feat(l9): consistency harness + Fusion v2 self-adversarial calibration + adaptive capture governor — RESEARCH#51
Merged
Conversation
… advisory, default-OFF) Fuses PoEP presence (embodiment) x retina trajectory-authenticity into a cross-oracle CONSISTENCY signal where DISAGREEMENT is the security signal (escapes the single-classifier GCAP ROC ceiling). Pure-function, injected signals, no bridge import (l9_presence stays standalone). Closes (in principle) machine-assisted cheating presence cannot; partial relay closure via tight binding; does NOT close account-sharing/identity. Honesty rails: advisory-only, fail-open to UNVERIFIABLE, UNCALIBRATED_SYNTHETIC (never emits a score), binding-is-security. 21 tests (logic + binding fail-closure + never-spurious-accusation + uncalibrated rail). Separation power [UNVALIDATED] until the adversarial capture matrix in the doc runs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… 1) + first run Runs the fusion doc section-5 experiment on synthetic, PARAMETERISED data (a sensitivity analysis over the retina-axis unknowns, not real capture). Pipeline: generate 5-class labeled sessions -> adapt to (Presence,Trajectory,L4) signals -> assemble_consistency -> 5x6 confusion + metrics. Stacks on the engine branch (#50). 32 tests pass. First-run result (tpr=0.85, proskill-fp=0.15): machine_assist_catch=0.83 ~= retina TPR; PRO_SKILL false-accusation=0.16 ~= retina FPR. HONEST FINDING (quantified): the fusion's value is CONTEXTUAL disambiguation (BOT/relay correctly contextualised: fusion accuses BOT 0.09 vs retina-alone 0.91) but it does NOT rescue the aim-assist-vs-pro-skill boundary (fusion ~= retina-alone there; pro-skill FP == retina FPR by construction). The make-or-break (retina elite-play FPR) is Phase-2 real capture. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Gold-standard spec measuring the two real numbers the synthetic run reduced everything to: retina_tpr_aimassist + retina_fpr_proskill on real data. Pre-registered estimands/thresholds/N + a KILL criterion (no operating point meeting TPR>=0.80 AND elite-FPR<=0.02 at 95% CI upper bound => gate thesis dead, forensic-only home, do not move the threshold). 5-class real capture matrix (PRO_SKILL = the load-bearing elite recruit), BIPA/GDPR/dual-use rails, experiment-only session binding, reuses the Phase 1 harness via a real_sessions loader, Rule-of-Three power (>=300 elite windows). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…reframe Protocol §0: N=1 elite (operator) can FALSIFY the gate but cannot VALIDATE it (within-subject only; PASS reserved for future multi-subject run). real_sessions.py: stdlib-sqlite loader assembling REAL LabeledWindows from l6b_probe_log (presence, ms->s) + retina_event_log (trajectory) + records.pitl_l4_distance (L4), bound by device+time-window, presence carried forward within freshness. consistency_eval real-mode header/caveat; runner --real --db --sessions. 211 l9_presence tests pass (incl. real-loader sqlite fixture). No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ion labeler Protocol section 2 thresholds FROZEN 2026-06-21 before any data (TPR>=0.80, elite-FPR<=0.02, >=300 elite windows, >=10 players for the multi-subject PASS only; NCAA CFB 26 / Edge). Git history = immutability proof; editing after data invalidates pre-registration. capture_session_labeler.py: start/stop/relabel/list/validate CLI maintaining the sessions.json manifest the --real runner consumes; --pending + relabel enforce post-hoc PRO_SKILL/HUMAN_CLEAN labeling by performance (section-0 single-subject confound rail). Testable core; 6 tests + manifest round-trips through real_sessions loader. No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… class rename Capture build for the N=1 run. capture_cockpit.py: read-only live dashboard (ANSI, stdlib) over bridge HTTP + DB (sqlite mode=ro) + labeler manifest — bridge/retina health, live retina/presence flow, presence-BINDING coverage (the fraction of windows that will actually fuse, with low-coverage warning), per-class window progress vs FROZEN >=300 elite, run-readiness; Windows hotkeys (h/m/b/y/x/r/v/q) drive the labeler; --once smoke verified against the live bridge. Rename HUMAN_AIM_ASSIST -> HUMAN_INPUT_MACRO + retina_tpr_aimassist -> retina_tpr_cheat across harness/labeler/runner/tests/protocol: aim-assist is a shooter cheat; NCAA CFB 26's machine-assist is input automation/macros. Fusion mechanism unchanged. 221 l9_presence tests pass. No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…forcefulness first) Per operator directive: the in-session presence challenge must be felt + unmistakable vs NCAA CFB haptics (default L6B is sub-perceptual 60/255). presence_challenge.py: forceful_signature_profile (high-force 230/255 dual-trigger TRIPLE-PULSE signature gameplay can't sync) + is_forceful/is_signature proxy invariants + ChallengeScheduler (idle-gated, jittered). presence_challenge_feeltest.py: standalone operator tool (bridge stopped, owns the DualSense) to CERTIFY felt+distinguishable and tune the force floor, with --motor / --rigid-kicks comparison modes; fails gracefully w/o controller. HONEST: forcefulness is perceptual — only the feel-test certifies it; the code can't feel the pad (bridge is sim-mode). 7 tests (invariants + scheduler). In-session bridge wiring reuses the CONFIRMED force, built after the feel-test. No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ed felt+distinct) Validated on a real Edge: adaptive-trigger resistance is only felt when the trigger is PULLED (useless as a passive challenge). Main rumble motors are felt strongly in the palms regardless. Redesigned to forceful_motor_signature (amp 255, 3-pulse bzz-bzz-bzz on both motors; --alternate L/R sweep). Operator feel-test confirmed: felt every rep AND distinguishable from tackle rumble at amp=255/pulses=3. feel-test + 8 tests updated to the motor API; ChallengeScheduler unchanged. Protocol note corrected trigger->motor. No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ntrol) Empirically confirmed on the real Edge: back paddles register raw as L5/R5 via pydualsense independent of PS5 mapping (unmapped = zero NCAA effect but bridge-detectable), and touchpad SWIPE registers via trackPadTouch0 (X/Y, separate from the pause click). Built presence_challenger.py: standalone (coexists with the bridge's hidapi capture), fires the felt motor signature on a jittered cadence with SHAM trials, detects the response gesture (default R5 paddle; l5/swipe options) within the human band [120,450]ms, logs presence proofs to l6b_probe_log. Determination = real-in-band response RATE vs sham-false RATE (the GAP), not any single reaction. classify_gesture_response added (pure, 4 tests: in-band HUMAN / too-fast anticipation / no-response / too-late). 12 tests pass. No merge (operator holds). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Trigger vibration: all 7 force indices maxed on both L2/R2. Main motors: 300ms on / 20ms off near-continuous alternating L/R sweep, 6 pulses. Lightbar: orange during challenge, dim blue at rest. Band max 800ms for gameplay. CLI: --on-ms --off-ms --band-max-ms --alternate/--no-alternate exposed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ecord_hash production)
The §6 binding gap: retina events carry record_hash_hex (PoAC-anchored), but
l6b_probe_log presence proofs carried only a timestamp — so a HUMAN presence proof
and the gameplay record it co-occurred with could not be tied together. The gap was
presence-side only; the retina side was always crypto-anchored.
Closed in two complementary halves:
(A) PROTOTYPE — l9_presence/adversarial/cocapture_binding.py (pure, 13 tests):
a ±2s temporal correlator (reuses the engine DEFAULT_WINDOW_NS so the join window
is the same 2.0s check_binding enforces). BindingMode {TEMPORAL_PROTOTYPE /
RECORD_HASH_PRODUCTION / UNBOUND}; coverage + offset stats + a loud banner that a
temporal pair is correlation, NOT cryptographic proof. Runner
scripts/correlate_presence_retina.py (stdlib sqlite3, no bridge import) writes a
dated audit artifact. Real-DB result: gameplay session 90 probes -> 56 temporally
bound (62.2%), HUMAN 50 -> 29 (58.0%), offset |dt| median 434.7ms; all binding
occurs in the gameplay session (full-DB 6.8% — desk/menu probes have no co-logged
retina). crypto=0% (no probe carried a hash yet — honest).
(B) PRODUCTION — scripts/presence_challenger.py::log_probe self-migrates an additive
record_hash column and stamps the latest records.record_hash for the device at
probe time, so future proofs share a verifiable PoAC anchor (time-independent).
record_hash also added to the bridge's additive l6b_probe_log telemetry list in
store/_core.py (same existing idiom) so the column is canonical. E2E verified.
No FROZEN/PoAC/chain/Solidity/firmware edit. PV-CI gate PASS; 13 new + 32 regression
tests green. PR #50/#51 remain held (operator-merge).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The challenger now accepts ANY of several response gestures per probe instead of a single fixed button. --response is '+'-joined (tokens: l5 r5 l4 r4 touch; swipe/ touchpad alias touch); default is 'l5+touch' so a probe (orange LED on) can be answered by the L5 back paddle OR a touchpad touch, whichever is faster in the moment. - parse_accepted(): tokenizes/validates/dedupes the gesture list (pure, testable). - gesture_active_from_state(): returns True if ANY accepted gesture is active (pure). - run_challenge() takes the accepted list; the in-band classifier is unchanged (the OR happens in the per-sample active bool, so latency banding is identical). - 9 new pure tests (parse + dual-OR + safety on missing touch attr). No controller dep. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… presence probe Make the probe yield to the game. The challenger cannot see the PS5's outgoing haptic commands (output reports PS5->controller); the only live signal that a haptic is happening now is the IMU registering the physical vibration. So the gate is built from the input stream the challenger already reads. New pure module bridge/controller/probe_gate.py (13 tests): - LULL detection: still sticks + no trigger + quiet IMU = between-plays / pre-snap, the natural quiet window in NCAA CFB. classify() -> LULL / ACTIVE / UNSETTLED. - Pre-fire VETO: window accel variance vs a rolling baseline (scale-independent, since the DualSense IMU scale is device-specific). Loud IMU -> UNSETTLED -> defer. - HAPTIC SELF-ECHO (QorTroller-exclusive): after firing OUR motor signature, the IMU must show variance above baseline DURING our pulses. echo_confirmed() is the closed-loop proof the buzz physically fired on THIS device -- hardens the presence proof against the relay attack (buzz device A, human reacts on device B). Reuses the same IMU stream. - update_baseline(): EMA over quiet windows = the rolling quiet reference. Challenger wiring (scripts/presence_challenger.py): - --lull-gate (default ON) / --no-lull-gate; --prefire-ms; --haptic-ratio. When due, the loop sniffs a pre-fire window and fires ONLY in a LULL, else defers + reschedules. - run_challenge() samples accel during our pulses and reports during_accel_var + echo_confirmed; the per-probe line shows echo=OK/MISS. - Pure helpers _accel_mag/_gate_sample/_sample_window do the I/O; gate logic stays pure. Honesty: the lull rule is part of the protocol -- it gates WHEN a trial happens and is applied identically to real and sham, so the buzz-vs-sham GAP stays uncontaminated. 13 new + 34 regression tests green; PV-CI gate PASS. PR #50/#51 remain held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two additional, opt-in lull sources that AND with the IMU lull-gate; each is inert when
its source is unavailable, so neither can block the probe loop.
CONTEXT GATE (bridge/controller/probe_context.py, pure + tested):
- Reuses the protocol's OWN gameplay classifier instead of re-deriving it. Maps a bridge
status dict -> ContextVerdict: APOP 5-state (MATCH_TRANSITION=IN_MATCH_LULL,
ACTIVE_MATCH_PLAY/COMPETITIVE_CONTROL=ACTIVE, NON_COMPETITIVE_MENU=MENU,
UNKNOWN_LOW_EVIDENCE=UNKNOWN), GAD fallback (ACTIVE_GAMEPLAY/MENU_DETECTED).
- Challenger: --context-gate (opt-in), --bridge-url (default :8000), --bridge-api-key,
--context-allow-menu. fetch_bridge_context() tries /agent/active-play-occupancy-status
then /bridge/capture-health; returns None on any failure -> gate inert.
SCREEN GATE (bridge/controller/probe_screen.py, pure classifier + optional OCR reader):
- classify_screen(text, playclock_value) -> ScreenVerdict {PRE_SNAP / STOPPAGE / LIVE /
UNKNOWN}: stoppage banners (timeout/review/two-minute) > a valid 1..40 play clock >
defer. play-clock 0 is the snap boundary, NOT pre-snap.
- read_screen_region() reuses the cocapture ScreenCapturer + pytesseract, guarded so a
missing dep returns None (gate inert). Heaviest path; SUPPORTING vote only.
- Challenger: --screen-gate (opt-in), --screen-region X Y W H.
Startup banner shows active gates (gates=IMU+CTX+SCR). Honesty rail unchanged: every gate
decides WHEN a trial happens and is applied identically to real and sham.
14 new + 47 regression tests green; PV-CI gate PASS. PR #50/#51 remain held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ntroller lobe)
Novel QorTroller-exclusive fusion. QorTroller already uses Trio-Retina as a model-agnostic
encoder over the controller INPUT stream (input world model, cryptographically anchored via
events-root -> state_commitment -> DA-witness -> PDA). This adds a second OUTCOME lobe (OCR
of the game HUD) and fuses the two by CAUSALITY: every on-screen outcome must be explained
by a preceding controller input from THIS certified device.
Exclusive because screen-OCR alone is ordinary vision anti-cheat; the moat is binding the
outcome stream to a CERTIFIED input world-model. Catches relay (human drives screen B, bot
on certified A -> ORPHAN_OUTCOME), replay-to-headless (ORPHAN_INPUT), live human (COHERENT).
Generalizes L9/PoCP stick->camera coupling into input-trajectory -> game-outcome semantics.
- retina_screen_lobe.py: parse_hud (OCR text -> HudState: down/distance/play-clock/quarter/
score) + diff_hud (transitions -> ScreenEvents). Conservative: a field going None (OCR
dropout) never fabricates an outcome. down/distance/play-clock load-bearing; score
provisional. scene.down_advanced/first_down/score_changed are input-caused;
playclock_reset/quarter_changed are markers.
- retina_causal_coherence.py: TimedEvent normaliser + adapters + assess_coherence ->
CoherenceReport {COHERENT / ORPHAN_OUTCOME / ORPHAN_INPUT / INSUFFICIENT}. Each
input-caused outcome matched to an input within [t-window, t] (default 10s). Pure over a
normalized event stream -> testable without the retina lib or a controller.
- UNCALIBRATED: causal map + window are a hypothesis until real co-capture (mirrors the
consistency engine's UNCALIBRATED_SYNTHETIC). Default-off; not wired into the live loop.
- docs/qortroller-dual-lobe-causal-retina.md design note.
22 pure tests green; PV-CI gate PASS. No FROZEN/PoAC/chain/Solidity edit. PR #50/#51 held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…usion
l9_presence/screen_capture.py (WGC/DXGI/mss) + cv_motion + coupling (InputOutputCoupling-
Oracle) were the L9/PoCP causal-presence probe — validated (P4: coupling 0.955, neg-control
0.09 at ~400-500ms cloud lag) but left a design-only scaffold, never woven into the retina.
This revives it: the SAME WGC frame stream feeds TWO screen channels at two timescales, both
bound to the certified controller input lobe:
* CONTINUOUS coupling (~60Hz): cv_motion optical flow -> coupling. Camera moves BECAUSE the
aim-stick moved, at human lag (+ decoupled_energy injection proxy; neg-control honesty rail).
* DISCRETE outcome coherence (event-rate): OCR HUD -> retina_screen_lobe -> causal coherence.
* CONTROLLER input lobe (~1kHz): the shared cryptographic anchor both bind to.
bridge/vapi_bridge/screen_retina_fusion.py (pure; imports only CoherenceVerdict, takes
coupling as primitives so it stays decoupled from l9_presence):
- classify_continuous(): COUPLED_CLEAN / COUPLED_INJECTION / DECOUPLED / NEUTRAL. The
negative control MUST collapse (coupling - shuffled >= gap) or it's a latency-search
artifact -> DECOUPLED.
- fuse_screen_retina(): joins the two ORTHOGONAL axes -> LIVE_COHERENT / LIVE_COUPLED /
INJECTION_SUSPECT / REPLAY_OR_RELAY / DECOUPLED_REVIEW / INSUFFICIENT. NEUTRAL continuous
(not aiming) rests on the discrete axis.
Exclusive + strong: an attacker must satisfy THREE independent causal bindings to the SAME
certified controller at three timescales. A video replay fakes OCR outcomes but continuous
coupling to the live stick collapses -> REPLAY_OR_RELAY; an aimbot keeps coupling but spikes
residual -> INJECTION_SUSPECT. Only QorTroller has the certified input anchor. This is the
L9-aligning role screen_capture was built for.
UNCALIBRATED (thresholds are hypotheses until labelled co-capture). Default-off; pure core +
15 tests (58 in the fusion+coupling sweep); PV-CI PASS. No FROZEN/PoAC/chain edit. PR held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…Fusion v2 Phase 1) Pure, I/O-free control loop that keeps video output STEADY and keeps the coupling oracle in its valid regime, driven by the same lag telemetry the witness agent uses to prove presence. Honest scope: cannot reduce external Remote-Play stream lag; it stabilizes the CAPTURE PIPELINE (steady frame cadence by trading downscale/region for fps) and ADAPTS THE ESTIMATOR (widen coupling lag-window when measured lag nears the search ceiling; raise resample grid when samples are short). l9_presence/adaptive_capture.py: - compute_telemetry(frame_ts_ms) -> CaptureTelemetry (fps, fps_cv jitter, stale_ms, lag, grid). - decide(telemetry, controls, cfg) -> AdjustmentDecision: priority STEADY-VIDEO-FIRST (jitter/low-fps -> downscale up, then region shrink), then estimator validity (lag-window widen, resample raise), then opportunistic sharpen (downscale down when steady+fast). One control change per call; bounded + clamped. - AdaptiveCaptureGovernor: EMA smoothing + cooldown so a steady in-regime stream never thrashes the controls; records every decision + telemetry_summary() for the session artifact. 18 pure tests (fps/cv math, each priority branch, bounds clamp, cooldown, no-oscillation, summary shape). PV-CI PASS. No FROZEN/PoAC/chain touch. PR #50/#51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…o capture (Fusion v2 Phase 2) Activates the witness agent for real-time lag/FPS self-tuning and optimizable-telemetry collection, wiring the Phase-1 governor into both the live loop and the post-hoc manifest. - cv_motion.MotionExtractor: instance-level downscale + set_downscale() (additive; the governor can retune flow resolution live to keep video steady). to_gray_small takes a downscale arg. Backward-compatible (defaults to module DOWNSCALE). - session_recorder.record_session: optional governor= param. When provided, every N frames it observes the recent frame cadence and applies the recommended downscale via mx.set_downscale; the governor telemetry_summary is saved into the session npz (capture_governor). None => byte-identical prior behavior; governor errors never break a live capture (guarded). - witness_agent: WitnessConfig.adaptive_capture_enabled (default True) + collect_telemetry (default True). run_once builds a governor and passes it to record_session. process_session embeds capture_telemetry into the manifest — the live governor record if present, else a hardware-free post-hoc replay of the frame cadence through the governor (capture_telemetry_from_session). Governance seams stay OFF/dry-run. 4 new tests (telemetry collected/disabled, post-hoc replay shape with no fps thrash, live summary preferred). 36 pass in the witness+governor sweep. PV-CI PASS. No FROZEN/PoAC/chain. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The calibration core: run every screen-bound oracle on one bound session artifact, and manufacture ground-truth adversaries from a real session at N=1. oracle_panel.py (bridge; imports l9_presence.coupling — l9_presence stays pure): - SessionArtifact: the panel input contract (HID + camera streams + optional per-frame OCR HUD text + class_label/provenance/record_hash + capture_telemetry). - evaluate_artifact() runs continuous coupling (InputOutputCouplingOracle), discrete coherence (OCR HUD deltas via parse_hud/diff_hud vs HID-derived input events -> assess_coherence), and tri-channel fusion (fuse_screen_retina) -> PanelReport (UNCALIBRATED). - derive_input_events (trigger onset on rising R2 edge + stick radial-jump) needs no trio-retina; emits times in SECONDS to share the coherence time base with diff_hud. self_adversary.py (bridge; transforms SessionArtifact -> labelled SessionArtifact): - make_replay (foreign camera -> coupling collapses), make_relay (idle controller, screen advances -> ORPHAN_OUTCOME), make_headless (HID only, no render -> no coupling), make_injection (decoupled camera sweep -> raised decoupled_energy). Each stamps class_label + provenance=real_derived. 12 pure tests: live artifact -> LIVE_COHERENT; replay -> coupling collapse -> REPLAY_OR_RELAY; relay -> ORPHAN_OUTCOME; headless -> no coupling; injection -> monotonic decoupled_energy. PV-CI PASS. No FROZEN/PoAC/chain. PR #50/#51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…act (Phase 3 e2e)
scripts/run_fusion_v2_experiment.py: builds a base LIVE artifact + the four self-adversarial
classes (replay/relay/headless/injection), runs each through evaluate_artifact, tabulates a
5-class x fusion_verdict confusion, writes audits/fusion-v2-calibration-<date>.{md,json}.
First synthetic run (UNCALIBRATED, honest read):
- HUMAN_CLEAN -> LIVE_COHERENT (clean)
- HUMAN_RELAY (replay+relay) -> REPLAY_OR_RELAY / DECOUPLED_REVIEW, never LIVE_COHERENT
- BOT_FULL (headless) -> INSUFFICIENT (no rendered channel)
- HUMAN_INPUT_MACRO (injection @ strength 2.0) -> still LIVE_COHERENT: residual did NOT cross
the 0.6 decoupled-energy threshold. This is the MEASURED SEPARATION GAP the real experiment
must close (tune the injection threshold / capture real aim-assist) — surfaced honestly, not
hidden.
2 runner tests (clean+relay separation, UNCALIBRATED caveat in markdown). PV-CI PASS.
No FROZEN/PoAC/chain. PR #50/#51 held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ly endpoint (Phase 5)
Advisory surface for the oracle panel + Adaptive Capture Governor. Does NOT touch the
228-byte PoAC, chain, or any FROZEN-v1 primitive; default-gated OFF.
- config.py: l9_fusion_v2_enabled (default False), l9_fusion_coherence_threshold (0.70),
l9_fusion_neg_control_gap (0.15), adaptive_capture_enabled (default True). _env_bool/_env_float
idiom next to the retina_* flags.
- store: new L9FusionMixin (store/l9_fusion.py: insert_l9_fusion_event / get_l9_fusion_status)
registered on Store; l9_fusion_event_log table + 2 indexes created in _core.py _init_schema
(additive, same idiom as retina_event_log). Stores coupling/coherence/fusion verdict +
capture telemetry json + report json.
- operator_api/agent_l9_fusion.py: GET /bridge/l9-fusion/capture-telemetry (static route FIRST)
+ GET /bridge/l9-fusion/{device_id}; read-key auth, asyncio.to_thread DB read, gated on
cfg.l9_fusion_v2_enabled. Registered in _app.py beside the other register_* modules.
4 store/config tests; 64 in the store+fusion-v2 regression sweep. PV-CI PASS (179). No FROZEN/
PoAC/chain/Solidity edit. PR #50/#51 held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…no buzz) Read-only rig validator: prints live IMU |accel| + sticks/triggers + the lull-gate verdict (LULL/ACTIVE/UNSETTLED, CLEAR-to-fire/defer) for N seconds, then a verdict on whether the IMU is actually exposed by pydualsense. Directly closes the open live-validation item — if accel reads flat 0, the pre-fire veto and haptic self-echo silently no-op, and this surfaces that before a real session. - format_selftest_line(sample, window, baseline_var, gate_cfg): pure one-line diagnostic. - run_selftest(ds, secs, gate_cfg): read-only sample loop (fires NO buzz); EMA baseline on LULL windows like the live loop; returns 1 + WARNING if peak |accel| stayed 0, else 0. - CLI: --selftest + --selftest-secs (default 10); branch returns before the challenge loop. 5 new tests (line LULL/ACTIVE, run_selftest IMU-ok=0 / IMU-absent=1 via a fake controller). PV-CI PASS. No FROZEN/PoAC/chain. PR #50/#51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ConWan30
changed the title
…real hardware Running --selftest on a live DualSense exposed a correctness bug: the gate sat at UNSETTLED forever and would never fire. The accel baseline was seeded from one anomalously-quiet first window (0.43) but resting accel noise is ~2-50; the veto trips when var > base*ratio, and the baseline EMA only updated on LULL windows -- which never happened -- so base froze and LULL was unreachable. In a real run the probe would defer indefinitely. Fix: decouple input-activity from haptic-presence. - probe_gate.is_input_quiet(window, cfg): no trigger + sticks still (pure, testable). - presence_challenger (run_selftest + main loop): update the baseline on input-quiet windows instead of LULL windows, so it tracks the resting accel-noise FLOOR and an under-seeded baseline recovers. A real rumble is a brief spike the slow EMA shrugs off. Re-run --selftest: baseline climbs 0.43 -> ~20-40, gate flips to LULL/CLEAR-to-fire while at rest. Also confirmed IMU is exposed (peak |accel|=35.6) -- the open validation item is resolved. Tests: is_input_quiet + a deterministic deadlock-recovery regression. 28 in the gate+gesture sweep. PV-CI PASS. No FROZEN/PoAC/chain. PR #51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… session (N=1 unlock) The live Step C is now one command. scripts/run_fusion_v2_experiment.py --from-session <npz> loads a recorded witness/cocapture session, derives the four self-adversarial classes from it (replay/relay/headless/injection), runs each through the oracle panel, and writes the per-oracle confusion + carried capture telemetry. - artifact_from_npz(): npz HID+camera streams -> SessionArtifact (provenance=real; hud_texts=[] since recorded sessions have no OCR yet -> discrete coherence reads INSUFFICIENT, continuous coupling carries the verdict). - _foreign_from(): time-SHUFFLE the camera for make_replay (the negative-control op; decouples robustly even for periodic stick signals, unlike a time-roll). - _build_result() shared confusion builder; run_from_session() alongside run_synthetic(). - CLI: --from-session, --injection-strength; markdown handles the real (no seed) header. Demonstrated end-to-end on a generated session: HUMAN_CLEAN -> LIVE_COUPLED (coupling proves presence; no OCR), HUMAN_RELAY -> REPLAY_OR_RELAY/INSUFFICIENT (never live), BOT_FULL headless -> INSUFFICIENT. 4 runner tests (synthetic + from-session + artifact loader). PV-CI PASS. No FROZEN/PoAC/chain. PR #51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…VE_COHERENT Recorded sessions now carry hud_texts (the discrete-coherence channel), so the oracle panel reads LIVE_COHERENT on real play instead of just LIVE_COUPLED. Kept pure in l9_presence (pytesseract is external, not a bridge import); the bridge panel still does all HUD parsing. - l9_presence/hud_ocr.py (pytesseract-guarded): ocr_frame(frame, region) OCRs a HUD region of a BGR frame (None if pytesseract/Tesseract absent or on error — never breaks capture); dumps_hud_texts/loads_hud_texts for the .npz sidecar. - session_recorder.record_session: hud_region + hud_every params. When hud_region is set, OCR the frames already grabbed every N frames into hud_texts; saved as hud_json in the npz. Off (None) by default -> byte-identical prior behavior. - run_fusion_v2_experiment.artifact_from_npz: reads hud_json -> hud_texts so --from-session feeds the discrete channel. - witness_agent: WitnessConfig.hud_region / hud_every, passed through run_once. Proof: a HUD-bearing recorded session now classifies HUMAN_CLEAN -> LIVE_COHERENT (coherence COHERENT), where without HUD it was LIVE_COUPLED. 9 new/updated tests (hud_ocr roundtrip + guard; from-session-with-HUD -> LIVE_COHERENT). PV-CI PASS. No FROZEN/PoAC/chain. PR #51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…witness CLI OCR install is complete (pytesseract + Pillow via pip; Tesseract 5.4.0 engine present at C:\Program Files\Tesseract-OCR). Two small enablement fixes so it actually engages: - hud_ocr.py: locate tesseract.exe in the common UB-Mannheim install paths and set pytesseract.tesseract_cmd when it isn't on PATH, so a FRESH witness process finds the engine without a PATH edit. ocr_available() now verifies the engine resolves (get_tesseract_version), not just that the wrapper imports. - witness_agent run CLI: --hud-region X Y W H, wired into WitnessConfig.hud_region, so the discrete-coherence channel can be turned on at capture time. Verified end-to-end: fresh-process ocr_available() True; ocr_frame OCRs a synthetic HUD image. 5 hud_ocr tests pass. PV-CI PASS. No FROZEN/PoAC/chain. PR #51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…amera false-positive)
Running the fusion on real session P1_25 showed the continuous axis flagging CLEAN human play
as INJECTION_SUSPECT: coupling 0.39 (clean, neg-control 0.03, lag 150ms) but decoupled_energy
0.85. The injection/residual heuristic is FPS-tuned (aim-stick fully drives the camera, so high
residual = aimbot); it does NOT transfer to NCAA's AUTO-CAMERA (follows the play / replays /
transitions independently of the stick), where clean play sits at ~0.85 residual.
- screen_retina_fusion: ContinuousConfig.injection_axis_enabled (default True = FPS, preserved).
When False, classify_continuous never returns COUPLED_INJECTION -> clean coupling reads
COUPLED_CLEAN. NCAA_CONTINUOUS_CONFIG = injection axis OFF. Coupling + negative-control rails
are untouched (replay/decoupled detection unchanged).
- oracle_panel.evaluate_artifact(a, cont_cfg=None): threads the profile through (default FPS).
- run_fusion_v2_experiment: --game {ncaa,fps} (default ncaa) selects the profile.
Verified on P1_25: HUMAN_CLEAN INJECTION_SUSPECT -> LIVE_COUPLED (fixed). Honest follow-on the
fix exposed: with the residual axis gone the camera-shuffle replay reads LIVE_COUPLED on real
NCAA data -> coupling alone can't separate clean-vs-replay for football's weak/auto-camera;
the NCAA discriminators are presence (79% bound) + discrete HUD-coherence, not coupling.
5 new tests (NCAA drops injection / still catches replay / classify-axis-disabled). 35 in the
fusion sweep. PV-CI PASS. No FROZEN/PoAC/chain. PR #51 held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The Phase-5 surface (commit e81b1f0) was speculative plumbing with no producer: nothing in any live path calls insert_l9_fusion_event (only its own test did), so the table was never populated, the endpoints read an always-empty table, and the config flags gated nothing. The fusion only runs offline in run_fusion_v2_experiment.py, which writes to audits/, not the DB. Removed (zero functional loss): - bridge/vapi_bridge/store/l9_fusion.py (L9FusionMixin) + its registration on Store + the l9_fusion_event_log table/indexes in _core._init_schema. - bridge/vapi_bridge/operator_api/agent_l9_fusion.py + its registration in _app.py. - config.py flags l9_fusion_v2_enabled / l9_fusion_coherence_threshold / l9_fusion_neg_control_gap and the bridge-level adaptive_capture_enabled (WitnessConfig.adaptive_capture_enabled is the real one and is untouched). - bridge/tests/test_l9_fusion_store.py. Re-add when there is an actual live bridge hook that evaluates artifacts and persists a verdict. Everything load-bearing stays: governor, presence record_hash binding, HUD-OCR, the fusion core + self-adversary + --from-session runner, and the NCAA injection-axis drop. 71 fusion/witness/governor tests pass. PV-CI 179 PASS. No FROZEN/PoAC/chain. PR #51 held. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… Ed25519 provenance + SIC)
Activates VSD as a runnable, provenance-chained, self-verifying loop — the synthesis-domain
twin of FROZEN-v1 + PV-CI. Reversible, no chain, no governance ceremony; runnable as a /goal
with a deterministic stop condition. First cycle ran green end-to-end on this machine.
- vsd-vault/.vsd/synthesis_integrity_chain.py — SIC (FROZEN v1, tag VAPI-SIC-GENESIS-v1),
mirrors grind_chain.py: genesis_sic + compute_sic(prev||pbsa||harness||pv_ci||drift||ts) +
verify_chain (tamper-evident). Pure stdlib.
- vsd-vault/.vsd/vsd_provenance.py — per-note Ed25519 (vsd-note-manifest-v1), reuses the
wallet-attested architect key. Split-signing: routine notes (claim/ingredient/synthesis/pbsa)
loop-signed; decision notes get a content-bound STUB manifest signed:false/pending:operator
(the loop never forges the architect signature).
- vsd-vault/.vsd/vsd_eval_harness.py — IMMUTABLE checker (does NOT touch the frozen gate):
VSD-2 manifest verify, VSD-3 honesty fields (confidence in the 8 estimative words, int effort,
deployer==wallet), VSD-4 PBSA present, VSD-5 passing-note set for corpus regen.
- vsd-vault/.vsd/vsd_synthesizer.py — editable orchestrator: ensure seeds -> emit PBSA -> sign
-> harness + PV-CI (179, unedited) + best-effort Mythos -> stamp SIC -> append ledger ->
regen corpus (passing-only). --cycle/--report/--dry-run.
- eval/INVARIANTS.md + NOTE_SCHEMAS.md (declarative ground truth); orchestrator/{SYNTHESIS_LOOP,
BOUNDARIES}.md; eval/synthesis_ledger.jsonl; 2 seed notes + cycle-1/2 PBSAs + signed manifests.
- 14 tests (SIC determinism/verify/tamper; provenance sign/verify/pending/tamper; harness
parse/VSD-3/seeded-vault). corpus/ gitignored (derived).
Verified: cycle 1+2 green (harness PASS, PV-CI 179, mythos_drift 0); decision note
pending-operator; SIC chain re-verifies; tamper detected. No FROZEN/PoAC/chain edit; unified-gate
integration + SOF NFT fleet remain operator-fired. PR #51 held.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… agent #34 Implements the cycle-39 scope (s-bt-contention-angle-scope): Bluetooth-link contention as a first-class capture-integrity signal that GATES the presence proof under "capture integrity precedes presence." - bt_contention_intelligence.py (pure): assess_contention(host_state, poll_rate_cv, flap_count, streaming_source_active) -> ContentionAssessment{state, lean, evidence, contested}. Precedence: FLAPPING (module detach >= threshold) > CONTESTED (PCC host_state==CONTESTED OR CV>=0.40; lean BENIGN if a known streaming source like Remote Play is active, else SUSPECT) > CLEAR > UNKNOWN (DEGRADED/DISCONNECTED /missing -> abstain; PCC owns the disconnect path). contention_to_presence_signal() -> PRESENCE_CONTESTED. - live_presence_signaling_agent.py (#34): _check_devcert_presence now derives `contested` via assess_contention (richer than the prior raw host_state==CONTESTED), with streaming_source_active from retina_game_capture_enabled. Any contested state -> #34 PRESENCE_CONTESTED + dev-cert proof degrades. HONESTY: adversarial direction is a measured-LEAN, never a verdict (BT-CALIB study / BlueShield FN floors pending); bt_witness HCI evidence + hard verdict are v2 (LAN-tower hardware). v1 runs on PCC alone. Tests: 6 new (precedence + benign/suspect lean + CV breach + flap-dominates + abstain) + #34 5 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
… biometric blindness
Live A/B (75s each): playing THROUGH PS Remote Play (PS5 streamed to laptop) vs dual-connection (USB+BT,
play on TV). Both questions answered positively:
1. Capture stays NOMINAL — and MORE stable (poll-rate CV 0.140 -> 0.044); NOT contested. The CLAUDE.md
"Remote Play -> CONTESTED" risk did not materialize.
2. L4 comes fully alive — L4/L5/L6 ok 27% -> 100%; controller-lobe 65% ANOMALY -> 100% CLEAN. Playing
through Remote Play makes the controller the laptop's USB active host, so the HID carries live input.
Resolves the dual-connection blindness: Remote Play is the live-biometric-capture path for the PS5-exclusive
NCAA CFB 26. Also concretizes the BT-contention angle — Remote Play is a known BENIGN streaming source
(streaming_source_active), so its contention leans BENIGN. humanity_prob 0.40->0.52 (still <0.60 gate; that
is the live p_L4 mapping, a separate tuning lever, not a capture problem).
scripts/remote_play_ab_probe.py (reusable harness; reads bridge.db, PCC integrity + NQPV liveness) +
audits/remote-play-ab-latest.json + audits/remote-play-ab-finding.md. No FROZEN-v1 / 228B PoAC / chain / IOTX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…hot-loop
Activates the coupled-retina presence path now that the Remote Play A/B confirmed a live, biometrically-rich
stream. Three seams in dualshock_integration.py (all default-off via retina_game_capture_enabled, fail-open):
1. __init__: start RetinaGameCapture(window=retina_game_capture_window, default "Remote Play") — WGC
screen-capture bg thread -> cv_motion optical flow. start()=False (window not found) -> abstain.
2. per-frame loop: feed_hid(ts_ms, right_stick_x, right_stick_y) for every frame in the batch (cheap
deque append) -> dense live stick stream for the InputOutputCouplingOracle to correlate vs screen-pan.
3. nqpv co-capture block: map_l9_to_nqpv_retina(latest_coupled_verdict()) -> meta["retina_coupled_verdict"]
just before cocapture_fields_from_pitl_meta reads it -> flows into nqpv_cocapture_log + the fusion + #34
with NO fusion code change (forward-compat plumbing). None -> abstain (unchanged).
The coupled-retina verdict (COUPLED_CLEAN/IMPLAUSIBLE) now joins PoEP + CCO + L4L5L6 in the live NQPV proof.
Tests: qortroller_retina_capture + nqpv_cocapture 11 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…amera games + add WGC diagnostic Live Remote Play verification surfaced a false negative: as WGC frames accumulated (frames_seen 218), the coupled-retina verdict flipped abstain -> IMPLAUSIBLE 16/19. Root cause: NCAA CFB's AUTO-CAMERA pans the screen independently of the right stick (a dead-zone-stick game, no aim mechanic), so the coupling oracle reads "screen moves on its own" as a relay/injection signature -> IMPLAUSIBLE -> would degrade the dev-cert proof (presence 0.0). This is a false negative, not adversarial evidence. Fix (honest "functioning as engineered"): the coupled-retina lobe is an AIM-game lobe; for dead-zone/ auto-camera games absence-of-coupling is EXPECTED. - config: retina_coupled_negative_enabled (default False) — IMPLAUSIBLE injects only for aim-games where decoupling is genuinely adversarial. Positive coupling (COUPLED_CLEAN/LIVE_COHERENT) injects either way. - dualshock hot-loop: gate the meta injection accordingly (default: abstain on IMPLAUSIBLE, never degrade). - qortroller_retina_capture: status() + frames_seen diagnostic (proves WGC IS capturing: frames_seen>0 with a None/abstain verdict = honest abstain, not a broken capture). Also fixed a redundant double-map in the wiring (latest_coupled_verdict already returns NQPV vocab). Verified live: WGC captures frames (218+); coupled-retina correctly abstains for NCAA (same MIN_STICK_STD rail as L2C). Tests 12 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…dow adjustment for Remote Play The coupling oracle already searches causal lags [0,500ms] and the AdaptiveCaptureGovernor already widens that window when lag nears the ceiling — but the governor was NOT wired into the live retina capture, and my hot-loop feed stamped every frame in a batch with one timestamp (collapsing the per-frame timing the lag search needs). Both fixed so the Remote Play latency is meticulously tracked. - coupling.py: InputOutputCouplingOracle lag_max_ms/common_rate_hz/min_grid_samples are now instance attrs (sentinel-None defaults read the module constants at construction -> every existing call byte-identical, env-override preserved). The governor mutates oracle.lag_max_ms live. - dualshock hot-loop: feed_hid now stamps each frame with its OWN wall-clock ts (anchor latest frame to now, backdate earlier frames by their true device-timestamp delta) so the lag search resolves per-frame; and calls capture.tune() per record (governor is EMA-smoothed + cooldown-gated) under retina_adaptive_lag_enabled. - qortroller_retina_capture: WgcFrameSource tracks recent frame_ts; RetinaGameCapture holds the governor + tune() (applies lag_window_ms/resample_hz/downscale live); status() surfaces lag_ms + lag_window_ms + resample_hz + governor summary so the adjustment is observable. - config: retina_adaptive_lag_enabled (default True). Tests: 3 new (oracle tunable+backward-compat / tune widens window near ceiling / safe no-op) + retina + coupling + adaptive_capture = 35 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…(Remote Play screen-lobe) Live Warzone-via-Remote-Play capture froze the WGC screen-lobe at frames_seen=20 (~2 fps) while the biometric/presence pillars ran at 100%. Two root causes, both fixed: 1. HDR (operator enabled HDR + 60fps in Windows): WGC delivers 8-bit BGRA only under SDR; under HDR the frame_buffer is WIDER (uint16, or scRGB float16/32 where 1.0=SDR white and highlights exceed 1.0). The old `buf[:, :, :3]` assumed 8-bit and the silent `except: pass` hid the failure -> frames never processed. New `_to_u8_bgr()` normalizes any format to 8-bit BGR (uint16 -> >>8; float -> EMA-smoothed scale to avoid brightness flicker injecting false optical flow). First-frame format is logged + surfaced in status() so the agents know HDR is active; frame errors are now counted + logged once (no more silent). 2. Window-handle staleness: Remote Play recreates/fullscreens its window when a game stream starts, invalidating the handle WGC bound at start(). New `restart_if_stalled()` (called from tune(), cooldown- gated) re-acquires the window when frames stop -> the screen-lobe rebinds to the live stream. status() now reports frame_format / frame_errs / reacquires / frame_stall_s. Tests: 6 new (HDR uint8/uint16/ scRGB-float normalization + stall/cooldown re-acquire logic) + retina/adaptive 15 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…~2fps WGC window throttle) Live diagnosis: fullscreen Remote Play on the laptop throttled WGC window-handle capture to ~2fps (frame_format uint8 1080p, frame_errs=0, frame_stall_s=0 -> not HDR, not frozen; Windows throttles graphics-capture of fullscreen/non-foreground windows). The screen-lobe couldn't compute coupling/lag while the other 4 pillars ran at 100%. Fix: capture the whole MONITOR at full refresh instead of the window handle — immune to window-handle staleness AND fullscreen throttling. - config: retina_game_capture_monitor (int, default 0=window; >=1 = that 1-based monitor index). - WgcFrameSource: monitor_index -> WindowsCapture(monitor_index=...) vs window_name=...; target_desc in logs. - RetinaGameCapture + dualshock pass it through from cfg. .env: RETINA_GAME_CAPTURE_MONITOR=1 (laptop display where Remote Play is fullscreen; the PS5->TV HDMI is the PS5's own output, not on the laptop). Tests: 3 new (monitor target / window default / pass-through) + retina/adaptive/HDR 18 pass; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…(THE screen-lobe freeze) Root cause of the ~2fps screen-lobe freeze (frames_seen stuck at 22, frame_errs=550): the adaptive governor changes `downscale` live -> to_gray_small yields a different-sized gray image -> frames_to_motion's Farneback optical flow asserts prev0.size()==next0.size() and THROWS. Because the throw happened before prev_gray was updated, prev_gray stayed pinned at the old size and EVERY subsequent frame threw forever (confirmed: "optflowgf.cpp (-215:Assertion failed) prev0.size() == next0.size()"). It captured fine at 218 frames BEFORE the governor existed; the governor regressed it. Fix: guard the motion computation on prev_gray.shape == gray.shape (skip motion on a size change) and ALWAYS update prev_gray/prev_ts -> a downscale change cleanly re-baselines instead of throwing. The HDR-aware + re-acquire + monitor-capture work from this arc stays (all correct); this is the missing piece that lets frames actually flow so coupling/lag can compute. Test documents the trigger. PV-CI unaffected. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…; SIC head 51ddabea) Cycle-40 scopes the durable fix for the ~2fps WGC screen-lobe delivery (the shape-guard fix in cycle-39 unblocked it; this raises the rate). Crux is recursive-verification-first: PHASE 0 validates the in-bridge- contention hypothesis (run the existing standalone capture alongside the live bridge + measure fps) BEFORE building — full-rate standalone confirms isolation is the fix; still-2fps means the capture itself is the limit (re-scope to DXGI Desktop Duplication / accept low-rate). PHASE 1 (only if validated): subprocess owns WGC+cv_motion (reusing HDR normalizer + shape-guard) emitting tiny FrameMotion over a Queue; bridge keeps the coupling oracle where the HID is. Default-off, fail-open. The 4 non-screen pillars don't depend on it. Harness PASS (77 notes, 0 findings); chain 40->41 (head 51ddabea); VPM live; PV-CI 182; session attest witnessed_cycle 40 (7c6ab1d9). No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…) under ps5_compat_mode
Audit for "anything that perturbs play / could look like aim-assist" found exactly one controller WRITE on
the gameplay path: set_led(0,0,255) ("reset LED to idle blue") after each PITL proof, UNGUARDED by
ps5_compat_mode. It is harmless to aim/camera (lightbar colour only, never input) so it cannot cause camera
shake or be detected as input manipulation — but it violated ps5_compat=True (whose purpose is zero
controller writes during PS5/Remote-Play). Now guarded: under ps5_compat the capture is FULLY PASSIVE (zero
writes), matching agent #34's _fire_controller discipline.
Context for the operator's concern: QorTroller has NO feature that injects input or moves the camera — it
reads HID + reads the screen (WGC), like OBS. Aim-assist DETECTION (coupled-retina IMPLAUSIBLE) is OFF
(retina_coupled_negative_enabled=False) and is an internal research label never sent to the game/anti-cheat,
so it cannot get a player flagged. Takes effect on next bridge restart. No FROZEN-v1 / PoAC / chain / IOTX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
…apture surface is the limit) Built + ran the Phase-0 gate from s-retina-wgc-process-isolation-scope: measure standalone WGC fps (own process, no bridge contention) on monitor 1 while playing Remote Play fullscreen, alongside the bridge. RESULT: 56 frames / 35s = ~1.6 fps standalone — SAME as in-bridge. So the ~2fps is NOT in-bridge contention; WGC samples Remote Play's fullscreen (protected/overlay) surface at ~1.6fps regardless of process. VERDICT (b): the capture surface is the ceiling -> process isolation (Phase 1) would NOT help and is OFF. The validation gate prevented building the entire wrong fix. Re-scope (honest): full-rate coupled-retina/lag belongs to a NATIVE-PC aim-game (game on the local swapchain, WGC-capturable at 60fps), not a streamed Remote Play surface; DXGI Desktop Duplication is a distant second; otherwise Remote Play screen-lobe is a low-rate witness (~25% COUPLED_CLEAN, still real). The cycle-39 shape-guard remains correct + necessary; the 4 non-screen pillars are at 100% and independent of this. scripts/validate_wgc_standalone_fps.py (read-only, no controller writes) + audits/wgc-phase0-fps-validation.md. No Phase-1 code built. No FROZEN-v1 / PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FB95JZKj9nctwyPtxupJW1
… SIC head dca70ce9)
Cycle-41 follows up cycle-40 (process isolation ruled OUT). Reframe: the operator SEES smooth 60fps in the
Remote Play window and Windows is set to 60fps capture, so the frames physically exist on the display — WGC
just isn't sampling them. That makes the ~2fps a capture-PATH problem (likely solvable), not a frames-don't-
exist problem. Phase 0 only tested ONE path (WGC monitor-capture of fullscreen). Leading hypothesis:
fullscreen Remote Play presents via independent-flip / hardware overlay that bypasses DWM composition, so WGC
(which samples the composed surface) sees ~1.6fps; a composited (windowed) surface or a flip-chain-reading API
(DXGI Desktop Duplication) would get full rate.
Scopes a cheapest-first experiment funnel, STOP at first >=30fps: E0 bounds solvable-at-all (operator records
Remote Play with Xbox Game Bar / OBS — 60 => our WGC path is the problem, run E1+; ~2 => protected against all
capture, go native-PC fallback); E1 windowed + WGC window-capture; E2 Win11 graphics/flip settings; E3
process/OCR audit (low prior); E4 DXGI Desktop Duplication via dxcam behind the same RetinaGameCaptureCore;
E5 OBS virtual-cam fallback. Tooling: extend scripts/validate_wgc_standalone_fps.py with a
--backend {wgc-monitor,wgc-window,dxcam} switch + comparison table. No code built this cycle — scope note only.
Harness PASS (79 notes, 0 findings); chain 40->41 (head dca70ce9); VPM live; PV-CI 182. The 4 non-screen
pillars are at 100% and independent — this only raises the coupled-retina/lag sample rate. No FROZEN-v1 /
228B PoAC / chain / IOTX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…e (cycle 42; SIC head 8eed3160) Cycle-42 answers the operator's question: enhance screen monitoring by GROUNDING it in the device-verified input stream — per on-screen game-action, prove the action was AUTHORED by input from the vaulted controller. Names the candidate primitive PoSCA (Proof of Skilled Causal Authorship): a FUSION of three legs QorTroller already has — PROVENANCE (VMDR birth-cert + Path A silicon root + 228B PoAC chain), CAUSAL COUPLING (L9/PoCP input->screen), SKILL STRUCTURE (L4/L5 + adaptive-trigger force-curve). The novel claim is the per-action conjunction "this skilled play was authored by a verified human on a verified device" — exclusively QorTroller-buildable because no server-side anti-cheat has the vaulted-device anchor + 1kHz biometric surface + PoAC chain (they detect anomalous OUTCOMES; only QorTroller proves AUTHORSHIP from a verified physical source). (A) Alignment: YES, strong — composes INTO NQPV (the calibrated model already ABSTAINS on exactly this presence-oracle feed), not parallel to it. (B/C) Emulated controller: COULD yes; SHOULD as trust/input almost-certainly-not (it IS the Cronus/XIM/reWASD cheat vector the adaptive-trigger discriminator defeats — no silicon root, no agency, cannot be vaulted); SHOULD narrowly as a labeled red-team adversary harness (turns nqpv_adversary_synth modeled FAR into measured FAR; attack side of the ROC only, never registered). HONESTY RAILS: PoSCA proves authorship + liveness + human STRUCTURE, NOT a skill RANK (ranking is the banked GCAP human-TAR-collapse trap, would invert into false low-skill-human accusations — out of scope). Certification GATED on (a) the screen capture-rate fix (MPO/WGC work in progress), (b) live non-blind input+screen co-capture (Remote Play dual-connection is biometrically blind today), (c) a measured anti-GCAP TAR/FAR study. Advisory / default-off; the 4 non-screen pillars stay at 100% and independent. Harness PASS (81 notes, 0 findings); chain 42->43 (head 8eed3160); VPM live; PV-CI 179; session attest witnessed_cycle 42 (496fde58). Note loop-signed (Ed25519, pinned to attested architect key). grok is implementing PoSCA against this committed spec in parallel. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…into NQPV/co-capture (cycle-42) + corrections Composes the cycle-42 synthesis (s-posca-input-grounded-screen-authorship) into NQPV as an ADVISORY per-action authorship oracle: provenance (VMDR/PoAC device) + L9 causal coupling + L4 structure, per discrete on-screen game-action. Default-off, advisory; no FROZEN-v1 / 228B PoAC / chain / IOTX. Built by grok (parallel /goal build); integrated, corrected, and verified by Claude (single-integrator pass). grok build: posca_action_provenance.py (detector/binder/commitment reusing ScreenEvent + assess_coherence + is_input_caused); FusedGamerPresenceProof posca fields + fuse() params; dualshock co-capture hook; store columns; main.py persist; SDK dataclass/parser/demo + tests; operator_api endpoint passthrough. Integration fixes (single-integrator pass — full writeup audits/povca-integration-assessment-2026-06-27.md): - F1 (CRITICAL): _check_structure_ok failed OPEN — returned True without L4 evidence, and even on L4-anomalous input — manufacturing AUTHENTIC for macros/translators (the GCAP overclaim the cycle-42 rails forbid). Now tri-state Optional[bool]: None=abstain; True only when L4 present AND dist<7.009; False on anomalous. No AUTHENTIC without evidence, enforced in code. - F2 (HIGH): nqpv_cocapture_log INSERT wrote 5 posca columns the schema lacked -> every co-capture insert threw (silently swallowed by main.py best-effort), breaking cycle-33 persistence + 4 existing tests. Added columns to CREATE TABLE + idempotent ALTER migrations; fresh + existing 5.4GB DB converge. - F3 (HIGH): the recomputable commitment was dead code; fuse fabricated a non-recomputable "povca:" string. compute_posca_commitment now deterministic (struct.pack, QOR-POVCA-v1, tri-state byte), minted at detection, wired through store/fuse/endpoint; fuse passes it through, never fabricates. - F4 (MEDIUM): posca was set in contribs but absent from _PROVISIONAL_WEIGHTS -> 0-weight no-op. Made it an explicit ADVISORY field that does NOT move presence_score until a measured anti-GCAP study sets a weight; verdict via single-source posca_verdict_from(). - F5 (MEDIUM): added bridge/tests/test_posca_action_provenance.py (14 tests) locking tri-state structure, verdict helper, emulated gate, commitment determinism, detector binding, fuse-advisory-not-scored, store roundtrip. - F6 (LOW): live discrete path dormant until screen_events/input_events are co-captured (capture-rate fix); abstains honestly meanwhile. Verification: new posca 14/14; nqpv_cocapture_store 5/5 (was 4 failed); novel_presence_fusion 19/19 (no regression); nqpv study/loader/offline 31/31; SDK 48/48; PV-CI 182 (0 invariants added — no FROZEN touch); VSD chain untouched (head 8eed3160). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…vert Stride-slice frame.frame_buffer by the live downscale BEFORE _to_u8_bgr, so the ~6 MB ascontiguousarray copy + HDR float-normalize + grayscale run on ~1/d**2 the pixels instead of full 1080p. Reconciles the cycle-40/41 fps finding. 6521644 concluded "capture surface is the limit (~1.6fps), process isolation ruled OUT" -- but validate_wgc_standalone_fps reports rgc.frames_seen, which only increments AFTER frames_to_motion succeeds (post-processing throughput), not raw arrival. A no-op-callback probe shows raw WGC arrival ~39fps: WGC samples the fullscreen surface fine; the per-frame callback is the wall (static==motion==~7fps = fixed per-frame cost). So the cycle-41 E0-E5 backend funnel (windowed/DXGI/OBS) is moot -- this is a software fix. _to_u8_bgr and to_gray_small are untouched (the slice is at the call site; to_gray_small gets downscale=1 to avoid double-down). The shape guard re-baselines on downscale change as before. Advisory presence lobe only; no FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…estimator frames_to_motion computed a dense optical-flow field (cv2.calcOpticalFlowFarneback) only to average it into a single global yaw/pitch pan -- the field was discarded after np.mean. cv2.phaseCorrelate computes that global shift directly ~18x faster, removing the real per-frame wall the slice-at-source fix (cab15fd) exposed: dense Farneback (~37-200ms/frame, content-dependent, unchanged by the slice) was capping processed throughput at ~7-10fps regardless of the ~39fps WGC delivery. Offline proof (270x480): slice + phaseCorrelate = ~3.3ms/frame (~300fps ceiling) vs Farneback alone ~37ms -- the processed rate is now bounded by the ~39fps WGC delivery, not the callback. Reaches the usable-rate goal (Remote Play as a continuous coupled-retina witness; native-PC no longer required for rate). Contract preserved: same FrameMotion return + same negation sign (empirically confirmed -- phaseCorrelate(prev,cur) returns the prev->cur shift same-sign as the motion, so +x scene pan -> yaw_rate<0, identical to the old mean-flow convention). Coupling scores via Pearson r (scale-invariant) so the proxy scale is irrelevant; only yaw/pitch reach feed_frame_motion (flow_energy is discarded live). Hanning window cached by shape. frames_to_motion was untested (live I/O boundary); adds test_cv_motion_global_motion.py (6 tests: direction, axis separation, sign reversal, dt-linearity, no-motion, FrameMotion contract). Absolute sign + live coupling to be re-validated on the rig via validate_wgc_standalone_fps (frames_seen ~7 -> ~30-40) + status() COUPLED_CLEAN still firing. Advisory presence lobe only; no FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…3; SIC head 9f0425b0) Supersedes s-wgc-fps-deepdive-workflow's Part B backend funnel. The cycle-40/41 "capture surface is the limit" conclusion was a measurement trap: validate_wgc_ standalone_fps reports frames_seen (post-processing), not raw WGC arrival. A no-op probe showed raw ~39fps; the per-frame callback was the wall. Records the shipped fix (slice-at-source cab15fd + phaseCorrelate eb9eec2) + the open live gate. Cycle 43: harness pass, PV-CI 182, mythos_drift 0, visual_state=live, SIC 43->44 links (head 9f0425b0). Note loop-signed (Ed25519). Excludes two pre-existing untracked notes (s-nqpv-promotion-ceremony-draft, s-presence-oracle-liveness- readiness-checklist) per operator; the cycle-43 ledger note_ids records them as on-disk at cycle time, but the SIC does not depend on note_ids, so chain verify holds on a fresh clone without them. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…fix reality) The cycle-40 verdict logic answered "in-bridge contention vs capture-surface limit" and, post-fix, mis-read the high standalone fps as "process isolation is the correct fix". That question was resolved by s-wgc-fps-processing-wall-resolved (cycle-43): the bottleneck was the per-frame callback, raw WGC delivery is ~39fps, and the slice+phaseCorrelate fix (cab15fd/eb9eec27) made processed ~= delivery. Reframes the docstring + verdict bands around the real ceiling now (WGC DELIVERY), points a LOW reading at the no-op raw-arrival probe to disambiguate stream-limited vs callback-contended, and notes that exceeding ~39fps (60fps HDR) means raising delivery, not the callback. No behavior change — print text only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ee859b) Scopes the meticulous path to 60fps HDR coupled-retina. Key finding (microbenched): the HDR callback is ALREADY 60fps-ready post-fix (scRGB-float worst case 7.66ms at d=4, <half the 16.7ms budget; 1.4-3.6ms at d=6/8) -- the slice turned the old 164ms float-normalize into a sliced op. So the binding constraint is WGC DELIVERY (~39->60), which is present in SDR already (=> a Remote Play stream/present-rate reality, not HDR-specific nor a callback problem); HDR only makes 60 harder (more bitrate/frame). A0 (the true Remote Play stream fps in HDR) is make-or-break. Cycle 44: harness pass, PV-CI 182, mythos_drift 0, visual_state=live, SIC 44->45 links (head c6ee859b). Note loop-signed (Ed25519). Excludes the two pre-existing untracked notes per operator (SIC does not depend on note_ids; chain verify holds on a fresh clone without them). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…otion ceremony draft) Built by grok during the 2026-06-26 NQPV arc and left uncommitted in the working tree; landed separately per operator (deliberately excluded from this session's cycle-43/44 commits since the content is grok's, not this session's work). - s-presence-oracle-liveness-readiness-checklist: minimal readiness checklist for promoting NQPV from advisory to a certifying regime (PoEP + coupled-retina liveness, persistence/co-capture, study envelope, operational gates). - s-nqpv-promotion-ceremony-draft: draft operator two-key ceremony text + exact-phrase gate for the advisory->certified flip. Both loop-signed (Ed25519, signer=loop, attested pubkey 056e695f..., type=synthesis), harness-passing (in the cycle-44 passing set), repo-relative manifest paths. Content is grok's; committed here on operator authorization (single-committer discipline). No FROZEN-v1 / 228B PoAC / chain / IOTX touch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013UmnLpWQuFnW8eUk4jJgoP
…s shuffle null, surface calibration data
The coupled-retina screen-lobe's COUPLING_THRESHOLD (0.20) is uncalibrated. Live Remote-Play data (active-aim
coupling ~0.14-0.15, peak 0.213, vs time-shuffled null ~0.02) motivates a principled calibration — separate
real coupling from its own shuffle (negative_control) with a MEASURED FAR, never lower the bar until it fires.
- coupling_threshold_calibration.py: calibrate(coupled, null) -> {ADOPTABLE | INSEPARABLE | INSUFFICIENT_DATA}.
Threshold = FAR-controlled quantile of the shuffle null, so false-accepts are measured, not assumed. Refuses
to invent a passing threshold (overlap -> INSEPARABLE = the honest 'native-PC for the lag pillar' outcome).
Anti-GCAP rail: shuffle is the weakest null; a shuffle-only pass is provisional until structured
(auto-camera/replay) negatives are added. Per-regime. 7 tests.
- RGC.status() surfaces coupling_score + negative_control + decoupled_energy + grid_samples so every session
logs the calibration pairs (the diag already prints status()).
- scripts/calibrate_coupling_threshold.py: runner that harvests the pairs from the diag log and calibrates.
First pass this session: coupled N=26 (0.0-0.213) / placeholder null N=5 -> INSUFFICIENT_DATA (separation
positive but N too small + placeholder null pending a bridge restart that logs real negative_control). Adopt a
calibrated L9_COUPLING_THRESHOLD (env var, no code edit) ONLY if FAR-safe; else the data says native-PC for
the lag pillar. No FROZEN-v1 / 228B PoAC / chain / IOTX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
… 45; SIC head 09e09d5f) Cycle-45 scopes the coupling-threshold calibration hypothesis: the coupled-retina COUPLING_THRESHOLD=0.20 is uncalibrated; live data (active-aim ~0.14-0.15, peak 0.213, vs shuffle ~0.02) motivates a principled calibration — threshold = FAR-controlled quantile of the negative_control shuffle null, never lower-until-it-fires. Anti-GCAP rail: shuffle is the weakest null; structured (auto-camera/replay) negatives required before non-provisional adoption. Pairs with the calibration harness landed in 7e6d536. Harness PASS; chain 45->46 (head 09e09d5f); VPM live; PV-CI 182. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…Remote Play (+ WGC stop() bug fix) Make QorTroller's coupled-retina presence work over Remote Play streaming WITHOUT lagging the game, after a live debugging session localized the lag with DATA (not assumption): - the lag driver was the BRIDGE's ~38% CPU (agent fleet + 5.4GB DB + grind + provenance), NOT the capture (system CPU 73% bridge-on / 35% bridge-off; bridge-down = perfect gameplay, operator-confirmed); - WGC screen-capture competes with Remote Play's GPU decoder (observer effect) — capturing lags the game regardless of rate (a rate-cap relieves nothing: the capture SESSION's existence is the cost), and a separate process is ALSO throttled (~13fps under load) -> cross-process contention, not the GIL (process-isolation refuted); only STOPPING the capture frees the GPU. PRESENCE_LEAN_MODE (config, default-off): main.py run() early-returns after the DualShock spawn, skipping the ~30-agent fleet + grind + PCC + chain reconcilers (keeps DualShock + retina/coupling + uvicorn + loop_health). Cuts system CPU 73% -> 43-50% -> smooth play (operator-confirmed "much better"). Duty-cycle / on-demand capture (presence_burst.py NEW + config flags + dualshock wiring): capture in brief BURSTS (start -> accumulate coupling -> STOP, GPU freed) instead of continuously. ON-DEMAND (period<=0): zero capture during play (smooth), a single full-rate proof burst fired by a trigger file (~/.vapi/presence_trigger) — the captcha model for competitive play. PresenceBurstController is single-flight + fail-open + never leaves the GPU held. WGC stop() BUG FIX (qortroller_retina_capture.py): WgcFrameSource.stop() called self._cap.stop() but WindowsCapture has NO stop() (hasattr False -> silent no-op); only the CaptureControl from start_free_threaded() does. So the WGC session never actually halted in-process — a latent bug AND the prerequisite for duty-cycle. Now stores + uses the control. Also adds a minimum_update_interval rate-cap config (built; found ineffective for the GPU observer-effect; kept as a lever). Empirical wins banked: a McAfee-VPN was throttling the Remote Play stream (raw 16->29fps when killed); COUPLED_CLEAN proven (coupling 0.348 @ 13.6fps) stream-unlocked -> the oracle works over Remote Play; burst coupling is thinner (cold-start ~0.09-0.15) -> the cycle-45 calibration sets the FAR-safe threshold. Tests: bridge/tests/test_presence_burst.py NEW (8 — fire start/read/STOP, single-flight, fail-open, on-demand trigger fires+consumes, no-trigger-no-capture); retina/fusion/calibration regression 48/48 green; PV-CI 182 (0 invariants added); no FROZEN-v1 / 228B PoAC / chain / IOTX. Default-off — the full bridge is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…lation refuted; lean-mode plan; sidecar assessment) Three synthesis notes from the live Remote-Play presence debugging arc, landed together (they accumulated uncommitted, so the ledger gains 3 lines and the label/seeds sit at the cycle-48 state — not cleanly splittable into 3 commits): - cycle 46 s-retina-remote-play-process-isolation: scoped process isolation as the fix; PREMISE REFUTED live (a separate process is also throttled under bridge load -> cross-process contention, not the GIL). - cycle 47 s-presence-lean-mode-build-plan: the data-grounded lean-mode build plan (bridge = ~38% CPU = the lag; bridge-down = perfect) — built + shipped in 2758c74. - cycle 48 s-sidecar-capture-process-vs-device: a sidecar PROCESS can't give the capture its own GPU (one laptop GPU, measured); lean mode already gives the CPU isolation; the valid evolution is a sidecar DEVICE. Harness PASS; chain 46->47->48->49 (head 5099b67b); VPM live; PV-CI 182. Loop-signed (Ed25519, pinned to the attested architect key); the loop drafts, the operator commits. No FROZEN-v1 / 228B PoAC / chain / IOTX. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…ate + cycle-49 multi-channel design Campaign 2026-06-27 (Remote-Play/Warzone, dev-cert): calibration filter that fixes the coupling campaign + the deep multi-channel presence-gate design. - Calibration filter: decoupled-energy gate (gate_coupled_by_decoupled_energy) + --gate-decoupled runner flag. Campaign corpus (52 computed windows) ADOPTABLE-PROVISIONAL, FAR-safe ~0.06; the gate lifts TPR 0.85->1.00 at zero FAR. Staple: audits/coupling-calibration-2026-06-27.md + corpus JSON. - P1 LIVE gate: gate_features_by_decoupled_energy + GatedBurstSummary (l9 coupling) + RGC per-burst window history + presence_burst._fire_gated (median coupling of lowest-DE genuine-aim windows); default-off flag RETINA_BURST_DE_GATE_ENABLED. - Cycle-49 VSD synthesis notes (loop-signed, Ed25519, SIC chain 49 links): s-multi-channel-presence-gate (geometric + trigger->HUD) + s-recoil-compensation-coupling (closed-loop anti-recoil-macro proof). - Tests: l9 coupling 11, presence_burst 11, calibration 10. PV-CI 182 PASS. 0 IOTX; no FROZEN/chain/PoAC. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
…cile) Brings main's 10 commits (Arc 7 v2 #56, PROVING GROUND #57, PoSR phase-1 #58, GamerView rounds #59/#60) into the branch. Auto-merge handled ~31 of 33 changed-on-both files cleanly; 2 conflicts resolved: - frontend/src/views/GamerView.jsx: took main's newer four-corner telemetry design (rounds 5/6). Resolved file is IDENTICAL to main (branch had no unique GamerView additions) -> zero loss. - CLAUDE.md: kept the branch's PV-CI provenance narrative (both sides said 179; the live gate reports 182 -- pre-existing prose drift on both branches, flagged for a follow-up doc fix). Verified: PV-CI gate PASS 182 (main's INV-POSR x6 / INV-RETINA x2 / INV-W3S-006 / INV-TBR x2 / INV-VHR-V2 all preserved in both allowlist + gate code); cycle-49 tests (l9 11 + calibration/burst 21) pass; all key bridge modules import. Critical infra (invariant gate, allowlist, contracts/deployed-addresses) auto-merged cleanly. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqbiCM8tomkypSuJkdB11v
ConWan30
added a commit
that referenced
this pull request
Jun 27, 2026
…harness docs(claude): PV-CI baseline prose 179 → 182 (follow-up to #51)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Plan (a) executed: the harness that runs the fusion doc's §5 experiment. Stacks on the engine PR #50. Synthetic Phase 1 (software-only); real capture is the gated Phase 2.
Pipeline: generate 5-class labeled sessions → adapt to (Presence, Trajectory, L4) signals → run the real
assemble_consistencyengine → 5×6 confusion matrix + metrics + contextual-lift comparison → dated audit artifact.It is a parameterised sensitivity analysis over the two retina-axis unknowns (
retina_tpr_aimassist,retina_fpr_proskill), NOT real capture — it shows how the fusion behaves as a function of retina's trajectory ROC.First-run result (tpr=0.85, proskill-fp=0.15) — and it is honest
retina_fpr_proskillby construction (proven intest_proskill_false_accusation_equals_retina_fp_param).Conclusion the experiment supports: L9's worth via this fusion is contextual disambiguation + forensic binding, not a magic cheat-detector. The make-or-break — retina's trajectory false-positive rate on real elite play — is unmeasurable synthetically and is Phase 2 real capture.
Honesty rails
bridge/import in the harness), no DB/FROZEN/PoAC touch, gates nothing.UNCALIBRATED; all results carryprovenance=synthetic+provisional=True; PRO_SKILL flagged the weakest proxy.Fusion v2 — Self-Adversarial Co-Capture Calibration + Adaptive Capture Governor (Phases 1–5)
Built on top of the harness above. Turns the UNCALIBRATED stack into measured separation by using QorTroller's own primitives (HID replay, motor command, WGC capture, cryptographic binding) to manufacture ground-truth adversaries at N=1, co-capture all channels into one bound artifact, and replay each artifact through every oracle. Exclusive because only QorTroller owns the certified input anchor + command/replay/binding loop. Everything default-OFF, advisory,
UNCALIBRATED; no FROZEN/PoAC/chain edit; PV-CI 179 PASS throughout.Lead-in work also on this branch (precedes the phases):
l9_presence/adversarial/cocapture_binding.py±2s temporal correlator (reuses the engine'sDEFAULT_WINDOW_NS) +presence_challenger.log_probenow stamps the live PoACrecord_hash(additivel6b_probe_logcolumn, canonical instore/_core.py). Temporal-prototype vs cryptographic-production distinction explicit.--response l5+touch(any of l5/r5/l4/r4/touch counts).bridge/controller/probe_gate.py(LULL/ACTIVE/UNSETTLED; veto = window accel-var vs rolling baseline; echo = closed-loop device-binding). Plus opt-in context gate (probe_context.py, reuses APOP/GAD) and screen gate (probe_screen.py, OCR play-clock/stoppage).retina_screen_lobe.py(OCR HUD → outcome events) × controller lobe →retina_causal_coherence.py(input→outcome causal binding) →screen_retina_fusion.pytri-channel verdict (continuous coupling × discrete coherence), reviving the WGCscreen_captureas the shared sensor.Phase 1 — Adaptive Capture Governor (
l9_presence/adaptive_capture.py, 18 tests)Real-time lag/FPS self-tuning driven by the same lag signal that proves presence.
decide()priority: steady-video first (jitter/low-fps → downscale↑ then region↓), then estimator validity (widen coupling lag-window near the ceiling, raise resample on short grid), then opportunistic sharpen. EMA + cooldown ⇒ no oscillation. Honest scope: cannot reduce external Remote-Play stream lag — it stabilizes the capture pipeline + adapts the estimator.Phase 2 — Witness-agent activation + bound recorder
WitnessConfig.adaptive_capture_enabled/collect_telemetry(default ON).cv_motion.MotionExtractorgains liveset_downscale;session_recorder.record_sessionaccepts an optionalgovernor=(steps every N frames, applies downscale, savescapture_governorinto the npz;None= byte-identical prior behavior).process_sessionembedscapture_telemetry(live record, else hardware-free post-hoc replay). Governance seams stay OFF/dry-run.Phase 3 — Replay-through-all-oracles panel (
bridge/vapi_bridge/oracle_panel.py)SessionArtifactinput contract →evaluate_artifactruns continuous coupling + discrete OCR coherence + tri-channel fusion →PanelReport(UNCALIBRATED). Runnerscripts/run_fusion_v2_experiment.py→audits/fusion-v2-calibration-<date>.{md,json}(5-class × per-oracle confusion). Bridge importsl9_presence.coupling;l9_presencestays pure.Phase 4 — Self-adversarial generators (
bridge/vapi_bridge/self_adversary.py)make_replay(foreign camera → coupling collapses),make_relay(idle controller, screen advances → ORPHAN_OUTCOME),make_headless(HID only → no render),make_injection(decoupled camera sweep → raised residual). Each stampsclass_label+provenance=real_derived— the N=1 unlock.Phase 5 — Bridge wiring
config.pyflags (l9_fusion_v2_enableddefault OFF,l9_fusion_coherence_threshold,l9_fusion_neg_control_gap,adaptive_capture_enabled);store/l9_fusion.pyL9FusionMixin+l9_fusion_event_logtable; read-onlyGET /bridge/l9-fusion/{device_id}+/bridge/l9-fusion/capture-telemetry(gated). Advisory only — does NOT touch the 228-byte PoAC, chain, or FROZEN-v1.--selftest—scripts/presence_challenger.py --selftestprints live IMU |accel| + gate state (no buzz) and verifies the IMU is actually exposed by pydualsense before a real run.First synthetic Fusion v2 confusion (honest)
HUMAN_CLEAN → LIVE_COHERENT (clean); HUMAN_RELAY (replay+relay) → REPLAY_OR_RELAY / DECOUPLED_REVIEW, never LIVE_COHERENT; BOT_FULL (headless) → INSUFFICIENT; HUMAN_INPUT_MACRO (injection @ strength 2.0) still LIVE_COHERENT — residual did not cross the 0.6 decoupled-energy threshold. That is the measured separation gap the real experiment must close — surfaced, not hidden.
Out of scope (gated on a positive Phase 2)
Real aim-assist/relay/elite capture; reducing real network lag; production calibration of thresholds to a passing gate; FSCA-lattice integration; continuous-residual ROC; any activation flip. N=1 falsifies, does not validate.
🤖 Generated with Claude Code