feat: RuvSense Multistatic Sensing + Persistent Field Model + RuView Fusion (ADR-029/030/031) #76

New Issue

2026-03-02T10:40:04+08:00

ruvnet commented

2026-03-02 10:40:04 +08:00

(Migrated from github.com)

See Through Walls Better — With $48 Worth of ESP32s

WiFi-DensePose already tracks people through walls using a single receiver. But one viewpoint has blind spots — limbs behind the torso are invisible, depth is ambiguous, and two people at the same range merge into one signal. Physics, not software, is the bottleneck.

RuvSense fixes the physics. Four ESP32-S3 nodes ($12 each) arranged around a room provide 12 TX-RX measurement links covering 360 degrees. Each node hops across WiFi channels 1/6/11, tripling effective bandwidth from 20 to 60 MHz. An attention-weighted fusion layer learns which viewpoints matter most for each body part. The result: production-grade pose tracking that a single receiver physically cannot achieve.

What's New — Three ADRs, One Pipeline

ADR-029: RuvSense Multistatic Sensing Mode

The core pipeline. Turns a bag of ESP32s into a coordinated sensing instrument.

Component	What it does	Why it matters
TDM Protocol	Nodes take turns transmitting; all others receive	Creates 12 measurement links from 4 devices
Channel Hopping	Cycles through ch1/6/11 at 50ms dwell	Triples bandwidth without wider channels
Multi-Band Fusion	3 channels × 56 subcarriers = 168 virtual	Better multipath separation
Phase Alignment	Corrects LO rotation between channel hops	Clean cross-channel combination
Coherence Gating	Auto-rejects noisy frames, stable for days	No manual tuning, no drift
Pose Tracker	17-keypoint Kalman with re-ID embeddings	Two people, zero ID swaps, 10 minutes

Acceptance test: Two people, 20 Hz, <30mm torso jitter, zero identity swaps for 10 minutes, breathing SNR >10 dB at 3 meters.

ADR-030: Persistent Field Model — 7 Exotic Sensing Tiers

Treats the electromagnetic field as a persistent world model, not a momentary measurement. The room remembers.

Tier	Capability	How
1	Field Normal Modes	SVD on unoccupied CSI → room eigenstructure
2	RF Tomography	3D occupancy grid from link attenuations (ISTA solver)
3	Intention Prediction	Detect anticipatory postural shifts 200-500ms before movement
4	Longitudinal Drift	Track gait/posture changes over weeks via Welford stats
5	Cross-Room Identity	Preserve person ID across rooms without cameras
6	Gesture Recognition	DTW-based template matching on CSI perturbations
7	Adversarial Detection	Flag physically impossible signals (multi-link consistency)

Important: These detect biophysical proxies, not diagnoses. "Your gait asymmetry shifted 18% over 14 days" — actionable, not diagnostic. Full evidence chain stored.

ADR-031: RuView Cross-Viewpoint Fusion

Learned attention replaces hand-crafted aggregation.

Component	What it does
Geometric Bias Matrix	Encodes angular separation + distance between node pairs
Scaled Dot-Product Attention	Q,K,V projections with softmax((QK^T + G_bias)/√d)
Geometric Diversity Index	Quantifies how well nodes cover the room
Fusion Orchestrator	Collects per-viewpoint AETHER embeddings → fused output

Implementation Summary

Metric	Value
New Rust code	12,126 lines
New modules	22 (10 signal + 5 ruvector + 2 hardware + 4 train + 1 firmware)
New tests	285
Firmware changes	Channel hopping, NDP injection, 5 new NVS keys
DDD bounded contexts	6 (Sensing, Coherence, Tracking, Field, Identity, Adversarial)
Security fixes	Timestamp underflow (saturating_sub), bounded buffers, NaN guards

New Rust Modules

Signal crate (wifi-densepose-signal/src/ruvsense/):

mod.rs — Pipeline orchestrator
multiband.rs — Multi-band CSI frame fusion
phase_align.rs — Cross-channel phase correction
multistatic.rs — Attention-weighted viewpoint fusion
coherence.rs — Z-score coherence scoring
coherence_gate.rs — Accept/PredictOnly/Reject/Recalibrate
pose_tracker.rs — 17-keypoint Kalman + re-ID
field_model.rs — Room eigenstructure via SVD + Welford
tomography.rs — RF tomography with ISTA solver
longitudinal.rs — Personal drift detection over days
intention.rs — Pre-movement lead signal detection
cross_room.rs — Cross-room identity continuity
gesture.rs — DTW gesture classification
adversarial.rs — Impossible signal detection

RuVector crate (wifi-densepose-ruvector/src/viewpoint/):

attention.rs — Scaled dot-product with geometric bias
geometry.rs — Geometric Diversity Index + Cramer-Rao bounds
coherence.rs — Phase phasor coherence gating
fusion.rs — MultistaticArray fusion orchestrator

Hardware crate:

esp32/tdm.rs — TDM sensing protocol, sync beacons, drift compensation

Training crate:

ruview_metrics.rs — 3-metric acceptance test (Bronze/Silver/Gold)

Security Audit Findings

Severity	Count	Status
Critical	2	Fixed (timestamp underflow, FIFO eviction)
Warning	11	Documented (NaN guards, file size, naming)
Optimization	5	Noted for future iteration

Quick Verification

# Check new modules compile
cd rust-port/wifi-densepose-rs
cargo check --workspace --no-default-features

# Run the new tests
cargo test -p wifi-densepose-signal --no-default-features -- ruvsense
cargo test -p wifi-densepose-ruvector --no-default-features -- viewpoint
cargo test -p wifi-densepose-hardware --no-default-features -- tdm
cargo test -p wifi-densepose-train --no-default-features -- ruview

PR: #TBD (ruvsense-full-implementation → main)
ADR-029: RuvSense Multistatic
ADR-030: Persistent Field Model
ADR-031: RuView Fusion
DDD Domain Model

## See Through Walls Better — With $48 Worth of ESP32s WiFi-DensePose already tracks people through walls using a single receiver. But one viewpoint has blind spots — limbs behind the torso are invisible, depth is ambiguous, and two people at the same range merge into one signal. Physics, not software, is the bottleneck. **RuvSense fixes the physics.** Four ESP32-S3 nodes ($12 each) arranged around a room provide 12 TX-RX measurement links covering 360 degrees. Each node hops across WiFi channels 1/6/11, tripling effective bandwidth from 20 to 60 MHz. An attention-weighted fusion layer learns which viewpoints matter most for each body part. The result: production-grade pose tracking that a single receiver physically cannot achieve. --- ## What's New — Three ADRs, One Pipeline ### ADR-029: RuvSense Multistatic Sensing Mode The core pipeline. Turns a bag of ESP32s into a coordinated sensing instrument. | Component | What it does | Why it matters | |-----------|-------------|----------------| | **TDM Protocol** | Nodes take turns transmitting; all others receive | Creates 12 measurement links from 4 devices | | **Channel Hopping** | Cycles through ch1/6/11 at 50ms dwell | Triples bandwidth without wider channels | | **Multi-Band Fusion** | 3 channels × 56 subcarriers = 168 virtual | Better multipath separation | | **Phase Alignment** | Corrects LO rotation between channel hops | Clean cross-channel combination | | **Coherence Gating** | Auto-rejects noisy frames, stable for days | No manual tuning, no drift | | **Pose Tracker** | 17-keypoint Kalman with re-ID embeddings | Two people, zero ID swaps, 10 minutes | **Acceptance test:** Two people, 20 Hz, <30mm torso jitter, zero identity swaps for 10 minutes, breathing SNR >10 dB at 3 meters. ### ADR-030: Persistent Field Model — 7 Exotic Sensing Tiers Treats the electromagnetic field as a **persistent world model**, not a momentary measurement. The room remembers. | Tier | Capability | How | |------|-----------|-----| | 1 | **Field Normal Modes** | SVD on unoccupied CSI → room eigenstructure | | 2 | **RF Tomography** | 3D occupancy grid from link attenuations (ISTA solver) | | 3 | **Intention Prediction** | Detect anticipatory postural shifts 200-500ms before movement | | 4 | **Longitudinal Drift** | Track gait/posture changes over weeks via Welford stats | | 5 | **Cross-Room Identity** | Preserve person ID across rooms without cameras | | 6 | **Gesture Recognition** | DTW-based template matching on CSI perturbations | | 7 | **Adversarial Detection** | Flag physically impossible signals (multi-link consistency) | **Important:** These detect biophysical proxies, not diagnoses. "Your gait asymmetry shifted 18% over 14 days" — actionable, not diagnostic. Full evidence chain stored. ### ADR-031: RuView Cross-Viewpoint Fusion Learned attention replaces hand-crafted aggregation. | Component | What it does | |-----------|-------------| | **Geometric Bias Matrix** | Encodes angular separation + distance between node pairs | | **Scaled Dot-Product Attention** | Q,K,V projections with softmax((QK^T + G_bias)/√d) | | **Geometric Diversity Index** | Quantifies how well nodes cover the room | | **Fusion Orchestrator** | Collects per-viewpoint AETHER embeddings → fused output | --- ## Implementation Summary | Metric | Value | |--------|-------| | New Rust code | **12,126 lines** | | New modules | **22** (10 signal + 5 ruvector + 2 hardware + 4 train + 1 firmware) | | New tests | **285** | | Firmware changes | Channel hopping, NDP injection, 5 new NVS keys | | DDD bounded contexts | 6 (Sensing, Coherence, Tracking, Field, Identity, Adversarial) | | Security fixes | Timestamp underflow (saturating_sub), bounded buffers, NaN guards | ### New Rust Modules **Signal crate (`wifi-densepose-signal/src/ruvsense/`):** - `mod.rs` — Pipeline orchestrator - `multiband.rs` — Multi-band CSI frame fusion - `phase_align.rs` — Cross-channel phase correction - `multistatic.rs` — Attention-weighted viewpoint fusion - `coherence.rs` — Z-score coherence scoring - `coherence_gate.rs` — Accept/PredictOnly/Reject/Recalibrate - `pose_tracker.rs` — 17-keypoint Kalman + re-ID - `field_model.rs` — Room eigenstructure via SVD + Welford - `tomography.rs` — RF tomography with ISTA solver - `longitudinal.rs` — Personal drift detection over days - `intention.rs` — Pre-movement lead signal detection - `cross_room.rs` — Cross-room identity continuity - `gesture.rs` — DTW gesture classification - `adversarial.rs` — Impossible signal detection **RuVector crate (`wifi-densepose-ruvector/src/viewpoint/`):** - `attention.rs` — Scaled dot-product with geometric bias - `geometry.rs` — Geometric Diversity Index + Cramer-Rao bounds - `coherence.rs` — Phase phasor coherence gating - `fusion.rs` — MultistaticArray fusion orchestrator **Hardware crate:** - `esp32/tdm.rs` — TDM sensing protocol, sync beacons, drift compensation **Training crate:** - `ruview_metrics.rs` — 3-metric acceptance test (Bronze/Silver/Gold) ### Security Audit Findings | Severity | Count | Status | |----------|-------|--------| | Critical | 2 | Fixed (timestamp underflow, FIFO eviction) | | Warning | 11 | Documented (NaN guards, file size, naming) | | Optimization | 5 | Noted for future iteration | --- ## Quick Verification ```bash # Check new modules compile cd rust-port/wifi-densepose-rs cargo check --workspace --no-default-features # Run the new tests cargo test -p wifi-densepose-signal --no-default-features -- ruvsense cargo test -p wifi-densepose-ruvector --no-default-features -- viewpoint cargo test -p wifi-densepose-hardware --no-default-features -- tdm cargo test -p wifi-densepose-train --no-default-features -- ruview ``` ## Related - PR: #TBD (ruvsense-full-implementation → main) - [ADR-029: RuvSense Multistatic](https://github.com/ruvnet/wifi-densepose/blob/ruvsense-full-implementation/docs/adr/ADR-029-ruvsense-multistatic-sensing-mode.md) - [ADR-030: Persistent Field Model](https://github.com/ruvnet/wifi-densepose/blob/ruvsense-full-implementation/docs/adr/ADR-030-ruvsense-persistent-field-model.md) - [ADR-031: RuView Fusion](https://github.com/ruvnet/wifi-densepose/blob/ruvsense-full-implementation/docs/adr/ADR-031-ruview-sensing-first-rf-mode.md) - [DDD Domain Model](https://github.com/ruvnet/wifi-densepose/blob/ruvsense-full-implementation/docs/ddd/ruvsense-domain-model.md)

ruvnet commented

2026-03-02 10:43:39 +08:00

(Migrated from github.com)

Security Audit Results

Overall Rating: 8/10 — Strong security posture. Zero unsafe blocks, all public APIs return Result, comprehensive input validation.

Fixed (commit `5541926e`)

File	Fix	Severity
`tomography.rs`	`checked_mul()` for grid dimension overflow on 32-bit targets	HIGH
`multistatic.rs`	Numerically stable softmax (max-subtraction) prevents Inf in attention fusion	MEDIUM
`phase_align.rs`	Defensive `.get()` bounds check on index access	MEDIUM

Open Recommendations

#	Finding	Severity	Status
H-1	TDM SyncBeacon has no authentication (HMAC/nonce) — rogue node can desync mesh	HIGH	Needs ADR-032
M-3	CSI frame format (ADR-018) has no cryptographic MAC — frame injection possible	MEDIUM	Needs format v2
M-4	NDP injection has no rate limiter — potential RF flooding	MEDIUM	Awaiting TDM integration
M-5	Coherence gate recalibrate-override is by-design but lacks timeout cap	MEDIUM	Recommendation noted
L-1	`cross_room.rs` transition log unbounded	LOW	Add max_transitions
L-4	NVS password buffer not zeroed after use (stack residue)	LOW	Add memset
L-5	Static mutable state in csi_collector.c — potential dual-core race on ESP32-S3	LOW	Use _Atomic

Positive Security Patterns

Zero unsafe blocks across all 18 Rust files
thiserror derive on all error types (no unwrap() on public paths)
Bounded data structures throughout: max_rooms, max_entries, max_events, window_size
Welford online statistics (numerically stable)
Variance floors (1e-6) prevent division-by-zero in coherence
.clamp() on all output scores prevents NaN/Inf propagation
ESP32 firmware: ESP_ERROR_CHECK, strncpy + null termination, NVS bounds validation

## Security Audit Results **Overall Rating: 8/10** — Strong security posture. Zero `unsafe` blocks, all public APIs return `Result`, comprehensive input validation. ### Fixed (commit 5541926e) | File | Fix | Severity | |------|-----|----------| | `tomography.rs` | `checked_mul()` for grid dimension overflow on 32-bit targets | HIGH | | `multistatic.rs` | Numerically stable softmax (max-subtraction) prevents Inf in attention fusion | MEDIUM | | `phase_align.rs` | Defensive `.get()` bounds check on index access | MEDIUM | ### Open Recommendations | # | Finding | Severity | Status | |---|---------|----------|--------| | H-1 | TDM SyncBeacon has no authentication (HMAC/nonce) — rogue node can desync mesh | HIGH | Needs ADR-032 | | M-3 | CSI frame format (ADR-018) has no cryptographic MAC — frame injection possible | MEDIUM | Needs format v2 | | M-4 | NDP injection has no rate limiter — potential RF flooding | MEDIUM | Awaiting TDM integration | | M-5 | Coherence gate recalibrate-override is by-design but lacks timeout cap | MEDIUM | Recommendation noted | | L-1 | `cross_room.rs` transition log unbounded | LOW | Add max_transitions | | L-4 | NVS password buffer not zeroed after use (stack residue) | LOW | Add memset | | L-5 | Static mutable state in csi_collector.c — potential dual-core race on ESP32-S3 | LOW | Use _Atomic | ### Positive Security Patterns - Zero `unsafe` blocks across all 18 Rust files - `thiserror` derive on all error types (no `unwrap()` on public paths) - Bounded data structures throughout: `max_rooms`, `max_entries`, `max_events`, `window_size` - Welford online statistics (numerically stable) - Variance floors (`1e-6`) prevent division-by-zero in coherence - `.clamp()` on all output scores prevents NaN/Inf propagation - ESP32 firmware: `ESP_ERROR_CHECK`, `strncpy` + null termination, NVS bounds validation

ruvnet commented

2026-03-02 10:50:28 +08:00

(Migrated from github.com)

ADR-032: Multistatic Mesh Security Hardening

Created ADR-032 to address all open security findings from the security audit:

Findings Addressed

#	Finding	Severity	ADR-032 Solution
H-1	TDM SyncBeacon unauthenticated	HIGH	HMAC-SHA256 beacon auth + monotonic nonce
M-3	CSI frame no cryptographic MAC	MEDIUM	SipHash-2-4 frame integrity tag
M-4	NDP injection no rate limiter	MEDIUM	Token-bucket rate limiter (20 NDP/sec)
M-5	Coherence gate no timeout cap	MEDIUM	max_recalibrate_duration (30s default)
L-1	Unbounded transition log	LOW	Ring buffer (max 1000 entries)
L-4	NVS password not zeroed	LOW	explicit_bzero() after use
L-5	Static mutable dual-core race	LOW	_Atomic qualifiers / FreeRTOS mutex

Status

ADR-032 created: docs/adr/ADR-032-multistatic-mesh-security-hardening.md
CLAUDE.md updated with v0.3.0 state, 15 crates, 32 ADRs, module tables
Security rating: 8/10 (3 issues already fixed in prior commit)

## ADR-032: Multistatic Mesh Security Hardening Created ADR-032 to address all open security findings from the security audit: ### Findings Addressed | # | Finding | Severity | ADR-032 Solution | |---|---------|----------|-----------------| | H-1 | TDM SyncBeacon unauthenticated | HIGH | HMAC-SHA256 beacon auth + monotonic nonce | | M-3 | CSI frame no cryptographic MAC | MEDIUM | SipHash-2-4 frame integrity tag | | M-4 | NDP injection no rate limiter | MEDIUM | Token-bucket rate limiter (20 NDP/sec) | | M-5 | Coherence gate no timeout cap | MEDIUM | max_recalibrate_duration (30s default) | | L-1 | Unbounded transition log | LOW | Ring buffer (max 1000 entries) | | L-4 | NVS password not zeroed | LOW | explicit_bzero() after use | | L-5 | Static mutable dual-core race | LOW | _Atomic qualifiers / FreeRTOS mutex | ### Status - ADR-032 created: `docs/adr/ADR-032-multistatic-mesh-security-hardening.md` - CLAUDE.md updated with v0.3.0 state, 15 crates, 32 ADRs, module tables - Security rating: 8/10 (3 issues already fixed in prior commit)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dearsky/wifi-densepose#76