RuView/harness/ruview/skills/cognitum-spaces.md

Cognitum Spaces OAuth activation

Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces projection without giving an agent a bearer token or API key.

Boundary

• This is a read-only P2/P3 semantic projection. HomeCore Edge remains authoritative.
• Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and identity observations are prohibited.
• spaces:read grants no pairing, publication, write, command, policy approval, spending, or actuator authority.
• A read may refresh an expiring OAuth session and atomically rotate the local credential file.

Activate OAuth explicitly

Install or build the wifi-densepose CLI, then request the additional scope:

wifi-densepose login --spaces

For a terminal without a browser:

wifi-densepose login --spaces --no-browser

Confirm that the account reports spaces:read, then list through the metaharness:

wifi-densepose whoami
npx @ruvnet/ruview spaces
npx @ruvnet/ruview spaces --resource sites
npx @ruvnet/ruview spaces --resource events --limit 25

The versioned collections are sites, buildings, floors, spaces, zones, entities, events, and alerts. Continue a page with the returned opaque nextCursor; do not decode or reuse a cursor for another collection.

Use --credentials-path <private-file> only from the human-invoked CLI when a non-default credential store is intentional. Never put a bearer token or API key on the command line.

MCP

The tool is ruview_spaces_list. It is denied by default even though the cloud operation is read-only, because it consumes a local identity credential and contacts an external service. The MCP server operator must grant that capability and may bind the credential path in the server environment:

RUVIEW_MCP_GRANTS=credential-use \
RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
npx @ruvnet/ruview mcp start

MCP calls cannot choose a credential path and the tool schema has no token or API-key, workspace override, or base-URL field. The API origin is fixed to https://api.cognitum.one, the adapter requires an installed wifi-densepose binary, and the child environment excludes COGNITUM_SPACES_API, so this surface verifies the OAuth path rather than silently taking the compatibility API-key path.

Interpret results honestly

An empty data list can be a valid authenticated tenant result. It proves the read path and isolation behavior, not sensing quality. Every accepted response must declare HomeCore Edge as authoritative and carry the complete prohibited field list. Parent lineage, schema version, anonymous person/track identity, event/alert fields, confidence, and cursor bounds are independently checked. Any malformed, oversized, non-semantic, or raw-field response fails closed.