255 lines
8.9 KiB
Rust
255 lines
8.9 KiB
Rust
//! Acceptance tests for `BfldPipeline::process_to_frame`. ADR-118 §2.1 wire-bytes path.
|
|
|
|
#![cfg(feature = "std")]
|
|
|
|
use wifi_densepose_bfld::coherence_gate::DEBOUNCE_NS;
|
|
use wifi_densepose_bfld::{
|
|
BfldConfig, BfldFrame, BfldFrameHeader, BfldPayload, BfldPipeline, IdentityEmbedding,
|
|
PrivacyClass, SensingInputs, EMBEDDING_DIM,
|
|
};
|
|
|
|
fn inputs(timestamp_ns: u64, risk: [f32; 4]) -> SensingInputs {
|
|
let [sep, stab, consist, risk_conf] = risk;
|
|
SensingInputs {
|
|
timestamp_ns,
|
|
presence: true,
|
|
motion: 0.4,
|
|
person_count: 1,
|
|
sensing_confidence: 0.9,
|
|
sep,
|
|
stab,
|
|
consist,
|
|
risk_conf,
|
|
rf_signature_hash: None,
|
|
}
|
|
}
|
|
|
|
fn embedding() -> IdentityEmbedding {
|
|
IdentityEmbedding::from_raw([0.05; EMBEDDING_DIM])
|
|
}
|
|
|
|
fn header_template() -> BfldFrameHeader {
|
|
let mut h = BfldFrameHeader::empty();
|
|
h.ap_hash = [0xA1; 16];
|
|
h.sta_hash = [0xA2; 16];
|
|
h.session_id = [0xA3; 16];
|
|
h.channel = 36;
|
|
h.bandwidth_mhz = 80;
|
|
h.n_subcarriers = 234;
|
|
h.n_tx = 2;
|
|
h.n_rx = 2;
|
|
h
|
|
}
|
|
|
|
fn typed_payload() -> BfldPayload {
|
|
BfldPayload {
|
|
compressed_angle_matrix: vec![0x11; 32],
|
|
amplitude_proxy: vec![0x22; 16],
|
|
phase_proxy: vec![0x33; 16],
|
|
snr_vector: vec![0x44; 8],
|
|
csi_delta: None,
|
|
vendor_extension: vec![],
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_emits_frame_under_low_risk() {
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(1_700_000_000_000_000_000, [0.2, 0.2, 0.2, 0.2]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.expect("low-risk frame must be emitted");
|
|
assert_eq!({ frame.header.timestamp_ns }, 1_700_000_000_000_000_000);
|
|
assert_eq!({ frame.header.privacy_class }, PrivacyClass::Anonymous.as_u8());
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_returns_none_under_sustained_high_risk() {
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
// Push gate into Reject via two consecutive high-risk evaluations.
|
|
let _ = p.process_to_frame(
|
|
inputs(0, [1.0, 1.0, 1.0, 0.8]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
);
|
|
let after = p.process_to_frame(
|
|
inputs(DEBOUNCE_NS, [1.0, 1.0, 1.0, 0.8]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
);
|
|
assert!(after.is_none(), "Reject gate must drop the frame");
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_round_trips_through_bytes() {
|
|
// Default pipeline class is Anonymous(2). The frame must round-trip through
|
|
// wire bytes with no CRC error; the payload it carries is the privacy-gated
|
|
// (angle-matrix-stripped) form, not the raw input — see
|
|
// process_to_frame_at_anonymous_strips_identity_leaky_sections for the
|
|
// content assertion. This test pins byte/CRC consistency only.
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(1_700_000_000_000_000_000, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.unwrap();
|
|
let bytes = frame.to_bytes();
|
|
let parsed = BfldFrame::from_bytes(&bytes).expect("frame must round-trip");
|
|
let parsed_payload = parsed.parse_payload().expect("payload must round-trip");
|
|
// Round-trip preserves whatever the privacy gate left in place.
|
|
assert_eq!(parsed_payload, frame.parse_payload().unwrap());
|
|
// And the identity surface is gone at Anonymous.
|
|
assert!(parsed_payload.compressed_angle_matrix.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_overrides_class_in_privacy_mode() {
|
|
let mut p = BfldPipeline::new(
|
|
BfldConfig::new("seed-01").with_privacy_class(PrivacyClass::Anonymous),
|
|
);
|
|
p.enable_privacy_mode();
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(0, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.unwrap();
|
|
assert_eq!(
|
|
{ frame.header.privacy_class },
|
|
PrivacyClass::Restricted.as_u8(),
|
|
"privacy_mode must override into the frame header byte too",
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_preserves_header_template_identity_fields() {
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(0, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.unwrap();
|
|
assert_eq!(frame.header.ap_hash, [0xA1; 16]);
|
|
assert_eq!(frame.header.sta_hash, [0xA2; 16]);
|
|
assert_eq!(frame.header.session_id, [0xA3; 16]);
|
|
assert_eq!({ frame.header.channel }, 36);
|
|
}
|
|
|
|
// --- ADR-141 privacy-gate-correctness regression -------------------------
|
|
//
|
|
// `process_to_frame` stamps the frame with the pipeline's privacy_class but
|
|
// (pre-fix) serialized the caller-supplied payload UNCHANGED. That let a frame
|
|
// labeled Anonymous(2) / Restricted(3) carry the full identity-leaky
|
|
// `compressed_angle_matrix` (+ amplitude/phase/csi_delta) that
|
|
// `PrivacyGate::demote` is documented (privacy_gate_demote.rs) to strip at
|
|
// exactly those classes. A NetworkSink accepts class >= Derived, so such a
|
|
// frame would publish the beamforming angle matrix (identity surface) to the
|
|
// network despite its restrictive class byte. These tests pin that the payload
|
|
// content matches what the stamped class permits.
|
|
|
|
#[test]
|
|
fn process_to_frame_at_anonymous_strips_identity_leaky_sections() {
|
|
// Default pipeline class is Anonymous(2): the angle matrix and csi_delta
|
|
// MUST NOT survive into the emitted frame, matching PrivacyGate::demote.
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
let mut leaky = typed_payload();
|
|
leaky.csi_delta = Some(vec![0x55; 24]);
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(1_700_000_000_000_000_000, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
leaky,
|
|
Some(embedding()),
|
|
)
|
|
.expect("low-risk frame must be emitted");
|
|
assert_eq!({ frame.header.privacy_class }, PrivacyClass::Anonymous.as_u8());
|
|
let payload = frame.parse_payload().expect("payload parses");
|
|
assert!(
|
|
payload.compressed_angle_matrix.is_empty(),
|
|
"Anonymous frame must NOT carry the compressed_angle_matrix (identity surface)",
|
|
);
|
|
assert!(
|
|
payload.csi_delta.is_none(),
|
|
"Anonymous frame must NOT carry csi_delta",
|
|
);
|
|
// Aggregate sensing sections survive.
|
|
assert_eq!(payload.snr_vector.len(), 8);
|
|
assert_eq!(payload.amplitude_proxy.len(), 16);
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_in_privacy_mode_strips_amplitude_and_phase() {
|
|
// privacy_mode -> Restricted(3): amplitude + phase proxies must ALSO drop.
|
|
let mut p = BfldPipeline::new(
|
|
BfldConfig::new("seed-01").with_privacy_class(PrivacyClass::Anonymous),
|
|
);
|
|
p.enable_privacy_mode();
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(0, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.expect("frame emitted");
|
|
assert_eq!({ frame.header.privacy_class }, PrivacyClass::Restricted.as_u8());
|
|
let payload = frame.parse_payload().expect("payload parses");
|
|
assert!(payload.compressed_angle_matrix.is_empty(), "angle matrix stripped at Restricted");
|
|
assert!(payload.amplitude_proxy.is_empty(), "amplitude stripped at Restricted");
|
|
assert!(payload.phase_proxy.is_empty(), "phase stripped at Restricted");
|
|
assert_eq!(payload.snr_vector.len(), 8, "snr_vector survives");
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_at_derived_preserves_full_payload() {
|
|
// Derived(1) is a research mode that legitimately keeps the angle matrix.
|
|
// The strip must NOT over-fire at classes below Anonymous.
|
|
let mut p = BfldPipeline::new(
|
|
BfldConfig::new("seed-01").with_privacy_class(PrivacyClass::Derived),
|
|
);
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(0, [0.1, 0.1, 0.1, 0.1]),
|
|
header_template(),
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.expect("frame emitted");
|
|
assert_eq!({ frame.header.privacy_class }, PrivacyClass::Derived.as_u8());
|
|
let payload = frame.parse_payload().expect("payload parses");
|
|
assert_eq!(
|
|
payload, typed_payload(),
|
|
"Derived research frame keeps the full payload unchanged",
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn process_to_frame_uses_input_timestamp_not_template_timestamp() {
|
|
let mut p = BfldPipeline::new(BfldConfig::new("seed-01"));
|
|
let mut tmpl = header_template();
|
|
tmpl.timestamp_ns = 12345; // sentinel that must be overridden
|
|
let frame = p
|
|
.process_to_frame(
|
|
inputs(9_999_999_999_999_999, [0.1, 0.1, 0.1, 0.1]),
|
|
tmpl,
|
|
typed_payload(),
|
|
Some(embedding()),
|
|
)
|
|
.unwrap();
|
|
assert_eq!({ frame.header.timestamp_ns }, 9_999_999_999_999_999);
|
|
}
|