Skip to content

Beyond-SOTA sweep M5–M6 (ADR-159/160): appliance + edge-skill honesty + crates.io publish#1024

Merged
ruvnet merged 11 commits into
mainfrom
feat/v2-beyond-sota-sweep-m5
Jun 12, 2026
Merged

Beyond-SOTA sweep M5–M6 (ADR-159/160): appliance + edge-skill honesty + crates.io publish#1024
ruvnet merged 11 commits into
mainfrom
feat/v2-beyond-sota-sweep-m5

Conversation

@ruvnet

@ruvnet ruvnet commented Jun 12, 2026

Copy link
Copy Markdown
Owner

Beyond-SOTA sweep M5–M6 (ADR-159, ADR-160) — appliance + edge-skill honesty

Continuation of #1023 (M0–M4). Same discipline: real fixes, MEASURED, tests that fail on the old code. 3,128 tests / 0 failed (cargo test --workspace --no-default-features), Python proof PASS.

M5 — Cognitum appliance / detection (ADR-159)

The external audit's "the Seed never identified anyone" accusation is REFUTED, byte-level: cog-person-count and cog-pose-estimation ship real, trained, SHA-pinned, Ed25519-signed Candle models (trained weight distributions, not zeros/random) with honest manifests (they publish 34% / 3.0 PCK accuracy — not inflated) and an honest "stub" fallback. cog-ha-matter's witness chain is genuinely SOTA-grade. The ruview-swarm randn uses are all legitimate. The real defects were claim-surface overclaims, all fixed:

  • A1 (HIGH): pose runtime emitted zero frames under its own default config (hardcoded confidence 0.185 < default 0.3) — fixed so a default install emits + warns.
  • A2: 8-class counter on a 2-class-trained model → low-confidence flag/clamp + honest description.
  • A3: Remote ID broadcast NED metres as WGS84 lat/lon → renamed honest fields.
  • A4: hollow CLI manifest → emits the real signed manifest.

M6 — Edge-skill library honest labeling (ADR-160)

0 stubs, 0 theater — all ~70 skills run real DSP. Exposure was the claim surface:

  • A1 (HIGH): 5 med_* modules stated clinical detection as fact → mandatory "experimental / NOT a medical device" disclaimers + gated behind a non-default medical-experimental feature.
  • A2: deleted an uncited "12% faster" affect stat; disclaimed emotion heuristics.
  • A3: WEAPON_ALERTHIGH_METAL_REFLECTIVITY (honest physical quantity).
  • A5 (soundness): 61 static mut event buffers → owned per-instance (fixes latent aliasing UB + static_mut_refs deny). 0 warnings.

Also

  • 9 crates whose APIs changed in M0–M4 were published to crates.io (vitals/wifiscan/hardware/nn 0.3.1, ruvector 0.3.2, signal 0.3.3, train 0.3.2, mat 0.3.1, sensing-server 0.3.2).
  • Hardened 3 sensing-server tests to unique per-process temp dirs (deterministic under concurrent runs).

🤖 Generated with claude-flow

ruvnet added 11 commits June 11, 2026 22:41
vitals/wifiscan/hardware/nn 0.3.0->0.3.1, ruvector 0.3.1->0.3.2,
signal 0.3.2->0.3.3, train 0.3.1->0.3.2, mat 0.3.0->0.3.1,
sensing-server 0.3.1->0.3.2.

Co-Authored-By: claude-flow <ruv@ruv.net>
pose_v1 has no confidence head, so infer() emits a constant 0.185 per
frame. The config default_min_confidence was 0.3 and the runtime gates
on confidence >= min_confidence, so a default install silently emitted
ZERO pose.frame events while health reported healthy.

- Add inference::MODEL_TYPICAL_CONFIDENCE (0.185, the validation PCK@50)
  as the single published per-frame confidence.
- Pin default_min_confidence() to MODEL_TYPICAL_CONFIDENCE so a default
  install clears its own gate and emits.
- Warn at run.started when min_confidence exceeds the model typical
  confidence (disclosed, not silent); document the trade-off in the
  config field, the JSON schema, and inference.rs.

Failing-on-old test: default_config_emits_frames_with_real_model
(with old 0.3 it panics: "default install would emit zero pose.frame
events").

Co-Authored-By: claude-flow <ruv@ruv.net>
…R-159 A2)

The count head has 8 classes but count_train_results.json only has
support for classes 0/1 (presence, not multi-occupant counting). An
argmax on classes 2..=7 is out-of-distribution, yet the cog emitted it
as a confident headcount and the crate billed itself a "multi-person
counter".

- Add MAX_TRAINED_CLASS=1, CountPrediction::is_low_confidence() and
  clamped_count().
- person.count events now carry low_confidence + raw_count, downgrade to
  level "warn" when OOD, and clamp the reported count to the trained
  range (no fabricated headcount).
- run.started discloses count_max_trained_class / count_classes.
- Cargo.toml description: "multi-person counter" ->
  "presence detector + (data-gated) person count".

Multi-occupant accuracy stays DATA-GATED (not fabricated).

Failing-on-old test: untrained_class_argmax_is_flagged_low_confidence.

Co-Authored-By: claude-flow <ruv@ruv.net>
cmd_manifest emitted a null skeleton (binary_sha256: null) while the
real signed manifest existed on disk at
cog/artifacts/manifests/<arch>/manifest.json.

- New manifest module include_str!-embeds the real signed manifests
  (x86_64 + arm), selected by build target arch.
- cmd_manifest parses-then-emits the embedded signed manifest, mirroring
  cog-pose-estimation manifest_roundtrips. CLI now reports the real
  binary_sha256, weights_sha256, Ed25519 signature, and honest
  build_metadata (training_class1_accuracy = 0.343).

Failing-on-old test:
manifest::tests::embedded_manifest_has_non_null_binary_sha256 (+
embedded_manifest_is_signed, embedded_manifest_id_matches_cog).
Verified end-to-end: cog-person-count manifest -> non-null sha256.

Co-Authored-By: claude-flow <ruv@ruv.net>
… A3)

RemoteIdBroadcast::update stored NED metres (state.position.x/.y) into
drone_lat/drone_lon, so the ASTM F3411 broadcast would carry physically
-impossible coordinates ("latitude = 37.5 m"). The module doc claimed a
Location/Vector message but only encode_basic_id() exists.

- Rename drone_lat/drone_lon -> drone_north_m/drone_east_m (NED metres
  relative to the operator/takeoff datum), documented as non-geodetic.
  operator_lat/lon stay true WGS84.
- Correct the module doc to claim Basic ID only; Location/Vector encoding
  is deferred until a datum-anchored NED->WGS84 transform lands.

Never broadcast physically-impossible coordinates.

Failing-on-old test:
security::remote_id::tests::test_ned_offset_stored_as_metres_not_latlon.

Co-Authored-By: claude-flow <ruv@ruv.net>
Matter commissioning is deferred to v0.8 (TlsConfig::Off, LAN-only, per
tls_defaults_to_off_for_v1_lan_only). Soften the Cargo.toml description
from "Home Assistant + Matter integration" to "Home Assistant (MQTT)
integration ... Matter Bridge commissioning is deferred to v0.8 and not
yet implemented" (honest-absence, ADR-158 pattern). No code change.

Co-Authored-By: claude-flow <ruv@ruv.net>
Records the anti-AI-slop sweep over cog-person-count, cog-pose-estimation,
cog-ha-matter, ruview-swarm. HEADLINE: the "never identified anyone"
accusation is REFUTED (real SHA-pinned Ed25519-signed trained Candle
models, honest 34%/3% accuracy in manifests). Documents claim-surface
fixes A1-A5 (MEASURED), NO-ACTION positives (witness chain, fusion, PPO +
randn audit), graded SOTA landscape (counting/pose DATA-GATED, swarm MARL
untrained-at-runtime by design), and the deferred backlog (benches,
Location/Vector, Matter v0.8, wasm-edge accuracy).

Co-Authored-By: claude-flow <ruv@ruv.net>
…ls (ADR-160)

The wasm-edge skill library runs real DSP with 0 stubs / 0 theater; the exposure
is an over-confident claim surface on unvalidated skills plus a latent static-mut
soundness issue. Make the labels TRUE (do not pretend to validate the capability)
and fix the soundness mechanically:

- A1 (HIGH): med_seizure/cardiac/respiratory/sleep_apnea/gait -- add mandatory
  "EXPERIMENTAL / NOT VALIDATED AGAINST CLINICAL DATA / NOT A MEDICAL DEVICE"
  disclaimers, soften assertive verbs to "flags candidate <X>-like signatures",
  and gate all 5 behind a NON-default medical-experimental cargo feature so they
  cannot be silently shipped. DSP kept.
- A2 (HIGH): exo_happiness_score/exo_emotion_detect -- delete the uncited
  "~12% faster" stat, add "speculative, unvalidated affect heuristic; outputs are
  NOT measurements of emotion" disclaimers, reframe HAPPINESS_SCORE as a
  gait-energy proxy. Math kept.
- A3 (MEDIUM): sec_weapon_detect -- rename EVENT_WEAPON_ALERT ->
  EVENT_HIGH_METAL_REFLECTIVITY and WEAPON_RATIO_THRESH -> HIGH_REFLECTIVITY_THRESH
  (a variance ratio measures reflectivity, not weapons). Registry updated.
- A4 (MEDIUM): exo_dream_stage/exo_gesture_language -- add experimental
  disclaimers, promote the Exotic/Research tag into the header.
- A5 (MEDIUM, soundness): replace ~61 `static mut EVENTS`/EV/TE/EMPTY per-call
  scratch buffers (60 modules) with owned per-instance `events` fields returned as
  `&self.events[..n]`. Public signature unchanged; behavior preserved. Only the
  two legitimate single-threaded WASM module singletons (lib.rs STATE,
  ghost_hunter DETECTOR) remain as static mut. Removes the static_mut_refs source.

NO-ACTION positives (cited, labels untouched): qnt_* (quantum-/Grover-inspired,
disclosed), exo_time_crystal, exo_ghost_hunter, sig_*/lrn_* algorithm-named skills.

Co-Authored-By: claude-flow <ruv@ruv.net>
…59 backlog now TRUE)

- tests/honest_labeling.rs: 10 source-presence tests asserting the A1-A5 claim
  invariants (disclaimers present, uncited stat removed, WEAPON_ALERT no longer
  exported, med_* feature-gated, no static-mut event buffers). Each is designed to
  FAIL on the pre-fix source (ADR-159 A5 manifest-roundtrip style).
- ADR-160: records the headline (0 stubs/0 theater, all real DSP -> claim-surface
  honesty debt), the graded A1-A5 fixes, NO-ACTION positives, per-prefix
  classification, and the DATA-GATED deferred backlog (criterion benches,
  per-skill accuracy validation, wasm32 static_mut_refs CI confirmation).
- ADR-159: its deferred-backlog line "wasm-edge ... honestly labelled, not claimed"
  is now actually TRUE.

Validation (all 0 failed, host --features std):
  DEFAULT 615 | MEDICAL (+medical-experimental) 653 | NO-DEFAULT 615; 0 warnings.

Co-Authored-By: claude-flow <ruv@ruv.net>
…er concurrent runs)

checkpoint_round_trip / rvf_test / rvf_pipeline_test shared fixed temp_dir paths
and remove_dir at teardown, so two concurrent/repeated test runs raced (one's
teardown wiped the other's file -> NotFound). Make each dir process-unique.
Test-only; no public API change.

Co-Authored-By: claude-flow <ruv@ruv.net>
One-command harness: clone, run scripts/prove.sh, and every headline claim is
either verified on your machine (re-runs the bug-catching tests) or printed as
'CLAIMED — not reproduced here' with the exact prerequisite. Hard gate =
workspace tests + deterministic Python proof; section 3 re-runs 7 anti-slop
assertion tests (each fails on pre-fix code); gated claims (GPU/dataset/hardware/
trained-checkpoint/named-identity) are honestly listed, never faked.

Co-Authored-By: claude-flow <ruv@ruv.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant