Covers the work in RuView PR #1579, not yet merged.
Today, when RuView's WiFi sensing gives you an answer ("someone is in the room"), you have to just trust it. This release starts building the plumbing for the system to instead say either: "here's my answer, and here's proof it's trustworthy right now" — or, when it's not sure — "I don't know" — instead of quietly guessing.
Think of it like a nutrition label for a sensor reading: not just the number, but where it came from, whether the sensor was properly calibrated, and whether conditions have changed since.
- Better test data pipelines — the system can now ingest a well-known public WiFi-sensing benchmark (Widar3.0), newer high-resolution WiFi hardware data, and a rig for checking vital-sign (breathing/heart rate) accuracy against ground truth.
- Five safety fixes from an outside security/quality review, including:
- A guard that stops a network security bug where the sensor's data port could be reached by unintended senders — this one now actively checks every incoming connection.
- A check that catches when someone accidentally commits raw sensor recordings (which can contain identifiable personal data) into the code repository.
- A check that catches a specific kind of broken AI model before it ships — one that was published earlier and technically outputs a number that always says "yes, someone is present," no matter what it actually sees (more below).
- The beginning of a "trust chain" — nine new building blocks for calibrating a sensor, signing that calibration so it can't be silently altered, and checking whether current conditions still match what the sensor was calibrated for.
This is a preview, not a finished feature. Here's the plain-language version of the gap:
The new "trust chain" pieces (calibrate → sign → check → allow/deny) are each well-built and each have their own passing tests. But they are not yet connected to each other, and they're not yet wired into the actual sensing server that runs day to day. It's like building a smoke detector, a sprinkler system, and a fire alarm separately, each one tested on a workbench and working perfectly — but none of the wires between them have been run yet. Today, nothing in the running system actually uses this chain to stop a bad reading from being trusted.
Two of the five safety fixes above are the exception — they are fully wired in and active today:
- The network port guard (blocks unwanted senders on every connection, right now).
- The accidental-personal-data-commit checker (runs automatically on every code change).
- Full automated test suite: 4,337 tests passed, 0 failed.
- Deterministic signal-processing proof (a fixed reference signal must always produce an exact, reproducible fingerprint): passed, bit-for-bit match against the published expected result.
- This work is not merged into the main codebase yet — it's still under review.
- No ESP32 hardware or Python code was touched by this change, so none was tested here.
- The already-published broken AI model mentioned above has not been taken down yet — that requires a maintainer decision, and this release only prevents the next one from shipping.
- Full technical review (for developers): the PR itself, #1579
- User guide section added by this preview: "Perception Certificate Spine (Developer Preview, ADR-297)"
in
docs/user-guide.md