berkus
/
wifi-densepose
mirror of https://github.com/ruvnet/wifi-densepose.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
wifi-densepose/docs/research/ruview-beyond-sota/02-beyond-sota-architecture.md

30 KiB
Raw Blame History

RuView Beyond-SOTA Target Architecture

Series: ruview-beyond-sota (02) Date: 2026-06-09 Status: Research design — components marked PROPOSED do not exist yet; everything else cites real code. Governing constraint: ADR-136 §2.1 explicitly rejects renaming/rewriting the workspace. This document designs an evolution of the existing 38-crate v2/ workspace (v2/Cargo.toml), not a new system. Every beyond-SOTA layer attaches to the ADR-136 Stage<I,O> / FrameMeta / CanonicalFrame contracts (docs/adr/ADR-136-ruview-streaming-engine-frame-contracts.md §2.2–2.5) and preserves the ADR-028 witness chain.

1. Where the system is today (grounding)

The ADR-136 ten-role pipeline (ingest → signal → fusion → world → models → privacy → store → api → eval → observe) is already mapped 1:1 onto existing crates (ADR-136 §2.1, normative table). The composition root exists: v2/crates/wifi-densepose-engine/src/lib.rs wires ADR-135..146 blocks into one StreamingEngine::process_cycle that emits a TrustedOutput carrying fusion QualityScore, privacy class, SemanticProvenance, RF-SLAM (RfSlam field), and a BLAKE3 witness: [u8; 32].

Key existing substrate this design builds on:

Substrate Path What it gives us
Frame contracts + witness v2/crates/wifi-densepose-core/src/types.rs (CsiFrame, CsiMetadata + calibration_id/model_id/model_version), ADR-136 ComplexSample/CanonicalFrame Deterministic LE bytes, BLAKE3 witness, provenance-append-only boundary rule
Six-stage signal pipeline v2/crates/wifi-densepose-signal/src/ruvsense/mod.rs (+22 modules incl. cir.rs, calibration.rs, tomography.rs, rf_slam.rs, fusion_quality.rs, array_coordinator.rs) CSI→CIR, baseline calibration, multistatic fusion, coherence gating
Fusion quality + evidence ADR-137; ruvsense/multistatic.rs, ruvsense/fusion_quality.rs, wifi-densepose-ruvector/src/viewpoint/fusion.rs QualityScore with EvidenceRef/ContradictionFlag, privacy demotion on contradiction
Digital twin v2/crates/wifi-densepose-worldgraph/src/lib.rs (typed StableDiGraph, mandatory SemanticProvenance) Persistent room/sensor/track/belief graph
World model bridge v2/crates/wifi-densepose-worldmodel/src/lib.rs (OccWorldBridge, TrajectoryPrior, ADR-147) Occupancy prediction priors into the Kalman tracker
NN + training v2/crates/wifi-densepose-train/src/{model.rs,rapid_adapt.rs,ablation.rs,proof.rs,eval.rs,ruview_metrics.rs}, wifi-densepose-nn Shared backbone + 2 heads, AdaptationLoss::ContrastiveTTT, ADR-145 ablation matrix, seeded proof harness
Swarm v2/crates/ruview-swarm/src/ (sensing/{multiview.rs,payload.rs,occworld_bridge.rs}, marl/, topology.rs) Raft/hierarchical-mesh drone coordination with CSI payload (ADR-148)
Edge WASM v2/crates/wifi-densepose-wasm-edge/src/lib.rs (WASM3 on ESP32-S3, on_frame host ABI), wifi-densepose-wasm Hot-loadable on-device sensing modules
Quantum-adjacent sim v2/crates/nvsim/src/lib.rs (deterministic NV-magnetometry forward pipeline, SHA-256 witness, WASM-ready) Honest classical-quantum hybrid substrate (ADR-089)
Semantic record + agents ADR-140 (wifi-densepose-sensing-server/src/semantic/), homecore-assist Provenance-bearing semantic states, Ruflo agent bridge

2. Target architecture diagram

The beyond-SOTA layers (★ = new/PROPOSED, ☆ = exists-but-not-wired) wrap the ADR-136 pipeline; nothing replaces it.

                            ╔═══════════════════ BEYOND-SOTA CONTROL PLANE ═══════════════════╗
                            ║  P6 Continual adaptation loop (TTT + EWC★)   P5 Swarm aperture   ║
                            ║  rapid_adapt.rs → encoder LoRA deltas        planner★ (Raft)     ║
                            ╚════════════▲══════════════════════▲══════════════▲══════════════╝
                                         │ adaptation deltas    │ quality      │ tasking
 [ingest]            [signal]            │      [fusion]        │  [world]     │        [models]
 ESP32/Pi mesh ─► RuvSensePipeline ──────┴──► fuse_scored ──────┴─► WorldGraph ┴──► RF Foundation
 + drone payload    multiband→phase_align     (ADR-137           (ADR-139      │    Encoder (P1)
 (ruview-swarm      →calibration(135)         QualityScore,      twin) ◄───────┘    7 heads + UQ
  sensing/payload)  →cir(134)→multistatic     EvidenceRef,         ▲  │             (ADR-146/150)
      │             →coherence→gate           Contradiction)       │  ▼                  │
      │                  │                        │            RF-SLAM(143)──OccWorld    │
      ▼                  ▼                        │            rf_slam.rs    worldmodel  ▼
 P7 WASM edge      P2 Differentiable RF           │            (P3 closed loop ☆)   P4 cross-modal
 inference★        forward model★                 │                                 distilled student★
 (wasm-edge,       (tomography.rs +               │                                 (camera-free deploy)
  deterministic    cir.rs ISTA as seed)           │
  replay)               │ residuals feed fusion as EvidenceRef★
      │                 ▼
      │            P8 NV-magnetometry fusion★ (nvsim forward model as a sensing node class)
      ▼
 ─────────────────────── ADR-136 CONTRACT SPINE (unchanged) ───────────────────────────────────
  CsiFrame{ComplexSample, FrameMeta{calibration_id, model_id, model_version}} → Stage<I,O>
  → CanonicalFrame::witness_hash() at EVERY stage boundary (BLAKE3, LE-deterministic)
 ───────────────────────────────────────────────────────────────────────────────────────────────
      │                    │                      │                  │
   [privacy]            [store]                [api]              [eval]            [observe]
   wifi-densepose-bfld  homecore-recorder     homecore-api       ADR-145 ablation   homecore-
   gate + demotion      + replay corpus★      /HA/Matter/HAP     (train/ablation.rs automation,
   (ADR-141)                                                      + P1-P8 variants)  Ruflo (ADR-140)

3. The eight pillars

Each pillar: what / why beyond-SOTA / builds-on / contract sketch / feasibility. All trait sketches are PROPOSED unless a path is cited.

P1 — RF Foundation Encoder with multitask uncertainty heads (ADR-146 + ADR-150)

What. One shared, self-supervised RF encoder (wifi-densepose-nn) with seven typed heads (pose, presence, count, activity, vitals, gait, identity-embedding), each emitting calibrated uncertainty via the ADR-136 QualityScored trait, trained with the ADR-150 pose-contrastive objective (same-pose-across-subjects = positive) plus a coherence head that exposes channel instability.

Why beyond SOTA. Published WiFi-pose systems (MultiFormer, GraphPose-Fi lineage) report in-domain accuracy and hallucinate under domain shift. ADR-150 documents the real measured frontier: 81.63% torso-PCK@20 in-domain on MM-Fi vs ~11.6% leakage-free cross-subject, and that DANN and bigger capacity both failed (ADR-150 §1). A foundation encoder whose loss stack explicitly separates pose / identity / room / device factors and emits an RF-integrity signal per prediction is not in the published literature as a deployed, auditable artifact. Target (not a claim): close the cross-subject gap materially while every head output carries confidence_bounds().

Builds on. v2/crates/wifi-densepose-train/src/model.rs (WiFiDensePoseModel, kp_head/dp_head); v2/crates/wifi-densepose-sensing-server/src/embedding.rs (ProjectionHead + LoRA + info_nce_loss — the existing seventh head, ADR-146 §1.1); v2/crates/wifi-densepose-train/src/rapid_adapt.rs (ContrastiveTTT precedent); ADR-146 §1.4 head fan-out; ADR-150 §2 loss stack.

Contract sketch (lands in wifi-densepose-nn, per ADR-146 §1.3):

pub trait RfEncoder: Send + Sync {
    fn encode(&self, window: &CsiWindowTensor) -> Embedding;        // z ∈ R^d_model
    fn model_id(&self) -> u16;                                       // FrameMeta binding (ADR-136 §2.2)
}
pub trait TaskHead<O: QualityScored>: Send + Sync {
    fn name(&self) -> &'static str;
    fn forward(&self, z: &Embedding) -> O;                           // value + uncertainty bounds
}
pub struct MultiTaskOutput { /* per-head QualityScored outputs + coherence: f32 */ }

Feasibility: HIGH for the architecture, MEDIUM for the headline result. The pure-Rust f32 ABI is proven (embedding.rs), the head taxonomy is specified (ADR-146), and the ablation harness to measure it exists (wifi-densepose-train/src/ablation.rs). The risk is scientific, not engineering: ADR-150's own data shows naive approaches fail; the pose-contrastive objective is plausible but unproven at scale. Mitigation: ADR-150 §3's frozen-decoder three-variant experiment gates promotion.

P2 — Physics-informed differentiable RF forward model (PROPOSED)

What. A differentiable forward model render(scene, link_geometry) -> predicted CSI/CIR used three ways: (1) as a regularizer in encoder training (predictions must be consistent with a Born-approximation scattering model), (2) as an analysis-by-synthesis residual at inference (|observed − rendered| becomes an ADR-137 EvidenceRef), (3) as a synthetic-data generator complementing MM-Fi (ADR-015).

Why beyond SOTA. Published WiFi sensing is almost entirely discriminative; physics-informed neural fields exist for vision (NeRF) and acoustics but no deployed RF-human-sensing stack closes the loop forward model → residual → fusion evidence → privacy decision. Making physics disagreement a first-class, witnessed contradiction flag is novel system design, not just a model.

Builds on. The codebase already contains the seed of the forward model: v2/crates/wifi-densepose-signal/src/ruvsense/tomography.rs (RfTomographer, LinkGeometry, OccupancyVolume — a linear shadowing forward model inverted by ISTA), ruvsense/cir.rs (sub-DFT sensing matrix Φ, ISTA L1 — ADR-134), ADR-143 §1.3 (bistatic excess-delay geometry, the exact ray equations), and nvsim as the in-repo precedent for a deterministic, witness-hashed forward physics pipeline (v2/crates/nvsim/src/{propagation.rs,pipeline.rs,proof.rs}).

Contract sketch (new module wifi-densepose-signal/src/ruvsense/forward_model.rs, PROPOSED):

pub trait RfForwardModel: Versioned {
    /// Predict per-link CSI given a voxel scene + body primitive set.
    fn render(&self, scene: &OccupancyVolume, links: &[LinkGeometry]) -> Vec<PredictedCsi>;
    /// Physics residual in [0,1]; 0 = perfectly Maxwell/Born-consistent.
    fn residual(&self, observed: &CsiFrame, rendered: &PredictedCsi) -> PhysicsResidual; // → EvidenceRef
}

Feasibility: MEDIUM, with one honest line drawn. A full Maxwell FDTD-in-the-loop solver is infeasible at 20 Hz on this hardware and is a non-goal (§6). What is feasible: a first-order Born / ray-tracing bistatic model (the ADR-143 spheroid geometry generalized), differentiable through finite differences or a small Candle graph, validated against recorded calibration captures (ADR-135 baselines give per-link empty-room ground truth for free). "Maxwell-consistent" should be read as "consistent with a stated first-order approximation, with the approximation order recorded in the witness metadata."

P3 — RF-SLAM × WorldGraph × OccWorld closed loop (exists in parts, wiring is the work)

What. Close the loop: RF-SLAM discovers reflectors/anchors → WorldGraph persists them as object_anchor nodes → OccWorld consumes graph occupancy → TrajectoryPriors feed the Kalman tracker → improved tracks refine SLAM association. The environment model becomes self-acquiring and self-correcting (furniture moved ⇒ BaselineTopologyChange ⇒ recalibration trigger, ADR-143 §1.4).

Why beyond SOTA. Published RF-SLAM work maps or tracks; no published consumer system maintains a persistent, provenance-bearing, privacy-rolled-up environmental digital twin (PrivacyRollup in wifi-densepose-worldgraph/src/graph.rs) that is simultaneously the SLAM map, the automation substrate, and the audit record. The differentiator is the closed loop with evidence edges (supports/contradicts).

Builds on. All three vertices exist: v2/crates/wifi-densepose-signal/src/ruvsense/rf_slam.rs (RfSlam::observe, line 176, already a field of StreamingEngine — wifi-densepose-engine/src/lib.rs:116); v2/crates/wifi-densepose-worldgraph/src/lib.rs; v2/crates/wifi-densepose-worldmodel/src/{bridge.rs,occupancy.rs} (worldgraph_to_occupancy, OccWorldBridge::predict). The engine already upserts SLAM output and person tracks into the graph. Missing: prior-injection back into ruvsense/pose_tracker.rs, and the topology-change → ADR-135 recalibration edge.

Contract sketch (extends existing types):

impl StreamingEngine {
    /// PROPOSED: inject OccWorld priors into the next tracker cycle.
    pub fn apply_trajectory_priors(&mut self, priors: &[TrajectoryPrior]) -> Vec<WorldId>;
}
// WorldEdge gains (PROPOSED): PredictedBy { model_id: u16 }  — prior provenance edge

Feasibility: HIGH. This is mostly integration glue between tested crates. The two real risks are already named by ADR-143: no ground-truth oracle in a live home (mitigated by the v1-fixed / v2-flagged rollout, #[cfg(feature = "rf-slam-v2")]), and OccWorld's Python subprocess (ADR-147: 375 ms/inference) being off the deterministic path — priors must be treated as advisory, never witness-bearing (§5).

P4 — Cross-modal distillation: camera-teacher → RF-student, privacy-preserving deployment (PROPOSED)

What. Train-time-only camera supervision: a vision pose teacher labels synchronized CSI (MM-Fi already provides paired modalities, ADR-015), distilling dense pose + uncertainty into the P1 encoder. Deployed systems ship no camera and no camera-derived identity features; the ADR-145 privacy-leakage metric (membership-inference score in wifi-densepose-train/src/ablation.rs) gates that the student does not retain identity.

Why beyond SOTA. Camera-supervised WiFi pose is the original DensePose-WiFi recipe; what is not published is distillation with a measured, CI-enforced privacy-leakage budget and a witnessed claim that the deployed artifact is camera-free. The beyond-SOTA move is making "privacy-preserving" a measured property of the release pipeline, not a marketing adjective.

Builds on. v2/crates/wifi-densepose-train/src/{trainer.rs,losses.rs,dataset.rs} (training substrate); ADR-015 paired datasets; ADR-145 FeatureSet matrix + privacy-leakage scalar; v2/crates/wifi-densepose-bfld (privacy_gate.rs, signature_hasher.rs — runtime identity controls, ADR-120 invariants I1–I3).

Contract sketch (in wifi-densepose-train, PROPOSED):

pub struct DistillationLoss { pub teacher: TeacherSource, pub temperature: f32, pub uq_transfer: bool }
pub enum TeacherSource { CachedPoseLabels(PathBuf), /* never a live camera in the serving graph */ }
/// Release gate: leakage(student) ≤ budget, asserted by the ADR-145 harness per variant.
pub struct PrivacyBudget { pub max_mia_score: f32 }

Feasibility: HIGH. All ingredients exist; the work is a loss term, a label cache format, and a CI gate. The honest caveat: MIA-based leakage scores are a lower bound on real leakage; the budget is a regression tripwire, not a formal guarantee.

P5 — Swarm-distributed multistatic sensing with Raft-coordinated apertures (ADR-148, partially built)

What. Treat the drone swarm + fixed ESP32 mesh as one reconfigurable multistatic aperture: a Raft-elected cluster head plans node positions/channel assignments to maximize geometric diversity (GDI) for the current sensing task; per-node frames flow into the same MultistaticFuser path as fixed nodes.

Why beyond SOTA. Published multistatic WiFi sensing assumes fixed geometry. Closed-loop aperture optimization — moving the sensors to where the Fisher information is — driven by the GDI/Cramér–Rao machinery that already exists in v2/crates/wifi-densepose-ruvector/src/viewpoint/geometry.rs (per CLAUDE.md module table: GeometricDiversityIndex, Cramér-Rao bounds) is a genuinely new system class for SAR/MAT scenarios.

Builds on. v2/crates/ruview-swarm/src/sensing/{multiview.rs,payload.rs,occworld_bridge.rs}, topology.rs, planning.rs, marl/ (MAPPO, candle_ppo.rs); ruvsense/multistatic.rs + array_coordinator.rs (ADR-138 clock-quality gating — moving nodes will stress exactly this); wifi-densepose-mat (the MAT use case).

Contract sketch (in ruview-swarm, PROPOSED):

pub trait AperturePlanner: Send + Sync {
    /// Given current twin + task, propose node placements maximizing expected GDI.
    fn plan(&self, twin: &WorldGraphSnapshot, task: &SwarmTask) -> Vec<(NodeId, Position3D)>;
}
// Output flows through Raft (topology.rs) as a normal SwarmTask; frames return as ArrayNodeInput.

Feasibility: MEDIUM. Coordination, MARL, and fusion code exist and are tested; the hard physical problems are honest unknowns: airborne CSI phase stability (rotor vibration), clock sync across mobile nodes (ADR-138 gate will reject a lot initially), and ADR-148 §1.3's own regulatory scoping. Simulation-first via ruview-swarm/src/evals.rs + bench_support.rs; hardware validation is Phase 3.

P6 — Continual / test-time adaptation with EWC-style forgetting control (PROPOSED on existing TTT)

What. Promote rapid_adapt.rs from a per-deployment trick to a managed continual-learning loop: TTT/entropy adaptation produces LoRA deltas on the P1 encoder; an EWC (elastic weight consolidation) penalty — which does not exist in the workspace today (no EWC match in wifi-densepose-train/src/rapid_adapt.rs) — anchors weights important to previously-validated environments; every adaptation step is versioned as a new model_version (u16, ADR-136 §2.2) and must re-pass the ADR-145 acceptance matrix before activation.

Why beyond SOTA. TTT papers adapt and hope; nothing published couples adaptation to a deterministic regression gate with witness hashes, where an adapted model that regresses tier or leaks identity is automatically rejected and the model_version provenance lets any semantic state be traced to the exact adaptation step.

Builds on. v2/crates/wifi-densepose-train/src/rapid_adapt.rs (AdaptationLoss::ContrastiveTTT, entropy-minimization variant — lines 8–16); LoRA adapters in sensing-server/src/embedding.rs (rank-4 lora_1/lora_2); ADR-027 MERIDIAN evaluator (train/src/eval.rs); ADR-146 §2 calibration-robustness loss.

Contract sketch (in wifi-densepose-train, PROPOSED):

pub struct EwcPenalty { pub fisher_diag: Vec<f32>, pub anchor: Vec<f32>, pub lambda: f32 }
pub struct AdaptationStep {
    pub parent_model_version: u16, pub new_model_version: u16,
    pub loss: AdaptationLoss, pub ewc: Option<EwcPenalty>,
    pub acceptance: RuViewAcceptanceResult,           // must be ≥ parent tier
    pub witness: [u8; 32],                            // hash of delta + acceptance
}

Feasibility: HIGH. EWC over a small LoRA delta is cheap (Fisher diagonal over the replay corpus); the acceptance gate and proof seeds exist (proof.rs, PROOF_SEED = 42). Risk: online Fisher estimation from unlabeled home data is noisy — start with adaptation restricted to LoRA parameters only, backbone frozen.

P7 — On-device WASM edge inference with deterministic replay (extends existing Tier-3)

What. Push P1 head subsets (presence, vitals, coarse activity) into hot-loadable WASM modules on ESP32-S3, and onto browsers/workers via wifi-densepose-wasm. Every edge module's output is replayable: the same CanonicalFrame input bytes through the same module hash produce the same output bytes, verified in CI on x86_64/aarch64/wasm32.

Why beyond SOTA. Edge WiFi-sensing exists; bit-deterministic, witness-hashed edge inference with hot-swap and replay parity against the server pipeline does not appear in published systems. It turns the edge from a trust hole into a witness-chain extension.

Builds on. v2/crates/wifi-densepose-wasm-edge/src/lib.rs (WASM3 host ABI: csi_get_*, on_frame at ~20 Hz, ADR-040 Tier 3); nvsim as the proof that a no-std-time, no-OS-entropy, seeded-PRNG crate runs identically on wasm32 (nvsim/src/lib.rs doc); ADR-136 AC7 cross-architecture byte-stability test.

Contract sketch (PROPOSED additions to the wasm-edge host ABI):

// exports added to module lifecycle:
//   on_replay_begin(seed: u64)              — pins any module-internal PRNG
//   witness_digest(buf_ptr: i32) -> i32     — module returns BLAKE3 of its output stream
pub trait EdgeStage: Stage<CsiFrameView, EdgeEvent> { fn module_hash(&self) -> [u8; 32]; }

Feasibility: HIGH for presence/vitals heads, LOW for full pose on-ESP32. WASM3 interpretation on Xtensa caps throughput; full 7-head inference stays on Pi/Hailo/browser. Float determinism across native vs WASM needs care (no fast-math, fixed reduction order — same obligation ADR-136 §3.2 already accepts).

P8 — NV-magnetometry fusion: an honest classical-quantum hybrid (PROPOSED, simulation-first)

What. Add nvsim-modeled NV-magnetometer nodes as a fourth sensing modality class (after CSI, mmWave/ADR-021, BFLD) in the multistatic fusion: near-range (≤ tens of cm, per the physics review) cardiac/respiratory magnetic signatures fused with CSI/mmWave vitals under the ADR-137 evidence contract. Simulation-first: the modality lands end-to-end against nvsim before any hardware exists.

Why beyond SOTA. Not range — the Ghost Murmur review (docs/research/quantum-sensing/16-ghost-murmur-ruview-spec.md) documents why multi-mile cardiac magnetometry contradicts published physics, and this design adopts that conclusion. The beyond-SOTA element is architectural honesty: a fusion engine that can ingest a quantum-sensor modality with explicit, witnessed physics bounds (nvsim's forward model states its approximations and hashes its output, nvsim/src/proof.rs), so that when real NV hardware matures, the integration path and the anti-hype guardrails already exist. No published consumer sensing stack has this.

Builds on. v2/crates/nvsim/src/ (scene→source→attenuation→NV ensemble→digitiser, SHA-256 witness, ADR-089); nvsim-server; wifi-densepose-vitals (mmWave HR/BR — the modality NV would cross-validate); ruvsense/multistatic.rs fusion + ADR-137 EvidenceRef.

Contract sketch (PROPOSED): a SensorModality::NvMagnetometer variant on the existing wifi-densepose-worldgraph SensorModality enum, plus an ArrayNodeInput adapter from nvsim frames; vitals agreement/disagreement between NV and mmWave becomes an EvidenceRef/ContradictionFlag pair.

Feasibility: HIGH in simulation, SPECULATIVE on hardware. The sim path is days of glue; COTS NV magnetometers with the required sensitivity at consumer cost do not exist in 2026. This pillar's deliverable is the contract and the simulated validation, explicitly labeled as such.

4. Phased implementation plan

Phases are gated by the Pre-Merge Checklist (CLAUDE.md) and the witness chain (§5). Crate names per the ADR-136 §2.1 normative map — no new ruview_* crates except where a crate already exists (ruview-swarm).

Phase 0 — Hardening (close the ADR-136 "integration glue" debt).

  • wifi-densepose-signal: wire the full 600-frame Stage-chain replay (ADR-136 AC6) and register streaming_engine_replay_v1 in archive/v1/data/proof/expected_features.sha256.
  • CI: cross-architecture witness matrix x86_64/aarch64 (AC7); add wasm32 lane for nvsim + wifi-densepose-wasm.
  • wifi-densepose-engine: populate FrameMeta.calibration_id/model_id from the live calibration and model-binding stages (currently defaulted — ADR-136 §8).
  • homecore-recorder: define the replay corpus format (canonical-bytes frame streams + witness manifest) that P4/P6 training and all ablations consume.

Phase 1 — Encoder + measurement (P1, P4 groundwork, P6 skeleton).

  • wifi-densepose-nn: RfEncoder/TaskHead traits, seven-head fan-out, UQ layer (ADR-146); relocate ProjectionHead from sensing-server/src/embedding.rs.
  • wifi-densepose-train: ContrastiveBatcher, ADR-150 loss stack, distillation loss + cached-teacher format (P4), EwcPenalty + AdaptationStep (P6); extend ablation.rs FeatureSet with per-head and per-pillar variants; pin expected_ablation_*.sha256.
  • Run the ADR-150 three-variant frozen-decoder experiment; promotion gate on cross-subject delta.

Phase 2 — Closed loop + edge (P3, P7).

  • wifi-densepose-engine: apply_trajectory_priors (OccWorld → pose_tracker.rs); PredictedBy provenance edge in wifi-densepose-worldgraph; topology-change → ADR-135 recalibration trigger.
  • wifi-densepose-wasm-edge: replay ABI (on_replay_begin, witness_digest), presence/vitals head modules; parity test vs server pipeline on identical canonical bytes.
  • Enable rf-slam-v2 feature on the 7-day validation dataset (ADR-143 gate).

Phase 3 — Frontier (P2, P5, P8).

  • wifi-densepose-signal/src/ruvsense/forward_model.rs: Born/ray forward model seeded from tomography.rs; PhysicsResidual → EvidenceRef; synthetic-data generator into train/src/dataset.rs.
  • ruview-swarm: AperturePlanner over GDI (ruvector/src/viewpoint/geometry.rs); simulation evals in evals.rs; airborne CSI stability study before any hardware claim.
  • nvsim ↔ wifi-densepose-engine: SensorModality::NvMagnetometer adapter, simulated NV+mmWave vitals cross-validation in the ablation matrix.

5. Determinism & witness-chain preservation

The non-negotiable invariant (ADR-136 §2.5–2.6, ADR-028): replaying recorded canonical bytes through the pipeline twice yields byte-identical outputs and equal BLAKE3 witness hashes. Strategy per component class:

  1. Everything on the trust path implements CanonicalFrame. New frame types (MultiTaskOutput, PhysicsResidual, AdaptationStep, edge events, NV frames) get fixed-field-order LE encodings and witness_hash(); encoders are the only serializers (no ad-hoc serde on the witness path).
  2. Inference is witnessed by (input hash, model hash, output hash). model_id/model_version on FrameMeta already bind frames to models; P1 adds a weights digest so the triple is closed. Pure-Rust f32 inference (ADR-146 ABI) with fixed reduction order; no GPU nondeterminism on the witness path — GPU/libtorch is training-only, and training determinism is pinned by the existing seeds (proof.rs: PROOF_SEED = 42, MODEL_SEED = 0).
  3. Advisory vs witnessed split. Components that cannot be made deterministic — the OccWorld Python subprocess (ADR-147), live MARL exploration, any future LLM/agent output (ADR-140 Ruflo) — are advisory: their outputs may bias estimates but never enter to_canonical_bytes() directly; instead the decision to use them is recorded (prior id + content hash) so replay reproduces the decision even if the producer cannot be re-run. The Kalman tracker consumes priors as explicit inputs recorded in the replay corpus.
  4. Adaptation is a chain of witnessed steps. P6's AdaptationStep.witness hashes (parent version ‖ delta ‖ acceptance result); the active model at any timestamp is reconstructible from the step chain — the model-weights analogue of the frame witness chain.
  5. Edge parity. P7 modules must produce the same witness_digest as the server-side reference implementation on the AC6 fixture; the module hash joins the firmware source-hashes.txt in the ADR-028 witness bundle.
  6. Witness bundle growth is mechanical. Each pillar adds expected-hash keys (forward_model_residual_v1, edge_presence_replay_v1, nvsim already ships proof.rs) to the existing verify.py chain rather than inventing new verification mechanisms.

6. Explicit non-goals

  • No workspace rename or rewrite. Reaffirms ADR-136 §2.1/§4.1: no ruview_* crate prefix migration, no umbrella crate; pillars land inside the existing crates listed above.
  • No full-wave Maxwell solver in the runtime loop. P2 is first-order Born/ray, with the approximation order declared. "Physics-informed" never means FDTD at 20 Hz.
  • No long-range cardiac magnetometry claims. P8 is bounded by the physics review in docs/research/quantum-sensing/16-ghost-murmur-ruview-spec.md; ranges beyond published MCG physics are out of scope permanently, not just deferred.
  • No camera in any deployed serving graph (P4 teachers are train-time, cached-label only) and no identity recognition as a product feature — identity embeddings remain in-RAM, hash-rotated (ADR-120 invariants).
  • No weaponization or LAWS capability in P5, per ADR-148 §1.3; swarm work targets SAR/MAT and stays behind the ADR-148 regulatory gates.
  • No fabricated benchmarks. All pillar performance statements in this document are targets; promotion of any pillar requires the ADR-145 ablation matrix delta plus pinned determinism hashes, in CI, before any external claim.
  • No new verification mechanisms. The witness chain extends verify.py / BLAKE3 / expected_*.sha256; we do not introduce a second, parallel proof system.

7. Open questions for the next document in this series

  1. Airborne CSI phase stability (P5): what does the ADR-138 clock-quality gate measure on a real quadrotor payload?
  2. Forward-model fidelity floor (P2): what Born-residual magnitude on the ADR-135 empty-room captures is "good enough" to be a useful contradiction signal?
  3. Replay-corpus governance (Phase 0): retention, privacy class of recorded canonical bytes, and consent — the recorder stores signal evidence, which is itself sensitive.