PR #1579 — Perception Substrate Program Phase 1 (merged)

Note: this is a hand-published snapshot release for PR #1579, not one of RuView's
auto-generated vXXXX releases (those are CI-created on every merge to main with a matching
Docker image tag). PR #1579 is merged as of this release; a vXXXX release with a Docker
image will follow from the normal CI pipeline on its own schedule.

Perception Substrate Program — Phase 1 (ADR-291–321, merged)

163 files, +35,562/−57, merged into main. Adds comparable-evidence ingest (Widar3.0, FeitCSI,
vitals rig), five honesty/safety remediation items, and Phase 1 of a 9-crate "certificate spine"
(ruview-ontology, -attest, -evidence, wifi-densepose-calibration+cert, -ood, -witness,
-certify, -scorecard, -policy), plus Phase 2/3 primitives for 13 more crates.

ADR renumbering: this PR originally used ADR-288–318, which collided with PR #1561
(wifi-veil, merged first, real ADR-288/289/290). Renumbered to ADR-291–321 across all 31 ADR docs,
98 Rust source files, and the ADR index, verified with cargo check --workspace (clean) after the
shift and again after the full merge.

Independently verified

• cargo test --workspace --no-default-features (pre-merge, PR branch): 4337 passed, 0 failed
• cargo check --workspace (post-merge, full tree with #1561 + #1579 combined): clean
• Python proof (archive/v1/data/proof/verify.py): PASS, bit-exact hash match

Review finding — plain-language summary: https://gist.github.com/ruvnet/20cc9a198eef99be5685151433642039

Technical detail: the certificate-spine crates are well-built and well-tested in isolation,
but were not wired together at merge time — ruview-policy does not depend on ruview-certify,
which does not depend on ruview-ood; each defines its own separate DomainState enum (5 copies).
The PR's "load-bearing" drift-invalidation acceptance test is two disconnected unit tests, not an
integration test. The ADR-298 (was 295) model-release gate and ADR-295 (was 292) export-watermarking
are similarly built-but-uncalled. By contrast, the ADR-296 (was 293) UDP allowlist and ADR-299
(was 296) CSI data-policy CI guard are genuinely enforced today. This is disclosed in
docs/user-guide.md's new "Perception Certificate Spine (Developer Preview)" section, merged as
part of this PR.

Known, pre-existing, disclosed CI state

The CSI data-policy check (ADR-299) fails on main today — 6 pre-existing CSI recordings
(~64 MB, from before this PR) are still tracked in git. This is documented in the PR body as
gated on a data-owner sign-off decision, not a regression introduced here; the guard's own
workflow comments say this failure is expected until that cleanup happens.

Not done: no ESP32 hardware testing (this PR touches zero firmware/Python).