## Security audit (`mqtt::security`) New module enforcing the ADR-115 §3.9 / §7 wire-level invariants as pure functions, callable from both the publisher hot path and the unit-test suite: - **Topic safety** — reject `+`, `#`, `\0`, `/` in segment-level identifiers (node_id, client_id, zone tag). Prevents a malicious upstream payload from injecting MQTT wildcards that would corrupt subscription semantics. - **Path safety** — reject NUL / newline in TLS cert / CA paths. - **Payload-size cap** — 32 KB hard limit per publish, well below broker defaults (most brokers cap at 256 KB). Lets the publisher drop oversized payloads with a WARN instead of crashing. - **Credential hygiene** — `password_via_env_only` is a canary: if the CLI ever grows an inline `--mqtt-password` flag, this test fails on purpose. Today we only accept `--mqtt-password-env <VAR>`. - **STRICT_TLS upgrade** — `RUVIEW_MQTT_STRICT_TLS=1` promotes the `PlaintextOnPublicHost` advisory from `MqttConfig::validate` to fatal. This is the planned v0.8.0 default per ADR §9.5. - **Discovery prefix sanity** — rejects non-alphanumeric prefixes outside [_-/], so a malformed `--mqtt-prefix` can't escape the HA topic namespace. 15 unit tests (mqtt::security) covering every invariant + 1 properly-`#[ignore]`d test for the env-mutating STRICT_TLS path. ## Criterion benchmarks (`benches/mqtt_throughput.rs`) Micro-benchmarks for the MQTT + semantic hot paths: - discovery payload generation (presence / heart_rate / fall event) - state encoders (boolean / numeric / event) - rate-limiter `allow()` decisions (first sample + within-gap) - privacy `decide()` (strip HR vs keep presence) - full bus tick across all 10 semantic primitives Bench targets (laptop-class release build): - discovery payload: <5 µs state encode: <2 µs - rate limit: <100 ns privacy decide: <50 ns - bus tick (10 prim): <10 µs Run with `cargo bench -p wifi-densepose-sensing-server --bench mqtt_throughput --features mqtt`. Numbers will be captured into the witness bundle in P10. `criterion` 0.5 added as dev-dep. `[[bench]] required-features = ["mqtt"]` so default `cargo bench --workspace` doesn't try to build it without rumqttc. Lib test count: **372 passed** (357 → 372, +15 security tests). Refs #776. Co-Authored-By: claude-flow <ruv@ruv.net> |
||
|---|---|---|
| .. | ||
| benches | ||
| src | ||
| tests | ||
| Cargo.toml | ||
| README.md | ||
README.md
wifi-densepose-sensing-server
Lightweight Axum server for real-time WiFi sensing with RuVector signal processing.
Overview
wifi-densepose-sensing-server is the operational backend for WiFi-DensePose. It receives raw CSI
frames from ESP32 hardware over UDP, runs them through the RuVector-powered signal processing
pipeline, and broadcasts processed sensing updates to browser clients via WebSocket. A built-in
static file server hosts the sensing UI on the same port.
The crate ships both a library (wifi_densepose_sensing_server) exposing the training and inference
modules, and a binary (sensing-server) that starts the full server stack.
Integrates wifi-densepose-wifiscan for multi-BSSID WiFi scanning per ADR-022 Phase 3.
Features
- UDP CSI ingestion -- Receives ESP32 CSI frames on port 5005 and parses them into the internal
CsiFramerepresentation. - Vital sign detection -- Pure-Rust FFT-based breathing rate (0.1--0.5 Hz) and heart rate (0.67--2.0 Hz) estimation from CSI amplitude time series (ADR-021).
- RVF container -- Standalone binary container format for packaging model weights, metadata, and
configuration into a single
.rvffile with 64-byte aligned segments. - RVF pipeline -- Progressive model loading with streaming segment decoding.
- Graph Transformer -- Cross-attention bottleneck between antenna-space CSI features and the
COCO 17-keypoint body graph, followed by GCN message passing (ADR-023 Phase 2). Pure
std, no ML dependencies. - SONA adaptation -- LoRA + EWC++ online adaptation for environment drift without catastrophic forgetting (ADR-023 Phase 5).
- Contrastive CSI embeddings -- Self-supervised SimCLR-style pretraining with InfoNCE loss, projection head, fingerprint indexing, and cross-modal pose alignment (ADR-024).
- Sparse inference -- Activation profiling, sparse matrix-vector multiply, INT8/FP16 quantization, and a full sparse inference engine for edge deployment (ADR-023 Phase 6).
- Dataset pipeline -- Training dataset loading and batching.
- Multi-BSSID scanning -- Windows
netshintegration for BSSID discovery viawifi-densepose-wifiscan(ADR-022). - WebSocket broadcast -- Real-time sensing updates pushed to all connected clients at
ws://localhost:8765/ws/sensing. - Static file serving -- Hosts the sensing UI on port 8080 with CORS headers.
Modules
| Module | Description |
|---|---|
vital_signs |
Breathing and heart rate extraction via FFT spectral analysis |
rvf_container |
RVF binary format builder and reader |
rvf_pipeline |
Progressive model loading from RVF containers |
graph_transformer |
Graph Transformer + GCN for CSI-to-pose estimation |
trainer |
Training loop orchestration |
dataset |
Training data loading and batching |
sona |
LoRA adapters and EWC++ continual learning |
sparse_inference |
Neuron profiling, sparse matmul, INT8/FP16 quantization |
embedding |
Contrastive CSI embedding model and fingerprint index |
Quick Start
# Build the server
cargo build -p wifi-densepose-sensing-server
# Run with default settings (HTTP :8080, UDP :5005, WS :8765)
cargo run -p wifi-densepose-sensing-server
# Run with custom ports
cargo run -p wifi-densepose-sensing-server -- \
--http-port 9000 \
--udp-port 5005 \
--static-dir ./ui
Using as a library
use wifi_densepose_sensing_server::vital_signs::VitalSignDetector;
// Create a detector with 20 Hz sample rate
let mut detector = VitalSignDetector::new(20.0);
// Feed CSI amplitude samples
for amplitude in csi_amplitudes.iter() {
detector.push_sample(*amplitude);
}
// Extract vital signs
if let Some(vitals) = detector.detect() {
println!("Breathing: {:.1} BPM", vitals.breathing_rate_bpm);
println!("Heart rate: {:.0} BPM", vitals.heart_rate_bpm);
}
Architecture
ESP32 ──UDP:5005──> [ CSI Receiver ]
|
[ Signal Pipeline ]
(vital_signs, graph_transformer, sona)
|
[ WebSocket Broadcast ]
|
Browser <──WS:8765── [ Axum Server :8080 ] ──> Static UI files
Related Crates
| Crate | Role |
|---|---|
wifi-densepose-wifiscan |
Multi-BSSID WiFi scanning (ADR-022) |
wifi-densepose-core |
Shared types and traits |
wifi-densepose-signal |
CSI signal processing algorithms |
wifi-densepose-hardware |
ESP32 hardware interfaces |
wifi-densepose-wasm |
Browser WASM bindings for the sensing UI |
wifi-densepose-train |
Full training pipeline with ruvector |
wifi-densepose-mat |
Disaster detection module |
License
MIT OR Apache-2.0