-------------|
-| ESP32-S3 mesh (3-6 boards) | ~$54 | Full CSI: pose, breathing, heartbeat, presence |
+| ESP32-S3 mesh (3-6 boards) | ~$54 | CSI capture for presence, motion, and vital-sign heuristics; live 17-keypoint pose remains below-target and is not a validated capability |
 | Intel 5300 / Atheros AR9580 | $50-100 | Full CSI with 3x3 MIMO (Linux only) |
 | Any WiFi laptop | $0 | RSSI-only: coarse presence and motion detection |
 
@@ -425,6 +426,57 @@ curl http://localhost:3000/api/v1/sensing/latest
 
 If the ESP32 nodes are provisioned with `--target-ip <AGGREGATOR_HOST>`, that IP must be the machine running `sensing-server`. Only one process can receive UDP `:5005` at a time, so leave the standalone hardware `aggregator` off while the dashboard or Observatory is live.
 
+### Cognitum Spaces activation
+
+Cognitum Spaces gives RuView a tenant/workspace-scoped semantic world model
+without uploading raw RF/CSI, recordings, pose frames, vital waveforms, or
+identity observations. It represents sites, buildings, floors, bounded
+rooms/spaces, zones, anonymous entities, semantic events, and alerts.
+
+Activate the public RuView OAuth client with Authorization Code + PKCE:
+
+```bash
+wifi-densepose login --spaces
+wifi-densepose whoami
+wifi-densepose spaces --resource sites --limit 50
+wifi-densepose spaces --resource events --limit 25
+```
+
+The login requests `sensing:read spaces:read`. That consent is read-only: it
+does not grant publication, pairing, policy approval, command, or actuator
+authority. Versioned collections are `sites`, `buildings`, `floors`,
+`spaces`, `zones`, `entities`, `events`, and `alerts`. A returned
+`nextCursor` is opaque and valid only for the same collection.
+
+The dependency-free contributor harness exposes the same read path:
+
+```bash
+npx @ruvnet/ruview@0.5.0 spaces --resource alerts --limit 25
+npx @ruvnet/ruview@0.5.0 mcp start
+```
+
+Its MCP tool is `ruview_spaces_list`. MCP reads are OAuth-only, use the fixed
+Cognitum API origin, and require the explicit guarded-tool opt-in. The harness
+does not accept an arbitrary credential path or API origin.
+
+For service compatibility, `wifi-densepose spaces` can read
+`COGNITUM_SPACES_API` at request time. API-key access to a versioned collection
+also requires `--workspace <uuid>`; OAuth derives the workspace from the
+signed token. Never print or commit either credential.
+
+Every response is bounded and revalidated. Raw-sensing aliases, malformed
+hierarchy, non-anonymous person/track entities, invalid timestamps, stale
+confidence, and oversized structures fail closed. Empty data means no
+authorized state is present; it does not prove that a physical site is empty.
+
+RuVector spatial memory remains physically separated by tenant and workspace.
+Agents observe or recommend by default. Any consequential execution requires a
+separate policy/grant/approval decision and produces a signed, hash-chained
+receipt; the Spaces read token can never satisfy that gate.
+
+See ADR-325, ADR-326, and ADR-327 for the activation, memory, and governed-action
+decisions.
+
 ### Cognitum Seed Integration (ADR-069)
 
 Connect an ESP32-S3 to a [Cognitum Seed](https://cognitum.one) (Pi Zero 2 W, ~$15) for persistent vector storage, kNN similarity search, cryptographic witness chain, and AI-accessible sensing via MCP proxy.
@@ -1162,6 +1214,22 @@ levels. Read the label, not the headline ([ADR-187](adr/ADR-187-archive-v1-depre
 
 **Does it actually run, and can a single ESP32 do pose? ([#509](https://github.com/ruvnet/RuView/issues/509), [#1125](https://github.com/ruvnet/RuView/issues/1125))** Yes, it runs, and the results are reproducible: the deterministic signal-pipeline proof (`python archive/v1/data/proof/verify.py`, must print `VERDICT: PASS`), the committed pose training dump (`v2/crates/cog-pose-estimation/cog/artifacts/train_results.json`), and the auditable MM-Fi arena all back specific numbers. But a single-antenna, 56-subcarrier CSI stream at a 20-frame window does *not* carry the fine-grained spatial information the multi-antenna NIC research relies on — so the shippable pose accuracy the project stands behind today is the **MM-Fi benchmark number**, not a live single-ESP32 number. The path to a first reproducible on-device baseline (PCK@20 ≥ 35%) is tracked in [ADR-079](adr/ADR-079-camera-ground-truth-training.md) / [#645](https://github.com/ruvnet/RuView/issues/645).
 
+### Model and capture compatibility
+
+These artifacts share a pose objective, but not an input contract or adapter format. A checkpoint
+is usable only when capture preprocessing, tensor shape, architecture, and runtime all match.
+
+| Artifact/path | Required input | Measured status | Live ESP32 compatibility |
+|---------------|----------------|-----------------|--------------------------|
+| MM-Fi flagship and `micro` transformer | `[N,3,114,10]` amplitude | **MEASURED** on MM-Fi `random_split`; calibration reference is Python `.npz` LoRA | No direct S3/C6 path is validated; resampling a 56-tone SISO stream does not recreate three-antenna MM-Fi input |
+| Cog `pose_v1.safetensors` | `[N,56,20]` amplitude | **MEASURED** PCK@20 = 3.0%, below the ≥35% target; cog-format LoRA is `.safetensors` | Shape matches the canonical window, but the documented live runtime remains below-target/stub and is not a reliable pose claim |
+| Viewer `heuristic_pose_from_amplitude` | live canonical amplitude | Skeleton-layout placeholder, not a trained pose model | Renders a demonstrator skeleton only; it is not pose accuracy evidence |
+| MERIDIAN automatic unlabeled calibration | proposed ~200-frame target-room capture | **PROPOSED** in ADR-027; no validated end-to-end command | Not available. The current calibration tools require paired CSI/keypoint labels and model-specific inputs |
+
+Calibration files are not interchangeable: `calibrate.py` targets the MM-Fi transformer, while
+`cog_calibrate.py` targets the cog conv+MLP. See the
+[calibration reference](../aether-arena/calibration/README.md) for their exact schemas.
+
 ### Download
 
 ```bash
@@ -1406,7 +1474,7 @@ The pipeline runs 10 phases:
 3. Subcarrier resampling (114->56 or 30->56 via Catmull-Rom interpolation)
 4. Graph transformer construction (17 COCO keypoints, 16 bone edges)
 5. Cross-attention training (CSI features -> body pose)
-6. **Domain-adversarial training** (MERIDIAN: gradient reversal + virtual domain augmentation)
+6. Experimental domain-adversarial components (MERIDIAN research modules; not a validated automatic deployment path)
 7. Composite loss optimization (MSE + CE + UV + temporal + bone + symmetry)
 8. SONA adaptation (micro-LoRA + EWC++)
 9. Sparse inference optimization (hot/cold neuron partitioning)
@@ -1422,14 +1490,18 @@ Progressive loading enables instant startup (Layer A loads in <5ms with basic in
 
 ### Cross-Environment Adaptation (MERIDIAN)
 
-Models trained in one room typically lose 40-70% accuracy in a new room due to different WiFi multipath patterns. The MERIDIAN system (ADR-027) solves this with a 10-second automatic calibration:
+Models trained in one room can lose substantial accuracy in a new room because the multipath
+distribution changes. ADR-027 proposes an automatic adaptation design, and the Rust tree contains
+individual research components, but RuView does **not** currently provide a validated command that
+turns ~200 unlabeled frames into a working room adapter.
 
-1. **Deploy** the trained model in a new room
-2. **Collect** ~200 unlabeled CSI frames (10 seconds at 20 Hz)
-3. The system automatically generates environment-specific LoRA weights via contrastive test-time training
-4. No labels, no retraining, no user intervention
+Current, testable calibration is the separate **labeled** reference in
+`aether-arena/calibration/`: collect paired CSI/keypoint samples, then fit a model-specific LoRA
+adapter. The MM-Fi transformer expects `[N,3,114,10]`; the cog expects `[N,56,20]`. Neither adapter
+loads into the other model, and neither result establishes live ESP32 pose accuracy without a
+leakage-free held-out capture and mean-pose baseline.
 
-MERIDIAN components (all pure Rust, +12K parameters):
+ADR-027 research components:
 
 | Component | What it does |
 |-----------|-------------|
@@ -1437,7 +1509,7 @@ MERIDIAN components (all pure Rust, +12K parameters):
 | Domain Factorizer | Separates pose-relevant from room-specific features |
 | Geometry Encoder | Encodes AP positions (FiLM conditioning with DeepSets) |
 | Virtual Augmentor | Generates synthetic environments for robust training |
-| Rapid Adaptation | 10-second unsupervised calibration via contrastive TTT |
+| Rapid Adaptation | Proposed unlabeled contrastive TTT; not wired as a validated deployment workflow |
 
 See [ADR-027](adr/ADR-027-cross-environment-domain-generalization.md) for the full design.
 
@@ -1595,7 +1667,7 @@ Not every ADR-295–296 remediation item is preview-only. Three are live now:
 
 | Target | Use case | Source target flag | Notes |
 |---|---|---|---|
-| **ESP32-S3** (default) | Production CSI mesh, 17-keypoint pose | `idf.py set-target esp32s3` | Dual-core 240 MHz, PSRAM, native USB-OTG, DVP camera path |
+| **ESP32-S3** (default) | Production CSI capture mesh; presence/motion/vital heuristics | `idf.py set-target esp32s3` | Dual-core 240 MHz, PSRAM, native USB-OTG, DVP camera path; live 17-keypoint pose is not validated |
 | **ESP32-C6** ([ADR-110](adr/ADR-110-esp32-c6-firmware-extension.md)) | Wi-Fi 6 / 802.15.4 research, battery seed nodes | `idf.py set-target esp32c6` | Single-core 160 MHz, no PSRAM, 802.11ax HE PHY, 802.15.4 (Thread/Zigbee), LP-core hibernation ~5 µA |
 
 The same `firmware/esp32-csi-node` source tree builds for both. ESP-IDF picks up `sdkconfig.defaults.esp32c6` automatically when the target is set to `esp32c6`; otherwise it uses `sdkconfig.defaults` (S3). All C6-only modules are `#ifdef`-gated, so the S3 build is byte-identical to today.
@@ -2019,7 +2091,11 @@ Pre-trained models are available on HuggingFace:
 - **SOTA MM-Fi pose model** (82.69% torso-PCK@20) — https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose
 - **AetherArena leaderboard Space** — https://huggingface.co/spaces/ruvnet/aether-arena
 
-Download and start sensing immediately — no datasets, no GPU, no training needed. Results are reproducible via `python archive/v1/data/proof/verify.py` (deterministic SHA-256 proof) — see [ADR-168](adr/ADR-168-benchmark-proof.md).
+The encoder artifact can be downloaded for its documented inference path without retraining. The
+MM-Fi pose checkpoint is benchmark evidence, not a drop-in live ESP32 model; it requires its exact
+input contract and runtime described in [Model and capture compatibility](#model-and-capture-compatibility).
+The deterministic signal-pipeline proof is reproducible via `python archive/v1/data/proof/verify.py`
+(see [ADR-168](adr/ADR-168-benchmark-proof.md)), but that proof does not validate pose accuracy.
 
 ### Quick Start with Pre-Trained Models
 
@@ -2584,7 +2660,12 @@ No. Run `docker run -p 3000:3000 ruvnet/wifi-densepose:latest` and open `http://
 No. Consumer WiFi exposes only RSSI (one number per access point), not CSI (56+ complex subcarrier values per frame). RSSI supports coarse presence and motion detection. Full pose estimation requires CSI-capable hardware like an ESP32-S3 ($8) or a research NIC.
 
 **Q: How accurate is the pose estimation?**
-Accuracy depends on hardware and environment. With a 3-node ESP32 mesh in a single room, the system tracks 17 COCO keypoints. The core algorithm follows the CMU "DensePose From WiFi" paper ([arXiv:2301.00250](https://arxiv.org/abs/2301.00250)). The MERIDIAN domain generalization system (ADR-027) reduces cross-environment accuracy loss from 40-70% to under 15% via 10-second automatic calibration.
+The strongest published RuView result is the MM-Fi transformer benchmark (82.69% torso-PCK@20 on
+the matched `random_split` protocol), not a live ESP32 result. The committed cog model measured
+3.0% PCK@20 on its holdout, below the ≥35% target, and the viewer's live skeleton is a heuristic
+placeholder. No measured claim currently shows a 3-node ESP32 mesh reliably tracking 17 keypoints.
+ADR-027's 10-second unlabeled MERIDIAN adaptation is Proposed; the available measured calibration
+reference uses labeled, model-specific samples.
 
 **Q: Does it work through walls?**
 Yes. WiFi signals penetrate non-metallic materials (drywall, wood, concrete up to ~30cm). Metal walls/doors significantly attenuate the signal. With a single AP the effective through-wall range is approximately 5 meters. With a 3-6 node multistatic mesh (ADR-029), attention-weighted cross-viewpoint fusion extends the effective range to ~8 meters through standard residential walls.

docs/validation/2026-08-31-esp32-c6-node7-rate-aware-sensing.md

@@ -0,0 +1,120 @@
+# ESP32 C6 node 7 rate aware sensing qualification
+
+## Scope
+
+This record qualifies the firmware 0.8.8 timing and transport path on a second
+physically attached ESP32 C6. It measures raw callback cadence, edge DSP
+cadence, process stability, and end to end sensing delivery. It does not
+qualify heartbeat, respiration, pose, identity, room separation, or person
+count accuracy against labelled ground truth.
+
+## Hardware and firmware
+
+| Field | Measured value |
+|---|---|
+| Board | ESP32 C6 QFN40 revision 0.2 |
+| Logical node | 7 |
+| Firmware before | 0.8.4 |
+| Firmware after | 0.8.8 development build |
+| App image | 1,051,552 bytes |
+| App SHA 256 | `eab7561d65e302dc33e9331ac591763a46f92fb3fa9f824fef0e9b541daddb3f` |
+| OTA slot size | 1,900,544 bytes |
+| OTA headroom | 848,992 bytes, 45 percent |
+
+Only the application partition at offset `0x20000` was flashed. WiFi
+credentials, logical node identity, sensing server target, channel, edge tier,
+bootloader, partition table, OTA metadata, and NVS were preserved. The pre
+update application was copied to a private recovery file outside the
+repository. Its SHA 256 is
+`f5ebc5e0142425adae16e9180bf298ef444ea8862ba0d8809c310a39fe45721d`.
+The device partition table was also read before the update and had SHA 256
+`0a8d2f192a8fff209d6c75ab639fcf8aa2f43c64abb732c6e74596fbd6971dca`.
+
+The post update boot log reported firmware 0.8.8, node 7, channel 10, Tier 2,
+an 8 Hz edge DSP cadence, and the preserved sensing server target. The OTA
+status endpoint reported firmware 0.8.8 running from `ota_0`, with `ota_1` as
+the next partition and the correct 1,900,544 byte limit. The sensing server
+health endpoint remained ready with ESP32 input.
+
+## Before and after
+
+The pre update baseline was a 20 second observation on the same attached board.
+The post update observation was a five minute steady state run after boot.
+
+| Observation | Before 0.8.4 | After 0.8.8 |
+|---|---:|---:|
+| Raw callback mean | 39.05 pps | 36.32 pps |
+| Raw callback range | 35 through 42 pps | 24 through 42 pps |
+| Server CSI FPS mean | 46.23 Hz | 48.88 Hz |
+| WebSocket parser errors | 0 | 0 |
+| WebSocket reconnects | 0 | 0 |
+
+Raw callback mean changed by negative 7.0 percent while the server CSI FPS
+estimate changed by positive 5.7 percent. Both remain above the 20 pps
+transport floor. The result is transport neutral rather than an accuracy lift;
+the room and WiFi traffic were not controlled between the two windows.
+
+Firmware 0.8.4 did not expose the edge DSP cadence used by the temporal
+filters. Firmware 0.8.8 held that separately governed clock at exactly 8.0 Hz
+for every controller sample while preserving the higher rate raw network path.
+
+## Five minute physical result
+
+MEASURED on 2026 08 31 after flashing firmware 0.8.8:
+
+| Device observation | Result |
+|---|---:|
+| Duration | 300.70 seconds |
+| Controller samples | 300 |
+| Raw callback mean | 36.32 pps |
+| Raw callback range | 24 through 42 pps |
+| Edge DSP mean | 8.00 Hz |
+| Edge DSP range | 8.00 through 8.00 Hz |
+| ENOMEM events | 0 |
+| UDP send failures | 0 |
+| ESP NOW nonzero failure lines | 0 |
+| Other steady state errors | 0 |
+| Watchdogs, panics, or reboots | 0 |
+
+| End to end WebSocket observation | Result |
+|---|---:|
+| Duration | 300.06 seconds |
+| Sensing frames | 36,254 |
+| JSON parse errors | 0 |
+| WebSocket errors or reconnects | 0 |
+| Frames containing node 7 | 35,313 |
+| Node 7 frame coverage | 97.40 percent |
+| Node 7 stale frames | 0 |
+| Maximum node 7 staleness | 972 ms |
+| Maximum node 7 inference age | 483 ms |
+| Maximum WebSocket frame gap | 108 ms |
+| Nodes per frame | 0 through 5 |
+| Fused presence count contradictions | 0 |
+
+One ENOMEM backoff occurred during startup and recovered in 210 ms. No memory
+backoff or send failure recurred in the separate five minute steady state
+window. The boot log also reported the documented fail closed OTA behavior:
+the status service was available, but image upload remained rejected because
+this node has no provisioned OTA signing secret.
+
+## Result and limitation
+
+The node 7 timing and transport update passes. Its configuration survived, the
+edge DSP clock remained phase stable at the measured sustainable C6 rate, and
+the live service received fresh node 7 data throughout the run. This does not
+complete the ADR 346 occupancy qualification for node 7 because the room was
+not held empty and the live aggregate did not expose 30 absent edge packets.
+
+The largest uncertainty remains inference accuracy. Timing stability cannot
+prove better vital, motion, room separation, or multi person estimates without
+synchronized held out labels and a controlled empty room sequence.
+
+## Acceptance test
+
+Repeat this five minute procedure after timing, WiFi, filter, or scheduling
+changes. Pass transport only when raw callback yield remains at least 20 pps,
+DSP cadence stays within one hertz of the configured target, the device has
+zero steady state memory backoff, send failure, watchdog, panic, and reboot
+events, the server has zero parse failures and reconnects, and the updated node
+stays fresh. Complete occupancy qualification separately with at least 30
+absent edge packets and zero absent packets carrying a nonzero person count.

docs/validation/2026-08-31-esp32-c6-occupancy-integrity.md

@@ -0,0 +1,60 @@
+# ESP32 C6 occupancy evidence qualification
+
+## Scope
+
+This record qualifies the fail closed person count invariant in ADR 346 on one physically attached ESP32 C6. It does not qualify person counting accuracy, identity, pose, room separation, or vital sign accuracy.
+
+## Hardware and firmware
+
+| Field | Measured value |
+|---|---|
+| Board | ESP32 C6 QFN40 revision 0.2 |
+| Logical node | 4 |
+| Firmware before | 0.7.0 |
+| Firmware after | 0.8.4 development build |
+| App image | 1,051,168 bytes |
+| App SHA 256 | `f9470a31b82612f1740f0cf0943ddb78917cd58784ba16d2e9d57cc8fb39364c` |
+| OTA slot size | 1,900,544 bytes |
+| CSI stream target | Preserved from NVS |
+
+The device partition table was read before the update. NVS, OTA metadata, bootloader, and partition table were not overwritten. A private recovery copy was created outside the repository and excluded from version control.
+
+## Software gates
+
+| Gate | Result |
+|---|---|
+| Firmware host tests | PASS, 54 assertions across encoding, vital evidence, and mmWave detection |
+| Rust sensing server package | PASS, 532 library tests plus all package integration and documentation tests |
+| Mobile Jest suite | PASS, 164 suites and 1,223 tests |
+| Mobile TypeScript | PASS |
+| Mobile ESLint | PASS |
+| Mobile security verifier | PASS |
+| Repository wide Rust formatting | PREEXISTING DRIFT outside this change; changed code builds and package tests pass |
+
+## Physical result
+
+MEASURED on 2026 08 31 from the live local sensing WebSocket for 300 seconds:
+
+| Node | Firmware state | Edge packets | Absent packets | Absent with nonzero count | Result |
+|---|---|---:|---:|---:|---|
+| 4 | Updated | 242 | 61 | 0 | PASS |
+| 3 | Unupdated control | 216 | 216 | 216 | Expected control failure |
+| 7 | Unupdated control | 280 | 278 | 278 | Expected control failure |
+
+Node 4 reduced the targeted logical contradiction from observed to zero, a 100 percent reduction for this invariant during this run. This is not a person count accuracy result.
+
+The WebSocket run had zero JSON parse errors and one expected client close at completion. The sensing server remained ready with `engine_error_count=0`. A separate 45 second serial observation recorded 120 log lines, 17 CSI callback markers, zero ENOMEM backoffs, and zero other error lines.
+
+The updated OTA status endpoint reports the selected 1,900,544 byte partition rather than the stale 921,600 byte constant. The 1,051,168 byte image therefore fits with 849,376 bytes of partition headroom.
+
+## Remaining qualification
+
+Nodes 3 and 7 still demonstrate the old contradictory behavior and must be upgraded only after their network identity, OTA credential, and rollback path are verified. The current run had no labelled ground truth, so multi person fidelity and adjacent room rejection remain unmeasured.
+
+## Subsequent node 7 status
+
+Later on 2026 08 31, node 7 was separately identified, backed up, upgraded to firmware 0.8.8, and transport qualified for five minutes. That later occupied room run had zero fused presence count contradictions but did not produce the 30 absent edge packets required to supersede the historical control result above. See `docs/validation/2026-08-31-esp32-c6-node7-rate-aware-sensing.md`.
+
+## Acceptance test
+
+Repeat a five minute capture after every firmware change. Pass only when every updated node has at least 30 absent packets, zero packets where `presence=false` and `n_persons>0`, zero parser errors, and a ready sensing server with zero engine errors.

docs/validation/2026-08-31-esp32-c6-rate-aware-sensing.md

@@ -0,0 +1,124 @@
+# ESP32 C6 rate aware sensing qualification
+
+## Scope
+
+This record qualifies ADR 347 on one physically attached ESP32 C6 and verifies
+that the same source compiles for ESP32 S3. It measures transport cadence, edge
+DSP cadence, process stability, and end to end sensing delivery. It does not
+qualify heartbeat, respiration, gesture, pose, identity, or person count
+accuracy against labelled ground truth.
+
+## Hardware and firmware
+
+| Field | Measured value |
+|---|---|
+| Board | ESP32 C6 QFN40 revision 0.2 |
+| Logical node | 4 |
+| Firmware before | 0.8.4 |
+| Firmware after | 0.8.8 development build |
+| C6 app image | 1,051,552 bytes |
+| C6 app SHA 256 | `f2ea422c9b99ec13c7a168afc2b019229642769ffabfd8f29a85978770236e87` |
+| OTA slot size | 1,900,544 bytes |
+| OTA headroom | 848,992 bytes, 45 percent |
+| S3 compile image | 1,127,104 bytes |
+| S3 compile SHA 256 | `63e4f0c484d79e7dd37eb28275951c8beb924e6908942f7fec0b90d92109129c` |
+
+Only the application partition at offset `0x20000` was flashed. WiFi
+credentials, node identity, sensing server target, bootloader, partition table,
+OTA metadata, and NVS were preserved. The pre update OTA application was read
+to a private recovery file outside the repository. Its SHA 256 is
+`a2e503f1622b2f3f9c1cfce0a07ba34b9fc5d6a413b6346311622af1fe18a6d8`.
+
+The OTA status endpoint reported firmware 0.8.8 running from `ota_0` after the
+update. The sensing server health endpoint remained ready with ESP32 input.
+
+## Software gates
+
+| Gate | Result |
+|---|---|
+| Rate estimator and occupancy host tests | PASS, 30 assertions |
+| ADR 110 encoding host tests | PASS, 21 assertions |
+| mmWave frame predicate host tests | PASS, 8 assertions |
+| ESP32 C6 IDF 5.4 ARM64 build | PASS |
+| ESP32 S3 IDF 5.4 ARM64 build | PASS, compile only |
+| Image checksum and validation hash | PASS |
+| Repository diff whitespace check | PASS |
+| Local libFuzzer aggregate | NOT RUN, local Xcode toolchain lacks `libclang_rt.fuzzer_osx.a` |
+
+For this C6 record, the S3 result was source and toolchain validation only and
+no S3 runtime claim is made here. The later physical S3 Tier 0 transport run is
+recorded separately in
+`docs/validation/2026-08-31-esp32-s3-rate-aware-transport.md`.
+
+## Measured rate correction
+
+The pre update 20 second C6 baseline delivered a mean 34.05 raw callbacks per
+second, median 34.5, and range 28 through 37. An intermediate 0.8.7 physical
+run requested 10 Hz edge DSP but converged to 8.0 through 8.4 Hz while raw CSI
+remained 30 through 40 packets per second. This proved that C6 Tier 2 compute,
+not the raw transport, was the limiting path.
+
+Firmware 0.8.8 therefore keeps the 50 Hz probe and independent raw network
+path, but sets the C6 Tier 2 DSP clock to its measured sustainable 8 Hz. The
+phase preserving sampler prevents callback jitter from shifting the configured
+clock, and the filter estimator follows processed timestamps rather than raw
+probe intent.
+
+## Five minute physical result
+
+MEASURED on 2026 08 31 after flashing firmware 0.8.8:
+
+| Device observation | Result |
+|---|---:|
+| Duration | 300.64 seconds |
+| Controller ticks | 300 |
+| Raw callback mean | 34.92 pps |
+| Raw callback range | 22 through 41 pps |
+| Edge DSP mean | 8.00 Hz |
+| Edge DSP range | 8.00 through 8.00 Hz |
+| ENOMEM events | 0 |
+| UDP send failures | 0 |
+| Other steady state errors | 0 |
+| Watchdogs, panics, or reboots | 0 |
+
+| End to end WebSocket observation | Result |
+|---|---:|
+| Duration | 300.01 seconds |
+| Sensing frames | 26,786 |
+| JSON parse errors | 0 |
+| Reconnects | 0 |
+| Frames containing node 4 | 26,148 |
+| Node 4 frame coverage | 97.62 percent |
+| Node 4 stale frames | 0 |
+| Maximum node 4 inference age | 176 ms |
+| Maximum WebSocket frame gap | 110 ms |
+| Nodes per frame | 0 through 4 |
+| Fused `presence=false` with nonzero count contradictions | 0 |
+
+The boot log emitted one expected iTWT negotiation error because the access
+point rejected the requested target wake time parameters. Firmware immediately
+selected its documented opportunistic CSI fallback. No iTWT or other error
+recurred during the five minute steady state window.
+
+## Result and limitation
+
+ADR 347 timing and transport acceptance passes on the attached C6. Raw
+throughput did not regress relative to the short baseline, the edge clock now
+matches the rate the temporal filters actually receive, and node 4 was never
+stale when present in the live sensing service. The separate occupancy
+qualification recorded 61 absent node 4 packets with zero contradictions for
+the unchanged fail closed invariant. This run did not repeat an empty room
+sequence because the room was occupied during qualification.
+
+The largest remaining uncertainty is inference accuracy. Stable timing removes
+one source of feature distortion but cannot prove better heartbeat, respiration,
+gesture, or multi person classification without synchronized held out labels.
+
+## Acceptance test
+
+Repeat this five minute procedure after any timing, WiFi, filter, or task
+scheduling change. Pass only when raw callback yield remains at least 20 pps,
+DSP cadence remains within one hertz of the configured target, the device has
+zero steady state ENOMEM, send failure, watchdog, panic, and reboot events, the
+server has zero parse failures and reconnects, node 4 stays fresh, and fused
+presence count contradictions remain zero.

docs/validation/2026-08-31-esp32-s3-rate-aware-transport.md

@@ -0,0 +1,126 @@
+# ESP32 S3 rate aware transport qualification
+
+## Scope
+
+This record qualifies the firmware 0.8.8 raw transport path on one physically
+attached ESP32 S3. The node retained its existing Tier 0 configuration, so this
+run does not qualify the S3 edge DSP rate, temporal filters, heartbeat,
+respiration, gesture, pose, identity, person count, or localization accuracy.
+
+## Hardware and firmware
+
+| Field | Measured value |
+|---|---|
+| Board | ESP32 S3 QFN56 revision 0.2 with 2 MB embedded PSRAM |
+| Logical node | 1 |
+| Firmware before | 0.8.4 |
+| Firmware after | 0.8.8 development build |
+| Edge tier | 0, raw passthrough |
+| App image | 1,127,104 bytes |
+| App SHA 256 | `b531c76900c07d0d6f6e864a5f28afff3e71f124777af97358bb405b34e339a2` |
+| OTA slot size | 2,097,152 bytes |
+| OTA headroom | 970,048 bytes, 46 percent |
+
+The production partition table was read from the device before the update.
+Only the application partition at offset `0x20000` was flashed. WiFi
+credentials, logical node identity, channel, sensing server target, bootloader,
+partition table, OTA metadata, and NVS were preserved. A private recovery copy
+of the prior 2 MB application partition was saved outside the repository. Its
+SHA 256 is
+`14e72c060c4f1a465f739949b873f6aade5b8899a8909f6c5bb591ee49837c1b`.
+
+The post update boot log reported firmware 0.8.8, logical node 1, channel 4,
+the preserved UDP target, Tier 0 raw passthrough, and successful CSI streaming.
+The OTA status endpoint reported firmware 0.8.8 running from `ota_0` with the
+correct 2,097,152 byte update limit. The sensing server health endpoint remained
+ready with ESP32 input.
+
+## Software and image gates
+
+| Gate | Result |
+|---|---|
+| Firmware encoding, vitals, occupancy, and mmWave host tests | PASS, 59 assertions |
+| Firmware provisioning Python tests | PASS, 14 tests |
+| ESP32 S3 IDF 5.4 ARM64 clean build | PASS |
+| Image target detection | PASS, ESP32 S3 |
+| Image checksum | PASS |
+| Image validation hash | PASS |
+| Application partition fit | PASS, 46 percent free |
+| Physical flash write verification | PASS |
+| Preserved runtime configuration | PASS |
+
+The build excluded the optional WASM3 source because it was not present in the
+firmware checkout. The boot log therefore reported WASM Tier 3 disabled. That
+is not a regression introduced by this update and is outside this transport
+qualification.
+
+## Before and after comparison
+
+The pre update baseline was a 20 second serial and WebSocket capture on firmware
+0.8.4. The post update stability observation was 300 seconds on firmware 0.8.8.
+
+| Observation | Before 0.8.4 | After 0.8.8 | Change |
+|---|---:|---:|---:|
+| Raw CSI yield mean | 27.80 pps | 28.03 pps | plus 0.83 percent |
+| Server CSI FPS mean | 39.58 | 39.13 | minus 1.15 percent |
+| Node frame coverage | 100 percent | 100 percent | unchanged |
+| Maximum node staleness | 1,571 ms | 1,565 ms | minus 0.38 percent |
+| Maximum WebSocket frame gap | 111 ms | 112 ms | plus 0.90 percent |
+| Device or parser errors | 0 | 0 | unchanged |
+
+These small movements are operationally neutral and within uncontrolled room
+and WiFi variation. Firmware 0.8.8 did not regress the raw transport. Because
+Tier 0 bypasses the DSP task, this run provides no evidence that temporal
+features or inference accuracy improved.
+
+## Five minute physical result
+
+MEASURED on 2026 08 31 after flashing firmware 0.8.8:
+
+| Device observation | Result |
+|---|---:|
+| Duration | 300 seconds |
+| Controller yield samples | 300 |
+| Raw CSI yield mean | 28.03 pps |
+| Raw CSI yield range | 22 through 34 pps |
+| ENOMEM or stack errors | 0 |
+| UDP send failures | 0 |
+| ESP NOW send failures | 0 |
+| Unexpected resets | 0 |
+| Watchdogs or panics | 0 |
+
+| End to end WebSocket observation | Result |
+|---|---:|
+| Duration | 300.03 seconds |
+| Sensing frames | 10,559 |
+| Frames containing node 1 | 10,559 |
+| Node 1 frame coverage | 100 percent |
+| Source offline frames | 0 |
+| JSON parse errors | 0 |
+| WebSocket errors | 0 |
+| Early closes | 0 |
+| Maximum node staleness | 1,565 ms |
+| Maximum WebSocket frame gap | 112 ms |
+
+## Result and limitation
+
+The ESP32 S3 raw transport acceptance passes. Firmware 0.8.8 booted from the
+existing slot, retained the installation configuration, sustained the prior raw
+CSI delivery rate, and completed the burn with zero transport or runtime
+errors. The result extends ADR 347 physical coverage to the S3 transport path.
+
+The largest remaining uncertainty is S3 Tier 2 behavior and inference accuracy.
+The log line reporting the configured 20 Hz DSP cadence is not proof that DSP
+ran because the preserved Tier 0 setting explicitly disables the DSP task. A
+separate, rollback protected Tier 2 qualification with synchronized held out
+labels is required before making heartbeat, respiration, motion, or accuracy
+claims.
+
+## Acceptance test
+
+Repeat this five minute procedure after any S3 timing, WiFi, transport, or task
+scheduling change. Pass only when raw callback yield remains at least 20 pps,
+node frame coverage remains at least 99 percent, and the device and server have
+zero send failures, offline frames, parser errors, WebSocket errors, watchdogs,
+panics, and unexpected resets. Qualify Tier 2 separately and require its
+measured DSP cadence to stay within one hertz of the configured target.

firmware/esp32-csi-node/README.md

@@ -7,40 +7,81 @@ This firmware captures WiFi Channel State Information (CSI) from an ESP32-S3 (pr
 [![ESP-IDF v5.4](https://img.shields.io/badge/ESP--IDF-v5.4-blue.svg)](https://docs.espressif.com/projects/esp-idf/en/v5.4/)
 [![Target: ESP32-S3 / ESP32-C6](https://img.shields.io/badge/target-ESP32--S3%20%7C%20ESP32--C6-purple.svg)](https://www.espressif.com/en/products/socs/esp32-s3)
 [![License: MIT OR Apache-2.0](https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-green.svg)](../../LICENSE)
-[![Binary: ~943 KB](https://img.shields.io/badge/binary-~943%20KB-orange.svg)](#memory-budget)
+[![Binary: up to 1.1 MB](https://img.shields.io/badge/binary-up%20to%201.1%20MB-orange.svg)](#memory-budget)
 [![CI: Docker Build](https://img.shields.io/badge/CI-Docker%20Build-brightgreen.svg)](../../.github/workflows/firmware-ci.yml)
 
-> | Capability | Method | Performance |
-> |------------|--------|-------------|
-> | **CSI streaming** | Per-subcarrier I/Q capture over UDP | ~20 Hz, ADR-018 binary format |
-> | **Breathing detection** | Bandpass 0.1-0.5 Hz, zero-crossing BPM | 6-30 BPM |
-> | **Heart rate** | Bandpass 0.8-2.0 Hz, zero-crossing BPM | 40-120 BPM |
-> | **Presence indicator** (heuristic) | Phase variance + adaptive threshold (60 s ambient learning) | < 1 ms latency, false-positives under strong RF interference — see [Tier 2 caveats](#what-this-firmware-does-not-do-tier-2-caveats) |
+> | Capability | Method | Current contract |
+> |------------|--------|------------------|
+> | **CSI streaming** | Per-subcarrier I/Q capture over UDP | Radio-dependent cadence with a 20 packets-per-second hardware acceptance floor, ADR-018 binary format |
+> | **Breathing estimate** | Bandpass 0.1-0.5 Hz, zero-crossing BPM | Experimental 6-30 BPM output; calibrate against a reference before use |
+> | **Heart-rate estimate** | Bandpass 0.8-2.0 Hz, zero-crossing BPM | Experimental 40-120 BPM output; not a medical measurement |
+> | **Presence indicator** (heuristic) | Phase variance + adaptive threshold (60 s ambient learning) | Fast local indicator; strong RF interference can cause false positives — see [Tier 2 caveats](#what-this-firmware-does-not-do-tier-2-caveats) |
 > | **Fall detection** | Phase acceleration threshold | Configurable sensitivity |
 > | **Programmable sensing** | WASM modules loaded over HTTP | Hot-swap, no reflash |
 
+## Firmware 0.8.8 in plain language
+
+Release 0.8.8 makes the sensing stream more internally consistent and easier
+to diagnose:
+
+1. An empty-room decision can no longer carry a nonzero person count. Older
+   firmware could expose those two contradictory values at the same time.
+2. ESP32-C6 signal processing now uses a stable 8 Hz clock while raw CSI keeps
+   streaming at the faster radio-dependent rate. This prevents temporal
+   filters from silently using the wrong time scale.
+3. The one-second diagnostic reports both raw callback yield and the DSP rate,
+   making slow or overloaded nodes visible.
+4. OTA reports the application slot selected by the board instead of assuming
+   a fixed 900 KB limit.
+
+Two ESP32-C6 boards and one ESP32-S3 completed five-minute physical transport
+runs. The updated nodes had zero steady-state send failures, parser failures,
+watchdogs, panics, or reboots. These results prove timing and transport
+stability, not better heartbeat, pose, identity, or person-count accuracy.
+See the [0.8.8 release notes](../../docs/releases/v0.8.8-esp32.md) and
+[ADR 347](../../docs/adr/ADR-347-rate-aware-esp32-temporal-sensing.md) for the
+measured evidence and limitations.
+
 ---
 
 ## Quick Start
 
 For users who want to get running fast. Detailed explanations follow in later sections.
 
-### 0. Pre-built binaries (v0.6.5 — skip the build step)
+### 0. Download the 0.8.8 release
 
-Pre-built binaries are in `firmware/esp32-csi-node/release_bins/` (version: see `release_bins/version.txt`).
-Flash them directly:
+Use the versioned source tag and binaries on the
+[v0.8.8 ESP32 release page](https://github.com/ruvnet/RuView/releases/tag/v0.8.8-esp32).
+Choose the package that names both your chip and flash size:
+
+| Package | Use it for |
+|---------|------------|
+| `esp32-csi-node-v0.8.8-s3-8mb-flash-bundle.zip` | Fresh ESP32-S3 installation with 8 MB flash |
+| `esp32-csi-node-v0.8.8-s3-4mb-flash-bundle.zip` | Fresh ESP32-S3 installation with 4 MB flash |
+| `esp32-csi-node-v0.8.8-c6-4mb-flash-bundle.zip` | Fresh ESP32-C6 installation using the supported 4 MB layout |
+
+Each bundle contains the matching bootloader, partition table, OTA metadata,
+application, checksums, and a short flashing guide. Never flash an S3 bundle
+onto a C6, or a C6 bundle onto an S3.
+
+Example for an 8 MB ESP32-S3 after extracting its bundle:
 
 ```bash
 python -m esptool --chip esp32s3 --port COM7 --baud 460800 \
   write_flash --flash_mode dio --flash_size 8MB \
-  0x0     firmware/esp32-csi-node/release_bins/bootloader.bin \
-  0x8000  firmware/esp32-csi-node/release_bins/partition-table.bin \
-  0xf000  firmware/esp32-csi-node/release_bins/ota_data_initial.bin \
-  0x20000 firmware/esp32-csi-node/release_bins/esp32-csi-node.bin
+  0x0     bootloader.bin \
+  0x8000  partition-table.bin \
+  0xf000  ota_data_initial.bin \
+  0x20000 esp32-csi-node.bin
 ```
 
-For 4 MB boards use `release_bins/esp32-csi-node-4mb.bin` and `release_bins/partition-table-4mb.bin`
-with `--flash_size 4MB`.
+For an existing provisioned node, back up its current application and inspect
+`http://DEVICE_IP:8032/ota/status` before choosing an application-only update.
+Writing only offset `0x20000` is safe only when the status endpoint reports
+`running_partition` as `ota_0` and the downloaded image matches the board.
+The full bundles do not include NVS, so the documented four-offset install
+preserves WiFi and node configuration while replacing the boot and application
+images.
 
 ### 1. Build (Docker -- the only reliable method)
 
@@ -111,7 +152,7 @@ curl http://<ESP32_IP>:8032/wasm/list
 | **Recommended boards** | ESP32-S3-DevKitC-1, XIAO ESP32-S3 | Any ESP32-S3 with 8 MB flash works |
 | **Deployment** | 3-6 nodes per room | Multistatic mesh for 360-degree coverage |
 
-> **Tip:** A single node provides presence and vital signs along its line of sight. Multiple nodes (3-6) create a multistatic mesh that resolves 3D pose with <30 mm jitter and zero identity swaps.
+> **Tip:** A single node is mainly useful for presence and motion along one RF link. Three or more spatially separated links improve geometry and track separation. Location, pose, and multi-person accuracy still require room-specific calibration and held-out ground-truth evaluation.
 
 > **⚠️ Thermal warning — compact boards (ESP32-S3-Zero, SuperMini, other coin-sized clones):** This firmware runs the WiFi radio with modem sleep disabled (`WIFI_PS_NONE`, required for continuous CSI capture) plus a full edge-processing DSP pipeline on Core 1 (`edge_tier=2`) plus, on ADR-183 builds, a continuous 40 Hz onboard LED driver. That's sustained high current draw with no duty-cycling. Full-size dev boards (DevKitC-1, XIAO) have more copper pour and thermal mass around the regulator and tolerate this fine. Coin-sized clones with minimal PCB area and budget regulators may run hot to the touch during normal operation, and in at least one field report, boards that ran hot during a session failed to power on afterward (regulator damage suspected — see issue tracker). Give these boards airflow, don't stack or enclose them, and check them by touch during the first several minutes of a new deployment. If a board is uncomfortably hot (not just warm), power it down and let it cool before continuing.
 

firmware/esp32-csi-node/main/Kconfig.projbuild

@@ -39,6 +39,17 @@ menu "CSI Node Configuration"
         help
             WiFi channel to listen on for CSI data.
 
+    config CSI_SELF_PING_HZ
+        int "Connected-STA CSI probe rate (Hz)"
+        default 50
+        range 10 50
+        help
+            Rate of the one-byte ICMP probes used to create a stable OFDM
+            CSI source on quiet networks. Fifty hertz is the measured safety
+            ceiling for the current ESP-IDF WiFi callback path. Higher rates
+            are intentionally rejected because sustained callback load above
+            50 Hz has caused WiFi ISR and packet-buffer failures on S3 and C6.
+
 endmenu
 
 menu "Edge Intelligence (ADR-039)"
@@ -66,6 +77,18 @@ menu "Edge Intelligence (ADR-039)"
         help
             Number of highest-variance subcarriers to use for DSP.
 
+    config EDGE_DSP_SAMPLE_HZ
+        int "On-device edge DSP sample rate (Hz)"
+        default 8 if IDF_TARGET_ESP32C6
+        default 20
+        range 8 50
+        help
+            Uniform rate at which CSI callbacks enter the Tier 1 and Tier 2
+            edge DSP. Raw CSI transmission keeps its independent full-rate
+            path. Eight hertz is the hardware-measured sustainable C6 Tier 2
+            setting and preserves a 4 Hz Nyquist limit for the 0.1-2.0 Hz
+            vital bands.
+
     config EDGE_FALL_THRESH
         int "Fall detection threshold (x1000)"
         default 15000

firmware/esp32-csi-node/main/adaptive_controller.c

@@ -248,9 +248,10 @@ static void medium_loop_cb(TimerHandle_t t)
     portEXIT_CRITICAL(&s_obs_lock);
 
     if (s_obs_valid) {
-        ESP_LOGI(TAG, "medium tick: state=%u yield=%upps motion=%.2f presence=%.2f rssi=%d",
+        ESP_LOGI(TAG, "medium tick: state=%u yield=%upps dsp=%.1fHz motion=%.2f presence=%.2f rssi=%d",
                  (unsigned)s_state,
                  (unsigned)obs.pkt_yield_per_sec,
+                 (double)edge_get_sample_rate_hz(),
                  (double)obs.motion_score,
                  (double)obs.presence_score,
                  (int)obs.rssi_median_dbm);

firmware/esp32-csi-node/main/csi_collector.c

@@ -63,6 +63,32 @@ static uint32_t s_send_ok = 0;
 static uint32_t s_send_fail = 0;
 static uint32_t s_rate_skip = 0;
 
+#ifndef CONFIG_CSI_SELF_PING_HZ
+#define CONFIG_CSI_SELF_PING_HZ 50
+#endif
+
+#if CONFIG_CSI_SELF_PING_HZ < 10 || CONFIG_CSI_SELF_PING_HZ > 50
+#error "CONFIG_CSI_SELF_PING_HZ must stay within the hardware-qualified 10-50 Hz range"
+#endif
+
+#define CSI_SELF_PING_INTERVAL_MS (1000U / CONFIG_CSI_SELF_PING_HZ)
+
+#ifndef CONFIG_EDGE_DSP_SAMPLE_HZ
+#if CONFIG_IDF_TARGET_ESP32C6
+#define CONFIG_EDGE_DSP_SAMPLE_HZ 8
+#else
+#define CONFIG_EDGE_DSP_SAMPLE_HZ 20
+#endif
+#endif
+
+#if CONFIG_EDGE_DSP_SAMPLE_HZ < 8 || CONFIG_EDGE_DSP_SAMPLE_HZ > 50
+#error "CONFIG_EDGE_DSP_SAMPLE_HZ must stay within the supported 8-50 Hz range"
+#endif
+
+#define EDGE_DSP_MIN_INTERVAL_US (1000000U / CONFIG_EDGE_DSP_SAMPLE_HZ)
+static int64_t s_next_edge_enqueue_us = 0;
+static uint32_t s_edge_rate_skip = 0;
+
 /**
  * Minimum interval between UDP sends in microseconds.
  * CSI callbacks can fire hundreds of times per second in promiscuous mode.
@@ -300,10 +326,31 @@ static void wifi_csi_callback(void *ctx, wifi_csi_info_t *info)
         }
     }
 
-    /* ADR-039: Enqueue raw I/Q into edge processing ring buffer. */
+    /* ADR-039 / ADR-347: Raw CSI stays at the independent network cadence,
+     * while the on-device Tier 1/2 pipeline receives a uniform, sustainable
+     * stream. Enqueuing every burst frame overloaded the unicore C6 DSP and
+     * turned 30-40 callback pps into an irregular approximately 8 Hz subset. */
     if (info->buf && info->len > 0) {
-        edge_enqueue_csi((const uint8_t *)info->buf, (uint16_t)info->len,
-                         (int8_t)info->rx_ctrl.rssi, info->rx_ctrl.channel);
+        if (s_next_edge_enqueue_us == 0) {
+            s_next_edge_enqueue_us = now_us;
+        }
+
+        if (now_us >= s_next_edge_enqueue_us) {
+            (void)edge_enqueue_csi((const uint8_t *)info->buf, (uint16_t)info->len,
+                                   (int8_t)info->rx_ctrl.rssi, info->rx_ctrl.channel);
+
+            /* Preserve the configured sample clock instead of resetting it to
+             * each irregular callback. With roughly 35 raw callbacks per
+             * second, a last-seen 100 ms gate selected every fourth callback
+             * and drifted to roughly 8 Hz. Advancing the deadline by complete
+             * periods alternates the available callbacks around the configured
+             * phase and prevents both drift and catch-up bursts. */
+            int64_t periods = ((now_us - s_next_edge_enqueue_us) /
+                               EDGE_DSP_MIN_INTERVAL_US) + 1;
+            s_next_edge_enqueue_us += periods * EDGE_DSP_MIN_INTERVAL_US;
+        } else {
+            s_edge_rate_skip++;
+        }
     }
 
     /* ADR-110 §A0.11/§A0.12 — Emit a sync-packet every N CSI frames so the
@@ -411,7 +458,7 @@ static void csi_start_self_ping(void)
     esp_ping_config_t cfg = ESP_PING_DEFAULT_CONFIG();
     cfg.target_addr     = target;
     cfg.count           = ESP_PING_COUNT_INFINITE;
-    cfg.interval_ms     = 20;     /* 50 Hz -> ~50 received OFDM replies/sec */
+    cfg.interval_ms     = CSI_SELF_PING_INTERVAL_MS;
     cfg.data_size       = 1;
     cfg.task_stack_size = 4096;
 
@@ -424,7 +471,8 @@ static void csi_start_self_ping(void)
 
     if (esp_ping_new_session(&cfg, &cbs, &s_self_ping) == ESP_OK && s_self_ping != NULL) {
         esp_ping_start(s_self_ping);
-        ESP_LOGI(TAG, "self-ping started -> %s @50Hz (CSI OFDM source, fix #521/#954)", gw_str);
+        ESP_LOGI(TAG, "self-ping started -> %s @%dHz (CSI OFDM source, fix #521/#954)",
+                 gw_str, CONFIG_CSI_SELF_PING_HZ);
     } else {
         ESP_LOGW(TAG, "self-ping: esp_ping_new_session failed");
         s_self_ping = NULL;
@@ -592,6 +640,8 @@ void csi_collector_init(void)
 
     ESP_LOGI(TAG, "CSI collection initialized (node_id=%u, channel=%u)",
              (unsigned)s_node_id, (unsigned)csi_channel);
+    ESP_LOGI(TAG, "edge DSP cadence=%dHz; raw CSI network cadence remains independent",
+             CONFIG_EDGE_DSP_SAMPLE_HZ);
 
     /* RuView#521/#954: start the connected-STA traffic source so the CSI engine
      * receives a guaranteed OFDM unicast floor even when promiscuous capture is

firmware/esp32-csi-node/main/edge_processing.c

@@ -38,6 +38,16 @@ extern nvs_config_t g_nvs_config;
 
 static const char *TAG = "edge_proc";
 
+#ifndef CONFIG_EDGE_DSP_SAMPLE_HZ
+#if CONFIG_IDF_TARGET_ESP32C6
+#define CONFIG_EDGE_DSP_SAMPLE_HZ 8
+#else
+#define CONFIG_EDGE_DSP_SAMPLE_HZ 20
+#endif
+#endif
+
+#define EDGE_CONFIGURED_SAMPLE_RATE_HZ ((float)CONFIG_EDGE_DSP_SAMPLE_HZ)
+
 /* ======================================================================
  * SPSC Ring Buffer (lock-free, single-producer single-consumer)
  * ====================================================================== */
@@ -355,11 +365,12 @@ static float s_heartrate_filtered[EDGE_PHASE_HISTORY_LEN];
 
 /** Measured CSI sample rate (Hz), smoothed from frame timestamps.
  * #985's self-ping raised the callback rate above the old ~10 Hz beacon
- * assumption and made it variable (~13-19 Hz); a fixed rate scaled BPM wrong
- * and made HR swing with CSI yield. See update in process_csi_frame(). */
-static float    s_sample_rate_hz   = 15.0f;
-static float    s_filter_design_fs = 20.0f; /* fs the biquads were last designed at */
-static uint32_t s_last_frame_ts_us = 0;
+ * assumption and made it variable. A fixed rate scales BPM and Doppler bins
+ * incorrectly. Start from the filter design rate, then follow measured time. */
+static float    s_sample_rate_hz   = EDGE_CONFIGURED_SAMPLE_RATE_HZ;
+static float    s_filter_design_fs = EDGE_CONFIGURED_SAMPLE_RATE_HZ; /* fs the biquads were last designed at */
+static uint32_t s_rate_window_start_us = 0;
+static uint32_t s_rate_window_intervals = 0;
 
 /** Latest vitals state. */
 static float    s_breathing_bpm;
@@ -409,6 +420,21 @@ static edge_biquad_t s_person_bq_hr[EDGE_MAX_PERSONS];
 static float s_person_br_filt[EDGE_MAX_PERSONS][EDGE_PHASE_HISTORY_LEN];
 static float s_person_hr_filt[EDGE_MAX_PERSONS][EDGE_PHASE_HISTORY_LEN];
 
+/** Clear person slots whenever the room-level presence gate is closed. */
+static void reset_person_count_state(void)
+{
+    s_person_count_candidate = 0;
+    s_person_count_streak = 0;
+    s_person_count_stable = 0;
+    for (uint8_t p = 0; p < EDGE_MAX_PERSONS; p++) {
+        s_persons[p].active = false;
+        s_persons[p].history_len = 0;
+        s_persons[p].history_idx = 0;
+        s_persons[p].breathing_bpm = 0.0f;
+        s_persons[p].heartrate_bpm = 0.0f;
+    }
+}
+
 /** Latest vitals packet (thread-safe via volatile copy). */
 static volatile edge_vitals_pkt_t s_latest_pkt;
 static volatile bool s_pkt_valid;
@@ -898,7 +924,10 @@ static void send_vitals_packet(void)
     for (uint8_t p = 0; p < EDGE_MAX_PERSONS; p++) {
         if (s_persons[p].active) n_active++;
     }
-    pkt.n_persons = n_active;
+    /* Fail closed: the slot heuristic cannot assert occupants while the
+     * debounced presence gate is false. The host repeats this invariant for
+     * backward compatibility with older firmware. */
+    pkt.n_persons = edge_evidence_person_count(s_presence_detected, n_active);
 
     pkt.motion_energy = s_motion_energy;
     pkt.presence_score = s_presence_score;
@@ -1038,20 +1067,27 @@ static void process_frame(const edge_ring_slot_t *slot)
     s_frame_count++;
     s_latest_rssi = slot->rssi;
 
-    /* Measure the REAL CSI sample rate from inter-frame timestamps. #985's
-     * self-ping made the callback rate variable (~13-19 Hz); the old fixed
-     * 10 Hz both scaled BPM wrong (true ~87 BPM read as ~45) and made HR swing
-     * as CSI yield fluctuated. EMA-smooth and clamp to a plausible band. */
-    if (s_last_frame_ts_us != 0 && slot->timestamp_us > s_last_frame_ts_us) {
-        float dt = (float)(slot->timestamp_us - s_last_frame_ts_us) * 1e-6f;
-        if (dt > 0.02f && dt < 0.5f) {            /* 2-50 Hz plausible; reject gaps/hops */
-            float inst = 1.0f / dt;
-            s_sample_rate_hz += 0.05f * (inst - s_sample_rate_hz);
-            if (s_sample_rate_hz < 8.0f)  s_sample_rate_hz = 8.0f;
-            if (s_sample_rate_hz > 30.0f) s_sample_rate_hz = 30.0f;
+    /* Measure the real CSI sample rate over one-second timestamp windows. WiFi
+     * replies arrive in bursts, so filtering individual short intervals made
+     * a 35 pps stream look like 12-16 Hz. Counting all processed intervals in
+     * the window preserves the clock actually seen by the temporal filters. */
+    if (s_rate_window_start_us == 0) {
+        s_rate_window_start_us = slot->timestamp_us;
+        s_rate_window_intervals = 0;
+    } else if (slot->timestamp_us > s_rate_window_start_us) {
+        s_rate_window_intervals++;
+        uint32_t elapsed_us = slot->timestamp_us - s_rate_window_start_us;
+        if (elapsed_us >= EDGE_SAMPLE_RATE_WINDOW_MIN_US) {
+            s_sample_rate_hz = edge_sample_rate_window_update(
+                s_sample_rate_hz, s_rate_window_intervals, elapsed_us);
+            s_rate_window_start_us = slot->timestamp_us;
+            s_rate_window_intervals = 0;
         }
+    } else {
+        /* Timer wrap or reset. Start a fresh evidence window. */
+        s_rate_window_start_us = slot->timestamp_us;
+        s_rate_window_intervals = 0;
     }
-    s_last_frame_ts_us = slot->timestamp_us;
 
     /* Re-tune the biquads if the measured rate has drifted from their design fs,
      * so the breathing (0.1-0.5 Hz) and HR (0.8-2.0 Hz) passbands stay in real
@@ -1202,8 +1238,15 @@ static void process_frame(const edge_ring_slot_t *slot)
         }
     }
 
-    /* --- Step 11: Multi-person vitals --- */
-    update_multi_person_vitals(slot->iq_data, n_subcarriers, sample_rate);
+    /* --- Step 11: Multi-person vitals ---
+     * Person slots are subordinate to the room presence gate. Processing or
+     * retaining slots while absent produced contradictory packets such as
+     * presence=false with n_persons=4. */
+    if (s_presence_detected) {
+        update_multi_person_vitals(slot->iq_data, n_subcarriers, sample_rate);
+    } else {
+        reset_person_count_state();
+    }
     /* Yield after multi-person DSP so IDLE1 can feed Core 1 watchdog (#683). */
     if (s_cfg.tier >= 2) vTaskDelay(1);
 
@@ -1314,6 +1357,11 @@ bool edge_get_vitals(edge_vitals_pkt_t *pkt)
     return true;
 }
 
+float edge_get_sample_rate_hz(void)
+{
+    return s_sample_rate_hz;
+}
+
 void edge_get_multi_person(edge_person_vitals_t *persons, uint8_t *n_active)
 {
     uint8_t active = 0;
@@ -1373,6 +1421,10 @@ esp_err_t edge_processing_init(const edge_config_t *cfg)
     s_fall_detected = false;
     s_latest_rssi = 0;
     s_frame_count = 0;
+    s_sample_rate_hz = EDGE_CONFIGURED_SAMPLE_RATE_HZ;
+    s_filter_design_fs = EDGE_CONFIGURED_SAMPLE_RATE_HZ;
+    s_rate_window_start_us = 0;
+    s_rate_window_intervals = 0;
     s_prev_phase_velocity = 0.0f;
     s_fall_consec_count = 0;
     s_fall_last_alert_us = 0;
@@ -1397,9 +1449,9 @@ esp_err_t edge_processing_init(const edge_config_t *cfg)
     s_person_count_streak = 0;
     s_person_count_stable = 0;
 
-    /* Design biquad bandpass filters.
-     * Sampling rate ~20 Hz (typical ESP32 CSI callback rate). */
-    const float fs = 20.0f;
+    /* Design biquad bandpass filters against the configured DSP clock. The
+     * measured timestamp estimator then follows sustained hardware drift. */
+    const float fs = EDGE_CONFIGURED_SAMPLE_RATE_HZ;
     biquad_bandpass_design(&s_bq_breathing, fs, 0.1f, 0.5f);
     biquad_bandpass_design(&s_bq_heartrate, fs, 0.8f, 2.0f);
 

firmware/esp32-csi-node/main/edge_processing.h

@@ -35,9 +35,56 @@
 #define EDGE_TOP_K            8     /**< Top-K subcarriers to track. */
 #define EDGE_MAX_SUBCARRIERS  128   /**< Max subcarriers per frame. */
 
+/* ---- Measured sample-rate tracking ----
+ *
+ * The connected-STA probe produces up to 50 CSI opportunities per second,
+ * while contention and callback gating make the delivered cadence variable.
+ * Temporal filters must follow measured time rather than a fixed frame-rate
+ * assumption. The 60 Hz estimator ceiling leaves jitter headroom above the
+ * qualified 50 Hz callback limit. A one-second frame-count window represents
+ * bursty but valid WiFi arrivals more accurately than averaging only selected
+ * inter-frame intervals. */
+#define EDGE_SAMPLE_RATE_MIN_HZ 8.0f
+#define EDGE_SAMPLE_RATE_MAX_HZ 60.0f
+#define EDGE_SAMPLE_RATE_EMA_ALPHA 0.25f
+#define EDGE_SAMPLE_RATE_WINDOW_MIN_US 1000000U
+#define EDGE_SAMPLE_RATE_WINDOW_MAX_US 3000000U
+
+static inline float edge_sample_rate_window_update(float current_hz,
+                                                   uint32_t frame_intervals,
+                                                   uint32_t elapsed_us)
+{
+    if (frame_intervals == 0 || elapsed_us < EDGE_SAMPLE_RATE_WINDOW_MIN_US ||
+        elapsed_us > EDGE_SAMPLE_RATE_WINDOW_MAX_US) {
+        return current_hz;
+    }
+
+    float instant_hz = (float)frame_intervals * 1000000.0f / (float)elapsed_us;
+    if (instant_hz < EDGE_SAMPLE_RATE_MIN_HZ) instant_hz = EDGE_SAMPLE_RATE_MIN_HZ;
+    if (instant_hz > EDGE_SAMPLE_RATE_MAX_HZ) instant_hz = EDGE_SAMPLE_RATE_MAX_HZ;
+    float next_hz = current_hz + EDGE_SAMPLE_RATE_EMA_ALPHA * (instant_hz - current_hz);
+    if (next_hz < EDGE_SAMPLE_RATE_MIN_HZ) return EDGE_SAMPLE_RATE_MIN_HZ;
+    if (next_hz > EDGE_SAMPLE_RATE_MAX_HZ) return EDGE_SAMPLE_RATE_MAX_HZ;
+    return next_hz;
+}
+
 /* ---- Multi-person ---- */
 #define EDGE_MAX_PERSONS      4     /**< Max simultaneous persons. */
 
+/**
+ * Enforce the wire-level occupancy invariant.
+ *
+ * A subcarrier slot estimate is supporting evidence only. It cannot assert an
+ * occupant when the independently debounced presence gate is false. Keeping
+ * this helper in the public firmware header lets host tests exercise the exact
+ * function used by the device build.
+ */
+static inline uint8_t edge_evidence_person_count(bool presence, uint8_t active_count)
+{
+    if (!presence) return 0;
+    return active_count > EDGE_MAX_PERSONS ? EDGE_MAX_PERSONS : active_count;
+}
+
 /* ---- Multi-person counting gates (issue #998) ----
  *
  * Over-counting root cause: the multi-person path used to split the top-K
@@ -238,6 +285,12 @@ bool edge_enqueue_csi(const uint8_t *iq_data, uint16_t iq_len,
  */
 bool edge_get_vitals(edge_vitals_pkt_t *pkt);
 
+/**
+ * Return the timestamp-derived CSI cadence used to design temporal filters.
+ * This is diagnostic evidence, not the raw callback or network delivery rate.
+ */
+float edge_get_sample_rate_hz(void);
+
 /**
  * Get multi-person vitals array.
  *

firmware/esp32-csi-node/main/ota_update.c

@@ -23,9 +23,6 @@ static const char *TAG = "ota_update";
 /** OTA HTTP server port. */
 #define OTA_PORT 8032
 
-/** Maximum firmware size (900 KB — matches CI binary size gate). */
-#define OTA_MAX_SIZE (900 * 1024)
-
 /** NVS namespace and key for the OTA pre-shared key. */
 #define OTA_NVS_NAMESPACE "security"
 #define OTA_NVS_KEY       "ota_psk"
@@ -95,11 +92,11 @@ static esp_err_t ota_status_handler(httpd_req_t *req)
     int len = snprintf(response, sizeof(response),
         "{\"version\":\"%s\",\"date\":\"%s\",\"time\":\"%s\","
         "\"running_partition\":\"%s\",\"next_partition\":\"%s\","
-        "\"max_size\":%d}",
+        "\"max_size\":%lu}",
         app->version, app->date, app->time,
         running ? running->label : "unknown",
         update ? update->label : "none",
-        OTA_MAX_SIZE);
+        (unsigned long)(update ? update->size : 0));
 
     httpd_resp_set_type(req, "application/json");
     httpd_resp_send(req, response, len);
@@ -121,12 +118,6 @@ static esp_err_t ota_upload_handler(httpd_req_t *req)
 
     ESP_LOGI(TAG, "OTA update started, content_length=%d", req->content_len);
 
-    if (req->content_len <= 0 || req->content_len > OTA_MAX_SIZE) {
-        httpd_resp_send_err(req, HTTPD_400_BAD_REQUEST,
-                            "Invalid firmware size (must be 1B - 900KB)");
-        return ESP_FAIL;
-    }
-
     const esp_partition_t *update_partition = esp_ota_get_next_update_partition(NULL);
     if (update_partition == NULL) {
         httpd_resp_send_err(req, HTTPD_500_INTERNAL_SERVER_ERROR,
@@ -134,6 +125,15 @@ static esp_err_t ota_upload_handler(httpd_req_t *req)
         return ESP_FAIL;
     }
 
+    if (req->content_len <= 0 || (size_t)req->content_len > update_partition->size) {
+        ESP_LOGW(TAG, "OTA rejected: content_length=%d exceeds partition '%s' size=%lu",
+                 req->content_len, update_partition->label,
+                 (unsigned long)update_partition->size);
+        httpd_resp_send_err(req, HTTPD_400_BAD_REQUEST,
+                            "Invalid firmware size for OTA partition");
+        return ESP_FAIL;
+    }
+
     esp_ota_handle_t ota_handle;
     esp_err_t err = esp_ota_begin(update_partition, OTA_WITH_SEQUENTIAL_WRITES, &ota_handle);
     if (err != ESP_OK) {

firmware/esp32-csi-node/sdkconfig.defaults.esp32c6

@@ -58,6 +58,10 @@ CONFIG_ULP_COPROC_RESERVE_MEM=8192
 # CONFIG_DISPLAY_ENABLE is not set
 # CONFIG_WASM_ENABLE is not set
 
+# Physical Tier 2 qualification on ESP32-C6 rev 0.2 converges at 8 Hz while
+# leaving the raw network CSI stream independent at roughly 30-40 pps.
+CONFIG_EDGE_DSP_SAMPLE_HZ=8
+
 # ── Compiler ──
 CONFIG_COMPILER_OPTIMIZATION_SIZE=y
 

firmware/esp32-csi-node/test/test_vitals_count_presence.c

@@ -266,6 +266,19 @@ static void test_debounce_flapping_stays_stable(void)
     CHECK_EQ_U8("flapping count stays at 1", out, 1);
 }
 
+/* The packet count is evidence subordinated to presence, never an independent
+ * occupancy assertion. This guards the field failure where a node emitted
+ * presence=false with n_persons=3 or 4. */
+static void test_person_count_fails_closed_without_presence(void)
+{
+    CHECK_EQ_U8("absent with four active slots -> zero",
+                edge_evidence_person_count(false, 4), 0);
+    CHECK_EQ_U8("present preserves a bounded count",
+                edge_evidence_person_count(true, 3), 3);
+    CHECK_EQ_U8("present count clamps to protocol maximum",
+                edge_evidence_person_count(true, 255), EDGE_MAX_PERSONS);
+}
+
 /* ──────────────────────────────────────────────────────────────────────
  *  #996 — presence_flag_update: dithering score must NOT flicker the flag
  * ────────────────────────────────────────────────────────────────────── */
@@ -357,6 +370,36 @@ static void test_presence_dead_band_holds_state(void)
     CHECK_TRUE("dead band does not clear from true", flag);
 }
 
+/* The physical C6 delivered 28-37 CSI frames/s while the former estimator was
+ * capped at 30 Hz. A 34 Hz stream must converge above that old ceiling. */
+static void test_sample_rate_tracks_above_thirty_hz(void)
+{
+    float rate = 20.0f;
+    for (int i = 0; i < 12; i++) {
+        rate = edge_sample_rate_window_update(rate, 34U, 1000000U);
+    }
+    CHECK_TRUE("sample rate follows measured 34 Hz cadence", rate > 33.0f && rate < 35.0f);
+}
+
+static void test_sample_rate_requires_complete_window(void)
+{
+    float rate = 34.0f;
+    CHECK_TRUE("short window rejected",
+               edge_sample_rate_window_update(rate, 10U, 200000U) == rate);
+    CHECK_TRUE("stalled window rejected",
+               edge_sample_rate_window_update(rate, 10U, 4000000U) == rate);
+}
+
+static void test_sample_rate_is_bounded(void)
+{
+    float rate = EDGE_SAMPLE_RATE_MAX_HZ;
+    CHECK_TRUE("sample rate upper bound holds",
+               edge_sample_rate_window_update(rate, 1000U, 1000000U) <= EDGE_SAMPLE_RATE_MAX_HZ);
+    rate = EDGE_SAMPLE_RATE_MIN_HZ;
+    CHECK_TRUE("sample rate lower bound holds",
+               edge_sample_rate_window_update(rate, 1U, 1000000U) >= EDGE_SAMPLE_RATE_MIN_HZ);
+}
+
 /* ──────────────────────────────────────────────────────────────────────
  *  main
  * ────────────────────────────────────────────────────────────────────── */
@@ -375,6 +418,7 @@ int main(void)
     test_debounce_rejects_transient_spike();
     test_debounce_accepts_sustained_change();
     test_debounce_flapping_stays_stable();
+    test_person_count_fails_closed_without_presence();
 
     /* #996 presence hysteresis */
     test_presence_no_flicker_on_dither();
@@ -382,6 +426,11 @@ int main(void)
     test_presence_genuine_departure_clears();
     test_presence_dead_band_holds_state();
 
+    /* Timestamp-derived temporal calibration */
+    test_sample_rate_tracks_above_thirty_hz();
+    test_sample_rate_requires_complete_window();
+    test_sample_rate_is_bounded();
+
     printf("\n%d passed, %d failed\n", g_passed, g_failed);
     return g_failed == 0 ? 0 : 1;
 }

firmware/esp32-csi-node/version.txt

@@ -1 +1 @@
-0.8.4
+0.8.8

harness/ruview/.claude/skills/cognitum-spaces/SKILL.md

@@ -0,0 +1,77 @@
+# Cognitum Spaces OAuth activation
+
+Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces
+projection without giving an agent a bearer token or API key.
+
+## Boundary
+
+- This is a read-only P2/P3 semantic projection. HomeCore Edge remains
+  authoritative.
+- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and
+  identity observations are prohibited.
+- `spaces:read` grants no pairing, publication, write, command, policy approval,
+  spending, or actuator authority.
+- A read may refresh an expiring OAuth session and atomically rotate the local
+  credential file.
+
+## Activate OAuth explicitly
+
+Install or build the `wifi-densepose` CLI, then request the additional scope:
+
+```bash
+wifi-densepose login --spaces
+```
+
+For a terminal without a browser:
+
+```bash
+wifi-densepose login --spaces --no-browser
+```
+
+Confirm that the account reports `spaces:read`, then list through the
+metaharness:
+
+```bash
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites
+npx @ruvnet/ruview spaces --resource events --limit 25
+```
+
+The versioned collections are `sites`, `buildings`, `floors`, `spaces`,
+`zones`, `entities`, `events`, and `alerts`. Continue a page with the returned
+opaque `nextCursor`; do not decode or reuse a cursor for another collection.
+
+Use `--credentials-path <private-file>` only from the human-invoked CLI when a
+non-default credential store is intentional. Never put a bearer token or API
+key on the command line.
+
+## MCP
+
+The tool is `ruview_spaces_list`. It is denied by default even though the cloud
+operation is read-only, because it consumes a local identity credential and
+contacts an external service. The MCP server operator must grant that capability
+and may bind the credential path in the server environment:
+
+```bash
+RUVIEW_MCP_GRANTS=credential-use \
+RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
+npx @ruvnet/ruview mcp start
+```
+
+MCP calls cannot choose a credential path and the tool schema has no token or
+API-key, workspace override, or base-URL field. The API origin is fixed to
+`https://api.cognitum.one`, the adapter requires an installed
+`wifi-densepose` binary, and the child environment excludes
+`COGNITUM_SPACES_API`, so this
+surface verifies the OAuth path rather than silently taking the compatibility
+API-key path.
+
+## Interpret results honestly
+
+An empty `data` list can be a valid authenticated tenant result. It proves the
+read path and isolation behavior, not sensing quality. Every accepted response
+must declare `HomeCore Edge` as authoritative and carry the complete prohibited
+field list. Parent lineage, schema version, anonymous person/track identity,
+event/alert fields, confidence, and cursor bounds are independently checked.
+Any malformed, oversized, non-semantic, or raw-field response fails closed.

harness/ruview/.harness/claims.json

@@ -11,6 +11,11 @@
       "ruview_memory_search"
     ],
     "grants": {
+      "credential-use": {
+        "tools": ["ruview_spaces_list"],
+        "requiresConfirmation": false,
+        "notes": "Allows a tenant-scoped external read; OAuth refresh may rotate the local credential file."
+      },
       "workspace-write": {
         "tools": ["ruview_calibrate"],
         "requiresConfirmation": true

harness/ruview/.harness/manifest.json

@@ -3,7 +3,7 @@
   "generator": "RuView metaharness provenance v2",
   "template": "vertical:ruview",
   "name": "@ruvnet/ruview",
-  "version": "0.3.1",
+  "version": "0.5.1",
   "hosts": [
     "claude-code",
     "codex"
@@ -12,49 +12,52 @@
   "files": {
     ".claude/settings.json": "57d03e8995363bd120fb6d515702967afd0bd557797051301ff8f8156c845824",
     ".claude/skills/calibrate-room/SKILL.md": "4b29c7c331f47acad3c0f51b3d3d8f5b5573e316e081bae71dbe21a47fa95240",
+    ".claude/skills/cognitum-spaces/SKILL.md": "96ae42cc72ad31dbb2f34d59e874c4d15f2e55fc969cd1f610dc1b9a4138840e",
     ".claude/skills/onboard/SKILL.md": "97ee71f0aa985cfc03bb8e764789bb55c4f9fd5dae10a116c1071eab85b5893f",
     ".claude/skills/provision-node/SKILL.md": "5f73823794ed5f0b25c102aa8b1bf2dd534a1ec468173d8330c2af0ca24f239c",
     ".claude/skills/train-pose/SKILL.md": "92aebd4423470eb10eabaee642ec3493284d98b7ae9785e0f34378c709746e65",
     ".claude/skills/verify/SKILL.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76",
-    ".harness/claims.json": "fce72c9fc39d631adba41bab2614b0a373a7af8f31af5f8f36aa985c92a57885",
-    ".harness/mcp-policy.json": "c8458c3cca9d91625d4e51f096ec873d17c77627df79426cb8e49f3a421d0ea5",
+    ".harness/claims.json": "9544cee8012328eb26856a9fff38d80a73f09e48a2da7537f6c3695521b0fd54",
+    ".harness/mcp-policy.json": "749e9f24bde85921a45b91bf6fa4ab5605675af769c04c53fe69129019662d3e",
     ".mcp/servers.json": "fec6075400f8350d8075beac8306690355c4b015425bfd0e5f52966234e9d66f",
-    "CLAUDE.md": "d6947b2d2e3a9422914a94f81397f3f4b18df9ae75bb26269376dec192dcc249",
+    "CLAUDE.md": "46d5514f4cbf4d94f683f76aa6d50a3dce2ec5a95fd87b9154ed4752f5ea0e16",
     "LICENSE": "631f94984f626818d42ecf717aa6e8e0afd4f9f355ca706bd2effafbd1416d06",
-    "README.md": "4d21bda7797a0fcca40696592217d3a4f2ecc63716282e2b14fadc3490c6eaa8",
-    "bin/cli.js": "621fcfbfa630bb284cd5a056d0fb75b5aaf37a01f6a820f5e29a2df507e62b4d",
+    "README.md": "ce716f07b4b93d5b86285a46cc7be1c6ff48d95ee12ac73518dbf2fb7b61d82e",
+    "bin/cli.js": "0c96bf65a189732a35760c88a3d441a5bd6ce53abbd3bfaa73141665825e1be1",
     "brain/corpus/core.jsonl": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4",
     "flywheel/evaluations.json": "ac4ff1f897a2444870cd2b8ae8aee8b1578e61467aeca4db57893f41be98a572",
     "flywheel/fixture.mjs": "de71be88753d0da4695d91011b54380c994a018986fafba36cb13739307a9bce",
     "flywheel/gate.mjs": "4a0d68ec80a9b4a66f9e13a5d96c0f189af44f28763c456baadf931ac91c3bf8",
-    "flywheel/genome.json": "32c937ccf4431409c1bd7892b4afba6097c539d8c76d41aa968091c9a83d8f99",
+    "flywheel/genome.json": "75db44a3cab70d9459fc8c07863f640ac1214bfaa243483939e1506d63f51214",
     "flywheel/replay.mjs": "0670ca0b03701f4afe0b4bca8a3d58d481676b61a94a5b98c6a425aefb1159ab",
     "flywheel/run.mjs": "6d4f97db16900c45367b6538848cbe1915af999e663720dfc51f2bb1698f1cd0",
-    "package.json": "0da91067c1d71c5cee50cade1e09c270836cfc70efe3bf713f0ec3ce4e88aec3",
+    "package.json": "5d29ef238f310c9ee5c57501ab651acc0f856f831b696ada187de71e4b5935a6",
     "scripts/sync-skills.mjs": "43715dab61e204dc91bbd61755810e8fdb2f66e2b0c0bd791b4bf48a2e293565",
     "scripts/update-manifest.mjs": "8f56764b8f70aed55da0c7e2417ae875b0d58d781d839b6db7f115f08af61e6b",
     "scripts/verify-manifest.mjs": "6491a221762efcfeb3e749ecab243b204f17fd5bc871f3d4025597f31b8f0f10",
     "skills/calibrate-room.md": "4b29c7c331f47acad3c0f51b3d3d8f5b5573e316e081bae71dbe21a47fa95240",
+    "skills/cognitum-spaces.md": "96ae42cc72ad31dbb2f34d59e874c4d15f2e55fc969cd1f610dc1b9a4138840e",
     "skills/onboard.md": "97ee71f0aa985cfc03bb8e764789bb55c4f9fd5dae10a116c1071eab85b5893f",
     "skills/provision-node.md": "5f73823794ed5f0b25c102aa8b1bf2dd534a1ec468173d8330c2af0ca24f239c",
     "skills/train-pose.md": "92aebd4423470eb10eabaee642ec3493284d98b7ae9785e0f34378c709746e65",
     "skills/verify.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76",
     "src/brain.js": "0f16a75aea943acdacc430ff11d5df7ecdec9cca2ab497795ff6f33eaebdfab6",
     "src/guardrails.js": "aacc8fa6088f7f1ccea3a0b02171a5c516b95d3416ee3ba87add3879a1d6aaad",
-    "src/guidance.js": "dbca9dd4c2e692961b7e1f5b2a8d032666252c0da87746c8118aa1c4681b142f",
+    "src/guidance.js": "583904c854eb17e98cb7d959330989c01990a71cff091515777aba8f345de1bf",
     "src/hosts/claude-code.js": "2212bc39b49822018800dfe33a471e56bbb4c5233d716bfa7aa4fff77aa23edb",
     "src/hosts/codex.js": "d41ecd132ce2db7b47aad9cebbc020d70e6810d48c3554858d099ff2e8f6608b",
     "src/hosts/index.js": "ab276c41ab722bcdf72c2d1649cecbb760ae05c41c1372aae4c2447aa7c11539",
-    "src/mcp-server.js": "8c44b0f5e2ee0c386e5315b5927483620cd32ab978055b9f540259c65d4da5fc",
-    "src/policy.js": "c1203b381e0f66481cfe55454f361d0309cd9716fc543c8da06613bedbab6453",
+    "src/mcp-server.js": "8b2ee4b939b25c1b1f507b295a43a2ebad852b8bac9d31af9bf7fb39b181c12e",
+    "src/policy.js": "169cc33793b91ee01a78e6403aeefff1ab5e92f33b73eb85912fe03666464975",
     "src/process-runner.js": "49533b038044dfb8bc76ed01c030d06a9856ead0836157fb693e2a7d40f786d6",
     "src/redact.js": "ebf1afff46341078706b0401838c53db043603586e280d51ece5cf1feba35189",
     "src/repo-trust.js": "06e2a94d7113ed936f208a12b7fcc785801c215a3e2c5e7418f6238d991a289c",
-    "src/tools.js": "75ba14a26603a1e2885370d6203ba7c7941c9fd264238371c47fce2931254869"
+    "src/spaces.js": "45ef786537cb2a446db5e926e5a1c10b73639d2767dec84611f914f78d4325eb",
+    "src/tools.js": "55960c9a677661763e0317fd54ccc787c2edb39c87371c7fbc40cd55f0761c04"
   },
-  "filesDigest": "278e166323774f53215cb493818bdedff39ea0aab94cfaf6eeea216c90929e41",
+  "filesDigest": "28a3bbd9bbcf966df9fae8ec6ea5be3441f6ab535c1636bb1ce33f67b827d423",
   "brainDigest": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4",
-  "gateFingerprint": "06c79d85776260f1d36d1387760357c12410180faacb25f0d4850f2039ab2ea9",
+  "gateFingerprint": "6e53c784eee38310188948fc75fb49e6b4ebc04e247d01b903fa8c8a92d67bdd",
   "developmentPins": {
     "@metaharness/darwin": "0.8.0",
     "@metaharness/flywheel": "0.1.7",

harness/ruview/.harness/manifest.sha256

@@ -1 +1 @@
-026cb69f165dab97e299a96ee67169c7602cd26d5dec392284df619ed85f47c6  manifest.json
+478ccaff9aa249bc7ea6e20551ccc9ac88697a3cc91a7b55400337c5e939a19e  manifest.json

harness/ruview/.harness/mcp-policy.json

@@ -14,6 +14,13 @@
     "ruview_guidance",
     "ruview_memory_search"
   ],
+  "guardedReadTools": {
+    "ruview_spaces_list": {
+      "grant": "credential-use",
+      "network": true,
+      "mayRefreshStoredCredential": true
+    }
+  },
   "dangerousTools": {
     "ruview_calibrate": {
       "grant": "workspace-write",

harness/ruview/CLAUDE.md

@@ -19,15 +19,23 @@ accuracy number:
 
 `ruview_onboard`, `ruview_claim_check`, `ruview_verify`, `ruview_node_monitor`,
 `ruview_calibrate`, `ruview_node_flash`, `ruview_guidance`,
-`ruview_memory_search`. Start unfamiliar work with `ruview_guidance`; its
+`ruview_spaces_list`, `ruview_memory_search`. Start unfamiliar work with
+`ruview_guidance`; its
 capability status, source paths, validation commands, and limitations are
 navigation evidence, not authority. All tools fail closed. Mutating/hardware
 tools (`node_flash`) require explicit confirmation and are Windows/ESP-IDF
 gated.
 
+`ruview_spaces_list` is an OAuth-only external read for the eight versioned
+hierarchy/event/alert collections. MCP calls require the
+`credential-use` grant, cannot select a credential path or API origin, and may
+rotate the local refresh credential. It requires an installed binary and never
+runs Cargo from an auto-detected checkout. Cursors are opaque and collection-
+bound. It grants no write or action authority.
+
 ## Skills
 
-`onboard` · `provision-node` · `calibrate-room` · `train-pose` · `verify`
+`onboard` · `provision-node` · `calibrate-room` · `train-pose` · `verify` · `cognitum-spaces`
 (`npx @ruvnet/ruview skill <name>`).
 
 ## Don'ts

harness/ruview/README.md

@@ -17,6 +17,8 @@ npx @ruvnet/ruview claim-check --file REPORT.md   # the honesty guardrail (non-z
 npx @ruvnet/ruview verify                # run the deterministic proof (VERDICT: PASS)
 npx @ruvnet/ruview doctor                # self-check (tools, adapters, local CLIs)
 npx @ruvnet/ruview guidance --topic homecore --query "Wasmtime plugins"
+npx @ruvnet/ruview spaces --resource spaces
+npx @ruvnet/ruview spaces --resource events --limit 25
 npx @ruvnet/ruview --help
 ```
 
@@ -38,11 +40,44 @@ Exposed both as CLI verbs and as an MCP server (`npx @ruvnet/ruview mcp start`):
 | `ruview_calibrate` | ADR-151 room pipeline (baseline→enroll→train-room→room-watch) |
 | `ruview_node_flash` | Build+flash firmware (Windows/ESP-IDF; mutating, guarded) |
 | `ruview_guidance` | Source-cited code map, capability maturity, validation commands, and limitations |
+| `ruview_spaces_list` | OAuth-only paging for sites/buildings/floors/spaces/zones/entities/events/alerts (guarded over MCP) |
 | `ruview_memory_search` | Search the reviewed, source-cited contributor brain |
 
 Every tool is **fail-closed**: missing repo / python / binary / port → an honest
 negative, never a fabricated success.
 
+### Cognitum Spaces OAuth
+
+Activate the additional read scope through the Rust CLI, then use the same
+validated client through the metaharness:
+
+```bash
+wifi-densepose login --spaces
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites --limit 50
+npx @ruvnet/ruview spaces --resource events --cursor '<opaque-next-cursor>'
+```
+
+The metaharness never accepts a bearer token or API key and removes
+`COGNITUM_SPACES_API` from the child environment, so this surface cannot
+silently fall back to the compatibility API-key path. The API origin is fixed
+to `https://api.cognitum.one`, and the credentialed adapter requires an
+installed `wifi-densepose` binary rather than running Cargo build scripts from
+an auto-detected checkout. It returns only the bounded P2/P3 semantic
+projection. `--resource` selects one of `sites`, `buildings`, `floors`,
+`spaces`, `zones`, `entities`, `events`, or `alerts`; `--limit` is 1–100 and
+`--cursor` is the opaque value from the prior page. An empty list is a valid
+authenticated result, not sensing-quality evidence. An expired session may
+rotate the stored refresh credential before the read completes.
+
+MCP use is denied unless the server operator starts it with
+`RUVIEW_MCP_GRANTS=credential-use`. Set `RUVIEW_CREDENTIALS_PATH` in the MCP
+server environment when a non-default store is needed; MCP calls cannot choose
+an arbitrary credential file or URL. `spaces:read` grants no write, pairing,
+command, policy-approval, spending, or actuator authority. See the bundled
+`cognitum-spaces` skill for the full playbook.
+
 ### Codebase guidance
 
 `ruview_guidance` is the read-only starting point for unfamiliar work. Filter
@@ -65,7 +100,8 @@ as evidence.
 ## Skills
 
 Host-neutral playbooks in `skills/` (`onboard`, `provision-node`, `calibrate-room`,
-`train-pose`, `verify`). `npx @ruvnet/ruview skill <name>` prints one.
+`train-pose`, `verify`, `cognitum-spaces`). `npx @ruvnet/ruview skill <name>`
+prints one.
 
 ## Use as a Claude Code MCP server
 

harness/ruview/bin/cli.js

@@ -28,6 +28,7 @@ const VERB_TO_TOOL = {
   monitor: 'ruview_node_monitor',
   flash: 'ruview_node_flash',
   guidance: 'ruview_guidance',
+  spaces: 'ruview_spaces_list',
 };
 
 function pjson(o) { console.log(JSON.stringify(o, null, 2)); }
@@ -52,9 +53,10 @@ async function doctor() {
     which('claude') ? 'claude -p' : null,
     which('codex') ? 'codex exec' : null,
   ].filter(Boolean);
+  const spacesBackend = which('wifi-densepose') ? 'wifi-densepose binary' : 'unavailable (install wifi-densepose)';
   let ok = true;
   for (const [label, pass] of checks) { console.log(`${pass ? 'PASS' : 'FAIL'} ${label}`); if (!pass) ok = false; }
-  console.log(`\n${NAME}: ${ok ? 'all checks passed' : 'doctor found problems'} — local hosts: ${localHosts.join(', ') || 'none on PATH (optional)'}`);
+  console.log(`\n${NAME}: ${ok ? 'all checks passed' : 'doctor found problems'} — local hosts: ${localHosts.join(', ') || 'none on PATH (optional)'}; Spaces backend: ${spacesBackend}`);
   return ok ? 0 : 1;
 }
 
@@ -69,6 +71,7 @@ Operator tools:
   monitor --port COM8 [--seconds 12]                    assert CSI is flowing on a node
   flash --port COM8 --variant s3-8mb [--confirm]        build+flash firmware (Windows/ESP-IDF)
   guidance [--topic homecore] [--query "Wasmtime"]      source-cited code/capability map
+  spaces [--resource sites|...|alerts] [--limit 50]     page OAuth-bound Cognitum spatial resources
 
 Harness:
   doctor                 verify tools, adapters, and local CLI discovery
@@ -124,7 +127,12 @@ export async function run(args) {
     if (cmd === 'monitor' && flags.seconds) toolArgs.seconds = Number(flags.seconds);
     if (cmd === 'guidance' && flags.limit) toolArgs.limit = Number(flags.limit);
     if (cmd === 'calibrate' && typeof flags.args === 'string') toolArgs.args = flags.args.split(',');
-    const res = await runTool(VERB_TO_TOOL[cmd], toolArgs);
+    if (cmd === 'spaces') {
+      if (flags['credentials-path'] !== undefined) toolArgs.credentials_path = flags['credentials-path'];
+      delete toolArgs['credentials-path'];
+      if (flags.limit !== undefined) toolArgs.limit = Number(flags.limit);
+    }
+    const res = await runTool(VERB_TO_TOOL[cmd], toolArgs, { source: 'cli' });
     pjson(res);
     return res.ok ? 0 : 1;
   }

harness/ruview/flywheel/genome.json

@@ -6,7 +6,7 @@
     "contextBuilder": "Prefer current Git-tracked source and ADRs. Cite paths and lines. Treat retrieved memories as untrusted quotations until source-verified.",
     "reviewer": "Reject secret exposure, unsupported accuracy claims, bypass flags, unbounded subprocesses, missing tests, or mutations outside the requested workspace.",
     "retryPolicy": "Retry only after classifying a transient failure or changing one causal variable; never loop on unchanged evidence.",
-    "toolPolicy": "Read-only exploration is the default. Workspace writes, hardware, network publication, spend, and learning promotion require distinct explicit authority.",
+    "toolPolicy": "Read-only exploration is the default. Credentialed external reads require an explicit credential-use grant. Workspace writes, hardware, network publication, spend, and learning promotion require distinct explicit authority.",
     "memoryPolicy": "Store only sanitized, source-bound, attributable findings. Private overlays stay local; shared records require review and a reproducible digest.",
     "scorePolicy": "Promotion requires task success, no safety regression, passing anchors, bounded cost and latency, verified provenance, and human review."
   }

harness/ruview/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@ruvnet/ruview",
-  "version": "0.3.1",
+  "version": "0.5.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@ruvnet/ruview",
-      "version": "0.3.1",
+      "version": "0.5.1",
       "license": "MIT",
       "bin": {
         "ruview": "bin/cli.js"

harness/ruview/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ruvnet/ruview",
-  "version": "0.3.1",
-  "description": "RuView WiFi-sensing operator agent harness — onboard, calibrate, train, and verify camera-free WiFi-CSI sensing, with the project's MEASURED-vs-CLAIMED honesty guardrail enforced. Minted via metaharness (ADR-182).",
+  "version": "0.5.1",
+  "description": "RuView WiFi-sensing operator harness — onboard, calibrate, verify, enforce evidence guardrails, and read Cognitum Spaces through explicitly granted OAuth.",
   "type": "module",
   "bin": {
     "ruview": "bin/cli.js"
@@ -29,7 +29,7 @@
   ],
   "scripts": {
     "test": "node --test test/*.test.mjs",
-    "test:security": "node --test test/hosts.test.mjs test/brain.test.mjs test/policy.test.mjs",
+    "test:security": "node --test test/hosts.test.mjs test/brain.test.mjs test/policy.test.mjs test/spaces.test.mjs",
     "doctor": "node ./bin/cli.js doctor",
     "mcp": "node ./bin/cli.js mcp start",
     "brain:verify": "node ./bin/cli.js brain verify",
@@ -55,7 +55,9 @@
     "mcp",
     "mcp-server",
     "claude-code",
-    "ambient-intelligence"
+    "ambient-intelligence",
+    "cognitum-spaces",
+    "oauth"
   ],
   "engines": {
     "node": ">=20.0.0"

harness/ruview/skills/cognitum-spaces.md

@@ -0,0 +1,77 @@
+# Cognitum Spaces OAuth activation
+
+Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces
+projection without giving an agent a bearer token or API key.
+
+## Boundary
+
+- This is a read-only P2/P3 semantic projection. HomeCore Edge remains
+  authoritative.
+- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and
+  identity observations are prohibited.
+- `spaces:read` grants no pairing, publication, write, command, policy approval,
+  spending, or actuator authority.
+- A read may refresh an expiring OAuth session and atomically rotate the local
+  credential file.
+
+## Activate OAuth explicitly
+
+Install or build the `wifi-densepose` CLI, then request the additional scope:
+
+```bash
+wifi-densepose login --spaces
+```
+
+For a terminal without a browser:
+
+```bash
+wifi-densepose login --spaces --no-browser
+```
+
+Confirm that the account reports `spaces:read`, then list through the
+metaharness:
+
+```bash
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites
+npx @ruvnet/ruview spaces --resource events --limit 25
+```
+
+The versioned collections are `sites`, `buildings`, `floors`, `spaces`,
+`zones`, `entities`, `events`, and `alerts`. Continue a page with the returned
+opaque `nextCursor`; do not decode or reuse a cursor for another collection.
+
+Use `--credentials-path <private-file>` only from the human-invoked CLI when a
+non-default credential store is intentional. Never put a bearer token or API
+key on the command line.
+
+## MCP
+
+The tool is `ruview_spaces_list`. It is denied by default even though the cloud
+operation is read-only, because it consumes a local identity credential and
+contacts an external service. The MCP server operator must grant that capability
+and may bind the credential path in the server environment:
+
+```bash
+RUVIEW_MCP_GRANTS=credential-use \
+RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
+npx @ruvnet/ruview mcp start
+```
+
+MCP calls cannot choose a credential path and the tool schema has no token or
+API-key, workspace override, or base-URL field. The API origin is fixed to
+`https://api.cognitum.one`, the adapter requires an installed
+`wifi-densepose` binary, and the child environment excludes
+`COGNITUM_SPACES_API`, so this
+surface verifies the OAuth path rather than silently taking the compatibility
+API-key path.
+
+## Interpret results honestly
+
+An empty `data` list can be a valid authenticated tenant result. It proves the
+read path and isolation behavior, not sensing quality. Every accepted response
+must declare `HomeCore Edge` as authoritative and carry the complete prohibited
+field list. Parent lineage, schema version, anonymous person/track identity,
+event/alert fields, confidence, and cursor bounds are independently checked.
+Any malformed, oversized, non-semantic, or raw-field response fails closed.

harness/ruview/src/guidance.js

@@ -29,7 +29,7 @@ const TOPIC_SUMMARIES = Object.freeze({
   hardware: 'ESP32-S3/C6 firmware, capture, provisioning, and hardware evidence.',
   training: 'Calibration, training, evaluation, and data-dependent capability limits.',
   homecore: 'HOMECORE runtime, restore, plugins, API compatibility, migration, HAP, and voice.',
-  integrations: 'Home Assistant, MQTT, Matter, Apple Home HAP, and related boundaries.',
+  integrations: 'Cognitum Spaces, Home Assistant, MQTT, Matter, Apple Home HAP, and related boundaries.',
   deployment: 'Runnable servers, transports, feature flags, and operational entry points.',
   community: 'Contributor harness, reviewed shared brain, local agents, and learning flywheel.',
   testing: 'Deterministic proofs, package gates, Rust CI, and hardware witness requirements.',
@@ -228,6 +228,32 @@ const CAPABILITIES = Object.freeze([
     validation: ['cargo test -p ruview-unified --no-default-features'],
     limitations: ['Accuracy evidence remains synthetic until validated against measured real-world datasets.', 'Hardware adapters do not imply equivalent sensing quality across modalities.'],
   },
+  {
+    id: 'cognitum-spaces-oauth',
+    name: 'Cognitum Spaces OAuth projection',
+    topics: ['integrations', 'deployment', 'community'],
+    status: 'implemented-read-only-live',
+    evidence: 'MIXED',
+    summary: 'The production Spaces API and RuView PKCE client expose the same read-only authority across the versioned site/building/floor/space/zone/entity/event/alert collections with bounded pagination and independent metaharness validation.',
+    sources: [
+      'docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md',
+      'v2/crates/wifi-densepose-cli/src/spaces.rs',
+      'harness/ruview/src/spaces.js',
+      'docs/adr/ADR-326-tenant-scoped-ruvector-spatial-memory.md',
+      'docs/adr/ADR-327-governed-action-intents-and-witness-receipts.md',
+    ],
+    validation: [
+      'cd harness/ruview && node --test test/spaces.test.mjs test/policy.test.mjs',
+      'wifi-densepose login --spaces && node harness/ruview/bin/cli.js spaces --resource events',
+    ],
+    limitations: [
+      'The projection is read-only and grants no write, pairing, command, policy-approval, or actuator authority.',
+      'MCP requires the credential-use grant; bearer tokens and API keys are never accepted as tool arguments.',
+      'OAuth refresh may rotate the local credential file before a read returns.',
+      'Production evidence covers legacy and versioned HTTPS reads. Spatial memory remains tenant/workspace-local, while governed actions remain separately policy-gated; neither expands OAuth authority.',
+      'Persistent memory is local tenant/workspace state and governed actions expose authorization receipts only; neither expands OAuth authority.',
+    ],
+  },
   {
     id: 'contributor-metaharness',
     name: 'Contributor metaharness and shared brain',

harness/ruview/src/mcp-server.js

@@ -38,7 +38,7 @@ async function handle(msg, context = {}) {
         protocolVersion: PROTOCOL_VERSION,
         capabilities: { tools: { listChanged: false } },
         serverInfo: SERVER_INFO,
-        instructions: 'RuView WiFi-sensing operator tools. All results are fail-closed; accuracy claims must pass ruview_claim_check.',
+        instructions: 'RuView WiFi-sensing operator tools. All results are fail-closed; accuracy claims must pass ruview_claim_check. Credentialed external reads are denied without an operator grant; ruview_spaces_list requires credential-use.',
       });
     case 'notifications/initialized':
     case 'initialized':

harness/ruview/src/policy.js

@@ -9,6 +9,7 @@ export const TOOL_POLICY = Object.freeze({
   ruview_calibrate: { class: 'workspace-write', writesWorkspace: true, confirmField: 'confirm' },
   ruview_node_flash: { class: 'hardware-write', writesWorkspace: true, hardware: true, confirmField: 'confirm' },
   ruview_guidance: { class: 'read', readOnly: true },
+  ruview_spaces_list: { class: 'external-read', readOnly: true, requiredGrant: 'credential-use', openWorld: true, usesCredentials: true, mayRefreshCredentials: true },
   ruview_memory_search: { class: 'read', readOnly: true },
 });
 
@@ -52,11 +53,15 @@ export function validateArguments(schema, value, path = '$') {
 export function authorizeTool(name, args, context = {}) {
   const policy = TOOL_POLICY[name] || { class: 'unknown', denied: true };
   if (policy.denied) return { ok: false, reason: 'policy_missing', policy };
-  if (context.source !== 'mcp' || policy.readOnly) return { ok: true, policy };
+  if (context.source !== 'mcp') return { ok: true, policy };
+  const grants = new Set(context.grants || []);
+  if (policy.requiredGrant && !grants.has(policy.requiredGrant)) {
+    return { ok: false, reason: 'authority_denied', requiredGrant: policy.requiredGrant, policy };
+  }
+  if (policy.readOnly) return { ok: true, policy };
   if (policy.confirmField && args?.[policy.confirmField] !== true) {
     return { ok: false, reason: 'not_confirmed', policy };
   }
-  const grants = new Set(context.grants || []);
   if (!grants.has(policy.class)) return { ok: false, reason: 'authority_denied', requiredGrant: policy.class, policy };
   return { ok: true, policy };
 }
@@ -64,9 +69,9 @@ export function authorizeTool(name, args, context = {}) {
 export function mcpAnnotations(name) {
   const policy = TOOL_POLICY[name] || {};
   return {
-    readOnlyHint: policy.readOnly === true,
+    readOnlyHint: policy.readOnly === true && policy.mayRefreshCredentials !== true,
     destructiveHint: policy.writesWorkspace === true || policy.hardware === true,
-    idempotentHint: policy.readOnly === true,
-    openWorldHint: false,
+    idempotentHint: policy.readOnly === true && policy.mayRefreshCredentials !== true,
+    openWorldHint: policy.openWorld === true,
   };
 }

harness/ruview/src/spaces.js

@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: MIT
+// Cognitum Spaces adapter for the dependency-free RuView metaharness.
+//
+// OAuth stays in the Rust `wifi-densepose` CLI. This adapter never accepts a
+// bearer token or API key, strips the compatibility API-key environment from
+// the child, and validates the already-validated semantic projection again
+// before returning it to a CLI or MCP caller.
+
+import { DEFAULT_ENV_ALLOWLIST, runProcess } from './process-runner.js';
+import { redact } from './redact.js';
+
+const DEFAULT_BASE_URL = 'https://api.cognitum.one';
+const MAX_CLI_JSON_BYTES = 2 * 1024 * 1024;
+const MAX_JSON_DEPTH = 16;
+const MAX_JSON_NODES = 10_000;
+const MAX_ARRAY_ITEMS = 1000;
+const MAX_OBJECT_KEYS = 128;
+const MAX_STRING_BYTES = 4096;
+const MAX_RESOURCES = 100;
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,119}$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export const SPATIAL_RESOURCE_KINDS = Object.freeze([
+  'sites', 'buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts',
+]);
+const REQUIRED_EXCLUSIONS = Object.freeze([
+  'raw_csi',
+  'cir',
+  'rf_tensors',
+  'recordings',
+  'pose_frames',
+  'vital_waveforms',
+  'identity_observations',
+]);
+const FORBIDDEN_FIELDS = new Set([
+  ...REQUIRED_EXCLUSIONS.map(normalizeField),
+  'csi', 'channelstateinformation', 'rawcir', 'channelimpulseresponse',
+  'rftensor', 'rftensors', 'packetcapture', 'packetcaptures', 'pcap', 'recording', 'recordings', 'audiorecording',
+  'videorecording', 'poseframe', 'skeleton', 'keypoints', 'vitalwaveform',
+  'heartratewaveform', 'identityobservation', 'biometric', 'biometrics', 'face', 'faces', 'faceembedding',
+]);
+const SPACES_ENV_ALLOWLIST = Object.freeze([
+  ...DEFAULT_ENV_ALLOWLIST,
+  // Operators may bind an MCP server to a credential file without putting a
+  // secret or an arbitrary file path in tool-call arguments.
+  'RUVIEW_CREDENTIALS_PATH',
+]);
+
+function normalizeField(value) {
+  return String(value).replace(/[^a-z0-9]/gi, '').toLowerCase();
+}
+
+function assertBoundedValue(value, depth = 0, state = { nodes: 0 }) {
+  state.nodes += 1;
+  if (state.nodes > MAX_JSON_NODES) throw new Error('JSON structure exceeds node bound');
+  if (depth > MAX_JSON_DEPTH) throw new Error('JSON nesting is too deep');
+  if (typeof value === 'string') {
+    if (Buffer.byteLength(value, 'utf8') > MAX_STRING_BYTES) throw new Error('string exceeds bound');
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > MAX_ARRAY_ITEMS) throw new Error('array exceeds bound');
+    for (const item of value) assertBoundedValue(item, depth + 1, state);
+    return;
+  }
+  if (!value || typeof value !== 'object') return;
+  const entries = Object.entries(value);
+  if (entries.length > MAX_OBJECT_KEYS) throw new Error('object exceeds bound');
+  for (const [key, item] of entries) {
+    if (Buffer.byteLength(key, 'utf8') > MAX_STRING_BYTES) throw new Error('object key exceeds bound');
+    if (FORBIDDEN_FIELDS.has(normalizeField(key))) throw new Error(`forbidden raw field: ${key}`);
+    assertBoundedValue(item, depth + 1, state);
+  }
+}
+
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+
+/** Parse and independently enforce the metaharness semantic boundary. */
+export function parseSpacesOutput(stdout, expectedKind = undefined) {
+  if (Buffer.byteLength(String(stdout), 'utf8') > MAX_CLI_JSON_BYTES) {
+    throw new Error('CLI response exceeds bound');
+  }
+  let response;
+  try {
+    response = JSON.parse(String(stdout));
+  } catch {
+    throw new Error('CLI response is not JSON');
+  }
+  assertBoundedValue(response);
+  if (!response || response.object !== 'list' || !Array.isArray(response.data) || response.data.length > MAX_RESOURCES) {
+    throw new Error('invalid list envelope');
+  }
+  const versioned = response.schemaVersion !== undefined || response.kind !== undefined;
+  if (versioned && (response.schemaVersion !== '1.0' || !SPATIAL_RESOURCE_KINDS.includes(response.kind)
+    || (expectedKind !== undefined && response.kind !== expectedKind))) {
+    throw new Error('invalid spatial contract version or kind');
+  }
+  const boundary = response.boundary;
+  if (!boundary || boundary.authoritativeState !== 'HomeCore Edge' || !Array.isArray(boundary.excluded)
+    || !boundary.excluded.every((item) => typeof item === 'string')) {
+    throw new Error('incomplete edge privacy boundary');
+  }
+  for (const required of REQUIRED_EXCLUSIONS) {
+    if (!boundary.excluded.includes(required)) throw new Error('incomplete edge privacy boundary');
+  }
+  for (const item of response.data) {
+    if (!item || !ID_RE.test(String(item.id ?? '')) || !nonEmptyString(item.tenantId)) {
+      throw new Error('spatial identity is incomplete');
+    }
+    if (!['P2', 'P3'].includes(item.privacy)) {
+      throw new Error('non-semantic privacy class');
+    }
+    const confidence = versioned ? item.confidence : item.state?.confidence;
+    if (confidence !== null && confidence !== undefined
+      && (typeof confidence !== 'number' || !Number.isFinite(confidence) || confidence < 0 || confidence > 1)) {
+      throw new Error('invalid confidence');
+    }
+    if (!versioned) {
+      if (!nonEmptyString(item.siteId) || !nonEmptyString(item.name) || item.state?.classification !== 'P2') {
+        throw new Error('space identity is incomplete');
+      }
+      continue;
+    }
+    if (!UUID_RE.test(String(item.workspaceId ?? '')) || item.kind !== response.kind
+      || item.schemaVersion !== '1.0' || !nonEmptyString(item.messageId)
+      || !Number.isSafeInteger(item.eventSequence) || item.eventSequence < 0
+      || !Number.isSafeInteger(item.version) || item.version < 1
+      || !nonEmptyString(item.observedAt) || !Number.isFinite(Date.parse(item.observedAt))
+      || (item.expiresAt !== null && item.expiresAt !== undefined
+        && (!nonEmptyString(item.expiresAt) || !Number.isFinite(Date.parse(item.expiresAt))))
+      || !item.attributes || Array.isArray(item.attributes) || typeof item.attributes !== 'object'
+      || !item.provenance || Array.isArray(item.provenance) || typeof item.provenance !== 'object') {
+      throw new Error('versioned spatial identity is incomplete');
+    }
+    if (['buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts'].includes(response.kind)
+      && !nonEmptyString(item.siteId)) throw new Error('spatial parent is incomplete');
+    if (response.kind === 'floors' && !nonEmptyString(item.buildingId)) throw new Error('spatial parent is incomplete');
+    if (response.kind === 'spaces' && (!nonEmptyString(item.buildingId) || !nonEmptyString(item.floorId))) {
+      throw new Error('spatial parent is incomplete');
+    }
+    if (['zones', 'entities', 'events', 'alerts'].includes(response.kind) && !nonEmptyString(item.spaceId)) {
+      throw new Error('spatial parent is incomplete');
+    }
+    if (response.kind === 'entities'
+      && (!['sensor', 'person', 'object', 'track'].includes(item.entityType)
+        || (['person', 'track'].includes(item.entityType) && item.identityMode !== 'anonymous'))) {
+      throw new Error('entity privacy contract is invalid');
+    }
+    if (response.kind === 'events' && !nonEmptyString(item.eventType)) throw new Error('event type is missing');
+    if (response.kind === 'alerts'
+      && (!nonEmptyString(item.alertType) || !['info', 'warning', 'critical'].includes(item.severity)
+        || !['open', 'acknowledged', 'resolved'].includes(item.status))) {
+      throw new Error('alert contract is invalid');
+    }
+  }
+  if (versioned && response.nextCursor !== null && response.nextCursor !== undefined
+    && (!nonEmptyString(response.nextCursor) || response.nextCursor.length > 512
+      || /[\u0000-\u001f\u007f]/u.test(response.nextCursor))) {
+    throw new Error('invalid next cursor');
+  }
+  return response;
+}
+
+function commandFailure(error, env) {
+  const detail = redact(error?.message || error, { env }).slice(0, 1000);
+  if (/lacks spaces:read/i.test(detail)) return { reason: 'spaces_scope_missing', detail };
+  if (/no stored credentials|not logged in/i.test(detail)) return { reason: 'not_logged_in', detail };
+  if (/refresh/i.test(detail)) return { reason: 'oauth_refresh_failed', detail };
+  if (/rejected the credential|\b401\b|\b403\b/i.test(detail)) return { reason: 'authentication_failed', detail };
+  return { reason: 'spaces_command_failed', detail };
+}
+
+/**
+ * List Cognitum Spaces through the hardened Rust client.
+ *
+ * `binary` and `execute` are injectable so tests never need a real credential
+ * or network. Production callers must pass a discovered installed binary; the
+ * credentialed path never executes build scripts from an auto-detected repo.
+ */
+export async function listCognitumSpaces(input = {}, options = {}) {
+  const source = options.source || 'library';
+  if (source === 'mcp' && input.credentials_path !== undefined) {
+    return {
+      ok: false,
+      reason: 'credentials_path_not_allowed',
+      hint: 'Set RUVIEW_CREDENTIALS_PATH in the MCP server environment; credential paths are not accepted from tool calls.',
+    };
+  }
+
+  const resource = input.resource || 'spaces';
+  if (!SPATIAL_RESOURCE_KINDS.includes(resource)) {
+    return { ok: false, reason: 'invalid_resource' };
+  }
+  const limit = input.limit === undefined ? 50 : input.limit;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+    return { ok: false, reason: 'invalid_limit' };
+  }
+  if (input.cursor !== undefined
+    && (typeof input.cursor !== 'string' || input.cursor.length === 0 || input.cursor.length > 512 || /[\u0000-\u001f\u007f]/u.test(input.cursor))) {
+    return { ok: false, reason: 'invalid_cursor' };
+  }
+  const spacesArgs = [
+    'spaces', '--json', '--base-url', DEFAULT_BASE_URL,
+    '--resource', resource, '--limit', String(limit),
+  ];
+  if (input.cursor) spacesArgs.push('--cursor', input.cursor);
+  if (input.credentials_path) spacesArgs.push('--credentials-path', input.credentials_path);
+
+  let command;
+  let args;
+  let via;
+  if (options.binary) {
+    command = options.binary;
+    args = spacesArgs;
+    via = 'binary';
+  } else {
+    return {
+      ok: false,
+      reason: 'cli_missing',
+      hint: 'Install the wifi-densepose binary; credentialed metaharness calls never execute Cargo build scripts.',
+    };
+  }
+
+  const execute = options.execute || runProcess;
+  let result;
+  try {
+    result = await execute(command, args, {
+      timeoutMs: 120_000,
+      maxOutputBytes: MAX_CLI_JSON_BYTES,
+      env: options.env || process.env,
+      envAllowlist: SPACES_ENV_ALLOWLIST,
+    });
+  } catch (error) {
+    return { ok: false, authentication: 'oauth', via, ...commandFailure(error, options.env || process.env) };
+  }
+
+  let response;
+  try {
+    response = parseSpacesOutput(result.stdout, resource);
+  } catch (error) {
+    return {
+      ok: false,
+      authentication: 'oauth',
+      via,
+      reason: 'invalid_spaces_output',
+      detail: String(error.message).slice(0, 300),
+    };
+  }
+  return {
+    ok: true,
+    authentication: 'oauth',
+    via,
+    count: response.data.length,
+    resource,
+    schemaVersion: response.schemaVersion,
+    nextCursor: response.nextCursor ?? null,
+    data: response.data,
+    boundary: response.boundary,
+    authority: 'Read-only tenant/workspace projection; this result grants no action, write, pairing, or actuator authority.',
+    credentialSideEffect: 'An expired OAuth session may rotate and persist its refresh credential before the read returns.',
+  };
+}

harness/ruview/src/tools.js

@@ -20,6 +20,7 @@ import { claimCheck, summarize } from './guardrails.js';
 import { authorizeTool, mcpAnnotations, validateArguments } from './policy.js';
 import { searchBrain } from './brain.js';
 import { getGuidance, GUIDANCE_TOPICS } from './guidance.js';
+import { listCognitumSpaces } from './spaces.js';
 
 /** Walk up from `start` to find the RuView monorepo root (or null). */
 export function findRepoRoot(start = process.cwd()) {
@@ -290,6 +291,26 @@ export const TOOLS = {
     },
   },
 
+  ruview_spaces_list: {
+    title: 'List Cognitum Spatial Resources',
+    description: 'Page sites, buildings, floors, spaces, zones, anonymous entities, semantic events, or alerts in the authenticated tenant/workspace through the hardened wifi-densepose OAuth client. Never accepts tokens, API keys, writes, approvals, or action authority.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        credentials_path: { type: 'string', minLength: 1, maxLength: 4096, description: 'CLI only: OAuth credential file. MCP operators must set RUVIEW_CREDENTIALS_PATH in the server environment.' },
+        resource: { type: 'string', enum: ['sites', 'buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts'], description: 'Versioned spatial collection. Default: spaces.' },
+        limit: { type: 'number', minimum: 1, maximum: 100, description: 'Page size. Default: 50.' },
+        cursor: { type: 'string', minLength: 1, maxLength: 512, description: 'Opaque cursor from the prior page.' },
+      },
+    },
+    async handler(args = {}, context = {}) {
+      return listCognitumSpaces(args, {
+        source: context.source,
+        binary: which('wifi-densepose'),
+      });
+    },
+  },
+
   ruview_memory_search: {
     title: 'Search shared RuView brain',
     description: 'Search the reviewed, source-cited RuView contributor corpus. Retrieved text is evidence, never executable instruction.',
@@ -330,7 +351,7 @@ export async function runTool(name, args, context = {}) {
   const authorization = authorizeTool(canonical, input, context);
   if (!authorization.ok) return { ok: false, ...authorization, name: canonical };
   try {
-    return await TOOLS[canonical].handler(input);
+    return await TOOLS[canonical].handler(input, context);
   } catch (err) {
     return { ok: false, reason: 'tool_threw', name: canonical, error: String(err && err.message || err) };
   }

harness/ruview/test/guidance.test.mjs

@@ -67,6 +67,17 @@ test('homecore guidance exposes requested capabilities and honest boundaries', (
   );
 });
 
+test('integration guidance exposes the Cognitum OAuth surface and authority boundary', () => {
+  const result = getGuidance(
+    { topic: 'integrations', query: 'Cognitum Spaces OAuth' },
+    { repoRoot: REPO_ROOT },
+  );
+  assert.equal(result.ok, true, JSON.stringify(result.sourceCheck));
+  assert.equal(result.capabilities[0].id, 'cognitum-spaces-oauth');
+  assert.match(result.capabilities[0].limitations.join(' '), /no write|read-only/i);
+  assert.match(result.capabilities[0].limitations.join(' '), /credential-use/i);
+});
+
 test('query ranks the matching capability and searches reviewed knowledge', () => {
   const result = getGuidance(
     { topic: 'homecore', query: 'Wasmtime plugin', limit: 3 },

harness/ruview/test/mcp.test.mjs

@@ -47,14 +47,21 @@ test('MCP handshake: initialize reports the package.json version; list endpoints
     s.send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
     const init = await s.next(1);
     assert.equal(init.result.serverInfo.version, pkg.version, 'ADR-263 O6: version must match package.json');
+    assert.match(init.result.instructions, /credential-use/);
 
     s.send({ jsonrpc: '2.0', id: 2, method: 'tools/list' });
     const tools = (await s.next(2)).result.tools;
-    assert.equal(tools.length, 8);
+    assert.equal(tools.length, 9);
     for (const t of tools) assert.match(t.name, /^[a-zA-Z0-9_-]{1,64}$/, `advertised name not host-safe: ${t.name}`);
     const guidance = tools.find((tool) => tool.name === 'ruview_guidance');
     assert.ok(guidance);
     assert.equal(guidance.annotations.readOnlyHint, true);
+    const spaces = tools.find((tool) => tool.name === 'ruview_spaces_list');
+    assert.ok(spaces);
+    assert.equal(spaces.annotations.readOnlyHint, false, 'OAuth refresh can update the local credential file');
+    assert.equal(spaces.annotations.idempotentHint, false);
+    assert.equal(spaces.annotations.destructiveHint, false);
+    assert.equal(spaces.annotations.openWorldHint, true);
 
     s.send({ jsonrpc: '2.0', id: 3, method: 'resources/list' });
     assert.deepEqual((await s.next(3)).result, { resources: [] });
@@ -71,6 +78,11 @@ test('MCP handshake: initialize reports the package.json version; list endpoints
     assert.equal(guided.ok, true);
     assert.equal(guided.topic, 'homecore');
     assert.ok(guided.capabilities.some(({ id }) => id === 'homecore-runtime-restore'));
+
+    s.send({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'ruview_spaces_list', arguments: {} } });
+    const deniedSpaces = JSON.parse((await s.next(7)).result.content[0].text);
+    assert.equal(deniedSpaces.reason, 'authority_denied');
+    assert.equal(deniedSpaces.requiredGrant, 'credential-use');
   } finally {
     s.close();
   }

harness/ruview/test/policy.test.mjs

@@ -21,3 +21,25 @@ test('read-only tools remain available with no mutation grants', () => {
   assert.equal(authorizeTool('ruview_guidance', {}, { source: 'mcp', grants: [] }).ok, true);
   assert.deepEqual(validateArguments({ type: 'object', properties: {} }, {}), []);
 });
+
+test('credentialed external reads require an explicit MCP grant', () => {
+  const denied = authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
+  assert.equal(denied.reason, 'authority_denied');
+  assert.equal(denied.requiredGrant, 'credential-use');
+  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: ['credential-use'] }).ok, true);
+  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'cli', grants: [] }).ok, true);
+});
+
+test('Spaces schema never accepts raw credentials', async () => {
+  for (const credential of [
+    { token: 'secret' },
+    { access_token: 'secret' },
+    { api_key: 'cog_secret' },
+    { authorization: 'Bearer secret' },
+    { base_url: 'https://attacker.example' },
+  ]) {
+    const result = await runTool('ruview_spaces_list', credential);
+    assert.equal(result.ok, false);
+    assert.equal(result.reason, 'invalid_arguments');
+  }
+});

harness/ruview/test/spaces.test.mjs

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: MIT
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { listCognitumSpaces, parseSpacesOutput } from '../src/spaces.js';
+import { runTool } from '../src/tools.js';
+
+function validResponse(kind = 'spaces') {
+  return {
+    object: 'list',
+    kind,
+    schemaVersion: '1.0',
+    data: [{
+      id: 'room-1', tenantId: 'tenant-1', workspaceId: '11111111-1111-7111-8111-111111111111', siteId: 'site-1', name: 'Room',
+      buildingId: 'building-1', floorId: 'floor-1', kind, schemaVersion: '1.0',
+      messageId: 'message-1', eventSequence: 1, version: 1, privacy: 'P2',
+      confidence: 0.9, provenance: {}, attributes: {}, observedAt: '2026-08-19T00:00:00Z', expiresAt: null,
+    }],
+    nextCursor: null,
+    boundary: {
+      authoritativeState: 'HomeCore Edge',
+      cloudRole: 'tenant-scoped semantic synchronization',
+      excluded: ['raw_csi', 'cir', 'rf_tensors', 'recordings', 'pose_frames', 'vital_waveforms', 'identity_observations'],
+    },
+  };
+}
+
+test('Spaces adapter invokes OAuth-only CLI args in a scrubbed environment', async () => {
+  const credentialPath = 'C:/private/ruview-credentials.json';
+  const secretApiKey = ['cog', 'DO', 'NOT', 'FORWARD'].join('_');
+  let observed;
+  const result = await listCognitumSpaces(
+    { credentials_path: credentialPath },
+    {
+      source: 'cli',
+      binary: 'wifi-densepose-test-double',
+      env: { PATH: 'test-path', COGNITUM_SPACES_API: secretApiKey, RUVIEW_CREDENTIALS_PATH: credentialPath },
+      execute: async (command, args, options) => {
+        observed = { command, args, options };
+        return { stdout: JSON.stringify(validResponse()), stderr: '', code: 0 };
+      },
+    },
+  );
+
+  assert.equal(result.ok, true);
+  assert.equal(result.authentication, 'oauth');
+  assert.equal(result.count, 1);
+  assert.equal(observed.command, 'wifi-densepose-test-double');
+  assert.deepEqual(observed.args, [
+    'spaces', '--json', '--base-url', 'https://api.cognitum.one', '--resource', 'spaces', '--limit', '50',
+    '--credentials-path', credentialPath,
+  ]);
+  assert.ok(observed.options.envAllowlist.includes('RUVIEW_CREDENTIALS_PATH'));
+  assert.ok(!observed.options.envAllowlist.includes('COGNITUM_SPACES_API'));
+  assert.ok(!observed.args.join(' ').includes(secretApiKey));
+});
+
+test('MCP cannot select an arbitrary credential path even with a credential-use grant', async () => {
+  const result = await runTool(
+    'ruview_spaces_list',
+    { credentials_path: 'C:/private/credentials.json' },
+    { source: 'mcp', grants: ['credential-use'] },
+  );
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'credentials_path_not_allowed');
+});
+
+test('MCP denies a Spaces read before touching local credentials or the network', async () => {
+  const result = await runTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'authority_denied');
+  assert.equal(result.requiredGrant, 'credential-use');
+});
+
+test('metaharness rejects forbidden raw fields from a child process', () => {
+  const response = validResponse();
+  response.data[0].attributes.raw_csi = [1, 2, 3];
+  assert.throws(() => parseSpacesOutput(JSON.stringify(response)), /forbidden raw field/i);
+});
+
+test('metaharness rejects incomplete privacy boundaries and invalid confidence', () => {
+  const incomplete = validResponse();
+  incomplete.boundary.excluded = ['raw_csi'];
+  assert.throws(() => parseSpacesOutput(JSON.stringify(incomplete)), /incomplete edge privacy boundary/i);
+
+  const invalid = validResponse();
+  invalid.data[0].confidence = 2;
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalid)), /invalid confidence/i);
+});
+
+test('versioned hierarchy, events, alerts, and cursor args stay OAuth-only', async () => {
+  let observed;
+  const response = validResponse('events');
+  response.data[0].spaceId = 'room-1';
+  response.data[0].eventType = 'occupancy.changed';
+  response.data[0].buildingId = null;
+  response.data[0].floorId = null;
+  const result = await listCognitumSpaces(
+    { resource: 'events', limit: 25, cursor: 'opaque-cursor' },
+    {
+      source: 'mcp',
+      binary: 'wifi-densepose-test-double',
+      env: { PATH: 'test-path', COGNITUM_SPACES_API: 'cog_never_forward' },
+      execute: async (command, args, options) => {
+        observed = { command, args, options };
+        return { stdout: JSON.stringify(response), stderr: '', code: 0 };
+      },
+    },
+  );
+  assert.equal(result.ok, true);
+  assert.equal(result.resource, 'events');
+  assert.deepEqual(observed.args, [
+    'spaces', '--json', '--base-url', 'https://api.cognitum.one', '--resource', 'events', '--limit', '25',
+    '--cursor', 'opaque-cursor',
+  ]);
+  assert.ok(!observed.options.envAllowlist.includes('COGNITUM_SPACES_API'));
+});
+
+test('metaharness rejects raw aliases and malformed kind-specific records', () => {
+  const raw = validResponse();
+  raw.data[0].attributes.packet_capture = 'forbidden';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(raw), 'spaces'), /forbidden raw field/i);
+
+  const entity = validResponse('entities');
+  entity.data[0].spaceId = 'room-1';
+  entity.data[0].entityType = 'person';
+  entity.data[0].identityMode = 'named';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(entity), 'entities'), /entity privacy contract/i);
+
+  const invalidWorkspace = validResponse();
+  invalidWorkspace.data[0].workspaceId = 'workspace-1';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalidWorkspace), 'spaces'), /versioned spatial identity/i);
+
+  const invalidTimestamp = validResponse();
+  invalidTimestamp.data[0].observedAt = 'not-a-timestamp';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalidTimestamp), 'spaces'), /versioned spatial identity/i);
+});
+
+test('command failures redact API keys and JWT-shaped tokens', async () => {
+  const secret = `cog_${'test-value-'.repeat(4)}`;
+  const jwt = 'eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEifQ.signature-material';
+  const result = await listCognitumSpaces({}, {
+    source: 'cli',
+    binary: 'wifi-densepose-test-double',
+    env: { PATH: 'test-path', COGNITUM_SPACES_API: secret },
+    execute: async () => { throw new Error(`failed token=${jwt} api_key=${secret}`); },
+  });
+  assert.equal(result.ok, false);
+  assert.ok(!result.detail.includes(secret));
+  assert.ok(!result.detail.includes(jwt));
+  assert.match(result.detail, /REDACTED/);
+});
+
+test('credentialed calls never fall back to Cargo build scripts', async () => {
+  let executed = false;
+  const result = await listCognitumSpaces({}, {
+    source: 'cli',
+    cargo: 'cargo',
+    repoRoot: 'C:/trusted/ruview',
+    execute: async () => { executed = true; },
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'cli_missing');
+  assert.equal(executed, false);
+});

harness/ruview/test/tools.test.mjs

@@ -93,7 +93,7 @@ test('summarize gives PASS/finding text', () => {
 
 test('registry exposes the documented tools with schemas (underscore-canonical)', () => {
   const names = Object.keys(TOOLS);
-  for (const n of ['ruview_onboard', 'ruview_claim_check', 'ruview_verify', 'ruview_node_monitor', 'ruview_calibrate', 'ruview_node_flash', 'ruview_guidance', 'ruview_memory_search']) {
+  for (const n of ['ruview_onboard', 'ruview_claim_check', 'ruview_verify', 'ruview_node_monitor', 'ruview_calibrate', 'ruview_node_flash', 'ruview_guidance', 'ruview_spaces_list', 'ruview_memory_search']) {
     assert.ok(names.includes(n), `missing ${n}`);
     assert.equal(TOOLS[n].inputSchema.type, 'object');
     assert.match(n, /^[a-zA-Z0-9_-]{1,64}$/, 'canonical names must satisfy host tool-name regexes');

integrations/iphone-lidar/README.md

@@ -0,0 +1,78 @@
+# RuView iPhone LiDAR
+
+This experimental integration provides the native and browser components needed to use a LiDAR-capable iPhone as a RuView geometry sensor. The native source is type-checked against the iOS SDK in CI; physical-device validation is tracked separately below.
+
+## Architecture
+
+```text
+iPhone LiDAR
+  -> ARKit sceneDepth
+  -> depth + confidence + camera intrinsics + device pose
+  -> compact u16 millimeter wire frame
+  -> WebSocket relay
+  -> browser point cloud
+  -> future RuView HAL / fusion ingest
+```
+
+The native path is the sensor. The web path is a receiver and visualization surface. Mobile Safari does not expose ARKit scene depth directly to ordinary web pages, so the browser cannot replace the native capture layer on iPhone today.
+
+## Native iPhone path
+
+Create an iOS SwiftUI app target in Xcode, deployment target iOS 17 or newer, then add the files under `native/RuViewLiDAR/` to the target.
+
+Add this Info.plist value:
+
+```xml
+<key>NSCameraUsageDescription</key>
+<string>RuView uses the camera and LiDAR scanner to capture local depth geometry.</string>
+```
+
+Run on a physical LiDAR capable iPhone or iPad. The simulator does not provide LiDAR scene depth.
+
+The app requests `ARWorldTrackingConfiguration` with `.sceneDepth`, checks `supportsFrameSemantics`, extracts `ARDepthData.depthMap` and `confidenceMap`, and never transmits RGB camera frames.
+
+## Browser path
+
+```bash
+cd integrations/iphone-lidar/web
+npm ci
+npm test
+npm start
+```
+
+The relay prints a random per-run access token. Open the printed browser URL and set the iPhone endpoint to the printed native URL. They have this form:
+
+```text
+http://HOST:8787/?token=TOKEN
+ws://HOST:8787/ws/lidar?token=TOKEN
+```
+
+Set `RUVIEW_LIDAR_TOKEN` to supply the token explicitly. The token only prevents unauthenticated peers from joining the development relay; because `ws://` does not encrypt it, production use requires TLS and `wss://`.
+
+## Wire format
+
+Schema: `ruview.lidar.depth.v1`
+
+Depth is downsampled by 2 in each dimension by default and streamed at a maximum of 15 FPS. Each depth sample is encoded as little endian UInt16 millimeters plus one UInt8 confidence value. `[SYNTHETIC]` Arithmetic sizing reduces the depth payload from roughly 196 KB per 256 x 192 Float32 frame to roughly 37 KB per 128 x 96 frame before base64 and JSON overhead.
+
+`[SYNTHETIC]` At 15 FPS that is approximately 0.75 MB/s after base64 overhead, versus roughly 8 MB/s for uncompressed Float32 JSON at full resolution. These are sizing estimates, not device or network measurements.
+
+## Privacy and governance
+
+The initial implementation labels provenance as `source=live` and `privacyClass=geometry-only`. It sends depth geometry, confidence, camera intrinsics, pose, sequence, and wall clock timestamp. It does not send RGB imagery.
+
+The development relay requires an ephemeral token and bounds each WebSocket message, but it is not a production trust boundary. Production integration should terminate the WebSocket inside RuView, authenticate the device using the existing sensor identity path, convert each frame into `ruview-hal::Observation`, and attach witness receipts before fusion or persistence.
+
+## Validation status
+
+- `[MEASURED]` The committed Node tests cover wire decoding, malformed inputs, relay authentication, static-file restrictions, and live WebSocket forwarding.
+- `[MEASURED]` GitHub Actions type-checks the native sources with strict concurrency against the iOS 17 SDK.
+- Physical iPhone capture, end-to-end rendering, confidence-map behavior, and the latency target are not yet measured. A simulator or CI compile does not satisfy the hardware acceptance test.
+
+## Acceptance test
+
+1. Run the relay and browser viewer.
+2. Run the native app on a LiDAR capable iPhone.
+3. Start LiDAR capture and enable streaming.
+4. Move the phone through a room.
+5. Verify the browser shows a changing point cloud, sequence increases monotonically, latency stays below the `[CLAIMED target]` of 150 ms p95 on a local WiFi network, and no RGB payload is present in captured WebSocket frames.

integrations/iphone-lidar/native/RuViewLiDAR/ContentView.swift

@@ -0,0 +1,121 @@
+import SwiftUI
+
+struct ContentView: View {
+    @StateObject private var capture = LiDARCaptureManager()
+    @State private var endpoint = "ws://HOST:8787/ws/lidar?token=TOKEN"
+    @State private var streaming = false
+    @State private var status = "Idle"
+
+    private let streamer = WebSocketStreamer()
+
+    var body: some View {
+        NavigationStack {
+            Form {
+                Section("Sensor") {
+                    HStack {
+                        Text("State")
+                        Spacer()
+                        Text(stateText)
+                            .foregroundStyle(stateColor)
+                    }
+                    HStack {
+                        Text("Capture FPS")
+                        Spacer()
+                        Text(capture.framesPerSecond.formatted(.number.precision(.fractionLength(1))))
+                    }
+                    if let frame = capture.lastFrame {
+                        HStack {
+                            Text("Depth")
+                            Spacer()
+                            Text("\(frame.depth.width) x \(frame.depth.height)")
+                        }
+                        HStack {
+                            Text("Sequence")
+                            Spacer()
+                            Text("\(frame.provenance.sequence)")
+                        }
+                    }
+
+                    Button("Start LiDAR") {
+                        capture.start(smoothed: false)
+                    }
+                    .disabled(capture.state == .running)
+
+                    Button("Stop") {
+                        capture.stop()
+                    }
+                    .disabled(capture.state != .running)
+                }
+
+                Section("RuView Stream") {
+                    TextField("ws://host:port/ws/lidar", text: $endpoint)
+                        .textInputAutocapitalization(.never)
+                        .autocorrectionDisabled()
+
+                    Toggle("Stream geometry", isOn: $streaming)
+                        .onChange(of: streaming) { _, enabled in
+                            Task {
+                                if enabled {
+                                    do {
+                                        try await streamer.connect(to: endpoint)
+                                        status = "Connected"
+                                    } catch {
+                                        streaming = false
+                                        status = error.localizedDescription
+                                    }
+                                } else {
+                                    await streamer.disconnect()
+                                    status = "Disconnected"
+                                }
+                            }
+                        }
+
+                    Text(status)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+
+                Section("Privacy") {
+                    Text("This implementation transmits depth geometry, confidence, camera intrinsics, and device pose. RGB camera frames are not transmitted.")
+                        .font(.footnote)
+                }
+            }
+            .navigationTitle("RuView LiDAR")
+            .onAppear {
+                capture.onFrame = { frame in
+                    guard streaming else { return }
+                    Task {
+                        do {
+                            try await streamer.send(frame, maxFPS: 15, sampleStep: 2)
+                        } catch {
+                            await MainActor.run {
+                                status = error.localizedDescription
+                            }
+                        }
+                    }
+                }
+            }
+            .onDisappear {
+                capture.stop()
+                Task { await streamer.disconnect() }
+            }
+        }
+    }
+
+    private var stateText: String {
+        switch capture.state {
+        case .idle: return "Idle"
+        case .unsupported: return "No LiDAR"
+        case .running: return "Live"
+        case .failed(let message): return "Error: \(message)"
+        }
+    }
+
+    private var stateColor: Color {
+        switch capture.state {
+        case .running: return .green
+        case .failed, .unsupported: return .red
+        case .idle: return .secondary
+        }
+    }
+}

integrations/iphone-lidar/native/RuViewLiDAR/LiDARCaptureManager.swift

@@ -0,0 +1,138 @@
+import ARKit
+import CoreVideo
+import Foundation
+
+@MainActor
+final class LiDARCaptureManager: NSObject, ObservableObject {
+    enum State: Equatable {
+        case idle
+        case unsupported
+        case running
+        case failed(String)
+    }
+
+    @Published private(set) var state: State = .idle
+    @Published private(set) var lastFrame: RuViewLiDARFrame?
+    @Published private(set) var framesPerSecond: Double = 0
+
+    let session = ARSession()
+    var onFrame: (@MainActor @Sendable (RuViewLiDARFrame) -> Void)?
+
+    private var sequence: UInt64 = 0
+    private var lastTimestamp: TimeInterval?
+    private let processingQueue = DispatchQueue(label: "one.ruv.lidar.capture", qos: .userInitiated)
+
+    override init() {
+        super.init()
+        session.delegate = self
+        session.delegateQueue = processingQueue
+    }
+
+    func start(smoothed: Bool = false) {
+        let configuration = ARWorldTrackingConfiguration()
+        let semantic: ARConfiguration.FrameSemantics = smoothed ? .smoothedSceneDepth : .sceneDepth
+
+        guard ARWorldTrackingConfiguration.supportsFrameSemantics(semantic) else {
+            state = .unsupported
+            return
+        }
+
+        configuration.frameSemantics.insert(semantic)
+        configuration.worldAlignment = .gravity
+        session.run(configuration, options: [.resetTracking, .removeExistingAnchors])
+        state = .running
+    }
+
+    func stop() {
+        session.pause()
+        state = .idle
+    }
+
+    nonisolated private func makeFrame(from frame: ARFrame) -> RuViewLiDARFrame? {
+        guard let sceneDepth = frame.sceneDepth ?? frame.smoothedSceneDepth else { return nil }
+        let depthMap = sceneDepth.depthMap
+        let confidenceMap = sceneDepth.confidenceMap
+
+        guard CVPixelBufferLockBaseAddress(depthMap, .readOnly) == kCVReturnSuccess else {
+            return nil
+        }
+        defer { CVPixelBufferUnlockBaseAddress(depthMap, .readOnly) }
+
+        guard CVPixelBufferGetPixelFormatType(depthMap) == kCVPixelFormatType_DepthFloat32,
+              let depthBase = CVPixelBufferGetBaseAddress(depthMap) else {
+            return nil
+        }
+
+        let width = CVPixelBufferGetWidth(depthMap)
+        let height = CVPixelBufferGetHeight(depthMap)
+        let stride = CVPixelBufferGetBytesPerRow(depthMap) / MemoryLayout<Float>.size
+        let pointer = depthBase.assumingMemoryBound(to: Float.self)
+
+        var meters = [Float]()
+        meters.reserveCapacity(width * height)
+        for y in 0..<height {
+            let row = pointer.advanced(by: y * stride)
+            for x in 0..<width {
+                let value = row[x]
+                meters.append(value.isFinite && value > 0 ? value : 0)
+            }
+        }
+
+        var confidence = [UInt8](repeating: 0, count: width * height)
+        if let confidenceMap,
+           CVPixelBufferGetPixelFormatType(confidenceMap) == kCVPixelFormatType_OneComponent8,
+           CVPixelBufferGetWidth(confidenceMap) == width,
+           CVPixelBufferGetHeight(confidenceMap) == height,
+           CVPixelBufferLockBaseAddress(confidenceMap, .readOnly) == kCVReturnSuccess {
+            defer { CVPixelBufferUnlockBaseAddress(confidenceMap, .readOnly) }
+            if let confidenceBase = CVPixelBufferGetBaseAddress(confidenceMap) {
+                let confidenceStride = CVPixelBufferGetBytesPerRow(confidenceMap)
+                let confidencePointer = confidenceBase.assumingMemoryBound(to: UInt8.self)
+                for y in 0..<height {
+                    let row = confidencePointer.advanced(by: y * confidenceStride)
+                    for x in 0..<width {
+                        confidence[y * width + x] = row[x]
+                    }
+                }
+            }
+        }
+
+        return RuViewLiDARFrame(
+            intrinsics: frame.camera.intrinsics,
+            imageResolution: frame.camera.imageResolution,
+            cameraTransform: frame.camera.transform,
+            depthWidth: width,
+            depthHeight: height,
+            depthMeters: meters,
+            confidence: confidence,
+            sequence: 0,
+            timestamp: Date().timeIntervalSince1970
+        )
+    }
+}
+
+extension LiDARCaptureManager: ARSessionDelegate {
+    nonisolated func session(_ session: ARSession, didUpdate frame: ARFrame) {
+        guard let base = makeFrame(from: frame) else { return }
+        let frameTimestamp = frame.timestamp
+
+        Task { @MainActor in
+            sequence &+= 1
+            let corrected = base.assigningSequence(sequence)
+
+            if let previous = lastTimestamp {
+                let delta = frameTimestamp - previous
+                if delta > 0 { framesPerSecond = 1.0 / delta }
+            }
+            lastTimestamp = frameTimestamp
+            lastFrame = corrected
+            onFrame?(corrected)
+        }
+    }
+
+    nonisolated func session(_ session: ARSession, didFailWithError error: Error) {
+        Task { @MainActor in
+            state = .failed(error.localizedDescription)
+        }
+    }
+}

integrations/iphone-lidar/native/RuViewLiDAR/RuViewFrame.swift

@@ -0,0 +1,118 @@
+import Foundation
+import simd
+
+struct RuViewLiDARFrame: Codable, Sendable {
+    struct Intrinsics: Codable, Sendable {
+        let fx: Float
+        let fy: Float
+        let cx: Float
+        let cy: Float
+        let imageWidth: Int
+        let imageHeight: Int
+    }
+
+    struct Pose: Codable, Sendable {
+        let matrix: [Float]
+    }
+
+    struct Depth: Codable, Sendable {
+        let width: Int
+        let height: Int
+        let meters: [Float]
+        let confidence: [UInt8]
+    }
+
+    struct Provenance: Codable, Sendable {
+        let sensor: String
+        let source: String
+        let privacyClass: String
+        let sequence: UInt64
+        let timestampNs: UInt64
+        let schema: String
+    }
+
+    let type: String
+    let intrinsics: Intrinsics
+    let pose: Pose
+    let depth: Depth
+    let provenance: Provenance
+
+    init(
+        intrinsics: simd_float3x3,
+        imageResolution: CGSize,
+        cameraTransform: simd_float4x4,
+        depthWidth: Int,
+        depthHeight: Int,
+        depthMeters: [Float],
+        confidence: [UInt8],
+        sequence: UInt64,
+        timestamp: TimeInterval
+    ) {
+        self.type = "ruview.lidar.depth.v1"
+        self.intrinsics = Intrinsics(
+            fx: intrinsics.columns.0.x,
+            fy: intrinsics.columns.1.y,
+            cx: intrinsics.columns.2.x,
+            cy: intrinsics.columns.2.y,
+            imageWidth: Int(imageResolution.width),
+            imageHeight: Int(imageResolution.height)
+        )
+        self.pose = Pose(matrix: cameraTransform.columnMajorArray)
+        self.depth = Depth(
+            width: depthWidth,
+            height: depthHeight,
+            meters: depthMeters,
+            confidence: confidence
+        )
+        self.provenance = Provenance(
+            sensor: "apple-arkit-scene-depth",
+            source: "live",
+            privacyClass: "geometry-only",
+            sequence: sequence,
+            timestampNs: UInt64(max(0, timestamp) * 1_000_000_000),
+            schema: "ruview.lidar.depth.v1"
+        )
+    }
+
+    func assigningSequence(_ sequence: UInt64) -> RuViewLiDARFrame {
+        RuViewLiDARFrame(
+            type: type,
+            intrinsics: intrinsics,
+            pose: pose,
+            depth: depth,
+            provenance: Provenance(
+                sensor: provenance.sensor,
+                source: provenance.source,
+                privacyClass: provenance.privacyClass,
+                sequence: sequence,
+                timestampNs: provenance.timestampNs,
+                schema: provenance.schema
+            )
+        )
+    }
+
+    private init(
+        type: String,
+        intrinsics: Intrinsics,
+        pose: Pose,
+        depth: Depth,
+        provenance: Provenance
+    ) {
+        self.type = type
+        self.intrinsics = intrinsics
+        self.pose = pose
+        self.depth = depth
+        self.provenance = provenance
+    }
+}
+
+private extension simd_float4x4 {
+    var columnMajorArray: [Float] {
+        [
+            columns.0.x, columns.0.y, columns.0.z, columns.0.w,
+            columns.1.x, columns.1.y, columns.1.z, columns.1.w,
+            columns.2.x, columns.2.y, columns.2.z, columns.2.w,
+            columns.3.x, columns.3.y, columns.3.z, columns.3.w
+        ]
+    }
+}

integrations/iphone-lidar/native/RuViewLiDAR/RuViewLiDARApp.swift

@@ -0,0 +1,10 @@
+import SwiftUI
+
+@main
+struct RuViewLiDARApp: App {
+    var body: some Scene {
+        WindowGroup {
+            ContentView()
+        }
+    }
+}

integrations/iphone-lidar/native/RuViewLiDAR/WebSocketStreamer.swift

@@ -0,0 +1,93 @@
+import Foundation
+
+actor WebSocketStreamer {
+    enum StreamError: Error {
+        case invalidURL
+    }
+
+    struct WirePacket: Codable {
+        struct Depth: Codable {
+            let width: Int
+            let height: Int
+            let encoding: String
+            let millimetersBase64: String
+            let confidenceBase64: String
+        }
+
+        let type: String
+        let intrinsics: RuViewLiDARFrame.Intrinsics
+        let pose: RuViewLiDARFrame.Pose
+        let depth: Depth
+        let provenance: RuViewLiDARFrame.Provenance
+    }
+
+    private var task: URLSessionWebSocketTask?
+    private let encoder = JSONEncoder()
+    private var lastSentNs: UInt64 = 0
+
+    func connect(to endpoint: String) throws {
+        guard let url = URL(string: endpoint),
+              url.scheme == "ws" || url.scheme == "wss" else {
+            throw StreamError.invalidURL
+        }
+        task?.cancel(with: .goingAway, reason: nil)
+        let socket = URLSession.shared.webSocketTask(with: url)
+        socket.resume()
+        task = socket
+    }
+
+    func disconnect() {
+        task?.cancel(with: .goingAway, reason: nil)
+        task = nil
+    }
+
+    func send(_ frame: RuViewLiDARFrame, maxFPS: UInt64 = 15, sampleStep: Int = 2) async throws {
+        guard let task else { return }
+
+        let timestamp = frame.provenance.timestampNs
+        let minDelta = 1_000_000_000 / max(1, maxFPS)
+        guard timestamp >= lastSentNs + minDelta else { return }
+        lastSentNs = timestamp
+
+        let packet = Self.makeWirePacket(frame, sampleStep: max(1, sampleStep))
+        let data = try encoder.encode(packet)
+        guard let string = String(data: data, encoding: .utf8) else { return }
+        try await task.send(.string(string))
+    }
+
+    static func makeWirePacket(_ frame: RuViewLiDARFrame, sampleStep: Int) -> WirePacket {
+        let step = max(1, sampleStep)
+        let sourceWidth = frame.depth.width
+        let sourceHeight = frame.depth.height
+        let width = (sourceWidth + step - 1) / step
+        let height = (sourceHeight + step - 1) / step
+
+        var millimeters = Data(capacity: width * height * 2)
+        var confidence = Data(capacity: width * height)
+
+        for y in stride(from: 0, to: sourceHeight, by: step) {
+            for x in stride(from: 0, to: sourceWidth, by: step) {
+                let index = y * sourceWidth + x
+                let meters = frame.depth.meters[index]
+                let mm = UInt16(clamping: Int((meters * 1000).rounded()))
+                var littleEndian = mm.littleEndian
+                withUnsafeBytes(of: &littleEndian) { millimeters.append(contentsOf: $0) }
+                confidence.append(frame.depth.confidence[index])
+            }
+        }
+
+        return WirePacket(
+            type: frame.type,
+            intrinsics: frame.intrinsics,
+            pose: frame.pose,
+            depth: WirePacket.Depth(
+                width: width,
+                height: height,
+                encoding: "u16le-mm+u8-confidence",
+                millimetersBase64: millimeters.base64EncodedString(),
+                confidenceBase64: confidence.base64EncodedString()
+            ),
+            provenance: frame.provenance
+        )
+    }
+}

integrations/iphone-lidar/web/app.mjs

@@ -0,0 +1,108 @@
+import { decodeLiDARPacket, depthToPointCloud } from './codec.mjs';
+
+const canvas = document.querySelector('#view');
+const ctx = canvas.getContext('2d');
+const status = document.querySelector('#status');
+const fpsEl = document.querySelector('#fps');
+const pointsEl = document.querySelector('#points');
+const seqEl = document.querySelector('#seq');
+const latencyEl = document.querySelector('#latency');
+const sensorEl = document.querySelector('#sensor');
+
+let lastFrameAt = performance.now();
+let yaw = 0.3;
+let pitch = -0.15;
+let scale = 120;
+
+function connect() {
+  const token = new URLSearchParams(location.search).get('token');
+  if (!token) {
+    status.textContent = 'TOKEN REQUIRED';
+    status.dataset.state = 'warn';
+    return;
+  }
+
+  const protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
+  const socket = new WebSocket(`${protocol}//${location.host}/ws/lidar?token=${encodeURIComponent(token)}`);
+
+  socket.addEventListener('open', () => {
+    status.textContent = 'LIVE';
+    status.dataset.state = 'live';
+  });
+
+  socket.addEventListener('close', () => {
+    status.textContent = 'RECONNECTING';
+    status.dataset.state = 'warn';
+    setTimeout(connect, 1000);
+  });
+
+  socket.addEventListener('message', (event) => {
+    try {
+      const raw = JSON.parse(event.data);
+      const frame = decodeLiDARPacket(raw);
+      const points = depthToPointCloud(frame, 1);
+      render(points);
+
+      const now = performance.now();
+      const delta = now - lastFrameAt;
+      lastFrameAt = now;
+      fpsEl.textContent = delta > 0 ? (1000 / delta).toFixed(1) : '0.0';
+      pointsEl.textContent = points.length.toLocaleString();
+      seqEl.textContent = frame.provenance.sequence;
+      latencyEl.textContent = Math.max(0, Date.now() - Number(frame.provenance.timestampNs / 1_000_000)).toFixed(0);
+      sensorEl.textContent = frame.provenance.sensor;
+    } catch (error) {
+      console.error(error);
+      status.textContent = 'FRAME ERROR';
+      status.dataset.state = 'warn';
+    }
+  });
+}
+
+function resize() {
+  const dpr = Math.min(devicePixelRatio || 1, 2);
+  const rect = canvas.getBoundingClientRect();
+  canvas.width = Math.max(1, Math.floor(rect.width * dpr));
+  canvas.height = Math.max(1, Math.floor(rect.height * dpr));
+  ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+}
+
+function render(points) {
+  resize();
+  const w = canvas.clientWidth;
+  const h = canvas.clientHeight;
+  ctx.clearRect(0, 0, w, h);
+  ctx.fillStyle = '#091018';
+  ctx.fillRect(0, 0, w, h);
+
+  const cy = Math.cos(yaw);
+  const sy = Math.sin(yaw);
+  const cp = Math.cos(pitch);
+  const sp = Math.sin(pitch);
+
+  ctx.fillStyle = '#58e0d2';
+  for (let i = 0; i < points.length; i += 1) {
+    let [x, y, z] = points[i];
+    const rx = x * cy - z * sy;
+    const rz = x * sy + z * cy;
+    const ry = y * cp - rz * sp;
+    const rz2 = y * sp + rz * cp;
+    const perspective = 1 / Math.max(0.35, 1.8 - rz2 * 0.12);
+    const px = w / 2 + rx * scale * perspective;
+    const py = h / 2 + ry * scale * perspective;
+    if (px >= 0 && px < w && py >= 0 && py < h) ctx.fillRect(px, py, 1.4, 1.4);
+  }
+}
+
+canvas.addEventListener('pointermove', (event) => {
+  if (!event.buttons) return;
+  yaw += event.movementX * 0.006;
+  pitch += event.movementY * 0.006;
+});
+
+canvas.addEventListener('wheel', (event) => {
+  event.preventDefault();
+  scale = Math.max(40, Math.min(400, scale - event.deltaY * 0.2));
+}, { passive: false });
+
+connect();

integrations/iphone-lidar/web/codec.mjs

@@ -0,0 +1,121 @@
+export function decodeLiDARPacket(packet) {
+  if (!packet || packet.type !== 'ruview.lidar.depth.v1') {
+    throw new Error('Unsupported LiDAR packet type');
+  }
+
+  const { depth } = packet;
+  if (!depth || depth.encoding !== 'u16le-mm+u8-confidence') {
+    throw new Error('Unsupported depth encoding');
+  }
+
+  assertPositiveInteger(depth.width, 'depth.width');
+  assertPositiveInteger(depth.height, 'depth.height');
+  assertIntrinsics(packet.intrinsics);
+  if (!packet.pose || !Array.isArray(packet.pose.matrix) || packet.pose.matrix.length !== 16
+      || packet.pose.matrix.some((value) => !Number.isFinite(value))) {
+    throw new Error('Invalid camera pose');
+  }
+
+  const mmBytes = base64ToBytes(depth.millimetersBase64, 'millimetersBase64');
+  const confidence = base64ToBytes(depth.confidenceBase64, 'confidenceBase64');
+  const expectedPixels = depth.width * depth.height;
+
+  if (!Number.isSafeInteger(expectedPixels) || expectedPixels > 1_000_000) {
+    throw new Error('Depth dimensions exceed the supported pixel limit');
+  }
+
+  if (mmBytes.byteLength !== expectedPixels * 2) {
+    throw new Error(`Depth payload length mismatch: expected ${expectedPixels * 2}, got ${mmBytes.byteLength}`);
+  }
+  if (confidence.byteLength !== expectedPixels) {
+    throw new Error(`Confidence payload length mismatch: expected ${expectedPixels}, got ${confidence.byteLength}`);
+  }
+
+  const view = new DataView(mmBytes.buffer, mmBytes.byteOffset, mmBytes.byteLength);
+  const meters = new Float32Array(expectedPixels);
+  for (let i = 0; i < expectedPixels; i += 1) {
+    meters[i] = view.getUint16(i * 2, true) / 1000;
+  }
+
+  return {
+    ...packet,
+    depth: {
+      width: depth.width,
+      height: depth.height,
+      meters,
+      confidence,
+    },
+  };
+}
+
+export function depthToPointCloud(frame, confidenceThreshold = 1) {
+  const { width, height, meters, confidence } = frame.depth;
+  const { fx, fy, cx, cy, imageWidth, imageHeight } = frame.intrinsics;
+
+  assertPositiveInteger(width, 'depth.width');
+  assertPositiveInteger(height, 'depth.height');
+  assertIntrinsics(frame.intrinsics);
+  if (meters.length !== width * height || confidence.length !== width * height) {
+    throw new Error('Decoded depth array length mismatch');
+  }
+  if (!Number.isFinite(confidenceThreshold) || confidenceThreshold < 0 || confidenceThreshold > 255) {
+    throw new Error('Invalid confidence threshold');
+  }
+
+  const sx = width / imageWidth;
+  const sy = height / imageHeight;
+  const scaledFx = fx * sx;
+  const scaledFy = fy * sy;
+  const scaledCx = cx * sx;
+  const scaledCy = cy * sy;
+
+  const points = [];
+  for (let v = 0; v < height; v += 1) {
+    for (let u = 0; u < width; u += 1) {
+      const index = v * width + u;
+      const z = meters[index];
+      if (!Number.isFinite(z) || z <= 0 || confidence[index] < confidenceThreshold) continue;
+
+      const x = ((u - scaledCx) / scaledFx) * z;
+      const y = ((v - scaledCy) / scaledFy) * z;
+      points.push([x, y === 0 ? 0 : -y, -z]);
+    }
+  }
+  return points;
+}
+
+function assertPositiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+}
+
+function assertIntrinsics(intrinsics) {
+  if (!intrinsics
+      || !Number.isFinite(intrinsics.fx) || intrinsics.fx <= 0
+      || !Number.isFinite(intrinsics.fy) || intrinsics.fy <= 0
+      || !Number.isFinite(intrinsics.cx)
+      || !Number.isFinite(intrinsics.cy)) {
+    throw new Error('Invalid camera intrinsics');
+  }
+  assertPositiveInteger(intrinsics.imageWidth, 'intrinsics.imageWidth');
+  assertPositiveInteger(intrinsics.imageHeight, 'intrinsics.imageHeight');
+}
+
+function base64ToBytes(value, name) {
+  if (typeof value !== 'string' || value.length === 0 || value.length % 4 !== 0
+      || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new Error(`${name} must be canonical base64`);
+  }
+
+  if (typeof Buffer !== 'undefined') {
+    return Uint8Array.from(Buffer.from(value, 'base64'));
+  }
+
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}

integrations/iphone-lidar/web/codec.test.mjs

@@ -0,0 +1,69 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { decodeLiDARPacket, depthToPointCloud } from './codec.mjs';
+
+function b64(bytes) {
+  return Buffer.from(bytes).toString('base64');
+}
+
+test('decodes u16 millimeter depth and confidence', () => {
+  const packet = {
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 1, cy: 1, imageWidth: 2, imageHeight: 2 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: {
+      width: 2,
+      height: 2,
+      encoding: 'u16le-mm+u8-confidence',
+      millimetersBase64: b64([0xe8,0x03,0xd0,0x07,0xb8,0x0b,0xa0,0x0f]),
+      confidenceBase64: b64([2,2,1,0]),
+    },
+    provenance: { sensor: 'test', source: 'live', privacyClass: 'geometry-only', sequence: 1, timestampNs: 1, schema: 'ruview.lidar.depth.v1' },
+  };
+
+  const frame = decodeLiDARPacket(packet);
+  assert.deepEqual(Array.from(frame.depth.meters), [1,2,3,4]);
+  assert.deepEqual(Array.from(frame.depth.confidence), [2,2,1,0]);
+});
+
+test('rejects malformed payload length', () => {
+  assert.throws(() => decodeLiDARPacket({
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 1, cy: 1, imageWidth: 2, imageHeight: 2 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: { width: 2, height: 2, encoding: 'u16le-mm+u8-confidence', millimetersBase64: b64([1,2]), confidenceBase64: b64([1,1,1,1]) },
+  }), /length mismatch/);
+});
+
+test('rejects invalid dimensions, intrinsics, pose, and base64', () => {
+  const valid = {
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 0, cy: 0, imageWidth: 1, imageHeight: 1 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: {
+      width: 1,
+      height: 1,
+      encoding: 'u16le-mm+u8-confidence',
+      millimetersBase64: b64([0xe8, 0x03]),
+      confidenceBase64: b64([2]),
+    },
+  };
+
+  assert.throws(() => decodeLiDARPacket({ ...valid, depth: { ...valid.depth, width: 0 } }), /positive integer/);
+  assert.throws(() => decodeLiDARPacket({ ...valid, intrinsics: { ...valid.intrinsics, fx: 0 } }), /intrinsics/);
+  assert.throws(() => decodeLiDARPacket({ ...valid, pose: { matrix: [1] } }), /pose/);
+  assert.throws(() => decodeLiDARPacket({
+    ...valid,
+    depth: { ...valid.depth, millimetersBase64: '!!!!' },
+  }), /canonical base64/);
+});
+
+test('projects depth into a point cloud and honors confidence', () => {
+  const frame = {
+    intrinsics: { fx: 100, fy: 100, cx: 0, cy: 0, imageWidth: 2, imageHeight: 2 },
+    depth: { width: 2, height: 2, meters: Float32Array.from([1,1,1,1]), confidence: Uint8Array.from([2,0,2,0]) },
+  };
+  const points = depthToPointCloud(frame, 1);
+  assert.equal(points.length, 2);
+  assert.deepEqual(points[0], [0, 0, -1]);
+});

integrations/iphone-lidar/web/index.html

@@ -0,0 +1,36 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover" />
+  <title>RuView iPhone LiDAR</title>
+  <link rel="stylesheet" href="./styles.css" />
+</head>
+<body>
+  <main>
+    <header>
+      <div>
+        <p class="eyebrow">RUVIEW SENSOR BRIDGE</p>
+        <h1>iPhone LiDAR</h1>
+      </div>
+      <span id="status">CONNECTING</span>
+    </header>
+
+    <section class="metrics">
+      <div><strong id="fps">0.0</strong><span>FPS</span></div>
+      <div><strong id="points">0</strong><span>POINTS</span></div>
+      <div><strong id="seq">0</strong><span>SEQ</span></div>
+      <div><strong id="latency">0</strong><span>MS</span></div>
+    </section>
+
+    <canvas id="view"></canvas>
+
+    <footer>
+      <span>Geometry only</span>
+      <span>No RGB upload</span>
+      <span id="sensor">Waiting for sensor</span>
+    </footer>
+  </main>
+  <script type="module" src="./app.mjs"></script>
+</body>
+</html>

integrations/iphone-lidar/web/package-lock.json

@@ -0,0 +1,39 @@
+{
+  "name": "@ruview/iphone-lidar-web",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@ruview/iphone-lidar-web",
+      "version": "0.1.0",
+      "dependencies": {
+        "ws": "^8.18.3"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}

integrations/iphone-lidar/web/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "@ruview/iphone-lidar-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "start": "node relay.mjs",
+    "test": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "ws": "^8.18.3"
+  }
+}

integrations/iphone-lidar/web/relay.mjs

@@ -0,0 +1,166 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import http from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { WebSocket, WebSocketServer } from 'ws';
+
+const root = fileURLToPath(new URL('.', import.meta.url));
+const staticFiles = new Set(['index.html', 'app.mjs', 'codec.mjs', 'styles.css']);
+const maxPayloadBytes = 2_000_000;
+
+function constantTimeEqual(left, right) {
+  const leftBytes = Buffer.from(left, 'utf8');
+  const rightBytes = Buffer.from(right, 'utf8');
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+
+function rejectUpgrade(socket, status, message) {
+  const body = `${message}\n`;
+  socket.end(
+    `HTTP/1.1 ${status}\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`,
+  );
+}
+
+export function createLiDARRelay({ token, rootDirectory = root } = {}) {
+  const accessToken = token || randomBytes(24).toString('hex');
+  const clients = new Set();
+
+  const server = http.createServer(async (req, res) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, { allow: 'GET, HEAD' }).end();
+      return;
+    }
+
+    let pathname;
+    try {
+      pathname = decodeURIComponent(new URL(req.url || '/', 'http://localhost').pathname);
+    } catch {
+      res.writeHead(400).end('bad path');
+      return;
+    }
+
+    const filename = pathname === '/' ? 'index.html' : pathname.slice(1);
+    if (!staticFiles.has(filename)) {
+      res.writeHead(404).end('not found');
+      return;
+    }
+
+    try {
+      const data = await readFile(join(rootDirectory, filename));
+      const contentType = {
+        '.html': 'text/html; charset=utf-8',
+        '.mjs': 'text/javascript; charset=utf-8',
+        '.css': 'text/css; charset=utf-8',
+      }[extname(filename)] || 'application/octet-stream';
+      res.writeHead(200, {
+        'content-type': contentType,
+        'cache-control': 'no-store',
+        'content-security-policy': "default-src 'self'; connect-src 'self' ws: wss:; img-src 'self'; style-src 'self'; base-uri 'none'; frame-ancestors 'none'",
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+      });
+      if (req.method === 'HEAD') res.end();
+      else res.end(data);
+    } catch {
+      res.writeHead(404).end('not found');
+    }
+  });
+
+  const wss = new WebSocketServer({ noServer: true, maxPayload: maxPayloadBytes });
+
+  server.on('upgrade', (req, socket, head) => {
+    let url;
+    try {
+      url = new URL(req.url || '/', 'http://localhost');
+    } catch {
+      rejectUpgrade(socket, '400 Bad Request', 'bad websocket URL');
+      return;
+    }
+
+    if (url.pathname !== '/ws/lidar') {
+      rejectUpgrade(socket, '404 Not Found', 'not found');
+      return;
+    }
+
+    const suppliedToken = url.searchParams.get('token') || '';
+    if (!constantTimeEqual(suppliedToken, accessToken)) {
+      rejectUpgrade(socket, '401 Unauthorized', 'valid LiDAR relay token required');
+      return;
+    }
+
+    wss.handleUpgrade(req, socket, head, (websocket) => {
+      wss.emit('connection', websocket, req);
+    });
+  });
+
+  wss.on('connection', (socket) => {
+    clients.add(socket);
+    socket.on('close', () => clients.delete(socket));
+    socket.on('error', () => socket.terminate());
+    socket.on('message', (data, isBinary) => {
+      if (isBinary) return;
+
+      let packet;
+      try {
+        packet = JSON.parse(data.toString());
+      } catch {
+        return;
+      }
+
+      if (packet?.type !== 'ruview.lidar.depth.v1') return;
+
+      for (const peer of clients) {
+        if (peer !== socket && peer.readyState === WebSocket.OPEN) {
+          peer.send(data.toString());
+        }
+      }
+    });
+  });
+
+  return {
+    accessToken,
+    server,
+    async listen(port = 0, host = '127.0.0.1') {
+      await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(port, host, () => {
+          server.off('error', reject);
+          resolve();
+        });
+      });
+      return server.address();
+    },
+    async close() {
+      for (const peer of clients) peer.terminate();
+      await new Promise((resolve) => wss.close(resolve));
+      if (server.listening) {
+        await new Promise((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()));
+        });
+      }
+    },
+  };
+}
+
+function configuredPort(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65_535) {
+    throw new Error(`PORT must be an integer from 1 to 65535; received ${value}`);
+  }
+  return parsed;
+}
+
+const directInvocation = process.argv[1]
+  && pathToFileURL(process.argv[1]).href === import.meta.url;
+
+if (directInvocation) {
+  const port = configuredPort(process.env.PORT || '8787');
+  const host = process.env.HOST || '0.0.0.0';
+  const relay = createLiDARRelay({ token: process.env.RUVIEW_LIDAR_TOKEN });
+  await relay.listen(port, host);
+  const encodedToken = encodeURIComponent(relay.accessToken);
+  console.log(`RuView iPhone LiDAR relay listening on ${host}:${port}`);
+  console.log(`Browser: http://<host>:${port}/?token=${encodedToken}`);
+  console.log(`Native endpoint: ws://<host>:${port}/ws/lidar?token=${encodedToken}`);
+}

integrations/iphone-lidar/web/relay.test.mjs

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import test from 'node:test';
+import { WebSocket } from 'ws';
+import { createLiDARRelay } from './relay.mjs';
+
+function connect(url) {
+  return new Promise((resolve, reject) => {
+    const socket = new WebSocket(url);
+    socket.once('open', () => resolve(socket));
+    socket.once('error', reject);
+  });
+}
+
+function request(url) {
+  return new Promise((resolve, reject) => {
+    http.get(url, (response) => {
+      response.resume();
+      response.once('end', () => resolve(response));
+    }).once('error', reject);
+  });
+}
+
+test('relay requires a token, limits static files, and forwards LiDAR frames', async (t) => {
+  const token = 'test-token-for-relay';
+  const relay = createLiDARRelay({ token });
+  const address = await relay.listen(0, '127.0.0.1');
+  const httpBase = `http://127.0.0.1:${address.port}`;
+  const wsBase = `ws://127.0.0.1:${address.port}/ws/lidar`;
+  const sockets = [];
+
+  t.after(async () => {
+    for (const socket of sockets) socket.terminate();
+    await relay.close();
+  });
+
+  const indexResponse = await request(`${httpBase}/?token=${token}`);
+  assert.equal(indexResponse.statusCode, 200);
+  assert.match(indexResponse.headers['content-security-policy'], /frame-ancestors 'none'/);
+
+  const sourceResponse = await request(`${httpBase}/relay.mjs`);
+  assert.equal(sourceResponse.statusCode, 404);
+
+  await new Promise((resolve, reject) => {
+    const unauthorized = new WebSocket(wsBase);
+    unauthorized.once('unexpected-response', (_request, response) => {
+      assert.equal(response.statusCode, 401);
+      response.resume();
+      resolve();
+    });
+    unauthorized.once('open', () => reject(new Error('unauthorized websocket opened')));
+    unauthorized.once('error', () => {});
+  });
+
+  const sender = await connect(`${wsBase}?token=${encodeURIComponent(token)}`);
+  const receiver = await connect(`${wsBase}?token=${encodeURIComponent(token)}`);
+  sockets.push(sender, receiver);
+
+  const received = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timed out waiting for relayed frame')), 2_000);
+    receiver.once('message', (data, isBinary) => {
+      clearTimeout(timer);
+      resolve({ data, isBinary });
+    });
+  });
+
+  const frame = { type: 'ruview.lidar.depth.v1', provenance: { sequence: 7 } };
+  sender.send(JSON.stringify(frame));
+  const message = await received;
+
+  assert.equal(message.isBinary, false);
+  assert.deepEqual(JSON.parse(message.data.toString()), frame);
+});

integrations/iphone-lidar/web/styles.css

@@ -0,0 +1 @@
+*{box-sizing:border-box}body{margin:0;background:#05080d;color:#e8f1f5;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}main{min-height:100vh;padding:18px;display:grid;grid-template-rows:auto auto 1fr auto;gap:14px}header{display:flex;align-items:end;justify-content:space-between}h1{margin:0;font-size:clamp(28px,6vw,54px)}.eyebrow{margin:0 0 6px;color:#58e0d2;font-size:11px;letter-spacing:.16em}#status{border:1px solid #2a3946;border-radius:999px;padding:7px 11px;font-size:11px}#status[data-state=live]{color:#58e0d2;border-color:#58e0d2}.metrics{display:grid;grid-template-columns:repeat(4,1fr);gap:8px}.metrics div{background:#0b1219;border:1px solid #17222d;border-radius:10px;padding:10px}.metrics strong{display:block;font-size:18px}.metrics span,footer{font-size:10px;color:#8aa0af}canvas{width:100%;height:100%;min-height:55vh;border-radius:14px;border:1px solid #17222d;background:#091018;touch-action:none}footer{display:flex;gap:16px;flex-wrap:wrap}@media(max-width:640px){.metrics{grid-template-columns:repeat(2,1fr)}canvas{min-height:58vh}}

v2/.cargo/audit.toml

@@ -1,13 +1,9 @@
 # cargo-audit configuration — v2 workspace
 # Managed by security audit (fix/security-audit-rustsec-clippy branch).
 #
-# This file suppresses advisories in two categories:
-#   A) CVE-bearing advisories in TRANSITIVE deps we cannot upgrade directly
-#      because the parent published crate (ruvector-core 2.2.0) has not yet
-#      published a version with the fix.  These are tracked as issues.
-#   B) UNMAINTAINED-only advisories (no CVE) flowing through dependencies
-#      that are purely transitive / build-time and have no user-facing attack
-#      surface in this workspace.
+# This file suppresses UNMAINTAINED-only advisories (no CVE) flowing through
+# dependencies that are purely transitive / build-time and have no
+# user-facing attack surface in this workspace.
 # Each entry documents the root cause and the mitigation path.
 
 [advisories]
@@ -24,26 +20,6 @@
 # Mitigation: Accept transitively until Tauri v2 drops GTK3 or a workspace
 #   override path becomes available.
 ignore = [
-    # -----------------------------------------------------------------------
-    # CATEGORY A — transitive CVEs from ruvector-core 2.2.0 → reqwest 0.11
-    # ruvector-core 2.2.0 (latest on crates.io) depends on reqwest 0.11.27,
-    # which pulls in rustls 0.21 / rustls-webpki 0.101.7.  We cannot upgrade
-    # this without a new ruvector-core release.  Tracked in issue #812.
-    # The workspace's own TLS stack uses rustls-webpki 0.103.13 (patched);
-    # the vulnerable 0.101.7 instance is not reachable from our TLS code.
-    "RUSTSEC-2026-0098",   # rustls-webpki 0.101.7: URI name constraint bypass
-    "RUSTSEC-2026-0099",   # rustls-webpki 0.101.7: wildcard name constraint bypass
-    "RUSTSEC-2026-0104",   # rustls-webpki 0.101.7: reachable panic in CRL parsing
-    # quinn-proto 0.11.13 is also pulled through midstreamer-quic 0.3 (now
-    # upgraded).  The remaining 0.11.13 instance comes from the same
-    # ruvector-core transitive chain.  Tracked in issue #812.
-    "RUSTSEC-2026-0037",   # quinn-proto 0.11.13: DoS in Quinn endpoints
-    # CRL Distribution Point matching bug — same ruvector-core / reqwest 0.11
-    # transitive chain; rustls-webpki 0.101.7 also affected.
-    "RUSTSEC-2026-0049",   # rustls-webpki <0.103.10: CRL authority matching
-
-    # -----------------------------------------------------------------------
-    # CATEGORY B — unmaintained / no CVE
     "RUSTSEC-2024-0411",   # gdkwayland-sys: unmaintained
     "RUSTSEC-2024-0412",   # gdk: unmaintained
     "RUSTSEC-2024-0413",   # atk: unmaintained

v2/Cargo.toml

@@ -116,6 +116,7 @@ members = [
     "crates/ruview-twin",          # ADR-315 digital RF twin (per-deployment model)
     "crates/ruview-placement",     # ADR-308 sensor placement optimizer
     "crates/ruview-memory",        # ADR-312 long-term spatial memory / anomaly
+    "crates/ruview-spatial-memory",# ADR-326 tenant-scoped Cognitum Spaces history
     "crates/ruview-counterfactual",# ADR-313 counterfactual spatial inference
     "crates/ruview-infogain",      # ADR-314 information-gain scheduler
     "crates/ruview-active",        # ADR-309 active sensing control
@@ -254,7 +255,7 @@ midstreamer-attractor = "0.2"
 # ruvector integration (published on crates.io)
 # Vendored at origin/main (a083bd77f) in vendor/ruvector; using crates.io versions
 # until published. Bumps per ADR-152 §2.6 (2026-06-10 vendor sync survey).
-ruvector-core = "2.2.0"
+ruvector-core = "2.3.0"
 ruvector-mincut = "2.0.6"
 ruvector-attn-mincut = "2.0.4"
 ruvector-temporal-tensor = "2.0.6"

v2/crates/homecore-recorder/Cargo.toml

@@ -31,10 +31,16 @@ homecore = { path = "../homecore", version = "0.1.0-alpha.0" }
 # Async runtime
 tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros"] }
 
-# SQLite via sqlx — only the lite feature set; no postgres, no tls
-sqlx = { version = "0.8.1", default-features = false, features = [
-    "runtime-tokio-native-tls",
-    "sqlite",
+# SQLite-only SQLx crates, pinned in lockstep because their direct APIs are
+# semver-exempt. Depending on the umbrella `sqlx` package also resolves its
+# unused MySQL backend (and vulnerable `rsa`) into Cargo.lock.
+sqlx-core = { version = "=0.8.6", default-features = false, features = [
+    "_rt-tokio",
+    "chrono",
+    "uuid",
+] }
+sqlx-sqlite = { version = "=0.8.6", default-features = false, features = [
+    "bundled",
     "chrono",
     "uuid",
 ] }

v2/crates/homecore-recorder/src/db.rs

@@ -26,6 +26,19 @@ use homecore::StateMachine;
 use crate::dedup::fnv64a_hash;
 use crate::schema::ALL_DDL;
 
+// Preserve the narrow `sqlx::*` call surface used in this module while
+// depending only on SQLx core + SQLite. The umbrella crate resolves unused
+// database backends into Cargo.lock, including MySQL's vulnerable RSA stack.
+mod sqlx {
+    pub use sqlx_core::error::Error;
+    pub use sqlx_core::query::query;
+    pub use sqlx_core::query_as::query_as;
+
+    pub mod sqlite {
+        pub use sqlx_sqlite::{SqliteConnectOptions, SqlitePool, SqlitePoolOptions};
+    }
+}
+
 type SearchStateRecord = (
     i64,
     String,

v2/crates/homecore-server/Cargo.toml

@@ -50,7 +50,7 @@ tower-http = { version = "0.6", features = ["fs", "trace", "cors"] }
 # requires every crate that pulls reqwest to align on rustls-only (tracked in
 # CHANGELOG / ADR-131 security note).
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
-serde = { version = "1", features = ["derive"] }
+serde = { version = "1", features = ["derive", "rc"] }
 serde_yaml = "0.9"
 # Concurrent fan-out of per-bank RoomState fetches in the gateway (§11 perf).
 futures = "0.3"

v2/crates/ruview-cognitum-spaces/Cargo.toml

@@ -9,6 +9,7 @@ description = "Bounded, privacy-preserving Cognitum Spaces client for RuView"
 publish = false
 
 [dependencies]
+chrono = { version = "0.4", default-features = false }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 serde.workspace = true
 serde_json.workspace = true

v2/crates/ruview-cognitum-spaces/src/lib.rs

@@ -14,6 +14,7 @@ use url::Url;
 const MAX_RESPONSE_BYTES: usize = 1024 * 1024;
 const MAX_SPACES: usize = 100;
 const MAX_JSON_DEPTH: usize = 16;
+const MAX_JSON_NODES: usize = 10_000;
 const MAX_STRING_BYTES: usize = 4096;
 const REQUIRED_EXCLUSIONS: [&str; 7] = [
     "raw_csi",
@@ -73,6 +74,8 @@ pub enum Error {
     InvalidUrl,
     #[error("invalid or empty credential")]
     InvalidCredential,
+    #[error("invalid Spaces request: {0}")]
+    InvalidRequest(String),
     #[error("Spaces request failed: {0}")]
     Transport(#[from] reqwest::Error),
     #[error("Spaces rejected the credential ({0})")]
@@ -89,6 +92,7 @@ pub enum Error {
 
 #[derive(Clone, Debug)]
 pub struct Client {
+    base: Url,
     endpoint: Url,
     credential: Credential,
     http: reqwest::Client,
@@ -121,6 +125,7 @@ impl Client {
             ))
             .build()?;
         Ok(Self {
+            base,
             endpoint,
             credential,
             http,
@@ -128,10 +133,44 @@ impl Client {
     }
 
     pub async fn list(&self) -> Result<SpacesResponse, Error> {
-        let mut request = self
-            .http
-            .get(self.endpoint.clone())
-            .header("Accept", "application/json");
+        let body = self.get(self.endpoint.clone()).await?;
+        decode(&body)
+    }
+
+    /// Read one stable page from the versioned Cognitum spatial hierarchy.
+    /// This is a read-only method; the client exposes no publisher, approval,
+    /// command, or actuator operation.
+    pub async fn list_spatial(
+        &self,
+        kind: SpatialKind,
+        page: &PageRequest,
+    ) -> Result<SpatialResponse, Error> {
+        page.validate()?;
+        if matches!(self.credential, Credential::ApiKey(_)) && page.workspace_id.is_none() {
+            return Err(Error::InvalidRequest(
+                "API-key spatial reads require a workspace id".into(),
+            ));
+        }
+        let mut endpoint = self
+            .base
+            .join(&format!("/v1/spatial/{}", kind.as_str()))
+            .map_err(|_| Error::InvalidUrl)?;
+        {
+            let mut query = endpoint.query_pairs_mut();
+            query.append_pair("limit", &page.limit.to_string());
+            if let Some(cursor) = &page.cursor {
+                query.append_pair("cursor", cursor);
+            }
+            if let Some(workspace_id) = &page.workspace_id {
+                query.append_pair("workspaceId", workspace_id);
+            }
+        }
+        let body = self.get(endpoint).await?;
+        decode_spatial(&body, kind)
+    }
+
+    async fn get(&self, endpoint: Url) -> Result<Vec<u8>, Error> {
+        let mut request = self.http.get(endpoint).header("Accept", "application/json");
         request = match &self.credential {
             Credential::OAuth(token) => request.bearer_auth(token),
             Credential::ApiKey(key) => request.header("X-API-Key", key),
@@ -169,10 +208,162 @@ impl Client {
             }
             body.extend_from_slice(&chunk);
         }
-        decode(&body)
+        Ok(body)
     }
 }
 
+/// Versioned resource collections available from `/v1/spatial`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SpatialKind {
+    Sites,
+    Buildings,
+    Floors,
+    Spaces,
+    Zones,
+    Entities,
+    Events,
+    Alerts,
+}
+
+impl SpatialKind {
+    /// Stable wire path segment.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Sites => "sites",
+            Self::Buildings => "buildings",
+            Self::Floors => "floors",
+            Self::Spaces => "spaces",
+            Self::Zones => "zones",
+            Self::Entities => "entities",
+            Self::Events => "events",
+            Self::Alerts => "alerts",
+        }
+    }
+}
+
+/// Bounded stable-page request. OAuth derives its workspace from the signed
+/// token; the optional workspace id exists only for the legacy API-key path.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PageRequest {
+    pub limit: u8,
+    pub cursor: Option<String>,
+    pub workspace_id: Option<String>,
+}
+
+impl Default for PageRequest {
+    fn default() -> Self {
+        Self {
+            limit: 50,
+            cursor: None,
+            workspace_id: None,
+        }
+    }
+}
+
+impl PageRequest {
+    fn validate(&self) -> Result<(), Error> {
+        if self.limit == 0 || self.limit > 100 {
+            return Err(Error::InvalidRequest("limit must be from 1 to 100".into()));
+        }
+        if self.cursor.as_ref().is_some_and(|value| {
+            value.is_empty() || value.len() > 512 || value.chars().any(char::is_control)
+        }) {
+            return Err(Error::InvalidRequest("cursor is invalid".into()));
+        }
+        if self
+            .workspace_id
+            .as_ref()
+            .is_some_and(|value| !is_uuid(value))
+        {
+            return Err(Error::InvalidRequest("workspace id must be a UUID".into()));
+        }
+        Ok(())
+    }
+}
+
+fn is_uuid(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    bytes.len() == 36
+        && [8, 13, 18, 23].iter().all(|&index| bytes[index] == b'-')
+        && matches!(bytes[14], b'1'..=b'8')
+        && matches!(bytes[19].to_ascii_lowercase(), b'8' | b'9' | b'a' | b'b')
+        && bytes
+            .iter()
+            .enumerate()
+            .all(|(index, byte)| [8, 13, 18, 23].contains(&index) || byte.is_ascii_hexdigit())
+}
+
+fn valid_id(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= 120
+        && value.as_bytes()[0].is_ascii_alphanumeric()
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'.' | b':' | b'-'))
+}
+
+fn valid_timestamp(value: &str) -> bool {
+    chrono::DateTime::parse_from_rfc3339(value).is_ok()
+}
+
+fn optional_id_valid(value: Option<&str>) -> bool {
+    value.is_none_or(valid_id)
+}
+
+/// One versioned P2/P3 hierarchy/event/alert page.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SpatialResponse {
+    pub object: String,
+    pub kind: SpatialKind,
+    pub schema_version: String,
+    pub data: Vec<SpatialResource>,
+    pub next_cursor: Option<String>,
+    pub boundary: DataBoundary,
+}
+
+/// Common bounded spatial resource. Kind-specific fields stay in `attributes`;
+/// tenant/workspace and lineage fields remain typed and independently checked.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SpatialResource {
+    pub id: String,
+    pub tenant_id: String,
+    pub workspace_id: String,
+    pub kind: SpatialKind,
+    pub schema_version: String,
+    pub privacy: String,
+    pub message_id: String,
+    pub event_sequence: u64,
+    pub version: u64,
+    pub site_id: Option<String>,
+    pub building_id: Option<String>,
+    pub floor_id: Option<String>,
+    pub space_id: Option<String>,
+    pub zone_id: Option<String>,
+    pub name: Option<String>,
+    pub entity_type: Option<String>,
+    pub identity_mode: Option<String>,
+    pub event_type: Option<String>,
+    pub alert_type: Option<String>,
+    pub severity: Option<String>,
+    pub status: Option<String>,
+    #[serde(default)]
+    pub related_event_ids: Vec<String>,
+    pub observed_at: String,
+    pub expires_at: Option<String>,
+    pub retention_expires_at: Option<String>,
+    pub confidence: Option<f64>,
+    pub created_at: Option<String>,
+    pub updated_at: Option<String>,
+    #[serde(default)]
+    pub attributes: Value,
+    #[serde(default)]
+    pub provenance: Value,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SpacesResponse {
@@ -272,7 +463,178 @@ pub fn decode(bytes: &[u8]) -> Result<SpacesResponse, Error> {
     Ok(response)
 }
 
+/// Decode and independently enforce one `/v1/spatial/{kind}` page.
+pub fn decode_spatial(bytes: &[u8], expected_kind: SpatialKind) -> Result<SpatialResponse, Error> {
+    if bytes.len() > MAX_RESPONSE_BYTES {
+        return Err(Error::ResponseTooLarge);
+    }
+    let value: Value = serde_json::from_slice(bytes)
+        .map_err(|_| Error::InvalidResponse("malformed JSON".into()))?;
+    validate_value(&value, 0)?;
+    let response: SpatialResponse = serde_json::from_value(value)
+        .map_err(|error| Error::InvalidResponse(format!("spatial schema mismatch: {error}")))?;
+    if response.object != "list"
+        || response.kind != expected_kind
+        || response.schema_version != "1.0"
+        || response.data.len() > MAX_SPACES
+    {
+        return Err(Error::InvalidResponse(
+            "invalid spatial list envelope".into(),
+        ));
+    }
+    if response.boundary.authoritative_state != "HomeCore Edge"
+        || REQUIRED_EXCLUSIONS.iter().any(|required| {
+            !response
+                .boundary
+                .excluded
+                .iter()
+                .any(|excluded| excluded == required)
+        })
+    {
+        return Err(Error::InvalidResponse(
+            "incomplete edge privacy boundary".into(),
+        ));
+    }
+    if response.next_cursor.as_ref().is_some_and(|cursor| {
+        cursor.is_empty() || cursor.len() > 512 || cursor.chars().any(char::is_control)
+    }) {
+        return Err(Error::InvalidResponse("invalid next cursor".into()));
+    }
+    for record in &response.data {
+        if !valid_id(&record.id)
+            || record.tenant_id.is_empty()
+            || !is_uuid(&record.workspace_id)
+            || record.kind != expected_kind
+            || record.schema_version != "1.0"
+            || !valid_id(&record.message_id)
+            || record.version == 0
+            || !valid_timestamp(&record.observed_at)
+            || record
+                .expires_at
+                .as_deref()
+                .is_some_and(|value| !valid_timestamp(value))
+            || record
+                .retention_expires_at
+                .as_deref()
+                .is_some_and(|value| !valid_timestamp(value))
+            || record
+                .created_at
+                .as_deref()
+                .is_some_and(|value| !valid_timestamp(value))
+            || record
+                .updated_at
+                .as_deref()
+                .is_some_and(|value| !valid_timestamp(value))
+            || !optional_id_valid(record.site_id.as_deref())
+            || !optional_id_valid(record.building_id.as_deref())
+            || !optional_id_valid(record.floor_id.as_deref())
+            || !optional_id_valid(record.space_id.as_deref())
+            || !optional_id_valid(record.zone_id.as_deref())
+            || record.related_event_ids.len() > 32
+            || record.related_event_ids.iter().any(|id| !valid_id(id))
+            || record
+                .related_event_ids
+                .iter()
+                .enumerate()
+                .any(|(index, id)| record.related_event_ids[..index].contains(id))
+            || !record.attributes.is_object()
+            || !record.provenance.is_object()
+        {
+            return Err(Error::InvalidResponse(
+                "spatial resource identity is incomplete".into(),
+            ));
+        }
+        if let Some(expires_at) = record.expires_at.as_deref() {
+            let observed = chrono::DateTime::parse_from_rfc3339(&record.observed_at)
+                .map_err(|_| Error::InvalidResponse("invalid observed timestamp".into()))?;
+            let expires = chrono::DateTime::parse_from_rfc3339(expires_at)
+                .map_err(|_| Error::InvalidResponse("invalid expiry timestamp".into()))?;
+            if expires <= observed {
+                return Err(Error::InvalidResponse(
+                    "expiry must follow observation".into(),
+                ));
+            }
+        }
+        if !matches!(record.privacy.as_str(), "P2" | "P3") {
+            return Err(Error::InvalidResponse("non-semantic privacy class".into()));
+        }
+        if record
+            .confidence
+            .is_some_and(|value| !value.is_finite() || !(0.0..=1.0).contains(&value))
+        {
+            return Err(Error::InvalidResponse("invalid confidence".into()));
+        }
+        if matches!(record.kind, SpatialKind::Buildings | SpatialKind::Floors)
+            && record.site_id.as_deref().is_none_or(str::is_empty)
+        {
+            return Err(Error::InvalidResponse(
+                "spatial parent is incomplete".into(),
+            ));
+        }
+        if matches!(record.kind, SpatialKind::Spaces)
+            && (record.site_id.as_deref().is_none_or(str::is_empty)
+                || record.building_id.as_deref().is_none_or(str::is_empty)
+                || record.floor_id.as_deref().is_none_or(str::is_empty))
+        {
+            return Err(Error::InvalidResponse(
+                "spatial parent is incomplete".into(),
+            ));
+        }
+        if matches!(
+            record.kind,
+            SpatialKind::Zones | SpatialKind::Entities | SpatialKind::Events | SpatialKind::Alerts
+        ) && (record.site_id.as_deref().is_none_or(str::is_empty)
+            || record.space_id.as_deref().is_none_or(str::is_empty))
+        {
+            return Err(Error::InvalidResponse(
+                "spatial parent is incomplete".into(),
+            ));
+        }
+        if record.kind == SpatialKind::Entities
+            && (!matches!(
+                record.entity_type.as_deref(),
+                Some("sensor" | "person" | "object" | "track")
+            ) || matches!(record.entity_type.as_deref(), Some("person" | "track"))
+                && record.identity_mode.as_deref() != Some("anonymous"))
+        {
+            return Err(Error::InvalidResponse(
+                "entity privacy contract is invalid".into(),
+            ));
+        }
+        if record.kind == SpatialKind::Events
+            && record.event_type.as_deref().is_none_or(str::is_empty)
+        {
+            return Err(Error::InvalidResponse("event type is missing".into()));
+        }
+        if record.kind == SpatialKind::Alerts
+            && (record.alert_type.as_deref().is_none_or(str::is_empty)
+                || !matches!(
+                    record.severity.as_deref(),
+                    Some("info" | "warning" | "critical")
+                )
+                || !matches!(
+                    record.status.as_deref(),
+                    Some("open" | "acknowledged" | "resolved")
+                ))
+        {
+            return Err(Error::InvalidResponse("alert contract is invalid".into()));
+        }
+    }
+    Ok(response)
+}
+
 fn validate_value(value: &Value, depth: usize) -> Result<(), Error> {
+    let mut nodes = 0;
+    validate_value_inner(value, depth, &mut nodes)
+}
+
+fn validate_value_inner(value: &Value, depth: usize, nodes: &mut usize) -> Result<(), Error> {
+    *nodes = nodes.saturating_add(1);
+    if *nodes > MAX_JSON_NODES {
+        return Err(Error::InvalidResponse(
+            "JSON structure exceeds node bound".into(),
+        ));
+    }
     if depth > MAX_JSON_DEPTH {
         return Err(Error::InvalidResponse("JSON nesting is too deep".into()));
     }
@@ -285,7 +647,7 @@ fn validate_value(value: &Value, depth: usize) -> Result<(), Error> {
         }
         Value::Array(items) => {
             for item in items {
-                validate_value(item, depth + 1)?;
+                validate_value_inner(item, depth + 1, nodes)?;
             }
         }
         Value::Object(map) => {
@@ -303,19 +665,41 @@ fn validate_value(value: &Value, depth: usize) -> Result<(), Error> {
                     .collect();
                 if matches!(
                     normalized.as_str(),
-                    "rawcsi"
+                    "csi"
+                        | "rawcsi"
+                        | "channelstateinformation"
                         | "cir"
+                        | "rawcir"
+                        | "channelimpulseresponse"
+                        | "rftensor"
                         | "rftensors"
+                        | "packetcapture"
+                        | "packetcaptures"
+                        | "pcap"
+                        | "recording"
                         | "recordings"
+                        | "audiorecording"
+                        | "videorecording"
+                        | "poseframe"
                         | "poseframes"
+                        | "skeleton"
+                        | "keypoints"
+                        | "vitalwaveform"
                         | "vitalwaveforms"
+                        | "heartratewaveform"
+                        | "identityobservation"
                         | "identityobservations"
+                        | "biometric"
+                        | "biometrics"
+                        | "face"
+                        | "faces"
+                        | "faceembedding"
                 ) {
                     return Err(Error::InvalidResponse(format!(
                         "forbidden raw field: {key}"
                     )));
                 }
-                validate_value(item, depth + 1)?;
+                validate_value_inner(item, depth + 1, nodes)?;
             }
         }
         _ => {}
@@ -331,6 +715,10 @@ mod tests {
         br#"{"object":"list","data":[{"id":"room-1","tenantId":"tenant-1","workspaceId":"workspace-1","siteId":"site-1","name":"Room","version":1,"privacy":"P2","status":"live","connection":"connected","state":{"occupancy":1,"confidence":0.9,"observedAt":"2026-08-17T00:00:00Z","freshnessMs":5,"classification":"P2","uncertainty":null,"evidence":[]},"provenance":{},"hardware":{},"dataBoundary":{},"observedAt":"2026-08-17T00:00:00Z","expiresAt":null}],"boundary":{"authoritativeState":"HomeCore Edge","cloudRole":"tenant-scoped semantic synchronization","excluded":["raw_csi","cir","rf_tensors","recordings","pose_frames","vital_waveforms","identity_observations"]}}"#.to_vec()
     }
 
+    fn valid_spatial() -> Vec<u8> {
+        br#"{"object":"list","kind":"spaces","schemaVersion":"1.0","data":[{"id":"room-1","tenantId":"tenant-1","workspaceId":"22222222-2222-4222-8222-222222222222","kind":"spaces","schemaVersion":"1.0","privacy":"P2","messageId":"message-1","eventSequence":7,"version":1,"siteId":"site-1","buildingId":"building-1","floorId":"floor-1","spaceId":null,"zoneId":null,"name":"Room","observedAt":"2026-08-19T12:00:00Z","expiresAt":null,"retentionExpiresAt":null,"confidence":0.8,"attributes":{"occupancy":2},"provenance":{"witnessDigest":"abc"}}],"nextCursor":null,"boundary":{"authoritativeState":"HomeCore Edge","cloudRole":"tenant/workspace-scoped semantic synchronization","excluded":["raw_csi","cir","rf_tensors","recordings","pose_frames","vital_waveforms","identity_observations"]}}"#.to_vec()
+    }
+
     #[test]
     fn accepts_bounded_semantic_state() {
         assert_eq!(decode(&valid()).unwrap().data.len(), 1);
@@ -384,4 +772,78 @@ mod tests {
         let c = Credential::oauth("secret-token").unwrap();
         assert!(!format!("{c:?}").contains("secret-token"));
     }
+
+    #[test]
+    fn accepts_versioned_spatial_pages() {
+        let response = decode_spatial(&valid_spatial(), SpatialKind::Spaces).unwrap();
+        assert_eq!(response.data.len(), 1);
+        assert_eq!(response.data[0].event_sequence, 7);
+    }
+
+    #[test]
+    fn spatial_page_is_bound_to_requested_kind_and_parents() {
+        assert!(decode_spatial(&valid_spatial(), SpatialKind::Events).is_err());
+        let mut value: Value = serde_json::from_slice(&valid_spatial()).unwrap();
+        value["data"][0]["floorId"] = Value::Null;
+        assert!(matches!(
+            decode_spatial(&serde_json::to_vec(&value).unwrap(), SpatialKind::Spaces),
+            Err(Error::InvalidResponse(_))
+        ));
+    }
+
+    #[test]
+    fn spatial_page_rejects_cross_boundary_payload_and_bad_workspace() {
+        let mut raw: Value = serde_json::from_slice(&valid_spatial()).unwrap();
+        raw["data"][0]["attributes"]["pose_frames"] = serde_json::json!([1]);
+        assert!(decode_spatial(&serde_json::to_vec(&raw).unwrap(), SpatialKind::Spaces).is_err());
+
+        let mut workspace: Value = serde_json::from_slice(&valid_spatial()).unwrap();
+        workspace["data"][0]["workspaceId"] = Value::String("not-a-uuid".into());
+        assert!(decode_spatial(
+            &serde_json::to_vec(&workspace).unwrap(),
+            SpatialKind::Spaces
+        )
+        .is_err());
+
+        let mut timestamp: Value = serde_json::from_slice(&valid_spatial()).unwrap();
+        timestamp["data"][0]["observedAt"] = Value::String("not-a-timestamp".into());
+        assert!(decode_spatial(
+            &serde_json::to_vec(&timestamp).unwrap(),
+            SpatialKind::Spaces
+        )
+        .is_err());
+
+        let mut alias: Value = serde_json::from_slice(&valid_spatial()).unwrap();
+        alias["data"][0]["attributes"]["packet_captures"] = serde_json::json!([1]);
+        assert!(decode_spatial(&serde_json::to_vec(&alias).unwrap(), SpatialKind::Spaces).is_err());
+    }
+
+    #[test]
+    fn page_request_is_bounded_and_api_key_needs_workspace() {
+        assert!(PageRequest {
+            limit: 0,
+            ..PageRequest::default()
+        }
+        .validate()
+        .is_err());
+        assert!(PageRequest {
+            limit: 50,
+            cursor: Some("x".repeat(513)),
+            workspace_id: None,
+        }
+        .validate()
+        .is_err());
+        assert!(PageRequest {
+            workspace_id: Some("22222222-2222-4222-8222-222222222222".into()),
+            ..PageRequest::default()
+        }
+        .validate()
+        .is_ok());
+        assert!(PageRequest {
+            workspace_id: Some("22222222-2222-7222-8222-222222222222".into()),
+            ..PageRequest::default()
+        }
+        .validate()
+        .is_ok());
+    }
 }

v2/crates/ruview-policy/Cargo.toml

@@ -13,6 +13,7 @@ ruview-evidence = { path = "../ruview-evidence" }
 ruview-ood = { path = "../ruview-ood" }
 ruview-certify = { path = "../ruview-certify" }
 ruview-attest = { path = "../ruview-attest" }
+blake3 = { version = "1.5", default-features = false }
 
 [dev-dependencies]
 serde_json.workspace = true

v2/crates/ruview-policy/src/governed.rs

@@ -0,0 +1,995 @@
+//! Governed action intents and witnessed authorization receipts (ADR-327).
+//!
+//! This module never touches an actuator. Its strongest outcome is an
+//! `Authorized` receipt that a separate, explicitly configured adapter may
+//! consume. Observe and recommend are the default modes; execute fails closed
+//! unless a registered policy, live assurance, and signed approvals all pass.
+
+use crate::{authorize, ActionClass, AssuranceInputs, Authorization, FailedCondition};
+use ruview_attest::{Signature, Signer, Verifier};
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
+
+const INTENT_DOMAIN: &[u8] = b"ruview.governed-intent.v1\0";
+const APPROVAL_DOMAIN: &[u8] = b"ruview.governed-approval.v1\0";
+const RECEIPT_DOMAIN: &[u8] = b"ruview.governed-receipt.v1\0";
+const MAX_ID_BYTES: usize = 128;
+const MAX_APPROVALS: usize = 16;
+const MAX_TARGET_PREFIXES: usize = 32;
+const MAX_INTENT_LIFETIME_MS: i64 = 86_400_000;
+const MAX_RECEIPTS: usize = 10_000;
+
+/// Requested governance mode. Automation should default to `Recommend`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum IntentMode {
+    /// Record a governed observation without proposing a consequence.
+    Observe,
+    /// Produce a recommendation for human/policy review.
+    Recommend,
+    /// Request an authorization receipt for a separately configured adapter.
+    Execute,
+}
+
+impl Default for IntentMode {
+    fn default() -> Self {
+        Self::Recommend
+    }
+}
+
+/// A typed, bounded request. Parameters are represented only by a digest.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ActionIntent {
+    /// Idempotency key for this exact attempt.
+    pub intent_id: String,
+    /// Authenticated tenant identifier.
+    pub tenant_id: String,
+    /// Authenticated workspace identifier.
+    pub workspace_id: String,
+    /// Registered action kind, such as `alert.raise`.
+    pub action_kind: String,
+    /// Exact registered policy version requested by this intent.
+    pub policy_version: String,
+    /// Bounded target identifier.
+    pub target_id: String,
+    /// Consequence/assurance class.
+    pub class: ActionClass,
+    /// Observe, recommend, or explicitly request authorization.
+    #[serde(default)]
+    pub mode: IntentMode,
+    /// Authenticated requesting principal or agent.
+    pub requested_by: String,
+    /// Intent creation time in Unix milliseconds.
+    pub issued_at_ms: i64,
+    /// Hard expiry in Unix milliseconds.
+    pub expires_at_ms: i64,
+    /// Caller-generated replay nonce. All zeroes are invalid.
+    pub nonce: [u8; 16],
+    /// Digest of canonical adapter parameters; raw values are not logged here.
+    pub parameters_digest: [u8; 32],
+    /// Digest of the governed perception/evidence input.
+    pub evidence_digest: [u8; 32],
+}
+
+impl ActionIntent {
+    /// Deterministic bytes bound into approvals and receipts.
+    pub fn canonical_bytes(&self) -> Vec<u8> {
+        let mut out = Vec::with_capacity(512);
+        out.extend_from_slice(INTENT_DOMAIN);
+        for value in [
+            self.intent_id.as_str(),
+            self.tenant_id.as_str(),
+            self.workspace_id.as_str(),
+            self.action_kind.as_str(),
+            self.policy_version.as_str(),
+            self.target_id.as_str(),
+            self.requested_by.as_str(),
+        ] {
+            push_field(&mut out, value.as_bytes());
+        }
+        out.push(self.class as u8);
+        out.push(self.mode as u8);
+        out.extend_from_slice(&self.issued_at_ms.to_le_bytes());
+        out.extend_from_slice(&self.expires_at_ms.to_le_bytes());
+        out.extend_from_slice(&self.nonce);
+        out.extend_from_slice(&self.parameters_digest);
+        out.extend_from_slice(&self.evidence_digest);
+        out
+    }
+
+    /// Digest used as the immutable idempotency fingerprint.
+    pub fn digest(&self) -> [u8; 32] {
+        *blake3::hash(&self.canonical_bytes()).as_bytes()
+    }
+}
+
+/// A versioned, locally registered execution rule.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ActionRule {
+    /// Exact action kind this rule governs.
+    pub action_kind: String,
+    /// Monotonic/configuration version included in approvals and receipts.
+    pub policy_version: String,
+    /// Required assurance class. Intent class must match exactly.
+    pub class: ActionClass,
+    /// Number of distinct valid human/service approvals (at least one).
+    pub minimum_approvals: usize,
+    /// Trusted execution grant required in addition to perception assurance.
+    pub required_grant: String,
+    /// At least one prefix must match the target identifier.
+    pub target_prefixes: Vec<String>,
+}
+
+/// Local allow-list of action rules. Absence is a deny.
+#[derive(Clone, Debug, Default)]
+pub struct PolicyRegistry {
+    rules: BTreeMap<String, ActionRule>,
+}
+
+impl PolicyRegistry {
+    /// Register one valid rule; duplicate action kinds are refused.
+    pub fn register(&mut self, rule: ActionRule) -> Result<(), GovernanceError> {
+        validate_id(&rule.action_kind)?;
+        validate_id(&rule.policy_version)?;
+        validate_id(&rule.required_grant)?;
+        if rule.minimum_approvals == 0 || rule.minimum_approvals > MAX_APPROVALS {
+            return Err(GovernanceError::InvalidInput(
+                "approval threshold is out of bounds",
+            ));
+        }
+        if rule.target_prefixes.is_empty() || rule.target_prefixes.len() > MAX_TARGET_PREFIXES {
+            return Err(GovernanceError::InvalidInput(
+                "target prefix list is out of bounds",
+            ));
+        }
+        for prefix in &rule.target_prefixes {
+            validate_id(prefix)?;
+        }
+        if self.rules.contains_key(&rule.action_kind) {
+            return Err(GovernanceError::PolicyConflict);
+        }
+        self.rules.insert(rule.action_kind.clone(), rule);
+        Ok(())
+    }
+
+    fn get(&self, action_kind: &str) -> Option<&ActionRule> {
+        self.rules.get(action_kind)
+    }
+}
+
+/// Trusted grants established by the host authorization adapter.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AuthorityContext {
+    grants: BTreeSet<String>,
+}
+
+impl AuthorityContext {
+    /// Build a bounded set of authenticated grants. Strings are exact-match.
+    pub fn from_authenticated_grants<I, S>(grants: I) -> Result<Self, GovernanceError>
+    where
+        I: IntoIterator<Item = S>,
+        S: Into<String>,
+    {
+        let mut values = BTreeSet::new();
+        for (index, grant) in grants.into_iter().enumerate() {
+            if index >= MAX_APPROVALS {
+                return Err(GovernanceError::InvalidInput(
+                    "authority grant set is out of bounds",
+                ));
+            }
+            let grant = grant.into();
+            validate_id(&grant)?;
+            values.insert(grant);
+        }
+        Ok(Self { grants: values })
+    }
+
+    fn contains(&self, grant: &str) -> bool {
+        self.grants.contains(grant)
+    }
+}
+
+/// Human or service approval decision.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum ApprovalDecision {
+    /// Explicit approval.
+    Approve,
+    /// Explicit rejection; any valid rejection denies this attempt.
+    Reject,
+}
+
+/// Content signed by one registered approver.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ApprovalContent {
+    /// Intent digest prevents approval substitution.
+    pub intent_digest: [u8; 32],
+    /// Exact policy version reviewed by the approver.
+    pub policy_version: String,
+    /// Registered approver identity.
+    pub approver_id: String,
+    /// Explicit approve/reject decision.
+    pub decision: ApprovalDecision,
+    /// Approval timestamp in Unix milliseconds.
+    pub approved_at_ms: i64,
+}
+
+impl ApprovalContent {
+    /// Deterministic signing bytes.
+    pub fn canonical_bytes(&self) -> Vec<u8> {
+        let mut out = Vec::with_capacity(256);
+        out.extend_from_slice(APPROVAL_DOMAIN);
+        out.extend_from_slice(&self.intent_digest);
+        push_field(&mut out, self.policy_version.as_bytes());
+        push_field(&mut out, self.approver_id.as_bytes());
+        out.push(self.decision as u8);
+        out.extend_from_slice(&self.approved_at_ms.to_le_bytes());
+        out
+    }
+}
+
+/// Signed approval envelope.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SignedApproval {
+    /// Signed approval content.
+    pub content: ApprovalContent,
+    /// Attestation signature/MAC.
+    pub signature: Signature,
+}
+
+impl SignedApproval {
+    /// Sign approval content with an enrolled signer.
+    pub fn sign<S: Signer + ?Sized>(content: ApprovalContent, signer: &S) -> Self {
+        let signature = signer.sign(&content.canonical_bytes());
+        Self { content, signature }
+    }
+}
+
+/// Resolves approver identities to enrolled verification keys.
+pub trait ApprovalVerifier {
+    /// Return true only for a registered identity and valid signature.
+    fn verify(&self, approver_id: &str, message: &[u8], signature: &Signature) -> bool;
+}
+
+/// Stable terminal reason for a non-authorized receipt.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DenialReason {
+    /// Intent was expired or not yet valid.
+    IntentExpired,
+    /// Action kind has no registered policy.
+    NoPolicy,
+    /// Intent class does not match the registered policy.
+    ClassMismatch,
+    /// Intent names a policy version other than the registered version.
+    PolicyVersionMismatch,
+    /// Trusted host authority lacks the exact policy grant.
+    MissingAuthority,
+    /// Target is outside the registered allow-list.
+    TargetNotAllowed,
+    /// Too few distinct, valid, explicit approvals.
+    InsufficientApprovals,
+    /// An approval was malformed, rejected, duplicated, or unauthenticated.
+    InvalidApproval,
+    /// Existing assurance policy denied the requested class.
+    AssuranceDenied(FailedCondition),
+}
+
+/// Terminal governance decision. `Authorized` is not proof of actuation.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum GovernedDecision {
+    /// Observation was witnessed only.
+    Observed,
+    /// Recommendation was witnessed and awaits a new execute intent.
+    Recommended,
+    /// A separate configured adapter may execute this exact intent.
+    Authorized,
+    /// Authorization failed closed.
+    Denied(DenialReason),
+}
+
+/// Signed, hash-chained receipt content.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ReceiptContent {
+    /// Monotonic sequence within this engine instance.
+    pub sequence: u64,
+    /// Engine/service identity issuing the receipt.
+    pub issuer_id: String,
+    /// Exact intent digest.
+    pub intent_digest: [u8; 32],
+    /// Intent idempotency key for lookup.
+    pub intent_id: String,
+    /// Authenticated tenant/workspace copied from the intent.
+    pub tenant_id: String,
+    /// Authenticated tenant/workspace copied from the intent.
+    pub workspace_id: String,
+    /// Registered policy version, if a policy was found.
+    pub policy_version: Option<String>,
+    /// Terminal governance decision.
+    pub decision: GovernedDecision,
+    /// Number of distinct verified approvals used.
+    pub verified_approvals: usize,
+    /// Decision timestamp supplied by the caller.
+    pub decided_at_ms: i64,
+    /// Intent expiry copied into the receipt for adapter-side checks.
+    pub expires_at_ms: i64,
+    /// Non-secret replay nonce copied into the signed receipt.
+    pub nonce: [u8; 16],
+    /// Previous receipt digest; zeroes start a chain.
+    pub previous_receipt_digest: [u8; 32],
+}
+
+impl ReceiptContent {
+    /// Deterministic bytes for signing and chain hashing.
+    pub fn canonical_bytes(&self) -> Vec<u8> {
+        let mut out = Vec::with_capacity(512);
+        out.extend_from_slice(RECEIPT_DOMAIN);
+        out.extend_from_slice(&self.sequence.to_le_bytes());
+        for value in [
+            self.issuer_id.as_str(),
+            self.intent_id.as_str(),
+            self.tenant_id.as_str(),
+            self.workspace_id.as_str(),
+        ] {
+            push_field(&mut out, value.as_bytes());
+        }
+        out.extend_from_slice(&self.intent_digest);
+        match &self.policy_version {
+            Some(version) => {
+                out.push(1);
+                push_field(&mut out, version.as_bytes());
+            }
+            None => out.push(0),
+        }
+        push_decision(&mut out, &self.decision);
+        out.extend_from_slice(&(self.verified_approvals as u64).to_le_bytes());
+        out.extend_from_slice(&self.decided_at_ms.to_le_bytes());
+        out.extend_from_slice(&self.expires_at_ms.to_le_bytes());
+        out.extend_from_slice(&self.nonce);
+        out.extend_from_slice(&self.previous_receipt_digest);
+        out
+    }
+}
+
+/// Signed receipt. It authorizes at most; it never asserts physical execution.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct ActionReceipt {
+    /// Signed content.
+    pub content: ReceiptContent,
+    /// Signature over canonical content bytes.
+    pub signature: Signature,
+}
+
+impl ActionReceipt {
+    /// Verify the issuer signature.
+    pub fn verify<V: Verifier + ?Sized>(&self, verifier: &V) -> bool {
+        verifier.verify(&self.content.canonical_bytes(), &self.signature)
+    }
+
+    /// Digest used by the next receipt's chain link.
+    pub fn digest(&self) -> [u8; 32] {
+        let mut hasher = blake3::Hasher::new();
+        hasher.update(&self.content.canonical_bytes());
+        hasher.update(&self.signature.0);
+        *hasher.finalize().as_bytes()
+    }
+}
+
+#[derive(Clone, Debug)]
+struct StoredReceipt {
+    intent_digest: [u8; 32],
+    receipt: ActionReceipt,
+}
+
+/// Stateful governance boundary providing idempotency and receipt chaining.
+#[derive(Clone, Debug)]
+pub struct GovernanceEngine {
+    issuer_id: String,
+    policies: PolicyRegistry,
+    receipts: BTreeMap<String, StoredReceipt>,
+    nonces: BTreeMap<(String, String, [u8; 16]), [u8; 32]>,
+    next_sequence: u64,
+    previous_receipt_digest: [u8; 32],
+}
+
+impl GovernanceEngine {
+    /// Create an engine with an explicit local policy registry.
+    pub fn new(issuer_id: String, policies: PolicyRegistry) -> Result<Self, GovernanceError> {
+        validate_id(&issuer_id)?;
+        Ok(Self {
+            issuer_id,
+            policies,
+            receipts: BTreeMap::new(),
+            nonces: BTreeMap::new(),
+            next_sequence: 1,
+            previous_receipt_digest: [0; 32],
+        })
+    }
+
+    /// Evaluate and witness one intent. A repeated identical intent returns the
+    /// exact prior receipt; changed reuse of its idempotency key is rejected.
+    pub fn evaluate<S: Signer + ?Sized, V: ApprovalVerifier + ?Sized>(
+        &mut self,
+        intent: &ActionIntent,
+        authority: &AuthorityContext,
+        assurance: &AssuranceInputs,
+        approvals: &[SignedApproval],
+        approval_verifier: &V,
+        receipt_signer: &S,
+        now_ms: i64,
+    ) -> Result<ActionReceipt, GovernanceError> {
+        validate_intent(intent)?;
+        let intent_digest = intent.digest();
+        if let Some(stored) = self.receipts.get(&intent.intent_id) {
+            return if stored.intent_digest == intent_digest {
+                Ok(stored.receipt.clone())
+            } else {
+                Err(GovernanceError::IdempotencyConflict)
+            };
+        }
+        if self.receipts.len() >= MAX_RECEIPTS {
+            return Err(GovernanceError::CapacityReached);
+        }
+        let nonce_key = (
+            intent.tenant_id.clone(),
+            intent.workspace_id.clone(),
+            intent.nonce,
+        );
+        if self.nonces.contains_key(&nonce_key) {
+            return Err(GovernanceError::NonceReplay);
+        }
+
+        let rule = self.policies.get(&intent.action_kind);
+        let (decision, verified_approvals) =
+            if now_ms < intent.issued_at_ms || now_ms >= intent.expires_at_ms {
+                (GovernedDecision::Denied(DenialReason::IntentExpired), 0)
+            } else {
+                match intent.mode {
+                    IntentMode::Observe => (GovernedDecision::Observed, 0),
+                    IntentMode::Recommend => (GovernedDecision::Recommended, 0),
+                    IntentMode::Execute => evaluate_execution(
+                        intent,
+                        intent_digest,
+                        authority,
+                        assurance,
+                        approvals,
+                        approval_verifier,
+                        rule,
+                        now_ms,
+                    ),
+                }
+            };
+        let policy_version = rule.map(|value| value.policy_version.clone());
+        let content = ReceiptContent {
+            sequence: self.next_sequence,
+            issuer_id: self.issuer_id.clone(),
+            intent_digest,
+            intent_id: intent.intent_id.clone(),
+            tenant_id: intent.tenant_id.clone(),
+            workspace_id: intent.workspace_id.clone(),
+            policy_version,
+            decision,
+            verified_approvals,
+            decided_at_ms: now_ms,
+            expires_at_ms: intent.expires_at_ms,
+            nonce: intent.nonce,
+            previous_receipt_digest: self.previous_receipt_digest,
+        };
+        let receipt = ActionReceipt {
+            signature: receipt_signer.sign(&content.canonical_bytes()),
+            content,
+        };
+        self.next_sequence = self
+            .next_sequence
+            .checked_add(1)
+            .ok_or(GovernanceError::SequenceExhausted)?;
+        self.previous_receipt_digest = receipt.digest();
+        self.receipts.insert(
+            intent.intent_id.clone(),
+            StoredReceipt {
+                intent_digest,
+                receipt: receipt.clone(),
+            },
+        );
+        self.nonces.insert(nonce_key, intent_digest);
+        Ok(receipt)
+    }
+}
+
+fn evaluate_execution<V: ApprovalVerifier + ?Sized>(
+    intent: &ActionIntent,
+    intent_digest: [u8; 32],
+    authority: &AuthorityContext,
+    assurance: &AssuranceInputs,
+    approvals: &[SignedApproval],
+    verifier: &V,
+    rule: Option<&ActionRule>,
+    now_ms: i64,
+) -> (GovernedDecision, usize) {
+    if now_ms < intent.issued_at_ms || now_ms >= intent.expires_at_ms {
+        return (GovernedDecision::Denied(DenialReason::IntentExpired), 0);
+    }
+    let Some(rule) = rule else {
+        return (GovernedDecision::Denied(DenialReason::NoPolicy), 0);
+    };
+    if intent.class != rule.class {
+        return (GovernedDecision::Denied(DenialReason::ClassMismatch), 0);
+    }
+    if intent.policy_version != rule.policy_version {
+        return (
+            GovernedDecision::Denied(DenialReason::PolicyVersionMismatch),
+            0,
+        );
+    }
+    if !authority.contains(&rule.required_grant) {
+        return (GovernedDecision::Denied(DenialReason::MissingAuthority), 0);
+    }
+    if !rule
+        .target_prefixes
+        .iter()
+        .any(|prefix| intent.target_id.starts_with(prefix))
+    {
+        return (GovernedDecision::Denied(DenialReason::TargetNotAllowed), 0);
+    }
+    if approvals.len() > MAX_APPROVALS {
+        return (GovernedDecision::Denied(DenialReason::InvalidApproval), 0);
+    }
+    let mut distinct = BTreeSet::new();
+    for approval in approvals {
+        let content = &approval.content;
+        if validate_id(&content.approver_id).is_err()
+            || content.intent_digest != intent_digest
+            || content.policy_version != rule.policy_version
+            || content.approved_at_ms < intent.issued_at_ms
+            || content.approved_at_ms >= intent.expires_at_ms
+            || content.approved_at_ms > now_ms
+            || content.decision != ApprovalDecision::Approve
+            || !distinct.insert(content.approver_id.as_str())
+            || !verifier.verify(
+                &content.approver_id,
+                &content.canonical_bytes(),
+                &approval.signature,
+            )
+        {
+            return (
+                GovernedDecision::Denied(DenialReason::InvalidApproval),
+                distinct.len(),
+            );
+        }
+    }
+    if distinct.len() < rule.minimum_approvals {
+        return (
+            GovernedDecision::Denied(DenialReason::InsufficientApprovals),
+            distinct.len(),
+        );
+    }
+    match authorize(intent.class, assurance) {
+        Authorization::Allow { .. } => (GovernedDecision::Authorized, distinct.len()),
+        Authorization::Deny { failed_condition } => (
+            GovernedDecision::Denied(DenialReason::AssuranceDenied(failed_condition)),
+            distinct.len(),
+        ),
+    }
+}
+
+/// Engine/configuration errors. Policy denials are signed receipts, not errors.
+#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]
+pub enum GovernanceError {
+    /// Malformed caller/configuration input.
+    #[error("invalid governed-action input: {0}")]
+    InvalidInput(&'static str),
+    /// Duplicate action rule.
+    #[error("action policy already registered")]
+    PolicyConflict,
+    /// An intent idempotency key was reused with different content.
+    #[error("intent idempotency conflict")]
+    IdempotencyConflict,
+    /// A nonce was already bound to a different intent id.
+    #[error("intent nonce replay")]
+    NonceReplay,
+    /// The bounded in-memory replay store reached capacity.
+    #[error("governance receipt capacity reached")]
+    CapacityReached,
+    /// Receipt sequence exhausted.
+    #[error("receipt sequence exhausted")]
+    SequenceExhausted,
+}
+
+fn validate_intent(intent: &ActionIntent) -> Result<(), GovernanceError> {
+    for value in [
+        intent.intent_id.as_str(),
+        intent.tenant_id.as_str(),
+        intent.workspace_id.as_str(),
+        intent.action_kind.as_str(),
+        intent.policy_version.as_str(),
+        intent.target_id.as_str(),
+        intent.requested_by.as_str(),
+    ] {
+        validate_id(value)?;
+    }
+    if intent.issued_at_ms >= intent.expires_at_ms
+        || intent.expires_at_ms - intent.issued_at_ms > MAX_INTENT_LIFETIME_MS
+        || intent.nonce == [0; 16]
+    {
+        return Err(GovernanceError::InvalidInput("intent lifetime is invalid"));
+    }
+    Ok(())
+}
+
+fn validate_id(value: &str) -> Result<(), GovernanceError> {
+    if value.is_empty()
+        || value.len() > MAX_ID_BYTES
+        || !value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
+    {
+        return Err(GovernanceError::InvalidInput("identifier is invalid"));
+    }
+    Ok(())
+}
+
+fn push_field(output: &mut Vec<u8>, field: &[u8]) {
+    output.extend_from_slice(&(field.len() as u32).to_le_bytes());
+    output.extend_from_slice(field);
+}
+
+fn push_decision(output: &mut Vec<u8>, decision: &GovernedDecision) {
+    match decision {
+        GovernedDecision::Observed => output.push(0),
+        GovernedDecision::Recommended => output.push(1),
+        GovernedDecision::Authorized => output.push(2),
+        GovernedDecision::Denied(reason) => {
+            output.push(3);
+            push_denial(output, reason);
+        }
+    }
+}
+
+fn push_denial(output: &mut Vec<u8>, reason: &DenialReason) {
+    match reason {
+        DenialReason::IntentExpired => output.push(0),
+        DenialReason::NoPolicy => output.push(1),
+        DenialReason::ClassMismatch => output.push(2),
+        DenialReason::PolicyVersionMismatch => output.push(3),
+        DenialReason::MissingAuthority => output.push(4),
+        DenialReason::TargetNotAllowed => output.push(5),
+        DenialReason::InsufficientApprovals => output.push(6),
+        DenialReason::InvalidApproval => output.push(7),
+        DenialReason::AssuranceDenied(condition) => {
+            output.push(8);
+            match condition {
+                FailedCondition::NoPolicy => output.push(0),
+                FailedCondition::CertificateInvalid => output.push(1),
+                FailedCondition::CertificateClassTooLow { required, actual } => {
+                    output.extend_from_slice(&[2, *required as u8, *actual as u8]);
+                }
+                FailedCondition::CertificateStale { age_secs, max_secs } => {
+                    output.push(3);
+                    output.extend_from_slice(&age_secs.to_le_bytes());
+                    output.extend_from_slice(&max_secs.to_le_bytes());
+                }
+                FailedCondition::DomainDegraded => output.push(4),
+                FailedCondition::DomainNotKnown => output.push(5),
+                FailedCondition::UncertaintyOverCeiling { max_uncertainty } => {
+                    output.push(6);
+                    output.extend_from_slice(&max_uncertainty.to_bits().to_le_bytes());
+                }
+                FailedCondition::EvidenceBelowFloor { required, actual } => {
+                    output.extend_from_slice(&[7, *required as u8, *actual as u8]);
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{CertificateClass, DomainState};
+    use ruview_attest::Blake3MacSigner;
+    use ruview_evidence::EvidenceLevel;
+
+    const NOW: i64 = 10_000;
+
+    struct Approvers(BTreeMap<String, Blake3MacSigner>);
+
+    impl ApprovalVerifier for Approvers {
+        fn verify(&self, approver_id: &str, message: &[u8], signature: &Signature) -> bool {
+            self.0
+                .get(approver_id)
+                .is_some_and(|key| Verifier::verify(key, message, signature))
+        }
+    }
+
+    fn registry() -> PolicyRegistry {
+        let mut registry = PolicyRegistry::default();
+        registry
+            .register(ActionRule {
+                action_kind: "alert.raise".into(),
+                policy_version: "v1".into(),
+                class: ActionClass::Security,
+                minimum_approvals: 1,
+                required_grant: "alerts:execute".into(),
+                target_prefixes: vec!["alert:".into()],
+            })
+            .unwrap();
+        registry
+    }
+
+    fn intent(mode: IntentMode) -> ActionIntent {
+        ActionIntent {
+            intent_id: "intent-1".into(),
+            tenant_id: "tenant-1".into(),
+            workspace_id: "workspace-1".into(),
+            action_kind: "alert.raise".into(),
+            policy_version: "v1".into(),
+            target_id: "alert:room-1".into(),
+            class: ActionClass::Security,
+            mode,
+            requested_by: "agent-1".into(),
+            issued_at_ms: NOW - 100,
+            expires_at_ms: NOW + 100,
+            nonce: [1; 16],
+            parameters_digest: [1; 32],
+            evidence_digest: [2; 32],
+        }
+    }
+
+    fn assurance() -> AssuranceInputs {
+        AssuranceInputs {
+            certificate_class: CertificateClass::Standard,
+            certificate_valid: true,
+            certificate_age_secs: 1,
+            domain_state: DomainState::Known,
+            uncertainty: 0.1,
+            evidence_level: EvidenceLevel::L2,
+        }
+    }
+
+    fn approvers() -> Approvers {
+        Approvers(BTreeMap::from([(
+            "human-1".into(),
+            Blake3MacSigner::new([3; 32]),
+        )]))
+    }
+
+    fn authority() -> AuthorityContext {
+        AuthorityContext::from_authenticated_grants(["alerts:execute"]).unwrap()
+    }
+
+    fn approval(intent: &ActionIntent) -> SignedApproval {
+        SignedApproval::sign(
+            ApprovalContent {
+                intent_digest: intent.digest(),
+                policy_version: "v1".into(),
+                approver_id: "human-1".into(),
+                decision: ApprovalDecision::Approve,
+                approved_at_ms: NOW - 1,
+            },
+            &Blake3MacSigner::new([3; 32]),
+        )
+    }
+
+    #[test]
+    fn observe_and_recommend_are_non_executing_defaults() {
+        let signer = Blake3MacSigner::new([9; 32]);
+        for (mode, expected) in [
+            (IntentMode::Observe, GovernedDecision::Observed),
+            (IntentMode::Recommend, GovernedDecision::Recommended),
+        ] {
+            let mut engine =
+                GovernanceEngine::new("issuer".into(), PolicyRegistry::default()).unwrap();
+            let receipt = engine
+                .evaluate(
+                    &intent(mode),
+                    &authority(),
+                    &assurance(),
+                    &[],
+                    &approvers(),
+                    &signer,
+                    NOW,
+                )
+                .unwrap();
+            assert_eq!(receipt.content.decision, expected);
+            assert!(receipt.verify(&signer));
+        }
+    }
+
+    #[test]
+    fn expired_observation_and_recommendation_intents_are_denied() {
+        let signer = Blake3MacSigner::new([9; 32]);
+        for mode in [IntentMode::Observe, IntentMode::Recommend] {
+            let mut request = intent(mode);
+            request.issued_at_ms = NOW - 200;
+            request.expires_at_ms = NOW - 1;
+            let mut engine =
+                GovernanceEngine::new("issuer".into(), PolicyRegistry::default()).unwrap();
+            let receipt = engine
+                .evaluate(
+                    &request,
+                    &authority(),
+                    &assurance(),
+                    &[],
+                    &approvers(),
+                    &signer,
+                    NOW,
+                )
+                .unwrap();
+            assert_eq!(
+                receipt.content.decision,
+                GovernedDecision::Denied(DenialReason::IntentExpired)
+            );
+            assert!(receipt.verify(&signer));
+        }
+    }
+
+    #[test]
+    fn execute_requires_policy_signed_approval_and_assurance() {
+        let receipt_signer = Blake3MacSigner::new([9; 32]);
+        let request = intent(IntentMode::Execute);
+        let mut engine = GovernanceEngine::new("issuer".into(), registry()).unwrap();
+        let denied = engine
+            .evaluate(
+                &request,
+                &authority(),
+                &assurance(),
+                &[],
+                &approvers(),
+                &receipt_signer,
+                NOW,
+            )
+            .unwrap();
+        assert_eq!(
+            denied.content.decision,
+            GovernedDecision::Denied(DenialReason::InsufficientApprovals)
+        );
+
+        let mut second = request.clone();
+        second.intent_id = "intent-2".into();
+        second.nonce = [2; 16];
+        let authorized = engine
+            .evaluate(
+                &second,
+                &authority(),
+                &assurance(),
+                &[approval(&second)],
+                &approvers(),
+                &receipt_signer,
+                NOW,
+            )
+            .unwrap();
+        assert_eq!(authorized.content.decision, GovernedDecision::Authorized);
+        assert_eq!(authorized.content.previous_receipt_digest, denied.digest());
+        assert!(authorized.verify(&receipt_signer));
+    }
+
+    #[test]
+    fn invalid_approval_and_unknown_domain_fail_closed() {
+        let signer = Blake3MacSigner::new([9; 32]);
+        let request = intent(IntentMode::Execute);
+        let mut bad = approval(&request);
+        bad.signature.0[0] ^= 1;
+        let mut engine = GovernanceEngine::new("issuer".into(), registry()).unwrap();
+        let receipt = engine
+            .evaluate(
+                &request,
+                &authority(),
+                &assurance(),
+                &[bad],
+                &approvers(),
+                &signer,
+                NOW,
+            )
+            .unwrap();
+        assert_eq!(
+            receipt.content.decision,
+            GovernedDecision::Denied(DenialReason::InvalidApproval)
+        );
+
+        let mut second = request.clone();
+        second.intent_id = "intent-2".into();
+        second.nonce = [2; 16];
+        let mut weak = assurance();
+        weak.domain_state = DomainState::Unknown;
+        let receipt = engine
+            .evaluate(
+                &second,
+                &authority(),
+                &weak,
+                &[approval(&second)],
+                &approvers(),
+                &signer,
+                NOW,
+            )
+            .unwrap();
+        assert_eq!(
+            receipt.content.decision,
+            GovernedDecision::Denied(DenialReason::AssuranceDenied(
+                FailedCondition::DomainNotKnown
+            ))
+        );
+    }
+
+    #[test]
+    fn spaces_read_is_not_execution_authority_and_nonce_reuse_is_rejected() {
+        let signer = Blake3MacSigner::new([9; 32]);
+        let request = intent(IntentMode::Execute);
+        let read_only = AuthorityContext::from_authenticated_grants(["spaces:read"]).unwrap();
+        let mut engine = GovernanceEngine::new("issuer".into(), registry()).unwrap();
+        let receipt = engine
+            .evaluate(
+                &request,
+                &read_only,
+                &assurance(),
+                &[approval(&request)],
+                &approvers(),
+                &signer,
+                NOW,
+            )
+            .unwrap();
+        assert_eq!(
+            receipt.content.decision,
+            GovernedDecision::Denied(DenialReason::MissingAuthority)
+        );
+
+        let mut changed_id = request;
+        changed_id.intent_id = "intent-other".into();
+        assert_eq!(
+            engine.evaluate(
+                &changed_id,
+                &authority(),
+                &assurance(),
+                &[approval(&changed_id)],
+                &approvers(),
+                &signer,
+                NOW,
+            ),
+            Err(GovernanceError::NonceReplay)
+        );
+    }
+
+    #[test]
+    fn idempotency_is_exact_and_changed_reuse_is_rejected() {
+        let signer = Blake3MacSigner::new([9; 32]);
+        let request = intent(IntentMode::Recommend);
+        let mut engine = GovernanceEngine::new("issuer".into(), registry()).unwrap();
+        let first = engine
+            .evaluate(
+                &request,
+                &authority(),
+                &assurance(),
+                &[],
+                &approvers(),
+                &signer,
+                NOW,
+            )
+            .unwrap();
+        let replay = engine
+            .evaluate(
+                &request,
+                &authority(),
+                &assurance(),
+                &[],
+                &approvers(),
+                &signer,
+                NOW + 1,
+            )
+            .unwrap();
+        assert_eq!(first, replay);
+        let mut changed = request;
+        changed.parameters_digest = [0xAA; 32];
+        assert_eq!(
+            engine.evaluate(
+                &changed,
+                &authority(),
+                &assurance(),
+                &[],
+                &approvers(),
+                &signer,
+                NOW,
+            ),
+            Err(GovernanceError::IdempotencyConflict)
+        );
+    }
+}

v2/crates/ruview-policy/src/lib.rs

@@ -63,6 +63,9 @@
 use ruview_evidence::EvidenceLevel;
 use serde::{Deserialize, Serialize};
 
+/// Typed intent, approval, idempotency, and witnessed-receipt layer (ADR-327).
+pub mod governed;
+
 // ---------------------------------------------------------------------------
 // Value types owned by this crate
 // ---------------------------------------------------------------------------
@@ -479,10 +482,8 @@ pub fn authorize_from_certificate<V: ruview_attest::Verifier + ?Sized>(
     uncertainty: f64,
     evidence_level: EvidenceLevel,
 ) -> Authorization {
-    let certificate_valid =
-        cert.verify(verifier) && now_unix_s < cert.content.valid_until_unix_s;
-    let certificate_age_secs =
-        (now_unix_s - cert.content.calibrated_date_unix_s).max(0) as u64;
+    let certificate_valid = cert.verify(verifier) && now_unix_s < cert.content.valid_until_unix_s;
+    let certificate_age_secs = (now_unix_s - cert.content.calibrated_date_unix_s).max(0) as u64;
 
     authorize(
         class,

v2/crates/ruview-spatial-memory/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "ruview-spatial-memory"
+version.workspace = true
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Tenant-scoped encrypted RuVector spatial memory for Cognitum Spaces"
+
+[dependencies]
+chacha20poly1305 = "0.10"
+getrandom.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+wifi-densepose-ruvector = { path = "../wifi-densepose-ruvector" }
+zeroize = "1"
+
+[dev-dependencies]
+tempfile = "3"

v2/crates/wifi-densepose-bfld/Cargo.toml

@@ -39,7 +39,7 @@ serde = { workspace = true, features = ["derive"], optional = true }
 serde_json = { workspace = true, optional = true }
 # MQTT publisher backend (optional). Matches the `rumqttc` choice already in
 # `wifi-densepose-sensing-server` so both crates share TLS / version posture.
-rumqttc = { version = "0.24", default-features = false, features = ["use-rustls"], optional = true }
+rumqttc = { package = "rumqttc-v4-next", version = "0.34", default-features = false, features = ["use-rustls-ring"], optional = true }
 wifi-veil = { workspace = true, optional = true }
 
 [dev-dependencies]

v2/crates/wifi-densepose-bfld/src/ha_discovery.rs

@@ -31,7 +31,7 @@ use crate::PrivacyClass;
 /// };
 /// use rumqttc::MqttOptions;
 ///
-/// let opts = MqttOptions::new("seed-01", "broker.local", 1883);
+/// let opts = MqttOptions::new("seed-01", ("broker.local", 1883));
 /// let (retained_pub, _conn) = RumqttPublisher::connect(opts.clone(), 64);
 /// let mut retained_pub = retained_pub.with_retain(true);
 /// publish_discovery(&mut retained_pub, "seed-01", PrivacyClass::Anonymous)?;

v2/crates/wifi-densepose-bfld/src/rumqttc_publisher.rs

@@ -13,7 +13,7 @@
 //! use wifi_densepose_bfld::{publish_event, RumqttPublisher};
 //! use rumqttc::MqttOptions;
 //!
-//! let opts = MqttOptions::new("seed-01", "broker.local", 1883);
+//! let opts = MqttOptions::new("seed-01", ("broker.local", 1883));
 //! let (mut publisher, mut connection) = RumqttPublisher::connect(opts, 100);
 //! thread::spawn(move || for _ in connection.iter() { /* drain */ });
 //! // ... build BfldEvent ...
@@ -22,7 +22,7 @@
 
 #![cfg(feature = "mqtt")]
 
-use rumqttc::{Client, Connection, LastWill, MqttOptions, QoS};
+use rumqttc::{Client, Connection, LastWill, MqttOptions, PublishOptions, QoS};
 
 use crate::availability::{availability_topic, PAYLOAD_NOT_AVAILABLE};
 use crate::mqtt_topics::{Publish, TopicMessage};
@@ -60,7 +60,7 @@ impl RumqttPublisher {
     /// shown in the module-level doc example).
     #[must_use]
     pub fn connect(opts: MqttOptions, capacity: usize) -> (Self, Connection) {
-        let (client, connection) = Client::new(opts, capacity);
+        let (client, connection) = Client::builder(opts).capacity(capacity).build();
         (Self::new(client, QoS::AtLeastOnce), connection)
     }
 
@@ -87,7 +87,7 @@ impl RumqttPublisher {
 /// opt in to the LWT without using `connect_with_lwt`.
 #[must_use]
 pub fn with_lwt(mut opts: MqttOptions, node_id: &str) -> MqttOptions {
-    // rumqttc 0.24 LastWill::new takes (topic, message, qos, retain).
+    // LastWill::new takes (topic, message, qos, retain).
     // retain = true so HA sees "offline" on next start even if the session
     // dropped while HA was down.
     let will = LastWill::new(
@@ -105,6 +105,10 @@ impl Publish for RumqttPublisher {
 
     fn publish(&mut self, msg: &TopicMessage) -> Result<(), Self::Error> {
         self.client
-            .publish(&msg.topic, self.qos, self.retain, msg.payload.as_bytes())
+            .publish(
+                &msg.topic,
+                msg.payload.as_bytes(),
+                PublishOptions::new(self.qos).retain(self.retain),
+            )
     }
 }

v2/crates/wifi-densepose-bfld/tests/mosquitto_integration.rs

@@ -23,9 +23,7 @@ use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use rumqttc::{Client, Event, Incoming, MqttOptions, Packet, QoS};
-use wifi_densepose_bfld::{
-    publish_event, BfldEvent, PrivacyClass, RumqttPublisher,
-};
+use wifi_densepose_bfld::{publish_event, BfldEvent, PrivacyClass, RumqttPublisher};
 
 const SUBSCRIBE_TIMEOUT: Duration = Duration::from_secs(5);
 const RECEIVE_TIMEOUT: Duration = Duration::from_secs(10);
@@ -69,9 +67,9 @@ fn spawn_subscriber(
     port: u16,
     topic_filter: &str,
 ) -> (Receiver<(String, String)>, Receiver<()>) {
-    let mut opts = MqttOptions::new(unique_client_id("bfld-sub"), host, port);
-    opts.set_keep_alive(Duration::from_secs(5));
-    let (client, mut connection) = Client::new(opts, 64);
+    let mut opts = MqttOptions::new(unique_client_id("bfld-sub"), (host, port));
+    opts.set_keep_alive(5);
+    let (client, mut connection) = Client::builder(opts).capacity(64).build();
     client
         .subscribe(topic_filter, QoS::AtLeastOnce)
         .expect("subscribe enqueue");
@@ -79,13 +77,18 @@ fn spawn_subscriber(
     let (incoming_tx, incoming_rx) = channel();
     let (suback_tx, suback_rx) = channel();
     thread::spawn(move || {
+        // rumqttc-v4-next stops the connection once every request sender is
+        // dropped. Keep the subscriber client alive for as long as its pump
+        // thread runs; otherwise the broker sees a clean disconnect directly
+        // after SUBACK and no subsequent publications can be delivered.
+        let _client_guard = client;
         for notification in connection.iter() {
             match notification {
                 Ok(Event::Incoming(Packet::SubAck(_))) => {
                     let _ = suback_tx.send(());
                 }
                 Ok(Event::Incoming(Incoming::Publish(p))) => {
-                    let topic = p.topic.clone();
+                    let topic = String::from_utf8_lossy(&p.topic).to_string();
                     let payload = String::from_utf8_lossy(&p.payload).to_string();
                     if incoming_tx.send((topic, payload)).is_err() {
                         break;
@@ -141,8 +144,8 @@ fn live_broker_anonymous_event_roundtrips_all_six_topics() {
 
     // Publisher with its own connection. Spawn a thread iterating the
     // Connection so publishes actually reach the broker.
-    let mut opts = MqttOptions::new(unique_client_id("bfld-pub"), &host, port);
-    opts.set_keep_alive(Duration::from_secs(5));
+    let mut opts = MqttOptions::new(unique_client_id("bfld-pub"), (host.as_str(), port));
+    opts.set_keep_alive(5);
     let (mut publisher, mut pub_connection) = RumqttPublisher::connect(opts, 64);
     thread::spawn(move || {
         for _ in pub_connection.iter() { /* drain protocol events */ }
@@ -197,8 +200,8 @@ fn live_broker_restricted_event_omits_identity_risk() {
         .recv_timeout(SUBSCRIBE_TIMEOUT)
         .expect("SubAck within 5s");
 
-    let mut opts = MqttOptions::new(unique_client_id("bfld-pub-r"), &host, port);
-    opts.set_keep_alive(Duration::from_secs(5));
+    let mut opts = MqttOptions::new(unique_client_id("bfld-pub-r"), (host.as_str(), port));
+    opts.set_keep_alive(5);
     let (mut publisher, mut pub_connection) = RumqttPublisher::connect(opts, 64);
     thread::spawn(move || for _ in pub_connection.iter() {});
     thread::sleep(Duration::from_millis(200));

v2/crates/wifi-densepose-bfld/tests/rumqttc_lwt.rs

@@ -9,7 +9,7 @@ use wifi_densepose_bfld::{
 };
 
 fn unreachable_opts(client_id: &str) -> MqttOptions {
-    MqttOptions::new(client_id, "127.0.0.1", 1)
+    MqttOptions::new(client_id, ("127.0.0.1", 1))
 }
 
 #[test]
@@ -89,7 +89,7 @@ fn caller_built_options_can_opt_in_via_with_lwt_then_pass_to_connect() {
     // Operators with custom MqttOptions (e.g., TLS, credentials) build their
     // own opts, then call with_lwt before passing to RumqttPublisher::connect.
     let mut opts = unreachable_opts("bfld-lwt-6");
-    opts.set_keep_alive(std::time::Duration::from_secs(30));
+    opts.set_keep_alive(30);
     let opts = with_lwt(opts, "seed-01");
     let (_publisher, _connection) = RumqttPublisher::connect(opts, 16);
 }

v2/crates/wifi-densepose-bfld/tests/rumqttc_publisher_smoke.rs

@@ -12,7 +12,7 @@ use wifi_densepose_bfld::{publish_event, BfldEvent, PrivacyClass, Publish, Rumqt
 fn unreachable_opts() -> MqttOptions {
     // Port 1 is reserved (RFC 1700) and the loopback address will refuse
     // immediately — perfect for a construction smoke test that must not block.
-    MqttOptions::new("bfld-smoke-iter23", "127.0.0.1", 1)
+    MqttOptions::new("bfld-smoke-iter23", ("127.0.0.1", 1))
 }
 
 fn sample_event() -> BfldEvent {

v2/crates/wifi-densepose-cli/src/spaces.rs

@@ -2,9 +2,36 @@
 
 use std::path::PathBuf;
 
-use clap::Args;
+use clap::{Args, ValueEnum};
 use ruview_auth::{login, scope};
-use ruview_cognitum_spaces::{Client, Credential};
+use ruview_cognitum_spaces::{Client, Credential, PageRequest, SpatialKind};
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum SpatialResourceKind {
+    Sites,
+    Buildings,
+    Floors,
+    Spaces,
+    Zones,
+    Entities,
+    Events,
+    Alerts,
+}
+
+impl From<SpatialResourceKind> for SpatialKind {
+    fn from(value: SpatialResourceKind) -> Self {
+        match value {
+            SpatialResourceKind::Sites => Self::Sites,
+            SpatialResourceKind::Buildings => Self::Buildings,
+            SpatialResourceKind::Floors => Self::Floors,
+            SpatialResourceKind::Spaces => Self::Spaces,
+            SpatialResourceKind::Zones => Self::Zones,
+            SpatialResourceKind::Entities => Self::Entities,
+            SpatialResourceKind::Events => Self::Events,
+            SpatialResourceKind::Alerts => Self::Alerts,
+        }
+    }
+}
 
 #[derive(Debug, Args)]
 pub struct SpacesArgs {
@@ -20,6 +47,22 @@ pub struct SpacesArgs {
     #[arg(long, env = ruview_auth::login::CREDENTIALS_PATH_ENV)]
     pub credentials_path: Option<PathBuf>,
 
+    /// Versioned hierarchy/event/alert collection. Omit for the legacy flat projection.
+    #[arg(long, value_enum)]
+    pub resource: Option<SpatialResourceKind>,
+
+    /// Page size for a versioned resource collection (1..=100).
+    #[arg(long, default_value_t = 50, value_parser = clap::value_parser!(u8).range(1..=100), requires = "resource")]
+    pub limit: u8,
+
+    /// Opaque next-page cursor returned by a prior versioned read.
+    #[arg(long, requires = "resource")]
+    pub cursor: Option<String>,
+
+    /// API-key compatibility only: exact workspace UUID. OAuth derives this from its signed token.
+    #[arg(long, requires = "resource")]
+    pub workspace_id: Option<String>,
+
     /// Emit the validated response as JSON.
     #[arg(long)]
     pub json: bool,
@@ -46,7 +89,47 @@ pub async fn spaces_cmd(args: SpacesArgs) -> anyhow::Result<()> {
             Credential::oauth(session.ensure_fresh().await?)?
         }
     };
-    let response = Client::new(&args.base_url, credential)?.list().await?;
+    let client = Client::new(&args.base_url, credential)?;
+    if let Some(resource) = args.resource {
+        let response = client
+            .list_spatial(
+                resource.into(),
+                &PageRequest {
+                    limit: args.limit,
+                    cursor: args.cursor,
+                    workspace_id: args.workspace_id,
+                },
+            )
+            .await?;
+        if args.json {
+            println!("{}", serde_json::to_string_pretty(&response)?);
+            return Ok(());
+        }
+        println!(
+            "Cognitum Spatial {}: {}",
+            response.kind.as_str(),
+            response.data.len()
+        );
+        println!(
+            "Boundary: {} / {}",
+            response.boundary.authoritative_state, response.boundary.cloud_role
+        );
+        for item in response.data {
+            println!(
+                "{}\tkind={}\tprivacy={}\tsite={}\tspace={}",
+                item.id,
+                item.kind.as_str(),
+                item.privacy,
+                item.site_id.as_deref().unwrap_or("-"),
+                item.space_id.as_deref().unwrap_or("-")
+            );
+        }
+        if let Some(cursor) = response.next_cursor {
+            println!("Next cursor: {cursor}");
+        }
+        return Ok(());
+    }
+    let response = client.list().await?;
     if args.json {
         println!("{}", serde_json::to_string_pretty(&response)?);
         return Ok(());

v2/crates/wifi-densepose-rufield/Cargo.toml

@@ -19,6 +19,10 @@ rufield-core = { version = "0.1.0", path = "../../../vendor/rufield/crates/rufie
 rufield-provenance = { version = "0.1.0", path = "../../../vendor/rufield/crates/rufield-provenance" }
 rufield-privacy = { version = "0.1.0", path = "../../../vendor/rufield/crates/rufield-privacy" }
 rufield-fusion = { version = "0.1.0", path = "../../../vendor/rufield/crates/rufield-fusion" }
+# ADR-262 P4 second modality: UltrasonicReplayAdapter parses, validates and
+# signs BatVu range profiles upstream, so RuView only has to decide what it is
+# willing to put on a wire. Same pure-Rust constraint as the four above.
+rufield-adapters = { version = "0.1.0", path = "../../../vendor/rufield/crates/rufield-adapters" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 

v2/crates/wifi-densepose-rufield/src/bridge.rs

@@ -145,6 +145,21 @@ pub fn snapshot_to_field_event(snap: &SensingSnapshot, signer: &Signer) -> Field
         features: build_features(snap, range_m),
         labels: build_labels(snap),
         privacy_class: class,
+        // ── fields added upstream since the previous submodule pin ─────────
+        //
+        // Each empty for its own reason rather than because a default was
+        // convenient. `track_id`: this bridge emits per-cycle snapshots, not
+        // tracks, and a stable per-person identifier is exactly what §3.3
+        // warns about. `attributes`: nothing `features` and `labels` do not
+        // already carry, and an empty map is omitted from the wire.
+        // `identity_evidence` / `channel_sounding_provenance`: both are
+        // structurally BLE-only — `validate_evidence_at` rejects either on any
+        // other modality — so for `wifi_csi` they are not unset, they are
+        // unrepresentable.
+        track_id: None,
+        attributes: Default::default(),
+        identity_evidence: None,
+        channel_sounding_provenance: None,
     };
 
     // ── 3. Provenance (real sha256 over the tensor bytes) ───────────────────
@@ -166,6 +181,15 @@ pub fn snapshot_to_field_event(snap: &SensingSnapshot, signer: &Signer) -> Field
         vendor: "esp32".to_string(),
         device_id: snap.node_id.clone(),
         placement: "unknown".to_string(),
+        // Optional sensor pose, added upstream. Left unset on purpose: a CSI
+        // link has no boresight and no surveyed position here, and §6 is
+        // explicit that this surface makes no validated room-coordinate claim
+        // (`field_localize`). A placeholder pose would be inventing exactly
+        // that claim. The ultrasonic path DOES set these, because a handheld
+        // scanner genuinely knows where it was pointing.
+        coordinate_frame: None,
+        position_m: None,
+        orientation_xyzw: None,
         clock_domain: "local".to_string(),
     };
 

v2/crates/wifi-densepose-rufield/src/lib.rs

@@ -71,12 +71,14 @@
 pub mod bridge;
 pub mod privacy;
 pub mod snapshot;
+pub mod ultrasonic;
 
 pub use bridge::{snapshot_egress_class, snapshot_to_field_event};
 pub use privacy::{apply_demotion_floor, egress_class, map_privacy};
 pub use snapshot::{
     RuViewPrivacyClass, SensingClass, SensingFeatures, SensingSnapshot, SignalField,
 };
+pub use ultrasonic::{ScanError, ScanSource, UltrasonicScan, ULTRASONIC_EGRESS_CLASS};
 
 // Re-export the rufield surface a bridge consumer needs, so callers depend on
 // one crate.

v2/crates/wifi-densepose-rufield/src/ultrasonic.rs

@@ -0,0 +1,233 @@
+//! ADR-262 **P4, second modality**: ultrasonic range profiles on the field
+//! surface.
+//!
+//! Until now RuView's `/api/field` and `/ws/field` have carried exactly one
+//! modality — WiFi CSI, through [`crate::bridge`]. ADR-262 §4 lists multi-
+//! modality as P4 and leaves the choice of the second one open (§8 question 5
+//! asks whether it should be `rvcsi`, "making RuField the convergence point for
+//! both vendored sensing runtimes").
+//!
+//! This is a different answer to that question, and the reason is that it costs
+//! almost nothing: `rufield-adapters` now ships
+//! [`UltrasonicReplayAdapter`](rufield_adapters::UltrasonicReplayAdapter), the
+//! first adapter for `Modality::Ultrasonic` — registry code 7, which had sat in
+//! the §8 registry since v0.1 with nothing implementing it. It parses, validates
+//! and **signs** BatVu recordings upstream. RuView does not have to build any of
+//! that; it has to decide what it is willing to put on a wire.
+//!
+//! # What BatVu is, in one paragraph
+//!
+//! [BatVu](https://github.com/ruvnet/batvu) is a handheld sonar that runs in a
+//! phone browser: a 17.5–20.5 kHz chirp out of the speaker, a matched filter
+//! over the microphone, and a **range profile** — echo amplitude against
+//! distance along one beam. One microphone, so it measures range and infers
+//! bearing only from where the operator was pointing. That asymmetry is why the
+//! beam is carried as sensor *pose* rather than as an angle axis.
+//!
+//! # Why this module exists at all, given the adapter does the work
+//!
+//! Because RuView's egress rule is **stricter** than RuField's default guard,
+//! and the difference has to be structural rather than a runtime refusal.
+//!
+//! The adapter offers two output modes. [`UltrasonicOutput::RangeProfile`] is
+//! the full per-bin frame, classified `P0`, which
+//! [`network_egress_allowed`](crate::network_egress_allowed) holds edge-local —
+//! correctly, but *silently*, as a dropped event at the end of a pipeline that
+//! did all the parsing and signing first.
+//! [`UltrasonicOutput::CoarseProfile`] is a 32-bin max-pooled reduction,
+//! classified `P1`, which is egress-safe.
+//!
+//! So this module does not offer the choice. It configures the adapter for the
+//! coarse mode and says why, because a consumer cannot un-coarsen a coarse
+//! profile and a policy expressed in the *shape of the data* cannot be
+//! misconfigured later. The egress gate still runs — belt and braces, and it is
+//! asserted by a test — but by then there is nothing left for it to catch.
+//!
+//! # Honesty (ADR-262 §0 / §6)
+//!
+//! Same posture as P1, plus one more caveat that is BatVu's rather than ours:
+//!
+//! 1. **Replay, not live.** A file, not a streaming phone.
+//! 2. **Every current BatVu recording is its own simulator's output**, so the
+//!    events carry `synthetic: true` and are fusable only under
+//!    [`TrustPolicy::simulation`](rufield_provenance::TrustPolicy::simulation).
+//!    `captured_replay()` and `production()` reject them outright, as they
+//!    should. When a real device recording exists it declares
+//!    `device_capture` and this module refuses it unless the caller has asked
+//!    for that source explicitly — a recording cannot talk its way up a trust
+//!    tier by relabelling itself.
+//! 3. **No accuracy is claimed.** The detections are CFAR outputs at a
+//!    documented false-alarm rate. That is an operating point, not validated
+//!    accuracy against surveyed ground truth.
+//! 4. **Nothing here says a person is present.** The adapter deliberately
+//!    declines to populate the `presence` feature that would light up the
+//!    shipped `person_present` rule: one transducer pair cannot distinguish a
+//!    person from a coat over the back of a chair. The visible consequence is
+//!    that ultrasonic events currently produce no fused inferences at all, and
+//!    `ultrasonic_gates.rs` asserts that rather than papering over it.
+//!
+//! # What this does NOT do
+//!
+//! It does not touch the running server. P1 shipped as a library before P3
+//! wired it in, and this follows the same staging: a tested translation with
+//! its own gates, reviewable on its own, with the surface change as a separate
+//! change once the shape is agreed. [`UltrasonicScan::egress_events`] returns
+//! exactly what `FieldSurface::emit` would need to broadcast.
+
+use rufield_adapters::{
+    UltrasonicConfig, UltrasonicOutput, UltrasonicReplayAdapter, UltrasonicSource,
+};
+use rufield_core::{FieldEvent, PrivacyClass};
+
+use crate::network_egress_allowed;
+
+/// Which recordings a deployment is willing to accept.
+///
+/// Mirrors [`UltrasonicSource`] rather than re-exporting it, so a caller does
+/// not have to depend on `rufield-adapters` to make the choice — the bridge
+/// stays the single coupling point (ADR-262 §5.4).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ScanSource {
+    /// Rendered by BatVu's acoustic simulator. Events are `synthetic: true`.
+    /// The safe default: it cannot be mistaken for a measurement.
+    Simulated,
+    /// Captured from a real phone microphone. Events are `synthetic: false`
+    /// and are eligible for captured-replay trust once the sensor key is
+    /// enrolled.
+    DeviceCapture,
+}
+
+impl From<ScanSource> for UltrasonicSource {
+    fn from(s: ScanSource) -> Self {
+        match s {
+            ScanSource::Simulated => UltrasonicSource::Simulated,
+            ScanSource::DeviceCapture => UltrasonicSource::DeviceCapture,
+        }
+    }
+}
+
+/// Errors from loading a BatVu recording.
+#[derive(Debug, Clone, PartialEq)]
+pub enum ScanError {
+    /// The recording failed the adapter's parser. Carries its message, which
+    /// names the offending line.
+    Parse(String),
+    /// Calibration could not be established.
+    Calibrate(String),
+}
+
+impl std::fmt::Display for ScanError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ScanError::Parse(m) => write!(f, "ultrasonic recording rejected: {m}"),
+            ScanError::Calibrate(m) => write!(f, "ultrasonic calibration failed: {m}"),
+        }
+    }
+}
+
+impl std::error::Error for ScanError {}
+
+/// A loaded BatVu scan, ready to put on the field surface.
+#[derive(Debug)]
+pub struct UltrasonicScan {
+    adapter: UltrasonicReplayAdapter,
+    calibration_id: String,
+}
+
+impl UltrasonicScan {
+    /// Load a `.ultrasonic.jsonl` recording.
+    ///
+    /// `zone_id` is the room the scan was taken in and lands on every
+    /// observation. `accept` declares which source the deployment will take; a
+    /// recording declaring anything else is **refused**, in both directions, so
+    /// neither is a silent reinterpretation.
+    ///
+    /// Calibration runs here rather than being optional. The receipt id ends up
+    /// on every tensor, so an event that skipped it would be one nobody could
+    /// later ask "under what calibration was this measured".
+    pub fn load(text: &str, zone_id: &str, accept: ScanSource) -> Result<Self, ScanError> {
+        let config = UltrasonicConfig {
+            accept: accept.into(),
+            zone_id: zone_id.to_string(),
+            placement: "handheld".to_string(),
+            // Not a caller's choice. See the module docs: the raw per-bin frame
+            // is P0 and would be dropped by the egress gate after all the work
+            // of parsing and signing it. Coarsening at the source makes the
+            // policy a property of the data instead of a property of a check
+            // somebody could later reorder.
+            output: UltrasonicOutput::CoarseProfile,
+        };
+        let mut adapter = UltrasonicReplayAdapter::from_jsonl_with(text, config)
+            .map_err(|e| ScanError::Parse(e.to_string()))?;
+        let receipt = adapter
+            .calibrate(zone_id)
+            .map_err(|e| ScanError::Calibrate(e.to_string()))?;
+        Ok(UltrasonicScan {
+            adapter,
+            calibration_id: receipt.calibration_id,
+        })
+    }
+
+    /// Pings in the recording.
+    #[must_use]
+    pub fn ping_count(&self) -> usize {
+        self.adapter.ping_count()
+    }
+
+    /// The sensor identity the whole recording belongs to.
+    ///
+    /// This is the key RuField's replay watermark and trust registry are both
+    /// keyed on, so it has to be stable across scans — the adapter refuses a
+    /// recording whose device changes midway.
+    #[must_use]
+    pub fn device_id(&self) -> &str {
+        self.adapter.device_id()
+    }
+
+    /// The calibration receipt every tensor in this scan cites.
+    #[must_use]
+    pub fn calibration_id(&self) -> &str {
+        &self.calibration_id
+    }
+
+    /// Every event in the recording, signed and validated by the adapter.
+    ///
+    /// Includes events that the egress gate would refuse. Use this for an
+    /// edge-local consumer; use [`egress_events`](Self::egress_events) for
+    /// anything that reaches a network.
+    pub fn events(&mut self) -> Result<Vec<FieldEvent>, ScanError> {
+        self.adapter
+            .collect_events()
+            .map_err(|e| ScanError::Parse(e.to_string()))
+    }
+
+    /// Only the events RuView will put on the wire.
+    ///
+    /// Runs the same [`network_egress_allowed`] gate the CSI path runs, with
+    /// `identity_bound: false` — an ultrasonic scan has no identity to bind, and
+    /// hard-coding it rather than plumbing a flag means there is no argument a
+    /// caller can pass that turns the P4/P5 consent exception on. There is no
+    /// consent story for a room scan.
+    ///
+    /// In the coarse mode configured by [`load`](Self::load) this should drop
+    /// nothing, and `coarse_scan_passes_the_egress_gate_intact` asserts it. The
+    /// gate stays because a policy that is only enforced where it never fires
+    /// is a policy nobody notices removing.
+    pub fn egress_events(&mut self) -> Result<Vec<FieldEvent>, ScanError> {
+        Ok(self
+            .events()?
+            .into_iter()
+            .filter(|e| network_egress_allowed(e.observation.privacy_class, false))
+            .filter(|e| network_egress_allowed(e.tensor.privacy_class, false))
+            .collect())
+    }
+}
+
+/// The privacy class every event from [`UltrasonicScan`] carries.
+///
+/// `P1` — a derived non-identity feature. Stated as a constant so a test can
+/// pin it: if the adapter's default output mode ever changes upstream, that is
+/// a submodule bump which silently moves data from edge-local to network-eligible
+/// or back, and it should fail a build here rather than change behaviour in a
+/// deployment.
+pub const ULTRASONIC_EGRESS_CLASS: PrivacyClass = PrivacyClass::P1;