fix(ios): isolate ARKit sources to iOS builds

feat(nlos): add governed iOS beta setup assistant
ci(nlos): unsuppress strict Xcode diagnostics
2026-10-21 06:10:15 -05:00 · 2026-08-23 09:45:12 -04:00 · 2026-08-23 09:40:41 -04:00 · 2026-08-22 21:20:08 -04:00 · 2026-08-22 21:17:01 -04:00 · 2026-08-22 20:58:17 -04:00
276 changed files with 37436 additions and 159057 deletions
@@ -1 +1 @@
-{"sessionId":"d80c93c2-51b7-42e8-a0fc-dc47cff1200f","pid":45748,"acquiredAt":1779668018388}
+{"sessionId":"905385c4-b13f-5091-96df-5752fb109cf5","pid":509,"procStart":"527","acquiredAt":1786922977672}
@@ -0,0 +1,3 @@
+# The contributor harness hashes provenance inputs byte-for-byte. Keep text
+# files in this boundary on LF even when Windows enables core.autocrlf.
+harness/ruview/** text=auto eol=lf
@@ -204,7 +204,7 @@ jobs:
        node-version: '22'

    - name: Run UI unit tests
-      run: node --test ui/sw.test.mjs ui/services/ws-ticket.test.mjs ui/services/websocket.service.test.mjs
+      run: node --test ui/sw.test.mjs ui/services/ws-ticket.test.mjs ui/services/websocket.service.test.mjs v2/crates/wifi-densepose-desktop/ui/build-config.test.mjs

  # Unit and Integration Tests
  # Python pytest matrix — runs against the archived v1 Python tree.
@@ -0,0 +1,344 @@
+name: Consumer NLOS
+
+on:
+  push:
+    branches: [main, 'feat/**', 'feature/**']
+    paths:
+      - 'v2/crates/ruview-nlos/**'
+      - 'ui/ios-nlos/**'
+      - 'ui/mobile/**'
+      - 'harness/ruview/**'
+      - 'docs/adr/ADR-32[8-9]*'
+      - 'docs/adr/ADR-33[0-1]*'
+      - 'docs/adr/ADR-341-consumer-nlos-beta-tester-delivery-and-diagnostics.md'
+      - 'docs/research/consumer-nlos-acceptance-protocol.md'
+      - 'docs/research/consumer-nlos-beta-test-protocol.md'
+      - 'docs/schemas/ruview-nlos-*.schema.json'
+      - 'docs/schemas/ruview-ios-visible-depth-diagnostic-v1.schema.json'
+      - 'docs/security/consumer-nlos-threat-model.md'
+      - '.github/workflows/consumer-nlos-ci.yml'
+      - 'v2/Cargo.toml'
+      - 'v2/Cargo.lock'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'v2/crates/ruview-nlos/**'
+      - 'ui/ios-nlos/**'
+      - 'ui/mobile/**'
+      - 'harness/ruview/**'
+      - 'docs/**consumer-nlos*'
+      - 'docs/schemas/ruview-ios-visible-depth-diagnostic-v1.schema.json'
+      - '.github/workflows/consumer-nlos-ci.yml'
+      - 'v2/Cargo.toml'
+      - 'v2/Cargo.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  rust-core:
+    name: Rust core, security, and performance
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          submodules: recursive
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
+        with:
+          toolchain: '1.89'
+          components: rustfmt, clippy
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
+        with:
+          workspaces: v2
+
+      - name: Test dependency-free core
+        working-directory: v2
+        run: cargo test -p ruview-nlos --no-default-features
+
+      - name: Formatting and lint
+        working-directory: v2
+        run: |
+          cargo fmt --package ruview-nlos -- --check
+          cargo clippy -p ruview-nlos --all-features --all-targets -- -D warnings
+
+      - name: Test server and hardware adapters
+        working-directory: v2
+        run: cargo test -p ruview-nlos --all-features
+
+      - name: Check all targets
+        working-directory: v2
+        run: cargo check -p ruview-nlos --all-features --all-targets
+
+      - name: Audit Rust lockfile
+        working-directory: v2
+        run: |
+          cargo install cargo-audit --version 0.22.2 --locked
+          cargo audit
+
+      - name: Measure synthetic architecture gate
+        working-directory: v2
+        run: |
+          cargo run -p ruview-nlos --release -- benchmark --frames 300 --particles 1000 > /tmp/nlos-benchmark.json
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          report = json.loads(Path('/tmp/nlos-benchmark.json').read_text())
+          assert report['evidence'] == 'SYNTHETIC_L0'
+          assert report['hardwareReproductionGatePassed'] is False
+          assert report['throughputFps'] >= 30.0, report
+          assert report['lostTrackReductionPercent'] >= 25.0, report
+          print(json.dumps(report, indent=2, sort_keys=True))
+          PY
+
+  web-ios:
+    name: Expo web iOS client
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui/mobile
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: ui/mobile/package-lock.json
+
+      - run: npm ci --ignore-scripts
+      - run: npm test -- --runInBand
+      - run: npx tsc --noEmit
+      - run: npm run lint
+      - name: Export browser bundle
+        run: npx expo export --platform web
+      - name: Export Expo iOS bundle
+        run: npx expo export --platform ios --output-dir /tmp/ruview-expo-ios
+      - name: Audit web dependency boundary
+        run: |
+          npm audit --json > /tmp/mobile-audit.json || true
+          node <<'JS'
+          const report = require('/tmp/mobile-audit.json');
+          const severe = Object.entries(report.vulnerabilities ?? {})
+            .filter(([, finding]) => ['high', 'critical'].includes(finding.severity));
+          if (severe.length) {
+            console.error(JSON.stringify(severe, null, 2));
+            process.exit(1);
+          }
+          console.log(JSON.stringify(report.metadata?.vulnerabilities ?? {}, null, 2));
+          JS
+
+  native-ios:
+    name: Native Swift, simulator, and unsigned archive dry gate
+    runs-on: macos-26
+    defaults:
+      run:
+        working-directory: ui/ios-nlos
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Require Xcode 26
+        shell: bash
+        run: |
+          set -euo pipefail
+          xcodebuild -version
+          xcode_major="$(xcodebuild -version | awk '/^Xcode / {split($2, version, "."); print version[1]}')"
+          test "$xcode_major" = "26"
+
+      - name: Swift protocol and security tests
+        run: swift test
+
+      - name: Unsigned iOS Simulator build
+        run: >-
+          xcodebuild
+          -project RuViewNLOS.xcodeproj
+          -scheme RuViewNLOS
+          -sdk iphonesimulator
+          -destination 'generic/platform=iOS Simulator'
+          CODE_SIGNING_ALLOWED=NO
+          SWIFT_STRICT_CONCURRENCY=complete
+          SWIFT_SUPPRESS_WARNINGS=NO
+          SWIFT_TREAT_WARNINGS_AS_ERRORS=YES
+          build
+
+      - name: Unsigned generic iOS archive dry gate
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive_path="$RUNNER_TEMP/RuViewNLOS.xcarchive"
+          xcodebuild \
+            -project RuViewNLOS.xcodeproj \
+            -scheme RuViewNLOS \
+            -configuration Release \
+            -sdk iphoneos \
+            -destination 'generic/platform=iOS' \
+            -archivePath "$archive_path" \
+            CODE_SIGNING_ALLOWED=NO \
+            CODE_SIGNING_REQUIRED=NO \
+            SWIFT_STRICT_CONCURRENCY=complete \
+            SWIFT_SUPPRESS_WARNINGS=NO \
+            SWIFT_TREAT_WARNINGS_AS_ERRORS=YES \
+            archive
+          test -f "$archive_path/Info.plist"
+          if find "$archive_path" -name embedded.mobileprovision -print -quit | grep -q .; then
+            echo "Unsigned dry archive unexpectedly contains a provisioning profile" >&2
+            exit 1
+          fi
+
+  release-governance:
+    name: Beta release governance contract
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Validate ADR, protocol, workflow, and diagnostic boundary
+        shell: bash
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          adr_path = Path("docs/adr/ADR-341-consumer-nlos-beta-tester-delivery-and-diagnostics.md")
+          protocol_path = Path("docs/research/consumer-nlos-beta-test-protocol.md")
+          workflow_path = Path(".github/workflows/consumer-nlos-ci.yml")
+          schema_path = Path("docs/schemas/ruview-ios-visible-depth-diagnostic-v1.schema.json")
+
+          adr = adr_path.read_text(encoding="utf-8")
+          protocol = protocol_path.read_text(encoding="utf-8")
+          workflow = workflow_path.read_text(encoding="utf-8")
+          schema = json.loads(schema_path.read_text(encoding="utf-8"))
+
+          required_adr_sections = (
+              "## Specification",
+              "## Pseudocode and state transitions",
+              "## Architecture",
+              "## Release architecture",
+              "## Alternatives considered",
+              "## Refinement and failure handling",
+              "## Requirement-to-evidence mapping",
+              "## Acceptance test",
+          )
+          for section in required_adr_sections:
+              assert section in adr, f"missing ADR section: {section}"
+
+          required_contract = (
+              "under five minutes",
+              "15 second calibration",
+              "30 second wall scan",
+              "65,536 bytes",
+              "blocked_raw_transients_unavailable",
+              "No raw capture",
+          )
+          combined = adr + "\n" + protocol
+          for phrase in required_contract:
+              assert phrase in combined, f"missing beta contract: {phrase}"
+
+          assert "runs-on: macos-26" in workflow
+          assert 'test "$xcode_major" = "26"' in workflow
+          assert "CODE_SIGNING_ALLOWED=NO" in workflow
+          assert "CODE_SIGNING_REQUIRED=NO" in workflow
+          assert ("sec" + "rets.") not in workflow
+          assert ("upload" + "-app-store") not in workflow.lower()
+          assert ("al" + "tool") not in workflow.lower()
+
+          phase = {
+              "phase": "calibration",
+              "plannedDurationSeconds": 15,
+              "observedDurationSeconds": 15.0,
+              "frameCount": 450,
+              "averageFPS": 30.0,
+              "averageDepthCoverage": 0.91,
+              "averageMovementMetersPerSecond": 0.08,
+              "finalTrackingState": "normal",
+              "peakThermalState": "nominal",
+          }
+          diagnostic = {
+              "schema": "ruview.ios.visible-depth-diagnostic.v1",
+              "sessionId": "00000000-0000-4000-8000-000000000000",
+              "createdAt": "2026-08-23T00:00:00Z",
+              "deviceModelFamily": "iPhone",
+              "osVersion": "iOS 26.0",
+              "appVersion": "1.0 (1)",
+              "capabilities": {
+                  "worldTracking": True,
+                  "sceneDepth": True,
+                  "smoothedSceneDepth": True,
+                  "sceneMesh": True,
+                  "rawPhotonHistograms": False,
+              },
+              "phases": [phase, {**phase, "phase": "wall_scan", "plannedDurationSeconds": 30}],
+              "consent": {
+                  "localValidation": True,
+                  "diagnosticExport": True,
+                  "rawSensorExport": False,
+              },
+              "evidenceLabel": "direct_depth",
+              "physicalNLOSStatus": "blocked_raw_transients_unavailable",
+              "cameraPermission": "granted",
+              "completionStatus": "completed",
+          }
+          encoded = json.dumps(
+              diagnostic, sort_keys=True, separators=(",", ":"), allow_nan=False
+          ).encode("utf-8")
+          assert len(encoded) <= 65_536
+          assert set(diagnostic) == set(schema["required"])
+          assert diagnostic["consent"]["rawSensorExport"] is False
+          assert diagnostic["capabilities"]["rawPhotonHistograms"] is False
+          assert diagnostic["physicalNLOSStatus"] == (
+              "blocked_raw_transients_unavailable"
+          )
+
+          forbidden = {
+              "image", "images", "rgb", "depth", "depth_map", "point_cloud",
+              "csi", "transient", "histogram", "token", "authorization",
+              "latitude", "longitude", "location", "trajectory", "raw",
+          }
+
+          def walk(value):
+              if isinstance(value, dict):
+                  for key, child in value.items():
+                      assert key.lower() not in forbidden, f"forbidden diagnostic key: {key}"
+                      walk(child)
+              elif isinstance(value, list):
+                  for child in value:
+                      walk(child)
+
+          walk(diagnostic)
+          print(f"Validated beta governance contract and {len(encoded)} byte fixture")
+          PY
+
+  metaharness:
+    name: Advisory MetaHarness
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: harness/ruview
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: harness/ruview/package-lock.json
+
+      - run: npm ci --ignore-scripts
+      - run: npm test
+      - run: npm run test:security
+      - run: npm run brain:verify
+      - run: npm run flywheel:verify
+      - run: npm run manifest:verify
+      - run: npm pack --dry-run
@@ -0,0 +1,70 @@
+name: iPhone LiDAR integration
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'integrations/iphone-lidar/**'
+      - 'docs/adr/ADR-340-iphone-lidar-sensor-bridge.md'
+      - '.github/workflows/iphone-lidar.yml'
+  pull_request:
+    paths:
+      - 'integrations/iphone-lidar/**'
+      - 'docs/adr/ADR-340-iphone-lidar-sensor-bridge.md'
+      - '.github/workflows/iphone-lidar.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  web:
+    name: Node relay and codec
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: integrations/iphone-lidar/web
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: integrations/iphone-lidar/web/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run tests
+        run: npm test
+
+      - name: Audit runtime dependencies
+        run: npm audit --omit=optional --audit-level=high
+
+  ios:
+    name: iOS 17 compile
+    runs-on: macos-15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Compile native sources with strict concurrency
+        shell: bash
+        run: |
+          set -euo pipefail
+          sdk="$(xcrun --sdk iphoneos --show-sdk-path)"
+          build_dir="$RUNNER_TEMP/ruview-lidar-build"
+          mkdir -p "$build_dir"
+          cd "$build_dir"
+          xcrun swiftc \
+            -parse-as-library \
+            -target arm64-apple-ios17.0 \
+            -sdk "$sdk" \
+            -module-name RuViewLiDAR \
+            -strict-concurrency=complete \
+            -warnings-as-errors \
+            -emit-module \
+            -emit-module-path "$build_dir/RuViewLiDAR.swiftmodule" \
+            -c "$GITHUB_WORKSPACE"/integrations/iphone-lidar/native/RuViewLiDAR/*.swift
@@ -40,8 +40,10 @@ jobs:
          - dir: harness/ruview
            build: false
            publishable: true
-            # ADR-283: brain + local hosts + replay assets; still runtime-dependency-free.
-            unpacked_budget: 131072
+            # ADR-283/325/331: brain + local hosts + replay assets + guarded
+            # Spaces OAuth + consumer-NLOS verifier; still runtime-dependency-free.
+            # 220 KiB is the reviewed hard ceiling after the bounded NLOS addition.
+            unpacked_budget: 225280
          - dir: harness/homecore
            build: false
            publishable: true
@@ -104,8 +104,9 @@ jobs:
        run: |
          set -euo pipefail
          case "${{ inputs.package }}" in
-            # ADR-283: brain + local hosts + replay assets; no runtime deps.
-            harness/ruview) export UNPACKED_BUDGET=131072 ;;
+            # ADR-283/325/331: brain + hosts + replay + guarded Spaces OAuth +
+            # bounded consumer-NLOS verifier; no runtime dependencies.
+            harness/ruview) export UNPACKED_BUDGET=225280 ;;
            # ADR-285: CLI + MCP + reviewed brain + WASM-kernel adapter.
            harness/homecore) export UNPACKED_BUDGET=180000 ;;
            # ADR-264 O2: map-free tarball (was 188 kB with maps).
@@ -14,6 +14,33 @@ env:
  PYTHON_VERSION: '3.11'

 jobs:
+  # Rust dependency advisories are deterministic for the checked-in lockfile,
+  # so this job gates the PR and retains the exact machine-readable report.
+  rust-audit:
+    name: Rust Dependency Audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+    - name: Install cargo-audit
+      run: cargo install cargo-audit --locked --version 0.22.2
+
+    - name: Audit the checked-in Rust lockfile
+      run: |
+        set -o pipefail
+        cargo audit --file v2/Cargo.lock --json | tee v2/cargo-audit.json
+
+    - name: Upload Rust advisory report
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      if: always()
+      with:
+        name: cargo-audit-report
+        path: v2/cargo-audit.json
+        if-no-files-found: error
+
  # Static Application Security Testing (SAST)
  sast:
    name: Static Application Security Testing
@@ -28,6 +28,7 @@ on:
      - 'v2/crates/wifi-densepose-wifiscan/**'
      - 'v2/crates/wifi-densepose-bfld/**'
      - 'v2/crates/cog-ha-matter/**'
+      - 'v2/crates/homecore*/**'
      - 'v2/Cargo.toml'
      - 'v2/Cargo.lock'
      - 'ui/**'
@@ -303,4 +303,11 @@ ruvector.db
 # sensing-server runtime artifacts written by its test suite (trained model
 # snapshots + the generated session-secret) — never tracked
 v2/crates/wifi-densepose-sensing-server/data/
+# The server also writes this secret when launched from v2/. Keep the rule
+# file-specific so tracked datasets below v2/data remain visible.
+/v2/data/session-secret
 *.proptest-regressions
+
+# ADR-324: wasm-bindgen output for ruview-offaxis is generated locally
+# (see the crate README); never commit generated artifacts.
+v2/crates/ruview-offaxis/pkg/
@@ -47,17 +47,18 @@ from the current tree when needed.

 ## RuView contributor harness

-`@ruvnet/ruview@0.3.1` is the runtime-dependency-free contributor interface
+`@ruvnet/ruview@0.5.0` is the runtime-dependency-free contributor interface
 defined by ADR-283.

 ```bash
-npx @ruvnet/ruview@0.3.1 doctor
-npx @ruvnet/ruview@0.3.1 guidance --topic homecore --query "restore and plugins"
-npx @ruvnet/ruview@0.3.1 agent run \
+npx @ruvnet/ruview@0.5.0 doctor
+npx @ruvnet/ruview@0.5.0 guidance --topic homecore --query "restore and plugins"
+npx @ruvnet/ruview@0.5.0 agent run \
  --host codex --repo . --prompt "Find the nearest tests and cite files"
-npx @ruvnet/ruview@0.3.1 brain search --query "community memory"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.5.0 brain search --query "community memory"
+npx @ruvnet/ruview@0.5.0 brain verify --repo .
+npx @ruvnet/ruview@0.5.0 spaces
+npx @ruvnet/ruview@0.5.0 mcp start
 ```

 Start unfamiliar repository work with `ruview_guidance`. It returns reviewed
@@ -25,6 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`archive/v1` (the original pure-Python implementation) formally deprecated (ADR-187)** — commits `1fb5397dd`, `b1417fb6e`; refs #509, #1125. Added `archive/v1/DEPRECATED.md` (a loud tombstone) and a `> ⚠️ DEPRECATED` notice atop `archive/v1/README.md`, both pointing at the maintained `v2/` workspace and the `wifi-densepose 2.x` / `ruview` pip wheel (ADR-117). Records the honest fact behind #509: `archive/v1`'s `DensePoseHead` is **architecture-only** — random `kaiming_normal_` init with **zero committed checkpoints** under `archive/v1/` (MEASURED by Glob over `**/*.{pth,onnx,safetensors,pt,ckpt,bin}`). The ADR-028 deterministic proof `archive/v1/data/proof/verify.py` stays live and is explicitly out of scope. The same effort added a **"Model weights: what's real, what's not" three-tier table** to `README.md` + `docs/user-guide.md`, separating real-and-validated checkpoints (presence 82.3% held-out temporal-triplet, MM-Fi pose 82.69% torso-PCK@20, `count_v1`) from the real-but-weak on-device `pose_v1` (PCK@20 = 3.0%, runtime `confidence=0` stub, below the ADR-079 ≥35% target) from the architecture-only `archive/v1` head — and caveated every live single-ESP32 17-keypoint advertisement accordingly. Docs/labeling only; no code or model behavior changed.

 ### Fixed
+- **Pose-vitals, desktop, and repository-integrity issue remediation.** Breathing confidence now measures periodic autocorrelation at the estimated respiratory frequency instead of penalizing clean sinusoidal signals via crest factor (#1610). The desktop launcher resolves the Windows `.exe`, uses `where` for PATH lookup, and passes log filtering through `RUST_LOG`; its React versions, Vite type declarations, and Tauri UI hook working directories are aligned (#1516, #1517, #1518). Runtime session secrets written from `v2/` are ignored, and contributor-harness provenance inputs are pinned to LF across Windows checkouts (#1519, #1520). With explicit owner authorization, the six raw CSI/person-data capture and metadata files identified by ADR-299 were removed from the current tree; historical copies remain pending separately coordinated incident response.
 - **`docs/huggingface/MODEL_CARD.md` had drifted from the model card actually published on the Hub (issue #1481).** Every filename in its "Files in this repo" table (`pretrained-encoder.onnx`, `pretrained-heads.onnx`, `pretrained.rvf`, `room-profiles.json`) pointed at files never uploaded to `ruvnet/wifi-densepose-pretrained` — only `config.json` existed. Replaced the in-repo card with the content actually live on the Hub (`model.safetensors`, `model-q{2,4,8}.bin`, `node-{1,2}.json`, `presence-head.json`, `csi-embed-v2.*`, honest v1→v2 retraction of the single-class "100%" presence claim) and added a "Using with the Rust sensing server (RVF conversion)" section documenting the `--convert-model`/`--convert-out` and `--model` auto-convert paths that neither card previously mentioned.
 - **`--convert-model` failed on the published `model.safetensors`: NUL-padded safetensors header rejected by strict JSON parse (issue #1480, #894 follow-up).** The reference safetensors format pads its JSON header to an 8-byte boundary with trailing NUL bytes; `safetensors_to_rvf` (`wifi-densepose-sensing-server/src/model_format.rs`) fed the full declared-length header slice straight to `serde_json::from_slice`, which rejects the padding as "trailing characters." Since the only published full-precision weight file exercises this padding, `--convert-model` could not convert it at all. Fixed by trimming trailing NUL/whitespace bytes before parsing. Pinned by `safetensors_nul_padded_header_converts` (a header padded to the 8-byte boundary, matching the real HF file, converts and round-trips its weights through `ProgressiveLoader`).
 - **In-server training reconnected — "Start Training" no longer silently no-ops; `/ws/train/progress` streams real progress (ADR-186, issue #1233).** The dashboard's Start Training button POSTed a config, got `success:true`, and nothing happened: `/api/v1/train/start` was a stub that flipped a status string and logged one line, and `/ws/train/progress` 404'd. The full pure-Rust trainer in `training_api.rs` (loads recorded CSI, gradient-descent, exports a `.rvf`) already existed but was **orphaned** — never declared as a module (no `mod training_api;`), so it wasn't compiled at all. Fix (`wifi-densepose-sensing-server`): declared the module, reconciled `AppStateInner` (replaced the `training_status`/`training_config` stub fields with a shared `TrainingState` status handle + cooperative cancel flag + a `training_progress_tx` broadcast), deleted the stub handlers, and merged the real `training_api::routes()` (so `/api/v1/train/{start,stop,status,pretrain,lora}` and `/ws/train/progress` resolve under the existing `/api/v1/*` bearer gate). The training core was decoupled from the ~60-field server state so it is unit-testable. **P5 honesty guarantee:** with `RUVIEW_DISABLE_SERVER_TRAINING` set, start returns a structured `{enabled:false, cli:"wifi-densepose train-room"}` HTTP 409 — never a silent success — and the dashboard disables the Start buttons with a CLI tooltip (enablement is surfaced on `/api/v1/train/status`). Pinned by 8 new tests incl. a **live-socket** test that completes a genuine 101 WebSocket handshake and receives a real progress frame after a POST start, a full POST→poll-status→`.rvf`-exists round-trip, a path-traversal rejection, cancellation, and the disabled-409 path. `cargo test -p wifi-densepose-sensing-server -p wifi-densepose-train --no-default-features` — 0 failed.
@@ -45,7 +45,7 @@ retrieved memories, generated proposals, and old test counts are not.
 Do not hardcode crate, ADR, or test counts in instructions; derive them when a
 task needs them.

-## Contributor metaharness (`@ruvnet/ruview@0.3.1`)
+## Contributor metaharness (`@ruvnet/ruview@0.4.0`)

 ADR-283 defines the current community metaharness. It adds secure local
 Claude/Codex execution, a reviewed shared brain, default-deny MCP mutation
@@ -54,21 +54,24 @@ free of runtime dependencies.

 ```bash
 # Diagnose the installed harness
-npx @ruvnet/ruview@0.3.1 doctor
+npx @ruvnet/ruview@0.4.0 doctor

 # Get a source-cited capability map before unfamiliar work
-npx @ruvnet/ruview@0.3.1 guidance --topic homecore --query "restore and plugins"
+npx @ruvnet/ruview@0.4.0 guidance --topic homecore --query "restore and plugins"

 # Explore this trusted checkout through Claude Code (stdin, plan/safe mode)
-npx @ruvnet/ruview@0.3.1 agent run \
+npx @ruvnet/ruview@0.4.0 agent run \
  --host claude-code --repo . --prompt "Map the relevant subsystem and cite files"

 # Search reviewed, source-cited repository knowledge
-npx @ruvnet/ruview@0.3.1 brain search --query "community memory"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
+npx @ruvnet/ruview@0.4.0 brain search --query "community memory"
+npx @ruvnet/ruview@0.4.0 brain verify --repo .
+
+# Read the OAuth-bound Cognitum Spaces projection
+npx @ruvnet/ruview@0.4.0 spaces

 # Run the dependency-free RuView MCP server
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.4.0 mcp start
 ```

 `ruview_guidance` returns reviewed capability maturity, repository citations,
@@ -49,25 +49,26 @@ Every WiFi router already fills your space with radio waves. When people move, b
 <details>
 <summary><strong>RuView MetaHarness</strong> — guided operation for humans and AI agents</summary>

-The RuView-specific metaharness we created is published as [`@ruvnet/ruview`](harness/ruview/README.md). It provides source-cited guidance, guarded Claude Code/Codex agents, deterministic verification, and an honesty check for accuracy claims.
+The RuView-specific metaharness we created is published as [`@ruvnet/ruview`](harness/ruview/README.md). It provides source-cited guidance, guarded Claude Code/Codex agents, deterministic verification, an honesty check for accuracy claims, and an explicitly granted OAuth-only Cognitum Spaces read.

 ```bash
 # Check the local setup and get source-cited guidance
-npx @ruvnet/ruview@0.3.1 doctor
-npx @ruvnet/ruview@0.3.1 guidance --topic sensing --query "model loading"
+npx @ruvnet/ruview@0.4.0 doctor
+npx @ruvnet/ruview@0.4.0 guidance --topic sensing --query "model loading"

 # Run a read-only RuView agent through Codex
-npx @ruvnet/ruview@0.3.1 agent run --host codex --repo . \
+npx @ruvnet/ruview@0.4.0 agent run --host codex --repo . \
  --prompt "Find the nearest tests and cite the source files"

 # Search or verify the reviewed contributor brain
-npx @ruvnet/ruview@0.3.1 brain search --query "calibration"
-npx @ruvnet/ruview@0.3.1 brain verify --repo .
+npx @ruvnet/ruview@0.4.0 brain search --query "calibration"
+npx @ruvnet/ruview@0.4.0 brain verify --repo .

 # Check claims, replay the deterministic proof, or expose the MCP server
-npx @ruvnet/ruview@0.3.1 claim-check --file REPORT.md
-npx @ruvnet/ruview@0.3.1 verify
-npx @ruvnet/ruview@0.3.1 mcp start
+npx @ruvnet/ruview@0.4.0 claim-check --file REPORT.md
+npx @ruvnet/ruview@0.4.0 verify
+npx @ruvnet/ruview@0.4.0 spaces
+npx @ruvnet/ruview@0.4.0 mcp start
 ```

 Agent runs are read-only by default. Workspace writes require both `--allow-write` and `--confirm`; retrieved brain content is evidence, not authority.
@@ -244,8 +245,8 @@ See the measured benchmarks, witness records, and one-command reproducibility ch
 |------|-------|---------|
 | **MM-Fi pose model (SOTA)** | [`ruvnet/wifi-densepose-mmfi-pose`](https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose) | 82.69% torso-PCK@20 (single) · 83.59% (ensemble+TTA) · 75K-param micro variant 74.30% |
 | **AetherArena benchmark Space** | [`ruvnet/aether-arena`](https://huggingface.co/spaces/ruvnet/aether-arena) | self-correcting, auditable MM-Fi leaderboard |
-| **Full MM-Fi study (honest picture)** | [`docs/benchmarks/mmfi-wifi-sensing-study.md`](docs/benchmarks/mmfi-wifi-sensing-study.md) | pose + action; zero-shot cross-subject ~64%, +~30 s in-room calibration → 72.2% |
-| **Efficiency frontier** | [`docs/benchmarks/wifi-pose-efficiency-frontier.md`](docs/benchmarks/wifi-pose-efficiency-frontier.md) | SOTA-beating WiFi pose in a 20 KB int4 edge model |
+| **Full MM-Fi study (honest picture)** | [`docs/benchmarks/mmfi-wifi-sensing-study.md`](docs/benchmarks/mmfi-wifi-sensing-study.md) | pose + action; zero-shot cross-subject ~64%, labeled in-room calibration → 72.2% |
+| **Efficiency frontier** | [`docs/benchmarks/wifi-pose-efficiency-frontier.md`](docs/benchmarks/wifi-pose-efficiency-frontier.md) | SOTA-beating MM-Fi pose in a ~37 KB int4 model; live ESP32 compatibility not established |
 | **Pretrained encoder** | [`ruvnet/wifi-densepose-pretrained`](https://huggingface.co/ruvnet/wifi-densepose-pretrained) | 82.3% held-out temporal-triplet, 8 KB int4 |
 | **Reproducible proof (Trust Kill Switch)** | [`archive/v1/data/proof/verify.py`](archive/v1/data/proof/verify.py) + [`expected_features.sha256`](archive/v1/data/proof/expected_features.sha256) | one-command deterministic pipeline replay (SHA-256 of output vs published hash) |
 | **Benchmark-proof ADR** | [ADR-168](docs/adr/ADR-168-benchmark-proof.md) | how the numbers are produced and verified |
@@ -487,12 +488,20 @@ Neural Network: processed signals → 17 body keypoints + vital signs + room mod
 Output: real-time pose, breathing, heart rate, room fingerprint, drift alerts
 ```

-No training cameras required — the [Self-Learning system (ADR-024)](docs/adr/ADR-024-contrastive-csi-embedding-model.md) bootstraps from raw WiFi data alone. [MERIDIAN (ADR-027)](docs/adr/ADR-027-cross-environment-domain-generalization.md) ensures the model works in any room, not just the one it trained in.
+The [Self-Learning system (ADR-024)](docs/adr/ADR-024-contrastive-csi-embedding-model.md) provides
+camera-free representation-learning components. Cross-room pose remains a separate, data-gated
+problem: [MERIDIAN (ADR-027)](docs/adr/ADR-027-cross-environment-domain-generalization.md) is
+**Proposed**, while the measured calibration reference requires labeled CSI/keypoint pairs and
+model-specific adapters. See the [model compatibility boundary](docs/user-guide.md#model-and-capture-compatibility).

 ---

 ## 🏢 Use Cases & Applications

+> **Safety boundary:** these are research and prototype applications, not medical devices,
+> emergency systems, or safety-certified controls. Vital-sign and pose outputs require independent
+> validation on the exact hardware, room, subjects, and failure conditions before operational use.
+
 WiFi sensing works anywhere WiFi exists. No new hardware in most cases — just software on existing access points or a $8 ESP32 add-on. Because there are no cameras, deployments avoid privacy regulations (GDPR video, HIPAA imaging) by design.

 **Scaling:** Each AP distinguishes ~3-5 people (56 subcarriers). Multi-AP multiplies linearly — a 4-AP retail mesh covers ~15-20 occupants. No hard software limit; the practical ceiling is signal physics.
@@ -527,7 +536,7 @@ WiFi sensing works anywhere WiFi exists. No new hardware in most cases — just
 | Use Case | What It Does | Hardware | Key Metric | Edge Module |
 |----------|-------------|----------|------------|-------------|
 | **Smart home automation** | Room-level presence triggers (lights, HVAC, music) that work through walls — no dead zones, no motion-sensor timeouts | 2-3 ESP32-S3 nodes ($24) | Through-wall range ~5m | [HVAC Presence](docs/edge-modules/building.md), [Lighting Zones](docs/edge-modules/building.md) |
-| **Fitness & sports** | Rep counting, posture correction, breathing cadence during exercise — no wearable, no camera in locker rooms | 3+ ESP32-S3 mesh | Pose: 17 keypoints | [Breathing Sync](docs/edge-modules/exotic.md), [Gait Analysis](docs/edge-modules/medical.md) |
+| **Fitness & sports research** | Explore motion and breathing cadence without a wearable or camera; reliable posture correction requires a validated compatible pose model | 3+ ESP32-S3 mesh + edge host | Prototype; no live S3 pose accuracy claim | [Breathing Sync](docs/edge-modules/exotic.md), [Gait Analysis](docs/edge-modules/medical.md) |
 | **Childcare & schools** | Naptime breathing monitoring, playground headcount, restricted-area alerts — privacy-safe for minors | 2-4 ESP32-S3 per zone | Breathing: ±1 BPM | [Sleep Apnea](docs/edge-modules/medical.md), [Perimeter Breach](docs/edge-modules/security.md) |
 | **Event venues & concerts** | Crowd density mapping, crush-risk detection via breathing compression, emergency evacuation flow tracking | Multi-AP mesh (4-8 APs) | Density per m² | [Customer Flow](docs/edge-modules/retail.md), [Panic Motion](docs/edge-modules/security.md) |
 | **Stadiums & arenas** | Section-level occupancy for dynamic pricing, concession staffing, emergency egress flow modeling | Enterprise AP grid | 15-20 per AP mesh | [Dwell Heatmap](docs/edge-modules/retail.md), [Queue Length](docs/edge-modules/retail.md) |
@@ -694,7 +703,7 @@ claude --plugin-dir ./plugins/ruview

 Verify the plugin structure: `bash plugins/ruview/scripts/smoke.sh`. Full details: [`plugins/ruview/README.md`](plugins/ruview/README.md).

-For the portable RuView MetaHarness, use `npx @ruvnet/ruview@0.3.1`; the quick commands and fuller explanation are in the collapsed MetaHarness section near the top of this README and in [`harness/ruview/`](harness/ruview/README.md).
+For the portable RuView MetaHarness, use `npx @ruvnet/ruview@0.4.0`; the quick commands and fuller explanation are in the collapsed MetaHarness section near the top of this README and in [`harness/ruview/`](harness/ruview/README.md).

 </details>

@@ -1,8 +1,14 @@
 # RuView Calibration Service (reference implementation)

-Turn a **shared WiFi-CSI pose base model** into a room-specific one with a **30-second labeled
-calibration** and a **~11 KB per-room LoRA adapter**. This is the deployable resolution of the
-cross-subject / cross-environment generalization problem (full study: [ADR-150 §3.3–3.6](../../docs/adr/ADR-150-rf-foundation-encoder.md)).
+Fit a room-specific **~11 KB LoRA adapter** for a shared WiFi-CSI pose base from a short **labeled
+capture**. This is a measured MM-Fi reference path for cross-subject / cross-environment adaptation
+(full study: [ADR-150 §3.3–3.6](../../docs/adr/ADR-150-rf-foundation-encoder.md)); it is not proof of
+plug-and-play adaptation from a live ESP32 stream.
+
+> **Not the proposed MERIDIAN fast path.** Both producers below require paired CSI and keypoint
+> labels, and their tensor shapes and adapter files are model-specific. ADR-027's automatic,
+> unlabeled 10-second MERIDIAN calibration remains **Proposed** and is not implemented as an
+> end-to-end deployment command.

 ## Why

@@ -66,8 +72,8 @@ Adapters are **model-specific**. There are two calibration producers here:
 | `cog_calibrate.py` | cog **conv+MLP** (`pose_v1.safetensors`, 56×20) | `[N,56,20]` | `.safetensors` (`fc1.a`/`fc1.b`/`fc2.a`/`fc2.b`) | Rust `cog-pose-estimation run --adapter` |

 ```bash
-# Produce a cog-format per-room adapter for the deployed Rust pose engine:
-python cog_calibrate.py --base pose_v1.safetensors --data calib.npz --out room.safetensors
+# Produce a cog-format per-room adapter from X:[N,56,20], Y:[N,17,2]:
+python cog_calibrate.py --base pose_v1.safetensors --data cog-calib.npz --out room.safetensors
 # then in the cog runtime:
 cog-pose-estimation run --config <cfg> --adapter room.safetensors
 ```
@@ -1,15 +0,0 @@
-{
-  "id": "pretrain-1775182186",
-  "name": "pretrain-1775182186",
-  "label": "mixed-activity",
-  "started_at": "2026-04-03T02:09:46Z",
-  "ended_at": "2026-04-03T02:11:46Z",
-  "duration_secs": 120,
-  "frame_count": 5783,
-  "file_size_bytes": 2580539,
-  "file_path": "data/recordings\\pretrain-1775182186.csi.jsonl",
-  "nodes": {
-    "2": 2886,
-    "1": 2897
-  }
-}
@@ -2,7 +2,7 @@

 | Field | Value |
 |-------|-------|
-| **Status** | Accepted — **implemented** (O1–O9 in `@ruvnet/ruview@0.2.0`; security/community extension in `0.3.0`, ADR-283; source-cited guidance in `0.3.1`): fail-closed schemas and MCP policy, async dispatch, zero runtime dependencies, bounded/redacted local Claude/Codex adapters, reviewed shared brain, source-checked capability guidance, and replay-verified Darwin/Flywheel gate. CI gate: `ruview-harness-flywheel.yml` |
+| **Status** | Accepted — **implemented** (O1–O9 in `@ruvnet/ruview@0.2.0`; security/community extension in `0.3.0`, ADR-283; source-cited guidance in `0.3.1`; guarded Cognitum Spaces OAuth read in `0.4.0`, ADR-325): fail-closed schemas and MCP policy, async dispatch, zero runtime dependencies, bounded/redacted local Claude/Codex adapters, reviewed shared brain, source-checked capability guidance, credential-gated external reads, and replay-verified Darwin/Flywheel gate. CI gate: `ruview-harness-flywheel.yml` |
 | **Date** | 2026-07-02 |
 | **Deciders** | ruv |
 | **Codename** | **RUVIEW-NPM-REVIEW-1** |
@@ -31,6 +31,26 @@ bounded output/time, secret redaction and realpath-based RuView checkout
 validation. Write mode requires two explicit flags and never uses permission or
 sandbox bypasses.

+## Credentialed external reads
+
+Read-only cloud access is not equivalent to an uncredentialed local read. The
+Cognitum Spaces adapter therefore delegates OAuth and response validation to
+the Rust `wifi-densepose` client, never accepts bearer tokens or API keys, and
+removes the API-key compatibility environment from the child process. Its MCP
+tool is denied unless the server operator grants `credential-use`; MCP callers
+cannot select a credential path or API origin. The adapter uses only an
+installed `wifi-densepose` binary; it never executes Cargo build scripts from
+an auto-detected checkout while holding credential authority. The tool is
+marked open-world and independently rechecks response size, structure, privacy
+class, and prohibited raw fields.
+
+An expiring access token may rotate the stored refresh credential. The MCP
+annotation is therefore non-read-only and non-idempotent even though the cloud
+data operation is read-only. That bounded authentication side effect is
+disclosed in the schema and result. It does not change the cloud operation from
+read-only and confers no write or action authority. ADR-325 remains authoritative
+for the Spaces data and policy boundary.
+
 ## Shared brain

 The public brain is committed JSONL, not a shared mutable database. Canonical
@@ -67,5 +87,6 @@ autonomously promotes or publishes an evolved candidate.
 Contributors can explore RuView with either major local CLI and share durable
 findings without sharing secrets. Improvements become reproducible proposals
 with frozen evaluation evidence. The cost is a larger development-only npm
-lockfile, a 128 KiB unpacked-package budget (the current tarball is below that
-bound), and explicit maintenance of the corpus, genome and gate.
+lockfile, a 160 KiB unpacked-package budget after adding the duplicated host
+playbook and bounded OAuth adapter (the package remains runtime-dependency-free),
+and explicit maintenance of the corpus, genome and gate.
@@ -1,6 +1,6 @@
 # ADR-299: Repository CSI data-incident controls — ignore rules and a pre-commit/CI policy check

- **Status**: Accepted — controls implemented; tree remediation gated on owner sign-off
+- **Status**: Accepted — controls and current-tree remediation implemented; history coordination pending
 - **Date**: 2026-08-11
 - **Deciders**: ruv
 - **Tags**: privacy, data-governance, ci, security, incident
@@ -27,20 +27,20 @@ formatting nit.
  or present as tracked files, with a message pointing here. Tests may use
  only synthetic or expressly-consented minimal fixtures.

-**Explicitly gated on data-owner sign-off (NOT done autonomously):**
+**Owner-authorized current-tree remediation (2026-08-15):**

- Removing the existing recordings from the tree, and any history rewrite, are
-  outward-facing/destructive and require the data owner to first establish
-  provenance, consent, purpose, retention authority, and redistribution
-  rights. The review is correct that rewriting `origin` does not erase forks
-  and clones; coordination is required. This ADR records the controls and the
-  required follow-up; it does not delete the data.
+- The data owner authorized removal of the six known CSI capture and metadata
+  files from the current tree. The removal is recoverable from Git history and
+  does not claim to erase existing clones, forks, caches, or release artifacts.
+- Any history rewrite remains a separate coordinated incident-response action.
+  It requires an inventory of affected refs and releases, downstream notice,
+  credential and artifact review, and an explicit execution plan.

 ## Consequences

 - No new CSI captures can be committed (ignore + policy check).
- The existing tracked recordings remain until the owner decides; the incident
-  is documented and the guard prevents worsening it.
+- The six known tracked recordings are absent from the current tree. Historical
+  copies remain until a separately authorized and coordinated history rewrite.
 - CI gains one fast policy job; contributors get a local pre-commit check.

 ## Validation
@@ -48,3 +48,5 @@ formatting nit.
 - Policy-check unit tests: a staged `*.csi.jsonl` fails; a synthetic fixture
  under an allowed test path passes; the check is deterministic and offline.
 - Manual confirmation that the new ignore globs cover both active directories.
+- `bash scripts/csi-data-policy-check.sh --tracked` passes after the authorized
+  current-tree removal.
@@ -0,0 +1,364 @@
+# ADR-323: Native Rust physics-constrained pose refinement
+
+- **Status**: Proposed
+- **Date**: 2026-08-15
+- **Deciders**: ruv
+- **Owners**: RuView perception and edge runtime maintainers
+- **Tags**: pose, physics, rust, uncertainty, provenance, abstention, edge
+- **Numbering note**: ADR-323 is the next free number in the authoring checkout. Re-run the ADR index/collision check immediately before merge and rename if needed.
+- **Extends**: ADR-020, ADR-027, ADR-079, ADR-101, ADR-135, ADR-145, ADR-150, ADR-273, ADR-279, ADR-282, ADR-295, ADR-296, ADR-297, ADR-298, ADR-302, ADR-303, ADR-304, ADR-305, ADR-306
+- **Supersedes**: None
+
+## Executive decision
+
+RuView will add a clean-room native Rust boundary between RF pose inference and
+semantic publication. It will preserve the immutable RF observation, publish a
+physics assessment, optionally produce a bounded corrected candidate, and
+abstain when required evidence is absent. It must never increase observational
+confidence merely because a pose is physically plausible.
+
+Three independently gated layers are adopted:
+
+1. A deterministic kinematic auditor and bounded covariance-weighted projector
+   using Rust and `nalgebra`.
+2. An optional articulated-body dynamics auditor using `rapier3d`.
+3. A later optional supervised residual model using Burn.
+
+The first production milestone is deterministic audit. It is not a GRIP port,
+not PPO, and not evidence that the current pose observer is production-ready.
+
+## Context
+
+ADR-101's committed Cog emits 17 COCO keypoints as normalized 2D coordinates.
+Its model has no per-joint uncertainty head and publishes a constant confidence.
+The sensing server also contains renderer-oriented EMA and bone clamping. These
+surfaces cannot establish metric 3D physics and can make weak evidence look
+more convincing.
+
+Pose output can violate bone length, floor, velocity, acceleration, and temporal
+continuity constraints. Downstream consumers also cannot reliably distinguish
+observed coordinates from derived correction. The rejected premise is:
+"physically plausible means more likely correct." Plausibility is only a prior;
+many incorrect poses are plausible.
+
+GRIP is architectural inspiration for an observer/controller split, but it
+observes four wearable IMUs and pressure insoles and drives a simulator. RuView
+observes RF, so GRIP weights are not input-compatible. External code, weights,
+simulators, and datasets require independent license review and never enter the
+runtime dependency graph by implication.
+
+## Outcome and actors
+
+For every accepted person track/timestamp, the engine returns exactly one
+`PoseRefinementV1`, including off, timeout, rejection, and abstention paths:
+
+- immutable `PoseObservationV2` content hash;
+- constraint residuals and quality disposition;
+- an optional bounded candidate and an explicit `selected` bit;
+- a typed reason when correction is unavailable;
+- model, calibration, configuration, and optional learned-artifact provenance.
+
+The RF observer owns observations and calibrated uncertainty; tracking owns
+identity stability; physics owns assessment/correction only; the sensing server
+owns deadlines, modes, publication, and rollback; the evidence engine owns
+release evaluation; clients choose raw/both/refined without silent fallback.
+
+## Input and coordinate contract
+
+Metric correction requires a monotonic nanosecond timestamp, session-scoped
+track ID, sequence and sensor epoch, 17 ordered COCO joints in metric X/Y/Z,
+per-joint positive-semidefinite covariance calibrated on held-out data, a
+versioned right-handed Z-up room frame, a normalized upward floor plane, model
+and calibration hashes, ADR-302 trust state, and authenticated/replay-protected
+source provenance.
+
+`Image2d` observations may be audited for image-plane ratios and continuity but
+must never enter 3D projection/dynamics or be called physically corrected.
+Unknown trust, missing calibration, missing uncertainty, stale/non-monotonic
+input, non-finite values, invalid covariance, excessive tracks, and room-bound
+violations fail to raw output with a typed reason.
+
+## Public contracts
+
+`wifi-densepose-core` owns `PoseObservationV2` and `PoseRefinementV1`; no
+duplicate server/Cog contract is permitted. Public output remains COCO17. The
+engine derives pelvis and thorax virtually and never labels them observed.
+
+The raw content hash is deterministic and excludes its own hash field. The
+idempotency key is `(sensor_epoch, sequence, track_id, raw_hash, config_hash)`.
+An exact duplicate returns the cached result; same sequence with different
+content is a replay rejection.
+
+Contact is `hypothesis` unless a measured sensor and its provenance say
+otherwise. Raw, derived, hypothesis, and unknown labels must survive every
+projection.
+
+## Confidence invariant
+
+For upstream calibrated confidence `c_obs`, normalized residual `r`, and
+normalized intervention `i`:
+
+```text
+c_physics = exp(-(beta_r * r + beta_i * i))
+c_effective = min(c_obs, c_obs * c_physics)
+0 <= c_effective <= c_obs <= 1
+```
+
+Only a separately witnessed multimodal fusion contract may increase fused
+confidence.
+
+## Deterministic projector
+
+The default `kinematic` feature has no Rapier, Burn, ONNX, libtorch, Python,
+CUDA, or network dependency. Per bounded iteration it:
+
+1. projects observed parent/child distances toward anonymous track-scoped
+   bone-length posteriors;
+2. applies broad joint/trunk validity checks without an upright prior;
+3. bounds temporal motion and resets derivatives after gaps;
+4. resolves floor penetration only, allowing seated, kneeling, prone, child-
+   scale, mobility-aid, and genuine-fall poses;
+5. recomputes residuals and stops below epsilon.
+
+Initial operator-owned caps are four iterations (hard maximum eight), 0.20 m
+single-joint correction, 0.10 m root correction, 250 ms derivative gap, 500 ms
+track reset, ten known joints, a 100 m metric room bound, a separate 16,384
+image-coordinate audit bound, and a 5 ms one-track Pi 5 p95 gate. Keeping image
+and metric bounds separate prevents legitimate pixel observations from
+weakening the physical room bound. A candidate over either correction cap is
+discarded in full.
+
+Bone posteriors are initialized only from high-confidence frames, anonymous,
+memory-only, track-scoped, and deleted on expiry. Persistent personalization is
+outside this ADR and requires consent/retention/deletion governance.
+
+## Optional dynamics and learned layers
+
+`dynamics` adds a process-owned Rapier humanoid and begins audit-only. Network
+input may never provide Rapier snapshots, bodies, constraints, solver limits,
+or arbitrary geometry. Dynamics approval is independent of kinematic approval.
+
+`learned` uses first-party Burn 0.21 core/NN components without `burn-tch`
+because this workspace already has a different native libtorch link.
+`learned-cpu` adds the ndarray backend. The implemented two-layer GRU uses a
+20-frame history and width 128 to predict bounded residuals, uncertainty,
+foot-contact hypotheses, and abstention. Verified model records can be loaded
+from bytes and executed natively; no trained artifact is shipped or approved.
+The resolved Burn/CubeCL graph declares Rust 1.92, while the workspace file
+pins Rust 1.89 and the authoring host provides Rust 1.91.1.
+`--ignore-rust-version` is diagnostic evidence only: learned activation remains
+blocked until an approved Rust 1.92 release-toolchain change builds it without
+that override. Residuals are hard-clipped to deterministic caps and cannot
+bypass validation or confidence monotonicity. PPO is deferred until measured
+evidence identifies a failure supervised residual learning cannot address.
+
+## Feature boundary
+
+```text
+default = kinematic
+dynamics = rapier3d
+learned = burn-core + burn-nn
+learned-cpu = learned + burn-ndarray
+learned-train = learned + burn-train
+learned-wgpu = learned-train + burn-wgpu
+learned-cuda = learned-train + burn-cuda
+deterministic = rapier3d?/enhanced-determinism
+```
+
+The lockfile is release authority. The learned feature currently requires the
+toolchain supported by Burn/CubeCL's resolved graph; this does not change the
+default edge build.
+
+## Runtime modes and API
+
+Rollout is `OFF -> AUDIT -> SHADOW_CORRECT -> OPT_IN_CORRECT -> DEFAULT_CORRECT`.
+Evidence permits forward transitions; any regression returns immediately to
+audit/off. Correct selection additionally requires authenticated sensor
+identity and replay protection from ADR-305. High model confidence cannot
+override missing source authentication.
+
+Existing pose fields stay unchanged and raw remains the migration default:
+
+```text
+GET /api/v1/pose/current?view=raw
+GET /api/v1/pose/current?view=both
+GET /api/v1/pose/current?view=refined
+```
+
+Refined-only returns HTTP 409 with `pose_refined_unavailable` when no selected
+candidate exists. It never silently returns raw labeled refined.
+
+## Security, privacy, and availability
+
+All frames, model output, geometry, and pre-verification artifacts are
+untrusted. Calibration/config/model artifacts become trusted only after signed,
+hash-addressed verification and atomic activation. Runtime inference performs
+no model retrieval or other network access.
+
+Fixed arrays/caps, bounded iterations, a maximum track count, room geometry
+limits, deadlines, and track expiry constrain denial of service. Timeout drops
+partial refinement, never raw publication. Backpressure retains the newest raw
+frame per track, drops intermediate refinement work, resets derivatives after
+250 ms, and never extrapolates beyond 500 ms.
+
+Metrics contain only allowlisted aggregate scalars: mode/disposition/reason,
+stage latency, iterations, maximum correction, residuals, confidence delta,
+track resets, invalid input, timeout, and raw/refined divergence. They exclude
+joint arrays, body dimensions, room coordinates, CSI, and persistent person
+identifiers. Bone/gait state is memory-only and excluded from logs.
+
+Refined output is not a sole medical, emergency, industrial-safety, or
+autonomous-control source. A real fall is valid state and must never be made
+upright to stabilize a simulator.
+
+## Threat model summary
+
+| Threat | Primary control | Residual risk |
+|---|---|---|
+| Spoofed/replayed sensor | ADR-305 identity, MAC, sequence and replay window; correction gate | Compromised legitimate sensor |
+| Altered model/floor/config | Signed hashes, authenticated configuration, atomic activation | Authorized unsafe configuration |
+| Poisoned data/splits | Immutable manifests, strict split validator, witnessed benchmarks | Subtle label poisoning |
+| Operator repudiation | Append-only witnessed transition with actor/old/new hash/reason | Compromised signer |
+| Biometric/log leakage | Track-local retention and fixed metric allowlist | Aggregate inference |
+| Track/geometry CPU flood | Authentication, cardinality/geometry/allocation/deadline caps | Valid dense-scene overload |
+| Remote mode escalation | Capability-scoped local control plane, deny by default | Compromised operator capability |
+| Derived output relabeled observed | Required schema/provenance and signed event envelope | Malicious downstream stripping |
+
+The implementation review records commit, lockfile hash, Rust toolchain,
+scanner versions, and advisory-feed timestamp.
+
+## Evidence protocol
+
+Evidence levels are L0 deterministic synthetic, L1 public measured replay, L2
+controlled RuView RF plus optical truth, L3 subject/room/hardware/session-
+disjoint RuView, L4 privacy-safe shadow fleet aggregates, and L5 independent
+vertical validation outside this ADR.
+
+No sequence, contiguous take, subject, room, or calibration session may cross
+train/test for the generalization gate. Preprocessing, body priors, and
+uncertainty calibration fit training data only. Reports include raw observer,
+renderer smoothing, audit, deterministic correction, dynamics audit, and
+learned residual on identical observations, plus empty-room, prone/fall,
+missing-joint, and OOD subsets.
+
+Primary metrics are 3D MPJPE, declared-threshold PCK, per-joint error, foot
+slide, floor penetration, jerk, uncertainty calibration, abstention coverage,
+and selective risk. Learned runs use at least five fixed seeds and report mean,
+median, standard deviation, and 95% bootstrap intervals. All frames count;
+selective metrics report risk and coverage.
+
+## Acceptance gates
+
+- **G0 contract**: real metric 3D/covariance output, round-trip raw hash,
+  versioned frame/floor, 2D compatibility, non-stub observer, ADR-298 artifact
+  sanity, and the ADR-079 PCK@20 >=35% gate or adopted successor. The current
+  committed Cog does not pass G0, so correction remains unavailable.
+- **G1 deterministic audit**: property/fuzz tests, deterministic hashes per
+  platform class, 24-hour accelerated replay without panic/growth, Pi 5 p95
+  <=5 ms, and universal confidence monotonicity.
+- **G2 shadow correction**: strict-disjoint measured median MPJPE improvement
+  >=10% with positive 95% CI lower bound; foot slide >=30% and jerk >=25%
+  better; no joint median >5 mm worse; fall/prone sensitivity change <=2 pp;
+  >=95% corrections below 0.10 m; every correction above 0.20 m abstains.
+- **G3 opt-in**: >=30 subjects, 10 rooms, 3 hardware configurations, and 3
+  independent sessions/room; UNKNOWN never selected; confidence monotonic;
+  live disable; REST/WebSocket/MQTT/Home Assistant/replay compatibility.
+- **G4 default visualization only**: 30 shadow days under 0.1% timeout/internal
+  error, no open severity 1/2 incidents, and gates still valid for current
+  model/calibration.
+
+Dynamics and learned engines each repeat G2-G4; approval is not inherited.
+
+## Testing and completion evidence
+
+Unit/property/fuzz/integration/security coverage maps to requirements R1-R13:
+raw hash, confidence, modes, malformed/stale/frame/covariance input, caps and
+deadlines, provenance, dependency graph, pose diversity/fall preservation,
+strict splits, fail-to-raw faults, no network capability, and authenticated
+source/replay selection.
+
+Release commands include focused core/physics tests, default/dynamics/learned
+feature checks, format/clippy, benches, `cargo deny`, `cargo audit`, strict split
+verification, and golden replay verification. Completion also requires JSON
+schemas, measured Pi 5/x86 rows, strict manifest hashes, raw/refined metrics,
+SBOM/license report, rollback drill, and residual-risk owners. Missing measured
+or operational evidence leaves status Proposed and runtime in audit.
+
+## Rollback
+
+Rollback is an authenticated mode transition to audit/off, not a binary
+downgrade. Stop selection immediately, keep raw publication and disposition
+records, discard track state, and retain only aggregate incident metrics plus
+signed configuration history. Failed artifact activation leaves the previous
+engine atomically active. Additive schemas remain; refined-only callers receive
+the typed unavailable response.
+
+## Consequences
+
+### Positive
+
+- Explicit anti-hallucination and provenance boundary after RF inference.
+- Reusable native Rust consistency primitive with measurable abstention.
+- Python/CUDA remain absent from the production default.
+- Cross-modal teacher data remains possible without wearable runtime inputs.
+
+### Negative
+
+- Full value requires a real metric 3D observer and calibrated uncertainty.
+- Stateful tracks add latency/memory; optional backends add supply-chain surface.
+- A constrained but wrong pose can look more credible.
+- Strict data collection costs more than the software implementation.
+
+### Neutral
+
+- This ADR does not improve RF observability or current weight evidence.
+- Existing 2D consumers continue to function.
+
+## Implementation phases
+
+P0 contracts/schemas; P1 deterministic audit; P2 bounded shadow correction; P3
+server/Cog publication and evidence ledger; P4 Rapier audit; P5 Burn residual
+training/inference. Code may land ahead of evidence, but runtime authority
+advances only through the gates above.
+
+## Implementation status at proposal
+
+- P0-P3 are implemented on this branch: canonical contracts, strict schemas,
+  deterministic audit/projection, authenticated correction receipts,
+  idempotency, bounded track state, latest-frame backpressure, additive HTTP
+  and WebSocket publication, live legacy-2D audit, privacy-safe metrics, golden
+  replay, and strict-split checks.
+- P4 is implemented as an optional persistent per-track Rapier dynamics auditor
+  and remains audit-only pending independent G2-G4 evidence.
+- P5 inference architecture, artifact verification, serialization, and native
+  CPU execution are implemented. Training data, a signed trained artifact, and
+  G2-G4 accuracy/calibration evidence do not exist, so the layer has no runtime
+  selection authority. Its resolved Rust 1.92 requirement is also an explicit
+  activation blocker on the current Rust 1.91.1 release host.
+- The live Cog honestly emits `Image2d`, degraded trust, and uncalibrated
+  uncertainty. It can be audited but cannot be selected for 3D correction.
+  G0 therefore remains open until an independently released metric-3D observer
+  with calibrated covariance is integrated.
+- Local x86 latency and synthetic contract checks are recorded in the append-
+  only evidence ledger. Pi 5 measurements, 24-hour replay, 100-million-case
+  fuzzing, held-out RF/optical accuracy, fleet shadowing, and vertical safety
+  validation remain release evidence gates rather than software claims.
+
+## References
+
+- [GRIP project](https://ryosukehori.github.io/grip-project/)
+- [GRIP paper (arXiv:2603.16233)](https://arxiv.org/abs/2603.16233)
+- [Rapier documentation](https://docs.rs/rapier3d/)
+- [Burn documentation](https://docs.rs/burn/0.21.0/burn/)
+- [ADR-020](./ADR-020-rust-ruvector-ai-model-migration.md)
+- [ADR-079](./ADR-079-camera-ground-truth-training.md)
+- [ADR-101](./ADR-101-pose-estimation-cog.md)
+- [ADR-150](./ADR-150-rf-foundation-encoder.md)
+- [ADR-273](./ADR-273-unified-rf-spatial-world-model.md)
+- [ADR-279](./ADR-279-native-rf-frame-contract.md)
+- [ADR-298](./ADR-298-model-release-sanity-gates.md)
+- [ADR-302](./ADR-302-out-of-distribution-detection.md)
+- [ADR-303](./ADR-303-ground-truth-synchronization.md)
+- [ADR-304](./ADR-304-evidence-engine.md)
+- [ADR-305](./ADR-305-authenticated-sensor-identity.md)
+- [ADR-306](./ADR-306-canonical-spatial-ontology.md)
@@ -0,0 +1,276 @@
+# ADR-324: off-axis-mode — RF-assisted head-coupled perspective for the three.js realtime demo
+
+| Field | Value |
+|-------|-------|
+| **Status** | Proposed (core implemented — see §2.5) |
+| **Date** | 2026-08-16 |
+| **Deciders** | ruv |
+| **Codename** | **off-axis-mode** |
+| **Scope** | New `examples/three.js/demos/07-off-axis-window.html` (client-side only); no server changes |
+| **Relates to** | ADR-019 (sensing-only UI), ADR-035 (live sensing UI accuracy), ADR-169 (adam-mode), ADR-170 (yoga-mode), ADR-282 (L0–L5 evidence ladder), ADR-295 (source provenance), ADR-306 (spatial ontology), ADR-307 (persistent tracking), ADR-323 (pose refinement) |
+| **Prior art** | [`icurtis1/off-axis-sneaker`](https://github.com/icurtis1/off-axis-sneaker) (reference only — see §2.1 licensing) |
+| **Numbering note** | ADR-324 is the next free number in the authoring checkout (322 is unused, 323 is the latest on disk). Re-run the ADR index/collision check immediately before merge and rename if needed. |
+| **Tracking issue** | none yet |
+
+---
+
+## 1. Context
+
+### 1.1 The question this ADR answers
+
+"Can we use [`icurtis1/off-axis-sneaker`](https://github.com/icurtis1/off-axis-sneaker)
+with RuView?" The answer is: **yes for the technique, no for the code, and
+only honestly for the RF part.** This ADR records the research behind each of
+those three clauses and defines the integration that is actually defensible.
+
+### 1.2 What off-axis-sneaker is
+
+`off-axis-sneaker` is a React + TypeScript + Vite web app that renders a GLB
+model (a sneaker) in three.js and creates a *head-coupled perspective*
+("fish-tank VR" / "window into the screen") illusion:
+
+- **Tracking input**: MediaPipe Face Mesh (468 facial landmarks) from a
+  webcam. Head (x, y) comes from the eye midpoint; depth (z) is proxied by
+  inter-ocular distance. An exponential moving average (default factor 0.3)
+  smooths jitter; sensitivity multipliers are `strengthX: 4`, `strengthY: 3`,
+  `strengthZ: 2`.
+- **Projection**: `src/utils/offAxisCamera.ts` builds a **true asymmetric
+  (off-axis) frustum** — `makePerspective(left, right, top, bottom, near, far)`
+  with `left/right/top/bottom = (screenBound − eyePosition) · (near /
+  viewerToScreenDistance)` — i.e. Kooima's generalized perspective projection,
+  plus a matching camera translation. Constants: `nearPlane 0.05`,
+  `farPlane 1000`, `worldScale 0.01` (cm → world units), `movementScale 1.5`.
+- **Calibration**: a wizard captures physical screen width/height (cm),
+  typical viewing distance, and pixel density, stored locally, so eye position
+  is computed relative to the *physical* display.
+
+The technique descends from Johnny Chung Lee's 2007 Wii-remote desktop VR
+demo and the fish-tank VR literature (Ware, Arthur & Booth, CHI '93). The
+projection math is Robert Kooima's "Generalized Perspective Projection"
+(2008). Both are public, well-documented techniques independent of any one
+implementation.
+
+### 1.3 What the illusion physically requires
+
+The head-coupled illusion is only convincing when the tracked eye position is
+**accurate to roughly centimeters** and **low-latency**. The VR literature
+puts comfortable motion-to-photon latency below ~20 ms for head-mounted
+displays; desktop fish-tank VR tolerates more, but visible lag between head
+motion and parallax response is exactly what breaks the "window" illusion.
+`CLAIMED` (literature values; no RuView measurement exists for this demo yet).
+
+### 1.4 What RuView RF sensing can actually supply today
+
+This is where honesty is mandatory (repo rule: never present WiFi sensing as
+camera-grade).
+
+- **Field-peak position, not metric localization.**
+  `wifi-densepose-sensing-server/src/field_localize.rs` derives a position
+  from the strongest peak of the 20×20 `signal_field` carried on
+  `/ws/sensing` `sensing_update` frames. Its own module doc states the
+  caveat: the subcarrier→angle mapping is a *representation*; "a single ESP32
+  link cannot resolve a true (x, z) room position." The emitted position is
+  "strongest field peak in the room model," mapped with `X_SCALE 0.6`,
+  `Z_SCALE 0.5`, gated by `PEAK_THRESHOLD 0.35` — real, live, motion-tracking,
+  but **not a calibrated person fix** and nowhere near eye-position precision.
+- **RF pose is 2-D, normalized, constant-confidence.** The committed Cog
+  (ADR-101, restated by ADR-323) emits 17 COCO keypoints as normalized 2-D
+  coordinates with a constant confidence and no per-joint uncertainty. A
+  "nose" keypoint exists (COCO index 0), but it is not a metric 3-D head fix.
+- **Tracks are coarse and pseudonymous by design.** `ruview-track` (ADR-307)
+  maintains `person_N` tracks with container-level ("kitchen → hallway")
+  continuity, coarse non-reversible features, and asserts **no accuracy
+  number** — outputs default to evidence level `L1`.
+- **Update cadence and latency are unmeasured for this purpose.** The demo
+  pipeline runs at ~30 Hz on the MediaPipe side (ADR-170), but no end-to-end
+  RF motion-to-photon latency has been measured. Any figure quoted for the RF
+  path must be tagged `MEASURED` with a reproducer before it appears in docs
+  or UI.
+
+Conclusion of the capability match: **RF cannot drive a convincing fish-tank
+illusion by itself today**, and this ADR does not claim it can. RF *can*
+supply things a webcam cannot: camera-free presence, zone-level position,
+person count, approach direction, and pseudonymous continuity — including
+when the camera is off.
+
+### 1.5 What this ADR is *not*
+
+- Not a vendoring of `off-axis-sneaker` (see §2.1 — the repo has no license).
+- Not a claim of camera-grade RF head tracking, at any tier.
+- Not a backend change: no new server endpoints, no new auth surface, no
+  schema changes. Purely additive client-side HTML/JS, like ADR-169/170.
+- Not a React/Vite/Tailwind adoption. The `examples/three.js/demos/*` are
+  dependency-light single-file HTML demos and stay that way.
+
+## 2. Decision
+
+### 2.1 Licensing: adopt the technique, not the code
+
+`off-axis-sneaker` publishes **no license**. Under default copyright, its
+source cannot be copied, vendored, or translated into this repository.
+Decision:
+
+1. **No code, assets, or models from `off-axis-sneaker` enter this repo.**
+   The GLB sneaker model is likewise unlicensed for reuse; demos use assets
+   already present in `examples/`.
+2. The off-axis projection is implemented **clean-room from the public
+   sources**: Kooima's "Generalized Perspective Projection" (2008) — the
+   `pa/pb/pc` screen-corner formulation — and three.js's documented
+   `PerspectiveCamera.projectionMatrix` override path. The repository is cited
+   as prior art in this ADR only.
+3. If upstream later adds a permissive license, revisiting reuse requires a
+   new ADR note, not silent copying.
+
+### 2.2 Tiered integration — each tier labeled by what it really is
+
+**Tier A (ships first): webcam-fine + RF-context hybrid.**
+`07-off-axis-window.html` uses MediaPipe Face Landmarker (already the pattern
+in demo 05) for fine head tracking and the Kooima frustum for rendering —
+functionally what off-axis-sneaker does, reimplemented. RuView RF adds the
+camera-free layer around it:
+
+- **Presence-gated camera**: the webcam pipeline starts only when the RF
+  presence signal (`/ws/sensing` `sensing_update`) says someone is in the
+  zone, and stops after a configurable RF-vacancy timeout. The privacy
+  posture improves: the camera is *off* until physics says there is someone
+  to track.
+- **Multi-person arbitration**: when RF reports more than one person, the HUD
+  says so and the demo holds the last stable perspective instead of jumping
+  between faces.
+- **Pre-warm**: RF approach direction (field-peak trajectory) warms up
+  MediaPipe and the scene before the person sits down.
+
+**Tier B (demo mode, prominently labeled): RF-only coarse parallax.**
+A toggle drives the off-axis eye position from RF alone — field peak (x, z)
+plus the pose nose keypoint when present — through a one-euro filter, a
+deadband, and a hard gain clamp. The HUD labels it **"RF coarse body
+parallax — not head tracking"** and shows the live evidence level (`L1`
+heuristic unless a certificate says otherwise, per ADR-282/ADR-318). The
+expected experience is a slow, body-scale parallax sway — a demonstrative
+"the room model moves because *you* moved, with no camera" — not a stable
+fish-tank illusion. The demo must never present Tier B as equivalent to
+Tier A.
+
+**Tier C (future, explicitly gated, not promised): metric RF head position.**
+Only a calibrated multistatic deployment (ADR-297 multi-node semantics,
+ADR-311 fusion, ADR-303 ground-truth sync) with an evidence-engine ledger
+entry (ADR-304) and a capability certificate (ADR-318) could justify feeding
+RF positions into the fine path. No current data supports this; Tier C exists
+in this ADR solely so nobody ships it informally without those gates.
+
+### 2.3 Implementation surface
+
+- New file `examples/three.js/demos/07-off-axis-window.html` (07, not 06 —
+  ADR-170 reserves `06-yoga-mode.html`). Single-file demo following the 01–05
+  conventions: same CSS custom properties, same HUD/helper-panel pattern,
+  served from the existing static demo server
+  (`http://127.0.0.1:8765/examples/three.js/demos/…`).
+- A small clean-room module (inline `<script type="module">` or
+  `examples/three.js/lib/off-axis-camera.js` if shared later) that, given
+  screen corners `pa, pb, pc` (from calibration) and eye point `pe`, sets
+  `camera.projectionMatrix` via the Kooima formulation each frame.
+- Data inputs are the **existing** streams only: `/ws/sensing`
+  (`sensing_update` → `signal_field` → field peak, using the same
+  `X_SCALE`/`Z_SCALE`/`PEAK_THRESHOLD` mapping as `field_localize.rs`) and,
+  when available, `/api/v1/stream/pose` for the nose keypoint. WebSocket
+  access uses the existing ticket flow (`ws_ticket.rs` / `bearer_auth.rs`);
+  no endpoint is exempted or added.
+- Calibration mirrors the sneaker app's concept without its code: screen
+  width/height in cm, viewing distance, persisted in `localStorage` under a
+  demo-scoped key. No calibration data leaves the browser.
+- Provenance discipline: if the demo is pointed at a synthetic or replayed
+  source, the ADR-295 provenance state must surface in the HUD exactly as the
+  Observatory does — synthetic can never present as live.
+
+### 2.4 Honesty and evidence rules binding this feature
+
+1. Every user-visible latency, accuracy, or precision statement in the demo,
+   README, or docs carries a `MEASURED` (with reproducer), `CLAIMED`, or
+   `SYNTHETIC` tag. This ADR itself contains no `MEASURED` claims.
+2. Tier B is labeled coarse body parallax in the HUD at all times; there is
+   no configuration that hides the label while RF drives the camera.
+3. No PCK or pose-accuracy number may be quoted for the RF path without the
+   mean-pose baseline and a leakage-free held-out split (repo rule).
+4. The webcam feed never leaves the browser; no frames, landmarks, or
+   embeddings are sent to the server. RF data continues to obey ADR-307's
+   privacy invariants (pseudonymous, coarse, rotatable).
+
+### 2.5 Implementation status (2026-08-16 amendment)
+
+The projection core shipped as a **Rust crate compiled to WASM** rather than
+the inline JS module §2.3 anticipated — a strict upgrade with the same
+surface: `v2/crates/ruview-offaxis` (dependency-free native core; wasm-bindgen
+only on wasm32) implements the Kooima projection, the one-euro filter, the
+field-peak mapping (constants mirroring `field_localize.rs`), and the Tier B
+coarse-parallax stage with its deadband/gain/clamp bounds enforced in Rust.
+`examples/three.js/demos/07-off-axis-window.html` consumes the wasm-bindgen
+output (built locally per the crate README; generated artifacts are not
+committed). Validation and `MEASURED` benchmarks live in the crate README.
+The demo ships with a `SYNTHETIC`-labeled mouse simulator and the labeled
+Tier B RF mode; a Tier A fine tracker connects through
+`OffAxisCamera.update_normalized` and remains host-provided.
+
+## 3. Options considered
+
+| Option | Verdict | Why |
+|---|---|---|
+| Vendor `off-axis-sneaker` (or fork + point at RuView) | **Rejected** | No license ⇒ no redistribution rights. Also React/Vite stack conflicts with the repo's single-file demo convention. |
+| Clean-room Kooima off-axis demo, webcam-fine + RF-context (Tier A/B) | **Chosen** | Legally clean, matches demo conventions, uses RF for what it is actually good at, and demonstrates camera-free presence value honestly. |
+| RF-only head-coupled perspective as the headline | **Rejected** | Over-claim. Single-link field peaks are a representation, not metric localization (`field_localize.rs` caveat); shipping this as "head tracking" violates the camera-grade rule. Survives only as the labeled Tier B toggle. |
+| Wait for multistatic metric localization (Tier C) before any demo | **Rejected** | Blocks a useful, honest demo on a phase-2/3 program (ADR-303/311/318) with no delivery date. The gates are recorded instead. |
+| Add a dedicated server endpoint for head position | **Rejected** | Unnecessary — existing `/ws/sensing` + `/api/v1/stream/pose` suffice; a new endpoint would expand the auth surface for no capability gain. |
+
+## 4. Consequences
+
+**Improves**
+
+- A publicly legible demo of RF sensing's actual differentiator: the scene
+  knows you are there, where you roughly are, and how many of you there are —
+  before and without any camera.
+- Privacy posture of the head-tracking demo class: camera duty-cycle is
+  bounded by RF presence instead of always-on.
+- Canonical, licensed off-axis projection code the Observatory or future UI
+  can reuse.
+
+**Costs / risks**
+
+- Tier B can underwhelm viewers primed by webcam demos; the mitigation is the
+  labeling and the side-by-side toggle, not inflated gain.
+- MediaPipe CDN dependency (same as demo 05) remains a network-availability
+  risk for Tier A; the demo must degrade to Tier B with a visible notice.
+- Screen-calibration friction (cm measurements) may deter casual users; a
+  "skip calibration (approximate)" path with degraded-accuracy labeling is
+  acceptable.
+- Upstream `off-axis-sneaker` may change or add a license; tracking that is
+  manual.
+
+**Follow-ups (not in this ADR's scope)**
+
+- Measure end-to-end RF motion-to-parallax latency with a reproducer and
+  publish it `MEASURED`.
+- If/when ADR-303/311 land, evaluate Tier C against the ADR-318 certificate
+  gate.
+- Consider promoting the off-axis camera module into the Observatory 3D view.
+
+## 5. Validation
+
+- Demo checklist (manual, per ADR-169/170 practice): loads from the static
+  server; Tier A activates only on RF presence; Tier B label visible whenever
+  RF drives the camera; provenance badge correct against a synthetic source;
+  no network requests carrying webcam-derived data (verified in devtools).
+- `rg` gate before merge: no file under `examples/` contains code originating
+  from `icurtis1/off-axis-sneaker`.
+- No workspace, harness, or firmware validation rows are triggered — the
+  change is a static HTML demo plus this document.
+
+## 6. References
+
+- [`icurtis1/off-axis-sneaker`](https://github.com/icurtis1/off-axis-sneaker) — prior-art reference (unlicensed; technique only)
+- Robert Kooima, *Generalized Perspective Projection*, 2008 — off-axis frustum math
+- Johnny Chung Lee, *Head Tracking for Desktop VR Displays using the Wii Remote*, 2007
+- Ware, Arthur & Booth, *Fish Tank Virtual Reality*, CHI '93 — head coupling vs. stereo
+- `v2/crates/wifi-densepose-sensing-server/src/field_localize.rs` — field-peak honesty caveat and coordinate mapping
+- `v2/crates/wifi-densepose-sensing-server/src/ws_ticket.rs`, `bearer_auth.rs` — WebSocket auth pattern
+- `v2/crates/ruview-track/src/lib.rs` — ADR-307 privacy invariants and evidence discipline
+- ADR-169, ADR-170 — demo-scoped ADR pattern for `examples/three.js/demos/`
+- ADR-282 — L0–L5 evidence ladder; ADR-295 — provenance state machine
@@ -0,0 +1,543 @@
+# ADR-325: Cognitum Spaces activation and governed spatial exchange
+
+- **Status**: Accepted — legacy and versioned reads, OAuth activation, local spatial memory, governed-action policy, metaharness support, and npm distribution are implemented; HTTPS production evidence is complete
+- **Date**: 2026-08-17
+- **Deciders**: ruv
+- **Tags**: cognitum-spaces, oauth, spatial-state, privacy, ruvector, policy, autogenous
+- **Relates to**: ADR-271, ADR-277, ADR-304, ADR-306, ADR-312, ADR-318, ADR-319, ADR-321; Cognitum API ADR-094; Autogenous ADR-402
+
+## Context
+
+RuView produces camera-free RF perception locally. Cognitum Spaces provides a
+tenant-scoped cloud projection of physical places. Autogenous ADR-402 proposes
+using that projection as a spatial-intelligence input for agent coordination.
+The useful product is not another sensor dashboard: it is a governed chain from
+local perception to spatial state, persistent memory, explanation, and action.
+
+Four product pillars define the requested integration:
+
+1. **Spatial state** — sites, buildings, floors, rooms/spaces, zones, entities,
+   semantic events, and alerts.
+2. **RuView perception** — camera-free sensing is normalized locally before any
+   permitted P2/P3 semantic event synchronizes.
+3. **Persistent memory** — RuVector grounds anomaly explanations in
+   tenant-scoped spatial history.
+4. **Governed action** — agents observe or recommend by default; consequential
+   execution requires explicit policy authorization.
+
+The live API audit on 2026-08-17 established the current production boundary:
+
+- `GET https://api.cognitum.one/v1/spaces` exists and returns a bounded list;
+- an unauthenticated request is rejected;
+- the current account has no paired sites, so the authenticated result is an
+  empty list rather than fabricated sample state;
+- the projection declares HomeCore Edge authoritative and excludes raw CSI,
+  CIR, RF tensors, recordings, pose frames, vital waveforms, and identity
+  observations;
+- the first deployed Function revision accepted only legacy `cog_` API keys;
+- the gateway was configured to authenticate private Function hops, but the
+  direct Function endpoint was still publicly invokable; that bypass has now
+  been closed and the exact gateway runtime service account is the only
+  invoker;
+- OAuth protected-resource metadata and a RuView-scoped OAuth accept path were
+  absent.
+
+The Autogenous review at commit
+`f7fa308b261bac89a8909edae8a3fdbbfb8ce66c` found additional integration risks:
+
+- its Spaces client only listed spaces; no governed ingest contract existed;
+- it trusted a loose TypeScript cast, with no response-size, timeout, redirect,
+  or strict semantic-boundary validation;
+- its observation conversion dropped tenant/message/sequence identity;
+- missing confidence became zero but could still enter fusion;
+- provenance could be substituted for calibration identity;
+- a Spaces-derived belief could be converted back into an observation and
+  counted as independent corroboration, laundering one source into two;
+- its API-key exchange returns a `cognitum-cli` OAuth token, but the live Spaces
+  endpoint accepted only a `cog_` key. Calling this “OAuth Spaces access” was a
+  contract mismatch.
+
+## Decision
+
+Adopt a one-way-by-default, typed spatial exchange with separate activation,
+data, memory, and action authorities.
+
+```text
+RuView RF capture (P0/P1, local)
+  -> calibrated/OOD-gated semantic observation
+  -> ontology + evidence + witness envelope (P2/P3)
+  -> HomeCore authoritative edge state
+  -> Cognitum Spaces tenant/workspace projection
+  -> RuView bounded read client / Autogenous spatial context
+  -> RuVector tenant-scoped memory and explanation
+  -> recommendation
+  -> ruvview-policy authorization + approval + receipt
+  -> optional consequential action
+```
+
+Cloud state is a projection of edge state, not a second sensor and not an
+independent corroborating modality.
+
+### 1. Activation and data-plane credentials are distinct
+
+RuView uses Cognitum's existing Authorization Code + PKCE flow with the public
+`ruview` client. A user explicitly requests `spaces:read` with
+`wifi-densepose login --spaces`. The authorization-server registration is a
+ceiling; ordinary sensing login does not silently gain cloud access.
+
+The Spaces resource server accepts either:
+
+- a legacy API key carrying `spaces:read` (or the migration-compatible
+  predecessor `devices:manage`); or
+- a Cognitum OAuth access token that passes every condition below.
+
+OAuth acceptance is conjunctive:
+
+| Check | Required value |
+|---|---|
+| Signature | ES256 against `https://auth.cognitum.one/.well-known/jwks.json` |
+| Issuer | exact `https://auth.cognitum.one` |
+| Audience | exact `ruview` |
+| Client claim | exact `ruview` |
+| Token type | ordinary `access`; setup/workload tokens denied |
+| Lifetime | current `exp`/`nbf`, five-second clock tolerance only |
+| Scope | exact token `spaces:read` member |
+| Tenant binding | valid non-empty UUID `org_id` and `workspace_id` |
+
+An API key is not called OAuth. An OAuth token is not stored in
+`COGNITUM_SPACES_API`. The compatibility environment variable contains an API
+key only and is never printed, logged, or committed.
+
+OAuth consent grants identity-bound read access. It does **not** grant device
+pairing, data publication, deployment, billing, spending, leases, learning
+promotion, automation installation, commands, or actuator authority.
+
+The contributor metaharness exposes this as CLI verb `spaces` and MCP tool
+`ruview_spaces_list`. It delegates to the same Rust client rather than parsing
+or refreshing OAuth independently. The tool never accepts a bearer token or API
+key. MCP use requires an operator-provided `credential-use` grant, and MCP calls
+cannot select the credential path or API origin. The adapter requires an
+installed `wifi-densepose` binary rather than executing Cargo build scripts
+from an auto-detected checkout while holding credential authority. Because
+refresh tokens rotate, a read may atomically update the local OAuth credential
+before contacting Spaces; this authentication side effect is disclosed and
+does not add cloud write authority.
+
+### 2. The gateway owns the private credential relay
+
+The public gateway strips inbound `X-Cognitum-User-Authorization` and
+`X-Serverless-Authorization`. For a locked Function upstream it then:
+
+1. retains a legacy `cog_` credential in `X-API-Key`, or, for the exact Spaces
+   route only, retains a non-key bearer in a gateway-owned internal header;
+2. replaces `Authorization` with the gateway's Google invoker ID token;
+3. fails closed with `503` if it cannot mint that hop identity;
+4. forwards only to the configured Function origin.
+
+The Function's Cloud Run invoker check is enabled. `allUsers` has no invoker
+binding; only the exact `apigateway-sa` service account may invoke it. This is
+required because otherwise a caller could bypass Cloud Armor and spoof an
+internal relay header.
+
+The API publishes RFC 9728 protected-resource metadata naming the authorization
+server and `spaces:read` scope. Discovery describes capability; it does not
+grant it.
+
+### 3. Tenant isolation is part of authentication
+
+Legacy API-key documents are queried by their existing owner-bound `tenantId`.
+OAuth requests are conjunctively queried by both signed `org_id` and
+`workspace_id` using stored `tenantId` and `workspaceId` fields. The public
+tenant identifier is projected from signed `org_id`. A request cannot supply
+either selector in a query string.
+
+No cross-tenant aggregation exists on this path. Pagination, search, memory,
+and event endpoints added later must carry the same authoritative principal;
+client-provided tenant filters may only narrow within it, never replace it.
+
+### 4. Spatial model and ownership
+
+The canonical RuView vocabulary remains ADR-306:
+
+```text
+Site -> Building -> Floor -> Space -> Zone
+                                  -> Sensor / Person / Object / Track
+                                  -> Observation -> Event -> Alert
+```
+
+Cognitum may call a bounded room a “space”; RuView does not create a second
+room type. Stable external IDs are namespaced and validated before entering the
+ontology. HomeCore remains authoritative for local registry state and local
+automation. Cognitum owns tenant/workspace projection and activation. RuVector
+owns indexed spatial history, not tenancy or authorization.
+
+The current live endpoint exposes the first `Space` slice only. Sites, floors,
+zones, entities, events, and alerts are contract milestones, not inferred from
+missing fields. A client must represent absence as unknown/unavailable and must
+not fabricate parents, coordinates, people, alerts, or provenance.
+
+### 5. Privacy boundary and synchronization eligibility
+
+Only allow-listed P2/P3 semantic projections may cross the cloud boundary.
+
+| Class | Examples | Cloud default |
+|---|---|---|
+| P0 | raw CSI, CIR, RF tensors, packet captures | prohibited |
+| P1 | pose frames, vital waveforms, identity observations, recordings | prohibited |
+| P2 | occupancy count, bounded activity/fall possibility, anomaly score | permitted when policy allows |
+| P3 | versions, connection health, signed capability metadata | permitted |
+
+The client independently rejects forbidden raw-field names anywhere in the
+response. This is defense in depth, not a substitute for server-side
+projection. It also enforces HTTPS except for loopback tests, refuses redirects,
+uses bounded connect/total timeouts, caps responses at 1 MiB, caps the list at
+100 spaces, bounds nesting/arrays/strings, validates confidence, and rejects
+non-P2/P3 space records.
+
+Cloud-bound envelopes must preserve, when available:
+
+- tenant/workspace/site/space/device identity;
+- `messageId` and monotonic `eventSequence`;
+- `observedAt`, `expiresAt`, freshness, and connection state;
+- privacy class and semantic schema version;
+- calibrated confidence and explicit uncertainty/abstention;
+- model, HomeCore, hardware-manifest, calibration, evidence, and witness
+  provenance.
+
+Provenance is never used as a calibration identifier. Missing confidence,
+calibration, timestamp, or tenant identity stays missing and cannot satisfy an
+admission rule.
+
+### 6. No feedback laundering or false corroboration
+
+A Spaces record derived from RuView evidence carries derivation lineage. If it
+returns to RuView or Autogenous, it is a **projection/recollection** of that
+lineage, not a new observation. It cannot:
+
+- increment corroborating-sensor count;
+- raise evidence level;
+- be fused as an independent modality;
+- reset freshness to retrieval time;
+- erase abstention, contradiction, or uncertainty;
+- generate a second belief that cites the first as support.
+
+Deduplication keys include tenant, source/witness identity, message ID, and
+sequence. Cycles are detected and rejected. Independent corroboration requires
+a distinct authenticated source and evidence chain.
+
+### 7. Persistent memory is tenant-scoped and explanation-oriented
+
+RuVector indexes accepted semantic state under at least:
+
+```text
+(tenant_id, workspace_id, site_id, space_id, schema_version, time_bucket)
+```
+
+It stores bounded semantic features, uncertainty, evidence references, and
+witness digests. It does not store OAuth/API credentials or prohibited raw
+payloads. Retrieval always applies the authenticated tenant/workspace filter
+before similarity ranking.
+
+An anomaly explanation names:
+
+- the current semantic state and its uncertainty;
+- the relevant learned baseline/window from ADR-312;
+- comparable tenant-local history;
+- the measured deviation and contradictory evidence;
+- the provenance/witness chain;
+- the evidence label (`MEASURED`, `SYNTHETIC`, or `CLAIMED`).
+
+Memory supplies context, not permission. A historically common action is not
+automatically authorized.
+
+### 8. Agents observe and recommend; policy authorizes action
+
+Autogenous and other agents receive read-only spatial context by default. Their
+normal outputs are observations, explanations, proposals, and recommendations.
+
+Any consequential action must cross the ADR-321 `ruview-policy` gate with:
+
+- an exact action class and target;
+- a fresh capability certificate;
+- KNOWN/DEGRADED/UNKNOWN domain state;
+- bounded uncertainty and sufficient evidence;
+- tenant/workspace authorization;
+- expiry, nonce, idempotency key, and replay protection;
+- required human/policy approval;
+- a terminal witness receipt for allow or deny.
+
+Missing policy, unknown action class, stale state, incomplete provenance, or an
+unavailable approval service denies. OAuth `spaces:read` can never authorize an
+action. This ADR adds no actuator method to the Spaces client.
+
+## Implementation
+
+### RuView
+
+- `ruview-cognitum-spaces` is a reusable, read-only client with typed/redacted
+  credentials and a bounded response decoder.
+- `wifi-densepose login --spaces` explicitly requests `spaces:read` through the
+  existing PKCE flow and credential store.
+- `wifi-densepose spaces` refreshes OAuth through the existing single-flight,
+  persist-before-return mechanism, verifies that the stored grant contains
+  `spaces:read`, and lists validated state. `COGNITUM_SPACES_API` remains an
+  explicit compatibility path.
+- the dependency-free contributor metaharness adds `spaces` /
+  `ruview_spaces_list`, invokes only the OAuth branch, bounds and revalidates
+  child output, fixes the production API origin, strips the API-key compatibility
+  environment, requires an installed binary, and default-denies MCP access
+  without `credential-use`.
+
+### Cognitum Identity
+
+- the `ruview` public client allow-list includes `spaces:read`;
+- RFC 8414 metadata advertises it;
+- refresh preserves the originally granted scope;
+- no new client secret or password grant is introduced.
+
+### Cognitum API
+
+- the gateway preserves caller OAuth through an internal, spoof-resistant
+  relay while authenticating the private Function hop;
+- Spaces verifies the signed OAuth principal and queries by tenant + workspace;
+- legacy API-key behavior remains available;
+- bounded semantic-state `PUT` is available only to an explicitly scoped API-key
+  publisher and is not exposed by the RuView OAuth client;
+- OpenAPI documents both alternatives and RFC 9728 metadata supports discovery;
+- the Function remains gateway-only at Cloud Run IAM.
+
+### Autogenous
+
+Autogenous must consume an explicitly typed credential. It must not imply that
+`/v1/cli/session/exchange` produces a RuView-audience token: that exchange
+currently produces `client_id=cognitum-cli` and cannot pass the Spaces policy.
+An external RuView PKCE token may be supplied after activation, or a scoped API
+key may be used as the compatibility path. Response validation and lineage
+rules in this ADR apply before agent belief formation.
+
+## Threat model
+
+| Threat | Required control |
+|---|---|
+| Direct Function bypass | invoker IAM check; gateway SA only; no `allUsers` |
+| Forged internal OAuth header | strip inbound relay headers; gateway writes after route classification |
+| Token substitution | ES256/JWKS plus exact issuer, audience, client, type, scope, and tenant claims |
+| Cross-tenant enumeration | principal-derived Firestore selector; bounded non-enumerating errors |
+| Redirect/token exfiltration | redirects disabled; HTTPS required; fixed path |
+| Oversized/malformed response | byte/depth/count/string bounds before use |
+| Raw-data regression | server allow-list plus client forbidden-field rejection |
+| Secret disclosure | redacting types; no token logs/URLs; `.env` untracked |
+| Feedback amplification | lineage preservation, dedupe, cycle rejection, no independent corroboration |
+| Memory leakage | tenant filter before vector search; no global nearest-neighbor pass |
+| Agent overreach | observe/recommend default; ADR-321 fail-closed action gate |
+| Stale/replayed state | expiry, sequence, message ID, freshness, witness receipt |
+| JWKS outage/rotation | bounded cache; fail closed; refresh after unknown `kid`; no algorithm fallback |
+
+## Deployment and rollback
+
+Rollout order is dependency-safe:
+
+1. merge and deploy Identity scope/metadata;
+2. deploy the Spaces Function with OAuth verification while API-key behavior
+   remains unchanged;
+3. deploy the gateway relay and protected-resource metadata;
+4. verify gateway API-key access, OAuth denial matrices, direct-origin platform
+   denial (`401` or `403` before application code), and tenant isolation;
+5. merge/release the RuView client and CLI activation;
+6. enable Autogenous consumption only after its strict validation/lineage gates
+   pass.
+
+Rollback disables OAuth advertisement/relay and returns clients to scoped API
+keys. It must not restore public Function invocation. Revoking an OAuth session
+or API key must not alter paired-site state.
+
+## Validation and acceptance
+
+Required automated gates:
+
+- Identity: metadata test, migration application, PKCE authorize/token/refresh
+  scope preservation, cross-client scope denial;
+- API Function: valid claim matrix and rejection for wrong issuer/audience/
+  client/type/scope/tenant, API-key regression, tenant query assertion, bounded
+  projection tests, build and dependency audit;
+- gateway: spoofed relay stripped, caller OAuth preserved, Google hop identity
+  substituted, OpenAPI security alternatives, RFC 9728 metadata, build and
+  dependency audit;
+- RuView: semantic decoder bounds/privacy tests, redaction tests, login scope
+  tests, CLI compile, and live empty/non-empty response tests without fixtures
+  masquerading as production;
+- policy: no Spaces read can invoke an actuator; denial receipts are witnessed.
+
+Production readback must prove:
+
+- unauthenticated gateway request returns `401`;
+- legacy scoped API key returns the authenticated tenant list;
+- valid RuView OAuth returns only its workspace;
+- wrong client, missing `spaces:read`, setup/workload token, and second-tenant
+  token are denied;
+- the direct Function origin is rejected by the Google platform with `401` or
+  `403` before application code, even with a valid application credential;
+- response remains `no-store` and excludes P0/P1;
+- no secret appears in logs, diffs, artifacts, or issue/PR text.
+
+Performance, detection quality, and action-safety numbers are not claimed by
+this decision. Any such number requires a named reproducer and the repository's
+evidence labels. An empty production tenant is a successful isolation/read-path
+test, not sensing-quality evidence.
+
+## Production evidence (2026-08-18)
+
+The bounded Spaces read slice and RuView activation path are deployed. The exact
+production release chain is:
+
+- Spaces run `32148530629`, revision `spacesapi-00003-xij`, source
+  `fc333e634cd918b9d6fdde4eecbe7beac1043ab8`, Node 22, runtime service account
+  `spacesapi-runtime@cognitum-20260110.iam.gserviceaccount.com`, with
+  `apigateway-sa@cognitum-20260110.iam.gserviceaccount.com` as sole invoker;
+- gateway run `32151485401`, revision `apigateway-00180-peh`, source
+  `c4e99ebb4ce0d4e1407f435f905621476c1f0166`, image digest
+  `sha256:bacb81281a54256ff6fdaac253175e76ce6fc225f399163ca0a807a2839bd6a3`;
+- Identity run `32163542502`, revision `identity-00052-fid`, source
+  `fb6320827b879e481cad6caf184d3cbccd8279c4`, image digest
+  `sha256:0cd5896518bd8ecf042d2f3e9aea58a32e65a68dbddaab1e54f8ae6da2bfab06`,
+  and runtime service account
+  `identity-runtime-prod@cognitum-20260110.iam.gserviceaccount.com`.
+
+The live API-key matrix returned `200` with an empty bounded list,
+`Cache-Control: private, no-store`, and no prohibited P0/P1 projection fields.
+No credential returned `401`. A direct-origin request received a Google
+Frontend Bearer challenge (`401`) before application code.
+
+Two independent RuView Authorization Code + PKCE principals also passed the
+live matrix. Each token used ES256, exact issuer/audience/client checks,
+`sensing:read spaces:read`, signed UUID organization/workspace claims, refresh
+rotation, and revocation. Each gateway read returned `200`, an empty bounded
+list, and `private, no-store`; a corrupted signature returned `401`; and the
+principals had distinct pseudonymous tenant/workspace fingerprints. This proves
+the production empty-tenant behavior and independent claim binding. Non-empty
+cross-tenant isolation remains emulator/staging evidence because production was
+not mutated to manufacture a fixture.
+
+Identity metadata deliberately advertises `spaces:read` for RuView but not
+`spaces:write`. The deployed semantic-state `PUT` remains an API-key-only
+publisher surface. RuView therefore has no OAuth write, command, policy-approval,
+or actuator capability.
+
+That receipt was for the initial flat Space slice. The following production
+expansion supersedes only its hierarchy/event/alert deferral. MQTT, commands,
+actuators, real-hardware accuracy, and the long-duration operational trial
+remain outside the completed claim.
+
+## Completed implementation and production expansion (2026-08-19)
+
+- Cognitum API PRs #211 and #212 shipped the eight `/v1/spatial` collections,
+  transactional hierarchy integrity, stable pagination, event/alert retention,
+  strict P2/P3 admission, API-key-only writes, OAuth/API-key reads, and the
+  additive-only Firestore release authority. Function run `32279092861`
+  promoted active Node 22 revision `spacesapi-00005-kaf`.
+- Edge PRs #214, #215, and #216 preserved canonical UUID routing, kept SQLi
+  denial, and removed secret-valued API-key rate selection. Gateway run
+  `32284410107` promoted the reviewed immutable digest to 100% production
+  traffic. Every versioned collection returned HTTP 200 through the public
+  edge; the hierarchy composite index is `READY` and both retention TTL fields
+  are `ACTIVE`.
+- The dedicated RuView service credential was rotated to exactly
+  `spaces:read` and `spaces:write`; its predecessor returns 401. A non-mutating
+  invalid-body probe reached write validation without persisting customer data.
+  Other potentially affected owner keys and residual log retention remain
+  tracked in Cognitum API #217.
+- A live RuView Authorization Code + S256 PKCE consent requested exactly
+  `sensing:read spaces:read`. Its in-memory token read versioned `sites` with
+  HTTP 200 and schema `1.0`; the verifier then revoked the temporary refresh
+  credential and persisted no token.
+- RuView PR #1650 merged `ruview-cognitum-spaces`,
+  `ruview-spatial-memory`, the ADR-327 policy extension, CLI paging, and the
+  guarded `ruview_spaces_list` metaharness surface. PR #1651 removed stale
+  feature-branch guidance and refreshed the signed package manifest.
+- The contributor metaharness fixes the API origin, accepts bounded resource,
+  limit, and opaque-cursor inputs, strips API-key compatibility authority over
+  MCP, invokes only the hardened OAuth CLI, and rejects raw sensing or malformed
+  hierarchy/event/alert output. Its test, security, reviewed-brain, flywheel,
+  manifest, audit, exact-tarball, and claim-check gates pass.
+- Release run `32286297277` rebuilt and smoke-tested the exact package and
+  provenance-published `@ruvnet/ruview` 0.5.0. The public npm registry resolves
+  0.5.0 as `latest`; no workstation publish was used.
+- `ruview-spatial-memory` keeps one RuVector HNSW index per authenticated
+  tenant/workspace with replay, derivation, retention, cascading-erasure,
+  bounded-explanation, encrypted-snapshot, and reload-verified rotation gates.
+  This is local `SYNTHETIC` evidence, not a production sensing claim.
+- `ruview-policy` keeps observe/recommend/execute intents distinct, requires
+  exact host grants plus signed approval for consequence, rejects nonce replay,
+  and emits signed hash-chained receipts. `spaces:read` is explicitly denied as
+  execution authority.
+- Focused Rust gates and the Linux workspace/CLI/security lanes pass. Earlier
+  Windows whole-workspace attempts ended in host compiler failure or timeout;
+  those attempts are not reclassified as green evidence.
+- No OAuth write/action scope, actuator callback, MQTT deployment claim, sensing
+  accuracy claim, or real-hardware claim is introduced.
+
+## Consequences
+
+### Positive
+
+- One Cognitum identity can explicitly activate RuView's cloud spatial read
+  capability without sharing a long-lived static bearer.
+- Tenant and workspace become cryptographically bound inputs to the data query.
+- RuView and Autogenous gain useful spatial context without importing raw RF or
+  inventing independent evidence.
+- The design keeps a path for RuVector-grounded explanations and separately
+  governed action without treating either as part of the deployed read slice.
+- The direct-origin bypass is closed permanently, independent of OAuth rollout.
+
+### Costs and limitations
+
+- Two credential types coexist during migration and must stay visibly distinct.
+- OAuth depends on Identity JWKS availability and correct key rotation.
+- Production exposes both the legacy Space twins and the versioned hierarchy,
+  anonymous entities, semantic events, and alerts over HTTPS. MQTT remains a
+  design contract without deployment evidence.
+- OAuth workspace IDs will return only documents populated with `workspaceId`;
+  legacy owner-only documents require an explicit migration, never a broad query.
+- The RuView client exposes no write, command, or agent execution surface. The
+  separate API-key semantic-state ingress is neither OAuth activation nor
+  actuator authority.
+
+## Alternatives considered
+
+**Keep API keys only.** Rejected as the target: keys are useful for service
+compatibility but do not provide user activation, consent, short lifetime, or
+refresh/revocation semantics.
+
+**Treat the CLI API-key exchange token as a Spaces OAuth token.** Rejected: it
+is minted for `cognitum-cli`, not `ruview`, and accepting it would remove the
+audience/client boundary.
+
+**Trust the gateway without verifying OAuth in Spaces.** Rejected: hop identity
+and user authorization are distinct, and authorization must remain valid if the
+route topology changes.
+
+**Make Spaces state independent corroboration.** Rejected: it is derived from
+the same RuView/HomeCore lineage and would double-count evidence.
+
+**Allow agents to execute from `spaces:read`.** Rejected: read consent is not
+action authority, and perception confidence alone cannot authorize consequence.
+
+**Synchronize raw RF for better cloud models.** Rejected by default: it violates
+the edge privacy boundary and is unnecessary for the semantic product.
+
+## References
+
+- Autogenous ADR-402, `docs/adr/ADR-402-ruview-cognitum-spaces-spatial-intelligence.md`
+- Cognitum API ADR-094, `docs/adr/ADR-094-cognitum-spaces-homecore-edge-boundary.md`
+- Cognitum API hierarchy/events/alerts follow-up,
+  `https://github.com/cognitum-one/api/issues/206`
+- RuView metaharness OAuth surface,
+  `https://github.com/ruvnet/RuView/issues/1643`
+- RuVector spatial-history follow-up,
+  `https://github.com/ruvnet/RuView/issues/1640`
+- governed-action and witness-receipt follow-up,
+  `https://github.com/ruvnet/RuView/issues/1641`
+- RFC 7636, Proof Key for Code Exchange
+- RFC 8414, OAuth 2.0 Authorization Server Metadata
+- RFC 9700, OAuth 2.0 Security Best Current Practice
+- RFC 9728, OAuth 2.0 Protected Resource Metadata
@@ -0,0 +1,137 @@
+# ADR-326: Tenant-scoped RuVector spatial memory and anomaly explanations
+
+- **Status**: Accepted — implementation complete; repository-wide and deployment gates pending
+- **Date**: 2026-08-19
+- **Decision owners**: RuView maintainers
+- **Extends**: ADR-312, ADR-319, ADR-325
+- **Implements**: ruvnet/RuView#1640
+- **Tags**: cognitum-spaces, ruvector, memory, tenant-isolation, explanation, privacy
+
+## Context
+
+ADR-325 requires anomaly explanations grounded in tenant-local spatial history,
+but the deployed client only returns a current list. A global vector index would
+be unsafe: filtering nearest-neighbor results after the search can reveal that a
+different tenant has a close match, even when identifiers are removed. A memory
+record can also launder returned RuView-derived state into a second independent
+observation, reset freshness, or form circular evidence.
+
+Spatial memory must be useful without storing OAuth/API credentials, raw CSI/CIR,
+RF tensors, pose frames, vital waveforms, recordings, identity observations, or
+unbounded agent transcripts. Persistence also needs explicit retention,
+deletion, provenance, and key-rotation behavior.
+
+## Decision
+
+### 1. Partition before similarity
+
+`ruview-spatial-memory` owns a `SpatialMemory` map keyed by the exact authenticated
+`(tenant_id, workspace_id)` pair. Each partition owns its own RuVector HNSW index.
+Ingest and search resolve the partition first; no global ANN query exists. Site,
+space, schema version, and time-window constraints narrow within the selected
+partition before results are returned.
+
+### 2. Bounded semantic records
+
+An accepted record contains:
+
+- tenant/workspace/site/space and stable record identity;
+- source ID, message ID, record ID, monotonic event sequence, schema version;
+- original `observed_at`/`expires_at` and a retention deadline;
+- a bounded finite semantic feature vector, uncertainty, and evidence label;
+- provenance and witness digests, plus bounded derivation references;
+- explicit observation/inference classification.
+
+Credentials and P0/P1 fields have no representation in the type. Strings,
+features, references, record counts, and query `k` are bounded. Non-finite
+features and uncertainty fail closed.
+
+### 3. Lineage and replay
+
+The partition rejects:
+
+- changed reuse of `(source_id, message_id)`;
+- a non-increasing sequence for the same source;
+- duplicate derivation references;
+- self-reference, missing/forward parents, and therefore every cycle;
+- expired input or a provenance/witness substitution.
+
+A recollection keeps its original lineage, timestamp, uncertainty, and evidence
+label. It cannot increment corroborating-source count or become independent
+support for its own ancestor.
+
+### 4. Persistent encrypted storage
+
+Snapshots are encrypted with XChaCha20-Poly1305 under a caller-supplied 256-bit
+key and a non-secret key ID. The authenticated associated data binds the storage
+format and key ID. The envelope is bounded and versioned; plaintext spatial
+records are never written to disk. Loading requires a keyring containing the
+named key. Rotation decrypts with the old key, atomically creates a new
+generation under the new key ID, reload-verifies that generation, and leaves
+the source intact. Snapshots never overwrite an existing path implicitly.
+
+Deletion supports a tenant/workspace partition, a record, and retention cutoff.
+Every deletion rebuilds that partition's HNSW index so removed records cannot be
+returned from stale graph nodes.
+
+### 5. Explanations
+
+`explain` compares a bounded query vector with nearest tenant-local history and
+returns the exact authenticated partition, generation time, ordered record IDs,
+RuVector distances, original uncertainty/evidence labels, and provenance/witness
+digests. Its basis explicitly says that similarity is not causation. The API
+does not expose the vectors or invent a causal explanation.
+
+History provides context, not authority. An explanation cannot authorize an
+action, increase certificate class, or replace a policy decision.
+
+## Consequences
+
+### Positive
+
+- Cross-tenant ANN leakage is structurally unavailable.
+- Explanations cite the exact tenant-local records used.
+- Replay/cycle/provenance substitution are rejected before indexing.
+- Encrypted persistence has explicit key IDs and rotation behavior.
+
+### Costs and limitations
+
+- Partition-local HNSW uses more indexes than a global graph.
+- Deletes and key rotation rebuild indexes.
+- No detection-quality or latency claim is made; tests are `SYNTHETIC` unless a
+  reproducer explicitly marks a measurement.
+- Cloud Cognitum does not receive the local encrypted memory file.
+
+## Validation
+
+- cross-tenant and cross-workspace nearest-neighbor denial;
+- duplicate record/message, stale-sequence, self/duplicate/missing-parent, and
+  provenance-substitution tests;
+- expiry, retention deletion, whole-partition deletion, sealed round-trip,
+  tamper rejection, wrong-key rejection, and key-rotation tests;
+- explanation citations and retained evidence/provenance labels;
+- no forbidden raw-field or credential representation;
+- the focused `ruview-spatial-memory` crate suite passes with `SYNTHETIC`
+  evidence on 2026-08-19;
+- the whole-workspace Windows gate was non-terminal (compiler crash in parallel,
+  timeout when serialized), so Linux CI, a RustSec advisory scan, and package
+  review remain release gates.
+
+## Alternatives considered
+
+**One global HNSW followed by filtering.** Rejected: ranking itself crosses the
+tenant boundary.
+
+**Cloud vector memory.** Rejected as the default: it expands the privacy and
+credential boundary without being needed for local explanations.
+
+**Plain JSONL persistence.** Rejected because tenant spatial history is sensitive
+even when raw sensing is excluded.
+
+## References
+
+- ADR-312: Long-term spatial memory
+- ADR-319: Witness chain
+- ADR-325: Cognitum Spaces activation and governed exchange
+- Cognitum API ADR-101
+- ruvnet/RuView#1640
@@ -0,0 +1,133 @@
+# ADR-327: Governed action intents, approvals, replay protection, and witness receipts
+
+- **Status**: Accepted — implementation complete; repository-wide and deployment gates pending
+- **Date**: 2026-08-19
+- **Decision owners**: RuView maintainers
+- **Extends**: ADR-318, ADR-319, ADR-321, ADR-325
+- **Implements**: ruvnet/RuView#1641
+- **Tags**: policy, governed-action, approval, idempotency, witness, cognitum-spaces
+
+## Context
+
+The current `ruview-policy` crate evaluates assurance for an action class, but it
+does not define a complete action intent, tenant/workspace binding, policy
+version, approval, nonce/idempotency replay behavior, or signed terminal receipt.
+An agent recommendation can therefore be mistaken for execution authority, and
+`spaces:read` could be accidentally treated as a general capability.
+
+The system needs a framework that can prove why an action was allowed or denied
+without adding any actuator. Real actuation remains a separate integration and
+requires its own threat model and device evidence.
+
+## Decision
+
+### 1. Typed intent and registered policy
+
+A governed `ActionIntent` binds:
+
+- intent ID, tenant, workspace, action name/class, and exact target;
+- requested policy version and parameter/evidence digests;
+- creation/expiry, replay nonce, and requesting principal;
+- the recommendation/explanation that motivated review, never a hidden command.
+
+The gate accepts only a registered action policy. Unknown action, action-class
+mismatch, policy-version mismatch, target mismatch, invalid timestamps, and
+missing exact host authority deny before assurance is evaluated. Tenant and
+workspace are part of the signed intent/receipt and nonce key. `spaces:read` is
+explicitly tested as insufficient for an `alerts:execute` rule.
+
+### 2. Assurance and approval
+
+The existing ADR-321 certificate/domain/uncertainty/evidence gate remains the
+assurance authority. The registered policy declares a bounded minimum of
+distinct enrolled approvers. An absent, rejected, duplicated, expired,
+wrong-intent, wrong-policy-version, or unverifiable approval denies. Approval
+resolution fails closed.
+
+Agents observe, explain, or recommend by default. `evaluate` returns a decision
+receipt; it does not call an actuator. An executor may consume an `allow` receipt
+only if a separate adapter verifies the receipt, target, expiry, and its own
+device-specific authority.
+
+### 3. Replay and idempotency
+
+The bounded in-memory gate stores terminal receipts by intent ID and tracks
+nonces by `(tenant, workspace, nonce)`.
+
+- exact intent replay returns the original terminal receipt;
+- changed reuse of an intent ID returns a fail-closed idempotency error;
+- reuse of a nonce by another intent returns a fail-closed replay error;
+- expired intents and approvals deny;
+- failed or denied attempts are terminal and auditable.
+
+The current state store is bounded and in-memory, intended for local/runtime use
+rather than cross-process replay protection. A production executor must place
+the same intent/nonce/receipt invariants behind a transactional durable store;
+this ADR does not claim that adapter exists.
+
+### 4. Witnessed terminal receipt
+
+Every evaluated observe/recommend/execute request produces a canonical receipt
+containing the intent digest, decision/reason, policy version, tenant/workspace,
+decision/expiry time, intent ID and nonce, approval count, and previous receipt
+digest. The receipt is signed through the `ruview-attest` signer interface and
+can be independently verified. Hash chaining makes removal/reordering visible.
+Malformed input, ID conflict, nonce replay, capacity exhaustion, and sequence
+exhaustion are errors before receipt creation and must be audited by the host.
+
+The reference keyed-BLAKE3 signer remains `SYNTHETIC` evidence only, as documented
+by ADR-319. Production asymmetric signing and key custody must be supplied by the
+deployment adapter; no symmetric test MAC is represented as hardware identity.
+
+## Consequences
+
+### Positive
+
+- Recommendation, authorization, and execution are distinct typed stages.
+- Default-deny covers missing policy, stale evidence, unavailable approval, and replay.
+- Every decision has a terminal, verifiable explanation.
+- `spaces:read` cannot silently expand into consequence.
+
+### Costs and limitations
+
+- Executors must implement a separate receipt-verifying adapter.
+- Distributed replay protection needs a transactional durable store.
+- This ADR implements no actuator, command transport, pairing mutation, or device control.
+- Simulator tests are not hardware validation.
+
+## Validation
+
+- unknown/missing policy, stale intent, policy-version/target mismatch,
+  insufficient authority, and `spaces:read`-only denial;
+- certificate/domain/uncertainty/evidence denial matrix from ADR-321;
+- missing/rejected/expired/duplicate/wrong-intent approval tests;
+- exact idempotent replay, changed reuse, nonce replay, and bounded-store tests;
+- receipt signature, canonical digest, chain linkage, and tamper rejection;
+- tests proving evaluation exposes no actuator callback or network/file side effect.
+
+The focused `ruview-policy` suite passes on 2026-08-19. The reference signer
+tests are `SYNTHETIC`; they are not hardware-identity evidence. The non-terminal
+whole-workspace Windows gate still requires authoritative Linux CI evidence.
+
+Any future actuator adds a separate ADR, credential boundary, failure/rollback
+plan, allow/deny integration tests, and captured target-device evidence.
+
+## Alternatives considered
+
+**Let agents call actuators after a recommendation.** Rejected: recommendation
+quality is not authorization.
+
+**Treat OAuth scopes as action policy.** Rejected: `spaces:read` expresses read
+consent only and carries no target-specific assurance or approval.
+
+**Emit receipts only for successful actions.** Rejected: denial and unavailable
+approval are security-relevant terminal facts.
+
+## References
+
+- ADR-318: Capability certificates
+- ADR-319: Witness chain
+- ADR-321: Decision policy action authorization
+- ADR-325: Cognitum Spaces activation and governed exchange
+- ADR-326: Tenant-scoped RuVector spatial memory
+- ruvnet/RuView#1641
@@ -0,0 +1,252 @@
+# ADR-328: Consumer NLOS raw-transient pipeline and upstream reproduction boundary
+
+| Field | Decision |
+|---|---|
+| **Status** | Accepted for staged implementation; software contracts may be validated in CI, live-hardware reproduction remains pending until a witness capture passes the protocol |
+| **Date** | 2026-08-22 |
+| **Owners** | RuView Labs maintainers and sensing research reviewers |
+| **Scope** | Commodity optical transient acquisition, calibration, normalization, provenance, upstream reproduction |
+| **Extends** | ADR-295, ADR-303, ADR-305, ADR-319, ADR-320 |
+| **Related** | ADR-329, ADR-330, ADR-331 |
+| **Primary implementation** | `v2/crates/ruview-nlos`, upstream `sidsoma/consumer-nlos`, `harness/ruview` advisory verification |
+
+## Context
+
+Somasundaram et al. introduce motion-induced aperture sampling (MAS) for
+consumer time-of-flight LiDAR. Their measurement is not an ordinary depth map.
+Each sensor zone records light intensity over time. The strong direct relay-wall
+return is followed by much weaker multipath returns whose path lengths constrain
+hidden geometry. Multiple frames supply redundant and spatially diverse samples
+that improve signal-to-noise ratio and synthesize a larger virtual aperture.
+
+The [Nature paper](https://doi.org/10.1038/s41586-026-10502-x),
+[author manuscript](https://arxiv.org/html/2605.17865v1), and
+[MIT project page](https://cornar.media.mit.edu/) report 3D reconstruction,
+single and multi-object tracking, camera localization, and real-time tracking at
+30 Hz. These are upstream `CLAIMED` results until RuView reproduces them with a
+named live capture. They are not evidence that Apple exposes the required
+measurement to an ordinary iOS application.
+
+The upstream [consumer-nlos implementation](https://github.com/sidsoma/consumer-nlos)
+targets ST's P-NUCLEO-53L8A1 research path and captures per-zone histograms. ST
+documents the [VL53L8CH](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html)
+compact-normalized-histogram interface and configuration-dependent zone/bin/rate
+limits. The exact silicon, expansion board, firmware/API and transient format
+must be read from and bound to each capture rather than inferred from the kit
+name. The
+[P-NUCLEO-53L8A1](https://www.st.com/en/evaluation-tools/p-nucleo-53l8a1.html)
+combines the expansion board with an STM32 Nucleo host.
+
+RuView needs an explicit boundary because flattening the input to point clouds,
+`Observation.value`, ARKit depth, or CSI destroys the delayed transient that the
+inverse problem needs. A successful build or replay also cannot validate the
+photon path, relay geometry, ambient-light behavior, or target reflectivity.
+
+## Decision
+
+### 1. Reproduce upstream before modifying its inference state
+
+Phase 1 uses upstream commit
+`15314de422a765a2d1b72ea7037dfafb2f908d7c` and a documented,
+upstream-compatible ST assembly with verified raw or compact-normalized
+histogram access. The current reference adapter targets VL53L8CH framing, but
+the acceptance record stores the observed board/silicon identity and never
+promotes a model name inferred from packaging. RuView records the exact upstream
+commit, firmware/API digest, scoped enrollment/certificate reference, configuration, calibration
+digest, and capture-manifest digest. Upstream code runs as an isolated research
+sidecar or separately reviewed tool; it is not silently vendored into the
+production Rust dependency graph.
+
+The first geometry follows the upstream plug-and-play arrangement:
+
+1. a planar relay surface fills the sensor field of view;
+2. an opaque occluder prevents direct line of sight to the target;
+3. a known rigid retroreflective target supplies the initial high-SNR case;
+4. an independent ground-truth system measures the hidden trajectory; and
+5. an empty-scene background is captured before each experimental block.
+
+Diffuse rigid objects and people are later strata. They cannot be pooled into
+the retroreflective acceptance result. The manuscript notes weaker diffuse
+returns and an approximately fourth-power distance falloff in its diffuse model;
+the project therefore reports performance by target material and range.
+
+### 2. Preserve a first-class transient frame
+
+`v2/crates/ruview-nlos` owns the initial versioned transient scaffold. The table
+below is the capture-manifest/next-contract requirement for live promotion, not
+a claim that every field already exists in the current v1 Rust/track schema.
+The current scaffold implements bounded histogram/provenance/calibration pieces;
+missing clock-domain, certificate, world-frame, configuration, and capture
+bindings must land in a reviewed schema before L2. The eventual wire/storage
+representation retains, at minimum:
+
+| Field group | Required content | Rejection rule |
+|---|---|---|
+| Identity | schema version, sensor ID or certificate reference, session ID, sequence | unknown schema, unauthenticated identity, duplicate or regressing sequence |
+| Time | sensor monotonic timestamp, host receive timestamp, clock domain and uncertainty | future, stale, non-finite, or unbounded clock error |
+| Histogram | zone layout, temporal bin count and width, signed/unsigned count encoding, ambient estimate | zero/oversized dimensions, non-finite values, count overflow |
+| Geometry | per-zone ray or relay-wall point, sensor intrinsics, world transform, coordinate-frame ID | non-invertible transform, unit mismatch, incompatible frame |
+| Calibration | direct-return peak, mask, background reference, calibration and configuration digests | absent, expired, mismatched, or out-of-distribution calibration |
+| Provenance | source `LIVE_HARDWARE`/`REPLAY`/`SYNTHETIC`, firmware and capture digests, evidence level | unknown never becomes live; replay and synthetic are visibly distinct |
+
+The HAL may wrap the frame as a modality-specific payload, but it must not
+reduce the histogram to a scalar before NLOS preprocessing. Raw transient input
+has its own size/rate limits and parser fuzz surface.
+
+### 3. Deterministic normalization stages
+
+The reference normalization pipeline is ordered and individually testable:
+
+1. verify identity, schema, bounds, sequence, timestamps, and calibration;
+2. subtract a compatible empty-scene background;
+3. locate and mask the strong one-bounce relay-surface return per zone;
+4. align each zone's direct peak to the agreed temporal origin;
+5. reject saturated, underexposed, or calibration-incompatible zones;
+6. transform time/depth into the light-cone coordinate used by MAS; and
+7. emit a normalized transient plus quality flags, never an unconditional track.
+
+Calibration is an explicit state machine: `UNAVAILABLE`, `CAPTURING`, `VALID`,
+`DEGRADED`, `EXPIRED`, or `REJECTED`. Only `VALID` calibration can produce a
+live optical likelihood. Loss of calibration produces `unknown`, not a cached
+or synthetic fallback.
+
+### 4. Separate acquisition evidence from inference evidence
+
+The capture manifest is append-only and content-addressed. It binds the raw
+stream, exclusions, firmware, configuration, calibration, clock synchronization,
+target/relay-surface stratum, and ground-truth source. Track records reference
+the capture and model digests. RuVector or a particle filter may improve
+temporal inference, but neither can upgrade acquisition provenance or fabricate
+unobserved photons.
+
+Raw captures are local research data by default and are not committed to Git.
+Only schemas, small non-person fixtures, checksums, and aggregate metrics may be
+reviewed in the repository under the data policy.
+
+## Performance decision
+
+The first live reproduction targets end-to-end track updates at **at least 27
+Hz**, a preregistered operational definition of “roughly 30 fps.” The rate is
+measured from accepted sensor frame through emitted track, not the configured
+sensor clock. Dropped, duplicated, replayed, or late frames are not counted.
+The frozen zone/bin/integration configuration must itself be documented and
+demonstrated capable of this rate; ST configurations documented at 25 Hz cannot
+pass merely because another configuration has a 30 Hz maximum.
+
+Implementation budgets are:
+
+| Stage | Budget and behavior |
+|---|---|
+| Parser and provenance | bounded allocation; reject before copying oversized dimensions |
+| Normalization | one pass over zones × bins; reusable buffers; no unbounded capture queue |
+| Tracking | bounded particle count and search volume; overload drops stale work rather than growing latency |
+| End-to-end | report p50/p95 latency, update rate, frame loss, CPU and memory with named reproducer |
+
+The paper describes 1,000 particles and a 5 cm proximity prior at 30 Hz. Those
+are starting parameters, not RuView guarantees. Optimization must preserve a
+golden likelihood/track tolerance and may not hide quality loss behind pooled
+throughput.
+
+## Security and privacy
+
+1. USB/serial is the initial acquisition transport. A future network bridge
+   requires authenticated sensor identity, encryption, replay protection,
+   explicit bind configuration, and a separate threat review. No new
+   unauthenticated UDP listener is introduced.
+2. Firmware and upstream code are supply-chain inputs. Pin commits and toolchain
+   versions, review licenses, scan dependencies, and verify build/capture
+   digests. Flashing remains an explicit, confirmed hardware mutation.
+3. Malformed frames, NaN/Inf values, integer products, timestamp wrap,
+   decompression bombs, calibration substitution, and coordinate transforms are
+   fail-closed parser cases.
+4. NLOS presence and trajectory data are sensitive even without imagery. The
+   approved operator/controller and every required participant receive purpose/
+   space/time notice and consent controls, pause/withdrawal and a persistent
+   indicator; raw retention is bounded and session track IDs never claim identity.
+5. Safety-critical actuation is outside this ADR. A hypothesis never directly
+   drives a lock, vehicle, medical device, or emergency decision.
+
+The full attacker/asset analysis is in
+`docs/security/consumer-nlos-threat-model.md`.
+
+## Alternatives considered
+
+### Feed ARKit scene depth directly into the MIT algorithm
+
+Rejected. Apple's documented scene-depth surface is processed distance data,
+not the per-zone photon-arrival histogram required by the image formation
+model. ARKit remains useful for pose and visible geometry under ADR-330.
+
+### Treat CSI as a synthetic optical transient
+
+Rejected. CSI and optical time-of-flight measure different physical channels.
+CSI can contribute an independently calibrated likelihood under ADR-329; it
+cannot replace the optical measurement or supervise itself.
+
+### Port upstream code to Rust before reproducing it
+
+Rejected for Phase 1. Simultaneously changing hardware, forward model, state
+estimator, and language makes failures uninterpretable. The Rust port follows a
+pinned upstream baseline and golden captures.
+
+### Vendor all upstream firmware, Python, and data into RuView
+
+Rejected. It increases supply-chain, license, binary-size, and data-governance
+risk. The reproduction boundary uses pins, manifests, adapters, and small legal
+fixtures instead.
+
+## Consequences
+
+### Positive
+
+1. RuView gains an honest optical-transient modality without corrupting CSI or
+   scalar HAL semantics.
+2. Upstream reproduction and RuView extensions remain experimentally separable.
+3. Provenance, calibration, and failure states survive into every downstream
+   hypothesis.
+4. The same contract can later support another histogram-capable ToF sensor.
+
+### Costs and limitations
+
+1. Initial use requires an external ST board and ground-truth rig.
+2. Raw histograms and CSI increase sensitive data volume and governance burden.
+3. Calibration, reflectivity, relay geometry, ambient light, and motion can
+   dominate algorithm changes.
+4. This decision does not establish through-wall optical sensing, unrestricted
+   human reconstruction, identity, or production safety.
+
+## Rollout and rollback
+
+| Phase | Enable condition | Rollback trigger | Rollback action |
+|---|---|---|---|
+| R0 fixtures | schema/parser/property tests pass | parser panic, unbounded allocation, provenance ambiguity | disable crate feature and retain fixtures only |
+| R1 upstream live reproduction | approved protocol, verified histogram interface, external ground truth, and `MEASURED` >=27 Hz accepted-update witness | calibration drift, direct line of sight, saturation, provenance gap | invalidate capture; return to controlled geometry |
+| R2 Rust shadow | R1 remains valid and golden-capture agreement is within frozen tolerance | likelihood/track divergence or latency regression | keep upstream sidecar authoritative; disable Rust output |
+| R3 candidate live | independent witness plus ADR-331 confidence/security/privacy/guardrail gate | research endpoint fails or privacy controls regress | emit `unknown`; withdraw capability certificate |
+
+Rollback never relabels a failed live capture as a passing replay. Existing CSI,
+RuVector, WorldGraph, and other RuView runtime paths remain independently usable.
+
+## Objective acceptance mapping
+
+| ID | Requirement | Evidence |
+|---|---|---|
+| NLOS-328-01 | Preserve bounded per-zone timing histograms and calibration provenance | Rust round-trip, boundary, fuzz/property, golden-vector tests |
+| NLOS-328-02 | Reject stale, duplicate, oversized, unauthenticated, non-finite, and calibration-mismatched input | Negative parser and state-machine tests |
+| NLOS-328-03 | Keep `LIVE_HARDWARE`, `REPLAY`, and `SYNTHETIC` mutually exclusive | provenance transition tests and capture manifest review |
+| NLOS-328-04 | Reproduce hidden-target tracking at roughly 30 fps | `MEASURED` live capture, external ground truth, >=27 accepted updates/s |
+| NLOS-328-05 | Prevent synthetic-only acceptance | `ruview nlos verify --require-research-pass` rejection tests |
+| NLOS-328-06 | Make upstream/Rust comparison reproducible | pinned commit, firmware/config/calibration/capture SHA-256 digests |
+| NLOS-328-07 | Preserve normal RuView operation when NLOS is absent | workspace tests with crate/sensor disabled; advisory harness reports `ABSENT` |
+
+The authoritative experimental steps and statistical gate are in
+`docs/research/consumer-nlos-acceptance-protocol.md`.
+
+## References
+
+1. Somasundaram et al., [“Imaging Hidden Objects with Consumer LiDAR via Motion Induced Sampling”](https://doi.org/10.1038/s41586-026-10502-x), Nature 653, 693–699 (2026).
+2. [Author manuscript and methods](https://arxiv.org/html/2605.17865v1).
+3. [MIT Consumer NLOS project](https://cornar.media.mit.edu/).
+4. [Upstream implementation](https://github.com/sidsoma/consumer-nlos).
+5. STMicroelectronics, [VL53L8CH product specification](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html).
+6. STMicroelectronics, [P-NUCLEO-53L8A1 evaluation kit](https://www.st.com/en/evaluation-tools/p-nucleo-53l8a1.html).
@@ -0,0 +1,285 @@
+# ADR-329: Motion-induced aperture inference, CSI fusion, and RuView world-state integration
+
+| Field | Decision |
+|---|---|
+| **Status** | Accepted for staged implementation; software fusion is testable with replay, retained performance claims require the live paired protocol |
+| **Date** | 2026-08-22 |
+| **Owners** | RuView Labs perception, RuVector, RuField, and WorldGraph maintainers |
+| **Scope** | MAS forward model, temporal inference, calibrated RF/optical fusion, persistent identity-free state |
+| **Depends on** | ADR-273, ADR-295, ADR-301 through ADR-305, ADR-311, ADR-319, ADR-328 |
+| **Related** | ADR-330, ADR-331 |
+| **Primary implementation** | `v2/crates/ruview-nlos`, `ruview.nlos.track.v1` |
+
+## Context
+
+The consumer-NLOS model converts weak, time-resolved optical multipath into a
+posterior over hidden geometry or motion. Its strength is localized geometry
+around a relay surface; its weaknesses include low signal-to-noise ratio,
+reflectivity, range, aperture coverage, and temporal assumptions. RuView CSI
+offers a different failure profile: RF can persist through walls and clutter,
+but current commodity CSI generally provides coarser, environment-dependent
+spatial evidence.
+
+These modalities should not be concatenated merely because both are
+interesting. Fusion is justified only when an independently evaluated RF
+likelihood improves an objective endpoint over optical NLOS alone. It is also
+unsafe to let a learned temporal store or graph overwrite current sensing
+quality. RuVector, RuField, and WorldGraph must preserve uncertainty, freshness,
+calibration, and provenance rather than manufacture confidence.
+
+The [consumer-NLOS paper](https://arxiv.org/html/2605.17865v1) expresses tracking
+as a sequential posterior and uses a particle filter to carry uncertainty and a
+motion prior. This aligns with RuView's temporal and spatial primitives, but the
+physics likelihood remains the authority for the optical observation.
+
+## Decision
+
+### 1. Use a typed latent state and explicit likelihood factors
+
+For each session-scoped hidden target hypothesis, the latent state is
+
+\[
+X_t = (p_t, v_t, \Sigma_t, q_t, a_t)
+\]
+
+where position \(p_t\), velocity \(v_t\), covariance or particle distribution
+\(\Sigma_t\), quality state \(q_t\), and bounded attributes \(a_t\) are expressed
+in a versioned world coordinate frame. No identity field is inferred.
+
+The fused filter computes
+
+\[
+P(X_t \mid L_{1:t}, R_{1:t}) \propto
+P(L_t \mid X_t, C_L)^{w_L}
+P(R_t \mid X_t, C_R)^{w_R}
+P(X_t \mid X_{t-1}),
+\]
+
+where \(L_t\) is the normalized optical transient, \(R_t\) is independently
+captured CSI evidence, and \(C_L,C_R\) are modality-specific calibration states.
+The exponents are bounded reliability weights derived from current quality,
+not user-facing confidence decoration.
+Missing, stale, rejected or invalid modalities are omitted before factor
+evaluation and contribute the multiplicative identity. They are never evaluated
+as a zero likelihood raised to a zero weight (`0^0`).
+
+Conditional independence is an approximation. Correlated errors such as motion,
+clock drift, shared ground-truth leakage, and environmental change are measured
+and documented. If correlation cannot be bounded, the implementation uses a
+conservative mixture, covariance intersection, or gating rule instead of
+multiplying overconfident factors.
+
+### 2. Keep the MAS physics path inspectable
+
+The optical likelihood follows the upstream structure:
+
+1. transform the normalized transient into light-cone coordinates;
+2. precompute a canonical space-time impulse response for the known target
+   shape or reconstruction basis;
+3. propagate a bounded particle set using the frozen motion model;
+4. render each particle by indexing the canonical response at current relay-wall
+   samples and pose;
+5. score rendered and observed transients with a normalized, bounded likelihood;
+6. normalize, calculate degeneracy diagnostics, and residual-resample; and
+7. emit the posterior, entropy/effective-particle count, covariance, and quality.
+
+Optimization may vectorize or cache rendering, but every optimized kernel is
+compared against a scalar reference over golden and property-generated inputs.
+NaN/Inf, all-zero likelihood, underflow, particle collapse, and out-of-volume
+states produce a typed degradation or `unknown` result.
+
+### 3. Calibrate CSI as a likelihood, not a centimetre claim
+
+The initial RF factor is deliberately modest. It may provide:
+
+1. hidden-region presence or absence likelihood;
+2. coarse zone occupancy;
+3. motion onset/cessation likelihood;
+4. a broad position prior with measured covariance; or
+5. an empty-volume vote for guarded optical background updates.
+
+RF weights are zero when the CSI sensor identity, room calibration, coordinate
+transform, freshness, or out-of-distribution gate is invalid. CSI never sharpens
+an optical posterior beyond the calibration evidence that justifies it. A model
+trained with LiDAR pseudo-labels is evaluated on a held-out partition with
+external ground truth; it may not be scored against its own optical teacher.
+
+### 4. Synchronize before fusion
+
+Both inputs enter a bounded temporal join keyed by tenant, workspace, site,
+world-frame ID, and capture session. The join records sensor timestamp, receive
+timestamp, clock uncertainty, calibration digest, and maximum pairing skew.
+
+Frames outside the preregistered skew are not interpolated into apparent
+coherence. The system may make an optical-only or RF-only observation with the
+missing modality named, but it may label output `fused` only when both factors
+pass identity, freshness, calibration, and time/space alignment checks.
+
+### 5. Divide responsibilities across RuView primitives
+
+| Component | Responsibility | Explicit non-responsibility |
+|---|---|---|
+| MAS/particle filter | current optical likelihood and posterior update | long-term identity, authorization, hardware provenance creation |
+| CSI adapter/model | current calibrated RF likelihood | optical histogram synthesis, centimetre precision without evidence |
+| RuVector | embeddings for trajectory/canonical-response similarity and bounded temporal retrieval | replacing the live Bayesian update or upgrading evidence level |
+| RuField | observation confidence, covariance, quality, provenance, calibration, and expiration | presenting unknown/stale data as ground truth |
+| WorldGraph | session-scoped hidden-object hypothesis nodes and spatial/temporal relations | identity inference or permanent person graph by default |
+| Evidence/witness layer | content digests, acceptance result, lineage and receipts | sensing, fusion, or actuation |
+
+`ruview.nlos.track.v1` is the current shared output contract. It carries
+track/session IDs, one source classification, position/velocity, covariance,
+freshness/expiry, quality state, modality contribution weights, calibration
+hash, evidence level, algorithm revision, and one provenance record. It does
+not carry two authenticated modality lineages, a world-frame ID, coordinate
+transform digest, or capture-manifest digest. Consequently v1 rejects measured
+CSI fusion and `l3_corroborated`; the current CSI path is scope-bound synthetic
+L0 regression only. A future v2 contract must add those bindings before F1/F2
+measured fusion can be enabled. Consumers reject unknown schema versions and
+stale tracks now; coordinate compatibility remains a future contract gate.
+
+### 6. Cross-modal training follows, and cannot contaminate, evaluation
+
+After a frozen rules/physics fusion baseline, LiDAR may supervise an RF model.
+Dataset partitions are grouped by capture session, subject/target, room, sensor
+configuration, and time block to prevent adjacent-frame and environment
+leakage. Optical targets for RF training are probabilistic distributions with
+quality masks, not hard ground truth. The test endpoint always uses independent
+external ground truth and includes LiDAR-only, CSI-only, and fused arms.
+
+The system retains a non-learned fallback. A learned score or fusion policy must
+show stratified improvement and calibration before promotion. Model absence or
+error degrades to the last independently validated factor, never direct action.
+
+## Architecture and data flow
+
+```mermaid
+flowchart TD
+    A["Transient frame + optical calibration"] --> B["MAS optical likelihood"]
+    C["CSI frame + RF calibration"] --> D["RF likelihood"]
+    B --> E["Bounded temporal Bayesian join"]
+    D --> E
+    E --> F["ruview.nlos.track.v1"]
+    F --> G["RuField + RuVector + WorldGraph"]
+```
+
+Only the join creates a fused track. RuVector and WorldGraph are downstream
+state consumers, not a shortcut around missing, stale, or rejected modalities.
+
+## Performance decision
+
+1. The live tracking loop is bounded to the newest accepted frame. Backpressure
+   drops obsolete queued work and records loss; it does not accumulate latency.
+2. The particle count, canonical volume, search volume, history length, graph
+   nodes per session, and temporal-join window are configuration-bounded.
+3. The fusion budget is measured independently from optical tracking. Report
+   p50/p95 sensor-to-track latency and update rate for LiDAR-only and fused arms.
+4. Optimization is retained only when numerical agreement stays within the
+   frozen tolerance and the paired research endpoint does not regress.
+5. At least 27 accepted LiDAR-only track updates per second is required before
+   the fusion endpoint is interpreted. A fast fused path cannot rescue a failed
+   reproduction.
+
+## Security and privacy
+
+1. The join accepts only authenticated sensor/session identities and compatible
+   tenant/workspace/world-frame bindings. Cross-tenant or cross-session joins
+   are impossible by type and policy.
+2. Sequence and timestamp replay defenses are per modality. Reusing an old CSI
+   frame to make an optical track look persistent is rejected and audited.
+3. A malicious modality may inject extreme likelihoods. Inputs and weights are
+   bounded, posterior influence is observable, and single-modality ablations are
+   recorded for forensic review.
+4. Track IDs are random and session-scoped. Raw optical/CSI data is local by
+   default; downstream stores receive bounded hypotheses and provenance unless
+   an approved research protocol explicitly retains raw data.
+5. Long-term memory uses TTL, purpose limitation, deletion, and tenant isolation.
+   Similarity is not identity. The graph must not create a biometric profile.
+6. No fusion output grants actuation. Governed actions require the independent
+   ADR-321/327 policy, approval, freshness, and receipt path.
+
+## Alternatives considered
+
+### Concatenate optical and CSI tensors into one end-to-end network
+
+Deferred. It obscures failure attribution, calibration, and missing-modality
+behavior before a trustworthy baseline exists. A learned likelihood may be
+added after the factorized paired benchmark.
+
+### Use CSI only as a binary veto
+
+Useful as an initial safety rule, but insufficient as the final design because
+it discards calibrated spatial/motion information. The typed factor supports a
+binary likelihood without fixing the architecture to it.
+
+### Store only the posterior mean
+
+Rejected. NLOS can be multimodal and ambiguous. Covariance, particles or a
+bounded distribution summary, posterior entropy, and quality are essential for
+honest downstream behavior.
+
+### Let RuVector replace the particle filter
+
+Rejected. Vector memory can retrieve similar histories or canonical responses,
+but similarity alone is not the current physics likelihood and cannot enforce
+frame-level calibration/provenance.
+
+### Promote fusion if any pooled metric improves
+
+Rejected. The objective endpoint, pairing, strata, confidence interval, and
+non-success metrics are frozen before capture. Synthetic-only and pooled-only
+gains do not pass.
+
+## Consequences
+
+### Positive
+
+1. Optical localization evidence and RF persistence can complement one another without
+   conflating their measurement physics.
+2. Every downstream state retains uncertainty, freshness, modality, and lineage.
+3. The factorized baseline makes ablation, failure analysis, and rollback clear.
+4. Cross-modal training has a leakage-resistant target and external evaluation.
+
+### Costs and limitations
+
+1. Coordinate/clock calibration and paired ground truth add operational burden.
+2. Conditional-independence violations can make naive multiplication
+   overconfident; conservative fusion may sacrifice apparent sharpness.
+3. Current CSI may not provide enough independent spatial information to meet
+   the 25 percent endpoint. A negative result is acceptable and stops rollout.
+4. The architecture tracks hypotheses; it does not establish identity, intent,
+   photographic reconstruction, or safety certification.
+
+## Rollout and rollback
+
+| Phase | Behavior | Promotion | Rollback |
+|---|---|---|---|
+| F0 | optical-only reference plus recorded CSI | deterministic replay and calibration tests | disable RF factor |
+| F1 | shadow fusion, output not consumed | ADR-328 live LiDAR-only reproduction is `MEASURED` at >=27 Hz in its capture-manifest witness report and paired live capture is complete | discard shadow output |
+| F2 | research-visible fused track with explicit evidence | ADR-328 prerequisite remains valid; `MEASURED` >=25% endpoint has adjusted confidence support plus frozen-protocol, independent-CSI, security/privacy, guardrail and witness review | return to optical-only; invalidate certificate |
+| F3 | cross-modal learned likelihood in shadow | held-out external-ground-truth gain and calibration | remove model artifact; retain factorized baseline |
+
+Rollback is a configuration/capability-certificate change. Existing optical,
+CSI, RuVector, RuField, and WorldGraph services continue independently.
+
+## Objective acceptance mapping
+
+| ID | Requirement | Evidence |
+|---|---|---|
+| NLOS-329-01 | Reference MAS likelihood is deterministic and bounded | scalar/golden/property tests, all-zero, omitted-factor/`0^0`, and numeric-extreme tests |
+| NLOS-329-02 | Fused output requires valid identity, calibration, freshness, clocks, and coordinate frame for both factors | negative temporal/spatial join matrix plus missing/stale-factor omission tests |
+| NLOS-329-03 | Missing/rejected modality cannot be mislabeled fused | modality/provenance state tests |
+| NLOS-329-04 | RuVector/RuField/WorldGraph preserve uncertainty, TTL, lineage, and session scope | contract and integration tests |
+| NLOS-329-05 | Fusion improves a preregistered objective endpoint | F2/ADR-331 gate under one frozen protocol over >=100 paired `LIVE_HARDWARE` sequences: `MEASURED` >=25% mean-position-error **or** lost-track-rate reduction, successful multiplicity-adjusted interval excludes zero, shared endpoint-pairing digest and full position coverage, all frozen guardrails pass, independent CSI plus privacy/security/witness reviews pass |
+| NLOS-329-06 | Evaluation is leakage resistant | grouped partitions, frozen protocol, external ground truth, LiDAR/CSI/fused ablation |
+| NLOS-329-07 | Optimization preserves correctness and bounded latency | reference equivalence, benchmark deltas, overload/backpressure tests |
+| NLOS-329-08 | Fusion cannot actuate directly | policy/API tests proving hypothesis-only output |
+
+## References
+
+1. Somasundaram et al., [Nature article](https://doi.org/10.1038/s41586-026-10502-x).
+2. [Motion-induced aperture model and particle-filter methods](https://arxiv.org/html/2605.17865v1).
+3. ADR-273: Unified RF spatial world model.
+4. ADR-295: Source provenance state machine.
+5. ADR-301/302/303/304/305: calibration, OOD, ground truth, evidence, and authenticated sensor identity.
+6. ADR-311: Real sensor fusion.
+7. ADR-319: Witness chain.
@@ -0,0 +1,288 @@
+# ADR-330: Native and web iOS NLOS adapters and Apple API boundary
+
+| Field | Decision |
+|---|---|
+| **Status** | Accepted; native and web software surfaces are implementable now, direct built-in iPhone transient-NLOS remains unsupported until a documented Apple API and live device evidence exist |
+| **Date** | 2026-08-22 |
+| **Owners** | RuView Labs iOS, mobile web, API, security, and sensing maintainers |
+| **Scope** | Swift package/app, ARKit context adapter, authenticated track transport, web replay/live UI, capability claims |
+| **Depends on** | ADR-295, ADR-305, ADR-319, ADR-328, ADR-329 |
+| **Related** | ADR-034, ADR-035, ADR-331 |
+| **Implementation** | `ui/ios-nlos`, `ui/mobile`, `ruview.nlos.track.v1` |
+
+## Context
+
+The phrase “smartphone-grade LiDAR” describes a performance/cost class; it does
+not guarantee that an App Store process can read every internal sensor signal.
+The MIT technique needs each SPAD zone's photon-arrival histogram. Apple
+documents ARKit APIs for processed
+[`sceneDepth`](https://developer.apple.com/documentation/arkit/arframe/scenedepth),
+[`smoothedSceneDepth`](https://developer.apple.com/documentation/arkit/arframe/smoothedscenedepth),
+world tracking, and
+[`sceneReconstruction`](https://developer.apple.com/documentation/arkit/arworldtrackingconfiguration/scenereconstruction).
+Apple's [scene-depth point-cloud sample](https://developer.apple.com/documentation/arkit/displaying-a-point-cloud-using-scene-depth)
+shows how applications request and unproject processed depth. These public
+surfaces do not document the per-zone transient histogram used by the MAS
+measurement model.
+
+This is an API assessment, not a claim about undisclosed Apple hardware or
+future operating systems. It must be reviewed against official documentation
+for each supported iOS/Xcode release. Until the needed signal is documented and
+validated on a physical device, RuView must not present ARKit depth as an MIT
+NLOS reproduction.
+
+The user still needs two useful iOS surfaces:
+
+1. a native app that compiles a shared contract, uses public ARKit depth/pose for
+   visible context, and consumes external RuView NLOS tracks; and
+2. a web-capable mobile UI that receives authenticated tracks or deterministic
+   replay without pretending to capture the phone's LiDAR.
+
+## Decision
+
+### 1. Publish one contract with explicit capability levels
+
+All iOS surfaces consume `ruview.nlos.track.v1`. Capability is an enum, not
+inferred from device marketing:
+
+| Capability | Meaning | Permitted label |
+|---|---|---|
+| `unavailable` | no valid track source | unavailable/unknown |
+| `replay` | deterministic fixture or recorded stream | `SYNTHETIC` or `REPLAY`, persistently watermarked |
+| `arkit_context` | public ARKit pose/depth/mesh only | line-of-sight context; never NLOS |
+| `external_live` | authenticated live track from histogram-capable external pipeline | live external NLOS, subject to evidence/certificate |
+| `apple_transient_live` | future documented raw-transient Apple adapter | disabled until separate ADR, API proof, device witness, and ADR-331 gate |
+
+Unknown values fail closed. UI copy names the actual source and evidence level.
+It never shortens `external_live` to “iPhone sees around corners.”
+
+### 2. Keep the Swift core platform-neutral
+
+`ui/ios-nlos/Package.swift` defines:
+
+1. `RuViewNLOSCore`, a pure Swift contract/validation library that can be unit
+   tested without ARKit; and
+2. `RuViewNLOSApple`, an Apple-only adapter behind `canImport(ARKit)` and runtime
+   availability/capability checks.
+
+The direct iOS app and shared `RuViewNLOS` scheme use the same validated model.
+The current v1 core decoder rejects unknown/excess JSON shape, non-finite or
+bounded-range numeric values, invalid covariance diagonals, expired/future
+tracks, excessive arrays, duplicate IDs, and illegal provenance/evidence
+transitions. It has no world-frame or capture-manifest field yet; those are
+live-promotion contract requirements, not claims about this G0 scaffold.
+
+The current Apple adapter is deliberately a static capability probe: it does
+not start an `ARSession`, request camera permission, or capture/export any depth.
+It documents the public-API boundary and supports the authenticated external
+track client. A later, separately reviewed line-of-sight context adapter may
+export camera pose, intrinsics, visible scene depth/confidence, smoothed depth,
+and mesh metadata with explicit `arkit_context` labeling. Neither implementation
+synthesizes photon histograms or changes context into an NLOS evidence source.
+
+### 3. Treat the native app as a client of the external NLOS pipeline
+
+The production data path is intended to be an authenticated, versioned RuView
+track endpoint, not direct access to the ST board from UI code. The current v1
+client verifies:
+
+1. TLS and the configured RuView service identity;
+2. a scoped, revocable pairing token or short-lived session authorization;
+3. authenticated server session, envelope session, and schema bindings;
+4. monotonic sequence and bounded clock skew;
+5. track expiry, covariance, modality contributions, and calibration hash.
+
+L2/live promotion additionally requires tenant/workspace authorization,
+coordinate-frame and capture-manifest bindings, scoped enrolled sensor identity,
+and a valid witness/capability certificate. Those fields are not silently
+inferred from v1.
+
+Network loss, app suspension, sensor unavailability, decode error, and stale
+data immediately degrade the capability
+and clear or visually expire the live track. Cached data is never silently live.
+
+The initial Swift client further pins concrete bounds: `wss` only; no embedded
+URL credentials or fragments; redirects refused; ephemeral URLSession state; a
+256 KiB maximum message; an exact bounded JSON model; sequence no larger than
+the JavaScript safe integer and strictly increasing within a bound session; at
+most a 5 second track lifetime; and pairing tokens of 32–512 visible ASCII bytes
+stored as `WhenUnlockedThisDeviceOnly` Keychain data. `SYNTHETIC` frames require
+replay transport and the reserved zero calibration hash. Live provenance must
+retain a raw/CNH transient kind; a nonzero calibration hash is enforced at L2
+calibrated and above, not for every L1 live envelope. These are wire/client
+safety rules, not proof that the stream is physically honest.
+
+### 4. Web iOS consumes tickets and replay; it does not capture transients
+
+The NLOS surface in `ui/mobile` implements the same schema and freshness rules.
+Live mode first obtains an authenticated, short-lived, single-purpose ticket
+from `/api/v1/nlos/ws-ticket`, then connects to the NLOS stream. Long-lived
+OAuth tokens and credentials are not placed in query strings, logs, local
+storage, or replay files. The current server binds the ticket to its server
+session, a 30-second expiry, and one use; the client pins the returned WSS URL
+to the configured same authority. Tenant/workspace/audience/origin claims are
+required before L2 deployment but are not present in the v1 ticket schema.
+
+Deterministic replay is a first-class developer/demo mode. It is visibly marked
+`SYNTHETIC` throughout the view, uses fixed seeds/fixtures, cannot update live
+spatial memory, and cannot satisfy the research gate. Bounded exact-key
+validation and same-authority ticket checks are implemented. Deployment CSP,
+server-enforced origin policy, and reconnect backoff remain required hardening
+before live promotion.
+
+The web view visualizes plan/perspective geometry, covariance/quality,
+freshness/expiry, modality/provenance, and disconnected/degraded state. It does
+not call an undocumented WebKit or ARKit bridge.
+
+Both clients accept at most 1,000 ms of future clock skew and a 5,000 ms
+envelope lifetime. The web profile is intentionally stricter under receive
+silence: it clears a frame after 1,500 ms without a replacement even when the
+publisher supplied a longer TTL. Native clears at the signed envelope expiry.
+This conservative display-liveness difference does not alter wire acceptance,
+evidence level, or research metrics.
+
+### 5. Keep pose/context fusion separate from evidence fusion
+
+ARKit pose may help align the phone display or a separately calibrated external
+sensor. That transform is valid only when extrinsic calibration, timestamps,
+coordinate conventions, and uncertainty pass. Scene depth may display the
+relay wall or visible geometry. It is not added to the optical NLOS likelihood
+unless a future reviewed model defines and evaluates that factor.
+
+If the phone and external sensor are not rigidly mounted, phone pose cannot be
+treated as sensor pose without an independently measured time-varying transform.
+The UI may still display both frames separately.
+
+### 6. Re-evaluate Apple support through a documented gate
+
+At each major iOS/Xcode intake, a reviewer searches Apple's official SDK headers,
+documentation, entitlements, privacy manifest requirements, and App Store rules.
+Direct Apple transient support advances only if all are true:
+
+1. a public supported API exposes timing histogram/count data with documented
+   units, dimensions, timestamps, and device support;
+2. use requires no private symbols, jailbreak, reverse engineering, or hidden
+   entitlement;
+3. a physical-device capture proves that the data includes usable multipath;
+4. privacy/security review and user disclosure pass; and
+5. the same live reproduction/fusion protocol passes under a new adapter ADR.
+
+No marketing article, simulator API, depth-map correlation, or successful
+compile satisfies this gate.
+
+## Performance decision
+
+| Surface | Software target | Measurement note |
+|---|---|---|
+| Swift core | decode/validate without blocking the main actor; bounded memory | benchmark representative max-size track frames |
+| Native rendering | newest-frame policy; 30 fps-capable presentation where device allows | rendering rate is not sensing rate |
+| Web validation/store | bounded per-message parsing and no unbounded history | reject oversized messages before state update |
+| Web rendering | responsive recent-track visualization and backoff under loss | requestAnimationFrame rate is not NLOS update rate |
+| Transport | p50/p95 server-to-view latency, reconnects and dropped/stale counts | report separately from sensor-to-track latency |
+
+UI optimization may decimate display history, but it cannot decimate or reorder
+the evidence record. Performance tests use `SYNTHETIC` fixtures and are labeled
+software evidence only.
+
+## Security and privacy
+
+1. NLOS tracking can reveal a person outside direct view. Native and web apps
+   require explicit consent, purpose text, a persistent indicator, pause/stop,
+   and clear source/provenance. Background capture is disabled by default.
+2. App Transport Security/TLS and short-lived scoped authorization are required.
+   Debug cleartext/local exceptions are not release defaults.
+3. WebSocket messages are untrusted. Enforce maximum message size, schema,
+   numeric bounds, sequence, freshness, origin, rate, tenant, and coordinate
+   frame before rendering or storage.
+4. Replay files contain no credentials and no raw person/CSI/transient data by
+   default. Fixtures are synthetic or approved/de-identified and immutable.
+5. Native and web telemetry excludes positions, raw sensor frames, tokens,
+   calibration secrets, and stable person identifiers. Diagnostics use bounded
+   counters and redacted errors.
+6. The display is advisory. It cannot directly actuate a device or certify that
+   a hidden region is safe.
+
+## Alternatives considered
+
+### Make the first milestone a direct iPhone NLOS app
+
+Rejected. It makes the research depend on an undocumented measurement. The
+external sensor proves the architecture independently while iOS remains a
+transport, context, and presentation adapter.
+
+### Use only a native app
+
+Rejected. A web/mobile view lowers review and demo friction, exercises the
+versioned protocol, and can run deterministic fixtures. It still must not claim
+direct sensor access.
+
+### Use only a web app and skip native Swift
+
+Rejected. ARKit pose/depth and physical-device capability checks require the
+native SDK. The pure Swift core also gives an independent decoder implementation.
+
+### Embed a permanent bearer token in the app or WebSocket URL
+
+Rejected. Tokens leak through logs, browser history, proxies, crash reports,
+and screenshots. Use short-lived, scoped, one-use tickets.
+
+### Treat replay as a transparent fallback during disconnect
+
+Rejected. It would misrepresent stale/synthetic state as live. Replay is an
+explicit operator mode with persistent labeling and separate state.
+
+## Consequences
+
+### Positive
+
+1. Native and web iOS deliver useful live/replay experiences without blocking
+   the core research on Apple's API choices.
+2. The same schema, freshness, provenance, and coordinate rules apply across
+   Rust, Swift, and TypeScript.
+3. Public ARKit pose and visible geometry remain valuable but honestly scoped.
+4. Future Apple transient access has a precise, reviewable activation gate.
+
+### Costs and limitations
+
+1. The first live iOS experience needs an external histogram sensor and RuView
+   host; the phone alone is not the sensing system.
+2. Cross-language contract tests and release CI add maintenance.
+3. Web presentation depends on an authenticated RuView backend; offline mode is
+   replay only.
+4. Simulator and Linux Swift tests cannot validate ARKit, LiDAR hardware,
+   App Store behavior, or a physical iOS build.
+
+## Rollout and rollback
+
+| Phase | Enablement | Rollback trigger | Action |
+|---|---|---|---|
+| I0 | pure Swift/TypeScript contract and deterministic fixtures | decoder disagreement, unbounded input, provenance drift | disable view; fix contract/golden vectors |
+| I1 | future separately reviewed ARKit context on supported device | permission/session/transform failure | capability `unavailable`; clear context |
+| I2 | authenticated external live tracks with valid, unexpired evidence/capability certificate and privacy approval | stale/replay/auth/tenant/evidence mismatch or approval withdrawal | disconnect; clear live state; retain explicit replay option |
+| I3 | future Apple transient adapter | any of five activation gates absent/regressed | remove capability certificate and adapter flag |
+
+The NLOS tab/app can be removed or disabled without affecting core RuView CSI,
+Rust sensing, memory, MCP, or orchestration.
+
+## Objective acceptance mapping
+
+| ID | Requirement | Evidence |
+|---|---|---|
+| NLOS-330-01 | Swift core builds/tests without ARKit | `cd ui/ios-nlos && swift test` on supported Swift host |
+| NLOS-330-02 | Native iOS scheme builds with public APIs | macOS `xcodebuild` simulator gate and physical-device smoke evidence, separately labeled |
+| NLOS-330-03 | Current Apple capability probe, absent a new adapter ADR, never emits raw-transient/live-NLOS provenance | capability/provenance unit tests and source review |
+| NLOS-330-04 | Web contract accepts valid `ruview.nlos.track.v1` and rejects malformed/stale/oversized input | Jest/TypeScript boundary tests |
+| NLOS-330-05 | Live web transport uses short-lived authenticated tickets | client/server integration and replay/origin/expiry negative tests |
+| NLOS-330-06 | Replay remains persistently `SYNTHETIC` and cannot pass live gate | UI/store tests plus harness research rejection |
+| NLOS-330-07 | Missing Xcode/hardware or NLOS backend degrades honestly | advisory verifier skips and offline/disconnect UI tests |
+| NLOS-330-08 | Web and native builds remain separable from core runtime | build matrix with NLOS surfaces disabled/absent |
+| NLOS-330-09 | Future Apple activation uses only documented public access | official SDK/header diff, entitlement scan, privacy/App Store review, device witness, and separate adapter ADR |
+
+## References
+
+1. Apple, [`ARFrame.sceneDepth`](https://developer.apple.com/documentation/arkit/arframe/scenedepth).
+2. Apple, [`ARFrame.smoothedSceneDepth`](https://developer.apple.com/documentation/arkit/arframe/smoothedscenedepth).
+3. Apple, [`ARWorldTrackingConfiguration.sceneReconstruction`](https://developer.apple.com/documentation/arkit/arworldtrackingconfiguration/scenereconstruction).
+4. Apple, [Displaying a point cloud using scene depth](https://developer.apple.com/documentation/arkit/displaying-a-point-cloud-using-scene-depth).
+5. Somasundaram et al., [consumer-NLOS measurement model](https://arxiv.org/html/2605.17865v1).
+6. STMicroelectronics, [VL53L8CH raw compact normalized histogram interface](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html).
@@ -0,0 +1,332 @@
+# ADR-331: Consumer NLOS evidence levels, privacy/security, benchmarks, and optional MetaHarness governance
+
+| Field | Decision |
+|---|---|
+| **Status** | Accepted; software gates are implemented independently of live-hardware evidence, research promotion remains blocked until the preregistered capture passes |
+| **Date** | 2026-08-22 |
+| **Owners** | RuView Labs maintainers, security/privacy reviewers, benchmark owners |
+| **Scope** | Claim taxonomy, acceptance records, benchmark governance, contributor harness, release/promotion and rollback |
+| **Depends on** | ADR-166, ADR-168, ADR-282, ADR-295, ADR-299, ADR-303 through ADR-305, ADR-318/319, ADR-328 through ADR-330 |
+| **Implementation** | `harness/ruview`, `docs/security/consumer-nlos-threat-model.md`, `docs/research/consumer-nlos-acceptance-protocol.md` |
+
+## Context
+
+Consumer NLOS is unusually easy to overstate. A point-cloud animation can look
+plausible even when driven by replay, stale state, calibration leakage, direct
+line of sight, or a reflectivity regime unlike the deployment target. Native and
+web builds can validate contracts without measuring one multipath photon. CSI
+and LiDAR may also share temporal or labeling leakage, producing an apparent
+fusion gain that contains no independent RF information.
+
+The capability reveals presence and trajectories outside direct view, which
+raises privacy and misuse risks despite not producing a conventional photograph.
+It also has no present safety case for autonomous actuation. The project needs a
+promotion gate that separates source integrity, software validation, controlled
+laboratory evidence, field generalization, and production evidence.
+
+The existing RuView contributor harness is dependency-free at runtime and uses
+MetaHarness/Flywheel/Darwin only as development aids. NLOS verification should
+reuse that posture: helpful, deterministic, and removable, never a requirement
+for sensing, fusion, memory, routing, MCP, or normal runtime behavior.
+
+## Decision
+
+The `@ruvnet/ruview` packed-size ceiling increases from 160 KiB to 220 KiB to
+carry the bounded NLOS contract verifier, research-gate evaluator, and operator
+skill. The existing no-source-map, no-runtime-dependency, tarball smoke, and
+claim-honesty gates remain mandatory. This is a reviewed capability budget, not
+an unbounded exemption; the current dry-run package is approximately 203 KiB.
+
+### 1. Keep three orthogonal labels
+
+Every NLOS result records:
+
+1. **Source provenance**: exactly one logical value for live hardware, replay,
+   or synthetic input; unknown is never coerced to live. The acceptance record
+   encodes these as `LIVE_HARDWARE`/`REPLAY`/`SYNTHETIC`, while the
+   `ruview.nlos.track.v1` wire contract uses `live`/`replay`/`synthetic`.
+2. **Claim tag**: `MEASURED` with a named reproducer/manifest, `CLAIMED` with a
+   primary external source, or `SYNTHETIC` for simulation/fixtures. A build is
+   “validated software,” not a measured sensing result.
+3. **ADR-282 evidence level**:
+
+| Level | Meaning for NLOS |
+|---|---|
+| L0 | simulation or generated transient/track fixtures only |
+| L1 | captured replay; deterministic pipeline behavior, not a fresh live result |
+| L2 | controlled laboratory capture with external ground truth and frozen protocol |
+| L3 | held-out room plus target/subject validation with leakage-resistant splits |
+| L4 | multi-site field pilot under approved privacy/safety operations |
+| L5 | production operational evidence, incident monitoring, drift and rollback history |
+
+The upstream paper is cited as `CLAIMED` in RuView until reproduced. The first
+RuView live acceptance can reach L2 only. No amount of L0/L1 replay volume
+upgrades a capability to L2.
+
+This ADR-282 maturity level is not the similarly named wire
+`evidenceLevel` in `ruview.nlos.track.v1`. V1 accepts
+`l0_synthetic`/`l1_measured`/`l2_calibrated`; `l3_corroborated` is reserved for
+a future contract that can retain authenticated dual-modality lineage. These
+values describe one envelope's source/calibration ceiling. They never self-promote
+research maturity: a synthetic envelope is ADR L0, a captured replay remains
+ADR L1 regardless of its historical wire label, and a live
+`l2_calibrated` envelope reaches ADR L2 only through this
+frozen external-ground-truth witness protocol. The acceptance JSON therefore
+uses separate `claim_tag: MEASURED` and ADR maturity `evidence_level: L2`.
+
+### 2. Separate software, research, and release gates
+
+| Gate | What can pass it | What it proves | What it does not prove |
+|---|---|---|---|
+| Software | Rust/Swift/TypeScript unit, property, contract, build, replay and security tests | implementations compile and enforce declared invariants | photon capture, NLOS accuracy, physical iPhone support |
+| Research | preregistered `LIVE_HARDWARE` capture with external ground truth | objective reproduction and fusion endpoints for named strata | field generalization, safety, identity, production readiness |
+| Release/promotion | software + security + privacy + required evidence/certificate + human review | capability may be exposed at its exact evidence level | authority to actuate or claim a higher level |
+
+An unavailable Xcode/hardware toolchain is an explicit `SKIPPED`, not a pass or
+failure. A present partial/incompatible surface fails shallow discovery. If no
+toolchain executes, the verifier reports `NO_BUILD_TOOLCHAINS_AVAILABLE`, never
+a pass. Available-build success is only a subset of Gate A and is forbidden in
+a hardware or release claim.
+
+### 3. Preregister the reproduction and fusion endpoint
+
+Before opening the test partition, freeze:
+
+1. upstream commit and firmware/configuration;
+2. sensor/CSI identity, calibration and coordinate transforms;
+3. scene/target strata, exclusion rules and direct-line-of-sight checks;
+4. randomized sequence order and grouped split manifest;
+5. background capture and OOD/freshness thresholds;
+6. track initialization, lost-track definition and maximum association gap;
+7. primary metrics and bootstrap confidence interval procedure; and
+8. all model/weight/threshold versions for LiDAR-only and fused arms.
+
+The hard gate requested for this program is:
+
+1. **Reproduction:** LiDAR-only produces at least 27 accepted end-to-end track
+   updates per second on live hardware, the objective definition of roughly
+   30 fps.
+2. **Fusion:** over at least 100 paired live sequences, fusion achieves
+
+\[
+G_e = \frac{E_L-E_F}{E_L} \ge 0.25
+\quad\text{or}\quad
+G_\ell = \frac{\ell_L-\ell_F}{\ell_L} \ge 0.25,
+\]
+
+where \(E\) is the preregistered mean target-position error and \(\ell\) is the
+preregistered lost-track rate. Both metrics are reported even if only one is
+the success endpoint. Zero denominators do not count as improvement.
+
+The protocol also reports confidence intervals, p95 position error, time to
+first lock, false tracks in an empty hidden volume, update/latency distribution,
+frame loss, calibration/OOD rejection, and performance per reflectivity, range,
+motion, relay surface, room, and RF geometry. These secondary metrics prevent a
+single successful aggregate from hiding unacceptable behavior.
+
+### 4. Use a bounded, reviewable acceptance record
+
+`ruview.nlos.acceptance.v1` is repository-contained JSON that references, but
+does not embed, sensitive captures. Required fields include:
+
+1. exact schema, `LIVE_HARDWARE` provenance, `MEASURED` claim tag, L2 evidence
+   level, and `EXTERNAL` ground truth;
+2. protocol-frozen-before-capture flag;
+3. enrolled external ST VL53L8CH sensor-model label for v1, verified raw/CNH
+   transient kind, pinned upstream SHA-1, and SHA-256 digests for protocol,
+   firmware/API, combined and
+   CSI capture manifests, scoped enrolled identities, calibration and analysis;
+4. zero synthetic frames and zero replay frames in the scored set;
+5. independently verified CSI, a CSI-only ablation, at least one CSI source and
+   at least 100 paired sequences;
+6. raw aggregate counts/durations/sums from which each arm's update rate, mean
+   position error, lost-track rate, offered optical rate and fused optical-frame
+   loss are recomputed; full paired-sequence position coverage and shared
+   endpoint denominators are mandatory; and
+7. preregistered bootstrap seed digest, at least 10,000 resamples,
+   multiplicity-adjusted intervals, witness review, LOS exclusion, and passed
+   privacy/security review.
+
+The advisory verifier validates an exact-key record, bounds, provenance,
+digests, arithmetic, and thresholds; unknown fields fail so secrets or raw data
+cannot silently hitchhike in the acceptance artifact. It cannot independently
+prove that a digest corresponds to an honest physical experiment. Human reviewers inspect the immutable manifest,
+external ground-truth synchronization, raw-capture access controls, exclusions,
+and analysis reproducer before promotion.
+
+### 5. Extend, but do not require, the RuView contributor harness
+
+The dependency-free `@ruvnet/ruview` CLI/MCP registry adds governed advisory
+surfaces. MCP/static inspection remains read-only. Local `--run-builds` is an
+explicit execution mode, must target a trusted checkout, uses an allowlisted
+child environment and redacted bounded tails, and is not a sandbox:
+
+| Surface | Behavior |
+|---|---|
+| `ruview nlos plan` / `ruview_nlos_plan` | returns four staged phases, measurement invariant, expected surfaces and exit gates |
+| `ruview nlos verify` | shallowly discovers expected Rust/native/web manifests/contracts, can explicitly run available local builds in a trusted checkout, and evaluates an optional live acceptance record |
+| `ruview_nlos_verify` | read-only MCP inspection of the auto-detected repository and optional repository-confined evidence; rejects repository selection and build execution |
+| `consumer-nlos` skill | contributor playbook for measurement boundary, reproduction, fusion, evidence, security, and iOS limitations |
+
+The verifier discovers `v2/crates/ruview-nlos`, `ui/ios-nlos`, and `ui/mobile`.
+If an optional surface is absent, it reports `ABSENT`. Once its feature marker
+exists, missing, escaping, oversized or incompatible required artifacts are
+`MALFORMED` and fail. String/manifest discovery does not replace contract tests.
+Evidence files are regular, bounded, repository-confined JSON; path escape,
+symlink escape, oversize, malformed JSON, replay, or synthetic input fails.
+
+MetaHarness, Ruflo, Darwin, and Flywheel remain contributor tooling. Direct
+crate/app builds without the harness are the evidence that runtime does not
+require it; the verifier's status field is not proof by itself. Harness
+proposals cannot modify sensing evidence, promote a
+model, publish a package, merge code, or authorize hardware. Promotion retains
+human review.
+
+For future harness-policy evolution, a proposal is retained only if a frozen
+holdout shows more than 2 percent quality lift, contributor cost regression is
+below 1 percent, p95 latency regression is below 5 percent, security/legacy
+tests do not regress, provenance is verified, and a human approves it. These
+thresholds govern contributor tooling only; they do not replace the 25 percent
+sensor-fusion endpoint.
+
+### 6. Apply privacy-by-default controls
+
+1. A named controller/operator records purpose, lawful/organizational basis,
+   approved spaces, experiment window, access list, retention, and deletion.
+2. Visible notices and an active sensing indicator are required. Participants
+   can pause/withdraw where applicable. No hidden deployment is allowed.
+3. Raw transient, CSI, ground-truth video/tag data, and joined trajectories are
+   P0/P1 research data: encrypted locally, access logged, minimized, separated
+   by tenant/experiment, and deleted on the frozen schedule. They are never
+   committed to Git or emitted in harness logs.
+4. Default outputs are bounded session-scoped tracks with covariance,
+   provenance and expiry. No face image is needed, but “camera-free” is not
+   “privacy-free.” No biometric identity or cross-session re-identification is
+   claimed or enabled by default.
+5. Dataset/model publication needs a separate disclosure/re-identification
+   review, consent/license check, and removal request path.
+6. Safety and high-consequence use are out of scope. Tracks are advisory and
+   never direct actuation authority.
+
+### 7. Make security a release blocker
+
+The threat model in `docs/security/consumer-nlos-threat-model.md` is mandatory.
+Release requires no confirmed high/critical finding across:
+
+1. untrusted transient/track/parser boundaries and numeric/resource exhaustion;
+2. sensor, session, calibration and capture identity/provenance;
+3. replay/stale/future/duplicate and cross-tenant/world-frame attacks;
+4. transport authorization, short-lived web tickets, TLS/origin and secret
+   handling;
+5. firmware/upstream/npm/Cargo/Swift supply chain and license review;
+6. raw research-data retention, logs, fixtures, telemetry and repository policy;
+7. denial/degradation behavior and lack of direct actuation.
+
+Findings are confirmed with focused tests before remediation claims. Automated
+scanner output alone is not a confirmed vulnerability or a cleared release.
+
+## Performance and optimization governance
+
+Performance reports name hardware, OS/toolchain, configuration, capture digest,
+commit, warmup, sample count, and statistics. Report sensor capture rate,
+accepted frame rate, track update rate, sensor-to-track latency, service-to-view
+latency, CPU, peak memory, queue drops, and output quality separately.
+
+Optimization sequence:
+
+1. profile parser, normalization, rendering/likelihood, resampling, temporal
+   join, serialization, and UI independently;
+2. add scalar golden vectors and property tests before vectorization/caching;
+3. bound buffers/particles/history and prefer newest-frame backpressure;
+4. compare LiDAR-only and fused quality after every material optimization; and
+5. roll back any change that violates numerical tolerance, security, privacy,
+   freshness, or the preregistered endpoint.
+
+Configured 30 Hz, display 30/60 fps, and replay throughput are not equivalent
+to live end-to-end tracking. Reports must name which one was measured.
+
+## Alternatives considered
+
+### Allow synthetic evidence to pass when hardware is unavailable
+
+Rejected. Synthetic and replay are essential for software QA but cannot measure
+the required optical path or independent RF gain.
+
+### Treat the published MIT result as RuView's baseline evidence
+
+Rejected. It is a primary `CLAIMED` reference with different hardware/scenes and
+does not validate RuView's integration, privacy, security, or fusion.
+
+### Make MetaHarness a required runtime coordinator
+
+Rejected. Core sensing, fusion, memory, routing, MCP and UI must operate without
+development orchestration. An advisory tool cannot be a physical trust anchor.
+
+### Store all raw captures indefinitely for reproducibility
+
+Rejected. Reproducibility uses controlled access, immutable digests, frozen
+manifests and a retention schedule. Indefinite person/space/RF data creates
+disproportionate risk.
+
+### Promote on the 25 percent point estimate alone
+
+Rejected. Pairing, confidence intervals, strata, secondary harms, calibration,
+provenance, security, privacy and human review remain required.
+
+## Consequences
+
+### Positive
+
+1. Reviewers can distinguish compile/replay success from physical NLOS evidence.
+2. The 30 fps and 25 percent claims become executable, preregistered gates.
+3. Privacy and security are part of experiment design, not a post hoc checklist.
+4. The optional harness makes missing toolchains/surfaces explicit without
+   weakening the independent runtime.
+
+### Costs and limitations
+
+1. Controlled capture, external ground truth, review and data governance take
+   more time than a visual demo.
+2. The acceptance JSON verifies integrity/arithmetic, not physical truth by
+   itself; witness review remains necessary.
+3. L2 success does not establish L3–L5 generalization or safety.
+4. A negative fusion result blocks promotion even if each modality is
+   individually interesting.
+
+## Rollout and rollback
+
+| Stage | Published capability | Required evidence | Rollback |
+|---|---|---|---|
+| G0 | development preview | L0 synthetic software fixtures, explicitly labeled | disable flag/view/tool; retain tests |
+| G1 | captured replay demo | L1 capture manifest and privacy approval | revoke fixture/access; return to synthetic |
+| G2 | controlled research result | L2 live protocol + acceptance + security/privacy review | invalidate certificate; remove live label; optical-only or unknown |
+| G3+ | held-out/pilot/production | level-specific ADR-282 artifacts and monitoring | level downgrade, stop capture, delete per schedule, incident review |
+
+Rollback preserves audit/witness records and never rewrites provenance. It may
+disable NLOS/fusion independently while CSI and the rest of RuView continue.
+
+## Objective acceptance mapping
+
+| ID | Requirement | Evidence |
+|---|---|---|
+| NLOS-331-01 | Claim tag, provenance and L0–L5 level never alias | type/state tests, UI label tests, claim checker |
+| NLOS-331-02 | Synthetic/replay cannot pass research | `evaluateResearchEvidence` negative tests and CLI nonzero with `--require-research-pass` |
+| NLOS-331-03 | Reproduction is roughly 30 fps | live accepted update rate >=27 Hz, external-ground-truth manifest |
+| NLOS-331-04 | Fusion has objective value | `MEASURED` in the capture-manifest witness report under the frozen protocol over >=100 paired sequences; >=25% mean-error **or** lost-track reduction with adjusted interval excluding zero, shared pairing digest, and all frozen guardrails passing |
+| NLOS-331-05 | Harness remains optional | core/app tests without harness dependencies; absent-surface test |
+| NLOS-331-06 | Present malformed surface/evidence fails closed | path/bounds/schema/digest/provenance and partial-surface tests |
+| NLOS-331-07 | Privacy controls cover collection through deletion | approved experiment record, access/retention/deletion audit |
+| NLOS-331-08 | No unaccepted high/critical security finding at release | threat-model review, focused regression tests and dependency/secret scans; `NLOS-SEC-EX-001` was closed by lockfile remediation without an exception, while future findings still require correction or an exact signed, unexpired exception record |
+| NLOS-331-09 | Optimization does not trade away quality or freshness | golden/reference equivalence and named benchmark report |
+| NLOS-331-10 | No hardware/App Store claim from CI alone | PR/release claim check and explicit physical-device witness field |
+| NLOS-331-11 | Optional harness-policy evolution cannot self-promote or regress its frozen gates | `MEASURED` frozen held-out/anchor report proving >2% quality lift, <1% cost regression, <5% p95 latency regression, unchanged security/legacy gates, verified provenance and human approval; otherwise discard proposal |
+
+## References
+
+1. ADR-282: mandatory L0–L5 evidence ladder.
+2. ADR-295: source provenance state machine.
+3. ADR-303/304/305: ground-truth synchronization, evidence engine, authenticated sensor identity.
+4. ADR-318/319: capability certificates and witness chain.
+5. MIT, [Consumer NLOS project and 30 Hz demonstration](https://cornar.media.mit.edu/).
+6. Somasundaram et al., [Nature paper](https://doi.org/10.1038/s41586-026-10502-x).
+7. STMicroelectronics, [VL53L8CH raw histogram interface](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html).
@@ -0,0 +1,59 @@
+# ADR 340: iPhone LiDAR Sensor Bridge
+
+Status: Proposed
+
+## Context
+
+RuView needs a low cost mobile geometry sensor that can contribute calibrated spatial observations without coupling the perception substrate to Apple frameworks.
+
+ARKit exposes rear LiDAR scene depth through `ARFrame.sceneDepth` and `smoothedSceneDepth` on supported devices. Ordinary mobile web pages do not receive this ARKit depth surface directly, so native capture and web visualization must be separated.
+
+## Decision
+
+Use a two layer architecture.
+
+1. Native Swift and ARKit perform acquisition.
+2. A modality neutral wire frame transports geometry into browser tools and, next, the RuView HAL.
+
+The native client will capture depth, confidence, camera intrinsics, and world tracking pose. RGB imagery is excluded from the default transport.
+
+The protocol identifier is `ruview.lidar.depth.v1`.
+
+Depth samples are quantized to UInt16 millimeters for transport. Confidence remains UInt8. The default sender downsamples by two spatially and caps transmission at 15 FPS. Full fidelity depth remains available locally for future on device inference.
+
+## RuView integration boundary
+
+The transport must not become a second world model. The production receiver converts each packet into the canonical `ruview-hal::Observation`, then passes it through authenticated sensor identity, provenance, OOD gating, uncertainty aware fusion, spatial memory, and WorldGraph adapters.
+
+Rules:
+
+1. `source=live` is valid only for frames produced by an active ARKit session.
+2. Sequence numbers are monotonic per sensor session.
+3. Wall clock timestamp is separate from ARKit monotonic frame timing.
+4. RGB is off by default and requires an explicit higher privacy capability.
+5. Browser clients consume geometry but are not treated as authoritative sensors.
+6. Unsupported devices fail closed rather than substituting simulated depth.
+
+## Performance target
+
+`[SYNTHETIC]` A 256 x 192 Float32 depth map is about 196 KB before confidence and metadata. Downsampling to 128 x 96 and encoding each sample as two byte depth plus one byte confidence yields about 36.9 KB raw. At 15 FPS the raw sensor payload is about 553 KB/s. Base64 raises this to roughly 737 KB/s before JSON metadata. These values are arithmetic sizing estimates, not device measurements.
+
+The `[CLAIMED target]` for local network latency is below 150 ms p95. A later binary WebSocket or QUIC transport can remove base64 overhead; the exact end-to-end reduction must be measured before it is claimed.
+
+## Security
+
+The development relay is LAN-facing, requires a random per-run bearer token, bounds message size, and restricts the files it serves. Its default `ws://` transport is not encrypted, so it is not a production trust boundary.
+
+Production requires WSS, authenticated sensor identity, replay protection, message size limits, per tenant authorization, provenance receipts, and explicit retention policy before persistence.
+
+## Consequences
+
+Benefits include commodity hardware, metric depth, tracked camera pose, rapid room scanning, calibration support for RF sensing, and a practical ground truth source for RuView experiments.
+
+The main limitation is that Apple provides processed scene depth rather than the underlying raw transient LiDAR waveform. Therefore this implementation supports direct geometry and sensor fusion now, but does not reproduce research systems that require raw multipath time of flight transients for non line of sight reconstruction.
+
+## Acceptance criteria
+
+A physical LiDAR capable iPhone must stream live geometry to the browser viewer with monotonically increasing sequence numbers, no RGB payload, valid confidence maps, and below 150 ms p95 local network latency over a 60 second run.
+
+CI type-checking and simulator runs do not satisfy this criterion. Until a captured physical-device run records the environment and results, the hardware behavior and latency remain unverified.
@@ -0,0 +1,459 @@
+# ADR-341: Consumer NLOS beta tester delivery, setup assistant, and bounded diagnostics
+
+| Field | Decision |
+|---|---|
+| **Status** | Proposed; release governance and CI dry gates are defined, TestFlight and physical-device evidence remain operator-gated |
+| **Date** | 2026-08-23 |
+| **Owners** | RuView Labs iOS, release, privacy, security, and research maintainers |
+| **Scope** | TestFlight delivery, post-install setup, capability checks, calibration and wall-scan workflow, diagnostic package, observability, rollback |
+| **Depends on** | ADR-295, ADR-305, ADR-318, ADR-319, ADR-328 through ADR-331, ADR-340 |
+| **Implementation** | `ui/ios-nlos`, `.github/workflows/consumer-nlos-ci.yml`, `docs/research/consumer-nlos-beta-test-protocol.md` |
+
+## Context
+
+Beta testers need to install RuView NLOS without Xcode, understand what their
+device can actually measure, complete a short test, and return actionable
+feedback. Calling this an “installer” hides two different responsibilities:
+
+1. **TestFlight is the distribution and update mechanism.** Apple controls app
+   installation, signing, tester invitations, build expiry, and update delivery.
+2. **The RuView setup assistant starts after installation.** It checks device
+   support, requests narrowly scoped permissions, guides calibration and a wall
+   scan, labels the resulting evidence, and creates an optional diagnostic.
+
+RuView must not ship an ad hoc IPA installer, enterprise signing workaround, or
+credential-bearing upload workflow. Those paths add device registration or
+certificate custody, create revocation risk, and still cannot overcome the core
+sensor limitation: public ARKit exposes processed scene depth, not the raw
+transient histograms required by the consumer NLOS reconstruction in ADR-328.
+
+The product value of the beta is therefore evidence collection, onboarding
+quality, direct line-of-sight LiDAR characterization, and external NLOS client
+validation. It is not proof that an iPhone alone sees around corners.
+
+## Specification
+
+### Outcome and actors
+
+The outcome is a governed beta path that a nontechnical tester can complete in
+under five minutes without Xcode. Actors are the tester, App Store Connect
+release operator, privacy/security reviewer, research owner, and support
+maintainer.
+
+### Inputs
+
+1. A TestFlight build produced from a reviewed commit.
+2. A supported iPhone or iPad and current OS permitted by the build.
+3. Tester consent and only the permissions needed by the selected test mode.
+4. Optional short-lived authenticated RuView endpoint configuration for an
+   external NLOS track source.
+5. A local session identifier generated per run and not derived from an Apple
+   account, advertising identifier, device serial, or person identity.
+
+### Outputs
+
+1. A terminal setup state with an explicit capability label.
+2. A 15 second calibration result and a 30 second wall-scan result when the
+   device supports public ARKit scene depth.
+3. A local summary showing frame count, effective frame rate, depth coverage,
+   pose stability, thermal state, permission state, and failure codes.
+4. An opt-in diagnostic JSON document no larger than 65,536 bytes.
+5. A tester-controlled path to copy or share the diagnostic and open the
+   RuView explainer and feedback issue.
+
+### Constraints and invariants
+
+1. The full guided path targets less than 300 seconds from first launch to
+   diagnostic-ready state. Calibration is 15 seconds and wall scan is 30
+   seconds, each measured by monotonic time.
+2. Raw camera images, depth maps, point clouds, CSI, transient histograms,
+   audio, precise location, access tokens, and stable person identifiers are
+   never included in diagnostics.
+3. No raw capture is uploaded by the beta assistant. Diagnostic export is
+   explicit, inspectable, and initiated by the tester.
+4. The diagnostic is rejected locally if canonical UTF-8 JSON exceeds 64 KiB,
+   contains a forbidden key, has non-finite numbers, or violates the schema
+   contract below.
+5. `physical_nlos` remains `blocked_raw_transients_unavailable` unless a future
+   public sensor adapter passes ADR-330's activation gate and ADR-331's live
+   research gate. ARKit scene depth can report `direct_depth` only.
+6. Permission denial, unsupported hardware, thermal pressure, interruption,
+   stale frames, or transport failure must produce a recoverable degraded state,
+   never synthetic substitution presented as live data.
+7. TestFlight publication requires human authorization and App Store Connect
+   credentials held by Apple or the approved release environment. Pull request
+   CI never reads signing or App Store Connect secrets.
+8. A CI build, unsigned archive, simulator run, or TestFlight installation is
+   software evidence only. Physical LiDAR behavior requires a named device run.
+
+### Exclusions
+
+This decision does not authorize App Store release, enterprise distribution,
+remote device management, background sensing, raw-data collection, safety
+actuation, medical use, identity inference, or an iPhone-only NLOS claim.
+
+### Success criteria
+
+1. At least 90 percent of recruited compatible-device testers complete the
+   guided path in under five minutes in a pilot of at least 20 participants.
+2. Median completion time is at most 180 seconds and p95 is at most 300 seconds.
+3. Every exported diagnostic is at most 64 KiB and contains zero forbidden raw
+   fields in automated and manual review.
+4. Permission denial and unsupported-device tests reach useful guidance in at
+   most two taps after the failure is detected.
+5. Zero releases are uploaded from pull request CI and zero long-lived release
+   credentials are stored in repository workflows.
+
+## Pseudocode and state transitions
+
+### State model
+
+```text
+NOT_INSTALLED
+  -> TESTFLIGHT_INSTALLED
+  -> CONSENT_REQUIRED
+  -> CAPABILITY_CHECK
+     -> UNSUPPORTED
+     -> PERMISSION_REQUIRED
+        -> PERMISSION_DENIED
+        -> CALIBRATING
+           -> CALIBRATION_FAILED
+           -> WALL_SCAN_READY
+              -> WALL_SCANNING
+                 -> SCAN_INTERRUPTED
+                 -> SUMMARY_READY
+                    -> DIAGNOSTIC_PREVIEW
+                       -> EXPORTED
+                       -> DISCARDED
+```
+
+`UNSUPPORTED`, `PERMISSION_DENIED`, `CALIBRATION_FAILED`, and
+`SCAN_INTERRUPTED` are explicit terminal states for the current attempt, but
+each offers a bounded retry or support path. A retry creates a new session ID
+and does not merge evidence across attempts.
+
+### Setup control flow
+
+```text
+on_first_launch:
+  show purpose, privacy boundary, evidence labels, and explainer link
+  require affirmative consent before requesting sensor permissions
+  transition CONSENT_REQUIRED -> CAPABILITY_CHECK
+
+check_capability:
+  inspect public runtime capability APIs
+  if scene depth unsupported:
+    label capability = unavailable
+    physical_nlos = blocked_raw_transients_unavailable
+    transition -> UNSUPPORTED
+  else:
+    transition -> PERMISSION_REQUIRED
+
+request_permission_just_in_time:
+  request camera permission for ARKit session only
+  request local-network permission only if external_live mode is selected
+  do not request precise location for the default beta workflow
+  if denied:
+    record only permission status and bounded reason code
+    transition -> PERMISSION_DENIED
+
+run_calibration:
+  start monotonic timer for 15 seconds
+  aggregate frame count, valid-depth ratio, pose deltas, interruption count
+  retain no frame payload after aggregate update
+  if minimum quality or continuity rule fails:
+    transition -> CALIBRATION_FAILED
+  else:
+    transition -> WALL_SCAN_READY
+
+run_wall_scan:
+  start monotonic timer for 30 seconds
+  aggregate the same bounded metrics plus thermal state samples
+  drop raw frame immediately after aggregate update
+  on app suspension or sensor interruption:
+    stop session, discard partial evidence, transition -> SCAN_INTERRUPTED
+  on completion:
+    label mode = direct_depth
+    label physical_nlos = blocked_raw_transients_unavailable
+    transition -> SUMMARY_READY
+
+build_diagnostic:
+  construct exact schema from allowlisted aggregates
+  reject unknown or forbidden keys recursively
+  canonicalize JSON and reject size > 65536 bytes
+  render preview before enabling share sheet
+  never upload automatically
+```
+
+### Invariants walked through
+
+Success case: a supported device grants camera permission, completes 15 seconds
+of calibration and 30 seconds of wall scanning, then exports a 20 KiB aggregate
+diagnostic. Every frame is reduced to counters before the next frame, the mode
+is `direct_depth`, and `physical_nlos` stays blocked. All invariants hold.
+
+Failure case: the app is backgrounded 12 seconds into the wall scan. Capture
+stops, partial scan evidence is discarded, state becomes `SCAN_INTERRUPTED`, and
+the diagnostic records only the reason and duration. It cannot label the test
+complete or silently switch to replay. All invariants still hold.
+
+## Architecture
+
+### Components and ownership
+
+| Component | Responsibility | Owner | Trust level |
+|---|---|---|---|
+| TestFlight | Signed beta distribution, invitations, expiry, updates | Apple plus release operator | External distribution boundary |
+| Setup coordinator | State machine, timers, retry, evidence label | iOS maintainers | App process |
+| Capability probe | Public API and device capability checks | iOS maintainers | Untrusted device/runtime inputs |
+| Aggregate collector | Streaming calculation with no frame retention | Sensing plus privacy owners | Sensitive ephemeral boundary |
+| Diagnostic builder | Exact allowlist, redaction, size limit, preview | Security plus support owners | Export boundary |
+| External track client | Optional authenticated RuView NLOS tracks | API plus security owners | Network trust boundary |
+| Feedback handoff | Opens explainer, issue, and system share UI | Product plus support owners | User-authorized external action |
+| Xcode Cloud | Recommended signed archive and TestFlight delivery | Release operator | Privileged release boundary |
+
+### Data lifecycle
+
+```text
+ARKit frame
+  -> in-memory aggregate update
+  -> immediate frame release
+  -> bounded session summary
+  -> local diagnostic preview
+  -> tester exports or discards
+```
+
+The default retention target is the current app session. If the tester chooses
+to save a diagnostic, the operating system share destination controls later
+retention. RuView does not upload it automatically. Any future support portal
+must define tenant, encryption, deletion, access logging, and retention in a
+separate accepted decision before accepting diagnostics.
+
+### Diagnostic schema contract
+
+The on-device encoder emits the exact camel-case object below, defined by
+`VisibleDepthDiagnostic` and
+`docs/schemas/ruview-ios-visible-depth-diagnostic-v1.schema.json`. Unknown keys
+cannot enter the strongly typed encoder and are rejected by schema consumers.
+
+```json
+{
+  "schema": "ruview.ios.visible-depth-diagnostic.v1",
+  "sessionId": "random UUID generated for this attempt",
+  "createdAt": "RFC 3339 UTC timestamp",
+  "deviceModelFamily": "coarse model family",
+  "osVersion": "public OS version",
+  "appVersion": "public app version and build",
+  "capabilities": {
+    "worldTracking": true,
+    "sceneDepth": true,
+    "smoothedSceneDepth": true,
+    "sceneMesh": true,
+    "rawPhotonHistograms": false
+  },
+  "phases": [{
+    "phase": "calibration",
+    "plannedDurationSeconds": 15,
+    "observedDurationSeconds": 14.98,
+    "frameCount": 450,
+    "averageFPS": 30.0,
+    "averageDepthCoverage": 0.91,
+    "averageMovementMetersPerSecond": 0.08,
+    "finalTrackingState": "normal",
+    "peakThermalState": "nominal"
+  }],
+  "consent": {
+    "localValidation": true,
+    "diagnosticExport": true,
+    "rawSensorExport": false
+  },
+  "evidenceLabel": "direct_depth",
+  "physicalNLOSStatus": "blocked_raw_transients_unavailable",
+  "cameraPermission": "granted",
+  "completionStatus": "completed"
+}
+```
+
+The optional `failureReason` is bounded to 240 characters and contains only a
+public user-facing reason. Allowed values and numeric ranges are versioned with
+the app. Free-form logs, stack traces, URLs, IP addresses, WiFi names, precise
+device identifiers, file paths, and user-entered notes are excluded. The
+canonical encoded document must remain at or below 65,536 bytes.
+
+### Trust boundaries and threats
+
+1. **Apple distribution boundary:** only the approved release operator can
+   select a reviewed archive for external testing. Branch code cannot grant
+   release authority.
+2. **Sensor boundary:** ARKit frames are sensitive and untrusted. Validate
+   dimensions, timestamps, finite numeric values, and continuity before
+   aggregation. Never persist raw buffers by default.
+3. **Network boundary:** external NLOS mode uses ATS, WSS, scoped short-lived
+   authorization, server identity validation, replay protection, tenant binding,
+   maximum message sizes, and immediate stale-track clearing.
+4. **Export boundary:** diagnostic preview and affirmative share action are
+   mandatory. The export contains no token, raw sensor payload, stable identity,
+   precise location, or person trajectory.
+5. **Claim boundary:** UI and diagnostics carry source provenance and evidence
+   level. A successful calibration cannot mutate `direct_depth` into NLOS.
+6. **Support boundary:** issue comments are public by default. The app warns the
+   tester not to post private scene details and offers aggregate JSON only.
+
+### Observability
+
+Local observability is privacy-minimized and bounded:
+
+1. state transition and elapsed duration;
+2. completion and failure code counts;
+3. aggregate frame rate, valid-depth ratio, pose stability, and interruptions;
+4. peak coarse thermal state;
+5. diagnostic encoded byte count and export/discard action; and
+6. application version, build number, and coarse OS/device capability.
+
+No remote analytics SDK is required for the beta. If aggregate fleet telemetry
+is later enabled, it requires separate consent, documented retention, tenant
+isolation, deletion controls, a data protection review, and a kill switch.
+
+## Release architecture
+
+### Pull request CI
+
+GitHub Actions uses an Xcode 26 compatible macOS runner, verifies the selected
+Xcode major version, runs Swift tests and an unsigned simulator build, and
+creates an unsigned generic iOS archive as a dry gate. The job uses
+`CODE_SIGNING_ALLOWED=NO`, does not export an IPA, does not upload an archive,
+and receives no signing or App Store Connect credentials.
+
+The archive proves that the reviewed project can reach the archive phase under
+the selected SDK. It does not prove signing, TestFlight processing, installation,
+camera permission behavior, LiDAR support, or NLOS sensing.
+
+### Signed beta delivery
+
+Use Xcode Cloud as the recommended privileged path for signed archive and
+TestFlight delivery because Apple hosts the signing and App Store Connect
+integration. The release workflow must:
+
+1. trigger from an approved protected branch or reviewed tag;
+2. rerun tests and archive with the declared Xcode version;
+3. require a human release decision before external distribution;
+4. attach the commit, build number, privacy manifest, test notes, and known
+   capability limits; and
+5. keep `physical_nlos` blocked unless separate live evidence is approved.
+
+An equivalent manually operated Xcode Organizer path is acceptable for an
+initial pilot, but CI must never contain reusable signing certificates or
+automatic pull-request uploads.
+
+### Rollback
+
+Rollback is capability-first:
+
+1. Disable external tester availability for the affected TestFlight build.
+2. Publish a corrected build with a higher build number when safe.
+3. Remotely disable external track mode only through an already reviewed,
+   authenticated configuration path; otherwise fail closed locally.
+4. Preserve direct-depth and replay features only if the fault is isolated and
+   their evidence labels remain correct.
+5. Revoke pairing tokens and service sessions for transport incidents.
+6. Notify testers of affected versions, data exposure scope, remediation, and
+   diagnostic deletion instructions.
+
+If raw data is observed in any diagnostic, stop distribution immediately,
+disable export, treat the file as a privacy incident, and require security and
+privacy review before another build.
+
+## Alternatives considered
+
+| Alternative | Tester friction | Release risk | Privacy/security | Decision |
+|---|---:|---:|---:|---|
+| TestFlight plus in-app setup | About 2 to 5 minutes | Low to medium | Strong Apple signing boundary; bounded diagnostics | Selected |
+| Ad hoc IPA distribution | 10 to 30 minutes plus device registration | High | Certificate and device-list custody | Rejected |
+| Enterprise-signed public beta | Low initially | Critical | Misuses enterprise trust and broadens revocation blast radius | Rejected |
+| Xcode source build by testers | 30 to 90 minutes | Medium | Exposes developer workflow and excludes nontechnical users | Developer fallback only |
+| Web app only | Under 2 minutes | Low | Cannot directly access the required ARKit depth surface | Companion explainer/view only |
+| Custom diagnostic upload service | About 1 minute | Medium to high | Creates a new personal-data trust boundary | Deferred pending separate governance |
+
+TestFlight wins because it removes local signing and update complexity while
+keeping release authority outside pull request CI. Its main cost is Apple beta
+review and processing latency, which should be measured per build rather than
+promised. Xcode Cloud is preferred over credential-bearing GitHub upload jobs;
+the operational cost is an additional Apple-hosted workflow and usage budget.
+
+## Refinement and failure handling
+
+Deliver in reversible increments:
+
+1. Add the local setup state machine and synthetic tests with capture disabled.
+2. Add capability and permission checks with negative-path UI tests.
+3. Add streaming aggregate collectors and prove raw buffers are not serialized.
+4. Add diagnostic allowlist, forbidden-key scan, 64 KiB gate, and preview.
+5. Run a physical direct-depth pilot on named devices and record evidence.
+6. Configure Xcode Cloud and TestFlight only after privacy and release review.
+7. Recruit external testers after internal completion time and failure recovery
+   meet the protocol.
+
+Retries are manual and bounded to three attempts per session screen. Network
+reconnect uses capped exponential backoff and never preserves a live label
+across authentication, freshness, or tenant failure. Calibration and wall scan
+do not auto-retry after interruption because combining partial runs makes the
+quality result ambiguous.
+
+## Consequences
+
+### Positive
+
+1. Nontechnical testers can install and update without Xcode.
+2. Support receives small, structured, comparable diagnostics instead of raw
+   scenes or unbounded logs.
+3. Release, software, device, and research evidence remain distinct.
+4. The setup flow teaches the Apple API limitation before a tester can mistake
+   direct depth for around-the-corner reconstruction.
+
+### Costs and limitations
+
+1. Xcode Cloud and TestFlight add Apple processing, beta review, and operational
+   coordination. Budget and latency vary by account and must be measured.
+2. A 64 KiB aggregate diagnostic is safer but may omit rare low-level failures;
+   maintainers reproduce those through an explicitly approved development build.
+3. The five minute target requires physical usability testing, not CI.
+4. The largest uncertainty remains access to raw iPhone LiDAR transients. The
+   fix path is to validate external histogram-capable hardware independently and
+   keep the iPhone as a direct-depth, pose, transport, and presentation adapter.
+
+## Requirement-to-evidence mapping
+
+| ID | Requirement | Evidence | Promotion rule |
+|---|---|---|---|
+| NLOS-341-01 | TestFlight distributes; setup begins after install | release runbook review plus TestFlight install witness | Human release approval required |
+| NLOS-341-02 | Full setup under 5 minutes | at least 20 physical-device tester timing records; median at most 180 s, p95 at most 300 s | Cannot be inferred from simulator |
+| NLOS-341-03 | Calibration lasts 15 seconds | monotonic timer unit test plus physical run record | 14.5 to 16.5 s allowed for scheduling |
+| NLOS-341-04 | Wall scan lasts 30 seconds | monotonic timer unit test plus physical run record | 29.5 to 32.0 s allowed for scheduling |
+| NLOS-341-05 | No raw capture in diagnostic | serializer allowlist tests, forbidden-key fixtures, manual sample review | Any violation stops distribution |
+| NLOS-341-06 | Diagnostic at most 64 KiB | boundary tests at 65,536 and 65,537 bytes plus CI fixture validation | Oversized document cannot export |
+| NLOS-341-07 | NLOS claim blocked without raw transients | capability state tests plus diagnostic assertion | Must remain blocked until ADR-330 and ADR-331 gates pass |
+| NLOS-341-08 | Permission and interruption failures degrade honestly | state-machine negative tests and physical background/denial runs | No live or completed label after failure |
+| NLOS-341-09 | Pull request CI consumes no release credentials | workflow permission and secret-reference audit | Unsigned dry archive only |
+| NLOS-341-10 | Xcode 26 toolchain is explicit | CI runner and `xcodebuild -version` major-version assertion | Tool mismatch fails before build |
+| NLOS-341-11 | Tester controls diagnostic disclosure | preview and share/discard UI test plus usability observation | No automatic upload |
+| NLOS-341-12 | Rollback is operable | internal TestFlight removal exercise and token-revocation drill | Record owner, time, and outcome |
+
+## Acceptance test
+
+A nontechnical tester installs the approved TestFlight build, reads the evidence
+boundary, grants only the required permission, completes a measured 15 second
+calibration and 30 second wall scan, sees `direct_depth` with physical NLOS
+blocked, previews an aggregate diagnostic smaller than 64 KiB, opens the
+explainer, and chooses whether to share or discard the diagnostic. Total elapsed
+time must be under five minutes, and packet inspection plus diagnostic review
+must find no raw camera, depth, point-cloud, CSI, transient, token, location, or
+person-trajectory payload.
+
+## References
+
+1. Apple, [TestFlight overview](https://developer.apple.com/testflight/).
+2. Apple, [Invite external testers](https://developer.apple.com/help/app-store-connect/test-a-beta-version/invite-external-testers/).
+3. Apple, [Distribute builds using Xcode Cloud](https://developer.apple.com/documentation/xcode/distributing-your-app-for-beta-testing-and-releases).
+4. Apple, [ARFrame scene depth](https://developer.apple.com/documentation/arkit/arframe/scenedepth).
+5. Somasundaram et al., [consumer NLOS measurement model](https://arxiv.org/html/2605.17865v1).
+6. GitHub, [GitHub-hosted runner images and macOS 26 labels](https://github.com/actions/runner-images).
@@ -108,6 +108,8 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-115](ADR-115-home-assistant-integration.md) | Home Assistant integration via MQTT auto-discovery + Matter bridge (HA-DISCO + HA-FABRIC + HA-MIND) | Accepted (MQTT track) / Proposed (Matter SDK P8b) |
 | [ADR-169](ADR-169-adam-mode-light-theme.md) | adam-mode — light theme toggle for the three.js realtime demo | Proposed |
 | [ADR-170](ADR-170-yoga-mode-pose-system.md) | yoga-mode — yoga pose detection, classification, and scoring for the three.js realtime demo | Proposed |
+| [ADR-324](ADR-324-off-axis-head-coupled-perspective-demo.md) | off-axis-mode — RF-assisted head-coupled perspective demo (clean-room Kooima projection; RF presence gating) | Proposed |
+| [ADR-341](ADR-341-consumer-nlos-beta-tester-delivery-and-diagnostics.md) | Consumer NLOS beta delivery via TestFlight, post-install setup, and privacy-bounded diagnostics | Proposed |

 ### Architecture and infrastructure

@@ -179,6 +181,7 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-319](ADR-319-witness-chain.md) | Witness chain — staged, signed epistemic envelope | Accepted (phase 1) |
 | [ADR-320](ADR-320-sensor-hal.md) | RuView sensor HAL — abstract all sensing hardware to one Observation type | Proposed (phase 2) |
 | [ADR-321](ADR-321-decision-policy-action-authorization.md) | Decision policy — action authorization conditioned on certificate class, freshness, uncertainty, evidence | Accepted (phase 1) |
+| [ADR-323](ADR-323-native-rust-physics-constrained-pose-refinement.md) | Native Rust physics-constrained pose refinement | Proposed |

 ---

@@ -0,0 +1,71 @@
+# Physics pose refinement evidence ledger
+
+ADR-323 performance and accuracy targets are gates, not measured claims. Append
+rows; never replace prior measurements. Every row must identify the repository
+commit, lockfile hash, Rust toolchain, target, engine/features, configuration
+hash, corpus/split hash, command, sample count, and evidence label.
+
+## Runtime measurements
+
+| Date | Commit | Lock SHA-256 | Target/toolchain | Engine/config | Tracks | Samples | p50 | p95 | p99/max | RSS delta | Evidence | Reproducer |
+|---|---|---|---|---|---:|---:|---:|---:|---:|---:|---|---|
+| 2026-08-15 | `de27336` + uncommitted ADR-323 changes | `552737eab9092b59ea9dd2b2caf68389f0b0966679f0fbb33ff2b1b3d42e2668` | Windows x86_64, Intel Core Ultra 9 285H, rustc 1.91.1 | deterministic kinematic shadow, config `ef3cf581f75124c1d45a8d6bedcef32e4d1bacb39ee0dfcd4e520171fda2d8cf` | 1 | 20,000 | 0.0080 ms | 0.0097 ms | 0.0195/0.5465 ms | not measured | **MEASURED**, local host only; not Pi 5 evidence | `cargo run --release -p wifi-densepose-physics --example latency_probe -- 20000` |
+| 2026-08-15 | `de27336` + uncommitted ADR-323 changes | `552737eab9092b59ea9dd2b2caf68389f0b0966679f0fbb33ff2b1b3d42e2668` | Windows x86_64, Intel Core Ultra 9 285H, rustc 1.91.1 | deterministic kinematic shadow after final local optimization, same config | 1 | 20,000 | 0.0075 ms | 0.0084 ms | 0.0117/0.1579 ms | not measured | **MEASURED**, local host only; not Pi 5 evidence | same release probe command |
+| 2026-08-15 | `de27336` + uncommitted ADR-323 changes | `552737eab9092b59ea9dd2b2caf68389f0b0966679f0fbb33ff2b1b3d42e2668` | Windows x86_64, Intel Core Ultra 9 285H, rustc 1.91.1 | final deterministic kinematic shadow, config `a44dc696234f31eda54cd4b436bc2d2c69b9638565b729ac9f07435cedfd0dcc` | 1 | 20,000 | 0.0071 ms | 0.0084 ms | 0.0147/1.5994 ms | not measured | **MEASURED**, local host only; not Pi 5 evidence | same release probe command |
+
+The probe measures a warm, one-track `PhysicsEngine::process` call. It excludes
+transport, publication, resident-memory delta, dynamics, and learned inference.
+It is not evidence for the Pi 5 gate.
+
+Criterion separately measured `kinematic_one_track` at
+`[11.911, 12.757, 14.069] us` across 100 samples (approximately 369,000 timed
+iterations). That benchmark includes observation construction and canonical
+hashing in the timed routine and uses fresh engine state; it is **MEASURED** on
+the same local host and is not a percentile or Pi 5 claim.
+
+## Accuracy measurements
+
+| Date | Commit | Corpus/split | Variant | Coverage | MPJPE | PCK threshold/result | Foot slide | Jerk | Fall/prone delta | Evidence |
+|---|---|---|---|---:|---:|---|---:|---:|---:|---|
+
+No measured accuracy evidence has been recorded. The deterministic tests are
+L0/SYNTHETIC contract evidence only and cannot satisfy G2.
+
+## Validation and supply-chain record
+
+- The default dependency graph is checked to exclude Burn, Rapier, Tch, and
+  ONNX Runtime. Dynamics and learned backends remain opt-in.
+- Burn CPU serialization/inference tests pass on the authoring host only with
+  Cargo's `--ignore-rust-version`; the resolved CubeCL graph requires Rust 1.92.
+  The workspace file pins Rust 1.89 and the host provides Rust 1.91.1. This is
+  diagnostic, not release approval.
+- `cargo audit 0.22.1` used RustSec database commit
+  `69f93cf294852cfa9b53751f4ca86de3283dd290` (feed timestamp 2026-08-12).
+  ADR-323 updates remove resolved advisories in `event-listener`, `rkyv`, and
+  `wasmtime`. The workspace still has five advisories in pre-existing
+  `quick-xml` and `rsa` dependency paths; the default physics graph contains
+  none of them. The optional Burn training graph includes yanked `spin 0.9.8`.
+- `cargo-deny` is not installed on the authoring host, so the required license
+  and policy gate is not claimed complete.
+- Strict Clippy passes with warnings denied for core/physics default and
+  dynamics builds, the diagnostic learned-CPU build, and the Cog itself with
+  dependency linting excluded. Focused core, physics, dynamics, learned, Cog,
+  sensing-server adapter/live-audit/HTTP, schema, golden, strict-split,
+  feature-boundary, and fuzz-build checks pass.
+- The repository-wide rustfmt gate is already red across unrelated crates. The
+  sensing-server library has existing warning debt, and unscoped Cog Clippy is
+  blocked by existing `wifi-densepose-ruvector` warnings. The prescribed
+  `cargo test --workspace --no-default-features` did not reach a terminal result
+  in either a 904-second cold or 604-second warm serial run on this Windows
+  host. None of these broader gates is represented as green.
+- The standalone fuzz lock SHA-256 is
+  `d386c4edb130bb6b2d1a4ef77334c78e25e0695e90a9d97c01284876acb8c2c6`.
+
+## Required commands
+
+```text
+cargo bench -p wifi-densepose-physics
+node scripts/pose-physics/verify-feature-boundary.mjs
+bash scripts/verify-pose-physics-splits.sh <manifest.json>
+bash scripts/replay-pose-physics-golden.sh <golden-results.jsonl>
+```
@@ -5,10 +5,15 @@ PCK@20 (MultiFormer Table VII metric: `‖pred−gt‖ ≤ 0.2·‖R-shoulder

 The flagship [`ruvnet/wifi-densepose-mmfi-pose`](https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose)
 reaches **83.59%** torso-PCK@20 (vs MultiFormer 72.25%, CSI2Pose 68.41%). But the headline number
-isn't the whole story for **edge deployment** — on a Raspberry Pi / ESP32-class target, *params and
+isn't the whole story for **edge deployment** — on a Raspberry Pi-class edge host, *params and
 latency* matter as much as accuracy. So we swept model size to map the **accuracy-per-parameter
 frontier**: how small can a WiFi-CSI pose model be and still beat the prior published SOTA?

+> **Hardware compatibility boundary.** These models consume MM-Fi tensors shaped
+> `[3,114,10]`. Parameter size alone does not make that input, model architecture, or runtime
+> compatible with an ESP32-S3/C6 capture node. The measurements below are dataset and x86/GPU
+> measurements; no ESP32 inference latency or live ESP32-to-MM-Fi adapter is claimed.
+
 ## The frontier

 | Model | Params | Latency (batch=1) | torso-PCK@20 | vs SOTA (72.25%) |
@@ -38,8 +43,10 @@ Size alone isn't the claim — what matters is **accuracy at the deployed precis

 **The honest edge result:** `micro` is **lossless at int8 (73.5 KB, 74.70%)**, and at **int4 (36.7 KB)
 naïve post-training quantization falls below SOTA (70.21%) — but quantization-aware training fully
-recovers it to 74.46%**, still beating MultiFormer. So a **SOTA-beating WiFi-pose model genuinely runs
-in ~37 KB int4** (with QAT) or **~73 KB int8** (no retraining) — deployable on the sensing node itself.
+recovers it to 74.46%**, still beating MultiFormer. So a **SOTA-beating WiFi-pose model fits in
+~37 KB int4** (with QAT) or **~73 KB int8** (no retraining). That is a model-footprint result, not
+evidence that it runs on an ESP32 sensing node; a compatible capture adapter and embedded runtime
+still need to be implemented and measured.
 `nano` (40K params) sits at the SOTA line in fp32 and is best treated as int8.

 (We also tested flagship→tiny **knowledge distillation**: it did *not* help — the tiny students reach
@@ -0,0 +1,545 @@
+# Preregistered RuView consumer NLOS reproduction and CSI-fusion protocol
+
+**Protocol ID:** `ruview-consumer-nlos-v1`
+**Status:** Template to freeze before the first scored capture
+**Governed by:** ADR-328, ADR-329, ADR-330, ADR-331
+**Primary claim scope:** controlled, identity-free tracking of a known hidden
+rigid target using an externally enrolled, histogram-capable ST transient sensor
+whose exact silicon/firmware/API are recorded; not built-in iPhone
+NLOS, through-wall optical sensing, unrestricted people tracking, or safety use
+
+## 1. Research question and decision rule
+
+This protocol answers two ordered questions:
+
+1. Can the pinned consumer-NLOS baseline track a hidden target from live
+   commodity transient LiDAR at roughly 30 frames per second?
+2. After that is established, does independently captured RuView CSI improve
+   target-position error or lost-track rate by enough to justify fusion?
+
+The program passes only when all provenance/privacy/security gates pass and:
+
+1. the LiDAR-only arm emits at least **27 accepted end-to-end track updates per
+   second** on live hardware; and
+2. over at least **100 paired live sequences**, the fused arm reduces either
+   mean target-position error or lost-track rate by **at least 25 percent**
+   relative to LiDAR-only, with its adjusted interval excluding zero and all
+   frozen guardrails passing. Fused update rate remains a reported guardrail,
+   not an added substitute for the requested improvement endpoint.
+
+`SYNTHETIC`, simulator, generated, duplicated, or captured replay frames cannot
+pass. They may be used for software QA and pilot power planning only. A build,
+UI frame rate, configured sensor frequency, or upstream paper result is not the
+measured endpoint.
+
+## 2. Hypotheses
+
+### H1: live reproduction
+
+For the primary controlled stratum, the LiDAR-only pipeline's accepted
+sensor-to-track update rate is at least 27 Hz. Failure stops confirmatory fusion
+interpretation. Diagnostics may continue but are labeled exploratory.
+
+### H2a: position-error improvement
+
+\[
+G_e = \frac{\bar E_L - \bar E_F}{\bar E_L} \ge 0.25,
+\]
+
+where \(\bar E_L\) and \(\bar E_F\) are sequence-weighted mean Euclidean target
+position errors for LiDAR-only and fused arms, using an external ground-truth
+coordinate frame.
+
+### H2b: lost-track improvement
+
+\[
+G_\ell = \frac{\ell_L - \ell_F}{\ell_L} \ge 0.25,
+\]
+
+where \(\ell\) is the fraction of evaluable time that satisfies the frozen
+lost-track definition.
+
+Fusion succeeds if H2a **or** H2b meets its magnitude and multiplicity-adjusted
+uncertainty gate. Both metrics and all guardrails are reported. A zero baseline
+denominator cannot establish gain.
+
+## 3. Roles and separation of duties
+
+| Role | Responsibility | Must not do |
+|---|---|---|
+| Protocol owner | freeze protocol, strata, splits and decision rule | inspect sealed confirmatory results before freeze |
+| Capture operator | approved setup, consent, identity/calibration, run manifest | tune model/thresholds during scored capture |
+| Ground-truth owner | independent system, clock/transform checks, sealed labels | feed labels into online LiDAR or fusion arms |
+| Model owner | freeze upstream/Rust/CSI/fusion artifacts | alter artifacts after test partition opens |
+| Analyst | run committed reproducer and report all endpoints/strata | delete trials or change exclusions post hoc |
+| Security/privacy reviewer | approve collection, access, retention, threats | waive live provenance or identity/actuation boundaries |
+| Witness reviewer | verify digests, randomization, exclusions and analysis | equate acceptance JSON arithmetic with physical audit |
+
+One person may hold multiple roles in a pilot, but protocol/model ownership and
+ground-truth/confirmatory analysis should be independently reviewed.
+
+## 4. Hardware and software freeze
+
+Complete and sign this table before scored capture:
+
+| Item | Frozen value |
+|---|---|
+| ST kit and sensor | VL53L8CH silicon read from hardware; raw/CNH API compatibility witnessed; scoped enrollment/certificate reference stored in the restricted manifest rather than a guessable raw-serial hash |
+| Firmware | source/release, compiler/toolchain, binary SHA-256 |
+| Sensor configuration | zones, bins, bin width, requested rate, integration/subsampling, ambient settings |
+| Upstream baseline | `sidsoma/consumer-nlos` commit `15314de422a765a2d1b72ea7037dfafb2f908d7c` and clean/patch manifest |
+| RuView | full Git commit SHA; `ruview-nlos` crate feature/config digest |
+| CSI nodes | authenticated IDs, hardware/firmware, channel/bandwidth/subcarrier configuration |
+| Optical calibration | wall points/plane, direct-return masks/peaks, background, timestamps, SHA-256, expiry |
+| RF calibration | room/link fingerprint, coordinate transform, timestamp, SHA-256, expiry/OOD threshold |
+| Ground truth | device/camera/tag firmware/software, calibration digest and measured clock uncertainty |
+| Models | canonical target response, particle count/motion prior/score, CSI model, fusion weights and digests |
+| Hosts | CPU/GPU/RAM/OS, power mode, process priority, compiler/runtime versions |
+| Analysis | script/lockfile/container digest, bootstrap seed list and report template |
+
+Changing any frozen item starts a new protocol version or invalidates the
+affected block. No silent patch is permitted.
+
+## 5. Physical setup and primary stratum
+
+### 5.1 Geometry
+
+1. Mount the transient sensor so a matte, light-colored planar relay surface
+   fills its field of view.
+2. Place an opaque occluder so no sensor zone, phone camera, or operator-facing
+   optical path directly sees the scored target. Record a setup photograph/mesh
+   for review; do not publish participant imagery by default.
+3. Start with the upstream-friendly geometry: sensor-to-wall less than 1 m and
+   wall-to-target approximately 1 to 1.5 m, then record exact distances.
+4. Define a right-handed world coordinate frame, units in metres, transform
+   chain, uncertainties, and a hidden-region boundary before capture.
+5. Place CSI nodes/APs in a fixed documented configuration. Confirm CSI is not
+   derived from the LiDAR, target-control signal, or ground-truth system.
+
+### 5.2 Primary target
+
+The confirmatory reproduction target is a known rigid approximately 25 cm
+retroreflective patch or the exact upstream canonical target. The target shape
+and response are frozen before the confirmatory split. This supports a scoped
+known-shape tracking claim only.
+
+Diffuse rigid objects, hands/people, multiple objects, other sizes, longer
+ranges, sunlight, non-planar relay surfaces and moving sensors are separate
+exploratory or later confirmatory strata. Never pool them to imply generalized
+human/scene reconstruction.
+
+### 5.3 Ground truth
+
+Use an independent externally calibrated system, for example an overhead camera
+with a rigid AprilTag/active marker or a surveyed motion stage. The system must
+observe the target while remaining unavailable to the online algorithms. Measure
+spatial transform error and clock offset/jitter before and after each block.
+
+Ground-truth labels remain sealed until capture and all three online arms are frozen.
+A label interpolated beyond the frozen maximum gap makes that time point
+unevaluable; it is not imputed from the NLOS output.
+
+## 6. Calibration and negative controls
+
+For every block:
+
+1. enroll/verify sensor and CSI identities;
+2. fit the relay wall and verify per-zone direct-return distance against a
+   physical measurement;
+3. capture the frozen-duration empty-scene optical background with no person or
+   target in the hidden region;
+4. capture RF empty-room calibration under the approved protocol;
+5. verify clocks, transform chain and calibration digests;
+6. run an empty hidden-region negative sequence;
+7. run a direct-line-of-sight exclusion check with the occluder; and
+8. mark calibration `VALID` only after all bounds pass.
+
+Negative controls include sensor disconnected, CSI disconnected, stale/replayed
+frame injection in a non-scored software run, target absent, static distractor,
+and calibration mismatch. The live confirmatory stream contains no injected
+synthetic/replay frames.
+
+## 7. Trial unit, sample size and randomization
+
+### 7.1 Paired sequence
+
+A paired sequence is one continuous, live, preregistered target trajectory whose
+accepted transient-histogram and CSI frames are delivered simultaneously to frozen
+online arms:
+
+1. **L:** LiDAR-only MAS tracker; CSI is unavailable to every decision in this
+   arm; and
+2. **C:** CSI-only ablation, reported to establish independent RF information;
+   it need not satisfy a centimetre-localization promotion threshold; and
+3. **F:** the same optical inputs and initialization plus the frozen calibrated
+   CSI likelihood.
+
+All three arms use the same synchronized live interval; L/F share the offered
+optical fan-out and C/F share the offered CSI fan-out. They do not take turns on
+different captures. One-arm drops remain outcomes, not exclusions. If resource contention is material, run them
+on matched isolated hosts fed by the authenticated live fan-out and record fan-
+out latency/drop parity. Replaying a recording later does not satisfy the live
+gate.
+
+### 7.2 Minimum and power
+
+Capture at least 100 valid paired sequences in the primary stratum. Before
+confirmatory capture, use a disjoint pilot or synthetic/replay data to estimate
+cluster variance and document power for detecting a 25 percent gain at family-
+wise alpha 0.05. If the calculated requirement exceeds 100, use the larger
+number. Pilot sequences, rooms and target paths do not enter confirmatory
+metrics.
+
+Each sequence duration, initialization window and trajectory family is frozen.
+Include translation directions, speeds and positions across the hidden volume,
+not 100 copies of one favorable path. Randomize trajectory order and block order
+with a committed seed. Counterbalance any host assignment.
+
+### 7.3 Grouping and splits
+
+Calibration/training, pilot and confirmatory partitions are grouped by capture
+session, time block, path family, target instance, room and sensor configuration.
+Adjacent frames from one sequence cannot cross partitions. If a learned CSI
+model uses LiDAR supervision, no optical target/embedding from the confirmatory
+partition is used for training, thresholding, normalization or early stopping.
+
+## 8. Online quality and exclusion rules
+
+Freeze numeric values for each placeholder before capture:
+
+| Rule | Frozen value |
+|---|---|
+| Valid calibration age and OOD bounds | `<fill before capture>` |
+| Maximum optical/CSI/ground-truth clock uncertainty | `<fill>` ms |
+| Maximum optical-to-CSI pairing skew | `<fill>` ms |
+| Maximum ground-truth interpolation gap | `<fill>` ms |
+| Track association radius | `<fill>` m |
+| Lost-track consecutive interval | `<fill>` frames or ms |
+| Posterior quality/entropy/effective-particle threshold | `<fill>` |
+| Saturation/underexposure and minimum valid zones | `<fill>` |
+| Maximum sequence frame-loss fraction | `<fill>` |
+| Warmup/initialization exclusion | `<fill>` frames, applied to all three arms |
+
+Pre-capture exclusions only:
+
+1. consent/safety/indicator failure;
+2. sensor/CSI/ground-truth identity or clock failure;
+3. calibration invalid before sequence start;
+4. direct line of sight or physical setup outside tolerance;
+5. target controller/ground truth did not execute the randomized trajectory;
+6. raw capture corruption affecting all affected arms; or
+7. host failure prevents paired operation.
+
+Algorithm failure, low signal, lost track, high error, drift, overload, one-arm
+drop, poor target position, unfavorable reflectivity or unexpected but in-scope
+motion are outcomes, not exclusions. Report all excluded sequences with reason
+and arm-independent timing.
+
+## 9. Endpoint definitions
+
+### 9.1 Accepted update rate
+
+For each sequence and arm, use the entire frozen evaluable wall-time window:
+
+\[
+f = \frac{N_{valid,new}}{T_{evaluable}},
+\]
+
+where `valid,new` means a newly computed, schema-valid, calibrated, fresh track
+from a unique live sensor frame after the symmetric warmup. Duplicates, replay,
+late/stale frames, renderer frames and cached outputs do not count. Report
+the accepted sensor-frame count as well and require track updates not to exceed
+it. If an implementation instead uses first-to-last span, its estimator is
+`(N-1)/(t_last-t_first)`, not `N/span`. Report sequence distribution and overall accepted updates divided by evaluable wall
+time. H1 and the fused performance guard use the lower preregistered aggregate
+definition, not the maximum instantaneous rate.
+
+### 9.2 Position error
+
+At each evaluable matched timestamp:
+
+\[
+e_{a,t}=\|\hat p_{a,t}-p^{GT}_t\|_2.
+\]
+
+Compute a mean within each sequence first, then the equally weighted mean across
+sequences so long sequences do not dominate. Report median, p95 and axis-wise
+error as secondary metrics. Invalid/missing intervals contribute to lost-track
+rate and cannot simply disappear from the report. For the confirmatory position
+endpoint, every paired sequence receives a score in both arms. A sequence with
+no valid position receives the preregistered worst-case/censoring penalty; it is
+not dropped. Consequently each arm's `position_error_sample_count` must equal
+`paired_sequences`, and the shared scoring-mask/penalty rules are bound by
+`endpoint_pairing_sha256`.
+
+### 9.3 Lost-track rate
+
+A track is lost when the arm has no `VALID` matched hypothesis within the frozen
+association radius for at least the frozen consecutive interval after warmup.
+Lost-track rate is lost evaluable time divided by total evaluable time. Report
+number/duration of episodes and reacquisition time. Track-ID changes without
+position loss are reported separately.
+
+### 9.4 Empty-region false tracks and safety guardrails
+
+Report confident-track time and event count during preregistered empty-region
+sequences. Also report p95 latency, frame loss, calibration/OOD rejection and
+non-winning primary metric. A fusion gain accompanied by materially worse empty-
+region false tracks, severe latency/update-rate loss, provenance failure or a
+privacy/security failure is not promoted even if the 25 percent arithmetic
+passes. `offered_optical_frame_count` is the number of eligible optical frames
+offered to both paired arms. Its rate is recomputed against the shared
+LiDAR/fused evaluable duration and cannot exceed `sensor_configured_max_hz`.
+Fused frame loss is recomputed as
+`(offered_optical_frame_count - fused.accepted_sensor_frame_count) /
+offered_optical_frame_count`; a supplied rate that differs fails closed.
+
+## 10. Statistical analysis
+
+1. Calculate paired per-sequence deltas and relative gains. Do not treat frames
+   within a sequence as independent samples.
+2. Use a paired cluster bootstrap over sequences with at least 10,000 resamples
+   and committed seeds. Report point estimate and two-sided interval for every
+   metric.
+3. Because H2a/H2b are alternative success endpoints, control family-wise error
+   with Bonferroni-adjusted 97.5 percent confidence intervals or a frozen
+   equivalent procedure. The successful endpoint needs point gain at least 25
+   percent and its adjusted interval must exclude zero improvement.
+4. Report all primary/secondary/stratified results, exclusions and missingness.
+   No optional stopping; capture count is frozen by power/minimum before the
+   confirmatory set opens.
+5. Sensitivity analyses vary the frozen association/lost-track thresholds only
+   as clearly labeled exploratory analysis after the primary result.
+
+If only one endpoint passes, state exactly which one. Do not summarize it as
+“25 percent more accurate” when the passing endpoint was lost-track rate.
+
+## 11. Execution sequence
+
+### Gate A: software before participants/live capture
+
+1. Run the NLOS Rust unit/property/golden tests and workspace gate.
+2. Run Swift core tests and macOS iOS simulator build where available.
+3. Run mobile web tests, typecheck, lint and web export.
+4. Run harness tests/security/brain/flywheel/manifest/package gates.
+5. Run secret/raw-data/dependency/license scans and close confirmed high/critical
+   findings.
+6. Exercise deterministic `SYNTHETIC` replay, stale/disconnect/oversize/replay
+   rejection and empty fixture. Label all outputs software/L0.
+
+Convenience check:
+
+```bash
+cd harness/ruview
+node bin/cli.js nlos verify --repo ../.. --run-builds
+```
+
+This reports only the available build/discovery subset, with explicit skips. It
+cannot pass full Gate A, Gate B, or a release gate by itself; steps 1–6 remain
+required.
+
+### Gate B: upstream live reproduction
+
+1. Freeze/sign protocol, privacy approval, identities, software/hardware table,
+   randomization and analysis container.
+2. Inspect geometry and direct-line-of-sight exclusion.
+3. Calibrate optical/RF/ground truth and run negative control.
+4. Execute live primary-stratum sequences with LiDAR-only online output and
+   ground-truth labels sealed.
+5. Verify accepted end-to-end update rate >=27 Hz and report tracking/error/
+   empty-region diagnostics.
+6. If Gate B fails, stop confirmatory fusion interpretation; fix path under a
+   new protocol version.
+
+### Gate C: paired live fusion
+
+1. Freeze the CSI likelihood, fusion weights, arm fan-out and host assignment.
+2. Execute at least the powered minimum of paired randomized live sequences.
+3. Open ground truth once capture/artifacts/exclusions are immutable.
+4. Run the committed analysis, bootstrap and stratified report.
+5. Retain fusion only if update-rate, 25 percent endpoint, provenance,
+   privacy/security and guardrail review pass.
+
+### Gate D: Apple/iOS claim
+
+Native/web software may ship as external-track clients after Gate A. A claim that
+built-in Apple LiDAR performs transient NLOS needs a separate adapter ADR,
+documented public histogram API, physical-device capture, privacy/App Store
+review and fresh Gates B/C. ARKit scene depth alone cannot enter Gate B.
+
+## 12. Required artifacts
+
+| Artifact | Contains | Excludes |
+|---|---|---|
+| Frozen protocol | signed/versioned text, hypotheses, thresholds, seeds | post-result edits |
+| Capture manifest | content digests, identities, configurations, timing, strata, exclusions | raw credentials/private keys |
+| Raw store | encrypted transients/CSI/ground truth under access/retention policy | Git/package/harness inclusion |
+| Split manifest | grouped calibration/pilot/confirmatory IDs and hash | participant identity in public artifact |
+| Analysis reproducer | locked dependencies, script, seeds, exact tables/plots | manual spreadsheet-only results |
+| Security/privacy record | approvals, threat verification, retention/deletion | blanket “camera-free is safe” claim |
+| Acceptance JSON | bounded aggregate fields and SHA-256 references | raw trajectories/sensor data/tokens |
+| Witness report | reviewer checks and exact evidence level | higher-level field/production implication |
+
+## 13. Acceptance JSON
+
+The repository-contained record consumed by `ruview nlos verify` has this exact
+top-level and per-arm key set. Unknown fields are rejected; values below are
+placeholders, not results:
+
+```json
+{
+  "schema": "ruview.nlos.acceptance.v1",
+  "source": "LIVE_HARDWARE",
+  "claim_tag": "MEASURED",
+  "evidence_level": "L2",
+  "ground_truth": "EXTERNAL",
+  "protocol_frozen_before_capture": true,
+  "witness_reviewed": true,
+  "privacy_review_passed": true,
+  "security_review_passed": true,
+  "los_exclusion_verified": true,
+  "independent_csi_verified": true,
+  "sensor_model": "VL53L8CH",
+  "transient_kind": "COMPACT_NORMALIZED_HISTOGRAM",
+  "sensor_configured_max_hz": "<frozen-number>",
+  "upstream_commit": "15314de422a765a2d1b72ea7037dfafb2f908d7c",
+  "protocol_sha256": "<nonzero-64-hex>",
+  "capture_manifest_sha256": "<nonzero-64-hex>",
+  "sensor_identity_sha256": "<nonzero-64-hex-scoped-enrollment-reference>",
+  "calibration_sha256": "<nonzero-64-hex>",
+  "firmware_sha256": "<nonzero-64-hex>",
+  "analysis_sha256": "<nonzero-64-hex>",
+  "endpoint_pairing_sha256": "<nonzero-64-hex-shared-position/lost-track-evaluable-mask-manifest>",
+  "sensor_configuration_sha256": "<nonzero-64-hex>",
+  "witness_report_sha256": "<nonzero-64-hex>",
+  "privacy_review_sha256": "<nonzero-64-hex>",
+  "security_review_sha256": "<nonzero-64-hex>",
+  "guardrail_report_sha256": "<nonzero-64-hex>",
+  "csi_capture_manifest_sha256": "<nonzero-64-hex>",
+  "csi_sensor_identity_sha256": "<nonzero-64-hex-scoped-enrollment-reference>",
+  "csi_calibration_sha256": "<nonzero-64-hex>",
+  "synthetic_frames": 0,
+  "replay_frames": 0,
+  "paired_sequences": "<integer-at-least-100>",
+  "csi_source_count": "<positive-integer>",
+  "offered_optical_frame_count": "<positive-integer>",
+  "lidar_only": {
+    "sequence_count": "<equals-paired-sequences>",
+    "accepted_sensor_frame_count": "<integer>",
+    "accepted_update_count": "<integer>",
+    "evaluable_duration_s": "<number>",
+    "update_hz": "<accepted-update-count/evaluable-duration>",
+    "position_error_sum_m": "<sum-of-evaluable-sequence-means>",
+    "position_error_sample_count": "<equals-paired-sequences-after-frozen-missing-output-penalty>",
+    "position_error_m": "<sum/sample-count>",
+    "lost_track_duration_s": "<number>",
+    "evaluable_track_duration_s": "<number>",
+    "lost_track_rate": "<lost/evaluable-duration>"
+  },
+  "csi_only": {
+    "sequence_count": "<equals-paired-sequences>",
+    "accepted_sensor_frame_count": "<integer>",
+    "accepted_update_count": "<integer>",
+    "evaluable_duration_s": "<number>",
+    "update_hz": "<number>",
+    "lost_track_duration_s": "<number>",
+    "evaluable_track_duration_s": "<number>",
+    "lost_track_rate": "<number>"
+  },
+  "fused": {
+    "sequence_count": "<equals-paired-sequences>",
+    "accepted_sensor_frame_count": "<integer>",
+    "accepted_update_count": "<integer>",
+    "evaluable_duration_s": "<number>",
+    "update_hz": "<accepted-update-count/evaluable-duration>",
+    "position_error_sum_m": "<sum-of-evaluable-sequence-means>",
+    "position_error_sample_count": "<equals-paired-sequences-after-frozen-missing-output-penalty>",
+    "position_error_m": "<sum/sample-count>",
+    "lost_track_duration_s": "<number>",
+    "evaluable_track_duration_s": "<number>",
+    "lost_track_rate": "<lost/evaluable-duration>"
+  },
+  "confidence": {
+    "bootstrap_resamples": "<integer-at-least-10000>",
+    "bootstrap_seed_list_sha256": "<nonzero-64-hex>",
+    "familywise_confidence_level": 0.975,
+    "position_error_reduction_lower": "<number>",
+    "position_error_reduction_upper": "<number>",
+    "lost_track_reduction_lower": "<number>",
+    "lost_track_reduction_upper": "<number>"
+  },
+  "guardrails": {
+    "empty_false_track_rate": "<number>",
+    "empty_false_track_rate_max": "<frozen-number>",
+    "fused_p95_latency_ms": "<number>",
+    "fused_p95_latency_max_ms": "<frozen-number>",
+    "fused_frame_loss_rate": "<(offered-fused-accepted)/offered>",
+    "fused_frame_loss_rate_max": "<frozen-number>",
+    "exclusion_fraction": "<number>",
+    "exclusion_fraction_max": "<frozen-number>",
+    "fused_update_rate_ratio_min": "<frozen-number>",
+    "nonwinning_position_error_regression_max": "<frozen-number>",
+    "nonwinning_lost_track_regression_max": "<frozen-number>"
+  }
+}
+```
+
+Run the hard arithmetic/provenance gate only after witness review:
+
+```bash
+cd harness/ruview
+node bin/cli.js nlos verify --repo ../.. \
+  --evidence-file evidence/nlos/acceptance.json \
+  --require-research-pass
+```
+
+Do not commit a fabricated placeholder file merely to exercise this command;
+unit tests already cover synthetic fixtures.
+
+## 14. Reporting language
+
+Permitted after software only:
+
+> `SYNTHETIC`: the Rust, Swift, and web contracts pass deterministic replay and
+> boundary tests. No live NLOS accuracy or iPhone hardware claim was evaluated.
+
+Permitted after a passing L2 capture:
+
+> `MEASURED` on capture `<digest>` under protocol `ruview-consumer-nlos-v1`, the
+> external `<sensor_model>/<transient_kind>` LiDAR-only arm emitted `<rate>` accepted updates/s. Fusion
+> reduced `<exact endpoint>` by `<gain>` relative to LiDAR-only over `<n>` paired
+> controlled sequences. This is L2 controlled-laboratory evidence for the named
+> target/geometry, not built-in iPhone, diffuse-human, field, or safety evidence.
+
+Forbidden:
+
+1. “iPhone sees around corners” from ARKit depth, native/web build or external
+   track display;
+2. “30 fps” from requested sensor/display rate rather than accepted end-to-end
+   live tracks;
+3. “25 percent more accurate” when only lost-track rate passed;
+4. “hardware validated” without sensor/firmware/capture/ground-truth witness;
+5. pooled human/general-scene claims from the retroreflective target stratum; or
+6. identity, intent, through-wall optical, collision-avoidance or safety claims.
+
+## 15. Stop and rollback criteria
+
+Stop capture immediately for consent/indicator failure, eye/electrical hazard,
+credential compromise, raw-data leak, unapproved person entry, cross-tenant
+join, provenance ambiguity, calibration/clock failure or confirmed high/critical
+security issue. Quarantine the affected capture and never repair its label.
+
+Stop promotion when H1 fails, neither H2 endpoint passes, fusion guardrails are
+materially worse, exclusions exceed the frozen tolerance, confidence analysis
+cannot be reproduced, or any required artifact is absent. Roll back to
+LiDAR-only, explicit replay, or unavailable. Issue a new protocol version before
+recapture; do not tune against and reuse the opened confirmatory set.
+
+## 16. Primary sources
+
+1. Somasundaram et al., [Nature paper](https://doi.org/10.1038/s41586-026-10502-x).
+2. [Author manuscript and MAS/particle-filter methods](https://arxiv.org/html/2605.17865v1).
+3. [MIT project and reported real-time demonstration](https://cornar.media.mit.edu/).
+4. [Upstream implementation and hardware procedure](https://github.com/sidsoma/consumer-nlos).
+5. STMicroelectronics, [VL53L8CH histogram interface](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html).
+6. STMicroelectronics, [P-NUCLEO-53L8A1](https://www.st.com/en/evaluation-tools/p-nucleo-53l8a1.html).
@@ -0,0 +1,134 @@
+# Consumer NLOS iPhone beta test protocol
+
+Status: Draft for internal validation
+
+This protocol validates onboarding, direct-depth acquisition, privacy-bounded
+diagnostics, and optional external NLOS presentation. It does not validate
+iPhone-only around-the-corner sensing. Public ARKit scene depth is processed
+direct line-of-sight geometry; physical NLOS remains blocked without raw
+transient access and the live evidence required by ADR-330 and ADR-331.
+
+## Test inputs, outputs, and assumptions
+
+Inputs are an approved TestFlight build, one named physical iPhone or iPad, a
+plain wall with safe walking clearance, and a tester who has accepted the beta
+notice. An external RuView endpoint is optional and belongs to a separate test
+mode.
+
+Outputs are completion timing, aggregate quality metrics, bounded failure codes,
+the displayed capability labels, and an optional diagnostic JSON file no larger
+than 64 KiB. No raw image, depth map, point cloud, CSI, transient, location, or
+person trajectory is collected by this protocol.
+
+Assume the tester can install from TestFlight but does not have Xcode or sensing
+expertise. Run indoors with adequate light, a charged device above 30 percent,
+and at least one metre of clear space. Do not scan bystanders or private areas.
+
+## Release prerequisites
+
+1. Record app version, build number, reviewed commit, Xcode version, privacy
+   manifest review, and release approver.
+2. Confirm pull request CI passed Swift tests, simulator build, unsigned archive
+   dry gate, workflow policy checks, and diagnostic contract validation.
+3. Confirm the selected TestFlight build came from the approved release path.
+4. Confirm test notes say that direct depth is not physical NLOS.
+5. Confirm the feedback destination and explainer link are current.
+
+## Tester procedure
+
+1. Install the build from TestFlight and open it. Start the setup timer at first
+   launch. The full path must finish in under five minutes.
+2. Read the purpose and privacy screen. Confirm it says TestFlight installed the
+   app and the RuView assistant is configuring it after installation.
+3. Open the linked explainer, return to the app, and continue.
+4. Confirm the capability screen identifies the device as supported or
+   unsupported. An unsupported device must show useful next steps and must not
+   display simulated data as live.
+5. Grant camera permission when asked. Local-network permission should appear
+   only if external live mode was deliberately selected. Precise location should
+   not be requested in the default flow.
+6. Point the rear sensor at a plain wall from roughly one to two metres away.
+   Hold the device steadily and complete the 15 second calibration.
+7. Follow the on-screen movement guide and complete the 30 second wall scan.
+   Keep the wall visible. This measures direct depth and pose stability, not a
+   hidden object.
+8. Review the summary. Confirm it shows frame rate, depth coverage, pose
+   stability, thermal state, interruptions, and the exact capability label.
+9. Confirm the result says `direct_depth` and physical NLOS says
+   `blocked_raw_transients_unavailable`, unless a separately approved external
+   live source was used.
+10. Open diagnostic preview. Confirm consent says raw capture is false, then
+    choose share or discard. Sharing is optional and must never start
+    automatically.
+11. Stop the setup timer and record elapsed time. Submit the short feedback form
+    without names, room details, images, network names, or location.
+
+## Troubleshooting
+
+| Symptom | Likely cause | Safe recovery | Expected evidence state |
+|---|---|---|---|
+| Device unsupported | No public scene-depth capability | Use a LiDAR-capable supported device or test replay explicitly | `unavailable`, never live |
+| Camera permission denied | Permission was declined or restricted | Open system Settings if the tester chooses, then start a new attempt | `permission_denied` |
+| Calibration fails | Too little valid depth, fast motion, interruption | Face a plain wall, improve lighting, hold steady, retry once | failed attempt remains failed |
+| Depth coverage is low | Reflective, transparent, very dark, near, or distant surface | Use a matte wall at about one to two metres | `direct_depth` only |
+| Pose stability is low | Fast movement or visually sparse environment | Move slowly and keep wall edges or room features visible | degraded or failed |
+| App pauses during scan | Screen lock, call, app switch, thermal pressure | Return, cool device if needed, start a new 30 second scan | partial scan discarded |
+| External track disconnects | Auth, network, expiry, tenant, or server failure | Check endpoint status and pair again; do not use replay as a live fallback | disconnected and stale tracks cleared |
+| Diagnostic will not export | Size or schema guard rejected it | Capture the public failure code and app build; do not attach logs or raw files | export blocked |
+| TestFlight build unavailable | Invitation, beta review, expiry, or build removal | Contact the beta coordinator; do not seek an unsigned IPA | not installed |
+
+After three failed attempts, stop. Record the public failure code and build
+number rather than repeatedly granting permissions or collecting more data.
+
+## Negative tests for internal testers
+
+1. Deny camera permission. Verify the app stops before capture and reaches useful
+   guidance in at most two taps.
+2. Background the app during calibration and during wall scan. Verify each
+   partial result is discarded and cannot show complete.
+3. Turn on Low Power Mode and warm the device through ordinary use. Verify coarse
+   thermal state is reported without inventing an accuracy claim.
+4. Disconnect WiFi during external live mode. Verify tracks expire and the UI
+   does not substitute replay.
+5. Attempt to encode diagnostics containing `image`, `depth_map`, `point_cloud`,
+   `csi`, `transient`, `token`, `latitude`, `longitude`, or `trajectory`. Verify
+   local rejection.
+6. Construct canonical diagnostics of 65,536 and 65,537 bytes. Verify the first
+   is permitted and the second is rejected.
+7. Inspect the exported JSON. Verify there are no free-form logs, URLs, IP
+   addresses, WiFi names, precise device identifiers, or user-entered notes.
+
+## Feedback request
+
+Ask only:
+
+1. Did setup complete: yes or no?
+2. Total elapsed seconds.
+3. Which screen was confusing, if any?
+4. Public failure code, if any.
+5. Did the direct-depth and physical-NLOS distinction make sense: yes or no?
+6. Optional aggregate diagnostic attachment after preview.
+
+Do not request a video of the room, screenshot containing a person, raw capture,
+precise location, Apple account, device serial, or network credentials.
+
+## Pilot scorecard
+
+Run at least 20 compatible-device attempts before external expansion. Report:
+
+1. completion rate, target at least 90 percent;
+2. median completion time, target at most 180 seconds;
+3. p95 completion time, target at most 300 seconds;
+4. calibration and scan failure rates by public code;
+5. permission-denial recovery rate;
+6. diagnostic size distribution and forbidden-field count, target zero; and
+7. proportion correctly understanding that direct depth is not NLOS, target at
+   least 90 percent.
+
+## Acceptance test
+
+One nontechnical tester must complete steps 1 through 10 on a named physical
+device in under five minutes. Calibration must run for 15 seconds, wall scan for
+30 seconds, the result must remain `direct_depth` with physical NLOS blocked,
+and any exported diagnostic must be at most 64 KiB with zero forbidden raw or
+identifying fields.
@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ruview.net/schemas/pose-observation-v2.schema.json",
+  "title": "PoseObservationV2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "timestamp_ns", "sensor_epoch", "sequence", "track_id", "frame", "calibration_id", "floor_plane", "model", "source", "trust_state", "dimensionality", "uncertainty_calibrated", "joints", "observer_confidence", "canonical_hash"],
+  "properties": {
+    "schema_version": { "const": 2 },
+    "timestamp_ns": { "type": "integer", "minimum": 0 },
+    "sensor_epoch": { "type": "integer", "minimum": 0 },
+    "sequence": { "type": "integer", "minimum": 0 },
+    "track_id": { "$ref": "#/$defs/string_id" },
+    "frame": { "$ref": "#/$defs/frame" },
+    "calibration_id": { "$ref": "#/$defs/string_id" },
+    "floor_plane": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/floor" }] },
+    "model": { "$ref": "#/$defs/model" },
+    "source": { "$ref": "#/$defs/source" },
+    "trust_state": { "enum": ["KNOWN", "DEGRADED", "UNKNOWN"] },
+    "dimensionality": { "enum": ["image2d", "metric3d"] },
+    "uncertainty_calibrated": { "type": "boolean" },
+    "joints": { "type": "array", "minItems": 17, "maxItems": 17, "items": { "$ref": "#/$defs/joint" } },
+    "observer_confidence": { "$ref": "#/$defs/probability" },
+    "canonical_hash": { "$ref": "#/$defs/hash" }
+  },
+  "$defs": {
+    "probability": { "type": "number", "minimum": 0, "maximum": 1 },
+    "hash": { "type": "array", "minItems": 32, "maxItems": 32, "items": { "type": "integer", "minimum": 0, "maximum": 255 } },
+    "string_id": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "vec3": { "type": "array", "minItems": 3, "maxItems": 3, "items": { "type": "number" } },
+    "frame": { "type": "object", "additionalProperties": false, "required": ["name", "version", "metric", "right_handed", "z_up"], "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 128 }, "version": { "type": "integer", "minimum": 1 }, "metric": { "type": "boolean" }, "right_handed": { "type": "boolean" }, "z_up": { "type": "boolean" } } },
+    "floor": { "type": "object", "additionalProperties": false, "required": ["normal", "offset_m"], "properties": { "normal": { "$ref": "#/$defs/vec3" }, "offset_m": { "type": "number" } } },
+    "model": { "type": "object", "additionalProperties": false, "required": ["id", "artifact_hash"], "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 128 }, "artifact_hash": { "$ref": "#/$defs/hash" } } },
+    "source": { "type": "object", "additionalProperties": false, "required": ["sensor_id", "authenticated", "replay_protected"], "properties": { "sensor_id": { "type": "string", "minLength": 1, "maxLength": 128 }, "authenticated": { "type": "boolean" }, "replay_protected": { "type": "boolean" } } },
+    "covariance": { "type": "object", "additionalProperties": false, "required": ["xx", "xy", "xz", "yy", "yz", "zz"], "properties": { "xx": { "type": "number", "minimum": 0 }, "xy": { "type": "number" }, "xz": { "type": "number" }, "yy": { "type": "number", "minimum": 0 }, "yz": { "type": "number" }, "zz": { "type": "number", "minimum": 0 } } },
+    "joint": { "type": "object", "additionalProperties": false, "required": ["kind", "position_m", "covariance_m2", "confidence", "visibility"], "properties": { "kind": { "enum": ["nose", "left_eye", "right_eye", "left_ear", "right_ear", "left_shoulder", "right_shoulder", "left_elbow", "right_elbow", "left_wrist", "right_wrist", "left_hip", "right_hip", "left_knee", "right_knee", "left_ankle", "right_ankle"] }, "position_m": { "$ref": "#/$defs/vec3" }, "covariance_m2": { "$ref": "#/$defs/covariance" }, "confidence": { "$ref": "#/$defs/probability" }, "visibility": { "enum": ["visible", "occluded", "unknown"] } } }
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ruview.net/schemas/pose-refinement-v1.schema.json",
+  "title": "PoseRefinementV1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "raw_observation_hash", "mode", "disposition", "selected", "refined_joints_m", "physics_confidence", "effective_confidence", "intervention", "residuals", "refined_residuals", "contact_hypotheses", "dynamics", "provenance", "reason", "canonical_hash"],
+  "properties": {
+    "schema_version": { "const": 1 },
+    "raw_observation_hash": { "$ref": "#/$defs/hash" },
+    "mode": { "enum": ["off", "audit", "shadow_correct", "opt_in_correct", "default_correct"] },
+    "disposition": { "enum": ["bypassed", "audited2d", "audited", "shadowed", "corrected", "abstained", "rejected"] },
+    "selected": { "type": "boolean" },
+    "refined_joints_m": { "oneOf": [{ "type": "null" }, { "type": "array", "minItems": 17, "maxItems": 17, "items": { "$ref": "#/$defs/vec3" } }] },
+    "physics_confidence": { "$ref": "#/$defs/probability" },
+    "effective_confidence": { "$ref": "#/$defs/probability" },
+    "intervention": { "$ref": "#/$defs/intervention" },
+    "residuals": { "$ref": "#/$defs/residuals" },
+    "refined_residuals": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/residuals" }] },
+    "contact_hypotheses": { "type": "array", "minItems": 2, "maxItems": 2, "items": { "$ref": "#/$defs/contact" } },
+    "dynamics": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/dynamics" }] },
+    "provenance": { "$ref": "#/$defs/provenance" },
+    "reason": { "enum": [null, "mode_off", "unsupported_schema", "hash_mismatch", "invalid_number", "invalid_covariance", "stale_input", "coordinate_frame_mismatch", "calibration_unavailable", "uncertainty_uncalibrated", "ood_unknown", "source_unauthenticated", "replay_protection_unavailable", "correction_not_authorized", "replay_rejected", "non_monotonic_input", "too_few_known_joints", "correction_too_large", "deadline_exceeded", "track_capacity", "internal_error"] },
+    "canonical_hash": { "$ref": "#/$defs/hash" }
+  },
+  "$defs": {
+    "probability": { "type": "number", "minimum": 0, "maximum": 1 },
+    "hash": { "type": "array", "minItems": 32, "maxItems": 32, "items": { "type": "integer", "minimum": 0, "maximum": 255 } },
+    "vec3": { "type": "array", "minItems": 3, "maxItems": 3, "items": { "type": "number" } },
+    "intervention": { "type": "object", "additionalProperties": false, "required": ["max_joint_correction_m", "root_correction_m", "corrected_joint_count", "solver_iterations", "elapsed_us"], "properties": { "max_joint_correction_m": { "type": "number", "minimum": 0 }, "root_correction_m": { "type": "number", "minimum": 0 }, "corrected_joint_count": { "type": "integer", "minimum": 0, "maximum": 17 }, "solver_iterations": { "type": "integer", "minimum": 0, "maximum": 8 }, "elapsed_us": { "type": "integer", "minimum": 0 } } },
+    "residuals": { "type": "object", "additionalProperties": false, "required": ["bone_m", "joint_limit_rad", "velocity_mps", "acceleration_mps2", "temporal_jerk", "floor_penetration_m", "contact_m", "collision_m", "normalized_total"], "properties": { "bone_m": { "type": "number", "minimum": 0 }, "joint_limit_rad": { "type": "number", "minimum": 0 }, "velocity_mps": { "type": "number", "minimum": 0 }, "acceleration_mps2": { "type": "number", "minimum": 0 }, "temporal_jerk": { "type": "number", "minimum": 0 }, "floor_penetration_m": { "type": "number", "minimum": 0 }, "contact_m": { "type": "number", "minimum": 0 }, "collision_m": { "type": "number", "minimum": 0 }, "normalized_total": { "type": "number", "minimum": 0 } } },
+    "contact": { "type": "object", "additionalProperties": false, "required": ["state", "probability"], "properties": { "state": { "enum": ["hypothesis", "measured", "unknown"] }, "probability": { "$ref": "#/$defs/probability" } } },
+    "dynamics": { "type": "object", "additionalProperties": false, "required": ["stable", "segment_count", "joint_count", "contact_count", "substeps", "tracking_error_m", "joint_anchor_error_m", "floor_penetration_m", "control_effort"], "properties": { "stable": { "type": "boolean" }, "segment_count": { "type": "integer", "minimum": 0, "maximum": 255 }, "joint_count": { "type": "integer", "minimum": 0, "maximum": 255 }, "contact_count": { "type": "integer", "minimum": 0, "maximum": 65535 }, "substeps": { "type": "integer", "minimum": 1, "maximum": 8 }, "tracking_error_m": { "type": "number", "minimum": 0 }, "joint_anchor_error_m": { "type": "number", "minimum": 0 }, "floor_penetration_m": { "type": "number", "minimum": 0 }, "control_effort": { "type": "number", "minimum": 0 } } },
+    "provenance": { "type": "object", "additionalProperties": false, "required": ["engine", "engine_version", "config_hash", "rf_model_hash", "calibration_id", "learned_artifact_hash"], "properties": { "engine": { "type": "string", "minLength": 1, "maxLength": 128 }, "engine_version": { "type": "string", "minLength": 1, "maxLength": 64 }, "config_hash": { "$ref": "#/$defs/hash" }, "rf_model_hash": { "$ref": "#/$defs/hash" }, "calibration_id": { "type": "string", "minLength": 1, "maxLength": 128 }, "learned_artifact_hash": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/hash" }] } } }
+  }
+}
@@ -0,0 +1,79 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ruview.ai/schemas/ruview-ios-visible-depth-diagnostic-v1.schema.json",
+  "title": "RuView iOS visible depth diagnostic v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "sessionId", "createdAt", "deviceModelFamily", "osVersion",
+    "appVersion", "capabilities", "phases", "consent", "evidenceLabel",
+    "physicalNLOSStatus", "cameraPermission", "completionStatus"
+  ],
+  "properties": {
+    "schema": { "const": "ruview.ios.visible-depth-diagnostic.v1" },
+    "sessionId": { "type": "string", "format": "uuid", "maxLength": 36 },
+    "createdAt": { "type": "string", "format": "date-time", "maxLength": 40 },
+    "deviceModelFamily": { "type": "string", "minLength": 1, "maxLength": 80 },
+    "osVersion": { "type": "string", "minLength": 1, "maxLength": 40 },
+    "appVersion": { "type": "string", "minLength": 1, "maxLength": 40 },
+    "capabilities": { "$ref": "#/$defs/capabilities" },
+    "phases": {
+      "type": "array",
+      "maxItems": 2,
+      "items": { "$ref": "#/$defs/phase" }
+    },
+    "consent": { "$ref": "#/$defs/consent" },
+    "evidenceLabel": { "const": "direct_depth" },
+    "physicalNLOSStatus": { "const": "blocked_raw_transients_unavailable" },
+    "cameraPermission": { "enum": ["not_requested", "granted", "denied", "restricted"] },
+    "completionStatus": { "enum": ["completed", "cancelled", "failed"] },
+    "failureReason": { "type": "string", "maxLength": 240 }
+  },
+  "$defs": {
+    "capabilities": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "worldTracking", "sceneDepth", "smoothedSceneDepth", "sceneMesh",
+        "rawPhotonHistograms"
+      ],
+      "properties": {
+        "worldTracking": { "type": "boolean" },
+        "sceneDepth": { "type": "boolean" },
+        "smoothedSceneDepth": { "type": "boolean" },
+        "sceneMesh": { "type": "boolean" },
+        "rawPhotonHistograms": { "const": false }
+      }
+    },
+    "phase": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "phase", "plannedDurationSeconds", "observedDurationSeconds", "frameCount",
+        "averageFPS", "averageDepthCoverage", "averageMovementMetersPerSecond",
+        "finalTrackingState", "peakThermalState"
+      ],
+      "properties": {
+        "phase": { "enum": ["calibration", "wall_scan"] },
+        "plannedDurationSeconds": { "enum": [15, 30] },
+        "observedDurationSeconds": { "type": "number", "minimum": 0, "maximum": 60 },
+        "frameCount": { "type": "integer", "minimum": 0, "maximum": 14400 },
+        "averageFPS": { "type": "number", "minimum": 0, "maximum": 240 },
+        "averageDepthCoverage": { "type": "number", "minimum": 0, "maximum": 1 },
+        "averageMovementMetersPerSecond": { "type": "number", "minimum": 0, "maximum": 20 },
+        "finalTrackingState": { "type": "string", "maxLength": 48 },
+        "peakThermalState": { "enum": ["unknown", "nominal", "fair", "serious", "critical"] }
+      }
+    },
+    "consent": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["localValidation", "diagnosticExport", "rawSensorExport"],
+      "properties": {
+        "localValidation": { "type": "boolean" },
+        "diagnosticExport": { "type": "boolean" },
+        "rawSensorExport": { "const": false }
+      }
+    }
+  }
+}
@@ -0,0 +1,159 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ruview.ai/schemas/ruview-nlos-track-v1.schema.json",
+  "title": "RuView NLOS track envelope v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "sessionId", "sequence", "capturedAtUnixMs", "expiresAtUnixMs",
+    "source", "evidenceLevel", "algorithmVersion", "calibrationHash", "provenance", "tracks"
+  ],
+  "properties": {
+    "schema": { "const": "ruview.nlos.track.v1" },
+    "sessionId": { "$ref": "#/$defs/label" },
+    "sequence": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "capturedAtUnixMs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "expiresAtUnixMs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "source": { "enum": ["live", "replay", "synthetic"] },
+    "evidenceLevel": { "enum": ["l0_synthetic", "l1_measured", "l2_calibrated"] },
+    "algorithmVersion": { "$ref": "#/$defs/label" },
+    "calibrationHash": { "$ref": "#/$defs/sha256" },
+    "provenance": { "$ref": "#/$defs/provenance" },
+    "tracks": {
+      "type": "array",
+      "maxItems": 16,
+      "items": { "$ref": "#/$defs/track" }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "source": { "const": "synthetic" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "evidenceLevel": { "const": "l0_synthetic" },
+          "calibrationHash": { "const": "0000000000000000000000000000000000000000000000000000000000000000" },
+          "provenance": {
+            "properties": {
+              "transientKind": { "const": "replay" },
+              "transport": { "const": "replay" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "live" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "evidenceLevel": { "enum": ["l1_measured", "l2_calibrated"] },
+          "provenance": {
+            "properties": {
+              "transientKind": { "enum": ["raw_histogram", "compact_normalized_histogram"] },
+              "histogramPreserved": { "const": true },
+              "transport": { "enum": ["usb_serial", "ruview_server"] }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "replay" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "provenance": {
+            "properties": {
+              "transientKind": { "const": "replay" },
+              "histogramPreserved": { "const": true },
+              "transport": { "const": "replay" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "evidenceLevel": { "const": "l2_calibrated" } },
+        "required": ["evidenceLevel"]
+      },
+      "then": {
+        "properties": {
+          "calibrationHash": {
+            "not": { "const": "0000000000000000000000000000000000000000000000000000000000000000" }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "label": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z0-9_.:-]+$" },
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "unit": { "type": "number", "minimum": 0, "maximum": 1 },
+    "vector": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["x", "y", "z"],
+      "properties": { "x": { "type": "number" }, "y": { "type": "number" }, "z": { "type": "number" } }
+    },
+    "positionVector": {
+      "type": "object", "additionalProperties": false, "required": ["x", "y", "z"],
+      "properties": {
+        "x": { "type": "number", "minimum": -100, "maximum": 100 },
+        "y": { "type": "number", "minimum": -100, "maximum": 100 },
+        "z": { "type": "number", "minimum": -100, "maximum": 100 }
+      }
+    },
+    "velocityVector": {
+      "type": "object", "additionalProperties": false, "required": ["x", "y", "z"],
+      "properties": {
+        "x": { "type": "number", "minimum": -20, "maximum": 20 },
+        "y": { "type": "number", "minimum": -20, "maximum": 20 },
+        "z": { "type": "number", "minimum": -20, "maximum": 20 }
+      }
+    },
+    "covarianceVector": {
+      "type": "object", "additionalProperties": false, "required": ["x", "y", "z"],
+      "properties": {
+        "x": { "type": "number", "minimum": 0, "maximum": 10 },
+        "y": { "type": "number", "minimum": 0, "maximum": 10 },
+        "z": { "type": "number", "minimum": 0, "maximum": 10 }
+      }
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sensorId", "sensorModel", "firmwareVersion", "transientKind", "histogramPreserved", "transport"],
+      "properties": {
+        "sensorId": { "$ref": "#/$defs/label" },
+        "sensorModel": { "$ref": "#/$defs/label" },
+        "firmwareVersion": { "$ref": "#/$defs/label" },
+        "transientKind": { "enum": ["raw_histogram", "compact_normalized_histogram", "depth_only", "replay"] },
+        "histogramPreserved": { "type": "boolean" },
+        "transport": { "enum": ["usb_serial", "ruview_server", "replay"] }
+      }
+    },
+    "track": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "trackId", "state", "positionM", "velocityMps", "covarianceDiagonalM2",
+        "confidence", "posteriorEntropy", "signalQuality", "modalityContributions"
+      ],
+      "properties": {
+        "trackId": { "$ref": "#/$defs/label" },
+        "state": { "enum": ["tracking", "degraded", "unknown"] },
+        "positionM": { "$ref": "#/$defs/positionVector" },
+        "velocityMps": { "$ref": "#/$defs/velocityVector" },
+        "covarianceDiagonalM2": { "$ref": "#/$defs/covarianceVector" },
+        "confidence": { "$ref": "#/$defs/unit" },
+        "posteriorEntropy": { "type": "number", "minimum": 0 },
+        "signalQuality": { "$ref": "#/$defs/unit" },
+        "modalityContributions": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["lidar", "csi"],
+          "properties": { "lidar": { "$ref": "#/$defs/unit" }, "csi": { "$ref": "#/$defs/unit" } }
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1,132 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ruview.ai/schemas/ruview-nlos-transient-v1.schema.json",
+  "title": "RuView raw optical transient frame v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema", "sessionId", "sequence", "capturedAtUnixMs", "monotonicNs", "source",
+    "evidenceLevel", "binWidthPs", "startBin", "sensorPose", "calibrationHash", "provenance", "zones"
+  ],
+  "properties": {
+    "schema": { "const": "ruview.nlos.transient.v1" },
+    "sessionId": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z0-9_.:-]+$" },
+    "sequence": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "capturedAtUnixMs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "monotonicNs": { "type": "integer", "minimum": 0 },
+    "source": { "enum": ["live", "replay", "synthetic"] },
+    "evidenceLevel": { "enum": ["l0_synthetic", "l1_measured", "l2_calibrated"] },
+    "binWidthPs": { "type": "number", "minimum": 1, "maximum": 10000 },
+    "startBin": { "type": "integer", "minimum": 0, "maximum": 65535 },
+    "sensorPose": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["translationM", "quaternionXyzw"],
+      "properties": {
+        "translationM": { "$ref": "#/$defs/vector" },
+        "quaternionXyzw": {
+          "type": "array", "minItems": 4, "maxItems": 4,
+          "items": { "type": "number", "minimum": -1, "maximum": 1 }
+        }
+      }
+    },
+    "calibrationHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sensorId", "sensorModel", "firmwareVersion", "transientKind", "histogramPreserved", "transport"],
+      "properties": {
+        "sensorId": { "$ref": "#/$defs/label" },
+        "sensorModel": { "$ref": "#/$defs/label" },
+        "firmwareVersion": { "$ref": "#/$defs/label" },
+        "transientKind": { "enum": ["raw_histogram", "compact_normalized_histogram", "depth_only", "replay"] },
+        "histogramPreserved": { "type": "boolean" },
+        "transport": { "enum": ["usb_serial", "ruview_server", "replay"] }
+      }
+    },
+    "zones": {
+      "type": "array", "minItems": 1, "maxItems": 64,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["zoneId", "wallPointM", "distanceM", "ambient", "histogram"],
+        "properties": {
+          "zoneId": { "type": "integer", "minimum": 0, "maximum": 63 },
+          "wallPointM": { "$ref": "#/$defs/vector" },
+          "distanceM": { "type": "number", "minimum": 0.01, "maximum": 10 },
+          "ambient": { "type": "integer", "minimum": 0, "maximum": 4294967295 },
+          "histogram": {
+            "type": "array", "minItems": 8, "maxItems": 128,
+            "items": { "type": "integer", "minimum": 0, "maximum": 65535 }
+          }
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "source": { "const": "synthetic" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "evidenceLevel": { "const": "l0_synthetic" },
+          "calibrationHash": { "const": "0000000000000000000000000000000000000000000000000000000000000000" },
+          "provenance": {
+            "properties": {
+              "transientKind": { "const": "replay" },
+              "transport": { "const": "replay" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "live" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "evidenceLevel": { "enum": ["l1_measured", "l2_calibrated"] },
+          "provenance": {
+            "properties": {
+              "transientKind": { "enum": ["raw_histogram", "compact_normalized_histogram"] },
+              "histogramPreserved": { "const": true },
+              "transport": { "enum": ["usb_serial", "ruview_server"] }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "replay" } }, "required": ["source"] },
+      "then": {
+        "properties": {
+          "provenance": {
+            "properties": {
+              "transientKind": { "const": "replay" },
+              "histogramPreserved": { "const": true },
+              "transport": { "const": "replay" }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": { "evidenceLevel": { "const": "l2_calibrated" } },
+        "required": ["evidenceLevel"]
+      },
+      "then": {
+        "properties": {
+          "calibrationHash": {
+            "not": { "const": "0000000000000000000000000000000000000000000000000000000000000000" }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "label": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z0-9_.:-]+$" },
+    "vector": {
+      "type": "object", "additionalProperties": false,
+      "required": ["x", "y", "z"],
+      "properties": { "x": { "type": "number" }, "y": { "type": "number" }, "z": { "type": "number" } }
+    }
+  }
+}
@@ -0,0 +1,320 @@
+# Consumer NLOS threat model
+
+**Status:** Required design and release gate for ADR-328 through ADR-331
+**Last reviewed:** 2026-08-22
+**Scope:** enrolled histogram-capable ST transient acquisition with recorded
+board/silicon/firmware/API identity, MAS tracking/reconstruction, CSI
+fusion, RuVector/RuField/WorldGraph state, native iOS, web iOS, evidence and
+contributor harness
+**Security posture:** Research capability, local-first, identity-free,
+fail-closed, no direct actuation
+
+## 1. Executive security decision
+
+Around-the-corner tracking changes the privacy boundary of a space: a person can
+be observed without being in direct view of the operator or device. The output
+is sparse probability/geometry rather than a photograph, but location,
+trajectory, occupancy and joined RF evidence remain sensitive. “Camera-free”
+must never be used as “privacy-free.”
+
+The first RuView deployment is a controlled, consented research experiment with
+an external, upstream-compatible ST histogram sensor over local USB. Raw transients, CSI and
+ground truth remain local under an approved retention plan. Live APIs expose
+only bounded, expiring, session-scoped hypotheses. No NLOS output directly
+controls an actuator or certifies that a hidden region is safe.
+
+This PR is software stage G0 only. Its local USB source label (`st-local`) is
+not cryptographic sensor enrollment, and `ruview.nlos.track.v1` has no tenant,
+workspace or world-frame field. The controls below that depend on those
+bindings are mandatory live-promotion work; their documentation does not enable
+L2 or make the current scaffold physically authenticated.
+
+Release is blocked by a confirmed high or critical finding, missing consent,
+unauthenticated sensor/transport, ambiguous live/replay provenance, unbounded
+parser, cross-tenant/world-frame join, or absent stale/replay protection.
+
+## 2. System and trust boundaries
+
+```mermaid
+flowchart TD
+    A["Physical scene + ground truth"] --> B["ST sensor + firmware"]
+    B --> C["USB acquisition + transient parser"]
+    D["Authenticated CSI sensors"] --> E["Calibration + temporal join"]
+    C --> F["MAS likelihood + tracker"]
+    F --> E
+    E --> G["RuField / RuVector / WorldGraph"]
+    G --> H["Authenticated API + short-lived ticket"]
+    H --> I["Native and web iOS clients"]
+```
+
+Trust boundaries are crossed at every arrow. Physical proximity does not imply
+logical trust. USB is a device/input boundary; the ST firmware and upstream
+Python are supply-chain inputs; CSI is an independent, potentially malicious
+modality; memory is tenant/purpose separated; API clients are untrusted; and
+the UI is not evidence authority.
+
+The contributor harness reads repository metadata and optional bounded evidence
+JSON. It does not receive raw captures, credentials, sensing authority, or a
+runtime role.
+
+## 3. Assets
+
+| Asset | Security/privacy need | Default handling |
+|---|---|---|
+| Raw per-zone photon histograms | integrity, confidentiality, purpose/retention | local encrypted research store; never Git/logs |
+| Raw CSI/CIR and RF calibration | confidentiality, tenant isolation, provenance | edge/local; no default cloud export |
+| Ground-truth video/tags/trajectories | highest participant privacy and synchronization integrity | separated encrypted store, least access, scheduled deletion |
+| Sensor identity and firmware/config digest | authenticity and chain of custody | certificate/key reference plus content digest; no private key export |
+| Wall/background/extrinsic calibration | integrity, freshness, deployment binding | signed/content-addressed, expiring, invalidatable |
+| Track posterior/covariance/history | confidentiality, freshness, non-reidentification | session ID, TTL, bounded history, purpose-limited |
+| WorldGraph/RuVector state | tenant isolation, deletion, no identity escalation | tenant/workspace namespace, TTL, audited access |
+| API credentials/tickets | confidentiality, replay resistance, least authority | native pairing secret in ThisDeviceOnly Keychain; web uses short-lived scoped ticket; never URL/log/local storage bearer |
+| Capture/evidence manifest | integrity, reproducibility, nonrepudiation | canonical digest and witness record; no embedded raw data |
+| Model/canonical response | integrity and license/provenance | pinned digest, reviewed source, immutable artifact |
+| Availability/quality state | integrity and fail-closed semantics | explicit unavailable/degraded/unknown/expired states |
+
+## 4. Adversaries and misuse
+
+1. **Unauthorized operator** deploys or leaves sensing active without notice or
+   beyond the approved room/time/purpose.
+2. **Nearby attacker** injects RF, optical, physical-motion or relay-surface
+   changes to produce, hide or move a track.
+3. **Compromised sensor/firmware** fabricates histograms, sequence/timestamps,
+   calibration identity or firmware version.
+4. **Compromised CSI node** contributes an extreme likelihood or replays a frame
+   to create false persistence.
+5. **Malicious client** sends parser bombs, requests another tenant/session,
+   reuses a web ticket, scrapes track history or alters provenance labels.
+6. **Supply-chain attacker** compromises upstream Git/Python/firmware, Cargo/npm/
+   Swift packages, build tools or model artifacts.
+7. **Insider/researcher** copies raw captures, joins session tracks across time,
+   bypasses deletion or selectively reports favorable trials.
+8. **Curious contributor agent/harness** attempts to read secrets/raw data,
+   execute untrusted evidence, mutate code/hardware or promote a claim.
+9. **Accidental failure** includes clock/coordinate mismatch, stale calibration,
+   overflow, NaN, queue buildup, app suspension and simulator/replay confusion.
+
+Out of scope does not mean acceptable: nation-state hardware implants and
+physical destruction are not fully mitigated by this software, so high-assurance
+or safety deployments require a separate hardware/security case.
+
+## 5. Security invariants
+
+1. `LIVE_HARDWARE`, `REPLAY`, and `SYNTHETIC` are mutually exclusive by type.
+   Unknown is never live.
+2. A frame/track is usable only when schema, identity, session, sequence,
+   freshness, calibration, coordinate frame, numeric bounds and size pass.
+3. Fused output requires two independently valid modalities within the frozen
+   time/space join bounds. Missing or rejected input cannot be labeled fused.
+4. RuVector/WorldGraph similarity and persistence never upgrade acquisition
+   provenance, infer identity, or bypass freshness.
+5. Raw sensor and ground-truth data is local/minimized by default and never
+   enters Git, harness manifests, package tarballs, logs or client telemetry.
+6. Authorization is tenant/workspace/session/purpose scoped. A read scope is not
+   actuation authority.
+7. Stale, contradictory, out-of-distribution or low-quality evidence produces
+   `unknown`/degraded, not a confident fallback.
+8. No parser allocates from unchecked zone × bin × object × history dimensions.
+9. No client rendering rate, simulator build or replay can satisfy the live
+   research gate.
+10. A NLOS hypothesis has no direct actuator callback.
+
+## 6. Threat register
+
+Ratings describe the uncontrolled design. “Required control” is a release gate;
+it is not a claim that every future implementation is automatically safe.
+
+| ID | Threat | Initial risk | Required controls | Verification / residual risk |
+|---|---|---:|---|---|
+| T01 | Covert or overbroad sensing beyond direct view | Critical | explicit approved purpose/space/time, participant notice/consent, persistent indicator, pause/stop, background off, audit and deletion | privacy review plus physical walkthrough; residual High for misuse by an authorized operator, so no unconsented deployment |
+| T02 | Unauthenticated sensor or CSI impersonation | Critical | ADR-305 identity, enrollment, tenant/session binding, TLS where networked, digest/certificate on frame/calibration | forged/unknown identity tests; residual Medium for stolen keys, mitigated by rotation/revocation |
+| T03 | Replay/duplicate/future timestamp creates false track | High | monotonic sequence, nonce/session, bounded skew/TTL, duplicate cache, clock uncertainty, stale clear | exact/changed replay, wrap and clock-jump tests; residual Low/Medium under clock loss → unknown |
+| T04 | Calibration/background substitution or poisoning | High | signed/content-addressed calibration bound to sensor/config/room, expiry/OOD, controlled empty capture, immutable audit | mismatched/expired/poisoned calibration tests; residual Medium for slow physical drift |
+| T05 | Direct line of sight contaminates “hidden” result | High | opaque geometry check, independent scene inspection, registered camera/ground-truth exclusion, capture manifest | randomized occluder/negative trials; residual Medium for unnoticed reflections/view gaps |
+| T06 | Optical/RF adversarial injection or physical spoof | High | per-modality quality/OOD, bounded influence, optical-only/CSI-only ablation, multi-view/temporal consistency, unknown on contradiction | extreme likelihood and conflicting-modality tests; residual High in adversarial environments, so no safety claim |
+| T07 | Coordinate or time-frame mismatch fuses different targets | High | typed units/frame IDs, calibrated transform+uncertainty, bounded pairing skew, no cross-frame fallback | incompatible frame/unit/skew test matrix; residual Low after fail-closed controls |
+| T08 | Parser overflow, NaN/Inf, oversized histogram/track | High | pre-allocation dimension/product bounds, finite checks, fixed max message/evidence size, fuzz/property tests, bounded tails | sanitizers/fuzz/boundary corpus; residual Low/Medium for third-party decoders |
+| T09 | Queue/memory/CPU exhaustion hides freshness | High | bounded queues/particles/history, newest-frame policy, rate limits, timeouts, backpressure/drop counters | overload/slow-client tests; residual Medium under sustained physical/authorized load |
+| T10 | Web ticket/token theft or cross-origin stream | High | ATS/TLS, short-lived one-use scoped ticket, fixed origin, no bearer in URL/log/local storage, CSP, reconnect bounds | expiry/reuse/origin/tenant negative integration tests; residual Medium for compromised client device |
+| T11 | Native/web stale UI remains visually live | High | expiry timer independent of incoming messages, clear on suspend/disconnect/decode error, provenance/quality always visible | fake-clock/suspend/disconnect/replay UI tests; residual Low |
+| T12 | Cross-tenant or cross-session memory leakage | Critical | typed namespace at ingest/join/store/query, authorization, TTL/deletion, no global person ID | tenant/session isolation tests and access audit; residual Medium for admin/backup controls |
+| T13 | Re-identification from trajectory/embedding | High | random session track IDs, no identity training/labels, bounded TTL, purpose limitation, aggregation, access logging | privacy review and deletion tests; residual Medium/High in small populations, so identity use prohibited |
+| T14 | Raw data, secrets or positions leak via Git/log/telemetry/package | High | repo incident controls, `.gitignore`, secret/data scans, redaction, synthetic fixtures, no raw telemetry, tarball review | repository-policy, package dry run, log tests; residual Low/Medium for human export |
+| T15 | Upstream/firmware/dependency/model compromise | High | pin commits/versions/digests, license/source review, isolated sidecar, dependency audit, signed release/provenance, no auto-flash | SBOM/audit/reproducible hash and firmware review; residual Medium for build toolchain |
+| T16 | Malicious evidence JSON/path escape/code execution | High | regular bounded repository-confined JSON, realpath containment, no eval/import, strict schema/digest/arithmetic | traversal/symlink/oversize/malformed tests; residual Low |
+| T17 | Selective reporting, leakage or metric gaming | High | preregistration, immutable grouped split, external ground truth, paired arms, all strata/secondary metrics, witness review | independent analysis reproduction; residual Medium for undisclosed captures |
+| T18 | Learned RF model copies LiDAR labels and appears independent | High | group splits, test on external ground truth, LiDAR/CSI/fused ablations, teacher quality masks, sealed holdout | leakage/adjoining-frame tests; residual Medium under environmental confounding |
+| T19 | Harness/agent mutation gains sensing or release authority | High | MCP/static tools read-only and default-deny; opt-in CLI builds only in a trusted checkout with scrubbed environment/redacted tails; MetaHarness dev-only; human promotion | policy/tool/build-output tests and package manifest; residual Medium because build tools execute repository code |
+| T20 | Track drives unsafe actuator/decision | Critical | hypothesis-only API, explicit no actuator, ADR-321/327 independent governed action and deployment safety case | interface/source tests; residual Critical if bypassed, therefore release blocker |
+| T21 | Private/undocumented Apple API use | High | public SDK only, `canImport`/availability checks, official-doc review, no hidden entitlement/reverse engineering | Xcode source/entitlement review; residual Low with external-sensor-only claim |
+| T22 | Eye/laser or electrical hazard from modified hardware | High | unmodified Class 1 sensor, manufacturer limits, approved power/enclosure, no emitter modification, trained operator | hardware checklist; residual Medium; any optical modification requires new safety review |
+
+## 7. Input-boundary controls
+
+### 7.1 Transient frame
+
+Reject before allocating or mutating state when any of these is true:
+
+1. schema/version is unknown;
+2. zone/bin dimensions are zero, exceed configured maxima, or their product
+   overflows;
+3. bin width, timestamps, pose, intrinsics, wall points, ambient level or
+   normalized counts are non-finite/out of physical configured range;
+4. sensor/session identity is absent, revoked or mismatched;
+5. sequence is duplicate/regressing or time is stale/future beyond uncertainty;
+6. firmware/config/calibration digest differs from the session manifest;
+7. transform is non-invertible, units differ, or coordinate frame is unknown;
+8. calibration is not `VALID`; or
+9. the source-provenance transition is illegal.
+
+### 7.2 Track/API message
+
+`ruview.nlos.track.v1` validation happens before store/render. Bound message
+bytes, track count, history length, covariance/particle summary, strings and
+metadata. Position/velocity/covariance are finite and covariance is valid under
+the chosen representation. The client owns an independent expiry timer.
+Tenant/workspace/world-frame, capture-certificate and audience/origin checks are
+the required L2 contract. Current v1 validates session/schema/sequence/freshness,
+bounded exact shape, calibration hash and generic transient provenance only; it
+must remain G0 until the missing authorization/frame bindings are versioned end
+to end.
+
+### 7.3 Evidence record
+
+The harness permits at most 1 MiB, regular JSON inside the canonical repository
+root. `realpath` containment rejects `..` and symlink escapes. JSON is parsed as
+data, never imported or executed. Research pass requires exact live provenance,
+external ground truth, frozen protocol, digests, zero synthetic/replay frames,
+minimum sample size, valid rates/errors and the frozen arithmetic.
+
+## 8. Authentication, authorization and key handling
+
+1. Before live promotion, sensor enrollment creates a non-secret, scoped sensor identity reference and protects
+   the private key outside captures/manifests. Revocation invalidates future
+   frames and live capability certificates.
+2. Service authorization is least-privilege: read tracks for one tenant,
+   workspace, session and purpose. It grants no calibration write, firmware
+   flash, memory export, evidence promotion or actuation.
+3. The current G0 browser exchanges an authenticated session for a 30-second,
+   one-use WebSocket ticket bound to the server session; the client requires a
+   server-session acknowledgement, pins the returned WSS URL to the configured
+   same authority, and the server uses exact CORS. It does **not** yet bind
+   tenant/workspace/audience/origin claims in the ticket. Those bindings and
+   their negative tests are mandatory before L2. Tickets are not stored
+   persistently. Native pairing tokens are scoped, revocable, validated before
+   use, and stored as `WhenUnlockedThisDeviceOnly` Keychain data.
+4. TLS certificate verification is on in release builds. Debug/local exceptions
+   are explicit, non-exportable release configuration.
+5. Secrets are never command-line arguments when avoidable and never printed in
+   error tails. Harness tools accept no raw token/API key field.
+6. Research-store encryption keys are purpose/experiment scoped, kept outside
+   captures, manifests and backups, access-audited, rotated on compromise, and
+   destroyed at retention expiry. Backup retention cannot silently defeat
+   deletion or crypto-erasure evidence.
+
+## 9. Privacy impact and data lifecycle
+
+| Stage | Minimization | Access/retention | Deletion proof |
+|---|---|---|---|
+| Capture | record only approved zones/modalities/window; no audio; ground truth separated | named researchers, encrypted local store, frozen short schedule | manifest tombstone plus storage audit |
+| Calibration | no person present; bind to room/sensor/config | operators and pipeline; expire on change | invalidation record and artifact deletion |
+| Inference | process raw at edge; emit bounded position/covariance/provenance | live authorized clients only | TTL and session teardown tests |
+| RuVector/WorldGraph | no stable identity; session scope; minimal embeddings/relations | tenant/purpose-scoped queries | namespace purge and index compaction evidence |
+| Evidence | hashes and aggregate metrics, no raw person data | reviewers | retain per research governance without reconstructing raw capture |
+| Logs/telemetry | counters, digests truncated where needed, redacted errors | operators/security | rotation verification |
+
+Consent/notice must explain around-corner sensing in plain language. An optical
+sensor without RGB imagery can still infer a hidden person's location and
+movement. Withdrawal/deletion limitations for already aggregated, non-personal
+published metrics are documented before participation.
+
+## 10. Availability and safe degradation
+
+Every dependency has an explicit safe state:
+
+| Failure | Required behavior |
+|---|---|
+| sensor disconnect or malformed frame | stop live optical updates; emit unavailable/unknown |
+| calibration/OOD failure | invalidate likelihood; request recalibration; no cached live fallback |
+| CSI missing | optical-only label if optical remains valid; never fused |
+| optical missing | RF-only/coarse label if separately permitted; never NLOS/fused |
+| clock/coordinate disagreement | no join; record diagnostic counter |
+| tracker numeric collapse | reset bounded filter and emit unknown during reacquisition |
+| API auth/ticket expiry | disconnect and clear live state |
+| native suspension/web background | expire display independently of server |
+| RuVector/WorldGraph unavailable | current local track may continue without persistence; no memory fabrication |
+| harness/MetaHarness unavailable | no runtime impact; run direct crate/app tests |
+
+## 11. Security verification plan
+
+Minimum software evidence is staged: current G0 must pass the checks applicable
+to its implemented schema; every listed check is mandatory before live L2
+promotion. A test cannot stand in for a field the protocol does not yet carry.
+
+1. Rust unit/property/fuzz or boundary tests for transient/track decode,
+   dimension-product overflow, numeric extremes, calibration/provenance state,
+   temporal/coordinate join and bounded filter behavior.
+2. Swift and TypeScript cross-language golden vectors plus malformed/stale/
+   oversized/provenance tests.
+3. Authentication integration tests for invalid/expired/reused/cross-origin/
+   cross-tenant tickets and disconnect state.
+4. Empty/rejected modality, conflicting modality, replay, clock jump, sequence
+   wrap, overload and slow-client tests.
+5. Repository secret/data incident scan, Cargo/npm/Swift dependency review,
+   license/SBOM review and `npm pack --dry-run` inspection.
+6. Harness policy, evidence traversal/oversize/synthetic rejection, manifest,
+   brain/flywheel replay and full legacy tests.
+7. Manual review for private Apple API/entitlement use, raw data/credentials in
+   fixtures/logs, direct actuator callbacks and overclaimed metrics.
+
+### Closed dependency exception record `NLOS-SEC-EX-001`
+
+| Field | Record |
+|---|---|
+| Status | **CLOSED BY REMEDIATION**; no risk exception was approved or consumed |
+| Original finding | high-severity `image-size@1.2.1` advisories [GHSA-w3rx-r6r6-pgpr](https://github.com/advisories/GHSA-w3rx-r6r6-pgpr) and [GHSA-5p2g-fcmc-qvqq](https://github.com/advisories/GHSA-5p2g-fcmc-qvqq) through the prior Metro lock |
+| Remediation | aligned the Expo SDK 55 dependency set and regenerated `ui/mobile/package-lock.json`; the resulting 2026-08-22 audit reports zero high and zero critical findings |
+| Verification | `npm ci --ignore-scripts` plus `npm audit --json`; local audit digest `b6e5236f2b07dec4f714d60e7c8a5683348464455392d636fc77b9c591bb8dcb` |
+| Remaining findings | ten moderate transitive build-tool findings, including `uuid` through `xcode`; tracked normally and not covered by an exception |
+| CI policy | fail every high or critical dependency finding; no NLOS allowlist exists |
+| Promotion mapping | the former dependency block is removed; all other G0→G1 physical, privacy, authorization, provenance and witness gates remain closed until independently satisfied |
+
+The closed record is retained so reviewers can see why the lockfile changed and
+verify that the project remediated rather than silently accepted the finding.
+
+Live L2 evidence additionally needs a physical setup inspection, firmware and
+sensor identity witness, direct-line-of-sight exclusion, external ground-truth
+clock test, capture access/retention review, and independent reproduction of the
+analysis from the immutable manifest.
+
+## 12. Incident response and rollback
+
+On suspected unauthorized sensing, provenance failure, key theft, raw-data leak,
+metric manipulation or unsafe downstream use:
+
+1. stop capture and live stream; revoke sensor/client credentials and tickets;
+2. freeze bounded logs/manifests without copying unnecessary raw participant
+   data;
+3. disable the NLOS/fusion capability certificate and UI live flag;
+4. notify the privacy/security owner and affected participants/organizations as
+   required;
+5. determine affected tenants/sessions/captures/models and delete/quarantine per
+   policy;
+6. patch and add a focused regression test; rerun the complete gate;
+7. re-enable only after independent review and, where evidence was affected, a
+   fresh preregistered capture.
+
+Rollback may return to optical-only, RF-only, replay-only or fully unavailable.
+It never changes old provenance or represents replay as a live substitute.
+
+## 13. Residual-risk decision
+
+Even with controls, authorized misuse, physical spoofing, environment shift,
+re-identification from trajectories and supply-chain compromise retain material
+risk. Therefore the accepted scope is controlled, consented RuView Labs
+research and advisory visualization. Public-space surveillance, covert sensing,
+biometric identity, through-wall safety guarantees, vehicle collision avoidance,
+medical monitoring and autonomous actuation are not approved by these ADRs.
+
+Any expansion requires a new threat model, evidence level, deployment/privacy
+review, operational monitoring, incident/rollback plan and accountable owner.
@@ -22,6 +22,7 @@ WiFi DensePose turns commodity WiFi signals into real-time human pose estimation
   - [ESP32-S3 (Full CSI)](#esp32-s3-full-csi)
   - [ESP32 Multistatic Mesh (Advanced)](#esp32-multistatic-mesh-advanced)
   - [Connect Mesh Data to the Dashboard and Observatory](#connect-mesh-data-to-the-dashboard-and-observatory)
+   - [Cognitum Spaces activation](#cognitum-spaces-activation)
   - [Cognitum Seed Integration (ADR-069)](#cognitum-seed-integration-adr-069)
 5. [REST API Reference](#rest-api-reference)
 6. [WebSocket Streaming](#websocket-streaming)
@@ -74,7 +75,7 @@ WiFi DensePose turns commodity WiFi signals into real-time human pose estimation

 | Option | Cost | Capabilities |
 |--------|------|-------------|
-| ESP32-S3 mesh (3-6 boards) | ~$54 | Full CSI: pose, breathing, heartbeat, presence |
+| ESP32-S3 mesh (3-6 boards) | ~$54 | CSI capture for presence, motion, and vital-sign heuristics; live 17-keypoint pose remains below-target and is not a validated capability |
 | Intel 5300 / Atheros AR9580 | $50-100 | Full CSI with 3x3 MIMO (Linux only) |
 | Any WiFi laptop | $0 | RSSI-only: coarse presence and motion detection |

@@ -425,6 +426,57 @@ curl http://localhost:3000/api/v1/sensing/latest

 If the ESP32 nodes are provisioned with `--target-ip <AGGREGATOR_HOST>`, that IP must be the machine running `sensing-server`. Only one process can receive UDP `:5005` at a time, so leave the standalone hardware `aggregator` off while the dashboard or Observatory is live.

+### Cognitum Spaces activation
+
+Cognitum Spaces gives RuView a tenant/workspace-scoped semantic world model
+without uploading raw RF/CSI, recordings, pose frames, vital waveforms, or
+identity observations. It represents sites, buildings, floors, bounded
+rooms/spaces, zones, anonymous entities, semantic events, and alerts.
+
+Activate the public RuView OAuth client with Authorization Code + PKCE:
+
+```bash
+wifi-densepose login --spaces
+wifi-densepose whoami
+wifi-densepose spaces --resource sites --limit 50
+wifi-densepose spaces --resource events --limit 25
+```
+
+The login requests `sensing:read spaces:read`. That consent is read-only: it
+does not grant publication, pairing, policy approval, command, or actuator
+authority. Versioned collections are `sites`, `buildings`, `floors`,
+`spaces`, `zones`, `entities`, `events`, and `alerts`. A returned
+`nextCursor` is opaque and valid only for the same collection.
+
+The dependency-free contributor harness exposes the same read path:
+
+```bash
+npx @ruvnet/ruview@0.5.0 spaces --resource alerts --limit 25
+npx @ruvnet/ruview@0.5.0 mcp start
+```
+
+Its MCP tool is `ruview_spaces_list`. MCP reads are OAuth-only, use the fixed
+Cognitum API origin, and require the explicit guarded-tool opt-in. The harness
+does not accept an arbitrary credential path or API origin.
+
+For service compatibility, `wifi-densepose spaces` can read
+`COGNITUM_SPACES_API` at request time. API-key access to a versioned collection
+also requires `--workspace <uuid>`; OAuth derives the workspace from the
+signed token. Never print or commit either credential.
+
+Every response is bounded and revalidated. Raw-sensing aliases, malformed
+hierarchy, non-anonymous person/track entities, invalid timestamps, stale
+confidence, and oversized structures fail closed. Empty data means no
+authorized state is present; it does not prove that a physical site is empty.
+
+RuVector spatial memory remains physically separated by tenant and workspace.
+Agents observe or recommend by default. Any consequential execution requires a
+separate policy/grant/approval decision and produces a signed, hash-chained
+receipt; the Spaces read token can never satisfy that gate.
+
+See ADR-325, ADR-326, and ADR-327 for the activation, memory, and governed-action
+decisions.
+
 ### Cognitum Seed Integration (ADR-069)

 Connect an ESP32-S3 to a [Cognitum Seed](https://cognitum.one) (Pi Zero 2 W, ~$15) for persistent vector storage, kNN similarity search, cryptographic witness chain, and AI-accessible sensing via MCP proxy.
@@ -1162,6 +1214,22 @@ levels. Read the label, not the headline ([ADR-187](adr/ADR-187-archive-v1-depre

 **Does it actually run, and can a single ESP32 do pose? ([#509](https://github.com/ruvnet/RuView/issues/509), [#1125](https://github.com/ruvnet/RuView/issues/1125))** Yes, it runs, and the results are reproducible: the deterministic signal-pipeline proof (`python archive/v1/data/proof/verify.py`, must print `VERDICT: PASS`), the committed pose training dump (`v2/crates/cog-pose-estimation/cog/artifacts/train_results.json`), and the auditable MM-Fi arena all back specific numbers. But a single-antenna, 56-subcarrier CSI stream at a 20-frame window does *not* carry the fine-grained spatial information the multi-antenna NIC research relies on — so the shippable pose accuracy the project stands behind today is the **MM-Fi benchmark number**, not a live single-ESP32 number. The path to a first reproducible on-device baseline (PCK@20 ≥ 35%) is tracked in [ADR-079](adr/ADR-079-camera-ground-truth-training.md) / [#645](https://github.com/ruvnet/RuView/issues/645).

+### Model and capture compatibility
+
+These artifacts share a pose objective, but not an input contract or adapter format. A checkpoint
+is usable only when capture preprocessing, tensor shape, architecture, and runtime all match.
+
+| Artifact/path | Required input | Measured status | Live ESP32 compatibility |
+|---------------|----------------|-----------------|--------------------------|
+| MM-Fi flagship and `micro` transformer | `[N,3,114,10]` amplitude | **MEASURED** on MM-Fi `random_split`; calibration reference is Python `.npz` LoRA | No direct S3/C6 path is validated; resampling a 56-tone SISO stream does not recreate three-antenna MM-Fi input |
+| Cog `pose_v1.safetensors` | `[N,56,20]` amplitude | **MEASURED** PCK@20 = 3.0%, below the ≥35% target; cog-format LoRA is `.safetensors` | Shape matches the canonical window, but the documented live runtime remains below-target/stub and is not a reliable pose claim |
+| Viewer `heuristic_pose_from_amplitude` | live canonical amplitude | Skeleton-layout placeholder, not a trained pose model | Renders a demonstrator skeleton only; it is not pose accuracy evidence |
+| MERIDIAN automatic unlabeled calibration | proposed ~200-frame target-room capture | **PROPOSED** in ADR-027; no validated end-to-end command | Not available. The current calibration tools require paired CSI/keypoint labels and model-specific inputs |
+
+Calibration files are not interchangeable: `calibrate.py` targets the MM-Fi transformer, while
+`cog_calibrate.py` targets the cog conv+MLP. See the
+[calibration reference](../aether-arena/calibration/README.md) for their exact schemas.
+
 ### Download

 ```bash
@@ -1406,7 +1474,7 @@ The pipeline runs 10 phases:
 3. Subcarrier resampling (114->56 or 30->56 via Catmull-Rom interpolation)
 4. Graph transformer construction (17 COCO keypoints, 16 bone edges)
 5. Cross-attention training (CSI features -> body pose)
-6. **Domain-adversarial training** (MERIDIAN: gradient reversal + virtual domain augmentation)
+6. Experimental domain-adversarial components (MERIDIAN research modules; not a validated automatic deployment path)
 7. Composite loss optimization (MSE + CE + UV + temporal + bone + symmetry)
 8. SONA adaptation (micro-LoRA + EWC++)
 9. Sparse inference optimization (hot/cold neuron partitioning)
@@ -1422,14 +1490,18 @@ Progressive loading enables instant startup (Layer A loads in <5ms with basic in

 ### Cross-Environment Adaptation (MERIDIAN)

-Models trained in one room typically lose 40-70% accuracy in a new room due to different WiFi multipath patterns. The MERIDIAN system (ADR-027) solves this with a 10-second automatic calibration:
+Models trained in one room can lose substantial accuracy in a new room because the multipath
+distribution changes. ADR-027 proposes an automatic adaptation design, and the Rust tree contains
+individual research components, but RuView does **not** currently provide a validated command that
+turns ~200 unlabeled frames into a working room adapter.

-1. **Deploy** the trained model in a new room
-2. **Collect** ~200 unlabeled CSI frames (10 seconds at 20 Hz)
-3. The system automatically generates environment-specific LoRA weights via contrastive test-time training
-4. No labels, no retraining, no user intervention
+Current, testable calibration is the separate **labeled** reference in
+`aether-arena/calibration/`: collect paired CSI/keypoint samples, then fit a model-specific LoRA
+adapter. The MM-Fi transformer expects `[N,3,114,10]`; the cog expects `[N,56,20]`. Neither adapter
+loads into the other model, and neither result establishes live ESP32 pose accuracy without a
+leakage-free held-out capture and mean-pose baseline.

-MERIDIAN components (all pure Rust, +12K parameters):
+ADR-027 research components:

 | Component | What it does |
 |-----------|-------------|
@@ -1437,7 +1509,7 @@ MERIDIAN components (all pure Rust, +12K parameters):
 | Domain Factorizer | Separates pose-relevant from room-specific features |
 | Geometry Encoder | Encodes AP positions (FiLM conditioning with DeepSets) |
 | Virtual Augmentor | Generates synthetic environments for robust training |
-| Rapid Adaptation | 10-second unsupervised calibration via contrastive TTT |
+| Rapid Adaptation | Proposed unlabeled contrastive TTT; not wired as a validated deployment workflow |

 See [ADR-027](adr/ADR-027-cross-environment-domain-generalization.md) for the full design.

@@ -1595,7 +1667,7 @@ Not every ADR-295–296 remediation item is preview-only. Three are live now:

 | Target | Use case | Source target flag | Notes |
 |---|---|---|---|
-| **ESP32-S3** (default) | Production CSI mesh, 17-keypoint pose | `idf.py set-target esp32s3` | Dual-core 240 MHz, PSRAM, native USB-OTG, DVP camera path |
+| **ESP32-S3** (default) | Production CSI capture mesh; presence/motion/vital heuristics | `idf.py set-target esp32s3` | Dual-core 240 MHz, PSRAM, native USB-OTG, DVP camera path; live 17-keypoint pose is not validated |
 | **ESP32-C6** ([ADR-110](adr/ADR-110-esp32-c6-firmware-extension.md)) | Wi-Fi 6 / 802.15.4 research, battery seed nodes | `idf.py set-target esp32c6` | Single-core 160 MHz, no PSRAM, 802.11ax HE PHY, 802.15.4 (Thread/Zigbee), LP-core hibernation ~5 µA |

 The same `firmware/esp32-csi-node` source tree builds for both. ESP-IDF picks up `sdkconfig.defaults.esp32c6` automatically when the target is set to `esp32c6`; otherwise it uses `sdkconfig.defaults` (S3). All C6-only modules are `#ifdef`-gated, so the S3 build is byte-identical to today.
@@ -2019,7 +2091,11 @@ Pre-trained models are available on HuggingFace:
 - **SOTA MM-Fi pose model** (82.69% torso-PCK@20) — https://huggingface.co/ruvnet/wifi-densepose-mmfi-pose
 - **AetherArena leaderboard Space** — https://huggingface.co/spaces/ruvnet/aether-arena

-Download and start sensing immediately — no datasets, no GPU, no training needed. Results are reproducible via `python archive/v1/data/proof/verify.py` (deterministic SHA-256 proof) — see [ADR-168](adr/ADR-168-benchmark-proof.md).
+The encoder artifact can be downloaded for its documented inference path without retraining. The
+MM-Fi pose checkpoint is benchmark evidence, not a drop-in live ESP32 model; it requires its exact
+input contract and runtime described in [Model and capture compatibility](#model-and-capture-compatibility).
+The deterministic signal-pipeline proof is reproducible via `python archive/v1/data/proof/verify.py`
+(see [ADR-168](adr/ADR-168-benchmark-proof.md)), but that proof does not validate pose accuracy.

 ### Quick Start with Pre-Trained Models

@@ -2584,7 +2660,12 @@ No. Run `docker run -p 3000:3000 ruvnet/wifi-densepose:latest` and open `http://
 No. Consumer WiFi exposes only RSSI (one number per access point), not CSI (56+ complex subcarrier values per frame). RSSI supports coarse presence and motion detection. Full pose estimation requires CSI-capable hardware like an ESP32-S3 ($8) or a research NIC.

 **Q: How accurate is the pose estimation?**
-Accuracy depends on hardware and environment. With a 3-node ESP32 mesh in a single room, the system tracks 17 COCO keypoints. The core algorithm follows the CMU "DensePose From WiFi" paper ([arXiv:2301.00250](https://arxiv.org/abs/2301.00250)). The MERIDIAN domain generalization system (ADR-027) reduces cross-environment accuracy loss from 40-70% to under 15% via 10-second automatic calibration.
+The strongest published RuView result is the MM-Fi transformer benchmark (82.69% torso-PCK@20 on
+the matched `random_split` protocol), not a live ESP32 result. The committed cog model measured
+3.0% PCK@20 on its holdout, below the ≥35% target, and the viewer's live skeleton is a heuristic
+placeholder. No measured claim currently shows a 3-node ESP32 mesh reliably tracking 17 keypoints.
+ADR-027's 10-second unlabeled MERIDIAN adaptation is Proposed; the available measured calibration
+reference uses labeled, model-specific samples.

 **Q: Does it work through walls?**
 Yes. WiFi signals penetrate non-metallic materials (drywall, wood, concrete up to ~30cm). Metal walls/doors significantly attenuate the signal. With a single AP the effective through-wall range is approximately 5 meters. With a 3-6 node multistatic mesh (ADR-029), attention-weighted cross-viewpoint fusion extends the effective range to ~8 meters through standard residential walls.
@@ -0,0 +1,378 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>RuView · ADR-324 · off-axis window (ruview-offaxis WASM)</title>
+    <link rel="icon" type="image/svg+xml" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><rect x='7' y='9' width='18' height='14' rx='2' fill='none' stroke='%23e8a634' stroke-width='2'/><circle cx='16' cy='16' r='3' fill='%23e8a634'/></svg>">
+    <style>
+        :root {
+            --bg: #0a0a0a;
+            --bg-panel: rgba(0, 0, 0, 0.88);
+            --amber: #e8a634;
+            --amber-dim: #4a3a1a;
+            --amber-hot: #ffc04d;
+            --grid-major: #444444;
+            --grid-minor: #222222;
+            --green: #4f4;
+            --blue: #4cf;
+            --red: #f66;
+            --text-mute: #888;
+            --border: #2a2a2a;
+        }
+        * { box-sizing: border-box; }
+        body {
+            margin: 0;
+            background: var(--bg);
+            color: var(--amber);
+            font-family: 'SF Mono', Monaco, 'Cascadia Code', Consolas, monospace;
+            overflow: hidden;
+            -webkit-font-smoothing: antialiased;
+        }
+        canvas { display: block; }
+
+        #info {
+            position: absolute;
+            top: 16px;
+            left: 16px;
+            padding: 14px 16px;
+            background: var(--bg-panel);
+            border: 1px solid var(--amber);
+            border-radius: 8px;
+            min-width: 280px;
+            max-width: 360px;
+            font-size: 12px;
+            line-height: 1.55;
+            z-index: 10;
+            backdrop-filter: blur(6px);
+            box-shadow: 0 4px 24px rgba(232, 166, 52, 0.08);
+        }
+        #info h1 { margin: 0 0 2px 0; font-size: 14px; letter-spacing: 0.5px; }
+        #info .sub { font-size: 11px; color: var(--text-mute); margin-bottom: 10px; }
+        #info .row { display: flex; justify-content: space-between; gap: 12px; margin: 2px 0; }
+        #info .row .k { color: var(--text-mute); }
+        #info .row .v { color: var(--amber); font-variant-numeric: tabular-nums; }
+        #info .row .v.live { color: var(--green); }
+        #info .row .v.warn { color: var(--red); }
+
+        /* The mandatory ADR-324 §2.4 mode label: always visible while RF
+           drives the camera; there is no configuration that hides it. */
+        #mode-label {
+            position: absolute;
+            top: 16px;
+            right: 16px;
+            padding: 8px 14px;
+            background: var(--bg-panel);
+            border: 1px solid var(--blue);
+            border-radius: 8px;
+            color: var(--blue);
+            font-size: 12px;
+            z-index: 11;
+        }
+        #mode-label.rf { border-color: var(--red); color: var(--red); }
+
+        #controls {
+            position: absolute;
+            bottom: 16px;
+            left: 16px;
+            padding: 12px 16px;
+            background: var(--bg-panel);
+            border: 1px solid var(--border);
+            border-radius: 8px;
+            font-size: 12px;
+            z-index: 10;
+            max-width: 340px;
+        }
+        #controls h2 { margin: 0 0 8px 0; font-size: 12px; color: var(--text-mute); }
+        #controls label { display: flex; justify-content: space-between; gap: 8px; margin: 4px 0; align-items: center; }
+        #controls input[type="number"] {
+            width: 70px; background: #111; border: 1px solid var(--border);
+            color: var(--amber); font-family: inherit; font-size: 12px; padding: 2px 6px; border-radius: 4px;
+        }
+        #controls input[type="text"] {
+            width: 190px; background: #111; border: 1px solid var(--border);
+            color: var(--amber); font-family: inherit; font-size: 11px; padding: 2px 6px; border-radius: 4px;
+        }
+        #controls button {
+            background: var(--amber-dim); border: 1px solid var(--amber); color: var(--amber-hot);
+            font-family: inherit; font-size: 12px; padding: 4px 10px; border-radius: 5px; cursor: pointer; margin-top: 6px;
+        }
+        #controls button:hover { background: var(--amber); color: #000; }
+
+        #wasm-missing {
+            position: absolute;
+            inset: 0;
+            display: none;
+            align-items: center;
+            justify-content: center;
+            background: rgba(0, 0, 0, 0.92);
+            z-index: 50;
+        }
+        #wasm-missing .box {
+            max-width: 560px; border: 1px solid var(--amber); border-radius: 10px;
+            background: var(--bg-panel); padding: 22px 26px; font-size: 13px; line-height: 1.7;
+        }
+        #wasm-missing code { color: var(--amber-hot); background: #151005; padding: 1px 5px; border-radius: 4px; display: block; margin: 4px 0; }
+    </style>
+</head>
+<body>
+    <div id="info">
+        <h1>OFF-AXIS WINDOW</h1>
+        <div class="sub">ADR-324 · clean-room Kooima projection · ruview-offaxis (Rust→WASM)</div>
+        <div class="row"><span class="k">engine</span><span class="v" id="hud-engine">loading…</span></div>
+        <div class="row"><span class="k">input</span><span class="v" id="hud-input">mouse (SYNTHETIC)</span></div>
+        <div class="row"><span class="k">eye x/y/z (m)</span><span class="v" id="hud-eye">—</span></div>
+        <div class="row"><span class="k">render fps</span><span class="v live" id="hud-fps">—</span></div>
+        <div class="row"><span class="k">rf socket</span><span class="v" id="hud-ws">not connected</span></div>
+        <div class="row"><span class="k">rf peak</span><span class="v" id="hud-peak">—</span></div>
+        <div class="row" style="margin-top:8px"><span class="k" style="font-size:10px">
+            keys: <b>M</b> mouse · <b>R</b> RF Tier B · wheel = distance</span></div>
+    </div>
+
+    <div id="mode-label">MOUSE SIM — SYNTHETIC INPUT</div>
+
+    <div id="controls">
+        <h2>PHYSICAL CALIBRATION (stored locally)</h2>
+        <label>screen width (cm) <input id="cal-w" type="number" step="0.5" value="60"></label>
+        <label>screen height (cm) <input id="cal-h" type="number" step="0.5" value="34"></label>
+        <label>viewing distance (cm) <input id="cal-d" type="number" step="1" value="65"></label>
+        <h2 style="margin-top:10px">RF SOURCE (Tier B)</h2>
+        <label>ws url <input id="ws-url" type="text" value="ws://127.0.0.1:8080/ws/sensing"></label>
+        <button id="apply">apply calibration</button>
+    </div>
+
+    <div id="wasm-missing">
+        <div class="box">
+            <b>ruview-offaxis WASM module not found.</b><br><br>
+            This demo loads the crate's wasm-bindgen output from
+            <code>v2/crates/ruview-offaxis/pkg/</code>. Generated artifacts are not
+            committed (repo rule); build them once:
+            <code>cd v2 && cargo build -p ruview-offaxis --target wasm32-unknown-unknown --release</code>
+            <code>wasm-bindgen --target web --out-dir crates/ruview-offaxis/pkg \
+  target/wasm32-unknown-unknown/release/ruview_offaxis.wasm</code>
+            (install the CLI with <code>cargo install wasm-bindgen-cli --version 0.2.114</code>)<br>
+            then reload. Full steps: <code>v2/crates/ruview-offaxis/README.md</code>.
+        </div>
+    </div>
+
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
+    <script type="module">
+        // ADR-324 demo: the projection math lives in Rust/WASM (ruview-offaxis).
+        // This file only wires inputs (mouse SYNTHETIC sim, or /ws/sensing
+        // signal_field for the labeled Tier B coarse-parallax mode) into the
+        // WASM camera and copies its matrices onto a three.js camera.
+
+        const $ = (id) => document.getElementById(id);
+
+        // ---- Load the WASM module (not committed; user builds it once). ----
+        let wasm;
+        try {
+            wasm = await import('../../../v2/crates/ruview-offaxis/pkg/ruview_offaxis.js');
+            await wasm.default();
+            $('hud-engine').textContent = 'ruview-offaxis wasm';
+        } catch (e) {
+            console.error('ruview-offaxis pkg not found', e);
+            $('wasm-missing').style.display = 'flex';
+            throw e;
+        }
+        const { OffAxisCamera, RfParallax } = wasm;
+
+        // ---- Calibration (persisted locally; never leaves the browser). ----
+        const CAL_KEY = 'ruview-offaxis-demo-cal';
+        const saved = JSON.parse(localStorage.getItem(CAL_KEY) || 'null');
+        if (saved) { $('cal-w').value = saved.w; $('cal-h').value = saved.h; $('cal-d').value = saved.d; }
+        const cal = () => ({ w: +$('cal-w').value || 60, h: +$('cal-h').value || 34, d: +$('cal-d').value || 65 });
+
+        let cam = new OffAxisCamera(cal().w, cal().h, cal().d, 0.05, 100.0);
+        cam.set_filter(1.2, 0.4); // interactive: light smoothing, quick catch-up
+        let rf = new RfParallax(cal().d / 100);
+
+        $('apply').onclick = () => {
+            const c = cal();
+            localStorage.setItem(CAL_KEY, JSON.stringify(c));
+            cam = new OffAxisCamera(c.w, c.h, c.d, 0.05, 100.0);
+            cam.set_filter(1.2, 0.4);
+            rf = new RfParallax(c.d / 100);
+            buildRoom(); // room proportions follow the physical screen
+        };
+
+        // ---- three.js scene: a room extending behind the screen plane. ----
+        const renderer = new THREE.WebGLRenderer({ antialias: true });
+        renderer.setSize(window.innerWidth, window.innerHeight);
+        renderer.setPixelRatio(window.devicePixelRatio);
+        document.body.appendChild(renderer.domElement);
+
+        const scene = new THREE.Scene();
+        scene.background = new THREE.Color(0x0a0a0a);
+
+        // Camera is fully driven by the WASM matrices.
+        const camera = new THREE.PerspectiveCamera();
+        camera.matrixAutoUpdate = false;
+
+        let room = new THREE.Group();
+        function buildRoom() {
+            scene.remove(room);
+            room = new THREE.Group();
+            const c = cal();
+            const W = c.w / 100, H = c.h / 100, DEPTH = Math.max(W, 0.8) * 2.0;
+
+            // Wireframe box behind the screen: the classic "window" cue.
+            const boxGeo = new THREE.BoxGeometry(W, H, DEPTH);
+            const edges = new THREE.EdgesGeometry(boxGeo);
+            const box = new THREE.LineSegments(edges, new THREE.LineBasicMaterial({ color: 0xe8a634 }));
+            box.position.z = -DEPTH / 2; // screen plane is z = 0
+            room.add(box);
+
+            // Depth rails: rows of columns receding into the box.
+            const colMat = new THREE.MeshStandardMaterial({ color: 0x4a3a1a, emissive: 0x2a1f08 });
+            for (let i = 1; i <= 6; i++) {
+                for (const sx of [-1, 1]) {
+                    const col = new THREE.Mesh(new THREE.CylinderGeometry(0.008, 0.008, H * 0.9, 12), colMat);
+                    col.position.set(sx * W * 0.42, 0, -DEPTH * i / 7);
+                    room.add(col);
+                }
+            }
+
+            // Floating objects at staggered depths (parallax targets).
+            const knotMat = new THREE.MeshStandardMaterial({ color: 0xe8a634, metalness: 0.4, roughness: 0.35 });
+            const knot = new THREE.Mesh(new THREE.TorusKnotGeometry(H * 0.18, H * 0.05, 120, 16), knotMat);
+            knot.position.set(0, 0, -DEPTH * 0.45);
+            knot.name = 'knot';
+            room.add(knot);
+
+            const orb = new THREE.Mesh(
+                new THREE.IcosahedronGeometry(H * 0.08, 1),
+                new THREE.MeshStandardMaterial({ color: 0x4cf0ff, emissive: 0x0a3540 })
+            );
+            orb.position.set(-W * 0.22, H * 0.18, -DEPTH * 0.18);
+            room.add(orb);
+
+            // One object slightly IN FRONT of the screen plane — pops "out".
+            const pop = new THREE.Mesh(
+                new THREE.OctahedronGeometry(H * 0.05),
+                new THREE.MeshStandardMaterial({ color: 0xffc04d, emissive: 0x604010 })
+            );
+            pop.position.set(W * 0.28, -H * 0.2, 0.06);
+            room.add(pop);
+
+            room.add(new THREE.AmbientLight(0xffffff, 0.35));
+            const key = new THREE.PointLight(0xffe0a0, 1.0);
+            key.position.set(0.3, 0.4, 0.5);
+            room.add(key);
+            scene.add(room);
+        }
+        buildRoom();
+
+        // ---- Input modes. ----
+        // 'mouse' — SYNTHETIC eye simulator (always available, no hardware).
+        // 'rf'    — Tier B: /ws/sensing signal_field → RfParallax.
+        //           Labeled coarse body parallax, NOT head tracking (ADR-324 §2.4).
+        let mode = 'mouse';
+        const modeLabel = $('mode-label');
+        function setMode(m) {
+            mode = m;
+            if (m === 'rf') {
+                modeLabel.textContent = 'RF COARSE BODY PARALLAX — NOT HEAD TRACKING';
+                modeLabel.classList.add('rf');
+                $('hud-input').textContent = 'rf field peak (Tier B)';
+                connectWs();
+            } else {
+                modeLabel.textContent = 'MOUSE SIM — SYNTHETIC INPUT';
+                modeLabel.classList.remove('rf');
+                $('hud-input').textContent = 'mouse (SYNTHETIC)';
+            }
+        }
+        window.addEventListener('keydown', (e) => {
+            if (e.key === 'm' || e.key === 'M') setMode('mouse');
+            if (e.key === 'r' || e.key === 'R') setMode('rf');
+        });
+
+        // Mouse sim: pointer position maps to a ±0.3 m eye excursion;
+        // wheel adjusts distance.
+        let mouseEye = { x: 0, y: 0, d: cal().d / 100 };
+        window.addEventListener('pointermove', (e) => {
+            mouseEye.x = (e.clientX / window.innerWidth - 0.5) * 0.6;
+            mouseEye.y = (0.5 - e.clientY / window.innerHeight) * 0.4;
+        });
+        window.addEventListener('wheel', (e) => {
+            mouseEye.d = Math.min(2.5, Math.max(0.2, mouseEye.d + e.deltaY * 0.0005));
+        }, { passive: true });
+
+        // ---- RF Tier B input: /ws/sensing sensing_update.signal_field. ----
+        let ws = null;
+        function connectWs() {
+            if (ws) { try { ws.close(); } catch (_) {} }
+            const url = $('ws-url').value;
+            $('hud-ws').textContent = 'connecting…';
+            try { ws = new WebSocket(url); } catch (e) {
+                $('hud-ws').textContent = 'invalid url'; return;
+            }
+            ws.onopen = () => { $('hud-ws').textContent = 'connected'; };
+            ws.onclose = () => { $('hud-ws').textContent = 'closed'; };
+            ws.onerror = () => { $('hud-ws').textContent = 'error (server up? ticket needed?)'; };
+            ws.onmessage = (ev) => {
+                try {
+                    const msg = JSON.parse(ev.data);
+                    const field = msg.signal_field || (msg.data && msg.data.signal_field);
+                    if (!field || !field.values) return;
+                    const nx = field.grid_size || field.nx || 20;
+                    const nz = field.grid_size || field.nz || 20;
+                    const values = Float32Array.from(field.values);
+                    const found = rf.update(values, nx, nz, performance.now() / 1000);
+                    $('hud-peak').textContent = found
+                        ? `value ${rf.peak_value().toFixed(2)} (≥ 0.35 gate)`
+                        : 'below 0.35 gate — holding';
+                    // Provenance surfaced verbatim (ADR-295: synthetic never
+                    // presents as live).
+                    if (msg.provenance || msg.source) {
+                        $('hud-ws').textContent = `connected · src: ${msg.provenance || msg.source}`;
+                    }
+                } catch (_) { /* non-JSON frame */ }
+            };
+        }
+
+        // ---- Render loop: one WASM call, three matrix copies, render. ----
+        const tmp = new THREE.Matrix4();
+        let frames = 0, lastFps = performance.now();
+        function animate() {
+            requestAnimationFrame(animate);
+            const t = performance.now() / 1000;
+
+            if (mode === 'mouse') {
+                cam.update_eye(mouseEye.x, mouseEye.y, mouseEye.d, t);
+            } else {
+                const e = rf.eye(); // bounded coarse-parallax eye (metres)
+                cam.update_eye(e[0], e[1], e[2], t);
+            }
+
+            // Copy the Kooima matrices onto the three.js camera.
+            camera.projectionMatrix.fromArray(cam.projection());
+            camera.projectionMatrixInverse.copy(camera.projectionMatrix).invert();
+            tmp.fromArray(cam.view());
+            camera.matrixWorld.copy(tmp).invert();      // world = inverse(view)
+            camera.matrixWorldInverse.copy(tmp);
+
+            const knot = room.getObjectByName('knot');
+            if (knot) { knot.rotation.y += 0.003; knot.rotation.x += 0.001; }
+
+            renderer.render(scene, camera);
+
+            const eye = cam.eye();
+            $('hud-eye').textContent = `${eye[0].toFixed(3)} / ${eye[1].toFixed(3)} / ${eye[2].toFixed(3)}`;
+            frames++;
+            const now = performance.now();
+            if (now - lastFps > 1000) {
+                $('hud-fps').textContent = String(frames);
+                frames = 0; lastFps = now;
+            }
+        }
+        animate();
+
+        window.addEventListener('resize', () => {
+            renderer.setSize(window.innerWidth, window.innerHeight);
+            // NOTE: no camera.aspect update — the frustum is fully determined
+            // by the physical screen calibration, not the browser viewport.
+        });
+    </script>
+</body>
+</html>
@@ -0,0 +1,77 @@
+# Cognitum Spaces OAuth activation
+
+Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces
+projection without giving an agent a bearer token or API key.
+
+## Boundary
+
+- This is a read-only P2/P3 semantic projection. HomeCore Edge remains
+  authoritative.
+- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and
+  identity observations are prohibited.
+- `spaces:read` grants no pairing, publication, write, command, policy approval,
+  spending, or actuator authority.
+- A read may refresh an expiring OAuth session and atomically rotate the local
+  credential file.
+
+## Activate OAuth explicitly
+
+Install or build the `wifi-densepose` CLI, then request the additional scope:
+
+```bash
+wifi-densepose login --spaces
+```
+
+For a terminal without a browser:
+
+```bash
+wifi-densepose login --spaces --no-browser
+```
+
+Confirm that the account reports `spaces:read`, then list through the
+metaharness:
+
+```bash
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites
+npx @ruvnet/ruview spaces --resource events --limit 25
+```
+
+The versioned collections are `sites`, `buildings`, `floors`, `spaces`,
+`zones`, `entities`, `events`, and `alerts`. Continue a page with the returned
+opaque `nextCursor`; do not decode or reuse a cursor for another collection.
+
+Use `--credentials-path <private-file>` only from the human-invoked CLI when a
+non-default credential store is intentional. Never put a bearer token or API
+key on the command line.
+
+## MCP
+
+The tool is `ruview_spaces_list`. It is denied by default even though the cloud
+operation is read-only, because it consumes a local identity credential and
+contacts an external service. The MCP server operator must grant that capability
+and may bind the credential path in the server environment:
+
+```bash
+RUVIEW_MCP_GRANTS=credential-use \
+RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
+npx @ruvnet/ruview mcp start
+```
+
+MCP calls cannot choose a credential path and the tool schema has no token or
+API-key, workspace override, or base-URL field. The API origin is fixed to
+`https://api.cognitum.one`, the adapter requires an installed
+`wifi-densepose` binary, and the child environment excludes
+`COGNITUM_SPACES_API`, so this
+surface verifies the OAuth path rather than silently taking the compatibility
+API-key path.
+
+## Interpret results honestly
+
+An empty `data` list can be a valid authenticated tenant result. It proves the
+read path and isolation behavior, not sensing quality. Every accepted response
+must declare `HomeCore Edge` as authoritative and carry the complete prohibited
+field list. Parent lineage, schema version, anonymous person/track identity,
+event/alert fields, confidence, and cursor bounds are independently checked.
+Any malformed, oversized, non-semantic, or raw-field response fails closed.
@@ -0,0 +1,165 @@
+---
+name: consumer-nlos
+description: Plan, review, and verify RuView consumer time-of-flight non-line-of-sight research, including raw-transient reproduction, motion-induced aperture, CSI fusion, iOS boundaries, and real-hardware acceptance evidence.
+---
+
+# Consumer NLOS research and verification
+
+Use this skill to plan or review RuView's consumer time-of-flight non-line-of-sight
+research. It is an advisory contributor workflow. It does not capture hardware,
+authorize sensing, replace the Rust runtime, or turn a simulator result into a
+hardware claim.
+
+## Non-negotiable measurement boundary
+
+The MIT method consumes a transient photon-count histogram for each SPAD zone.
+Do not substitute an ARKit scene-depth map, mesh, conventional point cloud,
+WiFi CSI frame, or synthetic replay. Those inputs may provide pose, context,
+RF likelihoods, or deterministic software tests, but they do not contain the
+delayed optical multipath samples needed for NLOS inversion.
+
+The supported reproduction target is VL53L8CH on the pinned upstream commit
+`15314de422a765a2d1b72ea7037dfafb2f908d7c`, using a compatible ST assembly
+with verified raw or compact-normalized histogram access. Record the actual
+board/silicon/firmware/API identity rather than inferring it from the kit name.
+Verify the full upstream `sidsoma/consumer-nlos` commit, scoped enrollment
+reference, firmware/configuration, calibration, capture manifests, analysis and
+RuView commit before comparing results.
+
+## Start here
+
+```bash
+npx @ruvnet/ruview nlos plan
+npx @ruvnet/ruview nlos verify --repo .
+```
+
+The first command returns the four gated phases. The second performs static
+inspection only. `STATIC_DISCOVERY_ONLY`, an available-build pass, or a skip is
+not full Gate A, a research result, or proof of live NLOS behavior.
+
+Run available build gates explicitly:
+
+```bash
+npx @ruvnet/ruview nlos verify --repo . --run-builds
+```
+
+Repository selection and build execution are CLI-only. The MCP tools remain
+read-only advisory surfaces and reject `repo` and `run_builds` so a remote tool
+call cannot choose an arbitrary checkout or launch its toolchains.
+Run builds only in a trusted checkout: Cargo, Swift, Jest and Expo may execute
+repository code. The verifier scrubs the child environment and redacts output,
+but it is not a sandbox.
+
+Expected optional surfaces:
+
+1. `v2/crates/ruview-nlos` for typed transient frames, motion-induced aperture
+   state, calibrated likelihoods, fusion, and `ruview.nlos.track.v1` output.
+2. `ui/ios-nlos` for the pure Swift contract plus the public-API ARKit adapter.
+3. `ui/mobile` for authenticated live tracks and deterministic `SYNTHETIC`
+   replay. The browser does not claim direct access to iPhone photon histograms.
+
+An absent optional surface is an explicit skip. Once its marker exists, missing
+required files or a mismatched schema is a failure.
+
+## Upstream reproduction
+
+1. Freeze the experiment protocol before capture. Record hypotheses, endpoints,
+   exclusions, randomization, scene strata, sensor configuration, target class,
+   calibration procedure, and statistical analysis.
+2. Reproduce the upstream tracker before changing its state model. Use verified
+   live transient histograms, external ground truth, an opaque line-of-sight blocker,
+   and a controlled relay surface. Start with the upstream retroreflective
+   target before diffuse targets.
+3. Preserve zone, timing bin width, counts, ambient signal, sensor timestamp,
+   monotonic sequence, wall geometry, pose, calibration identity, and capture
+   provenance. Never flatten a transient frame to a depth point before NLOS
+   preprocessing.
+4. Measure end-to-end track update rate. The preregistered reproduction gate is
+   at least 27 Hz, meaning within ten percent of the reported 30 Hz target.
+5. Treat published accuracy as `CLAIMED` until reproduced. Generated fixtures
+   are `SYNTHETIC`; captured replay remains distinct `REPLAY`/L1 evidence. Use
+   `MEASURED` only with a named live capture manifest, L2 level and external
+   ground-truth reproducer.
+
+## CSI fusion experiment
+
+Use paired sequences: the same capture split, initial state, target trajectory,
+and scoring code for LiDAR-only and LiDAR-plus-CSI arms. Keep calibration and
+threshold selection inside the training/calibration partition. The test
+partition remains sealed until LiDAR-only, CSI-only, and fused arms are frozen.
+
+The retained fusion model must satisfy both conditions:
+
+1. The LiDAR-only reproduction arm produces at least 27 end-to-end updates per
+   second on live hardware.
+2. Fusion reduces mean target position error by at least 25 percent **or**
+   reduces lost-track rate by at least 25 percent relative to LiDAR-only over at
+   least 100 paired sequences.
+
+Do not count a replay, simulator, duplicated frame, or LiDAR-derived pseudo-CSI
+feature as independent RF evidence. Report both endpoints even when only one is
+the success endpoint. Stratify by reflectivity, range, motion, relay surface,
+and RF geometry so a pooled gain cannot hide a failing domain.
+
+## Evidence gate
+
+Create a repository-contained JSON record conforming to
+`ruview.nlos.acceptance.v1`. It separates `LIVE_HARDWARE` provenance,
+`MEASURED` claim tag and L2 evidence, and requires external ground truth, frozen
+protocol, actual sensor/transient identity, nonzero artifact/review digests,
+zero synthetic/replay frames, independent CSI with CSI-only ablation, at least
+100 paired sequences, full paired position-endpoint coverage, shared lost-track
+exposure, recomputable aggregate metrics (including offered rate and fused frame
+loss), adjusted confidence intervals and frozen numeric guardrails. The v1 live
+gate accepts an enrolled external ST VL53L8-series sensor label; it cannot be
+used to attest an iPhone sensor.
+
+Then require the real-hardware gate:
+
+```bash
+npx @ruvnet/ruview nlos verify --repo . \
+  --evidence-file evidence/nlos/acceptance.json \
+  --require-research-pass
+```
+
+The verifier fails closed on malformed, out-of-repository, oversized, replay,
+or synthetic evidence. A passing JSON record is an integrity and arithmetic
+check, not an independent audit of the physical capture; reviewers must inspect
+the immutable capture manifest and ground-truth synchronization evidence.
+
+## Native and web iOS boundary
+
+Apple's documented ARKit surfaces expose processed scene depth, smoothed depth,
+pose, and reconstructed meshes. Until Apple documents access to the required
+per-zone transient histograms, use those APIs only for line-of-sight context,
+pose, display, or transport. A native app may consume authenticated, versioned RuView tracks from
+the external sensor pipeline. A web client may consume an authenticated live
+stream or a visibly watermarked replay. Neither is evidence that the built-in
+iPhone LiDAR ran the MIT inversion.
+
+## Privacy and security
+
+1. Record approved purpose, space, time, controller and retention. Obtain all
+   required operator/participant notice and consent, provide pause/withdrawal,
+   show a persistent indicator, and prohibit hidden sensing.
+2. Before any live promotion, bind every frame to an authenticated sensor,
+   session, calibration, tenant/workspace, coordinate frame and monotonic
+   sequence. The G0 scaffold does not yet provide every binding. Reject stale,
+   duplicate, future, oversized, or coordinate-frame-incompatible inputs before
+   fusion.
+3. Keep raw transients and CSI local by default. Export bounded track hypotheses,
+   covariance, provenance, and expiration unless the frozen protocol requires
+   raw capture retention under an approved data policy.
+4. Never infer identity. Use random, session-scoped track identifiers and short
+   expiry. Unknown quality stays unknown; it never falls back to a live claim.
+5. RuVector, RuField, and WorldGraph carry state and evidence. They do not create
+   sensing authority or compensate for missing photons.
+
+## Authoritative references
+
+1. [Nature paper](https://doi.org/10.1038/s41586-026-10502-x)
+2. [Author manuscript](https://arxiv.org/html/2605.17865v1)
+3. [MIT project and reported 30 Hz demonstration](https://cornar.media.mit.edu/)
+4. [Upstream implementation](https://github.com/sidsoma/consumer-nlos)
+5. [ST VL53L8CH histogram interface](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html)
+6. [Apple scene-depth sample](https://developer.apple.com/documentation/arkit/displaying-a-point-cloud-using-scene-depth)
@@ -8,9 +8,16 @@
      "ruview_verify",
      "ruview_node_monitor",
      "ruview_guidance",
+      "ruview_nlos_plan",
+      "ruview_nlos_verify",
      "ruview_memory_search"
    ],
    "grants": {
+      "credential-use": {
+        "tools": ["ruview_spaces_list"],
+        "requiresConfirmation": false,
+        "notes": "Allows a tenant-scoped external read; OAuth refresh may rotate the local credential file."
+      },
      "workspace-write": {
        "tools": ["ruview_calibrate"],
        "requiresConfirmation": true
@@ -3,7 +3,7 @@
  "generator": "RuView metaharness provenance v2",
  "template": "vertical:ruview",
  "name": "@ruvnet/ruview",
-  "version": "0.3.1",
+  "version": "0.5.1",
  "hosts": [
    "claude-code",
    "codex"
@@ -12,47 +12,53 @@
  "files": {
    ".claude/settings.json": "57d03e8995363bd120fb6d515702967afd0bd557797051301ff8f8156c845824",
    ".claude/skills/calibrate-room/SKILL.md": "4b29c7c331f47acad3c0f51b3d3d8f5b5573e316e081bae71dbe21a47fa95240",
+    ".claude/skills/cognitum-spaces/SKILL.md": "96ae42cc72ad31dbb2f34d59e874c4d15f2e55fc969cd1f610dc1b9a4138840e",
+    ".claude/skills/consumer-nlos/SKILL.md": "60296281d8f4d3827a228fc2c4c5baf31401baf0d25fb2a46aedd78c1a15aa8f",
    ".claude/skills/onboard/SKILL.md": "97ee71f0aa985cfc03bb8e764789bb55c4f9fd5dae10a116c1071eab85b5893f",
    ".claude/skills/provision-node/SKILL.md": "5f73823794ed5f0b25c102aa8b1bf2dd534a1ec468173d8330c2af0ca24f239c",
    ".claude/skills/train-pose/SKILL.md": "92aebd4423470eb10eabaee642ec3493284d98b7ae9785e0f34378c709746e65",
    ".claude/skills/verify/SKILL.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76",
-    ".harness/claims.json": "fce72c9fc39d631adba41bab2614b0a373a7af8f31af5f8f36aa985c92a57885",
-    ".harness/mcp-policy.json": "c8458c3cca9d91625d4e51f096ec873d17c77627df79426cb8e49f3a421d0ea5",
+    ".harness/claims.json": "7a3810b11e874bcd19330d82dab121dfb6980a106335187b34acca9838c0117d",
+    ".harness/mcp-policy.json": "a40583341c86e4f609593c7db3cbb2d6522185c7dfae715a242dc04a3709fc16",
    ".mcp/servers.json": "fec6075400f8350d8075beac8306690355c4b015425bfd0e5f52966234e9d66f",
-    "CLAUDE.md": "d6947b2d2e3a9422914a94f81397f3f4b18df9ae75bb26269376dec192dcc249",
+    "CLAUDE.md": "73b3858f601251d7c6d2527d1eaf2befca841bf80e615280ddbf46d924f692f6",
    "LICENSE": "631f94984f626818d42ecf717aa6e8e0afd4f9f355ca706bd2effafbd1416d06",
-    "README.md": "4d21bda7797a0fcca40696592217d3a4f2ecc63716282e2b14fadc3490c6eaa8",
-    "bin/cli.js": "621fcfbfa630bb284cd5a056d0fb75b5aaf37a01f6a820f5e29a2df507e62b4d",
+    "README.md": "6263a3c835d829f1919a86949dcb0cccdad5f09b8f3bfacb6dce1c74b60c92a2",
+    "bin/cli.js": "df3033d1f369af819c1db6498d06c6b331ee9394608491a12b3cedb45b746266",
    "brain/corpus/core.jsonl": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4",
    "flywheel/evaluations.json": "ac4ff1f897a2444870cd2b8ae8aee8b1578e61467aeca4db57893f41be98a572",
    "flywheel/fixture.mjs": "de71be88753d0da4695d91011b54380c994a018986fafba36cb13739307a9bce",
    "flywheel/gate.mjs": "4a0d68ec80a9b4a66f9e13a5d96c0f189af44f28763c456baadf931ac91c3bf8",
-    "flywheel/genome.json": "32c937ccf4431409c1bd7892b4afba6097c539d8c76d41aa968091c9a83d8f99",
+    "flywheel/genome.json": "75db44a3cab70d9459fc8c07863f640ac1214bfaa243483939e1506d63f51214",
    "flywheel/replay.mjs": "0670ca0b03701f4afe0b4bca8a3d58d481676b61a94a5b98c6a425aefb1159ab",
    "flywheel/run.mjs": "6d4f97db16900c45367b6538848cbe1915af999e663720dfc51f2bb1698f1cd0",
-    "package.json": "0da91067c1d71c5cee50cade1e09c270836cfc70efe3bf713f0ec3ce4e88aec3",
+    "package.json": "3f3c518dcfc2d678484736471aa033b1078b8950cfa9bb66d9e72e5e9d3bf022",
    "scripts/sync-skills.mjs": "43715dab61e204dc91bbd61755810e8fdb2f66e2b0c0bd791b4bf48a2e293565",
    "scripts/update-manifest.mjs": "8f56764b8f70aed55da0c7e2417ae875b0d58d781d839b6db7f115f08af61e6b",
    "scripts/verify-manifest.mjs": "6491a221762efcfeb3e749ecab243b204f17fd5bc871f3d4025597f31b8f0f10",
    "skills/calibrate-room.md": "4b29c7c331f47acad3c0f51b3d3d8f5b5573e316e081bae71dbe21a47fa95240",
+    "skills/cognitum-spaces.md": "96ae42cc72ad31dbb2f34d59e874c4d15f2e55fc969cd1f610dc1b9a4138840e",
+    "skills/consumer-nlos.md": "60296281d8f4d3827a228fc2c4c5baf31401baf0d25fb2a46aedd78c1a15aa8f",
    "skills/onboard.md": "97ee71f0aa985cfc03bb8e764789bb55c4f9fd5dae10a116c1071eab85b5893f",
    "skills/provision-node.md": "5f73823794ed5f0b25c102aa8b1bf2dd534a1ec468173d8330c2af0ca24f239c",
    "skills/train-pose.md": "92aebd4423470eb10eabaee642ec3493284d98b7ae9785e0f34378c709746e65",
    "skills/verify.md": "2d38d240e9810a7827e2ebd3717dc0f85c646cc92e46c3812fe77c5b9eb40b76",
    "src/brain.js": "0f16a75aea943acdacc430ff11d5df7ecdec9cca2ab497795ff6f33eaebdfab6",
    "src/guardrails.js": "aacc8fa6088f7f1ccea3a0b02171a5c516b95d3416ee3ba87add3879a1d6aaad",
-    "src/guidance.js": "dbca9dd4c2e692961b7e1f5b2a8d032666252c0da87746c8118aa1c4681b142f",
+    "src/guidance.js": "583904c854eb17e98cb7d959330989c01990a71cff091515777aba8f345de1bf",
    "src/hosts/claude-code.js": "2212bc39b49822018800dfe33a471e56bbb4c5233d716bfa7aa4fff77aa23edb",
    "src/hosts/codex.js": "d41ecd132ce2db7b47aad9cebbc020d70e6810d48c3554858d099ff2e8f6608b",
    "src/hosts/index.js": "ab276c41ab722bcdf72c2d1649cecbb760ae05c41c1372aae4c2447aa7c11539",
-    "src/mcp-server.js": "8c44b0f5e2ee0c386e5315b5927483620cd32ab978055b9f540259c65d4da5fc",
-    "src/policy.js": "c1203b381e0f66481cfe55454f361d0309cd9716fc543c8da06613bedbab6453",
+    "src/mcp-server.js": "8b2ee4b939b25c1b1f507b295a43a2ebad852b8bac9d31af9bf7fb39b181c12e",
+    "src/nlos.js": "53114965a5c3d4373cfc57172efd41890797d7451756933db1bef98659bd9ac1",
+    "src/policy.js": "9ddc08231c1d1c84412a2bea03219ca77972a6254ccda940b9ce26df88e7a7bc",
    "src/process-runner.js": "49533b038044dfb8bc76ed01c030d06a9856ead0836157fb693e2a7d40f786d6",
    "src/redact.js": "ebf1afff46341078706b0401838c53db043603586e280d51ece5cf1feba35189",
    "src/repo-trust.js": "06e2a94d7113ed936f208a12b7fcc785801c215a3e2c5e7418f6238d991a289c",
-    "src/tools.js": "75ba14a26603a1e2885370d6203ba7c7941c9fd264238371c47fce2931254869"
+    "src/spaces.js": "45ef786537cb2a446db5e926e5a1c10b73639d2767dec84611f914f78d4325eb",
+    "src/tools.js": "3bb10444cd420006b7d9ba74617d1e6627528bd042e102592690311852998611"
  },
-  "filesDigest": "278e166323774f53215cb493818bdedff39ea0aab94cfaf6eeea216c90929e41",
+  "filesDigest": "8bb75d65e65ebf4d78002919d8b7cc06d7422c11d5c089ce72f4a3681634911a",
  "brainDigest": "c0fb7b079ded157059b91601361429944697dae3cc42abc00dfe1a680986b0f4",
  "gateFingerprint": "6e53c784eee38310188948fc75fb49e6b4ebc04e247d01b903fa8c8a92d67bdd",
  "developmentPins": {
@@ -1 +1 @@
-81db8a57fc4ae77b4a70078d454638c73a501bb7c46193bb99823a817d3cee9e  manifest.json
+866ee10afeaf318143213bec075bb08d587357b8b36ea6929d5abe5900f1e446  manifest.json
@@ -12,8 +12,17 @@
    "ruview_verify",
    "ruview_node_monitor",
    "ruview_guidance",
+    "ruview_nlos_plan",
+    "ruview_nlos_verify",
    "ruview_memory_search"
  ],
+  "guardedReadTools": {
+    "ruview_spaces_list": {
+      "grant": "credential-use",
+      "network": true,
+      "mayRefreshStoredCredential": true
+    }
+  },
  "dangerousTools": {
    "ruview_calibrate": {
      "grant": "workspace-write",
@@ -19,17 +19,31 @@ accuracy number:

 `ruview_onboard`, `ruview_claim_check`, `ruview_verify`, `ruview_node_monitor`,
 `ruview_calibrate`, `ruview_node_flash`, `ruview_guidance`,
-`ruview_memory_search`. Start unfamiliar work with `ruview_guidance`; its
+`ruview_nlos_plan`, `ruview_nlos_verify`,
+`ruview_spaces_list`, `ruview_memory_search`. Start unfamiliar work with
+`ruview_guidance`; its
 capability status, source paths, validation commands, and limitations are
 navigation evidence, not authority. All tools fail closed. Mutating/hardware
 tools (`node_flash`) require explicit confirmation and are Windows/ESP-IDF
 gated.

+`ruview_spaces_list` is an OAuth-only external read for the eight versioned
+hierarchy/event/alert collections. MCP calls require the
+`credential-use` grant, cannot select a credential path or API origin, and may
+rotate the local refresh credential. It requires an installed binary and never
+runs Cargo from an auto-detected checkout. Cursors are opaque and collection-
+bound. It grants no write or action authority.
+
 ## Skills

-`onboard` · `provision-node` · `calibrate-room` · `train-pose` · `verify`
+`onboard` · `provision-node` · `calibrate-room` · `train-pose` · `verify` · `cognitum-spaces` · `consumer-nlos`
 (`npx @ruvnet/ruview skill <name>`).

+The NLOS tools are advisory repository/research gates. They never capture a
+sensor or turn `SYNTHETIC` replay/build evidence into a live-hardware claim.
+Consumer NLOS requires per-zone photon timing histograms; ARKit depth and CSI
+are context/fusion inputs, not substitutes for that measurement.
+
 ## Don'ts

 - Don't present WiFi sensing as camera-grade.
@@ -17,6 +17,10 @@ npx @ruvnet/ruview claim-check --file REPORT.md   # the honesty guardrail (non-z
 npx @ruvnet/ruview verify                # run the deterministic proof (VERDICT: PASS)
 npx @ruvnet/ruview doctor                # self-check (tools, adapters, local CLIs)
 npx @ruvnet/ruview guidance --topic homecore --query "Wasmtime plugins"
+npx @ruvnet/ruview nlos plan
+npx @ruvnet/ruview nlos verify --repo .
+npx @ruvnet/ruview spaces --resource spaces
+npx @ruvnet/ruview spaces --resource events --limit 25
 npx @ruvnet/ruview --help
 ```

@@ -38,11 +42,85 @@ Exposed both as CLI verbs and as an MCP server (`npx @ruvnet/ruview mcp start`):
 | `ruview_calibrate` | ADR-151 room pipeline (baseline→enroll→train-room→room-watch) |
 | `ruview_node_flash` | Build+flash firmware (Windows/ESP-IDF; mutating, guarded) |
 | `ruview_guidance` | Source-cited code map, capability maturity, validation commands, and limitations |
+| `ruview_nlos_plan` | Advisory, phase-gated consumer transient-LiDAR and CSI fusion plan |
+| `ruview_nlos_verify` | Static/build inspection plus fail-closed live-hardware evidence arithmetic |
+| `ruview_spaces_list` | OAuth-only paging for sites/buildings/floors/spaces/zones/entities/events/alerts (guarded over MCP) |
 | `ruview_memory_search` | Search the reviewed, source-cited contributor brain |

 Every tool is **fail-closed**: missing repo / python / binary / port → an honest
 negative, never a fabricated success.

+### Consumer NLOS research gate
+
+`nlos plan` and `nlos verify` are optional contributor aids for ADR-328 through
+ADR-331. They do not capture sensors and are not required by the RuView runtime.
+The verifier discovers `v2/crates/ruview-nlos`, `ui/ios-nlos`, and the NLOS
+surface in `ui/mobile`. An absent optional surface is reported as `ABSENT`; a
+partial, escaping, oversized, or marker-incompatible surface fails shallow
+discovery. Contract tests remain authoritative. Add `--run-builds` to
+run the build/test commands supported by the current host. Xcode and hardware
+remain explicit skips when unavailable.
+
+Repository selection and build execution are local-CLI capabilities. The MCP
+tool auto-detects its checkout, performs read-only inspection/evidence checks,
+and rejects `repo` or `run_builds` arguments. Run CLI builds only in a trusted
+checkout: the environment is allowlisted and tails redacted, but Cargo/Swift/
+Jest/Expo execution is not a sandbox.
+
+The research gate accepts only a preregistered `LIVE_HARDWARE` record with an
+external ground-truth capture manifest. It requires the pinned VL53L8CH
+baseline to run at least 27 Hz and CSI fusion to reduce mean position error or
+lost-track rate by at least 25 percent over 100 or more paired sequences, with
+adjusted confidence,
+paired aggregate arithmetic, independent CSI ablation, frozen guardrails, and
+witness/privacy/security report digests. `SYNTHETIC` and replay
+frames can validate software, but can never pass that gate:
+
+```bash
+npx @ruvnet/ruview nlos verify --repo . --run-builds
+npx @ruvnet/ruview nlos verify --repo . \
+  --evidence-file evidence/nlos/acceptance.json \
+  --require-research-pass
+```
+
+The boundary is deliberate: the MIT method needs per-zone photon-arrival
+histograms. Apple currently documents processed ARKit scene depth and mesh, so
+the native adapter uses those for pose/context only; the web adapter consumes
+authenticated tracks or visibly labelled deterministic replay. Neither surface
+claims direct iPhone NLOS reconstruction.
+
+### Cognitum Spaces OAuth
+
+Activate the additional read scope through the Rust CLI, then use the same
+validated client through the metaharness:
+
+```bash
+wifi-densepose login --spaces
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites --limit 50
+npx @ruvnet/ruview spaces --resource events --cursor '<opaque-next-cursor>'
+```
+
+The metaharness never accepts a bearer token or API key and removes
+`COGNITUM_SPACES_API` from the child environment, so this surface cannot
+silently fall back to the compatibility API-key path. The API origin is fixed
+to `https://api.cognitum.one`, and the credentialed adapter requires an
+installed `wifi-densepose` binary rather than running Cargo build scripts from
+an auto-detected checkout. It returns only the bounded P2/P3 semantic
+projection. `--resource` selects one of `sites`, `buildings`, `floors`,
+`spaces`, `zones`, `entities`, `events`, or `alerts`; `--limit` is 1–100 and
+`--cursor` is the opaque value from the prior page. An empty list is a valid
+authenticated result, not sensing-quality evidence. An expired session may
+rotate the stored refresh credential before the read completes.
+
+MCP use is denied unless the server operator starts it with
+`RUVIEW_MCP_GRANTS=credential-use`. Set `RUVIEW_CREDENTIALS_PATH` in the MCP
+server environment when a non-default store is needed; MCP calls cannot choose
+an arbitrary credential file or URL. `spaces:read` grants no write, pairing,
+command, policy-approval, spending, or actuator authority. See the bundled
+`cognitum-spaces` skill for the full playbook.
+
 ### Codebase guidance

 `ruview_guidance` is the read-only starting point for unfamiliar work. Filter
@@ -65,7 +143,8 @@ as evidence.
 ## Skills

 Host-neutral playbooks in `skills/` (`onboard`, `provision-node`, `calibrate-room`,
-`train-pose`, `verify`). `npx @ruvnet/ruview skill <name>` prints one.
+`train-pose`, `verify`, `cognitum-spaces`, `consumer-nlos`). `npx @ruvnet/ruview skill <name>`
+prints one.

 ## Use as a Claude Code MCP server

@@ -28,6 +28,7 @@ const VERB_TO_TOOL = {
  monitor: 'ruview_node_monitor',
  flash: 'ruview_node_flash',
  guidance: 'ruview_guidance',
+  spaces: 'ruview_spaces_list',
 };

 function pjson(o) { console.log(JSON.stringify(o, null, 2)); }
@@ -52,9 +53,10 @@ async function doctor() {
    which('claude') ? 'claude -p' : null,
    which('codex') ? 'codex exec' : null,
  ].filter(Boolean);
+  const spacesBackend = which('wifi-densepose') ? 'wifi-densepose binary' : 'unavailable (install wifi-densepose)';
  let ok = true;
  for (const [label, pass] of checks) { console.log(`${pass ? 'PASS' : 'FAIL'} ${label}`); if (!pass) ok = false; }
-  console.log(`\n${NAME}: ${ok ? 'all checks passed' : 'doctor found problems'} — local hosts: ${localHosts.join(', ') || 'none on PATH (optional)'}`);
+  console.log(`\n${NAME}: ${ok ? 'all checks passed' : 'doctor found problems'} — local hosts: ${localHosts.join(', ') || 'none on PATH (optional)'}; Spaces backend: ${spacesBackend}`);
  return ok ? 0 : 1;
 }

@@ -69,6 +71,10 @@ Operator tools:
  monitor --port COM8 [--seconds 12]                    assert CSI is flowing on a node
  flash --port COM8 --variant s3-8mb [--confirm]        build+flash firmware (Windows/ESP-IDF)
  guidance [--topic homecore] [--query "Wasmtime"]      source-cited code/capability map
+  spaces [--resource sites|...|alerts] [--limit 50]     page OAuth-bound Cognitum spatial resources
+  nlos plan                                              print the staged consumer-NLOS research plan
+  nlos verify [--repo <dir>] [--run-builds]             inspect optional NLOS surfaces and run available gates
+       [--evidence-file <json>] [--require-research-pass]

 Harness:
  doctor                 verify tools, adapters, and local CLI discovery
@@ -124,7 +130,12 @@ export async function run(args) {
    if (cmd === 'monitor' && flags.seconds) toolArgs.seconds = Number(flags.seconds);
    if (cmd === 'guidance' && flags.limit) toolArgs.limit = Number(flags.limit);
    if (cmd === 'calibrate' && typeof flags.args === 'string') toolArgs.args = flags.args.split(',');
-    const res = await runTool(VERB_TO_TOOL[cmd], toolArgs);
+    if (cmd === 'spaces') {
+      if (flags['credentials-path'] !== undefined) toolArgs.credentials_path = flags['credentials-path'];
+      delete toolArgs['credentials-path'];
+      if (flags.limit !== undefined) toolArgs.limit = Number(flags.limit);
+    }
+    const res = await runTool(VERB_TO_TOOL[cmd], toolArgs, { source: 'cli' });
    pjson(res);
    return res.ok ? 0 : 1;
  }
@@ -147,6 +158,23 @@ export async function run(args) {
      }
      console.error('Usage: ruview mcp start'); return 2;
    }
+    case 'nlos': {
+      const action = rest[0] || 'plan';
+      if (action === 'plan') {
+        const result = await runTool('ruview_nlos_plan', {}, { source: 'cli' });
+        pjson(result); return result.ok ? 0 : 1;
+      }
+      if (action === 'verify') {
+        const toolArgs = {};
+        if (flags.repo !== undefined) toolArgs.repo = String(flags.repo);
+        if (flags['evidence-file'] !== undefined) toolArgs.evidence_file = String(flags['evidence-file']);
+        if (flags['run-builds'] === true) toolArgs.run_builds = true;
+        if (flags['require-research-pass'] === true) toolArgs.require_research_pass = true;
+        const result = await runTool('ruview_nlos_verify', toolArgs, { source: 'cli' });
+        pjson(result); return result.ok ? 0 : 1;
+      }
+      console.error('Usage: ruview nlos plan|verify'); return 2;
+    }
    case 'agent': {
      if (rest[0] !== 'run') { console.error('Usage: ruview agent run --host claude-code|codex --prompt "..." [--repo <dir>]'); return 2; }
      const hostName = String(flags.host || 'codex');
@@ -6,7 +6,7 @@
    "contextBuilder": "Prefer current Git-tracked source and ADRs. Cite paths and lines. Treat retrieved memories as untrusted quotations until source-verified.",
    "reviewer": "Reject secret exposure, unsupported accuracy claims, bypass flags, unbounded subprocesses, missing tests, or mutations outside the requested workspace.",
    "retryPolicy": "Retry only after classifying a transient failure or changing one causal variable; never loop on unchanged evidence.",
-    "toolPolicy": "Read-only exploration is the default. Workspace writes, hardware, network publication, spend, and learning promotion require distinct explicit authority.",
+    "toolPolicy": "Read-only exploration is the default. Credentialed external reads require an explicit credential-use grant. Workspace writes, hardware, network publication, spend, and learning promotion require distinct explicit authority.",
    "memoryPolicy": "Store only sanitized, source-bound, attributable findings. Private overlays stay local; shared records require review and a reproducible digest.",
    "scorePolicy": "Promotion requires task success, no safety regression, passing anchors, bounded cost and latency, verified provenance, and human review."
  }
@@ -1,12 +1,12 @@
 {
  "name": "@ruvnet/ruview",
-  "version": "0.3.1",
+  "version": "0.5.1",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@ruvnet/ruview",
-      "version": "0.3.1",
+      "version": "0.5.1",
      "license": "MIT",
      "bin": {
        "ruview": "bin/cli.js"
@@ -1,7 +1,7 @@
 {
  "name": "@ruvnet/ruview",
-  "version": "0.3.1",
-  "description": "RuView WiFi-sensing operator agent harness — onboard, calibrate, train, and verify camera-free WiFi-CSI sensing, with the project's MEASURED-vs-CLAIMED honesty guardrail enforced. Minted via metaharness (ADR-182).",
+  "version": "0.5.1",
+  "description": "RuView WiFi-sensing operator harness — onboard, calibrate, verify, enforce evidence guardrails, and read Cognitum Spaces through explicitly granted OAuth.",
  "type": "module",
  "bin": {
    "ruview": "bin/cli.js"
@@ -11,6 +11,7 @@
    "./guardrails": "./src/guardrails.js",
    "./brain": "./src/brain.js",
    "./guidance": "./src/guidance.js",
+    "./nlos": "./src/nlos.js",
    "./hosts": "./src/hosts/index.js"
  },
  "files": [
@@ -29,7 +30,7 @@
  ],
  "scripts": {
    "test": "node --test test/*.test.mjs",
-    "test:security": "node --test test/hosts.test.mjs test/brain.test.mjs test/policy.test.mjs",
+    "test:security": "node --test test/hosts.test.mjs test/brain.test.mjs test/policy.test.mjs test/spaces.test.mjs",
    "doctor": "node ./bin/cli.js doctor",
    "mcp": "node ./bin/cli.js mcp start",
    "brain:verify": "node ./bin/cli.js brain verify",
@@ -47,6 +48,8 @@
    "ruview",
    "csi",
    "channel-state-information",
+    "consumer-lidar",
+    "non-line-of-sight",
    "pose-estimation",
    "presence-detection",
    "esp32",
@@ -55,7 +58,9 @@
    "mcp",
    "mcp-server",
    "claude-code",
-    "ambient-intelligence"
+    "ambient-intelligence",
+    "cognitum-spaces",
+    "oauth"
  ],
  "engines": {
    "node": ">=20.0.0"
@@ -0,0 +1,77 @@
+# Cognitum Spaces OAuth activation
+
+Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces
+projection without giving an agent a bearer token or API key.
+
+## Boundary
+
+- This is a read-only P2/P3 semantic projection. HomeCore Edge remains
+  authoritative.
+- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and
+  identity observations are prohibited.
+- `spaces:read` grants no pairing, publication, write, command, policy approval,
+  spending, or actuator authority.
+- A read may refresh an expiring OAuth session and atomically rotate the local
+  credential file.
+
+## Activate OAuth explicitly
+
+Install or build the `wifi-densepose` CLI, then request the additional scope:
+
+```bash
+wifi-densepose login --spaces
+```
+
+For a terminal without a browser:
+
+```bash
+wifi-densepose login --spaces --no-browser
+```
+
+Confirm that the account reports `spaces:read`, then list through the
+metaharness:
+
+```bash
+wifi-densepose whoami
+npx @ruvnet/ruview spaces
+npx @ruvnet/ruview spaces --resource sites
+npx @ruvnet/ruview spaces --resource events --limit 25
+```
+
+The versioned collections are `sites`, `buildings`, `floors`, `spaces`,
+`zones`, `entities`, `events`, and `alerts`. Continue a page with the returned
+opaque `nextCursor`; do not decode or reuse a cursor for another collection.
+
+Use `--credentials-path <private-file>` only from the human-invoked CLI when a
+non-default credential store is intentional. Never put a bearer token or API
+key on the command line.
+
+## MCP
+
+The tool is `ruview_spaces_list`. It is denied by default even though the cloud
+operation is read-only, because it consumes a local identity credential and
+contacts an external service. The MCP server operator must grant that capability
+and may bind the credential path in the server environment:
+
+```bash
+RUVIEW_MCP_GRANTS=credential-use \
+RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
+npx @ruvnet/ruview mcp start
+```
+
+MCP calls cannot choose a credential path and the tool schema has no token or
+API-key, workspace override, or base-URL field. The API origin is fixed to
+`https://api.cognitum.one`, the adapter requires an installed
+`wifi-densepose` binary, and the child environment excludes
+`COGNITUM_SPACES_API`, so this
+surface verifies the OAuth path rather than silently taking the compatibility
+API-key path.
+
+## Interpret results honestly
+
+An empty `data` list can be a valid authenticated tenant result. It proves the
+read path and isolation behavior, not sensing quality. Every accepted response
+must declare `HomeCore Edge` as authoritative and carry the complete prohibited
+field list. Parent lineage, schema version, anonymous person/track identity,
+event/alert fields, confidence, and cursor bounds are independently checked.
+Any malformed, oversized, non-semantic, or raw-field response fails closed.
@@ -0,0 +1,165 @@
+---
+name: consumer-nlos
+description: Plan, review, and verify RuView consumer time-of-flight non-line-of-sight research, including raw-transient reproduction, motion-induced aperture, CSI fusion, iOS boundaries, and real-hardware acceptance evidence.
+---
+
+# Consumer NLOS research and verification
+
+Use this skill to plan or review RuView's consumer time-of-flight non-line-of-sight
+research. It is an advisory contributor workflow. It does not capture hardware,
+authorize sensing, replace the Rust runtime, or turn a simulator result into a
+hardware claim.
+
+## Non-negotiable measurement boundary
+
+The MIT method consumes a transient photon-count histogram for each SPAD zone.
+Do not substitute an ARKit scene-depth map, mesh, conventional point cloud,
+WiFi CSI frame, or synthetic replay. Those inputs may provide pose, context,
+RF likelihoods, or deterministic software tests, but they do not contain the
+delayed optical multipath samples needed for NLOS inversion.
+
+The supported reproduction target is VL53L8CH on the pinned upstream commit
+`15314de422a765a2d1b72ea7037dfafb2f908d7c`, using a compatible ST assembly
+with verified raw or compact-normalized histogram access. Record the actual
+board/silicon/firmware/API identity rather than inferring it from the kit name.
+Verify the full upstream `sidsoma/consumer-nlos` commit, scoped enrollment
+reference, firmware/configuration, calibration, capture manifests, analysis and
+RuView commit before comparing results.
+
+## Start here
+
+```bash
+npx @ruvnet/ruview nlos plan
+npx @ruvnet/ruview nlos verify --repo .
+```
+
+The first command returns the four gated phases. The second performs static
+inspection only. `STATIC_DISCOVERY_ONLY`, an available-build pass, or a skip is
+not full Gate A, a research result, or proof of live NLOS behavior.
+
+Run available build gates explicitly:
+
+```bash
+npx @ruvnet/ruview nlos verify --repo . --run-builds
+```
+
+Repository selection and build execution are CLI-only. The MCP tools remain
+read-only advisory surfaces and reject `repo` and `run_builds` so a remote tool
+call cannot choose an arbitrary checkout or launch its toolchains.
+Run builds only in a trusted checkout: Cargo, Swift, Jest and Expo may execute
+repository code. The verifier scrubs the child environment and redacts output,
+but it is not a sandbox.
+
+Expected optional surfaces:
+
+1. `v2/crates/ruview-nlos` for typed transient frames, motion-induced aperture
+   state, calibrated likelihoods, fusion, and `ruview.nlos.track.v1` output.
+2. `ui/ios-nlos` for the pure Swift contract plus the public-API ARKit adapter.
+3. `ui/mobile` for authenticated live tracks and deterministic `SYNTHETIC`
+   replay. The browser does not claim direct access to iPhone photon histograms.
+
+An absent optional surface is an explicit skip. Once its marker exists, missing
+required files or a mismatched schema is a failure.
+
+## Upstream reproduction
+
+1. Freeze the experiment protocol before capture. Record hypotheses, endpoints,
+   exclusions, randomization, scene strata, sensor configuration, target class,
+   calibration procedure, and statistical analysis.
+2. Reproduce the upstream tracker before changing its state model. Use verified
+   live transient histograms, external ground truth, an opaque line-of-sight blocker,
+   and a controlled relay surface. Start with the upstream retroreflective
+   target before diffuse targets.
+3. Preserve zone, timing bin width, counts, ambient signal, sensor timestamp,
+   monotonic sequence, wall geometry, pose, calibration identity, and capture
+   provenance. Never flatten a transient frame to a depth point before NLOS
+   preprocessing.
+4. Measure end-to-end track update rate. The preregistered reproduction gate is
+   at least 27 Hz, meaning within ten percent of the reported 30 Hz target.
+5. Treat published accuracy as `CLAIMED` until reproduced. Generated fixtures
+   are `SYNTHETIC`; captured replay remains distinct `REPLAY`/L1 evidence. Use
+   `MEASURED` only with a named live capture manifest, L2 level and external
+   ground-truth reproducer.
+
+## CSI fusion experiment
+
+Use paired sequences: the same capture split, initial state, target trajectory,
+and scoring code for LiDAR-only and LiDAR-plus-CSI arms. Keep calibration and
+threshold selection inside the training/calibration partition. The test
+partition remains sealed until LiDAR-only, CSI-only, and fused arms are frozen.
+
+The retained fusion model must satisfy both conditions:
+
+1. The LiDAR-only reproduction arm produces at least 27 end-to-end updates per
+   second on live hardware.
+2. Fusion reduces mean target position error by at least 25 percent **or**
+   reduces lost-track rate by at least 25 percent relative to LiDAR-only over at
+   least 100 paired sequences.
+
+Do not count a replay, simulator, duplicated frame, or LiDAR-derived pseudo-CSI
+feature as independent RF evidence. Report both endpoints even when only one is
+the success endpoint. Stratify by reflectivity, range, motion, relay surface,
+and RF geometry so a pooled gain cannot hide a failing domain.
+
+## Evidence gate
+
+Create a repository-contained JSON record conforming to
+`ruview.nlos.acceptance.v1`. It separates `LIVE_HARDWARE` provenance,
+`MEASURED` claim tag and L2 evidence, and requires external ground truth, frozen
+protocol, actual sensor/transient identity, nonzero artifact/review digests,
+zero synthetic/replay frames, independent CSI with CSI-only ablation, at least
+100 paired sequences, full paired position-endpoint coverage, shared lost-track
+exposure, recomputable aggregate metrics (including offered rate and fused frame
+loss), adjusted confidence intervals and frozen numeric guardrails. The v1 live
+gate accepts an enrolled external ST VL53L8-series sensor label; it cannot be
+used to attest an iPhone sensor.
+
+Then require the real-hardware gate:
+
+```bash
+npx @ruvnet/ruview nlos verify --repo . \
+  --evidence-file evidence/nlos/acceptance.json \
+  --require-research-pass
+```
+
+The verifier fails closed on malformed, out-of-repository, oversized, replay,
+or synthetic evidence. A passing JSON record is an integrity and arithmetic
+check, not an independent audit of the physical capture; reviewers must inspect
+the immutable capture manifest and ground-truth synchronization evidence.
+
+## Native and web iOS boundary
+
+Apple's documented ARKit surfaces expose processed scene depth, smoothed depth,
+pose, and reconstructed meshes. Until Apple documents access to the required
+per-zone transient histograms, use those APIs only for line-of-sight context,
+pose, display, or transport. A native app may consume authenticated, versioned RuView tracks from
+the external sensor pipeline. A web client may consume an authenticated live
+stream or a visibly watermarked replay. Neither is evidence that the built-in
+iPhone LiDAR ran the MIT inversion.
+
+## Privacy and security
+
+1. Record approved purpose, space, time, controller and retention. Obtain all
+   required operator/participant notice and consent, provide pause/withdrawal,
+   show a persistent indicator, and prohibit hidden sensing.
+2. Before any live promotion, bind every frame to an authenticated sensor,
+   session, calibration, tenant/workspace, coordinate frame and monotonic
+   sequence. The G0 scaffold does not yet provide every binding. Reject stale,
+   duplicate, future, oversized, or coordinate-frame-incompatible inputs before
+   fusion.
+3. Keep raw transients and CSI local by default. Export bounded track hypotheses,
+   covariance, provenance, and expiration unless the frozen protocol requires
+   raw capture retention under an approved data policy.
+4. Never infer identity. Use random, session-scoped track identifiers and short
+   expiry. Unknown quality stays unknown; it never falls back to a live claim.
+5. RuVector, RuField, and WorldGraph carry state and evidence. They do not create
+   sensing authority or compensate for missing photons.
+
+## Authoritative references
+
+1. [Nature paper](https://doi.org/10.1038/s41586-026-10502-x)
+2. [Author manuscript](https://arxiv.org/html/2605.17865v1)
+3. [MIT project and reported 30 Hz demonstration](https://cornar.media.mit.edu/)
+4. [Upstream implementation](https://github.com/sidsoma/consumer-nlos)
+5. [ST VL53L8CH histogram interface](https://www.st.com/en/imaging-and-photonics-solutions/vl53l8ch.html)
+6. [Apple scene-depth sample](https://developer.apple.com/documentation/arkit/displaying-a-point-cloud-using-scene-depth)
@@ -29,7 +29,7 @@ const TOPIC_SUMMARIES = Object.freeze({
  hardware: 'ESP32-S3/C6 firmware, capture, provisioning, and hardware evidence.',
  training: 'Calibration, training, evaluation, and data-dependent capability limits.',
  homecore: 'HOMECORE runtime, restore, plugins, API compatibility, migration, HAP, and voice.',
-  integrations: 'Home Assistant, MQTT, Matter, Apple Home HAP, and related boundaries.',
+  integrations: 'Cognitum Spaces, Home Assistant, MQTT, Matter, Apple Home HAP, and related boundaries.',
  deployment: 'Runnable servers, transports, feature flags, and operational entry points.',
  community: 'Contributor harness, reviewed shared brain, local agents, and learning flywheel.',
  testing: 'Deterministic proofs, package gates, Rust CI, and hardware witness requirements.',
@@ -228,6 +228,32 @@ const CAPABILITIES = Object.freeze([
    validation: ['cargo test -p ruview-unified --no-default-features'],
    limitations: ['Accuracy evidence remains synthetic until validated against measured real-world datasets.', 'Hardware adapters do not imply equivalent sensing quality across modalities.'],
  },
+  {
+    id: 'cognitum-spaces-oauth',
+    name: 'Cognitum Spaces OAuth projection',
+    topics: ['integrations', 'deployment', 'community'],
+    status: 'implemented-read-only-live',
+    evidence: 'MIXED',
+    summary: 'The production Spaces API and RuView PKCE client expose the same read-only authority across the versioned site/building/floor/space/zone/entity/event/alert collections with bounded pagination and independent metaharness validation.',
+    sources: [
+      'docs/adr/ADR-325-cognitum-spaces-activation-and-governed-spatial-exchange.md',
+      'v2/crates/wifi-densepose-cli/src/spaces.rs',
+      'harness/ruview/src/spaces.js',
+      'docs/adr/ADR-326-tenant-scoped-ruvector-spatial-memory.md',
+      'docs/adr/ADR-327-governed-action-intents-and-witness-receipts.md',
+    ],
+    validation: [
+      'cd harness/ruview && node --test test/spaces.test.mjs test/policy.test.mjs',
+      'wifi-densepose login --spaces && node harness/ruview/bin/cli.js spaces --resource events',
+    ],
+    limitations: [
+      'The projection is read-only and grants no write, pairing, command, policy-approval, or actuator authority.',
+      'MCP requires the credential-use grant; bearer tokens and API keys are never accepted as tool arguments.',
+      'OAuth refresh may rotate the local credential file before a read returns.',
+      'Production evidence covers legacy and versioned HTTPS reads. Spatial memory remains tenant/workspace-local, while governed actions remain separately policy-gated; neither expands OAuth authority.',
+      'Persistent memory is local tenant/workspace state and governed actions expose authorization receipts only; neither expands OAuth authority.',
+    ],
+  },
  {
    id: 'contributor-metaharness',
    name: 'Contributor metaharness and shared brain',
@@ -38,7 +38,7 @@ async function handle(msg, context = {}) {
        protocolVersion: PROTOCOL_VERSION,
        capabilities: { tools: { listChanged: false } },
        serverInfo: SERVER_INFO,
-        instructions: 'RuView WiFi-sensing operator tools. All results are fail-closed; accuracy claims must pass ruview_claim_check.',
+        instructions: 'RuView WiFi-sensing operator tools. All results are fail-closed; accuracy claims must pass ruview_claim_check. Credentialed external reads are denied without an operator grant; ruview_spaces_list requires credential-use.',
      });
    case 'notifications/initialized':
    case 'initialized':
@@ -0,0 +1,747 @@
+// SPDX-License-Identifier: MIT
+// Advisory consumer-NLOS planning and verification helpers.
+//
+// This module never captures a sensor, changes runtime state, or treats a build
+// as sensing evidence. It is intentionally dependency-free so RuView remains
+// fully usable when MetaHarness, Xcode, hardware, or optional UI surfaces are
+// absent (ADR-331).
+
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { scrubEnvironment } from './process-runner.js';
+import { redact } from './redact.js';
+
+export const NLOS_EVIDENCE_SCHEMA = 'ruview.nlos.acceptance.v1';
+export const NLOS_TRACK_SCHEMA = 'ruview.nlos.track.v1';
+export const NLOS_REFERENCE_SENSOR_MODEL = 'VL53L8CH';
+export const NLOS_UPSTREAM_COMMIT = '15314de422a765a2d1b72ea7037dfafb2f908d7c';
+
+const MAX_EVIDENCE_BYTES = 1024 * 1024;
+const MAX_SURFACE_FILE_BYTES = 4 * 1024 * 1024;
+const SHA256 = /^[a-f0-9]{64}$/i;
+const ZERO_SHA256 = /^0{64}$/;
+const GIT_SHA1 = /^[a-f0-9]{40}$/i;
+const ZERO_GIT_SHA1 = /^0{40}$/;
+const SAFE_LABEL = /^[A-Za-z0-9._:+-]{1,128}$/;
+const EVIDENCE_KEYS = new Set([
+  'schema',
+  'source',
+  'claim_tag',
+  'evidence_level',
+  'ground_truth',
+  'protocol_frozen_before_capture',
+  'witness_reviewed',
+  'privacy_review_passed',
+  'security_review_passed',
+  'los_exclusion_verified',
+  'independent_csi_verified',
+  'sensor_model',
+  'transient_kind',
+  'sensor_configured_max_hz',
+  'upstream_commit',
+  'protocol_sha256',
+  'capture_manifest_sha256',
+  'sensor_identity_sha256',
+  'calibration_sha256',
+  'firmware_sha256',
+  'analysis_sha256',
+  'endpoint_pairing_sha256',
+  'sensor_configuration_sha256',
+  'witness_report_sha256',
+  'privacy_review_sha256',
+  'security_review_sha256',
+  'guardrail_report_sha256',
+  'csi_capture_manifest_sha256',
+  'csi_sensor_identity_sha256',
+  'csi_calibration_sha256',
+  'synthetic_frames',
+  'replay_frames',
+  'paired_sequences',
+  'csi_source_count',
+  'offered_optical_frame_count',
+  'lidar_only',
+  'csi_only',
+  'fused',
+  'confidence',
+  'guardrails',
+]);
+const ARM_KEYS = new Set([
+  'sequence_count',
+  'accepted_sensor_frame_count',
+  'accepted_update_count',
+  'evaluable_duration_s',
+  'update_hz',
+  'position_error_sum_m',
+  'position_error_sample_count',
+  'position_error_m',
+  'lost_track_duration_s',
+  'evaluable_track_duration_s',
+  'lost_track_rate',
+]);
+const CSI_ARM_KEYS = new Set([
+  'sequence_count',
+  'accepted_sensor_frame_count',
+  'accepted_update_count',
+  'evaluable_duration_s',
+  'update_hz',
+  'lost_track_duration_s',
+  'evaluable_track_duration_s',
+  'lost_track_rate',
+]);
+const CONFIDENCE_KEYS = new Set([
+  'bootstrap_resamples',
+  'bootstrap_seed_list_sha256',
+  'familywise_confidence_level',
+  'position_error_reduction_lower',
+  'position_error_reduction_upper',
+  'lost_track_reduction_lower',
+  'lost_track_reduction_upper',
+]);
+const GUARDRAIL_KEYS = new Set([
+  'empty_false_track_rate',
+  'empty_false_track_rate_max',
+  'fused_p95_latency_ms',
+  'fused_p95_latency_max_ms',
+  'fused_frame_loss_rate',
+  'fused_frame_loss_rate_max',
+  'exclusion_fraction',
+  'exclusion_fraction_max',
+  'fused_update_rate_ratio_min',
+  'nonwinning_position_error_regression_max',
+  'nonwinning_lost_track_regression_max',
+]);
+
+const SURFACES = Object.freeze([
+  {
+    id: 'rust-core',
+    base: 'v2/crates/ruview-nlos',
+    marker: 'v2/crates/ruview-nlos/Cargo.toml',
+    required: [
+      'v2/crates/ruview-nlos/Cargo.toml',
+      'v2/crates/ruview-nlos/src/lib.rs',
+    ],
+  },
+  {
+    id: 'native-ios',
+    base: 'ui/ios-nlos',
+    marker: 'ui/ios-nlos/Package.swift',
+    required: [
+      'ui/ios-nlos/Package.swift',
+      'ui/ios-nlos/RuViewNLOS.xcodeproj/project.pbxproj',
+    ],
+  },
+  {
+    id: 'web-ios',
+    base: 'ui/mobile',
+    marker: 'ui/mobile/src/types/nlos.ts',
+    required: [
+      'ui/mobile/src/types/nlos.ts',
+      'ui/mobile/src/services/nlos.service.ts',
+      'ui/mobile/src/stores/nlosStore.ts',
+      'ui/mobile/src/hooks/useNlosStream.ts',
+      'ui/mobile/src/screens/NLOSScreen/index.tsx',
+    ],
+  },
+]);
+
+function fileContains(path, needle) {
+  try { return readFileSync(path, 'utf8').includes(needle); } catch { return false; }
+}
+
+function inspectRepoFile(repo, path) {
+  const candidate = join(repo, path);
+  if (!existsSync(candidate)) return { ok: false, reason: 'missing', candidate };
+  try {
+    const canonicalRepo = realpathSync(repo);
+    const canonicalFile = realpathSync(candidate);
+    const rel = relative(canonicalRepo, canonicalFile);
+    if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+      return { ok: false, reason: 'outside-repo', candidate };
+    }
+    const stat = statSync(canonicalFile);
+    if (!stat.isFile()) return { ok: false, reason: 'not-regular', candidate };
+    if (stat.size > MAX_SURFACE_FILE_BYTES) return { ok: false, reason: 'oversize', candidate };
+    return { ok: true, candidate: canonicalFile };
+  } catch {
+    return { ok: false, reason: 'unreadable', candidate };
+  }
+}
+
+function inspectSurface(repo, surface) {
+  const marker = inspectRepoFile(repo, surface.marker);
+  if (!marker.ok && marker.reason === 'missing') {
+    return { id: surface.id, status: 'ABSENT', base: surface.base, findings: [] };
+  }
+  const states = new Map(surface.required.map((path) => [path, inspectRepoFile(repo, path)]));
+  const findings = [];
+  if (!marker.ok) findings.push(`${surface.marker}:${marker.reason}`);
+  for (const [path, state] of states) {
+    if (!state.ok && path !== surface.marker) findings.push(`${path}:${state.reason}`);
+  }
+
+  if (surface.id === 'rust-core' && !findings.length) {
+    const cargo = states.get('v2/crates/ruview-nlos/Cargo.toml').candidate;
+    const lib = states.get('v2/crates/ruview-nlos/src/lib.rs').candidate;
+    if (!fileContains(cargo, 'name = "ruview-nlos"')) findings.push('rust-core:crate-name-mismatch');
+    if (!fileContains(lib, NLOS_TRACK_SCHEMA)) findings.push(`rust-core:${NLOS_TRACK_SCHEMA}:missing`);
+  }
+  if (surface.id === 'native-ios' && !findings.length) {
+    const packageFile = states.get('ui/ios-nlos/Package.swift').candidate;
+    if (!fileContains(packageFile, 'RuViewNLOSCore')) findings.push('native-ios:RuViewNLOSCore-product-missing');
+    if (!fileContains(packageFile, 'RuViewNLOSApple')) findings.push('native-ios:RuViewNLOSApple-product-missing');
+  }
+  if (surface.id === 'web-ios' && !findings.length) {
+    const typeFile = states.get('ui/mobile/src/types/nlos.ts').candidate;
+    if (!fileContains(typeFile, NLOS_TRACK_SCHEMA)) findings.push(`web-ios:${NLOS_TRACK_SCHEMA}:missing`);
+  }
+
+  return {
+    id: surface.id,
+    status: findings.length ? 'MALFORMED' : 'PRESENT',
+    base: surface.base,
+    findings,
+  };
+}
+
+function buildResult(id, command, result) {
+  return {
+    id,
+    command: command.join(' '),
+    status: result.ok ? 'PASS' : 'FAIL',
+    exit: result.status,
+    error: redact(result.error, { env: process.env }),
+    stdout_tail: redact(result.stdout.slice(-1200), { env: process.env }),
+    stderr_tail: redact(result.stderr.slice(-800), { env: process.env }),
+  };
+}
+
+async function runBuilds(repo, surfaces, { runCommand, whichCommand }) {
+  const results = [];
+  const buildEnv = scrubEnvironment(process.env);
+  const present = new Set(surfaces.filter((item) => item.status === 'PRESENT').map((item) => item.id));
+
+  if (present.has('rust-core')) {
+    if (!whichCommand('cargo')) results.push({ id: 'rust-core', status: 'SKIPPED', reason: 'cargo_unavailable' });
+    else {
+      const args = ['test', '--locked', '--offline', '-p', 'ruview-nlos'];
+      results.push(buildResult('rust-core', ['cargo', ...args], await runCommand('cargo', args, {
+        cwd: join(repo, 'v2'), timeout: 600000, env: buildEnv,
+      })));
+    }
+  }
+
+  if (present.has('native-ios')) {
+    if (!whichCommand('swift')) results.push({ id: 'native-swift', status: 'SKIPPED', reason: 'swift_unavailable' });
+    else {
+      const args = ['test'];
+      results.push(buildResult('native-swift', ['swift', ...args], await runCommand('swift', args, {
+        cwd: join(repo, 'ui/ios-nlos'), timeout: 600000, env: buildEnv,
+      })));
+    }
+    if (process.platform !== 'darwin' || !whichCommand('xcodebuild')) {
+      results.push({ id: 'native-xcode', status: 'SKIPPED', reason: 'xcodebuild_requires_macos' });
+    } else {
+      const args = [
+        '-project', 'RuViewNLOS.xcodeproj', '-scheme', 'RuViewNLOS', '-sdk', 'iphonesimulator',
+        '-destination', 'generic/platform=iOS Simulator', 'CODE_SIGNING_ALLOWED=NO', 'build',
+      ];
+      results.push(buildResult('native-xcode', ['xcodebuild', ...args], await runCommand('xcodebuild', args, {
+        cwd: join(repo, 'ui/ios-nlos'), timeout: 900000, env: buildEnv,
+      })));
+    }
+  }
+
+  if (present.has('web-ios')) {
+    const mobile = join(repo, 'ui/mobile');
+    if (!existsSync(join(mobile, 'node_modules'))) {
+      results.push({ id: 'web-ios', status: 'SKIPPED', reason: 'node_modules_absent_run_npm_ci' });
+    } else {
+      const commands = [
+        [process.execPath, [join(mobile, 'node_modules/jest/bin/jest.js'), '--runInBand'], 600000, 'web-test'],
+        [process.execPath, [join(mobile, 'node_modules/typescript/bin/tsc'), '--noEmit'], 600000, 'web-types'],
+        [process.execPath, [join(mobile, 'node_modules/eslint/bin/eslint.js'), '.'], 600000, 'web-lint'],
+        [process.execPath, [join(mobile, 'node_modules/expo/bin/cli'), 'export', '--platform', 'web'], 900000, 'web-export'],
+      ];
+      for (const [cmd, args, timeout, id] of commands) {
+        if (!existsSync(args[0])) results.push({ id, status: 'SKIPPED', reason: 'local_tool_unavailable' });
+        else {
+          const env = id === 'web-export'
+            ? { ...buildEnv, CI: '1', EXPO_NO_TELEMETRY: '1', EXPO_OFFLINE: '1' }
+            : buildEnv;
+          results.push(buildResult(id, ['node', ...args], await runCommand(cmd, args, {
+            cwd: mobile, timeout, env,
+          })));
+        }
+      }
+    }
+  }
+  return results;
+}
+
+function number(value, name, { min = 0, max = Infinity, positive = false } = {}) {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return `${name}:must-be-finite-number`;
+  if (positive ? value <= min : value < min) return `${name}:below-minimum`;
+  if (value > max) return `${name}:above-maximum`;
+  return null;
+}
+
+function nearlyEqual(actual, expected) {
+  return Math.abs(actual - expected) <= Math.max(1e-9, Math.abs(expected) * 1e-6);
+}
+
+function isNonzeroSha256(value) {
+  const text = String(value || '');
+  return SHA256.test(text) && !ZERO_SHA256.test(text);
+}
+
+function validateArm(arm, name, pairedSequences, { position = true } = {}) {
+  const findings = [];
+  if (!arm || typeof arm !== 'object' || Array.isArray(arm)) return [`${name}:missing`];
+  const allowedKeys = position ? ARM_KEYS : CSI_ARM_KEYS;
+  for (const key of Object.keys(arm)) {
+    if (!allowedKeys.has(key)) findings.push(`${name}.${key}:unknown-field`);
+  }
+  for (const key of allowedKeys) {
+    if (!(key in arm)) findings.push(`${name}.${key}:missing`);
+  }
+  const numericFindings = [
+    number(arm.update_hz, `${name}.update_hz`, { positive: true, max: 240 }),
+    number(arm.lost_track_rate, `${name}.lost_track_rate`, { max: 1 }),
+    number(arm.evaluable_duration_s, `${name}.evaluable_duration_s`, { positive: true, max: 1e9 }),
+    number(arm.lost_track_duration_s, `${name}.lost_track_duration_s`, { max: 1e9 }),
+    number(arm.evaluable_track_duration_s, `${name}.evaluable_track_duration_s`, { positive: true, max: 1e9 }),
+  ];
+  if (position) numericFindings.push(
+    number(arm.position_error_m, `${name}.position_error_m`, { max: 1000 }),
+    number(arm.position_error_sum_m, `${name}.position_error_sum_m`, { max: 1e12 }),
+  );
+  for (const finding of numericFindings) if (finding) findings.push(finding);
+  for (const [key, min, max] of [
+    ['sequence_count', 1, 1e6],
+    ['accepted_sensor_frame_count', 1, 1e9],
+    ['accepted_update_count', 1, 1e9],
+    ...(position ? [['position_error_sample_count', 1, 1e6]] : []),
+  ]) {
+    if (!Number.isSafeInteger(arm[key]) || arm[key] < min || arm[key] > max) {
+      findings.push(`${name}.${key}:invalid-safe-integer`);
+    }
+  }
+  if (Number.isSafeInteger(pairedSequences) && arm.sequence_count !== pairedSequences) {
+    findings.push(`${name}.sequence_count:must-equal-paired-sequences`);
+  }
+  if (Number.isSafeInteger(arm.accepted_update_count)
+    && Number.isSafeInteger(arm.accepted_sensor_frame_count)
+    && arm.accepted_update_count > arm.accepted_sensor_frame_count) {
+    findings.push(`${name}.accepted_update_count:above-sensor-frame-count`);
+  }
+  if (position && Number.isSafeInteger(arm.position_error_sample_count)
+    && Number.isSafeInteger(arm.accepted_update_count)
+    && arm.position_error_sample_count > arm.accepted_update_count) {
+    findings.push(`${name}.position_error_sample_count:above-update-count`);
+  }
+  if (position && Number.isSafeInteger(pairedSequences)
+    && Number.isSafeInteger(arm.position_error_sample_count)
+    && arm.position_error_sample_count !== pairedSequences) {
+    findings.push(`${name}.position_error_sample_count:must-equal-paired-sequences`);
+  }
+  if (Number.isFinite(arm.lost_track_duration_s)
+    && Number.isFinite(arm.evaluable_track_duration_s)
+    && arm.lost_track_duration_s > arm.evaluable_track_duration_s) {
+    findings.push(`${name}.lost_track_duration_s:above-evaluable-duration`);
+  }
+  if (Number.isSafeInteger(arm.accepted_update_count) && Number.isFinite(arm.evaluable_duration_s)
+    && arm.evaluable_duration_s > 0 && Number.isFinite(arm.update_hz)
+    && !nearlyEqual(arm.update_hz, arm.accepted_update_count / arm.evaluable_duration_s)) {
+    findings.push(`${name}.update_hz:arithmetic-mismatch`);
+  }
+  if (position && Number.isSafeInteger(arm.position_error_sample_count) && arm.position_error_sample_count > 0
+    && Number.isFinite(arm.position_error_sum_m) && Number.isFinite(arm.position_error_m)
+    && !nearlyEqual(arm.position_error_m, arm.position_error_sum_m / arm.position_error_sample_count)) {
+    findings.push(`${name}.position_error_m:arithmetic-mismatch`);
+  }
+  if (Number.isFinite(arm.lost_track_duration_s) && Number.isFinite(arm.evaluable_track_duration_s)
+    && arm.evaluable_track_duration_s > 0 && Number.isFinite(arm.lost_track_rate)
+    && !nearlyEqual(arm.lost_track_rate, arm.lost_track_duration_s / arm.evaluable_track_duration_s)) {
+    findings.push(`${name}.lost_track_rate:arithmetic-mismatch`);
+  }
+  return findings;
+}
+
+function validateConfidence(confidence) {
+  const findings = [];
+  if (!confidence || typeof confidence !== 'object' || Array.isArray(confidence)) return ['confidence:missing'];
+  for (const key of Object.keys(confidence)) {
+    if (!CONFIDENCE_KEYS.has(key)) findings.push(`confidence.${key}:unknown-field`);
+  }
+  for (const key of CONFIDENCE_KEYS) {
+    if (!(key in confidence)) findings.push(`confidence.${key}:missing`);
+  }
+  if (!Number.isSafeInteger(confidence.bootstrap_resamples)
+    || confidence.bootstrap_resamples < 10_000 || confidence.bootstrap_resamples > 10_000_000) {
+    findings.push('confidence.bootstrap_resamples:out-of-range');
+  }
+  if (!isNonzeroSha256(confidence.bootstrap_seed_list_sha256)) {
+    findings.push('confidence.bootstrap_seed_list_sha256:invalid');
+  }
+  for (const finding of [
+    number(confidence.familywise_confidence_level, 'confidence.familywise_confidence_level', { min: 0.975, max: 1 }),
+    number(confidence.position_error_reduction_lower, 'confidence.position_error_reduction_lower', { min: -100, max: 1 }),
+    number(confidence.position_error_reduction_upper, 'confidence.position_error_reduction_upper', { min: -100, max: 1 }),
+    number(confidence.lost_track_reduction_lower, 'confidence.lost_track_reduction_lower', { min: -100, max: 1 }),
+    number(confidence.lost_track_reduction_upper, 'confidence.lost_track_reduction_upper', { min: -100, max: 1 }),
+  ]) if (finding) findings.push(finding);
+  if (Number.isFinite(confidence.position_error_reduction_lower)
+    && Number.isFinite(confidence.position_error_reduction_upper)
+    && confidence.position_error_reduction_lower > confidence.position_error_reduction_upper) {
+    findings.push('confidence.position_error_reduction:interval-inverted');
+  }
+  if (Number.isFinite(confidence.lost_track_reduction_lower)
+    && Number.isFinite(confidence.lost_track_reduction_upper)
+    && confidence.lost_track_reduction_lower > confidence.lost_track_reduction_upper) {
+    findings.push('confidence.lost_track_reduction:interval-inverted');
+  }
+  return findings;
+}
+
+function validateGuardrails(guardrails) {
+  const findings = [];
+  if (!guardrails || typeof guardrails !== 'object' || Array.isArray(guardrails)) return ['guardrails:missing'];
+  for (const key of Object.keys(guardrails)) {
+    if (!GUARDRAIL_KEYS.has(key)) findings.push(`guardrails.${key}:unknown-field`);
+  }
+  for (const key of GUARDRAIL_KEYS) {
+    if (!(key in guardrails)) findings.push(`guardrails.${key}:missing`);
+  }
+  for (const finding of [
+    number(guardrails.empty_false_track_rate, 'guardrails.empty_false_track_rate', { max: 1 }),
+    number(guardrails.empty_false_track_rate_max, 'guardrails.empty_false_track_rate_max', { max: 1 }),
+    number(guardrails.fused_p95_latency_ms, 'guardrails.fused_p95_latency_ms', { max: 60_000 }),
+    number(guardrails.fused_p95_latency_max_ms, 'guardrails.fused_p95_latency_max_ms', { positive: true, max: 60_000 }),
+    number(guardrails.fused_frame_loss_rate, 'guardrails.fused_frame_loss_rate', { max: 1 }),
+    number(guardrails.fused_frame_loss_rate_max, 'guardrails.fused_frame_loss_rate_max', { max: 1 }),
+    number(guardrails.exclusion_fraction, 'guardrails.exclusion_fraction', { max: 1 }),
+    number(guardrails.exclusion_fraction_max, 'guardrails.exclusion_fraction_max', { max: 1 }),
+    number(guardrails.fused_update_rate_ratio_min, 'guardrails.fused_update_rate_ratio_min', { max: 1 }),
+    number(guardrails.nonwinning_position_error_regression_max, 'guardrails.nonwinning_position_error_regression_max', { max: 10 }),
+    number(guardrails.nonwinning_lost_track_regression_max, 'guardrails.nonwinning_lost_track_regression_max', { max: 10 }),
+  ]) if (finding) findings.push(finding);
+  for (const [value, limit, label] of [
+    ['empty_false_track_rate', 'empty_false_track_rate_max', 'empty_false_track_rate'],
+    ['fused_p95_latency_ms', 'fused_p95_latency_max_ms', 'fused_p95_latency_ms'],
+    ['fused_frame_loss_rate', 'fused_frame_loss_rate_max', 'fused_frame_loss_rate'],
+    ['exclusion_fraction', 'exclusion_fraction_max', 'exclusion_fraction'],
+  ]) {
+    if (Number.isFinite(guardrails[value]) && Number.isFinite(guardrails[limit])
+      && guardrails[value] > guardrails[limit]) findings.push(`guardrails.${label}:above-frozen-limit`);
+  }
+  return findings;
+}
+
+/** Validate a preregistered, real-hardware comparison. Never accepts replay-only evidence. */
+export function evaluateResearchEvidence(evidence) {
+  if (evidence === null || evidence === undefined) {
+    return {
+      status: 'NOT_EVALUATED', pass: false,
+      reason: 'no_evidence_file',
+      note: 'Software or replay validation is not real-hardware NLOS evidence.',
+    };
+  }
+  const findings = [];
+  if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence)) findings.push('evidence:must-be-object');
+  if (findings.length) return { status: 'FAIL', pass: false, findings };
+
+  for (const key of Object.keys(evidence)) {
+    if (!EVIDENCE_KEYS.has(key)) findings.push(`${key}:unknown-field`);
+  }
+  for (const key of EVIDENCE_KEYS) {
+    if (!(key in evidence)) findings.push(`${key}:missing`);
+  }
+
+  if (evidence.schema !== NLOS_EVIDENCE_SCHEMA) findings.push('schema:mismatch');
+  if (evidence.source !== 'LIVE_HARDWARE') findings.push('source:must-be-LIVE_HARDWARE');
+  if (evidence.claim_tag !== 'MEASURED') findings.push('claim_tag:must-be-MEASURED');
+  if (evidence.evidence_level !== 'L2') findings.push('evidence_level:must-be-L2');
+  if (evidence.ground_truth !== 'EXTERNAL') findings.push('ground_truth:must-be-EXTERNAL');
+  if (evidence.protocol_frozen_before_capture !== true) findings.push('protocol:not-preregistered');
+  for (const field of [
+    'witness_reviewed', 'privacy_review_passed', 'security_review_passed',
+    'los_exclusion_verified', 'independent_csi_verified',
+  ]) if (evidence[field] !== true) findings.push(`${field}:must-be-true`);
+  if (!SAFE_LABEL.test(String(evidence.sensor_model || ''))) findings.push('sensor_model:invalid');
+  if (evidence.sensor_model !== NLOS_REFERENCE_SENSOR_MODEL) {
+    findings.push(`sensor_model:v1-requires-${NLOS_REFERENCE_SENSOR_MODEL}`);
+  }
+  if (evidence.transient_kind !== 'COMPACT_NORMALIZED_HISTOGRAM'
+    && evidence.transient_kind !== 'RAW_PHOTON_HISTOGRAM') {
+    findings.push('transient_kind:unsupported');
+  }
+  const sensorRateFinding = number(
+    evidence.sensor_configured_max_hz, 'sensor_configured_max_hz', { positive: true, max: 60 },
+  );
+  if (sensorRateFinding) findings.push(sensorRateFinding);
+  if (!GIT_SHA1.test(String(evidence.upstream_commit || ''))
+    || ZERO_GIT_SHA1.test(String(evidence.upstream_commit || ''))) {
+    findings.push('upstream_commit:expected-nonzero-full-sha1');
+  } else if (evidence.upstream_commit !== NLOS_UPSTREAM_COMMIT) {
+    findings.push('upstream_commit:must-match-pinned-baseline');
+  }
+  for (const field of [
+    'protocol_sha256', 'capture_manifest_sha256', 'sensor_identity_sha256',
+    'calibration_sha256', 'firmware_sha256', 'analysis_sha256',
+    'endpoint_pairing_sha256',
+    'sensor_configuration_sha256', 'witness_report_sha256', 'privacy_review_sha256',
+    'security_review_sha256', 'guardrail_report_sha256',
+    'csi_capture_manifest_sha256', 'csi_sensor_identity_sha256', 'csi_calibration_sha256',
+  ]) if (!isNonzeroSha256(evidence[field])) findings.push(`${field}:invalid-or-zero`);
+  if (evidence.synthetic_frames !== 0) findings.push('synthetic_frames:must-be-zero');
+  if (evidence.replay_frames !== 0) findings.push('replay_frames:must-be-zero');
+  if (!Number.isSafeInteger(evidence.paired_sequences)
+    || evidence.paired_sequences < 100 || evidence.paired_sequences > 1_000_000) {
+    findings.push('paired_sequences:out-of-range');
+  }
+  if (!Number.isSafeInteger(evidence.csi_source_count)
+    || evidence.csi_source_count < 1 || evidence.csi_source_count > 256) {
+    findings.push('csi_source_count:out-of-range');
+  }
+  if (!Number.isSafeInteger(evidence.offered_optical_frame_count)
+    || evidence.offered_optical_frame_count < 1 || evidence.offered_optical_frame_count > 1_000_000_000) {
+    findings.push('offered_optical_frame_count:out-of-range');
+  }
+  findings.push(...validateArm(evidence.lidar_only, 'lidar_only', evidence.paired_sequences));
+  findings.push(...validateArm(evidence.csi_only, 'csi_only', evidence.paired_sequences, { position: false }));
+  findings.push(...validateArm(evidence.fused, 'fused', evidence.paired_sequences));
+  findings.push(...validateConfidence(evidence.confidence));
+  findings.push(...validateGuardrails(evidence.guardrails));
+  for (const name of ['lidar_only', 'fused']) {
+    const arm = evidence[name];
+    if (arm && Number.isFinite(arm.evaluable_duration_s) && arm.evaluable_duration_s > 0
+      && Number.isSafeInteger(arm.accepted_sensor_frame_count)
+      && Number.isFinite(evidence.sensor_configured_max_hz)
+      && arm.accepted_sensor_frame_count / arm.evaluable_duration_s > evidence.sensor_configured_max_hz + 1e-6) {
+      findings.push(`${name}.accepted_sensor_frame_rate:above-configured-maximum`);
+    }
+    if (arm && Number.isSafeInteger(arm.accepted_sensor_frame_count)
+      && Number.isSafeInteger(evidence.offered_optical_frame_count)
+      && arm.accepted_sensor_frame_count > evidence.offered_optical_frame_count) {
+      findings.push(`${name}.accepted_sensor_frame_count:above-offered-count`);
+    }
+  }
+  if (evidence.lidar_only && Number.isSafeInteger(evidence.offered_optical_frame_count)
+    && Number.isFinite(evidence.lidar_only.evaluable_duration_s)
+    && evidence.lidar_only.evaluable_duration_s > 0
+    && Number.isFinite(evidence.sensor_configured_max_hz)
+    && evidence.offered_optical_frame_count / evidence.lidar_only.evaluable_duration_s
+      > evidence.sensor_configured_max_hz + 1e-6) {
+    findings.push('offered_optical_frame_rate:above-configured-maximum');
+  }
+  if (evidence.fused && evidence.guardrails
+    && Number.isSafeInteger(evidence.offered_optical_frame_count)
+    && evidence.offered_optical_frame_count > 0
+    && Number.isSafeInteger(evidence.fused.accepted_sensor_frame_count)
+    && Number.isFinite(evidence.guardrails.fused_frame_loss_rate)) {
+    const measuredLoss = (evidence.offered_optical_frame_count
+      - evidence.fused.accepted_sensor_frame_count) / evidence.offered_optical_frame_count;
+    if (!nearlyEqual(evidence.guardrails.fused_frame_loss_rate, measuredLoss)) {
+      findings.push('guardrails.fused_frame_loss_rate:arithmetic-mismatch');
+    }
+  }
+  if (evidence.lidar_only && evidence.fused
+    && !nearlyEqual(evidence.lidar_only.evaluable_duration_s, evidence.fused.evaluable_duration_s)) {
+    findings.push('paired_optical_evaluable_duration:mismatch');
+  }
+  if (evidence.lidar_only && evidence.fused
+    && !nearlyEqual(evidence.lidar_only.evaluable_track_duration_s, evidence.fused.evaluable_track_duration_s)) {
+    findings.push('lost_track_endpoint_pairing:evaluable-duration-mismatch');
+  }
+  if (evidence.lidar_only && evidence.fused
+    && evidence.lidar_only.position_error_sample_count !== evidence.fused.position_error_sample_count) {
+    findings.push('position_endpoint_pairing:sample-count-mismatch');
+  }
+  if (evidence.lidar_only && evidence.fused && evidence.guardrails) {
+    const updateRatio = evidence.lidar_only.update_hz > 0
+      ? evidence.fused.update_hz / evidence.lidar_only.update_hz : 0;
+    const positionRegression = evidence.lidar_only.position_error_m > 0
+      ? Math.max(0, (evidence.fused.position_error_m - evidence.lidar_only.position_error_m)
+        / evidence.lidar_only.position_error_m)
+      : (evidence.fused.position_error_m > 0 ? Infinity : 0);
+    const lostRegression = evidence.lidar_only.lost_track_rate > 0
+      ? Math.max(0, (evidence.fused.lost_track_rate - evidence.lidar_only.lost_track_rate)
+        / evidence.lidar_only.lost_track_rate)
+      : (evidence.fused.lost_track_rate > 0 ? Infinity : 0);
+    if (Number.isFinite(evidence.guardrails.fused_update_rate_ratio_min)
+      && updateRatio < evidence.guardrails.fused_update_rate_ratio_min) {
+      findings.push('guardrails.fused_update_rate_ratio:below-frozen-limit');
+    }
+    if (Number.isFinite(evidence.guardrails.nonwinning_position_error_regression_max)
+      && positionRegression > evidence.guardrails.nonwinning_position_error_regression_max) {
+      findings.push('guardrails.position_error_regression:above-frozen-limit');
+    }
+    if (Number.isFinite(evidence.guardrails.nonwinning_lost_track_regression_max)
+      && lostRegression > evidence.guardrails.nonwinning_lost_track_regression_max) {
+      findings.push('guardrails.lost_track_regression:above-frozen-limit');
+    }
+  }
+  if (findings.length) return { status: 'FAIL', pass: false, findings };
+
+  const baseError = evidence.lidar_only.position_error_m;
+  const fusedError = evidence.fused.position_error_m;
+  const baseLost = evidence.lidar_only.lost_track_rate;
+  const fusedLost = evidence.fused.lost_track_rate;
+  const positionErrorReduction = baseError > 0 ? (baseError - fusedError) / baseError : 0;
+  const lostTrackReduction = baseLost > 0 ? (baseLost - fusedLost) / baseLost : 0;
+  const reproductionPass = evidence.lidar_only.update_hz >= 27;
+  const positionEndpointPass = positionErrorReduction >= 0.25
+    && evidence.confidence.position_error_reduction_lower > 0
+    && positionErrorReduction >= evidence.confidence.position_error_reduction_lower
+    && positionErrorReduction <= evidence.confidence.position_error_reduction_upper;
+  const lostTrackEndpointPass = lostTrackReduction >= 0.25
+    && evidence.confidence.lost_track_reduction_lower > 0
+    && lostTrackReduction >= evidence.confidence.lost_track_reduction_lower
+    && lostTrackReduction <= evidence.confidence.lost_track_reduction_upper;
+  const fusionPass = positionEndpointPass || lostTrackEndpointPass;
+  const pass = reproductionPass && fusionPass;
+  return {
+    status: pass ? 'PASS' : 'FAIL',
+    pass,
+    reproduction: {
+      pass: reproductionPass,
+      threshold_hz: 27,
+      measured_hz: evidence.lidar_only.update_hz,
+      label: 'MEASURED',
+    },
+    fusion: {
+      pass: fusionPass,
+      measured_hz: evidence.fused.update_hz,
+      threshold_fraction: 0.25,
+      position_error_reduction: positionErrorReduction,
+      lost_track_reduction: lostTrackReduction,
+      position_endpoint_pass: positionEndpointPass,
+      lost_track_endpoint_pass: lostTrackEndpointPass,
+      adjusted_confidence_level: evidence.confidence.familywise_confidence_level,
+      rule: 'position_error_reduction OR lost_track_reduction',
+      label: 'MEASURED',
+    },
+    paired_sequences: evidence.paired_sequences,
+    capture_manifest_sha256: evidence.capture_manifest_sha256,
+    claim_tag: evidence.claim_tag,
+    evidence_level: evidence.evidence_level,
+  };
+}
+
+function readEvidence(repo, evidenceFile) {
+  if (!evidenceFile) return { evidence: null, path: null };
+  const candidate = resolve(repo, String(evidenceFile));
+  if (!existsSync(candidate)) throw new Error('evidence_file_missing');
+  const canonicalRepo = realpathSync(repo);
+  const canonicalFile = realpathSync(candidate);
+  const rel = relative(canonicalRepo, canonicalFile);
+  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error('evidence_file_outside_repo');
+  const stat = statSync(canonicalFile);
+  if (!stat.isFile()) throw new Error('evidence_file_not_regular');
+  if (stat.size > MAX_EVIDENCE_BYTES) throw new Error('evidence_file_too_large');
+  let evidence;
+  try { evidence = JSON.parse(readFileSync(canonicalFile, 'utf8')); }
+  catch { throw new Error('evidence_file_malformed_json'); }
+  return { evidence, path: rel.replaceAll('\\', '/') };
+}
+
+export function makeNlosPlan({ repoRoot = null } = {}) {
+  return {
+    ok: true,
+    advisory: true,
+    title: 'RuView consumer NLOS implementation plan',
+    invariant: 'Preserve per-zone photon timing histograms; processed depth maps cannot substitute for transient samples.',
+    phases: [
+      {
+        id: 1, name: 'Upstream reproduction',
+        input: `Pinned ${NLOS_REFERENCE_SENSOR_MODEL} baseline at ${NLOS_UPSTREAM_COMMIT} with verified compact normalized histogram access and recorded silicon identity`,
+        exit: 'LIVE_HARDWARE hidden-target tracking at >=27 Hz with frozen capture provenance',
+      },
+      {
+        id: 2, name: 'RuView temporal state',
+        input: 'Calibrated transient frames, pose, wall geometry, and canonical target response',
+        exit: 'ruview.nlos.track.v1 hypotheses with covariance, freshness, calibration, and evidence labels',
+      },
+      {
+        id: 3, name: 'CSI fusion',
+        input: 'Synchronized optical likelihood and CSI likelihood in one world frame',
+        exit: 'Paired preregistered comparison; >=25% lower position error OR lost-track rate',
+      },
+      {
+        id: 4, name: 'Native and web iOS adapters',
+        input: 'Authenticated versioned RuView tracks; ARKit scene depth only as pose/context unless raw transients become public',
+        exit: 'Native build and authenticated web transport/replay pass without an iPhone-NLOS claim',
+      },
+    ],
+    surfaces: SURFACES.map(({ id, base, marker }) => ({ id, base, marker })),
+    verifier: {
+      static: 'ruview nlos verify --repo <root>',
+      builds: 'ruview nlos verify --repo <root> --run-builds',
+      research: `ruview nlos verify --repo <root> --evidence-file <${NLOS_EVIDENCE_SCHEMA}.json> --require-research-pass`,
+    },
+    repo_detected: Boolean(repoRoot),
+    repo_root: repoRoot,
+  };
+}
+
+export async function verifyNlos(args = {}, {
+  repoRoot = null,
+  source = 'internal',
+  runCommand = null,
+  whichCommand = null,
+} = {}) {
+  if (source === 'mcp' && (args.repo !== undefined || args.run_builds === true)) {
+    return { ok: false, reason: 'cli_only_repo_or_builds', advisory: true };
+  }
+  const repo = args.repo ? resolve(args.repo) : repoRoot;
+  if (!repo) return { ok: false, reason: 'not_in_ruview_repo' };
+  const isRepo = existsSync(join(repo, 'v2/Cargo.toml'))
+    || existsSync(join(repo, 'archive/v1/data/proof/verify.py'));
+  if (!isRepo) return { ok: false, reason: 'not_in_ruview_repo' };
+
+  const surfaces = SURFACES.map((surface) => inspectSurface(repo, surface));
+  const malformed = surfaces.filter((surface) => surface.status === 'MALFORMED');
+  let loaded;
+  try { loaded = readEvidence(repo, args.evidence_file); }
+  catch (error) {
+    return { ok: false, reason: String(error.message || error), surfaces, advisory: true };
+  }
+  const research = evaluateResearchEvidence(loaded.evidence);
+  if (args.run_builds === true && (!runCommand || !whichCommand)) {
+    return { ok: false, reason: 'build_executor_unavailable', surfaces, advisory: true };
+  }
+  const builds = args.run_builds === true
+    ? await runBuilds(repo, surfaces, { runCommand, whichCommand })
+    : [];
+  const buildFailures = builds.filter((result) => result.status === 'FAIL');
+  const requireResearch = args.require_research_pass === true;
+  const evidenceSupplied = loaded.path !== null;
+  const researchMustPass = requireResearch || evidenceSupplied;
+  const ok = malformed.length === 0 && buildFailures.length === 0
+    && (!researchMustPass || research.pass);
+  const completedBuilds = builds.filter((result) => result.status !== 'SKIPPED');
+  let softwareStatus = 'STATIC_DISCOVERY_ONLY';
+  if (malformed.length || buildFailures.length) softwareStatus = 'FAIL';
+  else if (args.run_builds && builds.length === 0) softwareStatus = 'NO_PRESENT_BUILD_SURFACES';
+  else if (args.run_builds && completedBuilds.length === 0) softwareStatus = 'NO_BUILD_TOOLCHAINS_AVAILABLE';
+  else if (args.run_builds && builds.some((result) => result.status === 'SKIPPED')) {
+    softwareStatus = 'AVAILABLE_CHECKS_PASS_WITH_SKIPS';
+  } else if (args.run_builds) softwareStatus = 'AVAILABLE_CHECKS_PASS';
+
+  return {
+    ok,
+    advisory: true,
+    meta_harness_required_by_runtime: false,
+    track_schema: NLOS_TRACK_SCHEMA,
+    surfaces,
+    software_gate: {
+      status: softwareStatus,
+      malformed: malformed.map((surface) => surface.id),
+      build_failures: buildFailures.map((result) => result.id),
+      builds,
+    },
+    research_gate: { ...research, evidence_file: loaded.path },
+    note: 'Static discovery and available-build results are advisory subsets of Gate A. They are never hardware or release validation.',
+    build_authority: args.run_builds ? 'OPT_IN_LOCAL_CLI_TRUSTED_CHECKOUT' : 'NONE',
+  };
+}
@@ -9,6 +9,9 @@ export const TOOL_POLICY = Object.freeze({
  ruview_calibrate: { class: 'workspace-write', writesWorkspace: true, confirmField: 'confirm' },
  ruview_node_flash: { class: 'hardware-write', writesWorkspace: true, hardware: true, confirmField: 'confirm' },
  ruview_guidance: { class: 'read', readOnly: true },
+  ruview_nlos_plan: { class: 'read', readOnly: true },
+  ruview_nlos_verify: { class: 'execute', readOnly: true },
+  ruview_spaces_list: { class: 'external-read', readOnly: true, requiredGrant: 'credential-use', openWorld: true, usesCredentials: true, mayRefreshCredentials: true },
  ruview_memory_search: { class: 'read', readOnly: true },
 });

@@ -52,11 +55,15 @@ export function validateArguments(schema, value, path = '$') {
 export function authorizeTool(name, args, context = {}) {
  const policy = TOOL_POLICY[name] || { class: 'unknown', denied: true };
  if (policy.denied) return { ok: false, reason: 'policy_missing', policy };
-  if (context.source !== 'mcp' || policy.readOnly) return { ok: true, policy };
+  if (context.source !== 'mcp') return { ok: true, policy };
+  const grants = new Set(context.grants || []);
+  if (policy.requiredGrant && !grants.has(policy.requiredGrant)) {
+    return { ok: false, reason: 'authority_denied', requiredGrant: policy.requiredGrant, policy };
+  }
+  if (policy.readOnly) return { ok: true, policy };
  if (policy.confirmField && args?.[policy.confirmField] !== true) {
    return { ok: false, reason: 'not_confirmed', policy };
  }
-  const grants = new Set(context.grants || []);
  if (!grants.has(policy.class)) return { ok: false, reason: 'authority_denied', requiredGrant: policy.class, policy };
  return { ok: true, policy };
 }
@@ -64,9 +71,9 @@ export function authorizeTool(name, args, context = {}) {
 export function mcpAnnotations(name) {
  const policy = TOOL_POLICY[name] || {};
  return {
-    readOnlyHint: policy.readOnly === true,
+    readOnlyHint: policy.readOnly === true && policy.mayRefreshCredentials !== true,
    destructiveHint: policy.writesWorkspace === true || policy.hardware === true,
-    idempotentHint: policy.readOnly === true,
-    openWorldHint: false,
+    idempotentHint: policy.readOnly === true && policy.mayRefreshCredentials !== true,
+    openWorldHint: policy.openWorld === true,
  };
 }
@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: MIT
+// Cognitum Spaces adapter for the dependency-free RuView metaharness.
+//
+// OAuth stays in the Rust `wifi-densepose` CLI. This adapter never accepts a
+// bearer token or API key, strips the compatibility API-key environment from
+// the child, and validates the already-validated semantic projection again
+// before returning it to a CLI or MCP caller.
+
+import { DEFAULT_ENV_ALLOWLIST, runProcess } from './process-runner.js';
+import { redact } from './redact.js';
+
+const DEFAULT_BASE_URL = 'https://api.cognitum.one';
+const MAX_CLI_JSON_BYTES = 2 * 1024 * 1024;
+const MAX_JSON_DEPTH = 16;
+const MAX_JSON_NODES = 10_000;
+const MAX_ARRAY_ITEMS = 1000;
+const MAX_OBJECT_KEYS = 128;
+const MAX_STRING_BYTES = 4096;
+const MAX_RESOURCES = 100;
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,119}$/;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export const SPATIAL_RESOURCE_KINDS = Object.freeze([
+  'sites', 'buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts',
+]);
+const REQUIRED_EXCLUSIONS = Object.freeze([
+  'raw_csi',
+  'cir',
+  'rf_tensors',
+  'recordings',
+  'pose_frames',
+  'vital_waveforms',
+  'identity_observations',
+]);
+const FORBIDDEN_FIELDS = new Set([
+  ...REQUIRED_EXCLUSIONS.map(normalizeField),
+  'csi', 'channelstateinformation', 'rawcir', 'channelimpulseresponse',
+  'rftensor', 'rftensors', 'packetcapture', 'packetcaptures', 'pcap', 'recording', 'recordings', 'audiorecording',
+  'videorecording', 'poseframe', 'skeleton', 'keypoints', 'vitalwaveform',
+  'heartratewaveform', 'identityobservation', 'biometric', 'biometrics', 'face', 'faces', 'faceembedding',
+]);
+const SPACES_ENV_ALLOWLIST = Object.freeze([
+  ...DEFAULT_ENV_ALLOWLIST,
+  // Operators may bind an MCP server to a credential file without putting a
+  // secret or an arbitrary file path in tool-call arguments.
+  'RUVIEW_CREDENTIALS_PATH',
+]);
+
+function normalizeField(value) {
+  return String(value).replace(/[^a-z0-9]/gi, '').toLowerCase();
+}
+
+function assertBoundedValue(value, depth = 0, state = { nodes: 0 }) {
+  state.nodes += 1;
+  if (state.nodes > MAX_JSON_NODES) throw new Error('JSON structure exceeds node bound');
+  if (depth > MAX_JSON_DEPTH) throw new Error('JSON nesting is too deep');
+  if (typeof value === 'string') {
+    if (Buffer.byteLength(value, 'utf8') > MAX_STRING_BYTES) throw new Error('string exceeds bound');
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > MAX_ARRAY_ITEMS) throw new Error('array exceeds bound');
+    for (const item of value) assertBoundedValue(item, depth + 1, state);
+    return;
+  }
+  if (!value || typeof value !== 'object') return;
+  const entries = Object.entries(value);
+  if (entries.length > MAX_OBJECT_KEYS) throw new Error('object exceeds bound');
+  for (const [key, item] of entries) {
+    if (Buffer.byteLength(key, 'utf8') > MAX_STRING_BYTES) throw new Error('object key exceeds bound');
+    if (FORBIDDEN_FIELDS.has(normalizeField(key))) throw new Error(`forbidden raw field: ${key}`);
+    assertBoundedValue(item, depth + 1, state);
+  }
+}
+
+function nonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+
+/** Parse and independently enforce the metaharness semantic boundary. */
+export function parseSpacesOutput(stdout, expectedKind = undefined) {
+  if (Buffer.byteLength(String(stdout), 'utf8') > MAX_CLI_JSON_BYTES) {
+    throw new Error('CLI response exceeds bound');
+  }
+  let response;
+  try {
+    response = JSON.parse(String(stdout));
+  } catch {
+    throw new Error('CLI response is not JSON');
+  }
+  assertBoundedValue(response);
+  if (!response || response.object !== 'list' || !Array.isArray(response.data) || response.data.length > MAX_RESOURCES) {
+    throw new Error('invalid list envelope');
+  }
+  const versioned = response.schemaVersion !== undefined || response.kind !== undefined;
+  if (versioned && (response.schemaVersion !== '1.0' || !SPATIAL_RESOURCE_KINDS.includes(response.kind)
+    || (expectedKind !== undefined && response.kind !== expectedKind))) {
+    throw new Error('invalid spatial contract version or kind');
+  }
+  const boundary = response.boundary;
+  if (!boundary || boundary.authoritativeState !== 'HomeCore Edge' || !Array.isArray(boundary.excluded)
+    || !boundary.excluded.every((item) => typeof item === 'string')) {
+    throw new Error('incomplete edge privacy boundary');
+  }
+  for (const required of REQUIRED_EXCLUSIONS) {
+    if (!boundary.excluded.includes(required)) throw new Error('incomplete edge privacy boundary');
+  }
+  for (const item of response.data) {
+    if (!item || !ID_RE.test(String(item.id ?? '')) || !nonEmptyString(item.tenantId)) {
+      throw new Error('spatial identity is incomplete');
+    }
+    if (!['P2', 'P3'].includes(item.privacy)) {
+      throw new Error('non-semantic privacy class');
+    }
+    const confidence = versioned ? item.confidence : item.state?.confidence;
+    if (confidence !== null && confidence !== undefined
+      && (typeof confidence !== 'number' || !Number.isFinite(confidence) || confidence < 0 || confidence > 1)) {
+      throw new Error('invalid confidence');
+    }
+    if (!versioned) {
+      if (!nonEmptyString(item.siteId) || !nonEmptyString(item.name) || item.state?.classification !== 'P2') {
+        throw new Error('space identity is incomplete');
+      }
+      continue;
+    }
+    if (!UUID_RE.test(String(item.workspaceId ?? '')) || item.kind !== response.kind
+      || item.schemaVersion !== '1.0' || !nonEmptyString(item.messageId)
+      || !Number.isSafeInteger(item.eventSequence) || item.eventSequence < 0
+      || !Number.isSafeInteger(item.version) || item.version < 1
+      || !nonEmptyString(item.observedAt) || !Number.isFinite(Date.parse(item.observedAt))
+      || (item.expiresAt !== null && item.expiresAt !== undefined
+        && (!nonEmptyString(item.expiresAt) || !Number.isFinite(Date.parse(item.expiresAt))))
+      || !item.attributes || Array.isArray(item.attributes) || typeof item.attributes !== 'object'
+      || !item.provenance || Array.isArray(item.provenance) || typeof item.provenance !== 'object') {
+      throw new Error('versioned spatial identity is incomplete');
+    }
+    if (['buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts'].includes(response.kind)
+      && !nonEmptyString(item.siteId)) throw new Error('spatial parent is incomplete');
+    if (response.kind === 'floors' && !nonEmptyString(item.buildingId)) throw new Error('spatial parent is incomplete');
+    if (response.kind === 'spaces' && (!nonEmptyString(item.buildingId) || !nonEmptyString(item.floorId))) {
+      throw new Error('spatial parent is incomplete');
+    }
+    if (['zones', 'entities', 'events', 'alerts'].includes(response.kind) && !nonEmptyString(item.spaceId)) {
+      throw new Error('spatial parent is incomplete');
+    }
+    if (response.kind === 'entities'
+      && (!['sensor', 'person', 'object', 'track'].includes(item.entityType)
+        || (['person', 'track'].includes(item.entityType) && item.identityMode !== 'anonymous'))) {
+      throw new Error('entity privacy contract is invalid');
+    }
+    if (response.kind === 'events' && !nonEmptyString(item.eventType)) throw new Error('event type is missing');
+    if (response.kind === 'alerts'
+      && (!nonEmptyString(item.alertType) || !['info', 'warning', 'critical'].includes(item.severity)
+        || !['open', 'acknowledged', 'resolved'].includes(item.status))) {
+      throw new Error('alert contract is invalid');
+    }
+  }
+  if (versioned && response.nextCursor !== null && response.nextCursor !== undefined
+    && (!nonEmptyString(response.nextCursor) || response.nextCursor.length > 512
+      || /[\u0000-\u001f\u007f]/u.test(response.nextCursor))) {
+    throw new Error('invalid next cursor');
+  }
+  return response;
+}
+
+function commandFailure(error, env) {
+  const detail = redact(error?.message || error, { env }).slice(0, 1000);
+  if (/lacks spaces:read/i.test(detail)) return { reason: 'spaces_scope_missing', detail };
+  if (/no stored credentials|not logged in/i.test(detail)) return { reason: 'not_logged_in', detail };
+  if (/refresh/i.test(detail)) return { reason: 'oauth_refresh_failed', detail };
+  if (/rejected the credential|\b401\b|\b403\b/i.test(detail)) return { reason: 'authentication_failed', detail };
+  return { reason: 'spaces_command_failed', detail };
+}
+
+/**
+ * List Cognitum Spaces through the hardened Rust client.
+ *
+ * `binary` and `execute` are injectable so tests never need a real credential
+ * or network. Production callers must pass a discovered installed binary; the
+ * credentialed path never executes build scripts from an auto-detected repo.
+ */
+export async function listCognitumSpaces(input = {}, options = {}) {
+  const source = options.source || 'library';
+  if (source === 'mcp' && input.credentials_path !== undefined) {
+    return {
+      ok: false,
+      reason: 'credentials_path_not_allowed',
+      hint: 'Set RUVIEW_CREDENTIALS_PATH in the MCP server environment; credential paths are not accepted from tool calls.',
+    };
+  }
+
+  const resource = input.resource || 'spaces';
+  if (!SPATIAL_RESOURCE_KINDS.includes(resource)) {
+    return { ok: false, reason: 'invalid_resource' };
+  }
+  const limit = input.limit === undefined ? 50 : input.limit;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+    return { ok: false, reason: 'invalid_limit' };
+  }
+  if (input.cursor !== undefined
+    && (typeof input.cursor !== 'string' || input.cursor.length === 0 || input.cursor.length > 512 || /[\u0000-\u001f\u007f]/u.test(input.cursor))) {
+    return { ok: false, reason: 'invalid_cursor' };
+  }
+  const spacesArgs = [
+    'spaces', '--json', '--base-url', DEFAULT_BASE_URL,
+    '--resource', resource, '--limit', String(limit),
+  ];
+  if (input.cursor) spacesArgs.push('--cursor', input.cursor);
+  if (input.credentials_path) spacesArgs.push('--credentials-path', input.credentials_path);
+
+  let command;
+  let args;
+  let via;
+  if (options.binary) {
+    command = options.binary;
+    args = spacesArgs;
+    via = 'binary';
+  } else {
+    return {
+      ok: false,
+      reason: 'cli_missing',
+      hint: 'Install the wifi-densepose binary; credentialed metaharness calls never execute Cargo build scripts.',
+    };
+  }
+
+  const execute = options.execute || runProcess;
+  let result;
+  try {
+    result = await execute(command, args, {
+      timeoutMs: 120_000,
+      maxOutputBytes: MAX_CLI_JSON_BYTES,
+      env: options.env || process.env,
+      envAllowlist: SPACES_ENV_ALLOWLIST,
+    });
+  } catch (error) {
+    return { ok: false, authentication: 'oauth', via, ...commandFailure(error, options.env || process.env) };
+  }
+
+  let response;
+  try {
+    response = parseSpacesOutput(result.stdout, resource);
+  } catch (error) {
+    return {
+      ok: false,
+      authentication: 'oauth',
+      via,
+      reason: 'invalid_spaces_output',
+      detail: String(error.message).slice(0, 300),
+    };
+  }
+  return {
+    ok: true,
+    authentication: 'oauth',
+    via,
+    count: response.data.length,
+    resource,
+    schemaVersion: response.schemaVersion,
+    nextCursor: response.nextCursor ?? null,
+    data: response.data,
+    boundary: response.boundary,
+    authority: 'Read-only tenant/workspace projection; this result grants no action, write, pairing, or actuator authority.',
+    credentialSideEffect: 'An expired OAuth session may rotate and persist its refresh credential before the read returns.',
+  };
+}
@@ -20,6 +20,8 @@ import { claimCheck, summarize } from './guardrails.js';
 import { authorizeTool, mcpAnnotations, validateArguments } from './policy.js';
 import { searchBrain } from './brain.js';
 import { getGuidance, GUIDANCE_TOPICS } from './guidance.js';
+import { listCognitumSpaces } from './spaces.js';
+import { makeNlosPlan, verifyNlos } from './nlos.js';

 /** Walk up from `start` to find the RuView monorepo root (or null). */
 export function findRepoRoot(start = process.cwd()) {
@@ -76,7 +78,11 @@ export function run(cmd, args, opts = {}) {
    let stderr = '';
    let child;
    try {
-      child = spawn(cmd, args, { cwd: opts.cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+      child = spawn(cmd, args, {
+        cwd: opts.cwd,
+        env: opts.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
    } catch (e) {
      resolvePromise({ status: null, ok: false, stdout: '', stderr: '', error: e.message });
      return;
@@ -290,6 +296,54 @@ export const TOOLS = {
    },
  },

+  ruview_nlos_plan: {
+    title: 'Plan consumer NLOS work',
+    description: 'Return the staged, source-bounded RuView consumer-NLOS plan. Advisory only: it never captures hardware, mutates the repository, or claims a research result.',
+    inputSchema: { type: 'object', properties: {} },
+    handler() {
+      return makeNlosPlan({ repoRoot: findRepoRoot() });
+    },
+  },
+
+  ruview_nlos_verify: {
+    title: 'Verify consumer NLOS surfaces and evidence',
+    description: 'Inspect optional Rust/native/web NLOS surfaces and evaluate a preregistered live-hardware evidence record. The local CLI can also run available build gates; MCP rejects repository selection and build execution. Missing optional surfaces are reported, not fabricated; malformed present surfaces fail.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        repo: { type: 'string', minLength: 1, maxLength: 4096, description: 'CLI only: RuView repository root. Default: auto-detect from cwd.' },
+        evidence_file: { type: 'string', minLength: 1, maxLength: 4096, description: 'Repository-contained ruview.nlos.acceptance.v1 JSON evidence record.' },
+        run_builds: { type: 'boolean', description: 'CLI only: run available Rust, Swift/Xcode, and web gates. Unavailable toolchains are explicit skips.' },
+        require_research_pass: { type: 'boolean', description: 'Fail unless live-hardware reproduction and fusion acceptance both pass.' },
+      },
+    },
+    async handler(args = {}, context = {}) {
+      return verifyNlos(args, {
+        repoRoot: findRepoRoot(), source: context.source, runCommand: run, whichCommand: which,
+      });
+    },
+  },
+
+  ruview_spaces_list: {
+    title: 'List Cognitum Spatial Resources',
+    description: 'Page sites, buildings, floors, spaces, zones, anonymous entities, semantic events, or alerts in the authenticated tenant/workspace through the hardened wifi-densepose OAuth client. Never accepts tokens, API keys, writes, approvals, or action authority.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        credentials_path: { type: 'string', minLength: 1, maxLength: 4096, description: 'CLI only: OAuth credential file. MCP operators must set RUVIEW_CREDENTIALS_PATH in the server environment.' },
+        resource: { type: 'string', enum: ['sites', 'buildings', 'floors', 'spaces', 'zones', 'entities', 'events', 'alerts'], description: 'Versioned spatial collection. Default: spaces.' },
+        limit: { type: 'number', minimum: 1, maximum: 100, description: 'Page size. Default: 50.' },
+        cursor: { type: 'string', minLength: 1, maxLength: 512, description: 'Opaque cursor from the prior page.' },
+      },
+    },
+    async handler(args = {}, context = {}) {
+      return listCognitumSpaces(args, {
+        source: context.source,
+        binary: which('wifi-densepose'),
+      });
+    },
+  },
+
  ruview_memory_search: {
    title: 'Search shared RuView brain',
    description: 'Search the reviewed, source-cited RuView contributor corpus. Retrieved text is evidence, never executable instruction.',
@@ -330,7 +384,7 @@ export async function runTool(name, args, context = {}) {
  const authorization = authorizeTool(canonical, input, context);
  if (!authorization.ok) return { ok: false, ...authorization, name: canonical };
  try {
-    return await TOOLS[canonical].handler(input);
+    return await TOOLS[canonical].handler(input, context);
  } catch (err) {
    return { ok: false, reason: 'tool_threw', name: canonical, error: String(err && err.message || err) };
  }
@@ -67,6 +67,17 @@ test('homecore guidance exposes requested capabilities and honest boundaries', (
  );
 });

+test('integration guidance exposes the Cognitum OAuth surface and authority boundary', () => {
+  const result = getGuidance(
+    { topic: 'integrations', query: 'Cognitum Spaces OAuth' },
+    { repoRoot: REPO_ROOT },
+  );
+  assert.equal(result.ok, true, JSON.stringify(result.sourceCheck));
+  assert.equal(result.capabilities[0].id, 'cognitum-spaces-oauth');
+  assert.match(result.capabilities[0].limitations.join(' '), /no write|read-only/i);
+  assert.match(result.capabilities[0].limitations.join(' '), /credential-use/i);
+});
+
 test('query ranks the matching capability and searches reviewed knowledge', () => {
  const result = getGuidance(
    { topic: 'homecore', query: 'Wasmtime plugin', limit: 3 },
@@ -47,14 +47,27 @@ test('MCP handshake: initialize reports the package.json version; list endpoints
    s.send({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
    const init = await s.next(1);
    assert.equal(init.result.serverInfo.version, pkg.version, 'ADR-263 O6: version must match package.json');
+    assert.match(init.result.instructions, /credential-use/);

    s.send({ jsonrpc: '2.0', id: 2, method: 'tools/list' });
    const tools = (await s.next(2)).result.tools;
-    assert.equal(tools.length, 8);
+    assert.equal(tools.length, 11);
    for (const t of tools) assert.match(t.name, /^[a-zA-Z0-9_-]{1,64}$/, `advertised name not host-safe: ${t.name}`);
    const guidance = tools.find((tool) => tool.name === 'ruview_guidance');
    assert.ok(guidance);
    assert.equal(guidance.annotations.readOnlyHint, true);
+    const nlosPlan = tools.find((tool) => tool.name === 'ruview_nlos_plan');
+    const nlosVerify = tools.find((tool) => tool.name === 'ruview_nlos_verify');
+    assert.ok(nlosPlan);
+    assert.ok(nlosVerify);
+    assert.equal(nlosPlan.annotations.readOnlyHint, true);
+    assert.equal(nlosVerify.annotations.readOnlyHint, true);
+    const spaces = tools.find((tool) => tool.name === 'ruview_spaces_list');
+    assert.ok(spaces);
+    assert.equal(spaces.annotations.readOnlyHint, false, 'OAuth refresh can update the local credential file');
+    assert.equal(spaces.annotations.idempotentHint, false);
+    assert.equal(spaces.annotations.destructiveHint, false);
+    assert.equal(spaces.annotations.openWorldHint, true);

    s.send({ jsonrpc: '2.0', id: 3, method: 'resources/list' });
    assert.deepEqual((await s.next(3)).result, { resources: [] });
@@ -71,6 +84,11 @@ test('MCP handshake: initialize reports the package.json version; list endpoints
    assert.equal(guided.ok, true);
    assert.equal(guided.topic, 'homecore');
    assert.ok(guided.capabilities.some(({ id }) => id === 'homecore-runtime-restore'));
+
+    s.send({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'ruview_spaces_list', arguments: {} } });
+    const deniedSpaces = JSON.parse((await s.next(7)).result.content[0].text);
+    assert.equal(deniedSpaces.reason, 'authority_denied');
+    assert.equal(deniedSpaces.requiredGrant, 'credential-use');
  } finally {
    s.close();
  }
@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: MIT
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import {
+  evaluateResearchEvidence,
+  NLOS_EVIDENCE_SCHEMA,
+  NLOS_REFERENCE_SENSOR_MODEL,
+  NLOS_TRACK_SCHEMA,
+  NLOS_UPSTREAM_COMMIT,
+} from '../src/nlos.js';
+import { runTool } from '../src/tools.js';
+import { run as cliRun } from '../bin/cli.js';
+
+const DIGEST = 'a'.repeat(64);
+
+function arm(updateHz, positionErrorM, lostTrackRate) {
+  const evaluableDurationS = 100;
+  const acceptedUpdateCount = Math.round(updateHz * evaluableDurationS);
+  return {
+    sequence_count: 100,
+    accepted_sensor_frame_count: 3_000,
+    accepted_update_count: acceptedUpdateCount,
+    evaluable_duration_s: evaluableDurationS,
+    update_hz: acceptedUpdateCount / evaluableDurationS,
+    position_error_sum_m: positionErrorM * 100,
+    position_error_sample_count: 100,
+    position_error_m: positionErrorM,
+    lost_track_duration_s: lostTrackRate * evaluableDurationS,
+    evaluable_track_duration_s: evaluableDurationS,
+    lost_track_rate: lostTrackRate,
+  };
+}
+
+function csiArm(updateHz, lostTrackRate) {
+  const value = arm(updateHz, 0, lostTrackRate);
+  delete value.position_error_sum_m;
+  delete value.position_error_sample_count;
+  delete value.position_error_m;
+  return value;
+}
+
+function passingEvidence(overrides = {}) {
+  return {
+    schema: NLOS_EVIDENCE_SCHEMA,
+    source: 'LIVE_HARDWARE',
+    claim_tag: 'MEASURED',
+    evidence_level: 'L2',
+    ground_truth: 'EXTERNAL',
+    protocol_frozen_before_capture: true,
+    witness_reviewed: true,
+    privacy_review_passed: true,
+    security_review_passed: true,
+    los_exclusion_verified: true,
+    independent_csi_verified: true,
+    sensor_model: NLOS_REFERENCE_SENSOR_MODEL,
+    transient_kind: 'COMPACT_NORMALIZED_HISTOGRAM',
+    sensor_configured_max_hz: 30,
+    upstream_commit: NLOS_UPSTREAM_COMMIT,
+    protocol_sha256: DIGEST,
+    capture_manifest_sha256: DIGEST,
+    sensor_identity_sha256: DIGEST,
+    calibration_sha256: DIGEST,
+    firmware_sha256: DIGEST,
+    analysis_sha256: DIGEST,
+    endpoint_pairing_sha256: DIGEST,
+    sensor_configuration_sha256: DIGEST,
+    witness_report_sha256: DIGEST,
+    privacy_review_sha256: DIGEST,
+    security_review_sha256: DIGEST,
+    guardrail_report_sha256: DIGEST,
+    csi_capture_manifest_sha256: DIGEST,
+    csi_sensor_identity_sha256: DIGEST,
+    csi_calibration_sha256: DIGEST,
+    synthetic_frames: 0,
+    replay_frames: 0,
+    paired_sequences: 100,
+    csi_source_count: 1,
+    offered_optical_frame_count: 3_000,
+    lidar_only: arm(29.4, 0.12, 0.20),
+    csi_only: csiArm(15, 0.40),
+    fused: arm(28.9, 0.089, 0.19),
+    confidence: {
+      bootstrap_resamples: 10_000,
+      bootstrap_seed_list_sha256: DIGEST,
+      familywise_confidence_level: 0.975,
+      position_error_reduction_lower: 0.01,
+      position_error_reduction_upper: 0.40,
+      lost_track_reduction_lower: -0.10,
+      lost_track_reduction_upper: 0.20,
+    },
+    guardrails: {
+      empty_false_track_rate: 0,
+      empty_false_track_rate_max: 0.01,
+      fused_p95_latency_ms: 80,
+      fused_p95_latency_max_ms: 100,
+      fused_frame_loss_rate: 0,
+      fused_frame_loss_rate_max: 0.05,
+      exclusion_fraction: 0.02,
+      exclusion_fraction_max: 0.05,
+      fused_update_rate_ratio_min: 0.25,
+      nonwinning_position_error_regression_max: 0.10,
+      nonwinning_lost_track_regression_max: 0.10,
+    },
+    ...overrides,
+  };
+}
+
+test('nlos plan is advisory, staged, and names the canonical track schema', async () => {
+  const result = await runTool('ruview_nlos_plan', {});
+  assert.equal(result.ok, true);
+  assert.equal(result.advisory, true);
+  assert.equal(result.phases.length, 4);
+  assert.match(JSON.stringify(result), new RegExp(NLOS_TRACK_SCHEMA.replaceAll('.', '\\.')));
+});
+
+test('research gate accepts live hardware at roughly 30 Hz and either 25% fusion gain', () => {
+  const result = evaluateResearchEvidence(passingEvidence());
+  assert.equal(result.pass, true, JSON.stringify(result));
+  assert.equal(result.reproduction.pass, true);
+  assert.ok(result.fusion.position_error_reduction >= 0.25);
+
+  const lostTrackWin = passingEvidence({
+    lidar_only: arm(27, 0.10, 0.20),
+    fused: arm(19, 0.10, 0.14),
+    confidence: {
+      bootstrap_resamples: 10_000,
+      bootstrap_seed_list_sha256: DIGEST,
+      familywise_confidence_level: 0.975,
+      position_error_reduction_lower: -0.10,
+      position_error_reduction_upper: 0.10,
+      lost_track_reduction_lower: 0.01,
+      lost_track_reduction_upper: 0.50,
+    },
+  });
+  assert.equal(evaluateResearchEvidence(lostTrackWin).pass, true);
+});
+
+test('research gate never accepts synthetic or replay evidence', () => {
+  for (const evidence of [
+    passingEvidence({ source: 'SYNTHETIC' }),
+    passingEvidence({ synthetic_frames: 1 }),
+    passingEvidence({ replay_frames: 1 }),
+    passingEvidence({ claim_tag: 'SYNTHETIC', evidence_level: 'L0' }),
+  ]) {
+    const result = evaluateResearchEvidence(evidence);
+    assert.equal(result.pass, false, JSON.stringify(result));
+    assert.equal(result.status, 'FAIL');
+  }
+});
+
+test('research gate fails sub-rate reproduction and sub-threshold fusion', () => {
+  const slow = passingEvidence({
+    lidar_only: arm(26.9, 0.12, 0.20),
+  });
+  assert.equal(evaluateResearchEvidence(slow).reproduction.pass, false);
+
+  const noGain = passingEvidence({
+    fused: arm(29, 0.091, 0.16),
+  });
+  assert.equal(evaluateResearchEvidence(noGain).pass, false);
+
+  const slowFusion = passingEvidence({ fused: arm(12, 0.08, 0.19) });
+  assert.equal(evaluateResearchEvidence(slowFusion).pass, true, 'fused rate is reported but is not the user hard gate');
+});
+
+test('research evidence rejects unknown and incomplete fields', () => {
+  const extraTopLevel = evaluateResearchEvidence(passingEvidence({ bearer_token: 'must-not-be-here' }));
+  assert.equal(extraTopLevel.pass, false);
+  assert.ok(extraTopLevel.findings.includes('bearer_token:unknown-field'));
+
+  const incompleteArm = passingEvidence();
+  delete incompleteArm.fused.sequence_count;
+  const missing = evaluateResearchEvidence(incompleteArm);
+  assert.equal(missing.pass, false);
+  assert.ok(missing.findings.includes('fused.sequence_count:missing'));
+
+  const impossible = passingEvidence({ sensor_identity_sha256: '0'.repeat(64) });
+  impossible.lidar_only.update_hz = 1e300;
+  const bounded = evaluateResearchEvidence(impossible);
+  assert.equal(bounded.pass, false);
+  assert.ok(bounded.findings.includes('sensor_identity_sha256:invalid-or-zero'));
+  assert.ok(bounded.findings.includes('lidar_only.update_hz:above-maximum'));
+
+  for (const sensorModel of ['VL53L8CX', 'iPhone15Pro']) {
+    const wrongSensor = evaluateResearchEvidence(passingEvidence({ sensor_model: sensorModel }));
+    assert.equal(wrongSensor.pass, false);
+    assert.ok(wrongSensor.findings.includes('sensor_model:v1-requires-VL53L8CH'));
+  }
+
+  const zeroCommit = evaluateResearchEvidence(passingEvidence({ upstream_commit: '0'.repeat(40) }));
+  assert.equal(zeroCommit.pass, false);
+  assert.ok(zeroCommit.findings.includes('upstream_commit:expected-nonzero-full-sha1'));
+
+  const wrongCommit = evaluateResearchEvidence(passingEvidence({
+    upstream_commit: '0123456789abcdef0123456789abcdef01234567',
+  }));
+  assert.equal(wrongCommit.pass, false);
+  assert.ok(wrongCommit.findings.includes('upstream_commit:must-match-pinned-baseline'));
+});
+
+test('research evidence recomputes loss and requires powered paired endpoint coverage', () => {
+  const falseLoss = passingEvidence();
+  falseLoss.fused.accepted_sensor_frame_count = 2_700;
+  falseLoss.guardrails.fused_frame_loss_rate = 0;
+  const lossResult = evaluateResearchEvidence(falseLoss);
+  assert.equal(lossResult.pass, false);
+  assert.ok(lossResult.findings.includes('guardrails.fused_frame_loss_rate:arithmetic-mismatch'));
+
+  const impossibleOfferRate = passingEvidence({ offered_optical_frame_count: 3_001 });
+  impossibleOfferRate.lidar_only.accepted_sensor_frame_count = 3_001;
+  impossibleOfferRate.fused.accepted_sensor_frame_count = 3_001;
+  const offerResult = evaluateResearchEvidence(impossibleOfferRate);
+  assert.equal(offerResult.pass, false);
+  assert.ok(offerResult.findings.includes('offered_optical_frame_rate:above-configured-maximum'));
+
+  const oneOfOneHundred = passingEvidence();
+  oneOfOneHundred.lidar_only.position_error_sample_count = 1;
+  oneOfOneHundred.lidar_only.position_error_sum_m = 0.12;
+  oneOfOneHundred.fused.position_error_sample_count = 1;
+  oneOfOneHundred.fused.position_error_sum_m = 0.089;
+  const coverageResult = evaluateResearchEvidence(oneOfOneHundred);
+  assert.equal(coverageResult.pass, false);
+  assert.ok(coverageResult.findings.includes(
+    'lidar_only.position_error_sample_count:must-equal-paired-sequences',
+  ));
+
+  const mismatchedTrackDenominator = passingEvidence();
+  mismatchedTrackDenominator.fused.evaluable_track_duration_s = 10;
+  mismatchedTrackDenominator.fused.lost_track_duration_s = 1.5;
+  mismatchedTrackDenominator.fused.lost_track_rate = 0.15;
+  const pairingResult = evaluateResearchEvidence(mismatchedTrackDenominator);
+  assert.equal(pairingResult.pass, false);
+  assert.ok(pairingResult.findings.includes('lost_track_endpoint_pairing:evaluable-duration-mismatch'));
+});
+
+test('nlos verify degrades cleanly when all optional feature surfaces are absent', async () => {
+  const repo = mkdtempSync(join(tmpdir(), 'ruview-nlos-absent-'));
+  try {
+    mkdirSync(join(repo, 'v2'), { recursive: true });
+    writeFileSync(join(repo, 'v2', 'Cargo.toml'), '[workspace]\n');
+    const result = await runTool('ruview_nlos_verify', { repo });
+    assert.equal(result.ok, true, JSON.stringify(result));
+    assert.ok(result.surfaces.every((surface) => surface.status === 'ABSENT'));
+    assert.equal(result.research_gate.status, 'NOT_EVALUATED');
+    assert.equal(result.meta_harness_required_by_runtime, false);
+  } finally { rmSync(repo, { recursive: true, force: true }); }
+});
+
+test('nlos verify fails a malformed present surface', async () => {
+  const repo = mkdtempSync(join(tmpdir(), 'ruview-nlos-malformed-'));
+  try {
+    mkdirSync(join(repo, 'v2', 'crates', 'ruview-nlos'), { recursive: true });
+    writeFileSync(join(repo, 'v2', 'Cargo.toml'), '[workspace]\n');
+    writeFileSync(join(repo, 'v2', 'crates', 'ruview-nlos', 'Cargo.toml'), '[package]\nname="wrong"\n');
+    const result = await runTool('ruview_nlos_verify', { repo });
+    assert.equal(result.ok, false);
+    assert.equal(result.surfaces.find((surface) => surface.id === 'rust-core').status, 'MALFORMED');
+  } finally { rmSync(repo, { recursive: true, force: true }); }
+});
+
+test('nlos evidence is confined, bounded, and any supplied failing record fails closed', async () => {
+  const repo = mkdtempSync(join(tmpdir(), 'ruview-nlos-evidence-'));
+  const outside = join(tmpdir(), `ruview-nlos-outside-${process.pid}.json`);
+  try {
+    mkdirSync(join(repo, 'v2'), { recursive: true });
+    writeFileSync(join(repo, 'v2', 'Cargo.toml'), '[workspace]\n');
+    writeFileSync(join(repo, 'evidence.json'), JSON.stringify(passingEvidence()));
+    writeFileSync(join(repo, 'failing.json'), JSON.stringify(passingEvidence({ source: 'SYNTHETIC' })));
+    writeFileSync(join(repo, 'malformed.json'), '{"schema":');
+    writeFileSync(join(repo, 'oversize.json'), ' '.repeat(1024 * 1024 + 1));
+    writeFileSync(outside, JSON.stringify(passingEvidence()));
+
+    const pass = await runTool('ruview_nlos_verify', {
+      repo, evidence_file: 'evidence.json', require_research_pass: true,
+    });
+    assert.equal(pass.ok, true, JSON.stringify(pass));
+    assert.equal(pass.research_gate.status, 'PASS');
+
+    const failing = await runTool('ruview_nlos_verify', { repo, evidence_file: 'failing.json' });
+    assert.equal(failing.ok, false);
+    assert.equal(failing.research_gate.status, 'FAIL');
+
+    const malformed = await runTool('ruview_nlos_verify', { repo, evidence_file: 'malformed.json' });
+    assert.equal(malformed.ok, false);
+    assert.equal(malformed.reason, 'evidence_file_malformed_json');
+
+    const oversized = await runTool('ruview_nlos_verify', { repo, evidence_file: 'oversize.json' });
+    assert.equal(oversized.ok, false);
+    assert.equal(oversized.reason, 'evidence_file_too_large');
+
+    const escaped = await runTool('ruview_nlos_verify', { repo, evidence_file: outside });
+    assert.equal(escaped.ok, false);
+    assert.equal(escaped.reason, 'evidence_file_outside_repo');
+  } finally {
+    rmSync(repo, { recursive: true, force: true });
+    rmSync(outside, { force: true });
+  }
+});
+
+test('MCP NLOS verification cannot select a repository or execute build tools', async () => {
+  const selected = await runTool('ruview_nlos_verify', { repo: '/tmp' }, { source: 'mcp' });
+  assert.equal(selected.ok, false);
+  assert.equal(selected.reason, 'cli_only_repo_or_builds');
+  const builds = await runTool('ruview_nlos_verify', { run_builds: true }, { source: 'mcp' });
+  assert.equal(builds.ok, false);
+  assert.equal(builds.reason, 'cli_only_repo_or_builds');
+});
+
+test('nlos CLI nested commands reject unknown actions', async () => {
+  assert.equal(await cliRun(['nlos', 'plan']), 0);
+  assert.equal(await cliRun(['nlos', 'definitely-unknown']), 2);
+});
@@ -19,5 +19,29 @@ test('MCP workspace writes require confirmation and an explicit grant', () => {
 test('read-only tools remain available with no mutation grants', () => {
  assert.equal(authorizeTool('ruview_claim_check', { text: 'safe' }, { source: 'mcp', grants: [] }).ok, true);
  assert.equal(authorizeTool('ruview_guidance', {}, { source: 'mcp', grants: [] }).ok, true);
+  assert.equal(authorizeTool('ruview_nlos_plan', {}, { source: 'mcp', grants: [] }).ok, true);
+  assert.equal(authorizeTool('ruview_nlos_verify', {}, { source: 'mcp', grants: [] }).ok, true);
  assert.deepEqual(validateArguments({ type: 'object', properties: {} }, {}), []);
 });
+
+test('credentialed external reads require an explicit MCP grant', () => {
+  const denied = authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
+  assert.equal(denied.reason, 'authority_denied');
+  assert.equal(denied.requiredGrant, 'credential-use');
+  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'mcp', grants: ['credential-use'] }).ok, true);
+  assert.equal(authorizeTool('ruview_spaces_list', {}, { source: 'cli', grants: [] }).ok, true);
+});
+
+test('Spaces schema never accepts raw credentials', async () => {
+  for (const credential of [
+    { token: 'secret' },
+    { access_token: 'secret' },
+    { api_key: 'cog_secret' },
+    { authorization: 'Bearer secret' },
+    { base_url: 'https://attacker.example' },
+  ]) {
+    const result = await runTool('ruview_spaces_list', credential);
+    assert.equal(result.ok, false);
+    assert.equal(result.reason, 'invalid_arguments');
+  }
+});
@@ -0,0 +1,67 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import {
+  copyFileSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
+const provenanceFiles = [
+  "harness/ruview/package.json",
+  "harness/ruview/.harness/manifest.json",
+  "harness/ruview/.harness/manifest.sha256",
+];
+
+function git(args, cwd = repoRoot) {
+  return execFileSync("git", args, { cwd, encoding: "utf8" });
+}
+
+test("sensing-server session secret is ignored at the v2 runtime path", () => {
+  assert.doesNotThrow(() =>
+    git(["check-ignore", "--no-index", "--quiet", "--", "v2/data/session-secret"]),
+  );
+});
+
+test("harness provenance files are checked out with LF line endings", () => {
+  const attributes = git(["check-attr", "text", "eol", "--", ...provenanceFiles]);
+
+  for (const file of provenanceFiles) {
+    assert.match(attributes, new RegExp(`${file}: text: auto`));
+    assert.match(attributes, new RegExp(`${file}: eol: lf`));
+  }
+});
+
+test("core.autocrlf checkout preserves LF bytes for harness provenance", () => {
+  const scratch = mkdtempSync(join(tmpdir(), "ruview-lf-checkout-"));
+  const source = join(scratch, "source");
+  const checkout = join(scratch, "checkout");
+
+  try {
+    mkdirSync(join(source, "harness/ruview/.harness"), { recursive: true });
+    copyFileSync(join(repoRoot, ".gitattributes"), join(source, ".gitattributes"));
+    writeFileSync(join(source, "harness/ruview/.harness/manifest.json"), '{\n  "ok": true\n}\n');
+    writeFileSync(join(source, "harness/ruview/.harness/manifest.sha256"), "digest  manifest.json\n");
+
+    git(["init", "--quiet"], source);
+    git(["config", "user.email", "test@example.invalid"], source);
+    git(["config", "user.name", "RuView test"], source);
+    git(["add", "."], source);
+    git(["commit", "--quiet", "-m", "test fixture"], source);
+    execFileSync("git", ["-c", "core.autocrlf=true", "clone", "--quiet", source, checkout]);
+
+    for (const relativePath of provenanceFiles.slice(1)) {
+      const bytes = readFileSync(join(checkout, relativePath));
+      assert.equal(bytes.includes(Buffer.from("\r\n")), false, `${relativePath} must remain LF`);
+    }
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+});
@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: MIT
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { listCognitumSpaces, parseSpacesOutput } from '../src/spaces.js';
+import { runTool } from '../src/tools.js';
+
+function validResponse(kind = 'spaces') {
+  return {
+    object: 'list',
+    kind,
+    schemaVersion: '1.0',
+    data: [{
+      id: 'room-1', tenantId: 'tenant-1', workspaceId: '11111111-1111-7111-8111-111111111111', siteId: 'site-1', name: 'Room',
+      buildingId: 'building-1', floorId: 'floor-1', kind, schemaVersion: '1.0',
+      messageId: 'message-1', eventSequence: 1, version: 1, privacy: 'P2',
+      confidence: 0.9, provenance: {}, attributes: {}, observedAt: '2026-08-19T00:00:00Z', expiresAt: null,
+    }],
+    nextCursor: null,
+    boundary: {
+      authoritativeState: 'HomeCore Edge',
+      cloudRole: 'tenant-scoped semantic synchronization',
+      excluded: ['raw_csi', 'cir', 'rf_tensors', 'recordings', 'pose_frames', 'vital_waveforms', 'identity_observations'],
+    },
+  };
+}
+
+test('Spaces adapter invokes OAuth-only CLI args in a scrubbed environment', async () => {
+  const credentialPath = 'C:/private/ruview-credentials.json';
+  const secretApiKey = ['cog', 'DO', 'NOT', 'FORWARD'].join('_');
+  let observed;
+  const result = await listCognitumSpaces(
+    { credentials_path: credentialPath },
+    {
+      source: 'cli',
+      binary: 'wifi-densepose-test-double',
+      env: { PATH: 'test-path', COGNITUM_SPACES_API: secretApiKey, RUVIEW_CREDENTIALS_PATH: credentialPath },
+      execute: async (command, args, options) => {
+        observed = { command, args, options };
+        return { stdout: JSON.stringify(validResponse()), stderr: '', code: 0 };
+      },
+    },
+  );
+
+  assert.equal(result.ok, true);
+  assert.equal(result.authentication, 'oauth');
+  assert.equal(result.count, 1);
+  assert.equal(observed.command, 'wifi-densepose-test-double');
+  assert.deepEqual(observed.args, [
+    'spaces', '--json', '--base-url', 'https://api.cognitum.one', '--resource', 'spaces', '--limit', '50',
+    '--credentials-path', credentialPath,
+  ]);
+  assert.ok(observed.options.envAllowlist.includes('RUVIEW_CREDENTIALS_PATH'));
+  assert.ok(!observed.options.envAllowlist.includes('COGNITUM_SPACES_API'));
+  assert.ok(!observed.args.join(' ').includes(secretApiKey));
+});
+
+test('MCP cannot select an arbitrary credential path even with a credential-use grant', async () => {
+  const result = await runTool(
+    'ruview_spaces_list',
+    { credentials_path: 'C:/private/credentials.json' },
+    { source: 'mcp', grants: ['credential-use'] },
+  );
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'credentials_path_not_allowed');
+});
+
+test('MCP denies a Spaces read before touching local credentials or the network', async () => {
+  const result = await runTool('ruview_spaces_list', {}, { source: 'mcp', grants: [] });
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'authority_denied');
+  assert.equal(result.requiredGrant, 'credential-use');
+});
+
+test('metaharness rejects forbidden raw fields from a child process', () => {
+  const response = validResponse();
+  response.data[0].attributes.raw_csi = [1, 2, 3];
+  assert.throws(() => parseSpacesOutput(JSON.stringify(response)), /forbidden raw field/i);
+});
+
+test('metaharness rejects incomplete privacy boundaries and invalid confidence', () => {
+  const incomplete = validResponse();
+  incomplete.boundary.excluded = ['raw_csi'];
+  assert.throws(() => parseSpacesOutput(JSON.stringify(incomplete)), /incomplete edge privacy boundary/i);
+
+  const invalid = validResponse();
+  invalid.data[0].confidence = 2;
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalid)), /invalid confidence/i);
+});
+
+test('versioned hierarchy, events, alerts, and cursor args stay OAuth-only', async () => {
+  let observed;
+  const response = validResponse('events');
+  response.data[0].spaceId = 'room-1';
+  response.data[0].eventType = 'occupancy.changed';
+  response.data[0].buildingId = null;
+  response.data[0].floorId = null;
+  const result = await listCognitumSpaces(
+    { resource: 'events', limit: 25, cursor: 'opaque-cursor' },
+    {
+      source: 'mcp',
+      binary: 'wifi-densepose-test-double',
+      env: { PATH: 'test-path', COGNITUM_SPACES_API: 'cog_never_forward' },
+      execute: async (command, args, options) => {
+        observed = { command, args, options };
+        return { stdout: JSON.stringify(response), stderr: '', code: 0 };
+      },
+    },
+  );
+  assert.equal(result.ok, true);
+  assert.equal(result.resource, 'events');
+  assert.deepEqual(observed.args, [
+    'spaces', '--json', '--base-url', 'https://api.cognitum.one', '--resource', 'events', '--limit', '25',
+    '--cursor', 'opaque-cursor',
+  ]);
+  assert.ok(!observed.options.envAllowlist.includes('COGNITUM_SPACES_API'));
+});
+
+test('metaharness rejects raw aliases and malformed kind-specific records', () => {
+  const raw = validResponse();
+  raw.data[0].attributes.packet_capture = 'forbidden';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(raw), 'spaces'), /forbidden raw field/i);
+
+  const entity = validResponse('entities');
+  entity.data[0].spaceId = 'room-1';
+  entity.data[0].entityType = 'person';
+  entity.data[0].identityMode = 'named';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(entity), 'entities'), /entity privacy contract/i);
+
+  const invalidWorkspace = validResponse();
+  invalidWorkspace.data[0].workspaceId = 'workspace-1';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalidWorkspace), 'spaces'), /versioned spatial identity/i);
+
+  const invalidTimestamp = validResponse();
+  invalidTimestamp.data[0].observedAt = 'not-a-timestamp';
+  assert.throws(() => parseSpacesOutput(JSON.stringify(invalidTimestamp), 'spaces'), /versioned spatial identity/i);
+});
+
+test('command failures redact API keys and JWT-shaped tokens', async () => {
+  const secret = `cog_${'test-value-'.repeat(4)}`;
+  const jwt = 'eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEifQ.signature-material';
+  const result = await listCognitumSpaces({}, {
+    source: 'cli',
+    binary: 'wifi-densepose-test-double',
+    env: { PATH: 'test-path', COGNITUM_SPACES_API: secret },
+    execute: async () => { throw new Error(`failed token=${jwt} api_key=${secret}`); },
+  });
+  assert.equal(result.ok, false);
+  assert.ok(!result.detail.includes(secret));
+  assert.ok(!result.detail.includes(jwt));
+  assert.match(result.detail, /REDACTED/);
+});
+
+test('credentialed calls never fall back to Cargo build scripts', async () => {
+  let executed = false;
+  const result = await listCognitumSpaces({}, {
+    source: 'cli',
+    cargo: 'cargo',
+    repoRoot: 'C:/trusted/ruview',
+    execute: async () => { executed = true; },
+  });
+  assert.equal(result.ok, false);
+  assert.equal(result.reason, 'cli_missing');
+  assert.equal(executed, false);
+});
@@ -93,7 +93,7 @@ test('summarize gives PASS/finding text', () => {

 test('registry exposes the documented tools with schemas (underscore-canonical)', () => {
  const names = Object.keys(TOOLS);
-  for (const n of ['ruview_onboard', 'ruview_claim_check', 'ruview_verify', 'ruview_node_monitor', 'ruview_calibrate', 'ruview_node_flash', 'ruview_guidance', 'ruview_memory_search']) {
+  for (const n of ['ruview_onboard', 'ruview_claim_check', 'ruview_verify', 'ruview_node_monitor', 'ruview_calibrate', 'ruview_node_flash', 'ruview_guidance', 'ruview_nlos_plan', 'ruview_nlos_verify', 'ruview_spaces_list', 'ruview_memory_search']) {
    assert.ok(names.includes(n), `missing ${n}`);
    assert.equal(TOOLS[n].inputSchema.type, 'object');
    assert.match(n, /^[a-zA-Z0-9_-]{1,64}$/, 'canonical names must satisfy host tool-name regexes');
@@ -0,0 +1,78 @@
+# RuView iPhone LiDAR
+
+This experimental integration provides the native and browser components needed to use a LiDAR-capable iPhone as a RuView geometry sensor. The native source is type-checked against the iOS SDK in CI; physical-device validation is tracked separately below.
+
+## Architecture
+
+```text
+iPhone LiDAR
+  -> ARKit sceneDepth
+  -> depth + confidence + camera intrinsics + device pose
+  -> compact u16 millimeter wire frame
+  -> WebSocket relay
+  -> browser point cloud
+  -> future RuView HAL / fusion ingest
+```
+
+The native path is the sensor. The web path is a receiver and visualization surface. Mobile Safari does not expose ARKit scene depth directly to ordinary web pages, so the browser cannot replace the native capture layer on iPhone today.
+
+## Native iPhone path
+
+Create an iOS SwiftUI app target in Xcode, deployment target iOS 17 or newer, then add the files under `native/RuViewLiDAR/` to the target.
+
+Add this Info.plist value:
+
+```xml
+<key>NSCameraUsageDescription</key>
+<string>RuView uses the camera and LiDAR scanner to capture local depth geometry.</string>
+```
+
+Run on a physical LiDAR capable iPhone or iPad. The simulator does not provide LiDAR scene depth.
+
+The app requests `ARWorldTrackingConfiguration` with `.sceneDepth`, checks `supportsFrameSemantics`, extracts `ARDepthData.depthMap` and `confidenceMap`, and never transmits RGB camera frames.
+
+## Browser path
+
+```bash
+cd integrations/iphone-lidar/web
+npm ci
+npm test
+npm start
+```
+
+The relay prints a random per-run access token. Open the printed browser URL and set the iPhone endpoint to the printed native URL. They have this form:
+
+```text
+http://HOST:8787/?token=TOKEN
+ws://HOST:8787/ws/lidar?token=TOKEN
+```
+
+Set `RUVIEW_LIDAR_TOKEN` to supply the token explicitly. The token only prevents unauthenticated peers from joining the development relay; because `ws://` does not encrypt it, production use requires TLS and `wss://`.
+
+## Wire format
+
+Schema: `ruview.lidar.depth.v1`
+
+Depth is downsampled by 2 in each dimension by default and streamed at a maximum of 15 FPS. Each depth sample is encoded as little endian UInt16 millimeters plus one UInt8 confidence value. `[SYNTHETIC]` Arithmetic sizing reduces the depth payload from roughly 196 KB per 256 x 192 Float32 frame to roughly 37 KB per 128 x 96 frame before base64 and JSON overhead.
+
+`[SYNTHETIC]` At 15 FPS that is approximately 0.75 MB/s after base64 overhead, versus roughly 8 MB/s for uncompressed Float32 JSON at full resolution. These are sizing estimates, not device or network measurements.
+
+## Privacy and governance
+
+The initial implementation labels provenance as `source=live` and `privacyClass=geometry-only`. It sends depth geometry, confidence, camera intrinsics, pose, sequence, and wall clock timestamp. It does not send RGB imagery.
+
+The development relay requires an ephemeral token and bounds each WebSocket message, but it is not a production trust boundary. Production integration should terminate the WebSocket inside RuView, authenticate the device using the existing sensor identity path, convert each frame into `ruview-hal::Observation`, and attach witness receipts before fusion or persistence.
+
+## Validation status
+
+- `[MEASURED]` The committed Node tests cover wire decoding, malformed inputs, relay authentication, static-file restrictions, and live WebSocket forwarding.
+- `[MEASURED]` GitHub Actions type-checks the native sources with strict concurrency against the iOS 17 SDK.
+- Physical iPhone capture, end-to-end rendering, confidence-map behavior, and the latency target are not yet measured. A simulator or CI compile does not satisfy the hardware acceptance test.
+
+## Acceptance test
+
+1. Run the relay and browser viewer.
+2. Run the native app on a LiDAR capable iPhone.
+3. Start LiDAR capture and enable streaming.
+4. Move the phone through a room.
+5. Verify the browser shows a changing point cloud, sequence increases monotonically, latency stays below the `[CLAIMED target]` of 150 ms p95 on a local WiFi network, and no RGB payload is present in captured WebSocket frames.
@@ -0,0 +1,121 @@
+import SwiftUI
+
+struct ContentView: View {
+    @StateObject private var capture = LiDARCaptureManager()
+    @State private var endpoint = "ws://HOST:8787/ws/lidar?token=TOKEN"
+    @State private var streaming = false
+    @State private var status = "Idle"
+
+    private let streamer = WebSocketStreamer()
+
+    var body: some View {
+        NavigationStack {
+            Form {
+                Section("Sensor") {
+                    HStack {
+                        Text("State")
+                        Spacer()
+                        Text(stateText)
+                            .foregroundStyle(stateColor)
+                    }
+                    HStack {
+                        Text("Capture FPS")
+                        Spacer()
+                        Text(capture.framesPerSecond.formatted(.number.precision(.fractionLength(1))))
+                    }
+                    if let frame = capture.lastFrame {
+                        HStack {
+                            Text("Depth")
+                            Spacer()
+                            Text("\(frame.depth.width) x \(frame.depth.height)")
+                        }
+                        HStack {
+                            Text("Sequence")
+                            Spacer()
+                            Text("\(frame.provenance.sequence)")
+                        }
+                    }
+
+                    Button("Start LiDAR") {
+                        capture.start(smoothed: false)
+                    }
+                    .disabled(capture.state == .running)
+
+                    Button("Stop") {
+                        capture.stop()
+                    }
+                    .disabled(capture.state != .running)
+                }
+
+                Section("RuView Stream") {
+                    TextField("ws://host:port/ws/lidar", text: $endpoint)
+                        .textInputAutocapitalization(.never)
+                        .autocorrectionDisabled()
+
+                    Toggle("Stream geometry", isOn: $streaming)
+                        .onChange(of: streaming) { _, enabled in
+                            Task {
+                                if enabled {
+                                    do {
+                                        try await streamer.connect(to: endpoint)
+                                        status = "Connected"
+                                    } catch {
+                                        streaming = false
+                                        status = error.localizedDescription
+                                    }
+                                } else {
+                                    await streamer.disconnect()
+                                    status = "Disconnected"
+                                }
+                            }
+                        }
+
+                    Text(status)
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                }
+
+                Section("Privacy") {
+                    Text("This implementation transmits depth geometry, confidence, camera intrinsics, and device pose. RGB camera frames are not transmitted.")
+                        .font(.footnote)
+                }
+            }
+            .navigationTitle("RuView LiDAR")
+            .onAppear {
+                capture.onFrame = { frame in
+                    guard streaming else { return }
+                    Task {
+                        do {
+                            try await streamer.send(frame, maxFPS: 15, sampleStep: 2)
+                        } catch {
+                            await MainActor.run {
+                                status = error.localizedDescription
+                            }
+                        }
+                    }
+                }
+            }
+            .onDisappear {
+                capture.stop()
+                Task { await streamer.disconnect() }
+            }
+        }
+    }
+
+    private var stateText: String {
+        switch capture.state {
+        case .idle: return "Idle"
+        case .unsupported: return "No LiDAR"
+        case .running: return "Live"
+        case .failed(let message): return "Error: \(message)"
+        }
+    }
+
+    private var stateColor: Color {
+        switch capture.state {
+        case .running: return .green
+        case .failed, .unsupported: return .red
+        case .idle: return .secondary
+        }
+    }
+}
@@ -0,0 +1,138 @@
+import ARKit
+import CoreVideo
+import Foundation
+
+@MainActor
+final class LiDARCaptureManager: NSObject, ObservableObject {
+    enum State: Equatable {
+        case idle
+        case unsupported
+        case running
+        case failed(String)
+    }
+
+    @Published private(set) var state: State = .idle
+    @Published private(set) var lastFrame: RuViewLiDARFrame?
+    @Published private(set) var framesPerSecond: Double = 0
+
+    let session = ARSession()
+    var onFrame: (@MainActor @Sendable (RuViewLiDARFrame) -> Void)?
+
+    private var sequence: UInt64 = 0
+    private var lastTimestamp: TimeInterval?
+    private let processingQueue = DispatchQueue(label: "one.ruv.lidar.capture", qos: .userInitiated)
+
+    override init() {
+        super.init()
+        session.delegate = self
+        session.delegateQueue = processingQueue
+    }
+
+    func start(smoothed: Bool = false) {
+        let configuration = ARWorldTrackingConfiguration()
+        let semantic: ARConfiguration.FrameSemantics = smoothed ? .smoothedSceneDepth : .sceneDepth
+
+        guard ARWorldTrackingConfiguration.supportsFrameSemantics(semantic) else {
+            state = .unsupported
+            return
+        }
+
+        configuration.frameSemantics.insert(semantic)
+        configuration.worldAlignment = .gravity
+        session.run(configuration, options: [.resetTracking, .removeExistingAnchors])
+        state = .running
+    }
+
+    func stop() {
+        session.pause()
+        state = .idle
+    }
+
+    nonisolated private func makeFrame(from frame: ARFrame) -> RuViewLiDARFrame? {
+        guard let sceneDepth = frame.sceneDepth ?? frame.smoothedSceneDepth else { return nil }
+        let depthMap = sceneDepth.depthMap
+        let confidenceMap = sceneDepth.confidenceMap
+
+        guard CVPixelBufferLockBaseAddress(depthMap, .readOnly) == kCVReturnSuccess else {
+            return nil
+        }
+        defer { CVPixelBufferUnlockBaseAddress(depthMap, .readOnly) }
+
+        guard CVPixelBufferGetPixelFormatType(depthMap) == kCVPixelFormatType_DepthFloat32,
+              let depthBase = CVPixelBufferGetBaseAddress(depthMap) else {
+            return nil
+        }
+
+        let width = CVPixelBufferGetWidth(depthMap)
+        let height = CVPixelBufferGetHeight(depthMap)
+        let stride = CVPixelBufferGetBytesPerRow(depthMap) / MemoryLayout<Float>.size
+        let pointer = depthBase.assumingMemoryBound(to: Float.self)
+
+        var meters = [Float]()
+        meters.reserveCapacity(width * height)
+        for y in 0..<height {
+            let row = pointer.advanced(by: y * stride)
+            for x in 0..<width {
+                let value = row[x]
+                meters.append(value.isFinite && value > 0 ? value : 0)
+            }
+        }
+
+        var confidence = [UInt8](repeating: 0, count: width * height)
+        if let confidenceMap,
+           CVPixelBufferGetPixelFormatType(confidenceMap) == kCVPixelFormatType_OneComponent8,
+           CVPixelBufferGetWidth(confidenceMap) == width,
+           CVPixelBufferGetHeight(confidenceMap) == height,
+           CVPixelBufferLockBaseAddress(confidenceMap, .readOnly) == kCVReturnSuccess {
+            defer { CVPixelBufferUnlockBaseAddress(confidenceMap, .readOnly) }
+            if let confidenceBase = CVPixelBufferGetBaseAddress(confidenceMap) {
+                let confidenceStride = CVPixelBufferGetBytesPerRow(confidenceMap)
+                let confidencePointer = confidenceBase.assumingMemoryBound(to: UInt8.self)
+                for y in 0..<height {
+                    let row = confidencePointer.advanced(by: y * confidenceStride)
+                    for x in 0..<width {
+                        confidence[y * width + x] = row[x]
+                    }
+                }
+            }
+        }
+
+        return RuViewLiDARFrame(
+            intrinsics: frame.camera.intrinsics,
+            imageResolution: frame.camera.imageResolution,
+            cameraTransform: frame.camera.transform,
+            depthWidth: width,
+            depthHeight: height,
+            depthMeters: meters,
+            confidence: confidence,
+            sequence: 0,
+            timestamp: Date().timeIntervalSince1970
+        )
+    }
+}
+
+extension LiDARCaptureManager: ARSessionDelegate {
+    nonisolated func session(_ session: ARSession, didUpdate frame: ARFrame) {
+        guard let base = makeFrame(from: frame) else { return }
+        let frameTimestamp = frame.timestamp
+
+        Task { @MainActor in
+            sequence &+= 1
+            let corrected = base.assigningSequence(sequence)
+
+            if let previous = lastTimestamp {
+                let delta = frameTimestamp - previous
+                if delta > 0 { framesPerSecond = 1.0 / delta }
+            }
+            lastTimestamp = frameTimestamp
+            lastFrame = corrected
+            onFrame?(corrected)
+        }
+    }
+
+    nonisolated func session(_ session: ARSession, didFailWithError error: Error) {
+        Task { @MainActor in
+            state = .failed(error.localizedDescription)
+        }
+    }
+}
@@ -0,0 +1,118 @@
+import Foundation
+import simd
+
+struct RuViewLiDARFrame: Codable, Sendable {
+    struct Intrinsics: Codable, Sendable {
+        let fx: Float
+        let fy: Float
+        let cx: Float
+        let cy: Float
+        let imageWidth: Int
+        let imageHeight: Int
+    }
+
+    struct Pose: Codable, Sendable {
+        let matrix: [Float]
+    }
+
+    struct Depth: Codable, Sendable {
+        let width: Int
+        let height: Int
+        let meters: [Float]
+        let confidence: [UInt8]
+    }
+
+    struct Provenance: Codable, Sendable {
+        let sensor: String
+        let source: String
+        let privacyClass: String
+        let sequence: UInt64
+        let timestampNs: UInt64
+        let schema: String
+    }
+
+    let type: String
+    let intrinsics: Intrinsics
+    let pose: Pose
+    let depth: Depth
+    let provenance: Provenance
+
+    init(
+        intrinsics: simd_float3x3,
+        imageResolution: CGSize,
+        cameraTransform: simd_float4x4,
+        depthWidth: Int,
+        depthHeight: Int,
+        depthMeters: [Float],
+        confidence: [UInt8],
+        sequence: UInt64,
+        timestamp: TimeInterval
+    ) {
+        self.type = "ruview.lidar.depth.v1"
+        self.intrinsics = Intrinsics(
+            fx: intrinsics.columns.0.x,
+            fy: intrinsics.columns.1.y,
+            cx: intrinsics.columns.2.x,
+            cy: intrinsics.columns.2.y,
+            imageWidth: Int(imageResolution.width),
+            imageHeight: Int(imageResolution.height)
+        )
+        self.pose = Pose(matrix: cameraTransform.columnMajorArray)
+        self.depth = Depth(
+            width: depthWidth,
+            height: depthHeight,
+            meters: depthMeters,
+            confidence: confidence
+        )
+        self.provenance = Provenance(
+            sensor: "apple-arkit-scene-depth",
+            source: "live",
+            privacyClass: "geometry-only",
+            sequence: sequence,
+            timestampNs: UInt64(max(0, timestamp) * 1_000_000_000),
+            schema: "ruview.lidar.depth.v1"
+        )
+    }
+
+    func assigningSequence(_ sequence: UInt64) -> RuViewLiDARFrame {
+        RuViewLiDARFrame(
+            type: type,
+            intrinsics: intrinsics,
+            pose: pose,
+            depth: depth,
+            provenance: Provenance(
+                sensor: provenance.sensor,
+                source: provenance.source,
+                privacyClass: provenance.privacyClass,
+                sequence: sequence,
+                timestampNs: provenance.timestampNs,
+                schema: provenance.schema
+            )
+        )
+    }
+
+    private init(
+        type: String,
+        intrinsics: Intrinsics,
+        pose: Pose,
+        depth: Depth,
+        provenance: Provenance
+    ) {
+        self.type = type
+        self.intrinsics = intrinsics
+        self.pose = pose
+        self.depth = depth
+        self.provenance = provenance
+    }
+}
+
+private extension simd_float4x4 {
+    var columnMajorArray: [Float] {
+        [
+            columns.0.x, columns.0.y, columns.0.z, columns.0.w,
+            columns.1.x, columns.1.y, columns.1.z, columns.1.w,
+            columns.2.x, columns.2.y, columns.2.z, columns.2.w,
+            columns.3.x, columns.3.y, columns.3.z, columns.3.w
+        ]
+    }
+}
@@ -0,0 +1,10 @@
+import SwiftUI
+
+@main
+struct RuViewLiDARApp: App {
+    var body: some Scene {
+        WindowGroup {
+            ContentView()
+        }
+    }
+}
@@ -0,0 +1,93 @@
+import Foundation
+
+actor WebSocketStreamer {
+    enum StreamError: Error {
+        case invalidURL
+    }
+
+    struct WirePacket: Codable {
+        struct Depth: Codable {
+            let width: Int
+            let height: Int
+            let encoding: String
+            let millimetersBase64: String
+            let confidenceBase64: String
+        }
+
+        let type: String
+        let intrinsics: RuViewLiDARFrame.Intrinsics
+        let pose: RuViewLiDARFrame.Pose
+        let depth: Depth
+        let provenance: RuViewLiDARFrame.Provenance
+    }
+
+    private var task: URLSessionWebSocketTask?
+    private let encoder = JSONEncoder()
+    private var lastSentNs: UInt64 = 0
+
+    func connect(to endpoint: String) throws {
+        guard let url = URL(string: endpoint),
+              url.scheme == "ws" || url.scheme == "wss" else {
+            throw StreamError.invalidURL
+        }
+        task?.cancel(with: .goingAway, reason: nil)
+        let socket = URLSession.shared.webSocketTask(with: url)
+        socket.resume()
+        task = socket
+    }
+
+    func disconnect() {
+        task?.cancel(with: .goingAway, reason: nil)
+        task = nil
+    }
+
+    func send(_ frame: RuViewLiDARFrame, maxFPS: UInt64 = 15, sampleStep: Int = 2) async throws {
+        guard let task else { return }
+
+        let timestamp = frame.provenance.timestampNs
+        let minDelta = 1_000_000_000 / max(1, maxFPS)
+        guard timestamp >= lastSentNs + minDelta else { return }
+        lastSentNs = timestamp
+
+        let packet = Self.makeWirePacket(frame, sampleStep: max(1, sampleStep))
+        let data = try encoder.encode(packet)
+        guard let string = String(data: data, encoding: .utf8) else { return }
+        try await task.send(.string(string))
+    }
+
+    static func makeWirePacket(_ frame: RuViewLiDARFrame, sampleStep: Int) -> WirePacket {
+        let step = max(1, sampleStep)
+        let sourceWidth = frame.depth.width
+        let sourceHeight = frame.depth.height
+        let width = (sourceWidth + step - 1) / step
+        let height = (sourceHeight + step - 1) / step
+
+        var millimeters = Data(capacity: width * height * 2)
+        var confidence = Data(capacity: width * height)
+
+        for y in stride(from: 0, to: sourceHeight, by: step) {
+            for x in stride(from: 0, to: sourceWidth, by: step) {
+                let index = y * sourceWidth + x
+                let meters = frame.depth.meters[index]
+                let mm = UInt16(clamping: Int((meters * 1000).rounded()))
+                var littleEndian = mm.littleEndian
+                withUnsafeBytes(of: &littleEndian) { millimeters.append(contentsOf: $0) }
+                confidence.append(frame.depth.confidence[index])
+            }
+        }
+
+        return WirePacket(
+            type: frame.type,
+            intrinsics: frame.intrinsics,
+            pose: frame.pose,
+            depth: WirePacket.Depth(
+                width: width,
+                height: height,
+                encoding: "u16le-mm+u8-confidence",
+                millimetersBase64: millimeters.base64EncodedString(),
+                confidenceBase64: confidence.base64EncodedString()
+            ),
+            provenance: frame.provenance
+        )
+    }
+}
@@ -0,0 +1,108 @@
+import { decodeLiDARPacket, depthToPointCloud } from './codec.mjs';
+
+const canvas = document.querySelector('#view');
+const ctx = canvas.getContext('2d');
+const status = document.querySelector('#status');
+const fpsEl = document.querySelector('#fps');
+const pointsEl = document.querySelector('#points');
+const seqEl = document.querySelector('#seq');
+const latencyEl = document.querySelector('#latency');
+const sensorEl = document.querySelector('#sensor');
+
+let lastFrameAt = performance.now();
+let yaw = 0.3;
+let pitch = -0.15;
+let scale = 120;
+
+function connect() {
+  const token = new URLSearchParams(location.search).get('token');
+  if (!token) {
+    status.textContent = 'TOKEN REQUIRED';
+    status.dataset.state = 'warn';
+    return;
+  }
+
+  const protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
+  const socket = new WebSocket(`${protocol}//${location.host}/ws/lidar?token=${encodeURIComponent(token)}`);
+
+  socket.addEventListener('open', () => {
+    status.textContent = 'LIVE';
+    status.dataset.state = 'live';
+  });
+
+  socket.addEventListener('close', () => {
+    status.textContent = 'RECONNECTING';
+    status.dataset.state = 'warn';
+    setTimeout(connect, 1000);
+  });
+
+  socket.addEventListener('message', (event) => {
+    try {
+      const raw = JSON.parse(event.data);
+      const frame = decodeLiDARPacket(raw);
+      const points = depthToPointCloud(frame, 1);
+      render(points);
+
+      const now = performance.now();
+      const delta = now - lastFrameAt;
+      lastFrameAt = now;
+      fpsEl.textContent = delta > 0 ? (1000 / delta).toFixed(1) : '0.0';
+      pointsEl.textContent = points.length.toLocaleString();
+      seqEl.textContent = frame.provenance.sequence;
+      latencyEl.textContent = Math.max(0, Date.now() - Number(frame.provenance.timestampNs / 1_000_000)).toFixed(0);
+      sensorEl.textContent = frame.provenance.sensor;
+    } catch (error) {
+      console.error(error);
+      status.textContent = 'FRAME ERROR';
+      status.dataset.state = 'warn';
+    }
+  });
+}
+
+function resize() {
+  const dpr = Math.min(devicePixelRatio || 1, 2);
+  const rect = canvas.getBoundingClientRect();
+  canvas.width = Math.max(1, Math.floor(rect.width * dpr));
+  canvas.height = Math.max(1, Math.floor(rect.height * dpr));
+  ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+}
+
+function render(points) {
+  resize();
+  const w = canvas.clientWidth;
+  const h = canvas.clientHeight;
+  ctx.clearRect(0, 0, w, h);
+  ctx.fillStyle = '#091018';
+  ctx.fillRect(0, 0, w, h);
+
+  const cy = Math.cos(yaw);
+  const sy = Math.sin(yaw);
+  const cp = Math.cos(pitch);
+  const sp = Math.sin(pitch);
+
+  ctx.fillStyle = '#58e0d2';
+  for (let i = 0; i < points.length; i += 1) {
+    let [x, y, z] = points[i];
+    const rx = x * cy - z * sy;
+    const rz = x * sy + z * cy;
+    const ry = y * cp - rz * sp;
+    const rz2 = y * sp + rz * cp;
+    const perspective = 1 / Math.max(0.35, 1.8 - rz2 * 0.12);
+    const px = w / 2 + rx * scale * perspective;
+    const py = h / 2 + ry * scale * perspective;
+    if (px >= 0 && px < w && py >= 0 && py < h) ctx.fillRect(px, py, 1.4, 1.4);
+  }
+}
+
+canvas.addEventListener('pointermove', (event) => {
+  if (!event.buttons) return;
+  yaw += event.movementX * 0.006;
+  pitch += event.movementY * 0.006;
+});
+
+canvas.addEventListener('wheel', (event) => {
+  event.preventDefault();
+  scale = Math.max(40, Math.min(400, scale - event.deltaY * 0.2));
+}, { passive: false });
+
+connect();
@@ -0,0 +1,121 @@
+export function decodeLiDARPacket(packet) {
+  if (!packet || packet.type !== 'ruview.lidar.depth.v1') {
+    throw new Error('Unsupported LiDAR packet type');
+  }
+
+  const { depth } = packet;
+  if (!depth || depth.encoding !== 'u16le-mm+u8-confidence') {
+    throw new Error('Unsupported depth encoding');
+  }
+
+  assertPositiveInteger(depth.width, 'depth.width');
+  assertPositiveInteger(depth.height, 'depth.height');
+  assertIntrinsics(packet.intrinsics);
+  if (!packet.pose || !Array.isArray(packet.pose.matrix) || packet.pose.matrix.length !== 16
+      || packet.pose.matrix.some((value) => !Number.isFinite(value))) {
+    throw new Error('Invalid camera pose');
+  }
+
+  const mmBytes = base64ToBytes(depth.millimetersBase64, 'millimetersBase64');
+  const confidence = base64ToBytes(depth.confidenceBase64, 'confidenceBase64');
+  const expectedPixels = depth.width * depth.height;
+
+  if (!Number.isSafeInteger(expectedPixels) || expectedPixels > 1_000_000) {
+    throw new Error('Depth dimensions exceed the supported pixel limit');
+  }
+
+  if (mmBytes.byteLength !== expectedPixels * 2) {
+    throw new Error(`Depth payload length mismatch: expected ${expectedPixels * 2}, got ${mmBytes.byteLength}`);
+  }
+  if (confidence.byteLength !== expectedPixels) {
+    throw new Error(`Confidence payload length mismatch: expected ${expectedPixels}, got ${confidence.byteLength}`);
+  }
+
+  const view = new DataView(mmBytes.buffer, mmBytes.byteOffset, mmBytes.byteLength);
+  const meters = new Float32Array(expectedPixels);
+  for (let i = 0; i < expectedPixels; i += 1) {
+    meters[i] = view.getUint16(i * 2, true) / 1000;
+  }
+
+  return {
+    ...packet,
+    depth: {
+      width: depth.width,
+      height: depth.height,
+      meters,
+      confidence,
+    },
+  };
+}
+
+export function depthToPointCloud(frame, confidenceThreshold = 1) {
+  const { width, height, meters, confidence } = frame.depth;
+  const { fx, fy, cx, cy, imageWidth, imageHeight } = frame.intrinsics;
+
+  assertPositiveInteger(width, 'depth.width');
+  assertPositiveInteger(height, 'depth.height');
+  assertIntrinsics(frame.intrinsics);
+  if (meters.length !== width * height || confidence.length !== width * height) {
+    throw new Error('Decoded depth array length mismatch');
+  }
+  if (!Number.isFinite(confidenceThreshold) || confidenceThreshold < 0 || confidenceThreshold > 255) {
+    throw new Error('Invalid confidence threshold');
+  }
+
+  const sx = width / imageWidth;
+  const sy = height / imageHeight;
+  const scaledFx = fx * sx;
+  const scaledFy = fy * sy;
+  const scaledCx = cx * sx;
+  const scaledCy = cy * sy;
+
+  const points = [];
+  for (let v = 0; v < height; v += 1) {
+    for (let u = 0; u < width; u += 1) {
+      const index = v * width + u;
+      const z = meters[index];
+      if (!Number.isFinite(z) || z <= 0 || confidence[index] < confidenceThreshold) continue;
+
+      const x = ((u - scaledCx) / scaledFx) * z;
+      const y = ((v - scaledCy) / scaledFy) * z;
+      points.push([x, y === 0 ? 0 : -y, -z]);
+    }
+  }
+  return points;
+}
+
+function assertPositiveInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+}
+
+function assertIntrinsics(intrinsics) {
+  if (!intrinsics
+      || !Number.isFinite(intrinsics.fx) || intrinsics.fx <= 0
+      || !Number.isFinite(intrinsics.fy) || intrinsics.fy <= 0
+      || !Number.isFinite(intrinsics.cx)
+      || !Number.isFinite(intrinsics.cy)) {
+    throw new Error('Invalid camera intrinsics');
+  }
+  assertPositiveInteger(intrinsics.imageWidth, 'intrinsics.imageWidth');
+  assertPositiveInteger(intrinsics.imageHeight, 'intrinsics.imageHeight');
+}
+
+function base64ToBytes(value, name) {
+  if (typeof value !== 'string' || value.length === 0 || value.length % 4 !== 0
+      || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new Error(`${name} must be canonical base64`);
+  }
+
+  if (typeof Buffer !== 'undefined') {
+    return Uint8Array.from(Buffer.from(value, 'base64'));
+  }
+
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
@@ -0,0 +1,69 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { decodeLiDARPacket, depthToPointCloud } from './codec.mjs';
+
+function b64(bytes) {
+  return Buffer.from(bytes).toString('base64');
+}
+
+test('decodes u16 millimeter depth and confidence', () => {
+  const packet = {
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 1, cy: 1, imageWidth: 2, imageHeight: 2 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: {
+      width: 2,
+      height: 2,
+      encoding: 'u16le-mm+u8-confidence',
+      millimetersBase64: b64([0xe8,0x03,0xd0,0x07,0xb8,0x0b,0xa0,0x0f]),
+      confidenceBase64: b64([2,2,1,0]),
+    },
+    provenance: { sensor: 'test', source: 'live', privacyClass: 'geometry-only', sequence: 1, timestampNs: 1, schema: 'ruview.lidar.depth.v1' },
+  };
+
+  const frame = decodeLiDARPacket(packet);
+  assert.deepEqual(Array.from(frame.depth.meters), [1,2,3,4]);
+  assert.deepEqual(Array.from(frame.depth.confidence), [2,2,1,0]);
+});
+
+test('rejects malformed payload length', () => {
+  assert.throws(() => decodeLiDARPacket({
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 1, cy: 1, imageWidth: 2, imageHeight: 2 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: { width: 2, height: 2, encoding: 'u16le-mm+u8-confidence', millimetersBase64: b64([1,2]), confidenceBase64: b64([1,1,1,1]) },
+  }), /length mismatch/);
+});
+
+test('rejects invalid dimensions, intrinsics, pose, and base64', () => {
+  const valid = {
+    type: 'ruview.lidar.depth.v1',
+    intrinsics: { fx: 100, fy: 100, cx: 0, cy: 0, imageWidth: 1, imageHeight: 1 },
+    pose: { matrix: Array(16).fill(0) },
+    depth: {
+      width: 1,
+      height: 1,
+      encoding: 'u16le-mm+u8-confidence',
+      millimetersBase64: b64([0xe8, 0x03]),
+      confidenceBase64: b64([2]),
+    },
+  };
+
+  assert.throws(() => decodeLiDARPacket({ ...valid, depth: { ...valid.depth, width: 0 } }), /positive integer/);
+  assert.throws(() => decodeLiDARPacket({ ...valid, intrinsics: { ...valid.intrinsics, fx: 0 } }), /intrinsics/);
+  assert.throws(() => decodeLiDARPacket({ ...valid, pose: { matrix: [1] } }), /pose/);
+  assert.throws(() => decodeLiDARPacket({
+    ...valid,
+    depth: { ...valid.depth, millimetersBase64: '!!!!' },
+  }), /canonical base64/);
+});
+
+test('projects depth into a point cloud and honors confidence', () => {
+  const frame = {
+    intrinsics: { fx: 100, fy: 100, cx: 0, cy: 0, imageWidth: 2, imageHeight: 2 },
+    depth: { width: 2, height: 2, meters: Float32Array.from([1,1,1,1]), confidence: Uint8Array.from([2,0,2,0]) },
+  };
+  const points = depthToPointCloud(frame, 1);
+  assert.equal(points.length, 2);
+  assert.deepEqual(points[0], [0, 0, -1]);
+});
@@ -0,0 +1,36 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover" />
+  <title>RuView iPhone LiDAR</title>
+  <link rel="stylesheet" href="./styles.css" />
+</head>
+<body>
+  <main>
+    <header>
+      <div>
+        <p class="eyebrow">RUVIEW SENSOR BRIDGE</p>
+        <h1>iPhone LiDAR</h1>
+      </div>
+      <span id="status">CONNECTING</span>
+    </header>
+
+    <section class="metrics">
+      <div><strong id="fps">0.0</strong><span>FPS</span></div>
+      <div><strong id="points">0</strong><span>POINTS</span></div>
+      <div><strong id="seq">0</strong><span>SEQ</span></div>
+      <div><strong id="latency">0</strong><span>MS</span></div>
+    </section>
+
+    <canvas id="view"></canvas>
+
+    <footer>
+      <span>Geometry only</span>
+      <span>No RGB upload</span>
+      <span id="sensor">Waiting for sensor</span>
+    </footer>
+  </main>
+  <script type="module" src="./app.mjs"></script>
+</body>
+</html>
@@ -0,0 +1,39 @@
+{
+  "name": "@ruview/iphone-lidar-web",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@ruview/iphone-lidar-web",
+      "version": "0.1.0",
+      "dependencies": {
+        "ws": "^8.18.3"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1,16 @@
+{
+  "name": "@ruview/iphone-lidar-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "start": "node relay.mjs",
+    "test": "node --test"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "ws": "^8.18.3"
+  }
+}
@@ -0,0 +1,166 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import http from 'node:http';
+import { readFile } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { WebSocket, WebSocketServer } from 'ws';
+
+const root = fileURLToPath(new URL('.', import.meta.url));
+const staticFiles = new Set(['index.html', 'app.mjs', 'codec.mjs', 'styles.css']);
+const maxPayloadBytes = 2_000_000;
+
+function constantTimeEqual(left, right) {
+  const leftBytes = Buffer.from(left, 'utf8');
+  const rightBytes = Buffer.from(right, 'utf8');
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+
+function rejectUpgrade(socket, status, message) {
+  const body = `${message}\n`;
+  socket.end(
+    `HTTP/1.1 ${status}\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(body)}\r\n\r\n${body}`,
+  );
+}
+
+export function createLiDARRelay({ token, rootDirectory = root } = {}) {
+  const accessToken = token || randomBytes(24).toString('hex');
+  const clients = new Set();
+
+  const server = http.createServer(async (req, res) => {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.writeHead(405, { allow: 'GET, HEAD' }).end();
+      return;
+    }
+
+    let pathname;
+    try {
+      pathname = decodeURIComponent(new URL(req.url || '/', 'http://localhost').pathname);
+    } catch {
+      res.writeHead(400).end('bad path');
+      return;
+    }
+
+    const filename = pathname === '/' ? 'index.html' : pathname.slice(1);
+    if (!staticFiles.has(filename)) {
+      res.writeHead(404).end('not found');
+      return;
+    }
+
+    try {
+      const data = await readFile(join(rootDirectory, filename));
+      const contentType = {
+        '.html': 'text/html; charset=utf-8',
+        '.mjs': 'text/javascript; charset=utf-8',
+        '.css': 'text/css; charset=utf-8',
+      }[extname(filename)] || 'application/octet-stream';
+      res.writeHead(200, {
+        'content-type': contentType,
+        'cache-control': 'no-store',
+        'content-security-policy': "default-src 'self'; connect-src 'self' ws: wss:; img-src 'self'; style-src 'self'; base-uri 'none'; frame-ancestors 'none'",
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+      });
+      if (req.method === 'HEAD') res.end();
+      else res.end(data);
+    } catch {
+      res.writeHead(404).end('not found');
+    }
+  });
+
+  const wss = new WebSocketServer({ noServer: true, maxPayload: maxPayloadBytes });
+
+  server.on('upgrade', (req, socket, head) => {
+    let url;
+    try {
+      url = new URL(req.url || '/', 'http://localhost');
+    } catch {
+      rejectUpgrade(socket, '400 Bad Request', 'bad websocket URL');
+      return;
+    }
+
+    if (url.pathname !== '/ws/lidar') {
+      rejectUpgrade(socket, '404 Not Found', 'not found');
+      return;
+    }
+
+    const suppliedToken = url.searchParams.get('token') || '';
+    if (!constantTimeEqual(suppliedToken, accessToken)) {
+      rejectUpgrade(socket, '401 Unauthorized', 'valid LiDAR relay token required');
+      return;
+    }
+
+    wss.handleUpgrade(req, socket, head, (websocket) => {
+      wss.emit('connection', websocket, req);
+    });
+  });
+
+  wss.on('connection', (socket) => {
+    clients.add(socket);
+    socket.on('close', () => clients.delete(socket));
+    socket.on('error', () => socket.terminate());
+    socket.on('message', (data, isBinary) => {
+      if (isBinary) return;
+
+      let packet;
+      try {
+        packet = JSON.parse(data.toString());
+      } catch {
+        return;
+      }
+
+      if (packet?.type !== 'ruview.lidar.depth.v1') return;
+
+      for (const peer of clients) {
+        if (peer !== socket && peer.readyState === WebSocket.OPEN) {
+          peer.send(data.toString());
+        }
+      }
+    });
+  });
+
+  return {
+    accessToken,
+    server,
+    async listen(port = 0, host = '127.0.0.1') {
+      await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(port, host, () => {
+          server.off('error', reject);
+          resolve();
+        });
+      });
+      return server.address();
+    },
+    async close() {
+      for (const peer of clients) peer.terminate();
+      await new Promise((resolve) => wss.close(resolve));
+      if (server.listening) {
+        await new Promise((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()));
+        });
+      }
+    },
+  };
+}
+
+function configuredPort(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1 || parsed > 65_535) {
+    throw new Error(`PORT must be an integer from 1 to 65535; received ${value}`);
+  }
+  return parsed;
+}
+
+const directInvocation = process.argv[1]
+  && pathToFileURL(process.argv[1]).href === import.meta.url;
+
+if (directInvocation) {
+  const port = configuredPort(process.env.PORT || '8787');
+  const host = process.env.HOST || '0.0.0.0';
+  const relay = createLiDARRelay({ token: process.env.RUVIEW_LIDAR_TOKEN });
+  await relay.listen(port, host);
+  const encodedToken = encodeURIComponent(relay.accessToken);
+  console.log(`RuView iPhone LiDAR relay listening on ${host}:${port}`);
+  console.log(`Browser: http://<host>:${port}/?token=${encodedToken}`);
+  console.log(`Native endpoint: ws://<host>:${port}/ws/lidar?token=${encodedToken}`);
+}
@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import test from 'node:test';
+import { WebSocket } from 'ws';
+import { createLiDARRelay } from './relay.mjs';
+
+function connect(url) {
+  return new Promise((resolve, reject) => {
+    const socket = new WebSocket(url);
+    socket.once('open', () => resolve(socket));
+    socket.once('error', reject);
+  });
+}
+
+function request(url) {
+  return new Promise((resolve, reject) => {
+    http.get(url, (response) => {
+      response.resume();
+      response.once('end', () => resolve(response));
+    }).once('error', reject);
+  });
+}
+
+test('relay requires a token, limits static files, and forwards LiDAR frames', async (t) => {
+  const token = 'test-token-for-relay';
+  const relay = createLiDARRelay({ token });
+  const address = await relay.listen(0, '127.0.0.1');
+  const httpBase = `http://127.0.0.1:${address.port}`;
+  const wsBase = `ws://127.0.0.1:${address.port}/ws/lidar`;
+  const sockets = [];
+
+  t.after(async () => {
+    for (const socket of sockets) socket.terminate();
+    await relay.close();
+  });
+
+  const indexResponse = await request(`${httpBase}/?token=${token}`);
+  assert.equal(indexResponse.statusCode, 200);
+  assert.match(indexResponse.headers['content-security-policy'], /frame-ancestors 'none'/);
+
+  const sourceResponse = await request(`${httpBase}/relay.mjs`);
+  assert.equal(sourceResponse.statusCode, 404);
+
+  await new Promise((resolve, reject) => {
+    const unauthorized = new WebSocket(wsBase);
+    unauthorized.once('unexpected-response', (_request, response) => {
+      assert.equal(response.statusCode, 401);
+      response.resume();
+      resolve();
+    });
+    unauthorized.once('open', () => reject(new Error('unauthorized websocket opened')));
+    unauthorized.once('error', () => {});
+  });
+
+  const sender = await connect(`${wsBase}?token=${encodeURIComponent(token)}`);
+  const receiver = await connect(`${wsBase}?token=${encodeURIComponent(token)}`);
+  sockets.push(sender, receiver);
+
+  const received = new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timed out waiting for relayed frame')), 2_000);
+    receiver.once('message', (data, isBinary) => {
+      clearTimeout(timer);
+      resolve({ data, isBinary });
+    });
+  });
+
+  const frame = { type: 'ruview.lidar.depth.v1', provenance: { sequence: 7 } };
+  sender.send(JSON.stringify(frame));
+  const message = await received;
+
+  assert.equal(message.isBinary, false);
+  assert.deepEqual(JSON.parse(message.data.toString()), frame);
+});
@@ -0,0 +1 @@
+*{box-sizing:border-box}body{margin:0;background:#05080d;color:#e8f1f5;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}main{min-height:100vh;padding:18px;display:grid;grid-template-rows:auto auto 1fr auto;gap:14px}header{display:flex;align-items:end;justify-content:space-between}h1{margin:0;font-size:clamp(28px,6vw,54px)}.eyebrow{margin:0 0 6px;color:#58e0d2;font-size:11px;letter-spacing:.16em}#status{border:1px solid #2a3946;border-radius:999px;padding:7px 11px;font-size:11px}#status[data-state=live]{color:#58e0d2;border-color:#58e0d2}.metrics{display:grid;grid-template-columns:repeat(4,1fr);gap:8px}.metrics div{background:#0b1219;border:1px solid #17222d;border-radius:10px;padding:10px}.metrics strong{display:block;font-size:18px}.metrics span,footer{font-size:10px;color:#8aa0af}canvas{width:100%;height:100%;min-height:55vh;border-radius:14px;border:1px solid #17222d;background:#091018;touch-action:none}footer{display:flex;gap:16px;flex-wrap:wrap}@media(max-width:640px){.metrics{grid-template-columns:repeat(2,1fr)}canvas{min-height:58vh}}
@@ -0,0 +1 @@
+{"ankle_penetration_m":0.04,"evidence":"SYNTHETIC/L0","expected_raw_hash":"98caf45c249d584d52ede84e2d76bd8c4bf225d426a4ef1651a5ddb178258b88","expected_result_hash":"8ef2ded432c938055a5ebc86eadff811216884093853f5c740c7aff7708b9bef","sequence":1}
@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "records": [
+    {
+      "split": "train",
+      "sequence": "sequence-1",
+      "take": "take-1",
+      "subject": "subject-1",
+      "room": "room-1",
+      "calibration_session": "calibration-1"
+    },
+    {
+      "split": "test",
+      "sequence": "sequence-2",
+      "take": "take-2",
+      "subject": "subject-1",
+      "room": "room-2",
+      "calibration_session": "calibration-2"
+    }
+  ]
+}
@@ -0,0 +1,8 @@
+{
+  "evidence": "SYNTHETIC/L0",
+  "records": [
+    { "split": "train", "sequence": "syn-train-seq", "take": "syn-train-take", "subject": "syn-train-subject", "room": "syn-train-room", "calibration_session": "syn-train-cal" },
+    { "split": "validation", "sequence": "syn-validation-seq", "take": "syn-validation-take", "subject": "syn-validation-subject", "room": "syn-validation-room", "calibration_session": "syn-validation-cal" },
+    { "split": "test", "sequence": "syn-test-seq", "take": "syn-test-take", "subject": "syn-test-subject", "room": "syn-test-room", "calibration_session": "syn-test-cal" }
+  ]
+}
@@ -0,0 +1,25 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const result = spawnSync(
+  "cargo",
+  ["tree", "-p", "wifi-densepose-physics", "-e", "normal", "--prefix", "none"],
+  { cwd: path.join(root, "v2"), encoding: "utf8" },
+);
+
+if (result.error) throw result.error;
+if (result.status !== 0) {
+  if (result.stdout) process.stderr.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exit(result.status ?? 1);
+}
+
+const forbidden = /^(?:burn(?:-|\s|$)|rapier3d(?:\s|$)|tch(?:\s|$)|ort(?:\s|$))/m;
+if (forbidden.test(result.stdout)) {
+  process.stderr.write(result.stdout);
+  throw new Error("default physics dependency graph contains an optional heavy backend");
+}
+
+process.stdout.write(JSON.stringify({ verdict: "PASS", profile: "default-kinematic" }) + "\n");
@@ -0,0 +1,16 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const input = process.argv[2];
+if (!input) throw new Error("usage: replay-pose-physics-golden.sh <golden-results.jsonl>");
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+const result = spawnSync(
+  "cargo",
+  ["run", "--quiet", "-p", "wifi-densepose-physics", "--features", "deterministic", "--example", "verify_golden", "--", path.resolve(input)],
+  { cwd: path.join(root, "v2"), encoding: "utf8" },
+);
+if (result.stdout) process.stdout.write(result.stdout);
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.error) throw result.error;
+if (result.status !== 0) process.exit(result.status ?? 1);
@@ -0,0 +1,27 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+
+const directory = path.dirname(fileURLToPath(import.meta.url));
+const run = (script, fixture) =>
+  spawnSync(process.execPath, [path.join(directory, script), path.join(directory, "testdata", fixture)], {
+    cwd: path.resolve(directory, "../.."),
+    encoding: "utf8",
+  });
+
+const strict = run("verify-splits.mjs", "strict-split-manifest.json");
+if (strict.status !== 0 || !strict.stdout.includes('"verdict":"PASS"')) {
+  throw new Error(`strict split fixture failed: ${strict.stderr || strict.stdout}`);
+}
+
+const leaky = run("verify-splits.mjs", "leaky-split-manifest.json");
+if (leaky.status === 0 || !leaky.stderr.includes("leakage:")) {
+  throw new Error("leaky split fixture was not rejected with a typed leakage error");
+}
+
+const golden = run("verify-golden.mjs", "golden-results.jsonl");
+if (golden.status !== 0 || !golden.stdout.includes('"verdict":"PASS"')) {
+  throw new Error(`golden replay fixture failed: ${golden.stderr || golden.stdout}`);
+}
+
+process.stdout.write(JSON.stringify({ verdict: "PASS", checks: 3 }) + "\n");
@@ -0,0 +1,23 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+
+const path = process.argv[2];
+if (!path) throw new Error("usage: verify-pose-physics-splits.sh <manifest.json>");
+const bytes = fs.readFileSync(path);
+const manifest = JSON.parse(bytes);
+const dimensions = ["sequence", "take", "subject", "room", "calibration_session"];
+if (!Array.isArray(manifest.records) || manifest.records.length === 0) throw new Error("manifest.records must be non-empty");
+const ownership = new Map();
+for (const record of manifest.records) {
+  if (!record.split || !["train", "validation", "test"].includes(record.split)) throw new Error("invalid split");
+  for (const dimension of dimensions) {
+    const value = record[dimension];
+    if (typeof value !== "string" || value.length === 0) throw new Error(`missing ${dimension}`);
+    const key = `${dimension}:${value}`;
+    const prior = ownership.get(key);
+    if (prior && prior !== record.split) throw new Error(`leakage: ${key} crosses ${prior}/${record.split}`);
+    ownership.set(key, record.split);
+  }
+}
+const digest = crypto.createHash("sha256").update(bytes).digest("hex");
+console.log(JSON.stringify({ verdict: "PASS", records: manifest.records.length, sha256: digest }));
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+node "$(dirname "$0")/pose-physics/verify-golden.mjs" "$@"
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -euo pipefail
+node "$(dirname "$0")/pose-physics/verify-splits.mjs" "$@"
@@ -0,0 +1,5 @@
+.build/
+.swiftpm/
+DerivedData/
+xcuserdata/
+*.xcuserstate
@@ -0,0 +1,197 @@
+import Combine
+import Foundation
+import RuViewNLOSApple
+import RuViewNLOSCore
+import UIKit
+
+@MainActor
+final class AppModel: ObservableObject {
+    enum ConnectionState: Equatable {
+        case disconnected
+        case connecting
+        case connected
+        case blocked
+    }
+
+    @Published var endpointText = "" {
+        didSet {
+            if endpointText != oldValue {
+                storedTokenAvailable = false
+            }
+        }
+    }
+    @Published var pairingToken = ""
+    @Published private(set) var storedTokenAvailable = false
+    @Published private(set) var transportActive = false
+    @Published private(set) var connectionState: ConnectionState = .disconnected
+    @Published private(set) var statusMessage = "Disconnected; no track evidence is displayed."
+    @Published private(set) var frame: TrackDisplayFrame?
+
+    let capabilities = AppleCapabilityProbe.probe()
+    let visibleDepthSession = VisibleDepthValidationSession()
+
+    private let client = NLOSWebSocketClient()
+    private let tokenStore = KeychainPairingTokenStore()
+    private var diagnosticFileURL: URL?
+
+    init() {
+        client.onEvent = { [weak self] event in
+            self?.handle(event)
+        }
+    }
+
+    var tracks: [NLOSTrack] { frame?.tracks ?? [] }
+    var isConnected: Bool { transportActive }
+
+    func startVisibleDepthValidation() {
+        let shortVersion = Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? "unknown"
+        let buildVersion = Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? "unknown"
+        visibleDepthSession.start(
+            deviceModelFamily: UIDevice.current.model,
+            osVersion: "iOS \(UIDevice.current.systemVersion)",
+            appVersion: "\(shortVersion) (\(buildVersion))"
+        )
+    }
+
+    func cancelVisibleDepthValidation() {
+        visibleDepthSession.cancel()
+    }
+
+    func prepareDiagnosticExport(consent: Bool) throws -> URL {
+        guard consent else { throw DiagnosticExportError.consentRequired }
+        visibleDepthSession.setExportConsent(true)
+        guard let diagnostic = visibleDepthSession.diagnostic else {
+            throw DiagnosticExportError.noDiagnostic
+        }
+        if let diagnosticFileURL {
+            try? FileManager.default.removeItem(at: diagnosticFileURL)
+        }
+        let url = FileManager.default.temporaryDirectory
+            .appendingPathComponent("ruview-visible-depth-\(diagnostic.sessionId).json")
+        try diagnostic.encodedJSON().write(to: url, options: [.atomic, .completeFileProtection])
+        diagnosticFileURL = url
+        return url
+    }
+
+    func connect() {
+        if transportActive {
+            client.disconnect()
+        }
+        let trimmedEndpoint = endpointText.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard let endpoint = URL(string: trimmedEndpoint) else {
+            block("Enter a valid wss endpoint.")
+            return
+        }
+
+        do {
+            let enteredToken = pairingToken
+            let token: String
+            if enteredToken.isEmpty {
+                guard let stored = try tokenStore.load(for: endpoint) else {
+                    storedTokenAvailable = false
+                    block("Enter a pairing token. None is stored for this server authority.")
+                    return
+                }
+                storedTokenAvailable = true
+                token = stored
+            } else {
+                token = enteredToken
+            }
+
+            try WSSConnectionValidator.validate(endpoint: endpoint, pairingToken: token)
+            if !enteredToken.isEmpty {
+                try tokenStore.save(enteredToken, for: endpoint)
+                storedTokenAvailable = true
+            }
+            try client.connect(endpoint: endpoint, pairingToken: token)
+            pairingToken = ""
+        } catch let error as LocalizedError {
+            block(error.errorDescription ?? "Connection setup failed closed.")
+        } catch {
+            block("Connection setup failed closed.")
+        }
+    }
+
+    func disconnect() {
+        client.disconnect()
+    }
+
+    func suspendForPrivacy() {
+        if visibleDepthSession.state == .requestingPermission ||
+            visibleDepthSession.state == .calibration ||
+            visibleDepthSession.state == .wallScan {
+            visibleDepthSession.cancel()
+        }
+        guard isConnected || frame != nil else { return }
+        client.disconnect()
+    }
+
+    func forgetPairingToken() {
+        do {
+            if transportActive {
+                client.disconnect()
+            }
+            try tokenStore.deleteAll()
+            pairingToken = ""
+            storedTokenAvailable = false
+            statusMessage = "Pairing token removed from Keychain."
+        } catch {
+            block("Keychain token could not be removed.")
+        }
+    }
+
+    private func handle(_ event: NLOSStreamEvent) {
+        switch event {
+        case .connecting:
+            transportActive = true
+            connectionState = .connecting
+            clearFrame()
+            statusMessage = "Opening authenticated secure stream…"
+        case .connected:
+            transportActive = true
+            connectionState = .connected
+            statusMessage = "Secure stream connected; waiting for validated evidence."
+        case let .frame(displayFrame):
+            transportActive = true
+            connectionState = .connected
+            frame = displayFrame
+            if displayFrame.tracks.isEmpty {
+                statusMessage = "Frame accepted, but no displayable tracks were present. Unknown tracks remain hidden."
+            } else {
+                statusMessage = "Validated frame \(displayFrame.sequence) with \(displayFrame.tracks.count) displayable track(s)."
+            }
+        case let .failClosed(reason):
+            connectionState = .blocked
+            clearFrame()
+            statusMessage = reason
+        case let .disconnected(reason):
+            transportActive = false
+            connectionState = .disconnected
+            clearFrame()
+            statusMessage = reason
+        }
+    }
+
+    private func block(_ reason: String) {
+        transportActive = false
+        connectionState = .blocked
+        clearFrame()
+        statusMessage = reason
+    }
+
+    private func clearFrame() {
+        frame = nil
+    }
+}
+
+enum DiagnosticExportError: LocalizedError {
+    case consentRequired
+    case noDiagnostic
+
+    var errorDescription: String? {
+        switch self {
+        case .consentRequired: return "Explicit export consent is required."
+        case .noDiagnostic: return "Complete or cancel a validation run before exporting."
+        }
+    }
+}
@@ -0,0 +1,441 @@
+import Foundation
+import RuViewNLOSApple
+import RuViewNLOSCore
+import SwiftUI
+
+struct ContentView: View {
+    @ObservedObject var model: AppModel
+    @Environment(\.scenePhase) private var scenePhase
+    @State private var exportConsent = false
+    @State private var diagnosticURL: URL?
+    @State private var exportError: String?
+
+    var body: some View {
+        NavigationStack {
+            ScrollView {
+                VStack(spacing: 18) {
+                    onboardingCard
+                    visibleDepthCard
+                    Text("NLOS MONITOR")
+                        .font(.caption.bold().monospaced())
+                        .foregroundStyle(.secondary)
+                        .frame(maxWidth: .infinity, alignment: .leading)
+                    connectionCard
+                    statusCard
+                    visualizationCard
+                    capabilityCard
+                    boundaryCard
+                }
+                .padding()
+            }
+            .navigationTitle("RuView NLOS")
+            .background(Color(uiColor: .systemGroupedBackground))
+            .onChange(of: scenePhase) { phase in
+                if phase != .active {
+                    model.suspendForPrivacy()
+                }
+            }
+        }
+    }
+
+    private var onboardingCard: some View {
+        card(title: "Beta tester setup") {
+            Label("Validate your iPhone's public ARKit LiDAR capabilities before opening the NLOS monitor.", systemImage: "iphone.gen3.radiowaves.left.and.right")
+                .font(.subheadline)
+            Text("This test measures only visible surfaces. Every result is labeled direct_depth and is never presented as around the corner evidence.")
+                .font(.caption.bold())
+                .foregroundStyle(.orange)
+            Link(destination: URL(string: "https://ruview-nlos.ruv.chatgpt.site")!) {
+                Label("Open the visual explainer", systemImage: "safari")
+            }
+            Link(destination: URL(string: "https://github.com/ruvnet/RuView/issues/1690")!) {
+                Label("Read the test guide and provide feedback", systemImage: "bubble.left.and.exclamationmark.bubble.right")
+            }
+        }
+    }
+
+    private var visibleDepthCard: some View {
+        card(title: "Visible depth validation") {
+            VisibleDepthValidationView(
+                session: model.visibleDepthSession,
+                exportConsent: $exportConsent,
+                diagnosticURL: $diagnosticURL,
+                exportError: $exportError,
+                start: model.startVisibleDepthValidation,
+                cancel: model.cancelVisibleDepthValidation,
+                prepareExport: model.prepareDiagnosticExport
+            )
+        }
+    }
+
+    private var connectionCard: some View {
+        card(title: "Authenticated stream") {
+            TextField("wss://host.example/api/v1/nlos/ws", text: $model.endpointText)
+                .textInputAutocapitalization(.never)
+                .autocorrectionDisabled()
+                .keyboardType(.URL)
+                .textContentType(.URL)
+                .padding(12)
+                .background(Color(uiColor: .tertiarySystemBackground))
+                .clipShape(RoundedRectangle(cornerRadius: 10))
+
+            SecureField(
+                model.storedTokenAvailable ? "Pairing token stored in Keychain" : "Pairing token",
+                text: $model.pairingToken
+            )
+            .textInputAutocapitalization(.never)
+            .autocorrectionDisabled()
+            .textContentType(.password)
+            .padding(12)
+            .background(Color(uiColor: .tertiarySystemBackground))
+            .clipShape(RoundedRectangle(cornerRadius: 10))
+
+            HStack {
+                Button(model.isConnected ? "Reconnect" : "Connect") {
+                    model.connect()
+                }
+                .buttonStyle(.borderedProminent)
+
+                if model.isConnected {
+                    Button("Disconnect", role: .cancel) {
+                        model.disconnect()
+                    }
+                    .buttonStyle(.bordered)
+                }
+
+                Spacer()
+
+                if model.storedTokenAvailable {
+                    Button("Forget token", role: .destructive) {
+                        model.forgetPairingToken()
+                    }
+                    .font(.caption)
+                }
+            }
+
+            Label(
+                "Bearer token stays in this device's Keychain and is sent only over wss.",
+                systemImage: "lock.shield"
+            )
+            .font(.caption)
+            .foregroundStyle(.secondary)
+        }
+    }
+
+    private var statusCard: some View {
+        card(title: "Evidence status") {
+            HStack(alignment: .top) {
+                Circle()
+                    .fill(statusColor)
+                    .frame(width: 10, height: 10)
+                    .padding(.top, 4)
+                Text(model.statusMessage)
+                    .font(.subheadline)
+                Spacer()
+            }
+
+            if let frame = model.frame {
+                HStack(spacing: 8) {
+                    badge(frame.source.rawValue.uppercased(), color: sourceColor(frame.source))
+                    badge(frame.evidenceLevel.rawValue.uppercased(), color: .indigo)
+                    badge("SEQ \(frame.sequence)", color: .gray)
+                }
+                .accessibilityElement(children: .combine)
+
+                VStack(alignment: .leading, spacing: 4) {
+                    Text("Sensor: \(frame.provenance.sensorModel)")
+                    Text("Transient: \(frame.provenance.transientKind.rawValue)")
+                    Text("Histogram preserved: \(frame.provenance.histogramPreserved ? "yes" : "no")")
+                    Text("Algorithm: \(frame.algorithmVersion)")
+                }
+                .font(.caption.monospaced())
+                .foregroundStyle(.secondary)
+            }
+        }
+    }
+
+    private var visualizationCard: some View {
+        card(title: "Validated hidden target hypotheses") {
+            ZStack {
+                TrackCanvas(tracks: model.tracks)
+                    .frame(height: 300)
+                    .privacySensitive()
+
+                if let watermark = model.frame?.watermark {
+                    Text(watermark)
+                        .font(.system(size: 38, weight: .black, design: .rounded))
+                        .foregroundStyle(.orange.opacity(0.42))
+                        .rotationEffect(.degrees(-18))
+                        .accessibilityLabel("Synthetic evidence watermark")
+                }
+
+                if model.tracks.isEmpty {
+                    Text("NO DISPLAYABLE TRACKS")
+                        .font(.caption.bold().monospaced())
+                        .foregroundStyle(.secondary)
+                        .padding(10)
+                        .background(.ultraThinMaterial, in: Capsule())
+                }
+            }
+
+            ForEach(model.tracks) { track in
+                HStack {
+                    VStack(alignment: .leading) {
+                        Text(track.trackId)
+                            .font(.subheadline.monospaced())
+                            .lineLimit(1)
+                        Text(String(
+                            format: "x %.2f  y %.2f  z %.2f m",
+                            track.positionM.x,
+                            track.positionM.y,
+                            track.positionM.z
+                        ))
+                        .font(.caption.monospacedDigit())
+                        .foregroundStyle(.secondary)
+                    }
+                    Spacer()
+                    Text("\(Int(track.confidence * 100))%")
+                        .font(.headline.monospacedDigit())
+                    badge(track.state.rawValue.uppercased(), color: track.state == .degraded ? .orange : .cyan)
+                }
+                .accessibilityElement(children: .combine)
+            }
+        }
+        .privacySensitive()
+    }
+
+    private var capabilityCard: some View {
+        card(title: "Apple capability probe") {
+            capabilityRow("ARKit scene depth", model.capabilities.sceneDepth)
+            capabilityRow("ARKit smoothed depth", model.capabilities.smoothedSceneDepth)
+            capabilityRow("ARKit scene mesh", model.capabilities.sceneMesh)
+            capabilityRow("ARKit world pose", model.capabilities.worldPose)
+            capabilityRow("Raw photon histograms", model.capabilities.rawPhotonHistograms)
+
+            Text(model.capabilities.rawPhotonHistogramReason)
+                .font(.caption)
+                .foregroundStyle(.secondary)
+                .fixedSize(horizontal: false, vertical: true)
+        }
+    }
+
+    private var boundaryCard: some View {
+        card(title: "Interpretation boundary") {
+            Label(
+                "This client visualizes validated NLOS output produced by an external transient histogram pipeline.",
+                systemImage: "waveform.path.ecg.rectangle"
+            )
+            Label(
+                "ARKit depth, mesh, and pose are useful context, but this app never labels them as optical NLOS evidence.",
+                systemImage: "exclamationmark.shield"
+            )
+            Text("Unknown, stale, malformed, replayed, oversized, or unauthenticated input is hidden by default.")
+                .font(.caption.bold())
+        }
+        .font(.subheadline)
+    }
+
+    private var statusColor: Color {
+        switch model.connectionState {
+        case .connected: return .green
+        case .connecting: return .yellow
+        case .blocked: return .red
+        case .disconnected: return .secondary
+        }
+    }
+
+    private func sourceColor(_ source: NLOSSource) -> Color {
+        switch source {
+        case .live: return .green
+        case .replay: return .blue
+        case .synthetic: return .orange
+        }
+    }
+
+    private func capabilityRow(
+        _ title: String,
+        _ availability: AppleCapabilityAvailability
+    ) -> some View {
+        HStack {
+            Text(title)
+            Spacer()
+            Label(
+                availability.rawValue.capitalized,
+                systemImage: availability == .available ? "checkmark.circle.fill" : "xmark.circle.fill"
+            )
+            .foregroundStyle(availability == .available ? .green : .secondary)
+        }
+        .font(.subheadline)
+    }
+
+    private func badge(_ text: String, color: Color) -> some View {
+        Text(text)
+            .font(.caption2.bold().monospaced())
+            .lineLimit(1)
+            .padding(.horizontal, 8)
+            .padding(.vertical, 4)
+            .background(color.opacity(0.14), in: Capsule())
+            .foregroundStyle(color)
+    }
+
+    private func card<Content: View>(
+        title: String,
+        @ViewBuilder content: () -> Content
+    ) -> some View {
+        VStack(alignment: .leading, spacing: 12) {
+            Text(title)
+                .font(.headline)
+            content()
+        }
+        .padding()
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .background(Color(uiColor: .secondarySystemGroupedBackground))
+        .clipShape(RoundedRectangle(cornerRadius: 18))
+    }
+}
+
+private struct VisibleDepthValidationView: View {
+    @ObservedObject var session: VisibleDepthValidationSession
+    @Binding var exportConsent: Bool
+    @Binding var diagnosticURL: URL?
+    @Binding var exportError: String?
+    let start: () -> Void
+    let cancel: () -> Void
+    let prepareExport: (Bool) throws -> URL
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 12) {
+            HStack {
+                Text("DIRECT_DEPTH")
+                    .font(.caption.bold().monospaced())
+                    .padding(.horizontal, 8)
+                    .padding(.vertical, 4)
+                    .background(Color.orange.opacity(0.15), in: Capsule())
+                    .foregroundStyle(.orange)
+                Spacer()
+                Text(phaseLabel)
+                    .font(.caption.bold().monospacedDigit())
+            }
+
+            Text(session.statusMessage)
+                .font(.subheadline)
+
+            if isRunning {
+                ProgressView(value: phaseProgress)
+                LazyVGrid(columns: [GridItem(.flexible()), GridItem(.flexible())], spacing: 8) {
+                    metric("FPS", String(format: "%.1f", session.metrics.fps))
+                    metric("Depth coverage", "\(Int(session.metrics.depthCoverage * 100))%")
+                    metric("Tracking", session.metrics.trackingState)
+                    metric("Movement", String(format: "%.3f m/s", session.metrics.movementMetersPerSecond))
+                    metric("Thermal", session.metrics.thermalState)
+                    metric("Remaining", "\(session.metrics.phaseSecondsRemaining)s")
+                }
+                Button("Cancel validation", role: .cancel, action: cancel)
+                    .buttonStyle(.bordered)
+            } else {
+                Button {
+                    exportConsent = false
+                    diagnosticURL = nil
+                    exportError = nil
+                    start()
+                } label: {
+                    Label(session.diagnostic == nil ? "Start 45 second validation" : "Run again", systemImage: "sensor.tag.radiowaves.forward")
+                }
+                .buttonStyle(.borderedProminent)
+            }
+
+            if session.diagnostic != nil {
+                Divider()
+                diagnosticPreview
+                Toggle(isOn: $exportConsent) {
+                    VStack(alignment: .leading, spacing: 2) {
+                        Text("I choose to export aggregate diagnostics")
+                        Text("The JSON contains no images, raw depth, endpoint, token, or raw samples.")
+                            .font(.caption)
+                            .foregroundStyle(.secondary)
+                    }
+                }
+                .onChange(of: exportConsent) { consent in
+                    if !consent { diagnosticURL = nil }
+                }
+
+                if let diagnosticURL {
+                    ShareLink(item: diagnosticURL) {
+                        Label("Share diagnostic JSON", systemImage: "square.and.arrow.up")
+                    }
+                    .buttonStyle(.borderedProminent)
+                } else {
+                    Button("Prepare local JSON") {
+                        do {
+                            diagnosticURL = try prepareExport(exportConsent)
+                            exportError = nil
+                        } catch {
+                            exportError = error.localizedDescription
+                        }
+                    }
+                    .buttonStyle(.bordered)
+                    .disabled(!exportConsent)
+                }
+                if let exportError {
+                    Text(exportError).font(.caption).foregroundStyle(.red)
+                }
+                Link("Open issue 1690 to submit feedback", destination: URL(string: "https://github.com/ruvnet/RuView/issues/1690")!)
+                    .font(.caption)
+            }
+        }
+    }
+
+    private var isRunning: Bool {
+        session.state == .requestingPermission || session.state == .calibration || session.state == .wallScan
+    }
+
+    private var phaseLabel: String {
+        switch session.state {
+        case .idle: return "READY"
+        case .requestingPermission: return "PERMISSION"
+        case .calibration: return "CALIBRATION 15S"
+        case .wallScan: return "WALL SCAN 30S"
+        case .completed: return "COMPLETED"
+        case .cancelled: return "CANCELLED"
+        case .failed: return "FAILED"
+        }
+    }
+
+    private var phaseProgress: Double {
+        let total = session.state == .calibration ? 15.0 : 30.0
+        return max(0, min(1, (total - Double(session.metrics.phaseSecondsRemaining)) / total))
+    }
+
+    private func metric(_ title: String, _ value: String) -> some View {
+        VStack(alignment: .leading, spacing: 2) {
+            Text(title).font(.caption).foregroundStyle(.secondary)
+            Text(value).font(.subheadline.bold().monospacedDigit()).lineLimit(1).minimumScaleFactor(0.7)
+        }
+        .padding(10)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .background(Color(uiColor: .tertiarySystemBackground), in: RoundedRectangle(cornerRadius: 10))
+    }
+
+    @ViewBuilder
+    private var diagnosticPreview: some View {
+        if let diagnostic = session.diagnostic {
+            VStack(alignment: .leading, spacing: 4) {
+                Text("Diagnostic preview")
+                    .font(.subheadline.bold())
+                Text("Evidence: \(diagnostic.evidenceLabel.rawValue)")
+                Text("Physical NLOS: \(diagnostic.physicalNLOSStatus)")
+                Text("Permission: \(diagnostic.cameraPermission)")
+                Text("Phases: \(diagnostic.phases.count) aggregate summaries")
+                if let byteCount = try? diagnostic.encodedJSON().count {
+                    Text("Encoded size: \(byteCount) bytes of 65,536 maximum")
+                }
+                Text("Raw sensor export: false")
+            }
+            .font(.caption.monospaced())
+            .foregroundStyle(.secondary)
+            .padding(10)
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .background(Color(uiColor: .tertiarySystemBackground), in: RoundedRectangle(cornerRadius: 10))
+        }
+    }
+}
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleDisplayName</key>
+	<string>RuView NLOS</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+	<key>LSRequiresIPhoneOS</key>
+	<true/>
+	<key>NSLocalNetworkUsageDescription</key>
+	<string>RuView connects to an explicitly configured, authenticated NLOS processing server on your network.</string>
+	<key>NSCameraUsageDescription</key>
+	<string>RuView uses the camera and LiDAR only during an explicit visible depth validation. Images and raw depth samples are never saved.</string>
+	<key>UILaunchScreen</key>
+	<dict/>
+	<key>UISupportedInterfaceOrientations</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
+</dict>
+</plist>
Author	SHA1	Message	Date
rUv	4a8c8ea734	fix(ios): isolate ARKit sources to iOS builds	2026-08-23 09:45:12 -04:00
rUv	958a0df220	feat(nlos): add governed iOS beta setup assistant	2026-08-23 09:40:41 -04:00
ruv	a4b381527e	ci(nlos): unsuppress strict Xcode diagnostics	2026-08-22 21:20:08 -04:00
ruv	d6ec9f8590	fix(nlos): tighten evidence gates and stream replay	2026-08-22 21:17:01 -04:00
rUv	73ebd9f33e	ci(nlos): install Rust components on pinned toolchain	2026-08-22 20:58:17 -04:00
rUv	a373ff666b	feat(nlos): add consumer transient sensing pipeline	2026-08-22 20:46:26 -04:00
rUv	0df48df7b2	feat: add native iPhone LiDAR sensor and web viewer (#1684 ) * feat(ios): add RuView LiDAR frame protocol * feat(ios): capture ARKit scene depth for RuView * feat(ios): stream compact LiDAR frames over websocket * feat(ios): add native LiDAR capture UI * feat(ios): add RuView LiDAR app entrypoint * feat(web): add LiDAR bridge web package * feat(web): decode RuView LiDAR wire frames * feat(web): add local LiDAR websocket relay * feat(web): add LiDAR browser viewer * feat(web): render live LiDAR point cloud * fix(ios): use wall clock time for LiDAR provenance * feat(web): style LiDAR viewer * test(web): add LiDAR codec tests * docs: add iPhone LiDAR integration guide * docs(adr): define iPhone LiDAR sensor bridge * fix(ios): harden and validate LiDAR bridge * fix(ios): qualify LiDAR wire depth type	2026-08-22 18:06:16 -04:00
rUv	bd110e0eac	fix(homecore): enable standalone Arc serialization (#1682 )	2026-08-22 15:55:36 -04:00
rUv	f3c361efd1	fix: align multistatic CSI time and clear Rust advisories (#1669 ) Use mesh-aligned capture timestamps, remediate Rust advisories, harden the audit gate, and correct deployment claims. Includes the live MQTT subscriber lifetime fix verified against Mosquitto.	2026-08-22 14:59:22 -04:00
rUv	a3b6e1d500	docs(harness): publish final Cognitum Spaces evidence (#1653 )	2026-08-19 14:52:09 -04:00
rUv	1d2ad6aa8e	docs(harness): mark Cognitum Spaces guidance live (#1651 )	2026-08-19 14:03:15 -04:00
rUv	c929bbc8b3	feat(spaces): add spatial memory and governed actions (#1650 )	2026-08-19 13:23:29 -04:00
rUv	d36f346bba	feat(metaharness): add guarded Cognitum Spaces OAuth (#1644 )	2026-08-18 21:58:39 -04:00
rUv	2c249ec8cb	docs(adr): record Cognitum Spaces production evidence (#1639 ) * docs(adr): record Cognitum Spaces production evidence * docs(adr): link deferred Spaces milestones	2026-08-18 15:59:00 -04:00
rUv	7927839f4f	feat: add governed Cognitum Spaces activation (#1631 ) Add explicit spaces:read consent, a bounded read client and CLI surface, and ADR-325's privacy, memory, and action-governance contract. Closes #1630.	2026-08-18 15:21:48 -04:00
rUv	a76adc3c2f	Merge pull request #1624 from ruvnet/claude/off-axis-sneaker-ruview-u398g0 ADR-324: off-axis-mode — clean-room Kooima projection in Rust/WASM + demo	2026-08-16 21:02:12 -04:00
Claudeandclaude-flow	aae2ed5345	chore: refresh scheduled_tasks session lock Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01BU3NcEgTpAVvu5QGtw4czT	2026-08-16 23:53:55 +00:00
Claudeandclaude-flow	3161af52da	feat(offaxis): clean-room Kooima off-axis projection in Rust/WASM (ADR-324) New leaf crate v2/crates/ruview-offaxis implementing ADR-324's projection core from the published math only (Kooima 2008 generalized perspective projection; Casiez 2012 one-euro filter) — no code from the unlicensed prior-art repo. Dependency-free native core; wasm-bindgen surface gated to wasm32 (cdylib+rlib, ~54 KB wasm after bindgen). - projection: Screen (3 corners, any orientation) + off_axis() -> typed errors, never NaN matrices; column-major f64 (three.js Matrix4 layout). Tests pin the defining invariants: screen corners -> NDC corners for a grid of eye positions and tilted screens; screen-plane points are eye-invariant; centered eye reduces to the symmetric frustum; near/far map to NDC -1/+1. - filter: one-euro with injected timestamps (no clock in crate); monotonicity/convergence/NaN-rejection tests. - rf: field-peak extraction mirroring field_localize.rs constants (X_SCALE 0.6, Z_SCALE 0.5, PEAK_THRESHOLD 0.35) and the Tier B coarse-parallax stage (deadband, gain, hard clamp) so over-claiming is impossible at the API level. No accuracy numbers asserted. - wasm: OffAxisCamera + RfParallax bindgen classes; per-frame updates hold last good state instead of throwing. - benches (criterion): full Tier B frame ~598 ns; argmax scan optimized -18%/-33% (20x20/100x100). MEASURED table + reproducer in README. - examples/three.js/demos/07-off-axis-window.html: demo with SYNTHETIC mouse simulator and labeled RF Tier B mode ('coarse body parallax - not head tracking'), physical calibration panel, /ws/sensing input, and a build-instructions overlay when the local pkg/ output is missing (generated artifacts stay uncommitted; .gitignore entry added). - Validated 23 unit tests + doctest, clippy clean, wasm32 release build, Node smoke test of the bindgen output, and a headless-Chromium run of the demo (engine load, eye response, mode labels, ws failure path). - ADR-324: header + section 2.5 amendment recording the Rust/WASM core. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01BU3NcEgTpAVvu5QGtw4czT	2026-08-16 23:52:43 +00:00
Claudeandclaude-flow	501f138360	docs(adr): ADR-324 off-axis head-coupled perspective demo (RF-assisted) Deep-research ADR answering whether icurtis1/off-axis-sneaker can be used with RuView. Adopts the head-coupled perspective technique (Kooima generalized off-axis projection) via a clean-room implementation — the upstream repo is unlicensed, so no code or assets are reused. Defines a tiered integration: webcam-fine tracking with RF presence gating and multi-person arbitration (Tier A), an explicitly labeled RF-only coarse body-parallax mode (Tier B), and evidence-gated future metric RF head positioning (Tier C). No server changes; existing /ws/sensing and /api/v1/stream/pose streams only. Indexed in the ADR README. Co-Authored-By: claude-flow <ruv@ruv.net> Claude-Session: https://claude.ai/code/session_01BU3NcEgTpAVvu5QGtw4czT	2026-08-16 23:20:11 +00:00
rUv	4685618388	fix: remediate vitals, desktop, and repository integrity issues (#1618 ) Fix breathing confidence, Windows desktop launch and clean UI builds, contributor-harness line-ending integrity, runtime secret hygiene, and remove the six ADR-299 CSI/person-data files from the current tree.	2026-08-15 20:09:43 -04:00
rUv	1d50518a70	Merge pull request #1617 from ruvnet/feat/adr-323-pose-physics feat: add physics-constrained pose refinement	2026-08-15 17:08:02 -04:00
ruv	0370d49e4a	feat: add physics-constrained pose refinement	2026-08-15 14:29:07 -04:00
				`@@ -0,0 +1 @@`
				*{box-sizing:border-box}body{margin:0;background:#05080d;color:#e8f1f5;font-family:ui-monospace,SFMono-Regular,Menlo,monospace}main{min-height:100vh;padding:18px;display:grid;grid-template-rows:auto auto 1fr auto;gap:14px}header{display:flex;align-items:end;justify-content:space-between}h1{margin:0;font-size:clamp(28px,6vw,54px)}.eyebrow{margin:0 0 6px;color:#58e0d2;font-size:11px;letter-spacing:.16em}#status{border:1px solid #2a3946;border-radius:999px;padding:7px 11px;font-size:11px}#status[data-state=live]{color:#58e0d2;border-color:#58e0d2}.metrics{display:grid;grid-template-columns:repeat(4,1fr);gap:8px}.metrics div{background:#0b1219;border:1px solid #17222d;border-radius:10px;padding:10px}.metrics strong{display:block;font-size:18px}.metrics span,footer{font-size:10px;color:#8aa0af}canvas{width:100%;height:100%;min-height:55vh;border-radius:14px;border:1px solid #17222d;background:#091018;touch-action:none}footer{display:flex;gap:16px;flex-wrap:wrap}@media(max-width:640px){.metrics{grid-template-columns:repeat(2,1fr)}canvas{min-height:58vh}}
				`@@ -0,0 +1 @@`
				`{"ankle_penetration_m":0.04,"evidence":"SYNTHETIC/L0","expected_raw_hash":"98caf45c249d584d52ede84e2d76bd8c4bf225d426a4ef1651a5ddb178258b88","expected_result_hash":"8ef2ded432c938055a5ebc86eadff811216884093853f5c740c7aff7708b9bef","sequence":1}`