From 5e1a61e23fd40dc745e6cd915ccf66a138374743 Mon Sep 17 00:00:00 2001 From: ruvnet Date: Sun, 14 Jun 2026 17:01:11 +0000 Subject: [PATCH] deploy: f250149e94148d3f9b6a01a004c074178413cc2c --- .../adr/ADR-262-rufield-ruview-integration.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/api-docs/adr/ADR-262-rufield-ruview-integration.md b/api-docs/adr/ADR-262-rufield-ruview-integration.md index 7fcde475..2484dc65 100644 --- a/api-docs/adr/ADR-262-rufield-ruview-integration.md +++ b/api-docs/adr/ADR-262-rufield-ruview-integration.md @@ -2,7 +2,7 @@ | Field | Value | |-------|-------| -| **Status** | Proposed | +| **Status** | Proposed — P1 implemented | | **Date** | 2026-06-14 | | **Deciders** | ruv | | **Codebase target** | New thin bridge crate `wifi-densepose-rufield` (v2 workspace member); taps `wifi-densepose-sensing-server` emit path + `wifi-densepose-engine` `TrustedOutput`; depends on `vendor/rufield/crates/rufield-*` via path (the `vendor/rvcsi` pattern) | @@ -21,6 +21,19 @@ This project has been publicly accused of "AI slop." This ADR answers with **evi --- +## 0.1 Implementation status + +**P1 (§4) is implemented** as the `wifi-densepose-rufield` bridge crate (`v2/crates/wifi-densepose-rufield/`, a new v2 workspace member; path-deps the `vendor/rufield` submodule per §5.4): + +- **Input** — `SensingSnapshot` (owned primitives mirroring `SensingUpdate` features/classification/signal_field joined with the `TrustedOutput` `trust_class`/`demoted`/`identity_bound`); the bridge does **not** depend on `wifi-densepose-sensing-server` (anti-corruption layer). +- **Conversion** — `snapshot_to_field_event(&snap, &Signer)` emits a signed `FieldEvent` (`Modality::WifiCsi`, axis `[Frequency]`, real `timestamp_ns`); position derived from the signal-field peak when present (never fabricated); real sha256 `ProvenanceRef` + ed25519 signature, `synthetic = false`. +- **Privacy (§3.3 crux)** — `map_privacy()` maps by information content, **fail-closed**: `Raw → P0`, `Derived → P4` (or `P5` if identity-bound — **never P1**), `Anonymous → P2`, `Restricted → P2`; a `demoted` cycle floors egress to ≥ P2. +- **Gates that pass** (`tests/p1_gates.rs`, 15 tests / 0 failed = 5 unit + 9 integration + 1 doc): round-trip (snapshot → `FieldEvent` → serde → equal); `is_fusable` (verified ed25519 receipt); `RuFieldFusion::ingest` accept + `infer()` runs; **privacy-safety** (`gate_privacy_safety_derived_never_maps_to_low_privacy` — `Derived → P4/P5`, never P1; full §3.3 table; fail-closed demotion); determinism (same snapshot + same signer seed → byte-identical event). + +**Deferred:** the §3.3 *provenance carrier* recommendation (reuse the `cog-ha-matter` SHA-256+Ed25519 chain + embed the BLAKE3 engine witness) is **not** in P1 — P1 takes a dedicated `Signer` param (the §8 open question 1 key-ownership decision is unresolved). P2's BLAKE3-embed, P3 (live `/ws/field` surfacing — the bridge is **not** wired into the running server yet), and P4 (multi-modality) remain future work. **No accuracy is claimed** (§0 / §6) — P1 is tested plumbing + a safe privacy mapping. + +--- + ## 1. Context — two architectures, mapped ### 1.1 RuField MFS (ADR-260, `vendor/rufield/`)