--password puts the WiFi password in argv, where ps and shell history can
see it (#1754). This adds two ways to give it without that:
- --password-file PATH reads it from a file, dropping one trailing newline
(\n or \r\n). The file must exist and not be empty. If group or others can
read it, the script refuses and suggests chmod 600.
--allow-insecure-password-file accepts such a file with a warning, for
read-only mounts such as 0444 secrets.
- When --ssid is given with no password flag and stdin is a terminal, the
script asks with getpass. It reuses a saved password only if it was saved
for the same SSID. Without a terminal (scripts, CI) nothing is asked and
the existing missing-credentials check applies.
--password still works, but now prints a one-line warning on stderr that
points at --password-file. The two flags are mutually exclusive. The
firmware README examples now use --password-file.
Tests: 10 new tests in tests/test_provision_secrets.py, with placeholder
credentials and getpass and the flasher stubbed. 8 fail on the previous
commit; the other 2 check that nothing is asked without a terminal or when a
saved password matches the SSID. The suite goes from 25 to 35 passing.
Refs #1754
Co-Authored-By: claude-flow <ruv@ruv.net>
Rollback-enabled nodes (CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y) boot an
OTA'd image as PENDING_VERIFY, but nothing called
esp_ota_mark_app_valid_cancel_rollback(), so every OTA reverted at the next
reset, a second OTA was refused until then, and a bad image was never
deliberately rolled back.
- main/ota_health.{c,h}: at boot, if the running image is PENDING_VERIFY,
poll for STA got-IP and >=1 CSI frame accepted by the stream sender.
Confirm after CONFIG_OTA_HEALTH_MIN_UPTIME_S (30 s) once both are in;
roll back via esp_ota_mark_app_invalid_rollback_and_reboot() if they are
not in by CONFIG_OTA_HEALTH_TIMEOUT_S (120 s from boot). VALID, UNDEFINED,
NEW and no-otadata/factory images are left alone. The decision is a pure
header function, host-tested in test/test_ota_health.c (make host_tests).
- CONFIG_OTA_HEALTH_FORCE_FAIL (test only) rolls back where it would have
confirmed, for proving rollback on hardware.
- GET /ota/status reports ota_state so durability is visible remotely.
- RUNBOOK: replace the nonexistent ota_rollback_boot_check() claim and
document the behaviour and the hardware check (2.1).
Hardware-verified on an ESP32-S3 (push, confirm, hard reset, forced
rollback) and an ESP32-C6 (push, confirm, hard reset); see ADR-379, next in
this series. Host tests: make host_tests passes, including run_ota_health.
Co-Authored-By: claude-flow <ruv@ruv.net>
Lower the STA auth threshold from WPA2_PSK to WPA_PSK so routers running
WPA/WPA2-mixed compatibility mode aren't rejected with
WIFI_REASON_NO_AP_FOUND_IN_AUTHMODE_THRESHOLD (reason=211), and log the
disconnect reason/rssi instead of retrying blind. Also document the thermal
risk of running this firmware's continuous-radio, tier-2 DSP pipeline on
coin-sized clone boards (ESP32-S3-Zero, SuperMini) with minimal PCB copper
and budget regulators, after a field report of three such boards failing to
power on following a normal session.
Co-Authored-By: claude-flow <ruv@ruv.net>
The ADR-045 display probe false-positives on display-less
ESP32-S3-DevKitC-1 boards (SH8601 init 'succeeds' against floating
pins), so main.c skips the RuView#893 MGMT+DATA promiscuous upgrade
and CSI yield collapses to 0 pps. sdkconfig.defaults.devkitc compiles
display support out, making has_display constant-false so the #893
upgrade always applies. Hardware-verified on 2x DevKitC-1-N16R8:
0 pps -> steady 40-45 pps.
Also updates the Quick Start build commands and badge from
espressif/idf:v5.2 to v5.4 — current source uses esp_driver_uart
(IDF v5.3+) and no longer builds under v5.2; CI already uses v5.4.
Addresses #1308
Co-Authored-By: claude-flow <ruv@ruv.net>
@xiaofuchen's code audit in #568 was correct: the firmware's
`pkt.n_persons` is `s_top_k_count / 2` (clamped) — a subcarrier-slot
partition, not a learned classifier. The README's old wording
('Multi-person estimation', 'Presence sensing') reads stronger than
`edge_processing.c:481-548` actually supports. Same-direction fix as
commit bd4f81749 (which retracted the 92.9% PCK@20 claim because
ADR-079's eval phases are still Pending) and ADR-099 §D8 (which
honestly amended the 10× latency target because it's unreachable on
1-D scalar features).
Three things this commit changes:
1. **Headline-table 'Presence sensing' -> 'Presence indicator (heuristic)'.**
Adds an explicit caveat that strong RF interference can false-positive
without re-calibration, with a link to the detailed Tier-2 section.
The marketing word 'sensing' implied a classifier; the code is a
variance threshold.
2. **Tier-2 bullet 'Multi-person estimation' -> 'Multi-person slot count'.**
Now reads:
'partitions the top-K subcarriers into top_k / 2 groups (clamped to
[1, EDGE_MAX_PERSONS]), computes per-group filtered breathing/heart-
rate estimates, and reports the slot count as pkt.n_persons. This
is a slot-capacity heuristic, not a learned counter — the reported
count tracks subcarrier diversity, not actual occupancy.'
Links directly to `main/edge_processing.c:481-548` so the user can
verify the claim against the code.
3. **New 'What this firmware does NOT do (Tier 2 caveats)' subsection.**
Three explicit non-claims:
- No trained neural model on the ESP32 — the person count is
arithmetic, not inference.
- No pose estimation on the ESP32; pose comes from the host's Rust
server, and only runs learned inference when --model <rvf-file> is
passed. Without a trained model, the host runs signal-based
heuristics, not keypoint inference. Same point as #509 / #506.
- Presence indicator false-positives under fans/microwaves/AP TX
swings without re-running the 60 s ambient calibration. Notes the
concrete remedy (power-cycle in an empty room).
Closes#568.
* fix: bug triage from issues #559, #561, #588
- verify: point at archive/v1/ proof paths (v1/ was removed) (#559)
- firmware README: app flash offset 0x10000 -> 0x20000, include
ota_data_initial.bin at 0xf000, correct provision.py path from
scripts/ to firmware/esp32-csi-node/ (#561)
- provision.py: drop password-length leak in console output; print
(set)/(empty) instead of len(password) asterisks (#588)
Co-Authored-By: claude-flow <ruv@ruv.net>
* ci: fix Fuzz Testing + Swarm Test (ADR-062) workflow regressions
Both have been red on main for ~5 weeks; root-causing them so PR #590
can land green rather than merging on top of pre-existing breakage.
- esp_stubs.h: add wifi_ps_type_t enum (WIFI_PS_NONE/MIN/MAX) and
esp_wifi_set_ps() stub. csi_collector.c:346 added a real
esp_wifi_set_ps(WIFI_PS_NONE) call to disable modem sleep
(RuView#521 fix); the host-native fuzz target couldn't link.
- scripts/qemu_swarm.py: pass --force-partial to provision.py.
The per-node TDM/channel overlay intentionally omits WiFi
credentials (those live in the base flash image), but the
issue #391 wifi-trio guard now rejects calls missing the
--ssid/--password trio. --force-partial is exactly the opt-in
for this case.
Co-Authored-By: claude-flow <ruv@ruv.net>
ruv