feat(train): AetherTemporalAggregator — wire wifi-densepose-temporal into the tch graph (#513 )

ADR-096 train integration. Additive — does NOT modify model.rs. The existing WiFiDensePoseModel forward stays bit-equivalent for back-compat. New code lives in temporal_aether.rs behind the `aether-sparse-temporal` feature flag (which itself requires `tch-backend`). Architecture: tch::Tensor [T, in_dim] ──── tch nn::Linear (q/k/v projections) ↓ [T, q_heads*head_dim] etc ↓ tch_to_tensor3 (CPU, f32, 1× copy) ↓ ruvllm_sparse_attention::Tensor3 ↓ AetherTemporalHead::forward() ↓ Tensor3 [T, q_heads, head_dim] ↓ tensor3_to_tch (1× copy) ↓ tch::Tensor [T, q_heads*head_dim] ↓ tch nn::Linear (output projection) ↓ tch::Tensor [T, in_dim] Why additive rather than swapping `apply_antenna_attention` / `apply_spatial_attention` in model.rs: those are over antenna and spatial axes, not temporal — ADR-096 §8.1 was right that AETHER doesn't currently HAVE a temporal-axis attention. This commit adds that path without disturbing the others, so the §5 validation gate can A/B the two options before flipping the production default. Scope notes: - B=1 prefill only this version. Multi-batch lands when §5 turns green and we need to take perf seriously. The forward expects `[T, in_dim]` not `[B, T, in_dim]`; documented in the file. - Streaming step() bridge deferred — KvCache lifecycle ties to PoseTrack per ADR-096 §8.5, which is signal-side not train-side. - Two CPU memory copies per call (in + out). For training-rate forwards (~100/sec at batch 16) this is negligible vs the actual attention work; for inference-rate streaming it'd be the bottleneck and a zero-copy path is the natural follow-up. Build verification: - Source compiles cleanly with cargo check on the host crate (`-p wifi-densepose-temporal`, 21/21 tests still passing). - The train crate's tch-backend build is environmentally blocked on this Windows machine — torch-sys fails to link against the system PyTorch 2.11 + MSVC 14.50 toolchain. This predates this commit and affects all tch-bound code paths in the workspace. CI runners with working libtorch will verify the new module builds; the source follows the same nn::Linear / Module patterns the existing model.rs uses. Feature gating ensures default builds are byte-equivalent. Off by default; enable with `--features aether-sparse-temporal`. Co-Authored-By: claude-flow <ruv@ruv.net>
test(temporal): dense-vs-sparse numerical A/B baseline (ADR-096 §5, #513 )
2026-10-21 22:22:33 -05:00 · 2026-05-08 12:42:41 -04:00 · 2026-05-08 12:16:05 -04:00 · 2026-05-08 12:12:17 -04:00 · 2026-05-08 12:06:26 -04:00 · 2026-05-08 12:02:36 -04:00
1421 changed files with 531386 additions and 12187 deletions
@@ -0,0 +1 @@
+{"intelligence":7,"timestamp":1774922079152}
@@ -1,6 +1,6 @@
 {
  "running": true,
-  "startedAt": "2026-02-28T15:54:19.353Z",
+  "startedAt": "2026-03-09T15:26:00.921Z",
  "workers": {
    "map": {
      "runCount": 49,
@@ -8,16 +8,16 @@
      "failureCount": 0,
      "averageDurationMs": 1.2857142857142858,
      "lastRun": "2026-02-28T16:13:19.194Z",
-      "nextRun": "2026-02-28T16:28:19.195Z",
+      "nextRun": "2026-03-09T15:56:00.928Z",
      "isRunning": false
    },
    "audit": {
-      "runCount": 44,
+      "runCount": 45,
      "successCount": 0,
-      "failureCount": 44,
+      "failureCount": 45,
      "averageDurationMs": 0,
-      "lastRun": "2026-02-28T16:20:19.184Z",
-      "nextRun": "2026-02-28T16:30:19.185Z",
+      "lastRun": "2026-03-09T15:43:00.933Z",
+      "nextRun": "2026-03-09T15:38:00.914Z",
      "isRunning": false
    },
    "optimize": {
@@ -26,7 +26,7 @@
      "failureCount": 34,
      "averageDurationMs": 0,
      "lastRun": "2026-02-28T16:23:19.387Z",
-      "nextRun": "2026-02-28T16:18:19.361Z",
+      "nextRun": "2026-03-09T15:45:00.915Z",
      "isRunning": false
    },
    "consolidate": {
@@ -35,7 +35,7 @@
      "failureCount": 0,
      "averageDurationMs": 0.6521739130434783,
      "lastRun": "2026-02-28T16:05:19.091Z",
-      "nextRun": "2026-02-28T16:35:19.054Z",
+      "nextRun": "2026-03-09T16:02:00.918Z",
      "isRunning": false
    },
    "testgaps": {
@@ -44,8 +44,8 @@
      "failureCount": 27,
      "averageDurationMs": 0,
      "lastRun": "2026-02-28T16:08:19.369Z",
-      "nextRun": "2026-02-28T16:22:19.355Z",
-      "isRunning": true
+      "nextRun": "2026-03-09T15:54:00.920Z",
+      "isRunning": false
    },
    "predict": {
      "runCount": 0,
@@ -64,8 +64,8 @@
  },
  "config": {
    "autoStart": false,
-    "logDir": "/home/user/wifi-densepose/.claude-flow/logs",
-    "stateFile": "/home/user/wifi-densepose/.claude-flow/daemon-state.json",
+    "logDir": "/Users/cohen/GitHub/ruvnet/RuView/.claude-flow/logs",
+    "stateFile": "/Users/cohen/GitHub/ruvnet/RuView/.claude-flow/daemon-state.json",
    "maxConcurrent": 2,
    "workerTimeoutMs": 300000,
    "resourceThresholds": {
@@ -131,5 +131,5 @@
      }
    ]
  },
-  "savedAt": "2026-02-28T16:23:19.387Z"
+  "savedAt": "2026-03-09T15:43:00.933Z"
 }
@@ -1 +0,0 @@
-166
@@ -0,0 +1,12 @@
+{
+  "timestamp": "2026-03-06T13:17:27.368Z",
+  "mode": "local",
+  "checks": {
+    "envFilesProtected": true,
+    "gitIgnoreExists": true,
+    "noHardcodedSecrets": true
+  },
+  "riskLevel": "low",
+  "recommendations": [],
+  "note": "Install Claude Code CLI for AI-powered security analysis"
+}
@@ -6,7 +6,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs pre-bash",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" pre-bash",
            "timeout": 5000
          }
        ]
@@ -18,7 +18,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs post-edit",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" post-edit",
            "timeout": 10000
          }
        ]
@@ -29,7 +29,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs route",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" route",
            "timeout": 10000
          }
        ]
@@ -40,12 +40,12 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs session-restore",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-restore",
            "timeout": 15000
          },
          {
            "type": "command",
-            "command": "node .claude/helpers/auto-memory-hook.mjs import",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" import",
            "timeout": 8000
          }
        ]
@@ -56,7 +56,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs session-end",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-end",
            "timeout": 10000
          }
        ]
@@ -67,7 +67,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/auto-memory-hook.mjs sync",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/auto-memory-hook.mjs\" sync",
            "timeout": 10000
          }
        ]
@@ -79,11 +79,11 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs compact-manual"
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" compact-manual"
          },
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs session-end",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-end",
            "timeout": 5000
          }
        ]
@@ -93,11 +93,11 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs compact-auto"
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" compact-auto"
          },
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs session-end",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" session-end",
            "timeout": 6000
          }
        ]
@@ -108,7 +108,7 @@
        "hooks": [
          {
            "type": "command",
-            "command": "node .claude/helpers/hook-handler.cjs status",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/hook-handler.cjs\" status",
            "timeout": 3000
          }
        ]
@@ -117,7 +117,7 @@
  },
  "statusLine": {
    "type": "command",
-    "command": "node .claude/helpers/statusline.cjs"
+    "command": "node \"$CLAUDE_PROJECT_DIR/.claude/helpers/statusline.cjs\""
  },
  "permissions": {
    "allow": [
@@ -0,0 +1,6 @@
+{
+  "enabledMcpjsonServers": [
+    "claude-flow"
+  ],
+  "enableAllProjectMcpServers": true
+}
@@ -1,132 +1,8 @@
-# Git
-.git
-.gitignore
-.gitattributes
-
-# Documentation
-*.md
-docs/
-references/
-plans/
-
-# Development files
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# Python
-__pycache__/
-*.py[cod]
-*$py.class
-*.so
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# Virtual environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Testing
-.tox/
-.coverage
-.coverage.*
-.cache
-.pytest_cache/
-htmlcov/
-.nox/
-coverage.xml
-*.cover
-.hypothesis/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# pyenv
-.python-version
-
-# Environments
-.env.local
-.env.development
-.env.test
-.env.production
-
-# Logs
-logs/
+target/
+.git/
 *.log
-
-# Runtime data
-pids/
-*.pid
-*.seed
-*.pid.lock
-
-# Temporary files
-tmp/
-temp/
-.tmp/
-
-# OS generated files
-.DS_Store
-.DS_Store?
-._*
-.Spotlight-V100
-.Trashes
-ehthumbs.db
-Thumbs.db
-
-# IDE
-*.sublime-project
-*.sublime-workspace
-
-# Deployment
-docker-compose*.yml
-Dockerfile*
-.dockerignore
-k8s/
-terraform/
-ansible/
-monitoring/
-logging/
-
-# CI/CD
-.github/
-.gitlab-ci.yml
-
-# Models (exclude large model files from build context)
-*.pth
-*.pt
-*.onnx
-models/*.bin
-models/*.safetensors
-
-# Data files
-data/
-*.csv
-*.json
-*.parquet
-
-# Backup files
-*.bak
-*.backup
+__pycache__/
+*.pyc
+.env
+node_modules/
+.claude/
@@ -0,0 +1,58 @@
+version: 2
+updates:
+  # Keep all third-party GitHub Actions on verified, pinned commit SHAs.
+  # Pairs with the SHA pinning in security-scan.yml and ci.yml so that
+  # future bumps stay automated and reviewable rather than drifting back
+  # to mutable @master / @main refs. See issue #442.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+
+  # Mobile app npm deps. Includes the @xmldom/xmldom, node-forge, and
+  # picomatch advisories from #442 plus axios and any future surface.
+  - package-ecosystem: npm
+    directory: /ui/mobile
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - mobile
+
+  # Desktop UI npm deps. Direct vite devDep currently has a HIGH advisory
+  # (dev-server-only path traversal); track future bumps automatically.
+  - package-ecosystem: npm
+    directory: /v2/crates/wifi-densepose-desktop/ui
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - desktop
+
+  # Python deps used by v1/ and the FastAPI service. requirements.txt is
+  # only loosely pinned; let Dependabot surface upstream CVE bumps.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - python
+
+  # Rust workspace (15+ crates). cargo audit is not currently wired into
+  # any workflow, so Dependabot is the primary automated bump path.
+  - package-ecosystem: cargo
+    directory: /v2
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - rust
@@ -2,7 +2,7 @@ name: Continuous Integration

 on:
  push:
-    branches: [ main, develop, 'feature/*', 'hotfix/*' ]
+    branches: [ main, develop, 'feature/*', 'feat/*', 'hotfix/*' ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:
@@ -25,7 +25,7 @@ jobs:
        fetch-depth: 0

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -54,7 +54,7 @@ jobs:
      continue-on-error: true

    - name: Upload security reports
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-reports
@@ -62,6 +62,32 @@ jobs:
          bandit-report.json
          safety-report.json

+  # Rust Workspace Tests
+  rust-tests:
+    name: Rust Workspace Tests
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+
+    - name: Cache cargo
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+          v2/target
+        key: ${{ runner.os }}-cargo-${{ hashFiles('v2/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-
+
+    - name: Run Rust tests
+      working-directory: v2
+      run: cargo test --workspace --no-default-features
+
  # Unit and Integration Tests
  test:
    name: Tests
@@ -98,7 +124,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
@@ -126,14 +152,14 @@ jobs:
        pytest tests/integration/ -v --junitxml=integration-junit.xml

    - name: Upload coverage reports
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
      with:
        file: ./coverage.xml
        flags: unittests
        name: codecov-umbrella

    - name: Upload test results
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: test-results-${{ matrix.python-version }}
@@ -153,7 +179,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -174,7 +200,7 @@ jobs:
        locust -f tests/performance/locustfile.py --headless --users 50 --spawn-rate 5 --run-time 60s --host http://localhost:8000

    - name: Upload performance results
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      with:
        name: performance-results
        path: locust_report.html
@@ -183,7 +209,7 @@ jobs:
  docker-build:
    name: Docker Build & Test
    runs-on: ubuntu-latest
-    needs: [code-quality, test]
+    needs: [code-quality, test, rust-tests]
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
@@ -229,14 +255,14 @@ jobs:
        docker stop test-container

    - name: Run container security scan
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
      with:
        image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy scan results
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'
@@ -252,7 +278,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -272,7 +298,7 @@ jobs:
        "

    - name: Deploy to GitHub Pages
-      uses: peaceiris/actions-gh-pages@v3
+      uses: peaceiris/actions-gh-pages@v4
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        publish_dir: ./docs
@@ -282,43 +308,42 @@ jobs:
  notify:
    name: Notify
    runs-on: ubuntu-latest
-    needs: [code-quality, test, performance-test, docker-build, docs]
+    needs: [code-quality, test, rust-tests, performance-test, docker-build, docs]
    if: always()
+    # GitHub Actions does not allow `secrets.X` directly in step-level `if:`
+    # expressions — only `env.X`. Promote the secret to env at job scope so
+    # the gating expression below is parseable.
+    env:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    steps:
    - name: Notify Slack on success
-      if: ${{ needs.code-quality.result == 'success' && needs.test.result == 'success' && needs.docker-build.result == 'success' }}
+      if: ${{ env.SLACK_WEBHOOK_URL != '' && needs.code-quality.result == 'success' && needs.test.result == 'success' && needs.docker-build.result == 'success' }}
      uses: 8398a7/action-slack@v3
      with:
        status: success
        channel: '#ci-cd'
        text: '✅ CI pipeline completed successfully for ${{ github.ref }}'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Notify Slack on failure
-      if: ${{ needs.code-quality.result == 'failure' || needs.test.result == 'failure' || needs.docker-build.result == 'failure' }}
+      if: ${{ env.SLACK_WEBHOOK_URL != '' && (needs.code-quality.result == 'failure' || needs.test.result == 'failure' || needs.docker-build.result == 'failure') }}
      uses: 8398a7/action-slack@v3
      with:
        status: failure
        channel: '#ci-cd'
        text: '❌ CI pipeline failed for ${{ github.ref }}'
-      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Create GitHub Release
      if: github.ref == 'refs/heads/main' && needs.docker-build.result == 'success'
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      uses: softprops/action-gh-release@v2
      with:
        tag_name: v${{ github.run_number }}
-        release_name: Release v${{ github.run_number }}
+        name: Release v${{ github.run_number }}
        body: |
          Automated release from CI pipeline
-          
+
          **Changes:**
          ${{ github.event.head_commit.message }}
-          
+
          **Docker Image:**
          `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}`
        draft: false
@@ -0,0 +1,46 @@
+name: Dashboard a11y + cross-browser
+
+# Runs axe-core a11y assertions on the built dashboard across
+# Chromium, Firefox, and WebKit. Closes ADR-092 §11.5 (axe-core)
+# and §11.8 (cross-browser).
+
+on:
+  push:
+    branches: [main]
+    paths: ['dashboard/**', 'v2/crates/nvsim/**']
+  pull_request:
+    paths: ['dashboard/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  a11y:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with: { targets: wasm32-unknown-unknown }
+
+      - name: Install wasm-pack
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+
+      - name: Build nvsim WASM
+        working-directory: v2
+        run: |
+          wasm-pack build crates/nvsim --target web \
+            --out-dir ../../dashboard/public/nvsim-pkg \
+            --release -- --no-default-features --features wasm
+
+      - uses: actions/setup-node@v4
+        with: { node-version: 20, cache: npm, cache-dependency-path: dashboard/package-lock.json }
+
+      - working-directory: dashboard
+        run: |
+          npm ci
+          npm install --save-dev @playwright/test @axe-core/playwright
+          npx playwright install --with-deps
+          npm run build
+          npx playwright test
@@ -0,0 +1,87 @@
+name: nvsim Dashboard → GitHub Pages
+
+# Deploys the nvsim Vite/Lit dashboard to gh-pages/nvsim/ — preserving
+# the existing observatory/, pose-fusion/, and root index.html demos
+# already published from gh-pages. ADR-092 §9.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'v2/crates/nvsim/**'
+      - 'dashboard/**'
+      - '.github/workflows/dashboard-pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: dashboard-pages
+  cancel-in-progress: true
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+
+      - name: Install Rust + wasm32 target
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            v2/target
+          key: ${{ runner.os }}-cargo-nvsim-${{ hashFiles('v2/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-nvsim-
+
+      - name: Install wasm-pack
+        run: |
+          curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+          which wasm-pack
+
+      - name: Build nvsim WASM
+        working-directory: v2
+        run: |
+          wasm-pack build crates/nvsim \
+            --target web \
+            --out-dir ../../dashboard/public/nvsim-pkg \
+            --release \
+            -- --no-default-features --features wasm
+
+      - name: Setup Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+
+      - name: Install dashboard deps
+        working-directory: dashboard
+        run: npm ci
+
+      - name: Build dashboard
+        working-directory: dashboard
+        env:
+          NVSIM_BASE: /RuView/nvsim/
+        run: npm run build
+
+      - name: Deploy to gh-pages/nvsim/
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./dashboard/dist
+          destination_dir: nvsim
+          # CRITICAL: preserves observatory/, pose-fusion/, root index.html
+          # and any other RuView demos already on gh-pages.
+          keep_files: true
+          commit_message: 'deploy(nvsim): ${{ github.sha }}'
+          user_name: 'github-actions[bot]'
+          user_email: 'github-actions[bot]@users.noreply.github.com'
@@ -0,0 +1,184 @@
+name: Desktop Release
+
+on:
+  push:
+    tags:
+      - 'desktop-v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 0.4.0)'
+        required: true
+        default: '0.4.0'
+      attach_to_existing:
+        description: 'Attach to existing release tag (leave empty to create new)'
+        required: false
+        default: ''
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build-macos:
+    name: Build macOS
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        target: [aarch64-apple-darwin, x86_64-apple-darwin]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install frontend dependencies
+        working-directory: v2/crates/wifi-densepose-desktop/ui
+        run: npm ci
+
+      - name: Build frontend
+        working-directory: v2/crates/wifi-densepose-desktop/ui
+        run: npm run build
+
+      - name: Install Tauri CLI
+        run: cargo install tauri-cli --version "^2.0.0"
+
+      - name: Build Tauri app
+        working-directory: v2/crates/wifi-densepose-desktop
+        run: cargo tauri build --target ${{ matrix.target }}
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+      - name: Get architecture name
+        id: arch
+        run: |
+          if [ "${{ matrix.target }}" = "aarch64-apple-darwin" ]; then
+            echo "arch=arm64" >> $GITHUB_OUTPUT
+          else
+            echo "arch=x64" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Package macOS app
+        run: |
+          cd v2/target/${{ matrix.target }}/release/bundle/macos
+          zip -r "RuView-Desktop-${{ github.event.inputs.version || '0.4.0' }}-macos-${{ steps.arch.outputs.arch }}.zip" "RuView Desktop.app"
+
+      - name: Upload macOS artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ruview-macos-${{ steps.arch.outputs.arch }}
+          path: v2/target/${{ matrix.target }}/release/bundle/macos/*.zip
+
+  build-windows:
+    name: Build Windows
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install frontend dependencies
+        working-directory: v2/crates/wifi-densepose-desktop/ui
+        run: npm ci
+
+      - name: Build frontend
+        working-directory: v2/crates/wifi-densepose-desktop/ui
+        run: npm run build
+
+      - name: Install Tauri CLI
+        run: cargo install tauri-cli --version "^2.0.0"
+
+      - name: Build Tauri app
+        working-directory: v2/crates/wifi-densepose-desktop
+        run: cargo tauri build
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+
+      - name: Upload Windows MSI artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ruview-windows-msi
+          path: v2/target/release/bundle/msi/*.msi
+
+      - name: Upload Windows NSIS artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ruview-windows-nsis
+          path: v2/target/release/bundle/nsis/*.exe
+
+  create-release:
+    name: Create Release
+    needs: [build-macos, build-windows]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: List artifacts
+        run: find artifacts -type f
+
+      - name: Create or Update Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: RuView Desktop v${{ github.event.inputs.version || '0.4.0' }}
+          tag_name: ${{ github.event.inputs.attach_to_existing || format('desktop-v{0}', github.event.inputs.version || '0.4.0') }}
+          draft: false
+          prerelease: false
+          generate_release_notes: ${{ github.event.inputs.attach_to_existing == '' }}
+          files: |
+            artifacts/**/*.zip
+            artifacts/**/*.msi
+            artifacts/**/*.exe
+            artifacts/**/*.dmg
+          body: |
+            ## RuView Desktop v${{ github.event.inputs.version || '0.4.0' }}
+
+            WiFi-based human pose estimation desktop application.
+
+            ### Downloads
+
+            | Platform | Architecture | Download |
+            |----------|--------------|----------|
+            | macOS | Apple Silicon (M1/M2/M3) | `RuView-Desktop-*-macos-arm64.zip` |
+            | macOS | Intel | `RuView-Desktop-*-macos-x64.zip` |
+            | Windows | x64 | `RuView-Desktop-*.msi` or `RuView-Desktop-*.exe` |
+
+            ### Installation
+
+            **macOS:**
+            1. Download the appropriate `.zip` file for your Mac
+            2. Extract the zip file
+            3. Move `RuView Desktop.app` to your Applications folder
+            4. Right-click and select "Open" (first time only, to bypass Gatekeeper)
+
+            **Windows:**
+            1. Download the `.msi` installer
+            2. Run the installer
+            3. Launch RuView Desktop from the Start menu
+
+            ### Requirements
+            - macOS 11.0+ (Big Sur or later)
+            - Windows 10/11 (64-bit)
@@ -0,0 +1,124 @@
+name: Firmware CI
+
+on:
+  push:
+    paths:
+      - 'firmware/**'
+      - '.github/workflows/firmware-ci.yml'
+  pull_request:
+    paths:
+      - 'firmware/**'
+      - '.github/workflows/firmware-ci.yml'
+
+jobs:
+  build:
+    name: Build ESP32-S3 Firmware (${{ matrix.variant }})
+    runs-on: ubuntu-latest
+    container:
+      image: espressif/idf:v5.4
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: 8mb
+            sdkconfig: sdkconfig.defaults
+            partition_table_name: partitions_display.csv
+            size_limit_kb: 1100
+            artifact_app: esp32-csi-node.bin
+            artifact_pt: partition-table.bin
+          - variant: 4mb
+            sdkconfig: sdkconfig.defaults.4mb
+            partition_table_name: partitions_4mb.csv
+            size_limit_kb: 1100
+            artifact_app: esp32-csi-node-4mb.bin
+            artifact_pt: partition-table-4mb.bin
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build firmware (${{ matrix.variant }})
+        working-directory: firmware/esp32-csi-node
+        run: |
+          . $IDF_PATH/export.sh
+          if [ "${{ matrix.variant }}" != "8mb" ]; then
+            cp "${{ matrix.sdkconfig }}" sdkconfig.defaults
+          fi
+          idf.py set-target esp32s3
+          idf.py build
+
+      - name: Verify binary size (< ${{ matrix.size_limit_kb }} KB gate)
+        working-directory: firmware/esp32-csi-node
+        run: |
+          BIN=build/esp32-csi-node.bin
+          SIZE=$(stat -c%s "$BIN")
+          MAX=$((${{ matrix.size_limit_kb }} * 1024))
+          echo "Binary size: $SIZE bytes ($(( SIZE / 1024 )) KB)"
+          echo "Size limit:  $MAX bytes (${{ matrix.size_limit_kb }} KB)"
+          if [ "$SIZE" -gt "$MAX" ]; then
+            echo "::error::Firmware binary exceeds ${{ matrix.size_limit_kb }} KB size gate ($SIZE > $MAX)"
+            exit 1
+          fi
+          echo "Binary size OK: $SIZE <= $MAX"
+
+      - name: Verify flash image integrity
+        working-directory: firmware/esp32-csi-node
+        run: |
+          ERRORS=0
+          BIN=build/esp32-csi-node.bin
+
+          if [ ! -s "$BIN" ]; then
+            echo "::error::Binary not found or empty"
+            exit 1
+          fi
+
+          PT=build/partition_table/partition-table.bin
+          if [ -f "$PT" ]; then
+            MAGIC=$(od -A n -t x1 -N 2 "$PT" | tr -d ' ')
+            if [ "$MAGIC" != "aa50" ]; then
+              echo "::warning::Partition table magic mismatch: $MAGIC (expected aa50)"
+              ERRORS=$((ERRORS + 1))
+            fi
+          fi
+
+          BL=build/bootloader/bootloader.bin
+          if [ ! -s "$BL" ]; then
+            echo "::warning::Bootloader binary missing or empty"
+            ERRORS=$((ERRORS + 1))
+          fi
+
+          NONZERO=$(od -A n -t x1 -N 1024 "$BIN" | tr -d ' f\n' | wc -c)
+          if [ "$NONZERO" -lt 100 ]; then
+            echo "::error::Binary appears to be mostly padding (non-zero chars: $NONZERO)"
+            ERRORS=$((ERRORS + 1))
+          fi
+
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::warning::Flash image verification completed with $ERRORS warning(s)"
+          else
+            echo "Flash image integrity verified"
+          fi
+
+      - name: Stage release binaries with variant-specific names
+        working-directory: firmware/esp32-csi-node
+        run: |
+          mkdir -p release-staging
+          cp build/esp32-csi-node.bin                      release-staging/${{ matrix.artifact_app }}
+          cp build/partition_table/partition-table.bin     release-staging/${{ matrix.artifact_pt }}
+          if [ "${{ matrix.variant }}" = "8mb" ]; then
+            cp build/bootloader/bootloader.bin             release-staging/bootloader.bin
+            cp build/ota_data_initial.bin                  release-staging/ota_data_initial.bin
+          fi
+          ls -la release-staging/
+
+      - name: Check QEMU ESP32-S3 support status
+        run: |
+          echo "::notice::ESP32-S3 QEMU support is experimental in ESP-IDF v5.4. "
+          echo "Full smoke testing requires QEMU 8.2+ with xtensa-esp32s3 target."
+          echo "See: https://github.com/espressif/qemu/wiki"
+
+      - name: Upload firmware artifact (${{ matrix.variant }})
+        uses: actions/upload-artifact@v4
+        with:
+          name: esp32-csi-node-firmware-${{ matrix.variant }}
+          path: firmware/esp32-csi-node/release-staging/
+          retention-days: 90
@@ -0,0 +1,370 @@
+name: Firmware QEMU Tests (ADR-061)
+
+on:
+  push:
+    paths:
+      - 'firmware/**'
+      - 'scripts/qemu-esp32s3-test.sh'
+      - 'scripts/validate_qemu_output.py'
+      - 'scripts/generate_nvs_matrix.py'
+      - 'scripts/qemu_swarm.py'
+      - 'scripts/swarm_health.py'
+      - 'scripts/swarm_presets/**'
+      - '.github/workflows/firmware-qemu.yml'
+  pull_request:
+    paths:
+      - 'firmware/**'
+      - 'scripts/qemu-esp32s3-test.sh'
+      - 'scripts/validate_qemu_output.py'
+      - 'scripts/generate_nvs_matrix.py'
+      - 'scripts/qemu_swarm.py'
+      - 'scripts/swarm_health.py'
+      - 'scripts/swarm_presets/**'
+      - '.github/workflows/firmware-qemu.yml'
+
+env:
+  IDF_VERSION: "v5.4"
+  QEMU_REPO: "https://github.com/espressif/qemu.git"
+  QEMU_BRANCH: "esp-develop"
+
+jobs:
+  build-qemu:
+    name: Build Espressif QEMU
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cache QEMU build
+        id: cache-qemu
+        uses: actions/cache@v4
+        with:
+          path: /opt/qemu-esp32
+          # Include date component so cache refreshes monthly when branch updates
+          key: qemu-esp32s3-${{ env.QEMU_BRANCH }}-v5
+          restore-keys: |
+            qemu-esp32s3-${{ env.QEMU_BRANCH }}-
+
+      - name: Install QEMU build dependencies
+        if: steps.cache-qemu.outputs.cache-hit != 'true'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            git build-essential ninja-build pkg-config \
+            libglib2.0-dev libpixman-1-dev libslirp-dev \
+            libgcrypt20-dev \
+            python3 python3-venv
+
+      - name: Clone and build Espressif QEMU
+        if: steps.cache-qemu.outputs.cache-hit != 'true'
+        run: |
+          git clone --depth 1 -b "$QEMU_BRANCH" "$QEMU_REPO" /tmp/qemu-esp
+          cd /tmp/qemu-esp
+          mkdir build && cd build
+          ../configure \
+            --target-list=xtensa-softmmu \
+            --prefix=/opt/qemu-esp32 \
+            --enable-slirp \
+            --disable-werror
+          ninja -j$(nproc)
+          ninja install
+
+      - name: Verify QEMU binary
+        run: |
+          file_size() { stat -c%s "$1" 2>/dev/null || stat -f%z "$1" 2>/dev/null || wc -c < "$1"; }
+          /opt/qemu-esp32/bin/qemu-system-xtensa --version
+          echo "QEMU binary size: $(file_size /opt/qemu-esp32/bin/qemu-system-xtensa) bytes"
+
+      - name: Upload QEMU artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: qemu-esp32
+          path: /opt/qemu-esp32/
+          retention-days: 7
+
+  qemu-test:
+    name: QEMU Test (${{ matrix.nvs_config }})
+    needs: build-qemu
+    runs-on: ubuntu-latest
+    container:
+      image: espressif/idf:v5.4
+
+    strategy:
+      fail-fast: false
+      matrix:
+        nvs_config:
+          - default
+          - full-adr060
+          - edge-tier0
+          - edge-tier1
+          - tdm-3node
+          - boundary-max
+          - boundary-min
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download QEMU artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: qemu-esp32
+          path: /opt/qemu-esp32
+
+      - name: Make QEMU executable
+        run: chmod +x /opt/qemu-esp32/bin/qemu-system-xtensa
+
+      - name: Verify QEMU works
+        run: /opt/qemu-esp32/bin/qemu-system-xtensa --version
+
+      - name: Install Python dependencies
+        run: |
+          . $IDF_PATH/export.sh
+          pip install esptool esp-idf-nvs-partition-gen
+
+      - name: Set target ESP32-S3
+        working-directory: firmware/esp32-csi-node
+        run: |
+          . $IDF_PATH/export.sh
+          idf.py set-target esp32s3
+
+      - name: Build firmware (mock CSI mode)
+        working-directory: firmware/esp32-csi-node
+        run: |
+          . $IDF_PATH/export.sh
+          idf.py \
+            -D SDKCONFIG_DEFAULTS="sdkconfig.defaults;sdkconfig.qemu" \
+            build
+
+      - name: Generate NVS matrix
+        run: |
+          . $IDF_PATH/export.sh
+          python3 scripts/generate_nvs_matrix.py \
+            --output-dir firmware/esp32-csi-node/build/nvs_matrix \
+            --only ${{ matrix.nvs_config }}
+
+      - name: Create merged flash image
+        working-directory: firmware/esp32-csi-node
+        run: |
+          . $IDF_PATH/export.sh
+
+          # Determine merge_bin arguments
+          OTA_ARGS=""
+          if [ -f build/ota_data_initial.bin ]; then
+            OTA_ARGS="0xf000 build/ota_data_initial.bin"
+          fi
+
+          python3 -m esptool --chip esp32s3 merge_bin \
+            -o build/qemu_flash.bin \
+            --flash_mode dio --flash_freq 80m --flash_size 8MB \
+            --fill-flash-size 8MB \
+            0x0     build/bootloader/bootloader.bin \
+            0x8000  build/partition_table/partition-table.bin \
+            $OTA_ARGS \
+            0x20000 build/esp32-csi-node.bin
+
+          file_size() { stat -c%s "$1" 2>/dev/null || stat -f%z "$1" 2>/dev/null || wc -c < "$1"; }
+          echo "Flash image size: $(file_size build/qemu_flash.bin) bytes"
+
+      - name: Inject NVS partition
+        if: matrix.nvs_config != 'default'
+        working-directory: firmware/esp32-csi-node
+        run: |
+          NVS_BIN="build/nvs_matrix/nvs_${{ matrix.nvs_config }}.bin"
+          if [ -f "$NVS_BIN" ]; then
+            file_size() { stat -c%s "$1" 2>/dev/null || stat -f%z "$1" 2>/dev/null || wc -c < "$1"; }
+            echo "Injecting NVS: $NVS_BIN ($(file_size "$NVS_BIN") bytes)"
+            dd if="$NVS_BIN" of=build/qemu_flash.bin \
+              bs=1 seek=$((0x9000)) conv=notrunc 2>/dev/null
+          else
+            echo "WARNING: NVS binary not found: $NVS_BIN"
+          fi
+
+      - name: Run QEMU smoke test
+        env:
+          QEMU_PATH: /opt/qemu-esp32/bin/qemu-system-xtensa
+          QEMU_TIMEOUT: "90"
+        run: |
+          echo "Starting QEMU (timeout: ${QEMU_TIMEOUT}s)..."
+
+          timeout "$QEMU_TIMEOUT" "$QEMU_PATH" \
+            -machine esp32s3 \
+            -nographic \
+            -drive file=firmware/esp32-csi-node/build/qemu_flash.bin,if=mtd,format=raw \
+            -serial mon:stdio \
+            -nic user,model=open_eth,net=10.0.2.0/24 \
+            -no-reboot \
+            2>&1 | tee firmware/esp32-csi-node/build/qemu_output.log || true
+
+          echo "QEMU finished. Log size: $(wc -l < firmware/esp32-csi-node/build/qemu_output.log) lines"
+
+      - name: Validate QEMU output
+        run: |
+          python3 scripts/validate_qemu_output.py \
+            firmware/esp32-csi-node/build/qemu_output.log
+
+      - name: Upload test logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: qemu-logs-${{ matrix.nvs_config }}
+          path: |
+            firmware/esp32-csi-node/build/qemu_output.log
+            firmware/esp32-csi-node/build/nvs_matrix/
+          retention-days: 14
+
+  fuzz-test:
+    name: Fuzz Testing (ADR-061 Layer 6)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install clang
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang
+
+      - name: Build fuzz targets
+        working-directory: firmware/esp32-csi-node/test
+        run: make all CC=clang
+
+      - name: Run serialize fuzzer (60s)
+        working-directory: firmware/esp32-csi-node/test
+        run: make run_serialize FUZZ_DURATION=60 || echo "FUZZER_CRASH=serialize" >> "$GITHUB_ENV"
+
+      - name: Run edge enqueue fuzzer (60s)
+        working-directory: firmware/esp32-csi-node/test
+        run: make run_edge FUZZ_DURATION=60 || echo "FUZZER_CRASH=edge" >> "$GITHUB_ENV"
+
+      - name: Run NVS config fuzzer (60s)
+        working-directory: firmware/esp32-csi-node/test
+        run: make run_nvs FUZZ_DURATION=60 || echo "FUZZER_CRASH=nvs" >> "$GITHUB_ENV"
+
+      - name: Check for crashes
+        working-directory: firmware/esp32-csi-node/test
+        run: |
+          CRASHES=$(find . -type f \( -name "crash-*" -o -name "oom-*" -o -name "timeout-*" \) 2>/dev/null | wc -l)
+          echo "Crash artifacts found: $CRASHES"
+          if [ "$CRASHES" -gt 0 ] || [ -n "${FUZZER_CRASH:-}" ]; then
+            echo "::error::Fuzzer found $CRASHES crash/oom/timeout artifacts. FUZZER_CRASH=${FUZZER_CRASH:-none}"
+            ls -la crash-* oom-* timeout-* 2>/dev/null
+            exit 1
+          fi
+
+      - name: Upload fuzz artifacts
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-crashes
+          path: |
+            firmware/esp32-csi-node/test/crash-*
+            firmware/esp32-csi-node/test/oom-*
+            firmware/esp32-csi-node/test/timeout-*
+          retention-days: 30
+
+  nvs-matrix-validate:
+    name: NVS Matrix Generation
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install NVS generator
+        run: pip install esp-idf-nvs-partition-gen
+
+      - name: Generate all 14 NVS configs
+        run: |
+          python3 scripts/generate_nvs_matrix.py \
+            --output-dir build/nvs_matrix
+
+      - name: Verify all binaries generated
+        run: |
+          EXPECTED=14
+          ACTUAL=$(find build/nvs_matrix -type f -name "nvs_*.bin" 2>/dev/null | wc -l)
+          echo "Generated $ACTUAL / $EXPECTED NVS binaries"
+          ls -la build/nvs_matrix/
+
+          if [ "$ACTUAL" -lt "$EXPECTED" ]; then
+            echo "::error::Only $ACTUAL of $EXPECTED NVS binaries generated"
+            exit 1
+          fi
+
+      - name: Verify binary sizes
+        run: |
+          file_size() { stat -c%s "$1" 2>/dev/null || stat -f%z "$1" 2>/dev/null || wc -c < "$1"; }
+          for f in build/nvs_matrix/nvs_*.bin; do
+            SIZE=$(file_size "$f")
+            if [ "$SIZE" -ne 24576 ]; then
+              echo "::error::$f has unexpected size $SIZE (expected 24576)"
+              exit 1
+            fi
+            echo "  OK: $(basename $f) ($SIZE bytes)"
+          done
+
+  # ---------------------------------------------------------------------------
+  # ADR-062: QEMU Swarm Configurator Test
+  #
+  # Runs a lightweight 3-node swarm (ci_matrix preset) under QEMU to validate
+  # multi-node orchestration, TDM slot coordination, and swarm-level health
+  # assertions. Uses the pre-built QEMU binary from the build-qemu job and the
+  # firmware built by qemu-test.
+  #
+  # The CI runner is non-root, so TAP bridge networking is unavailable.
+  # The orchestrator (qemu_swarm.py) detects this and falls back to SLIRP
+  # user-mode networking, which is sufficient for the ci_matrix preset.
+  # ---------------------------------------------------------------------------
+  swarm-test:
+    name: Swarm Test (ADR-062)
+    needs: [build-qemu]
+    runs-on: ubuntu-latest
+    container:
+      image: espressif/idf:v5.4
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download QEMU artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: qemu-esp32
+          path: /opt/qemu-esp32
+
+      - name: Make QEMU executable
+        run: chmod +x /opt/qemu-esp32/bin/qemu-system-xtensa
+
+      - name: Install Python dependencies
+        run: |
+          . $IDF_PATH/export.sh
+          pip install pyyaml esptool esp-idf-nvs-partition-gen
+
+      - name: Build firmware for swarm
+        working-directory: firmware/esp32-csi-node
+        run: |
+          . $IDF_PATH/export.sh
+          idf.py set-target esp32s3
+          idf.py -D SDKCONFIG_DEFAULTS="sdkconfig.defaults;sdkconfig.qemu" build
+          python3 -m esptool --chip esp32s3 merge_bin \
+            -o build/qemu_flash.bin \
+            --flash_mode dio --flash_freq 80m --flash_size 8MB \
+            --fill-flash-size 8MB \
+            0x0     build/bootloader/bootloader.bin \
+            0x8000  build/partition_table/partition-table.bin \
+            0x20000 build/esp32-csi-node.bin
+
+      - name: Run swarm smoke test
+        run: |
+          . $IDF_PATH/export.sh
+          EXIT_CODE=0
+          python3 scripts/qemu_swarm.py --preset ci_matrix \
+            --qemu-path /opt/qemu-esp32/bin/qemu-system-xtensa \
+            --output-dir build/swarm-results || EXIT_CODE=$?
+          # Exit 0=PASS, 1=WARN (acceptable in CI without real hardware)
+          if [ "$EXIT_CODE" -gt 1 ]; then
+            echo "Swarm test failed with exit code $EXIT_CODE"
+            exit "$EXIT_CODE"
+          fi
+        timeout-minutes: 10
+
+      - name: Upload swarm results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: swarm-results
+          path: |
+            build/swarm-results/
+          retention-days: 14
@@ -0,0 +1,69 @@
+name: nvsim-server → ghcr.io
+
+# Builds and publishes the nvsim-server Docker image to ghcr.io on:
+# - push to main affecting nvsim-server or nvsim
+# - tag push matching nvsim-server-v*
+# - manual workflow_dispatch
+#
+# ADR-092 §6.2 + §9.4.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'v2/crates/nvsim-server/**'
+      - 'v2/crates/nvsim/**'
+      - '.github/workflows/nvsim-server-docker.yml'
+    tags: ['nvsim-server-v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/ruvnet/nvsim-server
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha,format=short
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build + push
+        uses: docker/build-push-action@v5
+        with:
+          context: v2
+          file: v2/crates/nvsim-server/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64
+
+      - name: Smoke-test the image
+        run: |
+          docker pull ghcr.io/ruvnet/nvsim-server:sha-${GITHUB_SHA::7} || \
+            docker pull ghcr.io/ruvnet/nvsim-server:latest
+          docker run --rm -d --name nvsim-test -p 7878:7878 \
+            ghcr.io/ruvnet/nvsim-server:latest
+          sleep 4
+          curl -fsS http://localhost:7878/api/health
+          docker stop nvsim-test
@@ -0,0 +1,74 @@
+name: Point Cloud Viewer → GitHub Pages
+
+# Publishes the live 3D point cloud viewer to gh-pages/pointcloud/.
+# The viewer defaults to a synthetic in-browser demo; users can append
+# ?backend=<url> or ?backend=auto to point it at a real ruview-pointcloud
+# server (CORS-permitting host required). See ADR-094.
+#
+# Uses keep_files: true to preserve the existing observatory/, pose-fusion/,
+# nvsim/, and root index.html demos already on gh-pages.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'v2/crates/wifi-densepose-pointcloud/src/viewer.html'
+      - '.github/workflows/pointcloud-pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: pointcloud-pages
+  cancel-in-progress: true
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+
+      - name: Stage viewer for Pages
+        run: |
+          mkdir -p _site/pointcloud
+          cp v2/crates/wifi-densepose-pointcloud/src/viewer.html _site/pointcloud/index.html
+          # Drop a tiny README so direct browsers of the directory get context.
+          cat > _site/pointcloud/README.md <<'EOF'
+          # RuView — Live 3D Point Cloud Viewer
+
+          Hosted at: https://ruvnet.github.io/RuView/pointcloud/
+
+          ## Modes
+
+          - Default — synthetic in-browser demo (no backend, no network calls).
+          - `?backend=auto` — fetch from `/api/splats` on the same origin
+            (only works when the viewer is served by `ruview-pointcloud serve`).
+          - `?backend=<url>` — fetch from `<url>/api/splats`. The intended
+            local-ESP32 use is `?backend=http://127.0.0.1:9880`: run
+            `ruview-pointcloud serve --bind 127.0.0.1:9880` on the same
+            machine with your ESP32 streaming CSI to UDP port 3333, then
+            visit the URL above. The local server's CorsLayer permits
+            requests from `https://ruvnet.github.io`, and modern browsers
+            permit HTTPS→127.0.0.1 mixed-content as a trustworthy origin.
+            The "📡 Connect ESP32" button in the viewer prompts for this
+            URL and persists it in localStorage.
+          - `?live=1` — require a live backend; show an offline message instead
+            of falling back to the synthetic demo.
+
+          See ADR-094 for the deployment design.
+          EOF
+
+      - name: Deploy to gh-pages/pointcloud/
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./_site/pointcloud
+          destination_dir: pointcloud
+          # CRITICAL: preserves observatory/, pose-fusion/, nvsim/, and root
+          # index.html already on gh-pages.
+          keep_files: true
+          commit_message: 'deploy(pointcloud): ${{ github.sha }}'
+          user_name: 'github-actions[bot]'
+          user_email: 'github-actions[bot]@users.noreply.github.com'
@@ -2,7 +2,7 @@ name: Security Scanning

 on:
  push:
-    branches: [ main, develop ]
+    branches: [ main, develop, 'feat/*' ]
  pull_request:
    branches: [ main, develop ]
  schedule:
@@ -29,7 +29,7 @@ jobs:
        fetch-depth: 0

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -46,7 +46,7 @@ jobs:
      continue-on-error: true

    - name: Upload Bandit results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: bandit-results.sarif
@@ -70,7 +70,7 @@ jobs:
      continue-on-error: true

    - name: Upload Semgrep results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: semgrep.sarif
@@ -89,7 +89,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -111,7 +111,7 @@ jobs:
      continue-on-error: true

    - name: Run Snyk vulnerability scan
-      uses: snyk/actions/python@master
+      uses: snyk/actions/python@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
@@ -119,14 +119,14 @@ jobs:
      continue-on-error: true

    - name: Upload Snyk results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: snyk-results.sarif
        category: snyk

    - name: Upload vulnerability reports
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: vulnerability-reports
@@ -163,14 +163,14 @@ jobs:
        cache-to: type=gha,mode=max

    - name: Run Trivy vulnerability scanner
-      uses: aquasecurity/trivy-action@master
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
      with:
        image-ref: 'wifi-densepose:scan'
        format: 'sarif'
        output: 'trivy-results.sarif'

    - name: Upload Trivy results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'
@@ -186,7 +186,7 @@ jobs:
        output-format: sarif

    - name: Upload Grype results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: ${{ steps.grype-scan.outputs.sarif }}
@@ -202,7 +202,7 @@ jobs:
        summary: true

    - name: Upload Docker Scout results
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: scout-results.sarif
@@ -221,7 +221,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Run Checkov IaC scan
-      uses: bridgecrewio/checkov-action@master
+      uses: bridgecrewio/checkov-action@99bb2caf247dfd9f03cf984373bc6043d4e32ebf # v12.1347.0
      with:
        directory: .
        framework: kubernetes,dockerfile,terraform,ansible
@@ -231,14 +231,14 @@ jobs:
        soft_fail: true

    - name: Upload Checkov results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: checkov-results.sarif
        category: checkov

    - name: Run Terrascan IaC scan
-      uses: tenable/terrascan-action@main
+      uses: tenable/terrascan-action@3a6e87da8e244513bd77b631e624552643f794c6 # v1.4.1
      with:
        iac_type: 'k8s'
        iac_version: 'v1'
@@ -247,7 +247,7 @@ jobs:
        sarif_upload: true

    - name: Run KICS IaC scan
-      uses: checkmarx/kics-github-action@master
+      uses: checkmarx/kics-github-action@05aa5eb70eede1355220f4ca5238d96b397e30a6 # v2.1.20
      with:
        path: '.'
        output_path: kics-results
@@ -256,7 +256,7 @@ jobs:
        exclude_queries: 'a7ef1e8c-fbf8-4ac1-b8c7-2c3b0e6c6c6c'

    - name: Upload KICS results to GitHub Security
-      uses: github/codeql-action/upload-sarif@v2
+      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: kics-results/results.sarif
@@ -277,7 +277,7 @@ jobs:
        fetch-depth: 0

    - name: Run TruffleHog secret scan
-      uses: trufflesecurity/trufflehog@main
+      uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 # v3.95.2
      with:
        path: ./
        base: main
@@ -306,7 +306,7 @@ jobs:
      uses: actions/checkout@v4

    - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHON_VERSION }}
        cache: 'pip'
@@ -323,7 +323,7 @@ jobs:
        licensecheck --zero

    - name: Upload license report
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      with:
        name: license-report
        path: licenses.json
@@ -361,11 +361,14 @@ jobs:
    - name: Validate Kubernetes security contexts
      run: |
        # Check for security contexts in Kubernetes manifests
-        if find k8s/ -name "*.yaml" -exec grep -l "securityContext" {} \; | wc -l | grep -q "^0$"; then
-          echo "❌ No security contexts found in Kubernetes manifests"
-          exit 1
+        if [[ -d "k8s" ]]; then
+          if find k8s/ -name "*.yaml" -exec grep -l "securityContext" {} \; | wc -l | grep -q "^0$"; then
+            echo "⚠️ No security contexts found in Kubernetes manifests"
+          else
+            echo "✅ Security contexts found in Kubernetes manifests"
+          fi
        else
-          echo "✅ Security contexts found in Kubernetes manifests"
+          echo "ℹ️ No k8s/ directory found — skipping Kubernetes security context check"
        fi

  # Notification and reporting
@@ -374,9 +377,14 @@ jobs:
    runs-on: ubuntu-latest
    needs: [sast, dependency-scan, container-scan, iac-scan, secret-scan, license-scan, compliance-check]
    if: always()
+    # Promote secret to env-scope so the gating `if:` on the Slack-notify
+    # step below is parseable (GitHub Actions rejects `secrets.X` in
+    # step-level `if:` expressions).
+    env:
+      SECURITY_SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
    steps:
    - name: Download all artifacts
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4

    - name: Generate security summary
      run: |
@@ -394,13 +402,16 @@ jobs:
        echo "Generated on: $(date)" >> security-summary.md

    - name: Upload security summary
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
      with:
        name: security-summary
        path: security-summary.md

+    # GitHub Actions does not allow `secrets.X` in step-level `if:` —
+    # use env.X instead. Inherits SECURITY_SLACK_WEBHOOK_URL from the
+    # job-level env block (added below).
    - name: Notify security team on critical findings
-      if: needs.sast.result == 'failure' || needs.dependency-scan.result == 'failure' || needs.container-scan.result == 'failure'
+      if: ${{ env.SECURITY_SLACK_WEBHOOK_URL != '' && (needs.sast.result == 'failure' || needs.dependency-scan.result == 'failure' || needs.container-scan.result == 'failure') }}
      uses: 8398a7/action-slack@v3
      with:
        status: failure
@@ -412,7 +423,7 @@ jobs:
          Workflow: ${{ github.workflow }}
          Please review the security scan results immediately.
      env:
-        SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }}
+        SLACK_WEBHOOK_URL: ${{ env.SECURITY_SLACK_WEBHOOK_URL }}

    - name: Create security issue on critical findings
      if: needs.sast.result == 'failure' || needs.dependency-scan.result == 'failure'
@@ -0,0 +1,50 @@
+name: Update vendor submodules
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'  # Every 6 hours
+  workflow_dispatch:        # Manual trigger
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update submodules to latest main
+        run: git submodule update --remote --merge
+
+      - name: Check for changes
+        id: check
+        run: |
+          if git diff --quiet; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create PR with updates
+        if: steps.check.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          BRANCH="chore/update-submodules-$(date +%Y%m%d-%H%M%S)"
+          git checkout -b "$BRANCH"
+          git add vendor/
+          git commit -m "chore: update vendor submodules to latest main"
+          git push origin "$BRANCH"
+          gh pr create \
+            --title "chore: update vendor submodules" \
+            --body "Automated submodule update to latest upstream main." \
+            --base main \
+            --head "$BRANCH"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -4,16 +4,16 @@ on:
  push:
    branches: [ main, master, 'claude/**' ]
    paths:
-      - 'v1/src/core/**'
-      - 'v1/src/hardware/**'
-      - 'v1/data/proof/**'
+      - 'archive/v1/src/core/**'
+      - 'archive/v1/src/hardware/**'
+      - 'archive/v1/data/proof/**'
      - '.github/workflows/verify-pipeline.yml'
  pull_request:
    branches: [ main, master ]
    paths:
-      - 'v1/src/core/**'
-      - 'v1/src/hardware/**'
-      - 'v1/data/proof/**'
+      - 'archive/v1/src/core/**'
+      - 'archive/v1/src/hardware/**'
+      - 'archive/v1/data/proof/**'
      - '.github/workflows/verify-pipeline.yml'
  workflow_dispatch:

@@ -37,19 +37,19 @@ jobs:
      - name: Install pinned dependencies
        run: |
          python -m pip install --upgrade pip
-          pip install -r v1/requirements-lock.txt
+          pip install -r archive/v1/requirements-lock.txt

      - name: Verify reference signal is reproducible
        run: |
          echo "=== Regenerating reference signal ==="
-          python v1/data/proof/generate_reference_signal.py
+          python archive/v1/data/proof/generate_reference_signal.py
          echo ""
          echo "=== Checking data file matches committed version ==="
          # The regenerated file should be identical to the committed one
          # (We compare the metadata file since data file is large)
          python -c "
          import json, hashlib
-          with open('v1/data/proof/sample_csi_meta.json') as f:
+          with open('archive/v1/data/proof/sample_csi_meta.json') as f:
              meta = json.load(f)
          assert meta['is_synthetic'] == True, 'Metadata must mark signal as synthetic'
          assert meta['numpy_seed'] == 42, 'Seed must be 42'
@@ -76,7 +76,7 @@ jobs:
          echo "=== Scanning for unseeded np.random usage in production code ==="
          # Search for np.random calls without a seed in production code
          # Exclude test files, proof data generators, and known parser placeholders
-          VIOLATIONS=$(grep -rn "np\.random\." v1/src/ \
+          VIOLATIONS=$(grep -rn "np\.random\." archive/v1/src/ \
            --include="*.py" \
            --exclude-dir="__pycache__" \
            | grep -v "np\.random\.RandomState" \
@@ -1,8 +1,41 @@
+# Local Claude config (contains WiFi credentials and machine-specific paths)
+CLAUDE.local.md
+
 # ESP32 firmware build artifacts and local config (contains WiFi credentials)
 firmware/esp32-csi-node/build/
 firmware/esp32-csi-node/sdkconfig
 firmware/esp32-csi-node/sdkconfig.defaults
 firmware/esp32-csi-node/sdkconfig.old
+# Downloaded WASM3 source (fetched at configure time)
+firmware/esp32-csi-node/components/wasm3/wasm3-src/
+# ESP-IDF managed components (downloaded at build time)
+firmware/esp32-csi-node/managed_components/
+firmware/esp32-csi-node/dependencies.lock
+firmware/esp32-csi-node/sdkconfig.defaults.bak
+
+# Claude Flow swarm runtime state
+.swarm/
+
+# CSI recordings (local training data, machine-specific)
+rust-port/wifi-densepose-rs/data/recordings/
+
+# NVS partition images and CSVs (contain WiFi credentials)
+nvs.bin
+nvs_config.csv
+nvs_provision.bin
+firmware/esp32-csi-node/nvs_seed.csv
+firmware/esp32-csi-node/nvs_seed.bin
+firmware/esp32-csi-node/nvs_config.bin
+firmware/esp32-csi-node/nvs_wifi.bin
+firmware/esp32-csi-node/nvs.bin
+# Catch any other NVS binaries/CSVs with credentials
+**/nvs_*.bin
+**/nvs_*.csv
+
+# Working artifacts that should not land in root
+/*.wasm
+/esp32_*.txt
+/serial_error.txt

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -193,9 +226,29 @@ cython_debug/
 # PyPI configuration file
 .pypirc

+# Compiled Swift helper binaries (macOS WiFi sensing)
+v1/src/sensing/mac_wifi
+
 # Cursor
 #  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
 #  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
 #  refer to https://docs.cursor.com/context/ignore-files
 .cursorignore
-.cursorindexingignore
+.cursorindexingignore
+
+# Claude Flow runtime artifacts (auto-generated, machine-specific)
+**/daemon.pid
+**/pending-insights.jsonl
+**/vectors.db
+**/memory.db
+**/.claude-flow/sessions/session-*.json
+**/.claude-flow/sessions/current.json
+
+# Node modules (should use npm ci, not committed)
+**/node_modules/
+
+# Local build scripts
+firmware/esp32-csi-node/build_firmware.batdata/
+models/
+demo_pointcloud.ply
+demo_splats.json
@@ -1,347 +0,0 @@
-# GitLab CI/CD Pipeline for WiFi-DensePose
-# This pipeline provides an alternative to GitHub Actions for GitLab users
-
-stages:
-  - validate
-  - test
-  - security
-  - build
-  - deploy-staging
-  - deploy-production
-  - monitor
-
-variables:
-  DOCKER_DRIVER: overlay2
-  DOCKER_TLS_CERTDIR: "/certs"
-  REGISTRY: $CI_REGISTRY
-  IMAGE_NAME: $CI_REGISTRY_IMAGE
-  PYTHON_VERSION: "3.11"
-  KUBECONFIG: /tmp/kubeconfig
-
-# Global before_script
-before_script:
-  - echo "Pipeline started for $CI_COMMIT_REF_NAME"
-  - export IMAGE_TAG=${CI_COMMIT_SHA:0:8}
-
-# Code Quality and Validation
-code-quality:
-  stage: validate
-  image: python:$PYTHON_VERSION
-  before_script:
-    - pip install --upgrade pip
-    - pip install -r requirements.txt
-    - pip install black flake8 mypy bandit safety
-  script:
-    - echo "Running code quality checks..."
-    - black --check --diff src/ tests/
-    - flake8 src/ tests/ --max-line-length=88 --extend-ignore=E203,W503
-    - mypy src/ --ignore-missing-imports
-    - bandit -r src/ -f json -o bandit-report.json || true
-    - safety check --json --output safety-report.json || true
-  artifacts:
-    reports:
-      junit: bandit-report.json
-    paths:
-      - bandit-report.json
-      - safety-report.json
-    expire_in: 1 week
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-# Unit Tests
-unit-tests:
-  stage: test
-  image: python:$PYTHON_VERSION
-  services:
-    - postgres:15
-    - redis:7
-  variables:
-    POSTGRES_DB: test_wifi_densepose
-    POSTGRES_USER: postgres
-    POSTGRES_PASSWORD: postgres
-    DATABASE_URL: postgresql://postgres:postgres@postgres:5432/test_wifi_densepose
-    REDIS_URL: redis://redis:6379/0
-    ENVIRONMENT: test
-  before_script:
-    - pip install --upgrade pip
-    - pip install -r requirements.txt
-    - pip install pytest-cov pytest-xdist
-  script:
-    - echo "Running unit tests..."
-    - pytest tests/unit/ -v --cov=src --cov-report=xml --cov-report=html --junitxml=junit.xml
-  coverage: '/TOTAL.*\s+(\d+%)$/'
-  artifacts:
-    reports:
-      junit: junit.xml
-      coverage_report:
-        coverage_format: cobertura
-        path: coverage.xml
-    paths:
-      - htmlcov/
-    expire_in: 1 week
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-# Integration Tests
-integration-tests:
-  stage: test
-  image: python:$PYTHON_VERSION
-  services:
-    - postgres:15
-    - redis:7
-  variables:
-    POSTGRES_DB: test_wifi_densepose
-    POSTGRES_USER: postgres
-    POSTGRES_PASSWORD: postgres
-    DATABASE_URL: postgresql://postgres:postgres@postgres:5432/test_wifi_densepose
-    REDIS_URL: redis://redis:6379/0
-    ENVIRONMENT: test
-  before_script:
-    - pip install --upgrade pip
-    - pip install -r requirements.txt
-    - pip install pytest
-  script:
-    - echo "Running integration tests..."
-    - pytest tests/integration/ -v --junitxml=integration-junit.xml
-  artifacts:
-    reports:
-      junit: integration-junit.xml
-    expire_in: 1 week
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-# Security Scanning
-security-scan:
-  stage: security
-  image: python:$PYTHON_VERSION
-  before_script:
-    - pip install --upgrade pip
-    - pip install -r requirements.txt
-    - pip install bandit semgrep safety
-  script:
-    - echo "Running security scans..."
-    - bandit -r src/ -f sarif -o bandit-results.sarif || true
-    - semgrep --config=p/security-audit --config=p/secrets --config=p/python --sarif --output=semgrep.sarif src/ || true
-    - safety check --json --output safety-report.json || true
-  artifacts:
-    reports:
-      sast: 
-        - bandit-results.sarif
-        - semgrep.sarif
-    paths:
-      - safety-report.json
-    expire_in: 1 week
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-# Container Security Scan
-container-security:
-  stage: security
-  image: docker:latest
-  services:
-    - docker:dind
-  before_script:
-    - docker info
-    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
-  script:
-    - echo "Building and scanning container..."
-    - docker build -t $IMAGE_NAME:$IMAGE_TAG .
-    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v $PWD:/tmp/.cache/ aquasec/trivy:latest image --format sarif --output /tmp/.cache/trivy-results.sarif $IMAGE_NAME:$IMAGE_TAG || true
-  artifacts:
-    reports:
-      container_scanning: trivy-results.sarif
-    expire_in: 1 week
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-
-# Build and Push Docker Image
-build-image:
-  stage: build
-  image: docker:latest
-  services:
-    - docker:dind
-  before_script:
-    - docker info
-    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
-  script:
-    - echo "Building Docker image..."
-    - docker build --target production -t $IMAGE_NAME:$IMAGE_TAG -t $IMAGE_NAME:latest .
-    - docker push $IMAGE_NAME:$IMAGE_TAG
-    - docker push $IMAGE_NAME:latest
-    - echo "Image pushed: $IMAGE_NAME:$IMAGE_TAG"
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    - if: $CI_COMMIT_TAG
-
-# Deploy to Staging
-deploy-staging:
-  stage: deploy-staging
-  image: bitnami/kubectl:latest
-  environment:
-    name: staging
-    url: https://staging.wifi-densepose.com
-  before_script:
-    - echo "$KUBE_CONFIG_STAGING" | base64 -d > $KUBECONFIG
-    - kubectl config view
-  script:
-    - echo "Deploying to staging environment..."
-    - kubectl set image deployment/wifi-densepose wifi-densepose=$IMAGE_NAME:$IMAGE_TAG -n wifi-densepose-staging
-    - kubectl rollout status deployment/wifi-densepose -n wifi-densepose-staging --timeout=600s
-    - kubectl get pods -n wifi-densepose-staging -l app=wifi-densepose
-    - echo "Staging deployment completed"
-  after_script:
-    - sleep 30
-    - curl -f https://staging.wifi-densepose.com/health || exit 1
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-  when: manual
-  allow_failure: false
-
-# Deploy to Production
-deploy-production:
-  stage: deploy-production
-  image: bitnami/kubectl:latest
-  environment:
-    name: production
-    url: https://wifi-densepose.com
-  before_script:
-    - echo "$KUBE_CONFIG_PRODUCTION" | base64 -d > $KUBECONFIG
-    - kubectl config view
-  script:
-    - echo "Deploying to production environment..."
-    # Backup current deployment
-    - kubectl get deployment wifi-densepose -n wifi-densepose -o yaml > backup-deployment.yaml
-    # Blue-Green Deployment
-    - kubectl patch deployment wifi-densepose -n wifi-densepose -p '{"spec":{"template":{"metadata":{"labels":{"version":"green"}}}}}'
-    - kubectl set image deployment/wifi-densepose wifi-densepose=$IMAGE_NAME:$IMAGE_TAG -n wifi-densepose
-    - kubectl rollout status deployment/wifi-densepose -n wifi-densepose --timeout=600s
-    - kubectl wait --for=condition=ready pod -l app=wifi-densepose,version=green -n wifi-densepose --timeout=300s
-    # Switch traffic
-    - kubectl patch service wifi-densepose-service -n wifi-densepose -p '{"spec":{"selector":{"version":"green"}}}'
-    - echo "Production deployment completed"
-  after_script:
-    - sleep 30
-    - curl -f https://wifi-densepose.com/health || exit 1
-  artifacts:
-    paths:
-      - backup-deployment.yaml
-    expire_in: 1 week
-  rules:
-    - if: $CI_COMMIT_TAG
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: manual
-  allow_failure: false
-
-# Post-deployment Monitoring
-monitor-deployment:
-  stage: monitor
-  image: curlimages/curl:latest
-  script:
-    - echo "Monitoring deployment health..."
-    - |
-      if [ "$CI_ENVIRONMENT_NAME" = "production" ]; then
-        BASE_URL="https://wifi-densepose.com"
-      else
-        BASE_URL="https://staging.wifi-densepose.com"
-      fi
-    - |
-      for i in $(seq 1 10); do
-        echo "Health check $i/10"
-        curl -f $BASE_URL/health || exit 1
-        curl -f $BASE_URL/api/v1/status || exit 1
-        sleep 30
-      done
-    - echo "Monitoring completed successfully"
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: on_success
-    - if: $CI_COMMIT_TAG
-      when: on_success
-  allow_failure: true
-
-# Rollback Job (Manual)
-rollback:
-  stage: deploy-production
-  image: bitnami/kubectl:latest
-  environment:
-    name: production
-    url: https://wifi-densepose.com
-  before_script:
-    - echo "$KUBE_CONFIG_PRODUCTION" | base64 -d > $KUBECONFIG
-  script:
-    - echo "Rolling back deployment..."
-    - kubectl rollout undo deployment/wifi-densepose -n wifi-densepose
-    - kubectl rollout status deployment/wifi-densepose -n wifi-densepose --timeout=600s
-    - kubectl get pods -n wifi-densepose -l app=wifi-densepose
-    - echo "Rollback completed"
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: manual
-  allow_failure: false
-
-# Cleanup old images
-cleanup:
-  stage: monitor
-  image: docker:latest
-  services:
-    - docker:dind
-  before_script:
-    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
-  script:
-    - echo "Cleaning up old images..."
-    - |
-      # Keep only the last 10 images
-      IMAGES_TO_DELETE=$(docker images $IMAGE_NAME --format "table {{.Tag}}" | tail -n +2 | tail -n +11)
-      for tag in $IMAGES_TO_DELETE; do
-        if [ "$tag" != "latest" ] && [ "$tag" != "$IMAGE_TAG" ]; then
-          echo "Deleting image: $IMAGE_NAME:$tag"
-          docker rmi $IMAGE_NAME:$tag || true
-        fi
-      done
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: on_success
-  allow_failure: true
-
-# Notification
-notify-success:
-  stage: monitor
-  image: curlimages/curl:latest
-  script:
-    - |
-      if [ -n "$SLACK_WEBHOOK_URL" ]; then
-        curl -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"✅ Pipeline succeeded for $CI_PROJECT_NAME on $CI_COMMIT_REF_NAME\"}" \
-          $SLACK_WEBHOOK_URL
-      fi
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: on_success
-  allow_failure: true
-
-notify-failure:
-  stage: monitor
-  image: curlimages/curl:latest
-  script:
-    - |
-      if [ -n "$SLACK_WEBHOOK_URL" ]; then
-        curl -X POST -H 'Content-type: application/json' \
-          --data "{\"text\":\"❌ Pipeline failed for $CI_PROJECT_NAME on $CI_COMMIT_REF_NAME\"}" \
-          $SLACK_WEBHOOK_URL
-      fi
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: on_failure
-  allow_failure: true
-
-# Include additional pipeline configurations
-include:
-  - template: Security/SAST.gitlab-ci.yml
-  - template: Security/Container-Scanning.gitlab-ci.yml
-  - template: Security/Dependency-Scanning.gitlab-ci.yml
-  - template: Security/License-Scanning.gitlab-ci.yml
@@ -0,0 +1,12 @@
+[submodule "vendor/midstream"]
+	path = vendor/midstream
+	url = https://github.com/ruvnet/midstream
+	branch = main
+[submodule "vendor/ruvector"]
+	path = vendor/ruvector
+	url = https://github.com/ruvnet/ruvector
+	branch = main
+[submodule "vendor/sublinear-time-solver"]
+	path = vendor/sublinear-time-solver
+	url = https://github.com/ruvnet/sublinear-time-solver
+	branch = main
@@ -0,0 +1,49 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "QEMU ESP32-S3 Debug",
+            "type": "cppdbg",
+            "request": "launch",
+            "program": "${workspaceFolder}/firmware/esp32-csi-node/build/esp32-csi-node.elf",
+            "cwd": "${workspaceFolder}/firmware/esp32-csi-node",
+            "MIMode": "gdb",
+            "miDebuggerPath": "xtensa-esp-elf-gdb",
+            "miDebuggerServerAddress": "localhost:1234",
+            "setupCommands": [
+                {
+                    "description": "Set remote hardware breakpoint limit (ESP32-S3 has 2)",
+                    "text": "set remote hardware-breakpoint-limit 2",
+                    "ignoreFailures": false
+                },
+                {
+                    "description": "Set remote hardware watchpoint limit (ESP32-S3 has 2)",
+                    "text": "set remote hardware-watchpoint-limit 2",
+                    "ignoreFailures": false
+                }
+            ]
+        },
+        {
+            "name": "QEMU ESP32-S3 Debug (attach)",
+            "type": "cppdbg",
+            "request": "attach",
+            "program": "${workspaceFolder}/firmware/esp32-csi-node/build/esp32-csi-node.elf",
+            "cwd": "${workspaceFolder}/firmware/esp32-csi-node",
+            "MIMode": "gdb",
+            "miDebuggerPath": "xtensa-esp-elf-gdb",
+            "miDebuggerServerAddress": "localhost:1234",
+            "setupCommands": [
+                {
+                    "description": "Set remote hardware breakpoint limit (ESP32-S3 has 2)",
+                    "text": "set remote hardware-breakpoint-limit 2",
+                    "ignoreFailures": false
+                },
+                {
+                    "description": "Set remote hardware watchpoint limit (ESP32-S3 has 2)",
+                    "text": "set remote hardware-watchpoint-limit 2",
+                    "ignoreFailures": false
+                }
+            ]
+        }
+    ]
+}
@@ -5,68 +5,614 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [Unreleased]
+
+### Added
+- **`nvsim` crate — deterministic NV-diamond magnetometer pipeline simulator** (ADR-089) —
+  New standalone leaf crate at `v2/crates/nvsim` modeling a forward-only
+  magnetic sensing path: scene → source synthesis (Biot–Savart, dipole,
+  current loop, ferrous induced moment) → material attenuation
+  (Air/Drywall/Brick/Concrete/Reinforced/SteelSheet) → NV ensemble
+  (4 〈111〉 axes, ODMR linear-readout proxy, shot-noise floor per
+  Wolf 2015 / Barry 2020) → 16-bit ADC + lock-in demodulation →
+  fixed-layout `MagFrame` records → SHA-256 witness. Six-pass build
+  per `docs/research/quantum-sensing/15-nvsim-implementation-plan.md`.
+  50 tests, ~4.5 M samples/s on x86_64 (4500× the Cortex-A53 1 kHz
+  acceptance gate), pinned reference witness
+  `cc8de9b01b0ff5bd97a6c17848a3f156c174ea7589d0888164a441584ec593b4`
+  for byte-equivalence regression. WASM-ready by construction
+  (zero `std::time/fs/env/process/thread`); builds cleanly for
+  `wasm32-unknown-unknown`. ADR-090 (Proposed, conditional) tracks the
+  optional Lindblad/Hamiltonian extension if AC magnetometry, MW power
+  saturation, hyperfine spectroscopy, or pulsed protocols become required.
+
+### Fixed
+- **Ghost skeletons in live UI with multi-node ESP32 setups** (#420, ADR-082) —
+  `tracker_bridge::tracker_to_person_detections` documented itself as filtering
+  to `is_alive()` tracks but in fact passed every non-Terminated track to the
+  WebSocket stream. `Lost` tracks — kept inside `reid_window` for
+  re-identification but not currently observed — were rendering as phantom
+  skeletons, accumulating to 22-24 with 3 nodes × 10 Hz CSI while
+  `estimated_persons` correctly reported 1. Added
+  `PoseTracker::confirmed_tracks()` (Tentative + Active only) and rewired the
+  bridge to use it. Lost tracks remain in the tracker for re-ID; they just
+  no longer ship to the UI. Regression test:
+  `test_lost_tracks_excluded_from_bridge_output`.
+- **Rust workspace build with `--no-default-features` on Windows** (#366, #415) —
+  `wifi-densepose-mat`, `wifi-densepose-sensing-server`, and `wifi-densepose-train`
+  all depended on `wifi-densepose-signal` with default features enabled, which
+  pulled `ndarray-linalg` → `openblas-src` → vcpkg/system-BLAS through the entire
+  workspace. `--no-default-features` at the workspace root then could not opt out
+  of BLAS, breaking `cargo build` / `cargo test` on Windows without vcpkg. All
+  three consumers now declare `wifi-densepose-signal = { ..., default-features = false }`,
+  so `cargo test --workspace --no-default-features` builds cleanly without
+  vcpkg/openblas. Validated: 1,538 tests pass, 0 fail, 8 ignored.
+- **`signal` test `test_estimate_occupancy_noise_only` failed without `eigenvalue`** —
+  The test unwrapped the `NotCalibrated` stub returned when the BLAS-backed
+  `estimate_occupancy` is compiled out. Gated with `#[cfg(feature = "eigenvalue")]`
+  so it only runs when the real implementation is available.
+
+## [v0.6.2-esp32] — 2026-04-20
+
+Firmware release cutting ADR-081 and the Timer Svc stack fix discovered during
+on-hardware validation. Cut from `main` at commit pointing to this entry.
+Tested on ESP32-S3 (QFN56 rev v0.2, MAC `3c:0f:02:e9:b5:f8`), 30 s continuous
+run: no crashes, 149 `rv_feature_state_t` emissions (~5 Hz), medium/slow ticks
+firing cleanly, HEALTH mesh packets sent.
+
+### Fixed
+- **Firmware: Timer Svc stack overflow on ADR-081 fast loop** — `emit_feature_state()` runs inside the FreeRTOS Timer Svc task via the fast-loop callback; it calls `stream_sender` network I/O which pushes past the ESP-IDF 2 KiB default timer stack and panics ~1 s after boot. Bumped `CONFIG_FREERTOS_TIMER_TASK_STACK_DEPTH` to 8 KiB in `sdkconfig.defaults`, `sdkconfig.defaults.template`, and `sdkconfig.defaults.4mb`. Follow-up (tracked separately): move heavy work out of the timer daemon into a dedicated worker task.
+- **Firmware: `adaptive_controller.c` implicit declaration** (#404) — `fast_loop_cb` called `emit_feature_state()` before its static definition, triggering `-Werror=implicit-function-declaration`. Added a forward declaration above the first use.
+
+### Changed
+- **CI: firmware build matrix (8MB + 4MB)** — `firmware-ci.yml` now matrix-builds both the default 8MB (`sdkconfig.defaults`) and 4MB SuperMini (`sdkconfig.defaults.4mb`) variants, uploading distinct artifacts and producing variant-named release binaries (`esp32-csi-node.bin` / `esp32-csi-node-4mb.bin`, `partition-table.bin` / `partition-table-4mb.bin`).
+
+### Added
+- **ADR-081: Adaptive CSI Mesh Firmware Kernel** — New 5-layer architecture
+  (Radio Abstraction Layer / Adaptive Controller / Mesh Sensing Plane /
+  On-device Feature Extraction / Rust handoff) that reframes the existing
+  ESP32 firmware modules as components of a chipset-agnostic kernel. ADR
+  in `docs/adr/ADR-081-adaptive-csi-mesh-firmware-kernel.md`. Goal: swap
+  one radio family for another without changing the Rust signal /
+  ruvector / train / mat crates.
+- **Firmware: radio abstraction vtable (`rv_radio_ops_t`)** — New
+  `firmware/esp32-csi-node/main/rv_radio_ops.{h}` defines the
+  chipset-agnostic ops (init, set_channel, set_mode, set_csi_enabled,
+  set_capture_profile, get_health), profile enum
+  (`RV_PROFILE_PASSIVE_LOW_RATE` / `ACTIVE_PROBE` / `RESP_HIGH_SENS` /
+  `FAST_MOTION` / `CALIBRATION`), and health snapshot struct.
+  `rv_radio_ops_esp32.c` provides the ESP32 binding wrapping
+  `csi_collector` + `esp_wifi_*`. A second binding (mock or alternate
+  chipset) is the portability acceptance test for ADR-081.
+- **Firmware: `rv_feature_state_t` packet (magic `0xC5110006`)** — New
+  60-byte compact per-node sensing state (packed, verified by
+  `_Static_assert`) in `firmware/esp32-csi-node/main/rv_feature_state.h`:
+  motion, presence, respiration BPM/conf, heartbeat BPM/conf, anomaly
+  score, env-shift score, node coherence, quality flags, IEEE CRC32.
+  Replaces raw ADR-018 CSI as the default upstream stream (~99.7%
+  bandwidth reduction: 300 B/s at 5 Hz vs. ~100 KB/s raw).
+- **Firmware: mock radio ops binding for QEMU** — New
+  `firmware/esp32-csi-node/main/rv_radio_ops_mock.c`, compiled only when
+  `CONFIG_CSI_MOCK_ENABLED`. Satisfies ADR-081's portability acceptance
+  test: a second `rv_radio_ops_t` binding compiles and runs against the
+  same controller + mesh-plane code as the ESP32 binding.
+- **Firmware: feature-state emitter wired into controller fast loop** —
+  `adaptive_controller.c` now emits one 60-byte `rv_feature_state_t` per
+  fast tick (default 200 ms → 5 Hz), pulling from the latest edge vitals
+  and controller observation. This is the first end-to-end Layer 4/5
+  path for ADR-081.
+- **Firmware: `csi_collector_get_pkt_yield_per_sec()` /
+  `_get_send_fail_count()` accessors** — Expose the CSI callback rate
+  and UDP send-failure counter so the ESP32 radio ops binding can
+  populate `rv_radio_health_t.pkt_yield_per_sec` and `.send_fail_count`,
+  closing the adaptive controller's observation loop.
+- **Firmware: host-side unit test suite for ADR-081 pure logic** — New
+  `firmware/esp32-csi-node/tests/host/` (Makefile + 2 test files + shim
+  `esp_err.h`). Exercises `adaptive_controller_decide()` (9 test cases:
+  degraded gate on pkt-yield collapse + coherence loss, anomaly > motion,
+  motion → SENSE_ACTIVE, aggressive cadence, stable presence →
+  RESP_HIGH_SENS, empty-room default, hysteresis, NULL safety) and
+  `rv_feature_state_*` helpers (size assertion, IEEE CRC32 known
+  vectors, determinism, receiver-side verification). 33/33 assertions
+  pass. Benchmarks: decide() 3.2 ns/call, CRC32(56 B) 614 ns/pkt
+  (87 MB/s), full finalize() 616 ns/call. Pure function
+  `adaptive_controller_decide()` extracted to
+  `adaptive_controller_decide.c` so the firmware build and the host
+  tests share a single source-of-truth implementation.
+- **Scripts: `validate_qemu_output.py` ADR-081 checks** — Validator
+  (invoked by ADR-061 `scripts/qemu-esp32s3-test.sh` in CI) gains three
+  checks for adaptive controller boot line, mock radio ops
+  registration, and slow-loop heartbeat, so QEMU runs regression-gate
+  Layer 1/2 presence.
+- **Firmware: ADR-081 Layer 3 mesh sensing plane** — New
+  `firmware/esp32-csi-node/main/rv_mesh.{h,c}` defines 4 node roles
+  (Anchor / Observer / Fusion relay / Coordinator), 7 on-wire message
+  types (TIME_SYNC, ROLE_ASSIGN, CHANNEL_PLAN, CALIBRATION_START,
+  FEATURE_DELTA, HEALTH, ANOMALY_ALERT), 3 authorization classes
+  (None / HMAC-SHA256-session / Ed25519-batch), `rv_node_status_t`
+  (28 B), `rv_anomaly_alert_t` (28 B), `rv_time_sync_t`,
+  `rv_role_assign_t`, `rv_channel_plan_t`, `rv_calibration_start_t`.
+  Pure-C encoder/decoder (`rv_mesh_encode()` / `rv_mesh_decode()`) with
+  16-byte envelope + payload + IEEE CRC32 trailer; convenience encoders
+  for each message type. Controller now emits `HEALTH` every slow-loop
+  tick (30 s default) and `ANOMALY_ALERT` on state transitions to ALERT
+  or DEGRADED. Host tests: `test_rv_mesh` exercises 27 assertions
+  covering roundtrip, bad magic, truncation, CRC flipping, oversize
+  payload rejection, and encode+decode throughput (1.0 μs/roundtrip
+  on host).
+- **Rust: ADR-081 Layer 1/3 mirror module** — New
+  `crates/wifi-densepose-hardware/src/radio_ops.rs` mirrors the
+  firmware-side `rv_radio_ops_t` vtable as the Rust `RadioOps` trait
+  (init, set_channel, set_mode, set_csi_enabled, set_capture_profile,
+  get_health) and provides `MockRadio` for offline testing.
+  Also mirrors the `rv_mesh.h` types (`MeshHeader`, `NodeStatus`,
+  `AnomalyAlert`, `MeshRole`, `MeshMsgType`, `AuthClass`) and ships
+  byte-identical `crc32_ieee()`, `decode_mesh()`, `decode_node_status()`,
+  `decode_anomaly_alert()`, and `encode_health()`. Exported from
+  `lib.rs`. 8 unit tests pass; `crc32_matches_firmware_vectors`
+  verifies parity with the firmware-side test vectors
+  (`0xCBF43926` for `"123456789"`, `0xD202EF8D` for single-byte zero),
+  and `mesh_constants_match_firmware` asserts `MESH_MAGIC`,
+  `MESH_VERSION`, `MESH_HEADER_SIZE`, and `MESH_MAX_PAYLOAD` match
+  `rv_mesh.h` byte-for-byte. Satisfies ADR-081's portability
+  acceptance test: signal/ruvector/train/mat crates are untouched.
+- **Firmware: adaptive controller** — New
+  `firmware/esp32-csi-node/main/adaptive_controller.{c,h}` implements
+  the three-loop closed-loop control specified by ADR-081: fast
+  (~200 ms) for cadence and active probing, medium (~1 s) for channel
+  selection and role transitions, slow (~30 s) for baseline
+  recalibration. Pure `adaptive_controller_decide()` policy function is
+  exposed in the header for offline unit testing. Default policy is
+  conservative (`enable_channel_switch` and `enable_role_change` off);
+  Kconfig surface added under "Adaptive Controller (ADR-081)".
+
+### Fixed
+- **Firmware: SPI flash cache crash under high CSI callback pressure** (RuView#396, #397) — ESP32-S3 nodes crashed in `cache_ll_l1_resume_icache` / `wDev_ProcessFiq` after ~2400 callbacks when the promiscuous filter admitted DATA frames at 100–500 Hz. Fixed by narrowing the filter mask to `WIFI_PROMIS_FILTER_MASK_MGMT` (~10 Hz beacons), adding a 50 Hz early callback rate gate (`CSI_MIN_PROCESS_INTERVAL_US`) that drops excess callbacks before any processing work, and enabling `CONFIG_ESP_WIFI_EXTRA_IRAM_OPT=y` as defense-in-depth. Stability validated with a 4-min-per-node soak.
+- **Firmware: `filter_mac` / `node_id` clobber by WiFi driver init** (#232, #375, #385, #386, #390, #397) — `g_nvs_config` can be corrupted during `wifi_init_sta()` on some devices (confirmed on `80:b5:4e:c1:be:b8`), reverting `node_id` to the Kconfig default and producing garbage MAC-filter reads in the CSI callback (100–500 Hz). New `csi_collector_set_node_id()` API called from `app_main()` **before** `wifi_init_sta()` captures both fields into module-local statics (`s_node_id`, `s_filter_mac`, `s_filter_mac_set`). `csi_collector_init()` now runs a canary that distinguishes "early≠g_nvs_config" (corruption confirmed) from a no-op match. All CSI runtime paths use the defensive copies exclusively.
+- **Firmware: `edge_processing` sample rate mismatch** (#397) — `estimate_bpm_zero_crossing()` was called with a hard-coded `sample_rate = 20.0f`, but MGMT-only promiscuous delivers ~10 Hz. Breathing and heart-rate reports were 2× too high. Corrected to `10.0f` with an explicit comment tying it to the callback rate.
+- **`provision.py` esptool command form** (#391, #397) — ESP-IDF v5.4 bundles `esptool 4.10.0`, which only accepts `write_flash` (underscore). Standalone `pip install esptool` v5.x accepts both forms but prefers `write-flash`. #391 switched to `write-flash` which broke the documented ESP-IDF Python venv flow; #397 reverts to `write_flash` (works with both esptool 4.x and 5.x) with an inline comment warning future maintainers not to "re-fix" it.
+- **`provision.py` esptool v5 dry-run hint** (#391) — Stale `write_flash` (underscore) syntax in the dry-run manual-flash hint now uses `write-flash` (hyphenated) for esptool >= 5.x. The primary flash command was already correct.
+- **`provision.py` silent NVS wipe** (#391) — The script replaces the entire `csi_cfg` NVS namespace on every run, so partial invocations were silently erasing WiFi credentials and causing `Retrying WiFi connection (10/10)` in the field. Now refuses to run without `--ssid`, `--password`, and `--target-ip` unless `--force-partial` is passed. `--force-partial` prints a warning listing which keys will be wiped.
+- **Firmware: defensive `node_id` capture** (#232, #375, #385, #386, #390) — Users on multi-node deployments reported `node_id` reverting to the Kconfig default (`1`) in UDP frames and in the `csi_collector` init log, despite NVS loading the correct value. The root cause (memory corruption of `g_nvs_config`) has not been definitively isolated, but the UDP frame header is now tamper-proof: `csi_collector_init()` captures `g_nvs_config.node_id` into a module-local `s_node_id` once, and `csi_serialize_frame()` plus all other consumers (`edge_processing.c`, `wasm_runtime.c`, `display_ui.c`, `swarm_bridge_init`) read it via the new `csi_collector_get_node_id()` accessor. A canary logs `WARN` if `g_nvs_config.node_id` diverges from `s_node_id` at end-of-init, helping isolate the upstream corruption path. Validated on attached ESP32-S3 (COM8): NVS `node_id=2` propagates through boot log, capture log, init log, and byte[4] of every UDP frame.
+
+### Docs
+- **CHANGELOG catch-up** (#367) — Added missing entries for v0.5.5, v0.6.0, and v0.7.0 releases.
+
+## [v0.7.0] — 2026-04-06
+
+Model release (no new firmware binary). Firmware remains at v0.6.0-esp32.
+
+### Added
+- **Camera ground-truth training pipeline (ADR-079)** — End-to-end supervised WiFlow pose training using MediaPipe + real ESP32 CSI.
+  - `scripts/collect-ground-truth.py` — MediaPipe PoseLandmarker webcam capture (17 COCO keypoints, 30fps), synchronized with CSI recording over nanosecond timestamps.
+  - `scripts/align-ground-truth.js` — Time-aligns camera keypoints with 20-frame CSI windows by binary search, confidence-weighted averaging.
+  - `scripts/train-wiflow-supervised.js` — 3-phase curriculum training (contrastive → supervised SmoothL1 → bone/temporal refinement) with 4 scale presets (lite/small/medium/full).
+  - `scripts/eval-wiflow.js` — PCK@10/20/50, MPJPE, per-joint breakdown, baseline proxy mode.
+  - `scripts/record-csi-udp.py` — Lightweight ESP32 CSI UDP recorder (no Rust build required).
+- **ruvector optimizations (O6-O10)** — Subcarrier selection (70→35, 50% reduction), attention-weighted subcarriers, Stoer-Wagner min-cut person separation, multi-SPSA gradient estimation, Mac M4 Pro training via Tailscale.
+- **Scalable WiFlow presets** — `lite` (189K params, ~19 min) through `full` (7.7M params, ~8 hrs) to match dataset size.
+- **Pre-trained WiFlow v1 model** — 92.9% PCK@20, 974 KB, 186,946 params. Published to [HuggingFace](https://huggingface.co/ruv/ruview) under `wiflow-v1/`.
+
+### Validated
+- **92.9% PCK@20** pose accuracy from a 5-minute data collection session with one $9 ESP32-S3 and one laptop webcam.
+- Training pipeline validated on real paired data: 345 samples, 19 min training, eval loss 0.082, bone constraint 0.008.
+
+## [v0.6.0-esp32] — 2026-04-03
+
+### Added
+- **Pre-trained CSI sensing weights published** — First official pre-trained models on [HuggingFace](https://huggingface.co/ruv/ruview). `model.safetensors` (48 KB), `model-q4.bin` (8 KB 4-bit), `model-q2.bin` (4 KB), `presence-head.json`, per-node LoRA adapters.
+- **17 sensing applications** — Sleep monitor, apnea detector, stress monitor, gait analyzer, RF tomography, passive radar, material classifier, through-wall detector, device fingerprint, and more. Each as a standalone `scripts/*.js`.
+- **ADRs 069-078** — 10 new architecture decisions covering Cognitum Seed integration, self-supervised pretraining, ruvllm pipeline, WiFlow architecture, channel hopping, SNN, MinCut person separation, CNN spectrograms, novel RF applications, multi-frequency mesh.
+- **Kalman tracker** (PR #341 by @taylorjdawson) — temporal smoothing of pose keypoints.
+
+### Fixed
+- Security fix merged via PR #310.
+
+### Performance
+- Presence detection: 100% accuracy on 60,630 overnight samples.
+- Inference: 0.008 ms per sample, 164K embeddings/sec.
+- Contrastive self-supervised training: 51.6% improvement over baseline.
+
+## [v0.5.5-esp32] — 2026-04-03
+
+### Added
+- **WiFlow SOTA architecture (ADR-072)** — TCN + axial attention pose decoder, 1.8M params, 881 KB at 4-bit. 17 COCO keypoints from CSI amplitude only (no phase).
+- **Multi-frequency mesh scanning (ADR-073)** — ESP32 nodes hop across channels 1/3/5/6/9/11 at 200ms dwell. Neighbor WiFi networks used as passive radar illuminators. Null subcarriers reduced from 19% to 16%.
+- **Spiking neural network (ADR-074)** — STDP online learning, adapts to new rooms in <30s with no labels, 16-160x less compute than batch training.
+- **MinCut person counting (ADR-075)** — Stoer-Wagner min-cut on subcarrier correlation graph. Fixes #348 (was always reporting 4 people).
+- **CNN spectrogram embeddings (ADR-076)** — Treat 64×20 CSI as an image, produce 128-dim environment fingerprints (0.95+ same-room similarity).
+- **Graph transformer fusion** — Multi-node CSI fusion via GATv2 attention (replaces naive averaging).
+- **Camera-free pose training pipeline** — Trains 17-keypoint model from 10 sensor signals with no camera required.
+
+### Fixed
+- **#348 person counting** — MinCut correctly counts 1-4 people (24/24 validation windows).
+
+## [v0.5.4-esp32] — 2026-04-02
+
+### Added
+- **ADR-069: ESP32 CSI → Cognitum Seed RVF ingest pipeline** — Live-validated pipeline connecting ESP32-S3 CSI sensing to Cognitum Seed (Pi Zero 2 W) edge intelligence appliance. 339 vectors ingested, 100% kNN validation, SHA-256 witness chain verified.
+- **Feature vector packet (magic 0xC5110003)** — New 48-byte packet with 8 normalized dimensions (presence, motion, breathing, heart rate, phase variance, person count, fall, RSSI) sent at 1 Hz alongside vitals.
+- **`scripts/seed_csi_bridge.py`** — Python bridge: UDP listener → HTTPS ingest with bearer token auth, `--validate` (kNN + PIR ground truth), `--stats`, `--compact` modes, hash-based vector IDs, NaN/inf rejection, source IP filtering, retry logic.
+- **Arena Physica research** — 26 research documents in `docs/research/` covering Maxwell's equations in WiFi sensing, Arena Physica Studio analysis, SOTA WiFi sensing 2025-2026, GOAP implementation plan for ESP32 + Pi Zero.
+- **Cognitum Seed MCP integration** — 114-tool MCP proxy enables AI assistants to query sensing state, vectors, witness chain, and device status directly.
+
+### Fixed
+- **Compressed frame magic collision** — Reassigned compressed frame magic from `0xC5110003` to `0xC5110005` to free `0xC5110003` for feature vectors.
+- **Uninitialized `s_top_k[0]` read** — Guarded variance computation against `s_top_k_count == 0` in `send_feature_vector()`.
+- **Presence score normalization** — Bridge now divides by 15.0 instead of clamping, preserving dynamic range for raw values 1.41-14.92.
+- **Stale magic references** — Updated ADR-039, DDD model to reflect `0xC5110005` for compressed frames.
+
+### Security
+- **Credential exposure remediation** — Removed hardcoded WiFi passwords and bearer tokens from source files. Added NVS binary/CSV patterns to `.gitignore`. Environment variable fallback for bearer token.
+- **NaN/Inf injection prevention** — Bridge validates all feature dimensions are finite before Seed ingest.
+- **UDP source filtering** — `--allowed-sources` argument restricts packet acceptance to known ESP32 IPs.
+
+### Changed
+- Wire format table now includes 6 magic numbers: `0xC5110001` (raw), `0xC5110002` (vitals), `0xC5110003` (features), `0xC5110004` (WASM events), `0xC5110005` (compressed), `0xC5110006` (fused vitals).
+
+## [v0.5.3-esp32] — 2026-03-30
+
+### Added
+- **Cross-node RSSI-weighted feature fusion** — Multiple ESP32 nodes fuse CSI features using RSSI-based weighting. Closer node gets higher weight. Reduces variance noise by 29%, keypoint jitter by 72%.
+- **DynamicMinCut person separation** — Uses `ruvector_mincut::DynamicMinCut` on the subcarrier temporal correlation graph to detect independent motion clusters. Replaces variance-based heuristic for multi-person counting.
+- **RSSI-based position tracking** — Skeleton position driven by RSSI differential between nodes. Walk between ESP32s and the skeleton follows you.
+- **Per-node state pipeline (ADR-068)** — Each ESP32 node gets independent `HashMap<u8, NodeState>` with frame history, classification, vitals, and person count. Fixes #249 (the #1 user-reported issue).
+- **RuVector Phase 1-3 integration** — Subcarrier importance weighting, temporal keypoint smoothing (EMA), coherence gating, skeleton kinematic constraints (Jakobsen relaxation), compressed pose history.
+- **Client-side lerp smoothing** — UI keypoints interpolate between frames (alpha=0.15) for fluid skeleton movement.
+- **Multi-node mesh tests** — 8 integration tests covering 1-255 node configurations.
+- **`wifi_densepose` Python package** — `from wifi_densepose import WiFiDensePose` now works (#314).
+
+### Fixed
+- **Watchdog crash on busy LANs (#321)** — Batch-limited edge_dsp to 4 frames before 20ms yield. Fixed idle-path busy-spin (`pdMS_TO_TICKS(5)==0`).
+- **No detection from edge vitals (#323)** — Server now generates `sensing_update` from Tier 2+ vitals packets.
+- **RSSI byte offset mismatch (#332)** — Server parsed RSSI from wrong byte (was reading sequence counter).
+- **Stack overflow risk** — Moved 4KB of BPM scratch buffers from stack to static storage.
+- **Stale node memory leak** — `node_states` HashMap evicts nodes inactive >60s.
+- **Unsafe raw pointer removed** — Replaced with safe `.clone()` for adaptive model borrow.
+- **Firmware CI** — Upgraded to IDF v5.4, replaced `xxd` with `od` (#327).
+- **Person count double-counting** — Multi-node aggregation changed from `sum` to `max`.
+- **Skeleton jitter** — Removed tick-based noise, dampened procedural animation, recalibrated feature scaling for real ESP32 data.
+
+### Changed
+- Motion-responsive skeleton: arm swing (0-80px) driven by CSI variance, leg kick (0-50px) by motion_band_power, vertical bob when walking.
+- Person count thresholds recalibrated for real ESP32 hardware (1→2 at 0.70, EMA alpha 0.04).
+- Vital sign filtering: larger median window (31), faster EMA (0.05), looser HR jump filter (15 BPM).
+- Vendored ruvector updated to v2.1.0-40 (316 commits ahead).
+
+### Benchmarks (2-node mesh, COM6 + COM9, 30s)
+| Metric | Baseline | v0.5.3 | Improvement |
+|--------|----------|--------|-------------|
+| Variance noise | 109.4 | 77.6 | **-29%** |
+| Feature stability | std=154.1 | std=105.4 | **-32%** |
+| Keypoint jitter | std=4.5px | std=1.3px | **-72%** |
+| Confidence | 0.643 | 0.686 | **+7%** |
+| Presence accuracy | 93.4% | 94.6% | **+1.3pp** |
+
+### Verified
+- Real hardware: COM6 (node 1) + COM9 (node 2) on ruv.net WiFi
+- All 284 Rust tests pass, 352 signal crate tests pass
+- Firmware builds clean at 843 KB
+- QEMU CI: 11/11 jobs green
+
+## [v0.5.2-esp32] — 2026-03-28
+
+### Fixed
+- RSSI byte offset in frame parser (#332)
+- Per-node state pipeline for multi-node sensing (#249)
+- Firmware CI upgraded to IDF v5.4 (#327)
+
+## [v0.5.1-esp32] — 2026-03-27
+
+### Fixed
+- Watchdog crash on busy LANs (#321)
+- No detection from edge vitals (#323)
+- `wifi_densepose` Python package import (#314)
+- Pre-compiled firmware binaries added to release
+
+## [v0.5.0-esp32] — 2026-03-15
+
+### Added
+- **60 GHz mmWave sensor fusion (ADR-063)** — Auto-detects Seeed MR60BHA2 (60 GHz, HR/BR/presence) and HLK-LD2410 (24 GHz, presence/distance) on UART at boot. Probes 115200 then 256000 baud, registers device capabilities, starts background parser.
+- **48-byte fused vitals packet** (magic `0xC5110004`) — Kalman-style fusion: mmWave 80% + CSI 20% when both available. Automatic fallback to standard 32-byte CSI-only packet.
+- **Server-side fusion bridge** (`scripts/mmwave_fusion_bridge.py`) — Reads two serial ports simultaneously for dual-sensor setups where mmWave runs on a separate ESP32.
+- **Multimodal ambient intelligence roadmap (ADR-064)** — 25+ applications from fall detection to sleep monitoring to RF tomography.
+
+### Verified
+- Real hardware: ESP32-S3 (COM7) WiFi CSI + ESP32-C6/MR60BHA2 (COM4) 60 GHz mmWave running concurrently. HR=75 bpm, BR=25/min at 52 cm range. All 11 QEMU CI jobs green.
+
+## [v0.4.3-esp32] — 2026-03-15
+
+### Fixed
+- **Fall detection false positives (#263)** — Default threshold raised from 2.0 to 15.0 rad/s²; normal walking (2-5 rad/s²) no longer triggers alerts. Added 3-consecutive-frame debounce and 5-second cooldown between alerts. Verified on real ESP32-S3 hardware: 0 false alerts in 60s / 1,300+ live WiFi CSI frames.
+- **Kconfig default mismatch** — `CONFIG_EDGE_FALL_THRESH` Kconfig default was still 2000 (=2.0) while `nvs_config.c` fallback was updated to 15.0. Fixed Kconfig to 15000. Caught by real hardware testing — mock data did not reproduce.
+- **provision.py NVS generator API change** — `esp_idf_nvs_partition_gen` package changed its `generate()` signature; switched to subprocess-first invocation for cross-version compatibility.
+- **QEMU CI pipeline (11 jobs)** — Fixed all failures: fuzz test `esp_timer` stubs, QEMU `libgcrypt` dependency, NVS matrix generator, IDF container `pip` path, flash image padding, validation WARN handling, swarm `ip`/`cargo` missing.
+
+### Added
+- **4MB flash support (#265)** — `partitions_4mb.csv` and `sdkconfig.defaults.4mb` for ESP32-S3 boards with 4MB flash (e.g. SuperMini). Dual OTA slots, 1.856 MB each. Thanks to @sebbu for the community workaround that confirmed feasibility.
+- **`--strict` flag** for `validate_qemu_output.py` — WARNs now pass by default in CI (no real WiFi in QEMU); use `--strict` to fail on warnings.
+
+## [Unreleased]
+
+### Added
+- **QEMU ESP32-S3 testing platform (ADR-061)** — 9-layer firmware testing without hardware
+  - Mock CSI generator with 10 physics-based scenarios (empty room, walking, fall, multi-person, etc.)
+  - Single-node QEMU runner with 16-check UART validation
+  - Multi-node TDM mesh simulation (TAP networking, 2-6 nodes)
+  - GDB remote debugging with VS Code integration
+  - Code coverage via gcov/lcov + apptrace
+  - Fuzz testing (3 libFuzzer targets + ASAN/UBSAN)
+  - NVS provisioning matrix (14 configs)
+  - Snapshot-based regression testing (sub-second VM restore)
+  - Chaos testing with fault injection + health monitoring
+- **QEMU Swarm Configurator (ADR-062)** — YAML-driven multi-ESP32 test orchestration
+  - 4 topologies: star, mesh, line, ring
+  - 3 node roles: sensor, coordinator, gateway
+  - 9 swarm-level assertions (boot, crashes, TDM, frame rate, fall detection, etc.)
+  - 7 presets: smoke (2n/15s), standard (3n/60s), ci-matrix, large-mesh, line-relay, ring-fault, heterogeneous
+  - Health oracle with cross-node validation
+- **QEMU installer** (`install-qemu.sh`) — auto-detects OS, installs deps, builds Espressif QEMU fork
+- **Unified QEMU CLI** (`qemu-cli.sh`) — single entry point for all 11 QEMU test commands
+- CI: `firmware-qemu.yml` workflow with QEMU test matrix, fuzz testing, NVS validation, and swarm test jobs
+- User guide: QEMU testing and swarm configurator section with plain-language walkthrough
+
+### Fixed
+- Firmware now boots in QEMU: WiFi/UDP/OTA/display guards for mock CSI mode
+- 9 bugs in mock_csi.c (LFSR bias, MAC filter init, scenario loop, overflow burst timing)
+- 23 bugs from ADR-061 deep review (inject_fault.py writes, CI cache, snapshot log corruption, etc.)
+- 16 bugs from ADR-062 deep review (log filename mismatch, SLIRP port collision, heap false positives, etc.)
+- All scripts: `--help` flags, prerequisite checks with install hints, standardized exit codes
+
+- **Sensing server UI API completion (ADR-043)** — 14 fully-functional REST endpoints for model management, CSI recording, and training control
+  - Model CRUD: `GET /api/v1/models`, `GET /api/v1/models/active`, `POST /api/v1/models/load`, `POST /api/v1/models/unload`, `DELETE /api/v1/models/:id`, `GET /api/v1/models/lora/profiles`, `POST /api/v1/models/lora/activate`
+  - CSI recording: `GET /api/v1/recording/list`, `POST /api/v1/recording/start`, `POST /api/v1/recording/stop`, `DELETE /api/v1/recording/:id`
+  - Training control: `GET /api/v1/train/status`, `POST /api/v1/train/start`, `POST /api/v1/train/stop`
+  - Recording writes CSI frames to `.jsonl` files via tokio background task
+  - Model/recording directories scanned at startup, state managed via `Arc<RwLock<AppStateInner>>`
+- **ADR-044: Provisioning tool enhancements** — 5-phase plan for complete NVS coverage (7 missing keys), JSON config files, mesh presets, read-back/verify, and auto-detect
+- **25 real mobile tests** replacing `it.todo()` placeholders — 205 assertions covering components, services, stores, hooks, screens, and utils
+- **Project MERIDIAN (ADR-027)** — Cross-environment domain generalization for WiFi pose estimation (1,858 lines, 72 tests)
+  - `HardwareNormalizer` — Catmull-Rom cubic interpolation resamples any hardware CSI to canonical 56 subcarriers; z-score + phase sanitization
+  - `DomainFactorizer` + `GradientReversalLayer` — adversarial disentanglement of pose-relevant vs environment-specific features
+  - `GeometryEncoder` + `FilmLayer` — Fourier positional encoding + DeepSets + FiLM for zero-shot deployment given AP positions
+  - `VirtualDomainAugmentor` — synthetic environment diversity (room scale, wall material, scatterers, noise) for 4x training augmentation
+  - `RapidAdaptation` — 10-second unsupervised calibration via contrastive test-time training + LoRA adapters
+  - `CrossDomainEvaluator` — 6-metric evaluation protocol (MPJPE in-domain/cross-domain/few-shot/cross-hardware, domain gap ratio, adaptation speedup)
+- ADR-027: Cross-Environment Domain Generalization — 10 SOTA citations (PerceptAlign, X-Fi ICLR 2025, AM-FM, DGSense, CVPR 2024)
+- **Cross-platform RSSI adapters** — macOS CoreWLAN (`MacosCoreWlanScanner`) and Linux `iw` (`LinuxIwScanner`) Rust adapters with `#[cfg(target_os)]` gating
+- macOS CoreWLAN Python sensing adapter with Swift helper (`mac_wifi.swift`)
+- macOS synthetic BSSID generation (FNV-1a hash) for Sonoma 14.4+ BSSID redaction
+- Linux `iw dev <iface> scan` parser with freq-to-channel conversion and `scan dump` (no-root) mode
+- ADR-025: macOS CoreWLAN WiFi Sensing (ORCA)
+
+### Fixed
+- **sendto ENOMEM crash (Issue #127)** — CSI callbacks in promiscuous mode exhaust lwIP pbuf pool causing guru meditation crash. Fixed with 50 Hz rate limiter in `csi_collector.c` and 100 ms ENOMEM backoff in `stream_sender.c`. Hardware-verified on ESP32-S3 (200+ callbacks, zero crashes)
+- **Provisioning script missing TDM/edge flags (Issue #130)** — Added `--tdm-slot`, `--tdm-total`, `--edge-tier`, `--pres-thresh`, `--fall-thresh`, `--vital-win`, `--vital-int`, `--subk-count` to `provision.py`
+- **WebSocket "RECONNECTING" on Dashboard/Live Demo** — `sensingService.start()` now called on app init in `app.js` so WebSocket connects immediately instead of waiting for Sensing tab visit
+- **Mobile WebSocket port** — `ws.service.ts` `buildWsUrl()` uses same-origin port instead of hardcoded port 3001
+- **Mobile Jest config** — `testPathIgnorePatterns` no longer silently ignores the entire test directory
+- Removed synthetic byte counters from Python `MacosWifiCollector` — now reports `tx_bytes=0, rx_bytes=0` instead of fake incrementing values
+
+---
+
+## [3.0.0] - 2026-03-01
+
+Major release: AETHER contrastive embedding model, Docker Hub images, and comprehensive UI overhaul.
+
+### Added — AETHER Contrastive Embedding Model (ADR-024)
+- **Project AETHER** — self-supervised contrastive learning for WiFi CSI fingerprinting, similarity search, and anomaly detection (`9bbe956`)
+- `embedding.rs` module: `ProjectionHead`, `InfoNceLoss`, `CsiAugmenter`, `FingerprintIndex`, `PoseEncoder`, `EmbeddingExtractor` (909 lines, zero external ML dependencies)
+- SimCLR-style pretraining with 5 physically-motivated augmentations (temporal jitter, subcarrier masking, Gaussian noise, phase rotation, amplitude scaling)
+- CLI flags: `--pretrain`, `--pretrain-epochs`, `--embed`, `--build-index <type>`
+- Four HNSW-compatible fingerprint index types: `env_fingerprint`, `activity_pattern`, `temporal_baseline`, `person_track`
+- Cross-modal `PoseEncoder` for WiFi-to-camera embedding alignment
+- VICReg regularization for embedding collapse prevention
+- 53K total parameters (55 KB at INT8) — fits on ESP32
+
+### Added — Docker & Deployment
+- Published Docker Hub images: `ruvnet/wifi-densepose:latest` (132 MB Rust) and `ruvnet/wifi-densepose:python` (569 MB) (`add9f19`)
+- Multi-stage Dockerfile for Rust sensing server with RuVector crates
+- `docker-compose.yml` orchestrating both Rust and Python services
+- RVF model export via `--export-rvf` and load via `--load-rvf` CLI flags
+
+### Added — Documentation
+- 33 use cases across 4 vertical tiers: Everyday, Specialized, Robotics & Industrial, Extreme (`0afd9c5`)
+- "Why WiFi Wins" comparison table (WiFi vs camera vs LIDAR vs wearable vs PIR)
+- Mermaid architecture diagrams: end-to-end pipeline, signal processing detail, deployment topology (`50f0fc9`)
+- Models & Training section with RuVector crate links (GitHub + crates.io), SONA component table (`965a1cc`)
+- RVF container section with deployment targets table (ESP32 0.7 MB to server 50+ MB)
+- Collapsible README sections for improved navigation (`478d964`, `99ec980`, `0ebd6be`)
+- Installation and Quick Start moved above Table of Contents (`50acbf7`)
+- CSI hardware requirement notice (`528b394`)
+
+### Fixed
+- **UI auto-detects server port from page origin** — no more hardcoded `localhost:8080`; works on any port (Docker :3000, native :8080, custom) (`3b72f35`, closes #55)
+- **Docker port mismatch** — server now binds 3000/3001 inside container as documented (`44b9c30`)
+- Added `/ws/sensing` WebSocket route to the HTTP server so UI only needs one port
+- Fixed README API endpoint references: `/api/v1/health` → `/health`, `/api/v1/sensing` → `/api/v1/sensing/latest`
+- Multi-person tracking limit corrected: configurable default 10, no hard software cap (`e2ce250`)
+
+---
+
+## [2.0.0] - 2026-02-28
+
+Major release: complete Rust sensing server, full DensePose training pipeline, RuVector v2.0.4 integration, ESP32-S3 firmware, and 6 security hardening patches.
+
+### Added — Rust Sensing Server
+- **Full DensePose-compatible REST API** served by Axum (`d956c30`)
+  - `GET /health` — server health
+  - `GET /api/v1/sensing/latest` — live CSI sensing data
+  - `GET /api/v1/vital-signs` — breathing rate (6-30 BPM) and heartbeat (40-120 BPM)
+  - `GET /api/v1/pose/current` — 17 COCO keypoints derived from WiFi signal field
+  - `GET /api/v1/info` — server build and feature info
+  - `GET /api/v1/model/info` — RVF model container metadata
+  - `ws://host/ws/sensing` — real-time WebSocket stream
+- Three data sources: `--source esp32` (UDP CSI), `--source windows` (netsh RSSI), `--source simulated` (deterministic reference)
+- Auto-detection: server probes ESP32 UDP and Windows WiFi, falls back to simulated
+- Three.js visualization UI with 3D body skeleton, signal heatmap, phase plot, Doppler bars, vital signs panel
+- Static UI serving via `--ui-path` flag
+- Throughput: 9,520–11,665 frames/sec (release build)
+
+### Added — ADR-021: Vital Sign Detection
+- `VitalSignDetector` with breathing (6-30 BPM) and heartbeat (40-120 BPM) extraction from CSI fluctuations (`1192de9`)
+- FFT-based spectral analysis with configurable band-pass filters
+- Confidence scoring based on spectral peak prominence
+- REST endpoint `/api/v1/vital-signs` with real-time JSON output
+
+### Added — ADR-023: DensePose Training Pipeline (Phases 1-8)
+- `wifi-densepose-train` crate with complete 8-phase pipeline (`fc409df`, `ec98e40`, `fce1271`)
+  - Phase 1: `DataPipeline` with MM-Fi and Wi-Pose dataset loaders
+  - Phase 2: `CsiToPoseTransformer` — 4-head cross-attention + 2-layer GCN on COCO skeleton
+  - Phase 3: 6-term composite loss (MSE, bone length, symmetry, joint angle, temporal, confidence)
+  - Phase 4: `DynamicPersonMatcher` via ruvector-mincut (O(n^1.5 log n) Hungarian assignment)
+  - Phase 5: `SonaAdapter` — MicroLoRA rank-4 with EWC++ memory preservation
+  - Phase 6: `SparseInference` — progressive 3-layer model loading (A: essential, B: refinement, C: full)
+  - Phase 7: `RvfContainer` — single-file model packaging with segment-based binary format
+  - Phase 8: End-to-end training with cosine-annealing LR, early stopping, checkpoint saving
+- CLI: `--train`, `--dataset`, `--epochs`, `--save-rvf`, `--load-rvf`, `--export-rvf`
+- Benchmark: ~11,665 fps inference, 229 tests passing
+
+### Added — ADR-016: RuVector Training Integration (all 5 crates)
+- `ruvector-mincut` → `DynamicPersonMatcher` in `metrics.rs` + subcarrier selection (`81ad09d`, `a7dd31c`)
+- `ruvector-attn-mincut` → antenna attention in `model.rs` + noise-gated spectrogram
+- `ruvector-temporal-tensor` → `CompressedCsiBuffer` in `dataset.rs` + compressed breathing/heartbeat
+- `ruvector-solver` → sparse subcarrier interpolation (114→56) + Fresnel triangulation
+- `ruvector-attention` → spatial attention in `model.rs` + attention-weighted BVP
+- Vendored all 11 RuVector crates under `vendor/ruvector/` (`d803bfe`)
+
+### Added — ADR-017: RuVector Signal & MAT Integration (7 integration points)
+- `gate_spectrogram()` — attention-gated noise suppression (`18170d7`)
+- `attention_weighted_bvp()` — sensitivity-weighted velocity profiles
+- `mincut_subcarrier_partition()` — dynamic sensitive/insensitive subcarrier split
+- `solve_fresnel_geometry()` — TX-body-RX distance estimation
+- `CompressedBreathingBuffer` + `CompressedHeartbeatSpectrogram`
+- `BreathingDetector` + `HeartbeatDetector` (MAT crate, real FFT + micro-Doppler)
+- Feature-gated behind `cfg(feature = "ruvector")` (`ab2453e`)
+
+### Added — ADR-018: ESP32-S3 Firmware & Live CSI Pipeline
+- ESP32-S3 firmware with FreeRTOS CSI extraction (`92a5182`)
+- ADR-018 binary frame format: `[0xAD, 0x18, len_hi, len_lo, payload]`
+- Rust `Esp32Aggregator` receiving UDP frames on port 5005
+- `bridge.rs` converting I/Q pairs to amplitude/phase vectors
+- NVS provisioning for WiFi credentials
+- Pre-built binary quick start documentation (`696a726`)
+
+### Added — ADR-014: SOTA Signal Processing
+- 6 algorithms, 83 tests (`fcb93cc`)
+  - Hampel filter (median + MAD, resistant to 50% contamination)
+  - Conjugate multiplication (reference-antenna ratio, cancels common-mode noise)
+  - Phase sanitization (unwrap + linear detrend, removes CFO/SFO)
+  - Fresnel zone geometry (TX-body-RX distance from first-principles physics)
+  - Body Velocity Profile (micro-Doppler extraction, 5.7x speedup)
+  - Attention-gated spectrogram (learned noise suppression)
+
+### Added — ADR-015: Public Dataset Training Strategy
+- MM-Fi and Wi-Pose dataset specifications with download links (`4babb32`, `5dc2f66`)
+- Verified dataset dimensions, sampling rates, and annotation formats
+- Cross-dataset evaluation protocol
+
+### Added — WiFi-Mat Disaster Detection Module
+- Multi-AP triangulation for through-wall survivor detection (`a17b630`, `6b20ff0`)
+- Triage classification (breathing, heartbeat, motion)
+- Domain events: `survivor_detected`, `survivor_updated`, `alert_created`
+- WebSocket broadcast at `/ws/mat/stream`
+
+### Added — Infrastructure
+- Guided 7-step interactive installer with 8 hardware profiles (`8583f3e`)
+- Comprehensive build guide for Linux, macOS, Windows, Docker, ESP32 (`45f8a0d`)
+- 12 Architecture Decision Records (ADR-001 through ADR-012) (`337dd96`)
+
+### Added — UI & Visualization
+- Sensing-only UI mode with Gaussian splat visualization (`b7e0f07`)
+- Three.js 3D body model (17 joints, 16 limbs) with signal-viz components
+- Tabs: Dashboard, Hardware, Live Demo, Sensing, Architecture, Performance, Applications
+- WebSocket client with automatic reconnection and exponential backoff
+
+### Added — Rust Signal Processing Crate
+- Complete Rust port of WiFi-DensePose with modular workspace (`6ed69a3`)
+  - `wifi-densepose-signal` — CSI processing, phase sanitization, feature extraction
+  - `wifi-densepose-core` — shared types and configuration
+  - `wifi-densepose-nn` — neural network inference (DensePose head, RCNN)
+  - `wifi-densepose-hardware` — ESP32 aggregator, hardware interfaces
+  - `wifi-densepose-config` — configuration management
+- Comprehensive benchmarks and validation tests (`3ccb301`)
+
+### Added — Python Sensing Pipeline
+- `WindowsWifiCollector` — RSSI collection via `netsh wlan show networks`
+- `RssiFeatureExtractor` — variance, spectral bands (motion 0.5-4 Hz, breathing 0.1-0.5 Hz), change points
+- `PresenceClassifier` — rule-based 3-state classification (ABSENT / PRESENT_STILL / ACTIVE)
+- Cross-receiver agreement scoring for multi-AP confidence boosting
+- WebSocket sensing server (`ws_server.py`) broadcasting JSON at 2 Hz
+- Deterministic CSI proof bundles for reproducible verification (`archive/v1/data/proof/`)
+- Commodity sensing unit tests (`b391638`)
+
+### Changed
+- Rust hardware adapters now return explicit errors instead of silent empty data (`6e0e539`)
+
+### Fixed
+- Review fixes for end-to-end training pipeline (`45f0304`)
+- Dockerfile paths updated from `src/` to `archive/v1/src/` (`7872987`)
+- IoT profile installer instructions updated for aggregator CLI (`f460097`)
+- `process.env` reference removed from browser ES module (`e320bc9`)
+
+### Performance
+- 5.7x Doppler extraction speedup via optimized FFT windowing (`32c75c8`)
+- Single 2.1 MB static binary, zero Python dependencies for Rust server
+
+### Security
+- Fix SQL injection in status command and migrations (`f9d125d`)
+- Fix XSS vulnerabilities in UI components (`5db55fd`)
+- Fix command injection in statusline.cjs (`4cb01fd`)
+- Fix path traversal vulnerabilities (`896c4fc`)
+- Fix insecure WebSocket connections — enforce wss:// on non-localhost (`ac094d4`)
+- Fix GitHub Actions shell injection (`ab2e7b4`)
+- Fix 10 additional vulnerabilities, remove 12 dead code instances (`7afdad0`)
+
+---
+
 ## [1.1.0] - 2025-06-07

 ### Added
- Multi-column table of contents in README.md for improved navigation
- Enhanced documentation structure with better organization
- Improved visual layout for better user experience
+- Complete Python WiFi-DensePose system with CSI data extraction and router interface
+- CSI processing and phase sanitization modules
+- Batch processing for CSI data in `CSIProcessor` and `PhaseSanitizer`
+- Hardware, pose, and stream services for WiFi-DensePose API
+- Comprehensive CSS styles for UI components and dark mode support
+- API and Deployment documentation

-### Changed
- Updated README.md table of contents to use a two-column layout
- Reorganized documentation sections for better logical flow
- Enhanced readability of navigation structure
+### Fixed
+- Badge links for PyPI and Docker in README
+- Async engine creation poolclass specification

-### Documentation
- Restructured table of contents for better accessibility
- Improved visual hierarchy in documentation
- Enhanced user experience for documentation navigation
+---

 ## [1.0.0] - 2024-12-01

 ### Added
- Initial release of WiFi DensePose
- Real-time WiFi-based human pose estimation using CSI data
- DensePose neural network integration
- RESTful API with comprehensive endpoints
- WebSocket streaming for real-time data
- Multi-person tracking capabilities
+- Initial release of WiFi-DensePose
+- Real-time WiFi-based human pose estimation using Channel State Information (CSI)
+- DensePose neural network integration for body surface mapping
+- RESTful API with comprehensive endpoint coverage
+- WebSocket streaming for real-time pose data
+- Multi-person tracking with configurable capacity (default 10, up to 50+)
 - Fall detection and activity recognition
- Healthcare, fitness, smart home, and security domain configurations
- Comprehensive CLI interface
- Docker and Kubernetes deployment support
- 100% test coverage
- Production-ready monitoring and logging
- Hardware abstraction layer for multiple WiFi devices
- Phase sanitization and signal processing
+- Domain configurations: healthcare, fitness, smart home, security
+- CLI interface for server management and configuration
+- Hardware abstraction layer for multiple WiFi chipsets
+- Phase sanitization and signal processing pipeline
 - Authentication and rate limiting
 - Background task management
- Database integration with PostgreSQL and Redis
- Prometheus metrics and Grafana dashboards
- Comprehensive documentation and examples
-
-### Features
- Privacy-preserving pose detection without cameras
- Sub-50ms latency with 30 FPS processing
- Support for up to 10 simultaneous person tracking
- Enterprise-grade security and scalability
- Cross-platform compatibility (Linux, macOS, Windows)
- GPU acceleration support
- Real-time analytics and alerting
- Configurable confidence thresholds
- Zone-based occupancy monitoring
- Historical data analysis
- Performance optimization tools
- Load testing capabilities
- Infrastructure as Code (Terraform, Ansible)
- CI/CD pipeline integration
- Comprehensive error handling and logging
+- Cross-platform support (Linux, macOS, Windows)

 ### Documentation
- Complete user guide and API reference
+- User guide and API reference
 - Deployment and troubleshooting guides
 - Hardware setup and calibration instructions
- Performance benchmarks and optimization tips
- Contributing guidelines and code standards
- Security best practices
- Example configurations and use cases
+- Performance benchmarks
+- Contributing guidelines
+
+[Unreleased]: https://github.com/ruvnet/wifi-densepose/compare/v3.0.0...HEAD
+[3.0.0]: https://github.com/ruvnet/wifi-densepose/compare/v2.0.0...v3.0.0
+[2.0.0]: https://github.com/ruvnet/wifi-densepose/compare/v1.1.0...v2.0.0
+[1.1.0]: https://github.com/ruvnet/wifi-densepose/compare/v1.0.0...v1.1.0
+[1.0.0]: https://github.com/ruvnet/wifi-densepose/releases/tag/v1.0.0
@@ -3,14 +3,51 @@
 ## Project: wifi-densepose

 WiFi-based human pose estimation using Channel State Information (CSI).
-Dual codebase: Python v1 (`v1/`) and Rust port (`rust-port/wifi-densepose-rs/`).
-
+Dual codebase: Python v1 (`v1/`) and Rust port (`v2/`).
 ### Key Rust Crates
- `wifi-densepose-signal` — SOTA signal processing (conjugate mult, Hampel, Fresnel, BVP, spectrogram)
- `wifi-densepose-train` — Training pipeline with ruvector integration (ADR-016)
- `wifi-densepose-mat` — Disaster detection module (MAT, multi-AP, triage)
- `wifi-densepose-nn` — Neural network inference (DensePose head, RCNN)
- `wifi-densepose-hardware` — ESP32 aggregator, hardware interfaces
+| Crate | Description |
+|-------|-------------|
+| `wifi-densepose-core` | Core types, traits, error types, CSI frame primitives |
+| `wifi-densepose-signal` | SOTA signal processing + RuvSense multistatic sensing (14 modules) |
+| `wifi-densepose-nn` | Neural network inference (ONNX, PyTorch, Candle backends) |
+| `wifi-densepose-train` | Training pipeline with ruvector integration + ruview_metrics |
+| `wifi-densepose-mat` | Mass Casualty Assessment Tool — disaster survivor detection |
+| `wifi-densepose-hardware` | ESP32 aggregator, TDM protocol, channel hopping firmware |
+| `wifi-densepose-ruvector` | RuVector v2.0.4 integration + cross-viewpoint fusion (5 modules) |
+| `wifi-densepose-api` | REST API (Axum) |
+| `wifi-densepose-db` | Database layer (Postgres, SQLite, Redis) |
+| `wifi-densepose-config` | Configuration management |
+| `wifi-densepose-wasm` | WebAssembly bindings for browser deployment |
+| `wifi-densepose-cli` | CLI tool (`wifi-densepose` binary) |
+| `wifi-densepose-sensing-server` | Lightweight Axum server for WiFi sensing UI |
+| `wifi-densepose-wifiscan` | Multi-BSSID WiFi scanning (ADR-022) |
+| `wifi-densepose-vitals` | ESP32 CSI-grade vital sign extraction (ADR-021) |
+| `nvsim` | Deterministic NV-diamond magnetometer pipeline simulator (ADR-089) — standalone leaf, WASM-ready |
+
+### RuvSense Modules (`signal/src/ruvsense/`)
+| Module | Purpose |
+|--------|---------|
+| `multiband.rs` | Multi-band CSI frame fusion, cross-channel coherence |
+| `phase_align.rs` | Iterative LO phase offset estimation, circular mean |
+| `multistatic.rs` | Attention-weighted fusion, geometric diversity |
+| `coherence.rs` | Z-score coherence scoring, DriftProfile |
+| `coherence_gate.rs` | Accept/PredictOnly/Reject/Recalibrate gate decisions |
+| `pose_tracker.rs` | 17-keypoint Kalman tracker with AETHER re-ID embeddings |
+| `field_model.rs` | SVD room eigenstructure, perturbation extraction |
+| `tomography.rs` | RF tomography, ISTA L1 solver, voxel grid |
+| `longitudinal.rs` | Welford stats, biomechanics drift detection |
+| `intention.rs` | Pre-movement lead signals (200-500ms) |
+| `cross_room.rs` | Environment fingerprinting, transition graph |
+| `gesture.rs` | DTW template matching gesture classifier |
+| `adversarial.rs` | Physically impossible signal detection, multi-link consistency |
+
+### Cross-Viewpoint Fusion (`ruvector/src/viewpoint/`)
+| Module | Purpose |
+|--------|---------|
+| `attention.rs` | CrossViewpointAttention, GeometricBias, softmax with G_bias |
+| `geometry.rs` | GeometricDiversityIndex, Cramer-Rao bounds, Fisher Information |
+| `coherence.rs` | Phase phasor coherence, hysteresis gate |
+| `fusion.rs` | MultistaticArray aggregate root, domain events |

 ### RuVector v2.0.4 Integration (ADR-016 complete, ADR-017 proposed)
 All 5 ruvector crates integrated in workspace:
@@ -21,33 +58,141 @@ All 5 ruvector crates integrated in workspace:
 - `ruvector-attention` → `model.rs` (apply_spatial_attention) + `bvp.rs`

 ### Architecture Decisions
-All ADRs in `docs/adr/` (ADR-001 through ADR-017). Key ones:
+43 ADRs in `docs/adr/` (ADR-001 through ADR-043). Key ones:
 - ADR-014: SOTA signal processing (Accepted)
 - ADR-015: MM-Fi + Wi-Pose training datasets (Accepted)
 - ADR-016: RuVector training pipeline integration (Accepted — complete)
 - ADR-017: RuVector signal + MAT integration (Proposed — next target)
+- ADR-024: Contrastive CSI embedding / AETHER (Accepted)
+- ADR-027: Cross-environment domain generalization / MERIDIAN (Accepted)
+- ADR-028: ESP32 capability audit + witness verification (Accepted)
+- ADR-029: RuvSense multistatic sensing mode (Proposed)
+- ADR-030: RuvSense persistent field model (Proposed)
+- ADR-031: RuView sensing-first RF mode (Proposed)
+- ADR-032: Multistatic mesh security hardening (Proposed)
+
+### Supported Hardware
+
+| Device | Port | Chip | Role | Cost |
+|--------|------|------|------|------|
+| ESP32-S3 (8MB flash) | COM7 | Xtensa dual-core | WiFi CSI sensing node | ~$9 |
+| ESP32-S3 SuperMini (4MB) | — | Xtensa dual-core | WiFi CSI (compact) | ~$6 |
+| ESP32-C6 + Seeed MR60BHA2 | COM4 | RISC-V + 60 GHz FMCW | mmWave HR/BR/presence | ~$15 |
+| HLK-LD2410 | — | 24 GHz FMCW | Presence + distance | ~$3 |
+
+**Not supported:** ESP32 (original), ESP32-C3 — single-core, can't run CSI DSP pipeline.

 ### Build & Test Commands (this repo)
 ```bash
-# Rust — check training crate (no GPU needed)
-cd rust-port/wifi-densepose-rs
+# Rust — full workspace tests (1,031+ tests, ~2 min)
+cd v2
+cargo test --workspace --no-default-features
+
+# Rust — single crate check (no GPU needed)
 cargo check -p wifi-densepose-train --no-default-features

-# Rust — run all tests
-cargo test -p wifi-densepose-train --no-default-features
-
-# Rust — full workspace check
-cargo check --workspace --no-default-features
-
-# Python — proof verification
-python v1/data/proof/verify.py
+# Python — deterministic proof verification (SHA-256)
+python archive/v1/data/proof/verify.py

 # Python — test suite
-cd v1 && python -m pytest tests/ -x -q
+cd archive/v1 && python -m pytest tests/ -x -q
 ```

+### ESP32 Firmware Build (Windows — Python subprocess required)
+```bash
+# Build 8MB firmware (real WiFi CSI mode, no mocks)
+# See CLAUDE.local.md for the full Python subprocess command
+# Key: must strip MSYSTEM env vars for ESP-IDF v5.4 on Git Bash
+
+# Build 4MB firmware
+cp sdkconfig.defaults.4mb sdkconfig.defaults
+# then same build process
+
+# Flash to COM7
+# [python, idf_py, '-p', 'COM7', 'flash']
+
+# Provision WiFi
+python firmware/esp32-csi-node/provision.py --port COM7 \
+  --ssid "YourWiFi" --password "secret" --target-ip 192.168.1.20
+
+# Monitor serial
+python -m serial.tools.miniterm COM7 115200
+```
+
+### Firmware Release Process
+1. Build 8MB from `sdkconfig.defaults.template` (no mock)
+2. Build 4MB from `sdkconfig.defaults.4mb` (no mock)
+3. Save 6 binaries: `esp32-csi-node.bin`, `bootloader.bin`, `partition-table.bin`, `ota_data_initial.bin`, `esp32-csi-node-4mb.bin`, `partition-table-4mb.bin`
+4. Tag: `git tag v0.X.Y-esp32 && git push origin v0.X.Y-esp32`
+5. Release: `gh release create v0.X.Y-esp32 <binaries> --title "..." --notes-file ...`
+6. Verify on real hardware (COM7) before publishing
+7. **CRITICAL:** Always test with real WiFi CSI, not mock mode — mock missed the Kconfig threshold bug
+
+### Crate Publishing Order
+Crates must be published in dependency order:
+1. `wifi-densepose-core` (no internal deps)
+2. `wifi-densepose-vitals` (no internal deps)
+3. `wifi-densepose-wifiscan` (no internal deps)
+4. `wifi-densepose-hardware` (no internal deps)
+5. `wifi-densepose-config` (no internal deps)
+6. `wifi-densepose-db` (no internal deps)
+7. `wifi-densepose-signal` (depends on core)
+8. `wifi-densepose-nn` (no internal deps, workspace only)
+9. `wifi-densepose-ruvector` (no internal deps, workspace only)
+10. `wifi-densepose-train` (depends on signal, nn)
+11. `wifi-densepose-mat` (depends on core, signal, nn)
+12. `wifi-densepose-api` (no internal deps)
+13. `wifi-densepose-wasm` (depends on mat)
+14. `wifi-densepose-sensing-server` (depends on wifiscan)
+15. `wifi-densepose-cli` (depends on mat)
+
+### Validation & Witness Verification (ADR-028)
+
+**After any significant code change, run the full validation:**
+
+```bash
+# 1. Rust tests — must be 1,031+ passed, 0 failed
+cd v2
+cargo test --workspace --no-default-features
+
+# 2. Python proof — must print VERDICT: PASS
+cd ..
+python archive/v1/data/proof/verify.py
+
+# 3. Generate witness bundle (includes both above + firmware hashes)
+bash scripts/generate-witness-bundle.sh
+
+# 4. Self-verify the bundle — must be 7/7 PASS
+cd dist/witness-bundle-ADR028-*/
+bash VERIFY.sh
+```
+
+**If the Python proof hash changes** (e.g., numpy/scipy version update):
+```bash
+# Regenerate the expected hash, then verify it passes
+python archive/v1/data/proof/verify.py --generate-hash
+python archive/v1/data/proof/verify.py
+```
+
+**Witness bundle contents** (`dist/witness-bundle-ADR028-<sha>.tar.gz`):
+- `WITNESS-LOG-028.md` — 33-row attestation matrix with evidence per capability
+- `ADR-028-esp32-capability-audit.md` — Full audit findings
+- `proof/verify.py` + `expected_features.sha256` — Deterministic pipeline proof
+- `test-results/rust-workspace-tests.log` — Full cargo test output
+- `firmware-manifest/source-hashes.txt` — SHA-256 of all 7 ESP32 firmware files
+- `crate-manifest/versions.txt` — All 15 crates with versions
+- `VERIFY.sh` — One-command self-verification for recipients
+
+**Key proof artifacts:**
+- `archive/v1/data/proof/verify.py` — Trust Kill Switch: feeds reference signal through production pipeline, hashes output
+- `archive/v1/data/proof/expected_features.sha256` — Published expected hash
+- `archive/v1/data/proof/sample_csi_data.json` — 1,000 synthetic CSI frames (seed=42)
+- `docs/WITNESS-LOG-028.md` — 11-step reproducible verification procedure
+- `docs/adr/ADR-028-esp32-capability-audit.md` — Complete audit record
+
 ### Branch
-All development on: `claude/validate-code-quality-WNrNw`
+Default branch: `main`
+Active feature branch: `ruvsense-full-implementation` (PR #77)

 ---

@@ -65,10 +210,15 @@ All development on: `claude/validate-code-quality-WNrNw`
 ## File Organization

 - NEVER save to root folder — use the directories below
- `docs/adr/` — Architecture Decision Records
- `rust-port/wifi-densepose-rs/crates/` — Rust workspace crates (signal, train, mat, nn, hardware)
- `v1/src/` — Python source (core, hardware, services, api)
- `v1/data/proof/` — Deterministic CSI proof bundles
+- `docs/adr/` — Architecture Decision Records (43 ADRs)
+- `docs/ddd/` — Domain-Driven Design models
+- `v2/crates/` — Rust workspace crates (15 crates)
+- `v2/crates/wifi-densepose-signal/src/ruvsense/` — RuvSense multistatic modules (14 files)
+- `v2/crates/wifi-densepose-ruvector/src/viewpoint/` — Cross-viewpoint fusion (5 files)
+- `v2/crates/wifi-densepose-hardware/src/esp32/` — ESP32 TDM protocol
+- `firmware/esp32-csi-node/main/` — ESP32 C firmware (channel hopping, NVS config, TDM)
+- `archive/v1/src/` — Python source (core, hardware, services, api)
+- `archive/v1/data/proof/` — Deterministic CSI proof bundles
 - `.claude-flow/` — Claude Flow coordination state (committed for team sharing)
 - `.claude/` — Claude Code settings, agents, memory (committed for team sharing)

@@ -89,6 +239,23 @@ All development on: `claude/validate-code-quality-WNrNw`
 - **HNSW**: Enabled
 - **Neural**: Enabled

+## Pre-Merge Checklist
+
+Before merging any PR, verify each item applies and is addressed:
+
+1. **Rust tests pass** — `cargo test --workspace --no-default-features` (1,031+ passed, 0 failed)
+2. **Python proof passes** — `python archive/v1/data/proof/verify.py` (VERDICT: PASS)
+3. **README.md** — Update platform tables, crate descriptions, hardware tables, feature summaries if scope changed
+4. **CLAUDE.md** — Update crate table, ADR list, module tables, version if scope changed
+5. **CHANGELOG.md** — Add entry under `[Unreleased]` with what was added/fixed/changed
+6. **User guide** (`docs/user-guide.md`) — Update if new data sources, CLI flags, or setup steps were added
+7. **ADR index** — Update ADR count in README docs table if a new ADR was created
+8. **Witness bundle** — Regenerate if tests or proof hash changed: `bash scripts/generate-witness-bundle.sh`
+9. **Docker Hub image** — Only rebuild if Dockerfile, dependencies, or runtime behavior changed
+10. **Crate publishing** — Only needed if a crate is published to crates.io and its public API changed
+11. **`.gitignore`** — Add any new build artifacts or binaries
+12. **Security audit** — Run security review for new modules touching hardware/network boundaries
+
 ## Build & Test

 ```bash
@@ -1,104 +0,0 @@
-# Multi-stage build for WiFi-DensePose production deployment
-FROM python:3.11-slim as base
-
-# Set environment variables
-ENV PYTHONUNBUFFERED=1 \
-    PYTHONDONTWRITEBYTECODE=1 \
-    PIP_NO_CACHE_DIR=1 \
-    PIP_DISABLE_PIP_VERSION_CHECK=1
-
-# Install system dependencies
-RUN apt-get update && apt-get install -y \
-    build-essential \
-    curl \
-    git \
-    libopencv-dev \
-    python3-opencv \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create app user
-RUN groupadd -r appuser && useradd -r -g appuser appuser
-
-# Set work directory
-WORKDIR /app
-
-# Copy requirements first for better caching
-COPY requirements.txt .
-
-# Install Python dependencies
-RUN pip install --no-cache-dir -r requirements.txt
-
-# Development stage
-FROM base as development
-
-# Install development dependencies
-RUN pip install --no-cache-dir \
-    pytest \
-    pytest-asyncio \
-    pytest-mock \
-    pytest-benchmark \
-    black \
-    flake8 \
-    mypy
-
-# Copy source code
-COPY . .
-
-# Change ownership to app user
-RUN chown -R appuser:appuser /app
-
-USER appuser
-
-# Expose port
-EXPOSE 8000
-
-# Development command
-CMD ["uvicorn", "v1.src.api.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]
-
-# Production stage
-FROM base as production
-
-# Copy only necessary files
-COPY requirements.txt .
-COPY v1/src/ ./v1/src/
-COPY assets/ ./assets/
-
-# Create necessary directories
-RUN mkdir -p /app/logs /app/data /app/models
-
-# Change ownership to app user
-RUN chown -R appuser:appuser /app
-
-USER appuser
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
-    CMD curl -f http://localhost:8000/health || exit 1
-
-# Expose port
-EXPOSE 8000
-
-# Production command
-CMD ["uvicorn", "v1.src.api.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "4"]
-
-# Testing stage
-FROM development as testing
-
-# Copy test files
-COPY v1/tests/ ./v1/tests/
-
-# Run tests
-RUN python -m pytest v1/tests/ -v
-
-# Security scanning stage
-FROM production as security
-
-# Install security scanning tools
-USER root
-RUN pip install --no-cache-dir safety bandit
-
-# Run security scans
-RUN safety check
-RUN bandit -r v1/src/ -f json -o /tmp/bandit-report.json
-
-USER appuser
@@ -1,271 +0,0 @@
-# WiFi-DensePose Package Manifest
-# This file specifies which files to include in the source distribution
-
-# Include essential project files
-include README.md
-include LICENSE
-include CHANGELOG.md
-include pyproject.toml
-include setup.py
-include requirements.txt
-include requirements-dev.txt
-
-# Include configuration files
-include *.cfg
-include *.ini
-include *.yaml
-include *.yml
-include *.toml
-include .env.example
-
-# Include documentation
-recursive-include docs *
-include docs/Makefile
-include docs/make.bat
-
-# Include source code
-recursive-include src *.py
-recursive-include src *.pyx
-recursive-include src *.pxd
-
-# Include configuration and data files
-recursive-include src *.yaml
-recursive-include src *.yml
-recursive-include src *.json
-recursive-include src *.toml
-recursive-include src *.cfg
-recursive-include src *.ini
-
-# Include model files
-recursive-include src/models *.pth
-recursive-include src/models *.onnx
-recursive-include src/models *.pt
-recursive-include src/models *.pkl
-recursive-include src/models *.joblib
-
-# Include database migrations
-recursive-include src/database/migrations *.py
-recursive-include src/database/migrations *.sql
-
-# Include templates and static files
-recursive-include src/templates *.html
-recursive-include src/templates *.jinja2
-recursive-include src/static *.css
-recursive-include src/static *.js
-recursive-include src/static *.png
-recursive-include src/static *.jpg
-recursive-include src/static *.svg
-recursive-include src/static *.ico
-
-# Include test files
-recursive-include tests *.py
-recursive-include tests *.yaml
-recursive-include tests *.yml
-recursive-include tests *.json
-
-# Include test data
-recursive-include tests/data *
-recursive-include tests/fixtures *
-
-# Include scripts
-recursive-include scripts *.py
-recursive-include scripts *.sh
-recursive-include scripts *.bat
-recursive-include scripts *.ps1
-
-# Include deployment files
-include Dockerfile
-include docker-compose.yml
-include docker-compose.*.yml
-recursive-include k8s *.yaml
-recursive-include k8s *.yml
-recursive-include terraform *.tf
-recursive-include terraform *.tfvars
-recursive-include ansible *.yml
-recursive-include ansible *.yaml
-
-# Include monitoring and logging configurations
-recursive-include monitoring *.yml
-recursive-include monitoring *.yaml
-recursive-include monitoring *.json
-recursive-include logging *.yml
-recursive-include logging *.yaml
-recursive-include logging *.json
-
-# Include CI/CD configurations
-include .github/workflows/*.yml
-include .github/workflows/*.yaml
-include .gitlab-ci.yml
-include .travis.yml
-include .circleci/config.yml
-include azure-pipelines.yml
-include Jenkinsfile
-
-# Include development tools configuration
-include .pre-commit-config.yaml
-include .gitignore
-include .gitattributes
-include .editorconfig
-include .flake8
-include .isort.cfg
-include .mypy.ini
-include .bandit
-include .safety-policy.json
-
-# Include package metadata
-include PKG-INFO
-include *.egg-info/*
-
-# Include version and build information
-include VERSION
-include BUILD_INFO
-
-# Exclude unnecessary files
-global-exclude *.pyc
-global-exclude *.pyo
-global-exclude *.pyd
-global-exclude __pycache__
-global-exclude .DS_Store
-global-exclude .git*
-global-exclude *.so
-global-exclude *.dylib
-global-exclude *.dll
-
-# Exclude development and temporary files
-global-exclude .pytest_cache
-global-exclude .mypy_cache
-global-exclude .coverage
-global-exclude htmlcov
-global-exclude .tox
-global-exclude .venv
-global-exclude venv
-global-exclude env
-global-exclude .env
-global-exclude node_modules
-global-exclude npm-debug.log*
-global-exclude yarn-debug.log*
-global-exclude yarn-error.log*
-
-# Exclude IDE files
-global-exclude .vscode
-global-exclude .idea
-global-exclude *.swp
-global-exclude *.swo
-global-exclude *~
-
-# Exclude build artifacts
-global-exclude build
-global-exclude dist
-global-exclude *.egg-info
-global-exclude .eggs
-
-# Exclude log files
-global-exclude *.log
-global-exclude logs
-
-# Exclude backup files
-global-exclude *.bak
-global-exclude *.backup
-global-exclude *.orig
-
-# Exclude OS-specific files
-global-exclude Thumbs.db
-global-exclude desktop.ini
-
-# Exclude sensitive files
-global-exclude .env.local
-global-exclude .env.production
-global-exclude secrets.yaml
-global-exclude secrets.yml
-global-exclude private_key*
-global-exclude *.pem
-global-exclude *.key
-
-# Exclude large data files (should be downloaded separately)
-global-exclude *.h5
-global-exclude *.hdf5
-global-exclude *.npz
-global-exclude *.tar.gz
-global-exclude *.zip
-global-exclude *.rar
-
-# Exclude compiled extensions
-global-exclude *.c
-global-exclude *.cpp
-global-exclude *.o
-global-exclude *.obj
-
-# Include specific important files that might be excluded by global patterns
-include src/models/README.md
-include tests/data/README.md
-include docs/assets/README.md
-
-# Include license files in subdirectories
-recursive-include * LICENSE*
-recursive-include * COPYING*
-
-# Include changelog and version files
-recursive-include * CHANGELOG*
-recursive-include * HISTORY*
-recursive-include * NEWS*
-recursive-include * VERSION*
-
-# Include requirements files
-include requirements*.txt
-include constraints*.txt
-include environment*.yml
-include Pipfile
-include Pipfile.lock
-include poetry.lock
-
-# Include makefile and build scripts
-include Makefile
-include makefile
-include build.sh
-include build.bat
-include install.sh
-include install.bat
-
-# Include package configuration for different package managers
-include setup.cfg
-include tox.ini
-include noxfile.py
-include conftest.py
-
-# Include security and compliance files
-include SECURITY.md
-include CODE_OF_CONDUCT.md
-include CONTRIBUTING.md
-include SUPPORT.md
-
-# Include API documentation
-recursive-include docs/api *.md
-recursive-include docs/api *.rst
-recursive-include docs/api *.yaml
-recursive-include docs/api *.yml
-recursive-include docs/api *.json
-
-# Include example configurations
-recursive-include examples *.py
-recursive-include examples *.yaml
-recursive-include examples *.yml
-recursive-include examples *.json
-recursive-include examples *.md
-
-# Include schema files
-recursive-include src/schemas *.json
-recursive-include src/schemas *.yaml
-recursive-include src/schemas *.yml
-recursive-include src/schemas *.xsd
-
-# Include localization files
-recursive-include src/locales *.po
-recursive-include src/locales *.pot
-recursive-include src/locales *.mo
-
-# Include font and asset files
-recursive-include src/assets *.ttf
-recursive-include src/assets *.otf
-recursive-include src/assets *.woff
-recursive-include src/assets *.woff2
-recursive-include src/assets *.eot
@@ -1,112 +0,0 @@
-# A generic, single database configuration.
-
-[alembic]
-# path to migration scripts
-script_location = src/database/migrations
-
-# template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
-# Uncomment the line below if you want the files to be prepended with date and time
-# file_template = %%(year)d_%%(month).2d_%%(day).2d_%%(hour).2d%%(minute).2d-%%(rev)s_%%(slug)s
-
-# sys.path path, will be prepended to sys.path if present.
-# defaults to the current working directory.
-prepend_sys_path = .
-
-# timezone to use when rendering the date within the migration file
-# as well as the filename.
-# If specified, requires the python-dateutil library that can be
-# installed by adding `alembic[tz]` to the pip requirements
-# string value is passed to dateutil.tz.gettz()
-# leave blank for localtime
-# timezone =
-
-# max length of characters to apply to the
-# "slug" field
-# truncate_slug_length = 40
-
-# set to 'true' to run the environment during
-# the 'revision' command, regardless of autogenerate
-# revision_environment = false
-
-# set to 'true' to allow .pyc and .pyo files without
-# a source .py file to be detected as revisions in the
-# versions/ directory
-# sourceless = false
-
-# version number format
-version_num_format = %04d
-
-# version path separator; As mentioned above, this is the character used to split
-# version_locations. The default within new alembic.ini files is "os", which uses
-# os.pathsep. If this key is omitted entirely, it falls back to the legacy
-# behavior of splitting on spaces and/or commas.
-# Valid values for version_path_separator are:
-#
-# version_path_separator = :
-# version_path_separator = ;
-# version_path_separator = space
-version_path_separator = os
-
-# set to 'true' to search source files recursively
-# in each "version_locations" directory
-# new in Alembic version 1.10
-# recursive_version_locations = false
-
-# the output encoding used when revision files
-# are written from script.py.mako
-# output_encoding = utf-8
-
-sqlalchemy.url = sqlite:///./data/wifi_densepose_fallback.db
-
-
-[post_write_hooks]
-# post_write_hooks defines scripts or Python functions that are run
-# on newly generated revision scripts.  See the documentation for further
-# detail and examples
-
-# format using "black" - use the console_scripts runner, against the "black" entrypoint
-# hooks = black
-# black.type = console_scripts
-# black.entrypoint = black
-# black.options = -l 79 REVISION_SCRIPT_FILENAME
-
-# lint with attempts to fix using "ruff" - use the exec runner, execute a binary
-# hooks = ruff
-# ruff.type = exec
-# ruff.executable = %(here)s/.venv/bin/ruff
-# ruff.options = --fix REVISION_SCRIPT_FILENAME
-
-# Logging configuration
-[loggers]
-keys = root,sqlalchemy,alembic
-
-[handlers]
-keys = console
-
-[formatters]
-keys = generic
-
-[logger_root]
-level = WARN
-handlers = console
-qualname =
-
-[logger_sqlalchemy]
-level = WARN
-handlers =
-qualname = sqlalchemy.engine
-
-[logger_alembic]
-level = INFO
-handlers =
-qualname = alembic
-
-[handler_console]
-class = StreamHandler
-args = (sys.stderr,)
-level = NOTSET
-formatter = generic
-
-[formatter_generic]
-format = %(levelname)-5.5s [%(name)s] %(message)s
-datefmt = %H:%M:%S
@@ -0,0 +1,74 @@
+# Archive
+
+Frozen, no-longer-active components of RuView preserved for historical
+reference, reproducibility, and load-bearing legacy paths the active
+codebase still depends on.
+
+## What lives here
+
+| Path | What it is | Why it's archived | Still load-bearing? |
+|------|------------|-------------------|---------------------|
+| `v1/` | Original Python implementation of RuView (CSI processing, hardware adapters, services, FastAPI) | Superseded by the Rust workspace at `v2/`; ~810× slower in benchmarks. Kept rather than deleted because the deterministic proof bundle (`v1/data/proof/`) is part of the pre-merge witness verification process per ADR-011 / ADR-028. | **Yes — for the proof bundle only.** Active code lives in `v2/`. |
+
+## What "archived" means
+
+- **Do not add new features here.** New work goes in `v2/`.
+- **Do not refactor or modernize the archived code beyond what is
+  strictly necessary** to keep the load-bearing paths working. The
+  Python proof bundle is intentionally frozen so that its SHA-256
+  reproducibility holds across releases (per ADR-028's witness
+  verification requirement).
+- **Bug fixes inside archived code are allowed** when the bug affects a
+  still-load-bearing path (currently: only the Python proof). All
+  other "bugs" in archived code are out-of-scope — they are part of
+  the historical record and any fix would unnecessarily churn the
+  witness hashes.
+- **CI continues to verify the load-bearing paths.**
+  `.github/workflows/verify-pipeline.yml` runs the Python proof on
+  every push and PR; if you change anything inside `archive/v1/src/`
+  or `archive/v1/data/proof/`, expect the determinism check to flag
+  it.
+
+## Quick reference for the load-bearing paths
+
+```bash
+# Run the deterministic Python proof (must print VERDICT: PASS)
+python archive/v1/data/proof/verify.py
+
+# Regenerate the expected hash (only if numpy/scipy version legitimately changed)
+python archive/v1/data/proof/verify.py --generate-hash
+
+# Run the full Python test suite (legacy, still maintained)
+cd archive/v1&& python -m pytest tests/ -x -q
+```
+
+## Why we keep `v1/` rather than delete it
+
+1. **Trust kill-switch.** The proof at `v1/data/proof/verify.py` feeds
+   a known reference signal through the full pipeline and hashes the
+   output. If the active code's behavior drifts, the hash changes and
+   CI fails. This is what stops accidental regression in the science
+   layer of the codebase.
+
+2. **Witness verification.** ADR-028's witness-bundle process bundles
+   the proof, the rust workspace test results, and firmware hashes
+   into a tarball recipients can self-verify. Removing v1 would break
+   that chain.
+
+3. **Historical reference.** ADR-011 documents the "no mocks in
+   production code" decision; the original violations and their fixes
+   live in this Python codebase. The ADRs reference these paths.
+
+If the time comes to retire the proof bundle (e.g., a Rust port of
+the proof exists and the Python version is no longer canonical), the
+right move is a single follow-up that simultaneously: ports the
+witness-bundle process, updates `verify-pipeline.yml`, and either
+deletes `archive/v1/` or moves it to a separate read-only repository.
+That decision belongs in its own ADR.
+
+## See also
+
+- `docs/adr/ADR-011-python-proof-of-reality-mock-elimination.md`
+- `docs/adr/ADR-028-esp32-capability-audit.md`
+- `archive/v1/data/proof/README.md` (if present)
+- `docs/WITNESS-LOG-028.md`
@@ -51,4 +51,4 @@ pytest tests/

 ## Note

-This is the legacy Python implementation. For the new Rust implementation with improved performance, see `/rust-port/wifi-densepose-rs/`.
+This is the legacy Python implementation. For the new Rust implementation with improved performance, see `/v2/`.
@@ -0,0 +1 @@
+8c0680d7d285739ea9597715e84959d9c356c87ee3ad35b5f1e69a4ca41151c6
@@ -17,7 +17,7 @@ from starlette.exceptions import HTTPException as StarletteHTTPException

 from src.config.settings import get_settings
 from src.config.domains import get_domain_config
-from src.api.routers import pose, stream, health
+from src.api.routers import pose, stream, health, auth
 from src.api.middleware.auth import AuthMiddleware
 from src.api.middleware.rate_limit import RateLimitMiddleware
 from src.api.dependencies import get_pose_service, get_stream_service, get_hardware_service
@@ -263,6 +263,12 @@ app.include_router(
    tags=["Streaming"]
 )

+app.include_router(
+    auth.router,
+    prefix=f"{settings.api_prefix}",
+    tags=["Authentication"]
+)
+

 # Root endpoint
@app.get("/")
@@ -189,7 +189,11 @@ class AuthMiddleware(BaseHTTPMiddleware):
                self.settings.secret_key,
                algorithms=[self.settings.jwt_algorithm]
            )
-            
+
+            # Check token blacklist (logout invalidation)
+            if token_blacklist.is_blacklisted(token):
+                raise ValueError("Token has been revoked")
+
            # Extract user information
            user_id = payload.get("sub")
            if not user_id:
@@ -0,0 +1,7 @@
+"""
+API routers package
+"""
+
+from . import pose, stream, health, auth
+
+__all__ = ["pose", "stream", "health", "auth"]
@@ -0,0 +1,32 @@
+"""
+Authentication router for WiFi-DensePose API.
+Provides logout (token blacklisting) endpoint.
+"""
+
+import logging
+from typing import Optional
+
+from fastapi import APIRouter, Request, HTTPException, status
+
+from src.api.middleware.auth import token_blacklist
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post("/logout")
+async def logout(request: Request):
+    """Logout by blacklisting the current Bearer token."""
+    auth_header = request.headers.get("authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Missing or invalid Authorization header",
+        )
+
+    token = auth_header.split(" ", 1)[1]
+    token_blacklist.add_token(token)
+    logger.info("Token blacklisted via /auth/logout")
+
+    return {"success": True, "message": "Token revoked"}
@@ -137,7 +137,7 @@ async def get_current_pose_estimation(
        logger.error(f"Error in pose estimation: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Pose estimation failed: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -174,7 +174,7 @@ async def analyze_pose_data(
        logger.error(f"Error in pose analysis: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Pose analysis failed: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -208,7 +208,7 @@ async def get_zone_occupancy(
        logger.error(f"Error getting zone occupancy: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get zone occupancy: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -232,7 +232,7 @@ async def get_zones_summary(
        logger.error(f"Error getting zones summary: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get zones summary: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -285,7 +285,7 @@ async def get_historical_data(
        logger.error(f"Error getting historical data: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get historical data: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -313,7 +313,7 @@ async def get_detected_activities(
        logger.error(f"Error getting activities: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get activities: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -357,7 +357,7 @@ async def calibrate_pose_system(
        logger.error(f"Error starting calibration: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to start calibration: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -383,7 +383,7 @@ async def get_calibration_status(
        logger.error(f"Error getting calibration status: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get calibration status: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -416,5 +416,5 @@ async def get_pose_statistics(
        logger.error(f"Error getting statistics: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get statistics: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )
@@ -2,6 +2,7 @@
 WebSocket streaming API endpoints
 """

+import asyncio
 import json
 import logging
 from typing import Dict, List, Optional, Any
@@ -71,26 +72,55 @@ async def websocket_pose_stream(
    zone_ids: Optional[str] = Query(None, description="Comma-separated zone IDs"),
    min_confidence: float = Query(0.5, ge=0.0, le=1.0),
    max_fps: int = Query(30, ge=1, le=60),
-    token: Optional[str] = Query(None, description="Authentication token")
 ):
    """WebSocket endpoint for real-time pose data streaming."""
    client_id = None
-    
+
    try:
        # Accept WebSocket connection
        await websocket.accept()
-        
-        # Check authentication if enabled
+
+        # First-message authentication (CWE-598 fix: no JWT in URL)
        from src.config.settings import get_settings
        settings = get_settings()
-        
-        if settings.enable_authentication and not token:
-            await websocket.send_json({
-                "type": "error",
-                "message": "Authentication token required"
-            })
-            await websocket.close(code=1008)
-            return
+
+        if settings.enable_authentication:
+            try:
+                raw = await asyncio.wait_for(websocket.receive_text(), timeout=10.0)
+                auth_msg = json.loads(raw)
+                if auth_msg.get("type") != "auth" or not auth_msg.get("token"):
+                    await websocket.send_json({
+                        "type": "error",
+                        "message": "First message must be {\"type\": \"auth\", \"token\": \"<jwt>\"}"
+                    })
+                    await websocket.close(code=1008)
+                    return
+                # Verify the token
+                from src.middleware.auth import get_auth_middleware
+                auth_middleware = get_auth_middleware(settings)
+                try:
+                    auth_middleware.token_manager.verify_token(auth_msg["token"])
+                except Exception:
+                    await websocket.send_json({
+                        "type": "error",
+                        "message": "Invalid or expired authentication token"
+                    })
+                    await websocket.close(code=1008)
+                    return
+            except asyncio.TimeoutError:
+                await websocket.send_json({
+                    "type": "error",
+                    "message": "Authentication timeout: no auth message received within 10 seconds"
+                })
+                await websocket.close(code=1008)
+                return
+            except (json.JSONDecodeError, Exception) as e:
+                await websocket.send_json({
+                    "type": "error",
+                    "message": "Invalid authentication message format"
+                })
+                await websocket.close(code=1008)
+                return
        
        # Parse zone IDs
        zone_list = None
@@ -157,25 +187,53 @@ async def websocket_events_stream(
    websocket: WebSocket,
    event_types: Optional[str] = Query(None, description="Comma-separated event types"),
    zone_ids: Optional[str] = Query(None, description="Comma-separated zone IDs"),
-    token: Optional[str] = Query(None, description="Authentication token")
 ):
    """WebSocket endpoint for real-time event streaming."""
    client_id = None
-    
+
    try:
        await websocket.accept()
-        
-        # Check authentication if enabled
+
+        # First-message authentication (CWE-598 fix: no JWT in URL)
        from src.config.settings import get_settings
        settings = get_settings()
-        
-        if settings.enable_authentication and not token:
-            await websocket.send_json({
-                "type": "error",
-                "message": "Authentication token required"
-            })
-            await websocket.close(code=1008)
-            return
+
+        if settings.enable_authentication:
+            try:
+                raw = await asyncio.wait_for(websocket.receive_text(), timeout=10.0)
+                auth_msg = json.loads(raw)
+                if auth_msg.get("type") != "auth" or not auth_msg.get("token"):
+                    await websocket.send_json({
+                        "type": "error",
+                        "message": "First message must be {\"type\": \"auth\", \"token\": \"<jwt>\"}"
+                    })
+                    await websocket.close(code=1008)
+                    return
+                from src.middleware.auth import get_auth_middleware
+                auth_middleware = get_auth_middleware(settings)
+                try:
+                    auth_middleware.token_manager.verify_token(auth_msg["token"])
+                except Exception:
+                    await websocket.send_json({
+                        "type": "error",
+                        "message": "Invalid or expired authentication token"
+                    })
+                    await websocket.close(code=1008)
+                    return
+            except asyncio.TimeoutError:
+                await websocket.send_json({
+                    "type": "error",
+                    "message": "Authentication timeout: no auth message received within 10 seconds"
+                })
+                await websocket.close(code=1008)
+                return
+            except (json.JSONDecodeError, Exception) as e:
+                await websocket.send_json({
+                    "type": "error",
+                    "message": "Invalid authentication message format"
+                })
+                await websocket.close(code=1008)
+                return
        
        # Parse parameters
        event_list = None
@@ -294,7 +352,7 @@ async def get_stream_status(
        logger.error(f"Error getting stream status: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get stream status: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -324,7 +382,7 @@ async def start_streaming(
        logger.error(f"Error starting streaming: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to start streaming: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -349,7 +407,7 @@ async def stop_streaming(
        logger.error(f"Error stopping streaming: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to stop streaming: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -371,7 +429,7 @@ async def get_connected_clients(
        logger.error(f"Error getting connected clients: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get connected clients: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -403,7 +461,7 @@ async def disconnect_client(
        logger.error(f"Error disconnecting client: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to disconnect client: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -442,7 +500,7 @@ async def broadcast_message(
        logger.error(f"Error broadcasting message: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to broadcast message: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )


@@ -461,5 +519,5 @@ async def get_streaming_metrics():
        logger.error(f"Error getting streaming metrics: {e}")
        raise HTTPException(
            status_code=500,
-            detail=f"Failed to get streaming metrics: {str(e)}"
+            detail="An internal error occurred. Please try again later."
        )
				`@@ -0,0 +1 @@`
				`{"intelligence":7,"timestamp":1774922079152}`
				`@@ -0,0 +1 @@`
				`8c0680d7d285739ea9597715e84959d9c356c87ee3ad35b5f1e69a4ca41151c6`