ruvnet/RuView v1316

Release v1316

on GitHub

Automated release from CI pipeline

Changes:
feat(adr-118): BFLD — Beamforming Feedback Layer for Detection (#789)

• feat(adr-118/p1.4): BfldFrame (header + payload + CRC32) — 24/24 GREEN

Iter 4. Lands the central wire-format primitive: complete frames with
header + arbitrary-length payload, protected by CRC-32/ISO-HDLC.

Added:

• crc = "3" dependency (CRC-32/ISO-HDLC, same poly as Ethernet / zlib)
• src/frame.rs: CRC32_ALG const and crc32_of_payload(&[u8]) -> u32
• src/frame.rs: BfldFrame { header, payload: Vec } (gated on std)
  • BfldFrame::new(header, payload) — auto-syncs payload_len + payload_crc32
  • BfldFrame::to_bytes() -> Vec — header LE bytes ‖ payload
  • BfldFrame::from_bytes(&[u8]) -> Result<Self, BfldError>
• BfldError::TruncatedFrame { got, need } variant
• Doc strings on BfldError::Crc and BfldError::PrivacyViolation field names
• tests/frame_roundtrip.rs (7 named tests, gated on feature = "std"):
  frame_roundtrip_preserves_header_and_payload
  frame_new_syncs_payload_len_and_crc
  frame_serialization_is_deterministic
  frame_rejects_payload_crc_mismatch
  frame_rejects_truncated_buffer_smaller_than_header
  frame_rejects_truncated_buffer_smaller_than_payload
  empty_payload_is_valid (CRC of empty payload is 0x00000000)

Test config:

• cargo test --no-default-features → 17 passed (frame_roundtrip cfg-out)
• cargo test (default features = std) → 24 passed (3+6+7+8)

ADR-119 ACs progressed:

• AC4 partial: bad-magic + bad-version + CRC-mismatch + truncation rejected
  with typed errors; field-level masking lives in the privacy_gate iter.
• AC5: BfldFrame round-trip preserves header + payload + CRC.
• AC6: Identical inputs produce bit-identical bytes (asserted explicitly).

Out of scope (next iter):

• Payload section parser (compressed_angle_matrix, amplitude_proxy, ...)
  — only the byte buffer is opaque so far; sections need length prefixes.
• BfldFrameRef<'_> for ESP32-S3 self-only mode (no-alloc, ADR-123 §2.5).
• PrivacyGate::demote(frame, target_class) transformer (ADR-120 §2.4).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p1.5): payload section parser (BfldPayload) — 32/32 GREEN

Iter 5. Implements ADR-119 §2.2 payload layout: 4-byte LE length prefix
followed by section bytes, in this fixed order:

compressed_angle_matrix ‖ amplitude_proxy ‖ phase_proxy ‖ snr_vector
‖ csi_delta (iff flags.bit0)
‖ vendor_extension (length 0 allowed)

Added:

• src/payload.rs (gated on feature = "std"):
  • BfldPayload struct with 6 fields (csi_delta: Option<Vec>)
  • SECTION_PREFIX_LEN const (= 4)
  • to_bytes(include_csi_delta: bool) -> Vec
  • wire_len(include_csi_delta: bool) -> usize (predictive, no allocation)
  • from_bytes(&[u8], expect_csi_delta: bool) -> Result<Self, BfldError>
  • push_section / read_section helpers (private)
• BfldError::MalformedSection { offset, reason } variant
• pub use BfldPayload from lib.rs (cfg-gated mirror of BfldFrame)

tests/payload_sections.rs (8 named tests, all green):
payload_roundtrip_with_csi_delta
payload_roundtrip_without_csi_delta
wire_len_matches_to_bytes_length
empty_payload_has_five_zero_length_sections
parser_rejects_buffer_shorter_than_first_length_prefix
parser_rejects_section_body_running_past_buffer_end
parser_rejects_trailing_bytes_after_vendor_extension
csi_delta_flag_mismatch_with_payload_is_detectable_via_trailing_bytes

ACs progressed:

• AC5 ↑ — full section-level round-trip preservation (round-trip with and
  without csi_delta both pass).
• AC6 ↑ — deterministic section encoding (length prefixes use to_le_bytes,
  body is byte-stable).
• AC1 partial — section layout now parses with bounded errors; CBFR-specific
  parsing (Phi/Psi Givens decoders) is a separate iter inside extractor.rs.

Test config:

• cargo test --no-default-features → 17 passed (payload module cfg-out)
• cargo test → 32 passed (3 + 6 + 7 + 8 + 8)

Out of scope (next iter target):

• Wire integration: feed BfldPayload bytes through BfldFrame::new so the
  header.payload_crc32 covers the section-prefixed bytes per ADR-119 §2.2
  ("CRC32 covers all section bytes including length prefixes").
• A no_std-friendly BfldPayloadRef<'_> borrowing variant (ESP32-S3 path).
• Givens-rotation angle decoder (Phi/Psi extraction from compressed_angle_matrix).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p1.6): BfldFrame <-> BfldPayload wire integration (39/39 GREEN)

Iter 6. Connects the typed payload parser (iter 5) to the framed
wire format (iter 4): the CRC32 now covers the section-prefixed
payload bytes per ADR-119 §2.2 ("CRC32 covers all section bytes
including length prefixes").

Added:

• BfldFrame::from_payload(header, &BfldPayload) -> Self
  Auto-syncs header.flags HAS_CSI_DELTA bit from payload.csi_delta.is_some(),
  serializes payload via to_bytes(), feeds BfldFrame::new() which computes
  payload_len + payload_crc32 over the section-prefixed bytes.
• BfldFrame::parse_payload(&self) -> Result<BfldPayload, BfldError>
  Reads HAS_CSI_DELTA bit from header.flags and dispatches to
  BfldPayload::from_bytes(&self.payload, expect_csi_delta).

tests/frame_payload_integration.rs (7 named tests, all green):
from_payload_then_parse_payload_is_identity
from_payload_autosets_has_csi_delta_flag
from_payload_clears_has_csi_delta_flag_when_csi_absent
(verifies the flag is cleared when csi_delta is None even if caller
pre-set the bit; other flag bits like PRIVACY_MODE are preserved)
frame_crc_covers_section_prefixed_bytes
(mutating a byte inside section body trips CRC, not magic/length)
frame_crc_covers_section_length_prefixes
(mutating a section length-prefix byte trips CRC before parser ever runs)
empty_typed_payload_roundtrips
end_to_end_wire_roundtrip_via_bytes
(BfldPayload -> from_payload -> to_bytes -> from_bytes -> parse_payload
is the identity function modulo flag auto-set)

ACs progressed:

• AC5 ↑ — full payload round-trip through the framed bytes (closes
  the round-trip leg from BfldPayload through wire and back).
• AC6 ↑ — same input produces same bytes through both layers.
• AC4 ↑ — CRC mismatch on tampered section bodies and tampered section
  length prefixes both surface as BfldError::Crc, not as silent acceptance
  or as a deeper parser error.

Test config:

• cargo test --no-default-features → 17 passed (integration tests cfg-out)
• cargo test → 39 passed (3 + 6 + 7 + 8 + 8 + 7)

Out of scope (next iter target):

• PrivacyGate::demote(frame, target_class) — ADR-120 §2.4 class transition
  transformer with subtle::Zeroize on dropped fields.
• IdentityEmbedding newtype with no Serialize impl (ADR-120 §2.5 / I2).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p2.1): IdentityEmbedding newtype + zeroizing Drop — 44/44 GREEN

Iter 7. First structural enforcement of ADR-118 invariant I2 — the
identity embedding is in-RAM-only and cannot be serialized, cloned,
or copied. Lands the type itself; ring-buffer lifecycle is next.

Added:

• src/embedding.rs (no_std-compatible; lives in the lib regardless of features):
  • IdentityEmbedding wrapping [f32; EMBEDDING_DIM=128]
  • from_raw(values), as_slice() -> &[f32], l2_norm(), len(), is_empty()
  • NO Serialize, NO Clone, NO Copy impl
  • Custom Debug emits only dim + L2 norm + "" — never raw values
  • Drop overwrites storage with 0.0 then core::hint::black_box(...) to defeat
    dead-store elimination (DSE would otherwise let the compiler skip the write)
• Compile-time structural guards via static_assertions:
  assert_impl_all!(IdentityEmbedding: Drop)
  assert_not_impl_any!(IdentityEmbedding: Copy, Clone)
• pub use IdentityEmbedding, EMBEDDING_DIM from lib.rs

tests/identity_embedding.rs (5 named tests, all green):
from_raw_preserves_values_through_as_slice
l2_norm_is_correct
debug_output_redacts_raw_values
(asserts the formatted output does NOT contain decimal text of values)
embedding_is_not_clonable
(runtime witness; compile-time assertion lives in src/embedding.rs)
drop_overwrites_storage_with_zeros
(Drop runs without panic; bit-level zeroization is asserted by the
black_box-guarded loop. Unsafe peek-after-free is intentionally avoided.)

ACs progressed:

• AC5 ↑ — even in privacy_mode, the IdentityEmbedding type can't be reached
  from any serialization path because the type system rejects the impl.
• I2 ↑ — Drop, no Clone, no Copy, redacted Debug are all in place as
  compile-time guarantees.

Test config:

• cargo test --no-default-features → 22 passed
• cargo test → 44 passed (3 + 6 + 7 + 8 + 8 + 7 + 5)

Out of scope (next iter target):

• EmbeddingRing — 64-entry FIFO ring buffer holding IdentityEmbeddings,
  drained on coherence-gate Recalibrate (ADR-121 §2.4).
• PrivacyGate::demote(frame, target_class) transformer (ADR-120 §2.4).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p2.2): EmbeddingRing 64-entry FIFO buffer — 53/53 GREEN

Iter 8. Lands the lifecycle half of ADR-120 §2.5: a bounded, in-place,
no_std-compatible ring of IdentityEmbeddings. Insertion is O(1); when
full, push evicts the oldest entry, whose Drop runs and zeroizes the
f32 storage. drain() clears the ring on the coherence-gate Recalibrate
action (ADR-121 §2.4).

Added:

• src/embedding_ring.rs (no_std-compatible; no heap):
  • EmbeddingRing struct with [Option; RING_CAPACITY=64]
    backing array, head cursor, count
  • EmbeddingRing::new() / Default impl
  • push(emb) -> Option (evicted oldest when full)
  • len / is_empty / capacity / is_full / iter
  • iter() returns occupied slots in insertion order (oldest first)
  • drain() -> usize (empties the ring, returns count drained)
• pub use EmbeddingRing, RING_CAPACITY from lib.rs

Uses [const { None }; RING_CAPACITY] (stable since 1.79) to initialize
the slot array for a non-Copy element type.

tests/embedding_ring.rs (9 named tests, all green):
new_ring_is_empty
default_constructor_matches_new
push_below_capacity_returns_none
iter_yields_in_insertion_order
push_at_capacity_evicts_oldest_and_returns_it
(verifies eviction reports the FIRST pushed value, not the last)
push_beyond_capacity_keeps_last_n_entries
(after 74 pushes into a 64-slot ring, the surviving 64 are positions 10..74)
drain_empties_the_ring_and_returns_count
drain_on_empty_ring_returns_zero
ring_can_be_refilled_after_drain
(post-drain push lands cleanly at index 0; iter yields exactly that entry)

ACs progressed:

• I2 ↑ — ring eviction and explicit drain both drop IdentityEmbeddings,
  which the iter-7 Drop impl zeroizes. The "in-RAM-only" lifecycle is now
  end-to-end: bounded buffer in, FIFO out, drain on Recalibrate.

Test config:

• cargo test --no-default-features → 31 passed (22 + 9)
• cargo test → 53 passed (44 + 9)

Out of scope (next iter target):

• PrivacyGate::demote(frame, target_class) — ADR-120 §2.4 monotonic class
  transition with field zeroization, refusing demote-to-Raw (compile-fail).
• SoulMatchOracle stub trait + no-op default impl (ADR-121 §2.6) so the
  Recalibrate exemption hook is wireable from --features soul-signature.

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p3.1): PrivacyGate::demote monotonic class transformer (60/60 GREEN)

Iter 9. Lands ADR-120 §2.4 — the only operation that can lower a frame's
information content. Demote is monotonic by construction (Result::Err
on non-monotone target), strips payload sections per the target class
table, and re-syncs header.privacy_class + CRC32.

Added:

• src/privacy_gate.rs (gated on feature = "std"):
  • PrivacyGate unit struct (+ Default impl)
  • PrivacyGate::demote(BfldFrame, target: PrivacyClass) -> Result
  • Stripping policy:
    target >= Anonymous (2): zeros + clears compressed_angle_matrix and
    csi_delta; sets csi_delta = None so from_payload clears HAS_CSI_DELTA
    target >= Restricted (3): also zeros + clears amplitude_proxy and phase_proxy
  • zeroize_then_clear helper — overwrite with 0 then black_box then truncate
• BfldError::InvalidDemote { from: u8, to: u8 } variant
• pub use PrivacyGate from lib.rs

Note: demote does NOT zero the original Vec capacity that the heap allocator
may still hold — the buffers we own are zeroed and cleared, but the
intermediate Vec passed back to BfldFrame::from_payload reallocates anew.
For strict heap zeroization in regulated deployments, a follow-up iter can
substitute zeroize::Zeroizing<Vec>.

tests/privacy_gate_demote.rs (7 named tests, all green):
demote_to_same_class_is_identity
demote_derived_to_anonymous_strips_compressed_angle_matrix
(also asserts csi_delta dropped, snr_vector and amplitude_proxy preserved)
demote_derived_to_restricted_strips_amplitude_and_phase_too
(snr_vector and vendor_extension survive at class 3)
demote_anonymous_to_derived_is_rejected
(asserts InvalidDemote { from: 2, to: 1 })
demote_to_raw_is_rejected_from_any_higher_class
(parameterized over Derived, Anonymous, Restricted as sources)
demote_preserves_frame_crc_consistency_through_wire_roundtrip
(post-demote frame survives to_bytes -> from_bytes with no CRC error)
demote_clears_has_csi_delta_flag_bit

ACs progressed:

• AC5 ↑ — privacy_mode enforcement at the frame-class boundary now works
  through PrivacyGate, not just the BfldEvent emitter (deferred). When the
  active class is Anonymous (2) or Restricted (3), the angle matrix /
  csi_delta / amplitude / phase sections that carry identity information
  are zeroed before any downstream code sees them.
• AC4 ↑ — demoted frames retain valid CRC; the round-trip-through-bytes
  test proves bit-correctness after the class transition.

Test config:

• cargo test --no-default-features → 31 passed (privacy_gate cfg-out)
• cargo test → 60 passed (53 + 7)

Out of scope (next iter target):

• SoulMatchOracle stub trait + no-op default impl (ADR-121 §2.6) so the
  Recalibrate exemption hook is wireable from --features soul-signature.
• IdentityRiskEngine — multiplicative formula on (sep, stab, consist, conf)
  with the coherence-gate GateAction enum (ADR-121 §2.2 + §2.4).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p3.2): identity_risk score + GateAction enum — 72/72 GREEN

Iter 10. Lands the stateless half of ADR-121 §2.2–§2.4: the
multiplicative risk-score formula and the 4-band gate classifier.
Hysteresis + 5s debounce (stateful CoherenceGate) land in iter 11.

Added (no_std-compatible):

• src/identity_risk.rs:
  • score(sep, stab, consist, conf) -> f32
    Each input clamped to [0,1]; NaN → 0 (conservative). Multiplicative
    combination: any near-zero factor collapses the score → privacy-biased.
  • Threshold constants: PREDICT_ONLY_THRESHOLD=0.5, REJECT_THRESHOLD=0.7,
    RECALIBRATE_THRESHOLD=0.9
  • GateAction enum: Accept | PredictOnly | Reject | Recalibrate
  • GateAction::from_score(f32) -> Self — band-based classification with
    inclusive lower edges (0.7 maps to Reject, 0.9 maps to Recalibrate)
  • GateAction::allows_publish() / drops_event() / requires_recalibrate()
• pub use identity_risk_score (the function) and GateAction from lib.rs

tests/identity_risk_score.rs (12 named tests, all green):
all_ones_yields_one
any_zero_factor_collapses_score_to_zero (4 single-factor variants)
score_is_monotonic_non_decreasing_in_single_factor
out_of_range_inputs_are_clamped_to_unit_interval
nan_inputs_treated_as_zero (verifies privacy-conservative NaN handling)
known_score_matches_hand_calculation (0.80.90.85*0.95 to 1e-6)
from_score_classifies_each_band (8 boundary-condition checks)
threshold_constants_match_documented_values
nan_score_maps_to_accept_conservatively
allows_publish_partitions_actions_correctly
drops_event_inverts_allows_publish (parameterized over all 4 actions)
requires_recalibrate_is_unique_to_recalibrate

ACs progressed:

• ADR-121 AC2 partial — score formula structurally enforces non-negativity,
  upper bound 1.0, and conservative behavior under uncertainty (NaN, negative
  input, single near-zero factor).
• ADR-121 AC7 partial — score function is pure / deterministic; identical
  inputs always produce identical outputs (asserted by the known-value test).

Test config:

• cargo test --no-default-features → 43 passed (31 + 12)
• cargo test → 72 passed (60 + 12)

Out of scope (next iter target):

• CoherenceGate stateful struct: ±0.05 hysteresis + 5-second debounce
  (ADR-121 §2.5) so the gate doesn't oscillate near band boundaries.
• SoulMatchOracle stub trait (ADR-121 §2.6) — the Recalibrate exemption
  hook for --features soul-signature deployments.

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p3.3): CoherenceGate hysteresis + 5s debounce — 85/85 GREEN

Iter 11. Wraps the stateless GateAction classifier from iter 10 with two
stabilizing mechanisms per ADR-121 §2.5:

• ±0.05 HYSTERESIS — a score must clear the current band's edge by
  HYSTERESIS before the gate considers the next band.
• 5-second DEBOUNCE_NS — a different action must persist that long
  before it becomes current; returning to the current band cancels it.

Added (no_std-compatible):

• src/coherence_gate.rs:
  • HYSTERESIS const (0.05) + DEBOUNCE_NS const (5_000_000_000)
  • CoherenceGate { current, pending: Option<(GateAction, u64)> }
  • new() / Default / current() / pending() (diagnostic accessors)
  • evaluate(score, timestamp_ns) -> GateAction
    Algorithm: compute effective_target via per-direction hysteresis check,
    promote pending after DEBOUNCE_NS elapsed, cancel pending on return to
    current band, reset debounce clock if pending target changes
  • Private helpers effective_target / action_idx / upper_edge_of / lower_edge_of
• pub use CoherenceGate from lib.rs

tests/coherence_gate.rs (13 named tests, all green):
fresh_gate_starts_in_accept_with_no_pending
low_score_stays_in_accept_with_no_pending
score_just_past_boundary_but_within_hysteresis_does_not_pend
(0.52: above 0.5 but inside hysteresis envelope — no pending)
score_clearly_past_hysteresis_starts_pending
(0.6: past 0.55 hysteresis edge — pending PredictOnly registered)
pending_action_promotes_after_full_debounce
pending_action_does_not_promote_before_debounce
(verified at DEBOUNCE_NS - 1)
returning_to_current_band_cancels_pending
changing_pending_target_resets_the_debounce_clock
(PredictOnly pending at t=0, then Recalibrate at t=1s — clock resets,
must wait until t=1s+DEBOUNCE_NS before Recalibrate is current)
downward_transitions_also_require_hysteresis
(from PredictOnly, 0.48 stays put; 0.44 pends Accept)
spike_to_one_then_back_to_zero_never_promotes_to_recalibrate
(transient spike + return to baseline produces no transition)
boundary_value_with_hysteresis_does_not_promote (0.5+0.05-epsilon)
boundary_value_at_hysteresis_exact_does_pend (0.5+0.05)
nan_score_stays_in_current_action_with_no_pending

ACs progressed:

• ADR-121 AC4 — Recalibrate fires when score >= 0.9 for >= DEBOUNCE_NS (5s).
  The debounce test above directly exercises this.
• ADR-121 AC5 — hysteresis test confirms action does not oscillate across
  ± 0.05 of a threshold within a 5-second window.

Test config:

• cargo test --no-default-features → 56 passed (43 + 13)
• cargo test → 85 passed (72 + 13)

Out of scope (next iter target):

• SoulMatchOracle stub trait (ADR-121 §2.6) + Recalibrate exemption —
  when --features soul-signature is enabled and the oracle reports a known
  enrolled person_id match, the gate downgrades Recalibrate → PredictOnly.
• BfldEvent struct (ADR-121 §2.1 output event) — first downstream consumer
  of the gate action.

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p3.4): SoulMatchOracle + Recalibrate exemption (93/93 GREEN)

Iter 12. Wires the ADR-121 §2.6 Recalibrate exemption: when an enrolled
person_id matches the current high-separability cluster, the gate
downgrades the would-be Recalibrate to PredictOnly. The high score is
the intended outcome of a Soul Signature match, not an attacker-grade
sniffer arrival — so site_salt rotation is suppressed.

Added (no_std-compatible):

• src/coherence_gate.rs additions:
  • MatchOutcome enum: Match { person_id: u64 } | NotEnrolled | Suppressed
  • SoulMatchOracle trait with matches_enrolled() -> MatchOutcome
  • NullOracle (default-constructible, always reports NotEnrolled)
  • CoherenceGate::evaluate_with_oracle(score, ts, &O: SoulMatchOracle)
    — same hysteresis/debounce as evaluate(), but downgrades Recalibrate
    to PredictOnly when oracle returns Match { .. }
  • Refactored evaluate(): extracted advance_state(target, ts) shared with
    evaluate_with_oracle. evaluate is now a 4-line wrapper.
• pub use MatchOutcome, NullOracle, SoulMatchOracle from lib.rs

tests/soul_match_oracle.rs (8 named tests, all green):
null_oracle_matches_default_evaluate_behavior
(parameterized over 5 score points; oracle-aware and oracle-free
gates produce identical trajectories)
match_outcome_downgrades_recalibrate_to_predict_only
(score=0.95 pends PredictOnly instead of Recalibrate)
match_exemption_promotes_predict_only_after_debounce_not_recalibrate
(after DEBOUNCE_NS, current is PredictOnly — never Recalibrate)
match_outcome_does_not_affect_lower_actions
(Reject pending stays Reject; oracle only intercepts Recalibrate)
suppressed_outcome_does_not_exempt_recalibrate
(Suppressed is functionally equivalent to NotEnrolled at the gate)
not_enrolled_outcome_does_not_exempt_recalibrate
match_outcome_carries_person_id
null_oracle_default_constructor_works

ACs progressed:

• ADR-121 §2.6 fully covered as a stateless integration point — the
  hook is in place for the --features soul-signature Soul Signature
  crate (TBD) to plug in a real RaBitQ-backed oracle.
• ADR-118 §1.4 Soul Signature companion contract is now structurally
  enforced at the gate boundary: enrolled subjects do not trigger
  site_salt rotation; everyone else does.

Test config:

• cargo test --no-default-features → 64 passed (56 + 8)
• cargo test → 93 passed (85 + 8)

Out of scope (next iter target):

• BfldEvent struct (ADR-121 §2.1 output event JSON) — the downstream
  consumer of GateAction. Pairs the gate decision with presence/motion/
  person_count sensing fields.
• Optional: connect SoulMatchOracle into the actual --features soul-signature build (compile-time gate around a re-export).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p4.1): BfldEvent privacy-gated output + JSON (102/102 GREEN)

Iter 13. Lands ADR-121 §2.1 (output event) + ADR-122 §2.1 (field-gating
policy). BfldEvent collapses the GateAction-driven sensing pipeline
into the canonical wire-format publishable on MQTT.

Added:

• serde (workspace, derive feature, optional) + serde_json (workspace, optional) deps
• New crate feature serde-json (default-on; requires std)
• src/event.rs (gated on feature = "std"):
  • BfldEvent struct with all sensing + identity-derived fields
  • with_privacy_gating(...) constructor that applies field-gating policy:
    class < Restricted (3): identity_risk_score + rf_signature_hash kept
    class >= Restricted (3): both nulled to None
  • apply_privacy_gating() — idempotent in-place masking
  • to_json() -> Result<String, serde_json::Error> (gated on serde-json)
  • Custom ser_privacy_class serializer emits lowercase names
    ("anonymous", "restricted", etc.) per the BFLD JSON spec
  • skip_serializing_if = "Option::is_none" on identity-derived fields so
    privacy-gated events are observationally indistinguishable from
    events that never had the field set
• pub use BfldEvent from lib.rs

tests/event_privacy_gating.rs (9 named tests, all green):
anonymous_event_retains_identity_risk_and_hash
restricted_event_strips_identity_fields (class 3 → None)
apply_privacy_gating_is_idempotent
event_type_is_always_bfld_update (parameterized over 3 classes)
json::json_round_trip_emits_type_field_first_or_last_but_present
json::anonymous_json_includes_identity_fields
json::restricted_json_omits_identity_fields_entirely
(asserts the JSON string does NOT contain identity_risk_score or
rf_signature_hash, verifying skip_serializing_if works as intended)
json::privacy_class_serializes_to_lowercase_name
json::zone_id_none_is_omitted_from_json

ACs progressed:

• ADR-121 AC6 (identity_risk score absent at class 3) — structurally
  enforced by with_privacy_gating + skip_serializing_if combination.
• ADR-122 AC1 — JSON shape matches the HA-DISCO publishable event
  contract; identity fields can be reliably stripped by privacy_class.
• ADR-118 AC5 — privacy_mode = engaged maps to PrivacyClass::Restricted
  with no identity fields in the published event.

Test config:

• cargo test --no-default-features → 64 passed (unchanged; event cfg-out)
• cargo test → 102 passed (93 + 9)

Out of scope (next iter target):

• Emitter struct that wires GateAction + privacy class + sensing inputs
  into BfldEvent construction (ADR-118 §2.1 pipeline diagram).
• MQTT topic publisher (ADR-122 §2.2) — depends on a runtime (tokio).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p4.2): BfldEmitter end-to-end pipeline (109/109 GREEN)

Iter 14. Wires every iter-1..13 primitive into a single ADR-118 §2.1
pipeline: per-frame sensing inputs go in, a privacy-gated BfldEvent
(or None) comes out. First time every constituent is exercised together.

Added (gated on feature = "std"):

• src/emitter.rs:
  • SensingInputs struct — 11 fields: timestamp_ns, presence, motion,
    person_count, sensing_confidence, sep, stab, consist, risk_conf,
    rf_signature_hash (Option)
  • BfldEmitter struct owning: node_id, default_zone_id, privacy_class,
    CoherenceGate, EmbeddingRing
  • Builder API: new(node_id) → with_zone(...) → with_privacy_class(...)
  • current_action() / ring_len() diagnostic accessors
  • emit(inputs, embedding) → Option
    1. score = identity_risk::score(sep, stab, consist, risk_conf)
    2. ring.push(embedding) if Some
    3. action = gate.evaluate_with_oracle(score, ts, &NullOracle)
    4. if action == Recalibrate { ring.drain() }
    5. if action.drops_event() { return None }
    6. else BfldEvent::with_privacy_gating(...) honoring privacy_class
  • emit_with_oracle(...) variant for --features soul-signature callers
• pub use BfldEmitter, SensingInputs from lib.rs

tests/emitter_pipeline.rs (7 named tests, all green):
emitter_emits_event_under_low_risk
emitter_drops_event_under_sustained_high_risk (debounce honored)
emitter_drains_ring_on_recalibrate
(fills ring to 5, then Recalibrate-grade score → ring_len() == 0)
restricted_class_strips_identity_fields_in_emitted_event
(class 3: identity_risk_score AND rf_signature_hash both None)
with_zone_sets_default_zone_id_on_event
embedding_is_pushed_to_ring_even_when_event_dropped
(privacy gating drops the event but the ring still observes the
embedding so subsequent separability calculations remain valid)
ring_unchanged_when_no_embedding_supplied

ACs progressed:

• ADR-118 AC1 (BFLD core pipeline integration) — every component from
  iter 1 (frame format) through iter 13 (event) is now traversed by a
  single emit() call. This is the first end-to-end smoke proof.
• ADR-121 AC4 — Recalibrate-grade sustained score triggers ring drain
  (verified by ring_len() going from 5 to 0).
• ADR-122 AC1 — privacy_class threaded through the pipeline so the
  output event is correctly gated for HA/Matter consumption.

Test config:

• cargo test --no-default-features → 64 passed (emitter cfg-out)
• cargo test → 109 passed (102 + 7)

Out of scope (next iter target):

• Wiring rf_signature_hash computation from BLAKE3-keyed(site_salt,
  features) per ADR-120 §2.3 — the SensingInputs.rf_signature_hash
  is supplied by caller for now; needs a SignatureHasher with site_salt
  initialization in a follow-up iter.
• Embedding ring → identity_separability_score derivation (currently
  sep is caller-supplied; should be computed from ring contents).
• MQTT topic publisher wrapping BfldEmitter (ADR-122 §2.2) — depends
  on a runtime (tokio).

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p3.5): SignatureHasher (BLAKE3-keyed) — 117/117 GREEN

Iter 15. Lands ADR-120 §2.3 — the cryptographic foundation of invariant
I3 ("cross-site identity correlation is impossible"). rf_signature_hash
is now derived from a per-site secret and a daily epoch, so two nodes
observing the same physical person produce uncorrelated 256-bit digests.

Added (no_std-compatible):

• blake3 = "1.5", default-features = false (no_std, no SIMD by default)
• src/signature_hasher.rs:
  • Constants SECONDS_PER_DAY (86_400), SITE_SALT_LEN (32), RF_SIGNATURE_LEN (32)
  • SignatureHasher { site_salt: [u8; 32] } with new(salt) const ctor
  • compute(day_epoch, &features) -> [u8; 32] (BLAKE3 keyed mode)
  • compute_at(unix_secs, &features) -> [u8; 32] convenience
  • day_epoch_from_unix_secs(unix_secs) -> u32 helper (floor(t / 86400))
• pub use SignatureHasher, RF_SIGNATURE_LEN, SITE_SALT_LEN from lib.rs

tests/signature_hasher.rs (8 named tests, all green):
deterministic_under_identical_inputs
different_site_salts_produce_different_hashes
different_day_epochs_rotate_the_hash
different_features_produce_different_hashes
output_length_is_32_bytes
day_epoch_from_unix_secs_matches_floor_division
(covers 0, 86_399, 86_400, and the 1.7e9 modern timestamp)
compute_at_matches_compute_with_derived_day
cross_site_hamming_distance_is_statistically_high
*** ADR-120 §2.7 AC2 acceptance test ***
Runs 100 trials with distinct (salt_a, salt_b) pairs observing
identical features, computes per-trial Hamming distance, asserts
mean >= 120 bits and min >= 80 bits. Empirically lands at ~128 bits
mean (the expected value for two independent 256-bit hashes), with
no trial below 80 bits — i.e., zero suspicious near-collisions.

ACs progressed:

• ADR-120 §2.7 AC2 — structurally enforced cross-site isolation, now
  proven empirically by the Hamming-distance test. This is the
  cryptographic half of invariant I3 in code, not just docs.
• ADR-118 invariant I3 — first runtime witness that two sites with
  independent site_salts cannot correlate the same person's signature.

Test config:

• cargo test --no-default-features → 72 passed (64 + 8; signature_hasher is no_std)
• cargo test → 117 passed (109 + 8)

Out of scope (next iter target):

• Wire SignatureHasher into BfldEmitter: replace caller-supplied
  rf_signature_hash with hasher.compute_at(ts, &features) so the
  pipeline produces correct hashes end-to-end.
• IdentityFeatures canonical-bytes encoder so callers don't need to
  hand-serialize per-feature representations.

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p4.3): wire SignatureHasher into BfldEmitter (123/123 GREEN)

Iter 16. End-to-end ADR-120 §2.3 wiring: BfldEmitter now produces
rf_signature_hash derived from (site_salt, day_epoch, features), with
the IdentityEmbedding bytes as the preferred feature source. Closes
the gap from iter 15 — the hasher is now reachable from the pipeline.

Added (in src/emitter.rs):

• BfldEmitter.signature_hasher: Option field
• BfldEmitter::with_signature_hasher(SignatureHasher) -> Self builder
• emit_with_oracle computes derived_hash BEFORE pushing embedding to ring:
  1. unix_secs = inputs.timestamp_ns / NS_PER_SEC
  2. feature bytes: embedding.as_slice() flattened to LE f32 bytes,
     OR fallback canonical_risk_bytes(&inputs) (4-tuple of LE f32)
  3. hasher.compute_at(unix_secs, &bytes)
• Derived hash overrides inputs.rf_signature_hash; when hasher absent
  caller-supplied value passes through unchanged (backward compat)
• canonical_risk_bytes(&inputs) -> [u8; 16] private helper for fallback

tests/emitter_hasher.rs (6 named tests, all green):
no_hasher_passes_caller_supplied_hash_through
installed_hasher_overrides_caller_supplied_hash
same_emitter_same_inputs_produce_same_hash (determinism through emitter)
different_site_salts_produce_different_hashes_end_to_end
*** cross-site isolation proven via the BfldEmitter API, not just
via the SignatureHasher direct API (iter 15) ***
no_embedding_falls_back_to_risk_factor_bytes
fallback_hash_differs_from_embedding_hash
(embedding-based and fallback-based hashes are distinct paths)

ACs progressed:

• ADR-120 §2.7 AC2 — cross-site isolation now provable at the public
  emitter surface, not just inside the hasher module.
• ADR-118 §2.1 pipeline integration — derived rf_signature_hash flows
  through to the BfldEvent without caller participation. Operators
  install the hasher once at boot; per-frame code never sees site_salt.

Test config:

• cargo test --no-default-features → 72 passed (emitter_hasher cfg-out)
• cargo test → 123 passed (117 + 6)

Out of scope (next iter target):

• IdentityFeatures struct — typed canonical-bytes encoder so callers
  don't need to know that embedding bytes feed the hasher directly.
• Cross-iter integration test: BfldEmitter → BfldEvent::to_json with
  derived hash, parsed back, hash field present and base64-encoded
  (or hex-encoded) per the JSON wire spec.

Co-Authored-By: claude-flow ruv@ruv.net

• feat(adr-118/p4.4): rf_signature_hash JSON as "blake3:" (128/128 GREEN)

Iter 17. Lands the BFLD JSON wire spec format for rf_signature_hash —
a "blake3:" prefix followed by 64 lowercase hex chars. Replaces the
default serde array-of-integers encoding which was unusable for
downstream consumers (HA, Matter, MQTT).

Added (in src/event.rs):

• ser_rf_signature_hash(hash: &Option<[u8;32]>, s) custom serializer
• Field attribute on BfldEvent.rf_signature_hash now uses
  serialize_with = "ser_rf_signature_hash" alongside skip_serializing_if
• nibble_to_hex(u8) -> char private const fn (no hex crate dep needed
  for 32 bytes; lowercase hex is trivial)
• Output format: "blake3:deadbeef..." exactly 71 ASCII chars

scoop install mosquitto
mosquitto -v -c mosquitto-allow-anon.conf &
BFLD_MQTT_BROKER=tcp://localhost:1883 cargo test \
    -p wifi-densepose-bfld --features mqtt --test mosquitto_integration

Docker Image:
ghcr.io/ruvnet/RuView:faecee9a37ba68b44ad54af9795cb03b43d9ba72