From d05aa59ccafc76e7339dc5003fb0ed5c3bbc6d7d Mon Sep 17 00:00:00 2001 From: Dragan Spiridonov Date: Thu, 22 Oct 2026 13:44:52 +0200 Subject: [PATCH] docs(adr): clarify MAT privacy and companion state lifetimes --- .../ADR-001-wifi-mat-disaster-detection.md | 23 +++++++++++++++++++ ...DR-355-local-empty-room-bootstrap-prior.md | 13 +++++++++++ .../ADR-419-secure-local-companion-pairing.md | 21 +++++++++++++++++ docs/adr/README.md | 1 + 4 files changed, 58 insertions(+) diff --git a/docs/adr/ADR-001-wifi-mat-disaster-detection.md b/docs/adr/ADR-001-wifi-mat-disaster-detection.md index f03c55346..cb997aee4 100644 --- a/docs/adr/ADR-001-wifi-mat-disaster-detection.md +++ b/docs/adr/ADR-001-wifi-mat-disaster-detection.md @@ -165,6 +165,29 @@ The module integrates with existing crates through adapters: | False positives from animals | Size/pattern classification | | Power constraints in field | Low-power modes, solar charging | +## Hosted API and privacy boundary amendment (2026-10-22) + +PR #2249 composes the MAT API into the sensing-server host with one in-memory +MAT `AppState`. It remains inside host validation and authentication; optional +ML unavailability and empty incident state must be reported explicitly. This +composition does not implement a durable incident database or establish the +physical performance targets above. + +The host's `--privacy-mode` applies to MAT REST output and WebSocket broadcasts. +HTTP response middleware cannot inspect messages after an upgrade, so the host +installs the same recursive serialized-output filter in the MAT stream path. +Besides structured vital signs, this removes generated alert prose and domain +event Debug details that can contain literal heart/breathing rates. Permitted +status, identity and coarse metadata remain; ordinary error messages and +privacy-off serialization retain their existing behavior. Standalone MAT hosts +must install their own output policy; the extension hook alone is not a privacy +guarantee. + +Authenticated nonempty REST and real-socket stream regressions cover the output +boundary in both privacy modes. They use synthetic incidents and do not qualify +survivor detection, clinical accuracy, phone transport, or restart persistence. +Native companion stream support remains governed by ADR-419's allowlist. + ## References - [WiFi-based Vital Signs Monitoring](https://dl.acm.org/doi/10.1145/3130944) diff --git a/docs/adr/ADR-355-local-empty-room-bootstrap-prior.md b/docs/adr/ADR-355-local-empty-room-bootstrap-prior.md index b47082dbf..641beed67 100644 --- a/docs/adr/ADR-355-local-empty-room-bootstrap-prior.md +++ b/docs/adr/ADR-355-local-empty-room-bootstrap-prior.md @@ -140,6 +140,19 @@ This is measured negative evidence for one installation. No occupied positive holdout was recorded, so it does not prove person recall, person counting, or cross home accuracy improvement. +## Full room receipt versus restart prior (2026-10-22) + +An explicit room calibration can name multiple contributing radios, but this +persisted field model remains bound to exactly one model-writing radio and its +CSI grid. On helper restart, the full explicit session, room binding and receipt +are not restored. Client history cannot recreate that live server authority. + +Verify all three radios' fresh reception independently of the restored prior's +single source. A one-radio `bootstrap_only` source set is neither proof that +other radios stopped receiving nor proof of a restored three-radio calibration. +Original expiry and negative-only authority remain unchanged. Retaining a room +or scan on an app is a separate lifecycle from restarting its paired helper. + ## Acceptance test With a physically empty room, complete calibration on stable nodes, promote diff --git a/docs/adr/ADR-419-secure-local-companion-pairing.md b/docs/adr/ADR-419-secure-local-companion-pairing.md index aeaa5ef99..844d02017 100644 --- a/docs/adr/ADR-419-secure-local-companion-pairing.md +++ b/docs/adr/ADR-419-secure-local-companion-pairing.md @@ -116,3 +116,24 @@ The consumer independently opts in to foreground sharing and renders remote geometry separately from local sensing/calibration authority. Software protocol, real socket and owner/companion middleware checks do not establish physical phone-to-Mac capture accuracy or calibration acceptance. + +## Retained replica boundaries (2026-10-22) + +The helper's durable `companion-room.json` is one canonical geometry envelope, +not a replica of either app's scan, models or local evidence history. The app +containers own those records separately; Cognitum sign-in and local pairing do +not synchronize them. Expiry or revocation withdraws transport access and does +not establish deletion of already retained client data. + +Every accepted room PUT increments the server revision. A client may avoid an +unnecessary new binding by validating and reusing the exact unchanged published +configuration instead of issuing another PUT. Importing that identical envelope +must preserve legitimate local evidence; a deliberate changed binding withdraws +current authority while local records remain historical. The client retention +repair is proposed in ruview-mobile ADR-047; it is not present in TestFlight +build 2026102213 and requires a subsequent delivered-build restart check. + +The sensor preview remains transient and currently carries no room-binding +digest. A displayed phone mesh is not a saved canonical room, durable draft, +live AR alignment or RF calibration receipt. MAT HTTP composition likewise does +not expand native companion WebSocket paths; see ADR-001's privacy amendment. diff --git a/docs/adr/README.md b/docs/adr/README.md index d4b5167df..b4c0226cb 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -135,6 +135,7 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme | [ADR-346](ADR-346-fail-closed-edge-occupancy-evidence.md) | Fail closed ESP32 occupancy evidence | Accepted (C6 occupancy integrity qualified) | | [ADR-347](ADR-347-rate-aware-esp32-temporal-sensing.md) | Rate aware ESP32 temporal sensing | Accepted (C6 timing and transport qualified) | | [ADR-363](ADR-363-native-macos-usb-node-onboarding.md) | Native macOS USB node onboarding with nonce bound discovery and fresh server verification | Accepted and physically qualified on one ESP32 S3; C6 and signed distribution pending | +| [ADR-419](ADR-419-secure-local-companion-pairing.md) | Secure local Mac–iPhone pairing, canonical room publication and transient sensor preview | Accepted decision; software verified, physical qualification pending | | [ADR-115](ADR-115-home-assistant-integration.md) | Home Assistant integration via MQTT auto-discovery + Matter bridge (HA-DISCO + HA-FABRIC + HA-MIND) | Accepted (MQTT track) / Proposed (Matter SDK P8b) | | [ADR-169](ADR-169-adam-mode-light-theme.md) | adam-mode — light theme toggle for the three.js realtime demo | Proposed | | [ADR-170](ADR-170-yoga-mode-pose-system.md) | yoga-mode — yoga pose detection, classification, and scoring for the three.js realtime demo | Proposed |