Certified-Empty Re-Teach
Before the room re-learns its normal picture, the radar swears the room was truly empty the whole time.
Contested Space · Contested capability
Latent emits a reading. It does not switch cameras, unlock cages, cut power or open a ticket. Your VMS, PoE switch or access controller does that, on your side of the boundary. A Latent blueprint contains no executable code, no remote URLs and no device secrets — by schema, not by policy.
No face, no plate, no MAC, no device identity, no payload. A movement signature is a shape moving through a room, not a person. Nothing stored here resolves to an individual.
An adversary can deny re-teach (not poison it) by keeping energy in the cone — a logged DoS. Out-of-cone presence still contaminates; the certificate’s honesty is its scope line, and a certificate without a coverage map is void.
Across Camera Shield Jam the mesh and the wake never fires. Two people moving together read as one disturbance. Re-rack a row and the fade map is wrong until you recalibrate.
Each node mints its own key over USB, in your hand. Physical possession is the root authority: a device that cannot prove physical presence is refused enrollment outright. A cloud pairing PIN is a weaker ownership claim and is never treated as liveness.
Every reading is attributable to a device id, profile id, hardware id and firmware version recorded at install and verified by mutual HMAC-SHA256 proof over an LFW1 nonce exchange. A node whose proof did not verify is marked untrusted, not merely offline.
Completing an installation is a high-risk action. It requires your explicit browser approval, an approval snapshot that still matches, an idempotency key, and heartbeats less than three minutes old. There is no silent commissioning.
How enrollment worksProperties you can map to your own controls
These are properties, not certifications. Latent does not assert compliance with any framework on your behalf.
Mapped to a shared offline runtime family and usable with a recording or compatible ESP32 CSI stream.
Published physics or adjacent results support the hypothesis; capability-specific product and site validation are still required.
Calibrated motion and presence score from CSI variance and change statistics.
No compatible ESP32 stream is connected. Use the bundled Camera Shield recording; it demonstrates the shared Presence runtime, not independent proof of this capability.
Intended capability
This describes the intended outcome. Readiness is shared-family mapped, evidence is class B, and a catalog mapping or recording is not proof of this outcome at a real site.
Solution blueprint
This exact kit is one of 191 first-class designs. It includes geometry, objects, nodes, wording, scenarios, installation, limitations, and catalog-bound readiness.
No rendered revision is available yet.
Bundled recording
This is one recorded vertical scenario. It is not separate validation of every capability in the catalog.
The presence class that contaminates CSI quiet windows undetected is a motionless human; LD2410C static micro-motion detection holds exactly that to 4-6 m in-cone. The certificate is scoped to radar-covered cones and never extends past them; uncovered zones re-teach uncertified and say so. Sibling of frontier's certified-quiescence gate, specialized to adversarial re-teach provenance.
Re-teach request -> LD2410 noise-floor attest across the teach window -> any energy aborts and logs the attempt -> clean window -> baseline accepted + empty-certificate in the provenance chain consumed by cage-calibration-drift-audit
This is a capability design path. Components may be shared with other catalog entries; it is not presented as a unique algorithm.
Adversarial trials: still confederate in-cone and out-of-cone during re-teach windows; in-cone poisoning must always abort, out-of-cone contamination must be labeled uncertified; DoS audit of oscillating-object abort spam.
'Provenance for the baseline itself' — for estate owners whose drift audits are only as good as the emptiness of the room they calibrated in.
A quiet reading is not an all-clear. If nodes are stale, degraded or jammed, this runtime says so explicitly. It never infers safety from missing data.