feat(ADR-262 P3): live /api/field + /ws/field — RuView sensing speaks RuField (fail-closed egress)#1071
Merged
Merged
Conversation
…d on /api/field + /ws/field Wire the P1 `wifi-densepose-rufield` bridge into the live `wifi-densepose-sensing-server` so the governed sensing cycle emits real signed RuField `FieldEvent`s on two additive endpoints. - Cargo: add the `wifi-densepose-rufield` path dep (the single coupling point, ADR-262 §5.4 — no new RuView-internal coupling). - New `src/rufield_surface.rs` (kept out of the 8k-line main.rs): `FieldSurface` holds a dedicated ed25519 `Signer` + a bounded ring of recent events + the `/ws/field` broadcast topic; `GET /api/field` and `GET /ws/field` handlers; a standalone `router()` for isolated testing. - Signer (defers the P2 key decision, ADR-262 §8 Q1): a STANDALONE dev/sensing key from `WDP_RUFIELD_SIGNING_SEED`, else a deterministic dev default with a logged WARN. Reusing the `cog-ha-matter` Ed25519 key is the deferred P2 call — P3 does not pre-empt it. - Tap: at the ESP32 governed-trust cycle (`main.rs` ~5886 observe_cycle / ~5938 SensingUpdate build), `emit_rufield_event` joins the cycle's features/classification/signal_field with the engine's effective_class/demoted trust state into a `SensingSnapshot` and surfaces it via the bridge. Existing endpoints (`/ws/sensing` etc.) are unchanged — purely additive. - Privacy egress: `network_egress_allowed` is fail-closed for an unattended live surface — only P1/P2 leave the box; P0 raw and P3/P4/P5 (identity/biometric/aggregate) are held edge-local. A `Derived` cycle maps to P4/P5 and never surfaces. - No-phantom: `emit` drops no-presence cycles (no fabricated events). Gates (tests/rufield_surface_test.rs, tower::oneshot, 4/0): well-formed signed event (WifiCsi, P2 not P1, is_fusable, real timestamp); empty cycle → no phantom; Derived trust never surfaces; mixed stream surfaces only egress-safe events. Honesty (ADR-262 §0/§6): real plumbing on a live endpoint, NOT accuracy. Single-link CSI with its existing caveats (no validated room-coordinate accuracy); dedicated dev signing key pending the P2 ownership decision; no accuracy claim. Co-Authored-By: claude-flow <ruv@ruv.net>
…ield; CHANGELOG - ADR-262 Status → "P1 + P3 implemented"; add a P3 implementation-status block (tap site, endpoints, dedicated dev signer deferring the §8 Q1 key decision, fail-closed egress, gates). Keep the honesty framing: real plumbing on a live endpoint, not accuracy. - CHANGELOG [Unreleased]: add the ADR-262 P3 entry. - user-guide: add `/api/field` to the REST table + a "RuField surface (ADR-262 P3)" section covering `/api/field` + `/ws/field`, the fail-closed P1/P2-only egress, the WDP_RUFIELD_SIGNING_SEED dev key, and the no-accuracy honesty note. Co-Authored-By: claude-flow <ruv@ruv.net>
Making wifi-densepose-rufield (ADR-262 bridge) a v2 workspace member means EVERY cargo-on-workspace context must have the vendor/rufield submodule present (cargo loads all member manifests). P1 only fixed the rust-tests job; this adds `submodules: recursive` to all workflow checkouts that run cargo (mqtt-integration was failing on the missing submodule manifest), and makes Dockerfile.rust COPY vendor/rufield/ to /vendor/rufield (matches the bridge's ../../../vendor/rufield path-dep under the collapsed Docker layout). update-submodules.yml left alone (it manages submodules itself). Co-Authored-By: claude-flow <ruv@ruv.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ADR-262 Phase 3 — RuView's live sensing-server now speaks RuField. Every governed sensing cycle emits a real ed25519-signed
FieldEventon new/api/field+/ws/fieldendpoints, via the P1 bridge. Real plumbing live on an endpoint — dedicated dev signing key pending the P2 ownership decision, no accuracy claim.What landed (surgical, additive)
sensing-server/src/rufield_surface.rs(kept out of the 8k-linemain.rs).main.rs:~6002(right after the/ws/sensingsend):emit_rufield_eventjoins the cycle'sSensingUpdate(features/classification/signal_field) with the engine'seffective_class/demoted→SensingSnapshot→ P1 bridge → signedFieldEvent. All existing endpoints byte-for-byte unchanged.GET /api/field— latest signed events (JSON) + signer pubkey +dev_signing_keyflag; bounded 64-event ring.GET /ws/field— broadcast stream per cycle (mirrors/ws/sensing, on both HTTP+WS ports).Security — fail-closed egress (stricter than default)
Added
network_egress_allowed: on this unattended live surface, only P1/P2 leave the box; P0 raw and P3/P4/P5 (identity/biometric) are held edge-local. ADerived → P4/P5cycle therefore never surfaces on the network. No-presence cycles emit no phantom event (enforced structurally).Signing key (defers P2 §8 Q1)
A dedicated standalone ed25519 key in server state, seeded from
WDP_RUFIELD_SIGNING_SEED(else a deterministic dev default with a logged WARN +dev_signing_key:truesurfaced). Reusing thecog-ha-matterkey is the deferred P2 decision — P3 uses a standalone sensing key so it doesn't pre-empt that call.Tests + validation
8 tests (4 in-process
tower::oneshotintegration + 4 unit): well-formed signed event (WifiCsi, P2 never P1,is_fusable), empty→no-phantom,Derived-never-surfaces privacy-safety pin, mixed-stream egress filter.cargo test -p wifi-densepose-sensing-server --no-default-features→ 667 passed, 0 failed.cargo test --workspace --no-default-features→ exit 0, 0 failed (3351).python archive/v1/data/proof/verify.py→ VERDICT: PASS.Honest scope
(1) Single-link CSI with its existing caveats — no validated room-coordinate accuracy (positions are strongest field-peak, not triangulation). (2) Dev signing key pending P2. (3) No accuracy claim — the win is narrowly "RuView's live sensing now speaks RuField on
/ws/field." ADR-262 Status → "P1 + P3 implemented".🤖 Generated with claude-flow