* feat(ADR-262 P3): live RuField surface — RuView sensing speaks RuField on /api/field + /ws/field
Wire the P1 `wifi-densepose-rufield` bridge into the live
`wifi-densepose-sensing-server` so the governed sensing cycle emits real
signed RuField `FieldEvent`s on two additive endpoints.
- Cargo: add the `wifi-densepose-rufield` path dep (the single coupling
point, ADR-262 §5.4 — no new RuView-internal coupling).
- New `src/rufield_surface.rs` (kept out of the 8k-line main.rs):
`FieldSurface` holds a dedicated ed25519 `Signer` + a bounded ring of
recent events + the `/ws/field` broadcast topic; `GET /api/field` and
`GET /ws/field` handlers; a standalone `router()` for isolated testing.
- Signer (defers the P2 key decision, ADR-262 §8 Q1): a STANDALONE
dev/sensing key from `WDP_RUFIELD_SIGNING_SEED`, else a deterministic
dev default with a logged WARN. Reusing the `cog-ha-matter` Ed25519
key is the deferred P2 call — P3 does not pre-empt it.
- Tap: at the ESP32 governed-trust cycle (`main.rs` ~5886 observe_cycle
/ ~5938 SensingUpdate build), `emit_rufield_event` joins the cycle's
features/classification/signal_field with the engine's
effective_class/demoted trust state into a `SensingSnapshot` and
surfaces it via the bridge. Existing endpoints (`/ws/sensing` etc.)
are unchanged — purely additive.
- Privacy egress: `network_egress_allowed` is fail-closed for an
unattended live surface — only P1/P2 leave the box; P0 raw and
P3/P4/P5 (identity/biometric/aggregate) are held edge-local. A
`Derived` cycle maps to P4/P5 and never surfaces.
- No-phantom: `emit` drops no-presence cycles (no fabricated events).
Gates (tests/rufield_surface_test.rs, tower::oneshot, 4/0): well-formed
signed event (WifiCsi, P2 not P1, is_fusable, real timestamp); empty
cycle → no phantom; Derived trust never surfaces; mixed stream surfaces
only egress-safe events.
Honesty (ADR-262 §0/§6): real plumbing on a live endpoint, NOT accuracy.
Single-link CSI with its existing caveats (no validated room-coordinate
accuracy); dedicated dev signing key pending the P2 ownership decision;
no accuracy claim.
Co-Authored-By: claude-flow <ruv@ruv.net>
* docs(ADR-262 P3): mark P1+P3 implemented; document /api/field + /ws/field; CHANGELOG
- ADR-262 Status → "P1 + P3 implemented"; add a P3 implementation-status
block (tap site, endpoints, dedicated dev signer deferring the §8 Q1
key decision, fail-closed egress, gates). Keep the honesty framing:
real plumbing on a live endpoint, not accuracy.
- CHANGELOG [Unreleased]: add the ADR-262 P3 entry.
- user-guide: add `/api/field` to the REST table + a "RuField surface
(ADR-262 P3)" section covering `/api/field` + `/ws/field`, the
fail-closed P1/P2-only egress, the WDP_RUFIELD_SIGNING_SEED dev key,
and the no-accuracy honesty note.
Co-Authored-By: claude-flow <ruv@ruv.net>
* ci: checkout submodules everywhere + Dockerfile copies vendor/rufield
Making wifi-densepose-rufield (ADR-262 bridge) a v2 workspace member means
EVERY cargo-on-workspace context must have the vendor/rufield submodule
present (cargo loads all member manifests). P1 only fixed the rust-tests
job; this adds `submodules: recursive` to all workflow checkouts that run
cargo (mqtt-integration was failing on the missing submodule manifest), and
makes Dockerfile.rust COPY vendor/rufield/ to /vendor/rufield (matches the
bridge's ../../../vendor/rufield path-dep under the collapsed Docker layout).
update-submodules.yml left alone (it manages submodules itself).
Co-Authored-By: claude-flow <ruv@ruv.net>
---------
Co-authored-by: ruv <ruvnet@gmail.com>
version.txt on main was still 0.6.2. CMake reads PROJECT_VER from it, so
esp_app_get_description()->version (and the boot log line) reported 0.6.2
for any source build — and v0.6.3-esp32 shipped a release binary that
internally identified as 0.6.2 because the bump never landed on main.
- version.txt: 0.6.2 -> 0.6.4 (matches the latest release tag)
- firmware-ci.yml: new `version-guard` job that runs on v*-esp32 tag
pushes and fails the run if the tag's X.Y.Z != version.txt, so a
future release can't ship a mislabeled binary.
Closes#505
Co-Authored-By: claude-flow <ruv@ruv.net>
version.txt → 0.6.2.
firmware-ci.yml: matrix-build both 8MB (sdkconfig.defaults) and 4MB
(sdkconfig.defaults.4mb) variants, uploading variant-named artifacts
(esp32-csi-node.bin / esp32-csi-node-4mb.bin, partition-table.bin /
partition-table-4mb.bin). Unblocks 6-binary releases from CI alone,
no local ESP-IDF required.
CHANGELOG: promote [Unreleased] ADR-081 work into [v0.6.2-esp32],
plus Fixed entries for Timer Svc stack overflow and the
fast_loop_cb → emit_feature_state implicit-decl compile error.
Validation: 30 s run on ESP32-S3 (MAC 3c:0f:02:e9:b5:f8), 149
rv_feature_state emissions, no stack overflow, HEALTH mesh packet sent.
Co-Authored-By: claude-flow <ruv@ruv.net>
- Container: espressif/idf:v5.2 → v5.4 (matches QEMU workflow)
- Replace xxd calls with od (xxd not available in IDF container)
- Add ota_data_initial.bin to artifact upload
- Extend artifact retention to 90 days
The xxd:not-found error was blocking all Firmware CI builds since the
container migration. This unblocks binary artifact generation for
release assets.
Closes#327
Co-Authored-By: claude-flow <ruv@ruv.net>
The espressif/idf container requires `. $IDF_PATH/export.sh` to put
idf.py on PATH. GitHub Actions container: runs with plain sh which
skips the container entrypoint. Also downgrade from v5.4 to v5.2
which matches our local Docker build environment.
Co-Authored-By: claude-flow <ruv@ruv.net>
rUv