Escort Compliance Witness: The Visitor Was Never Alone
Shows that a visitor stayed with their escort the whole visit — and flags the minutes they did not.
Contested Space · Contested capability
Latent emits a reading. It does not switch cameras, unlock cages, cut power or open a ticket. Your VMS, PoE switch or access controller does that, on your side of the boundary. A Latent blueprint contains no executable code, no remote URLs and no device secrets — by schema, not by policy.
No face, no plate, no MAC, no device identity, no payload. A movement signature is a shape moving through a room, not a person. Nothing stored here resolves to an individual.
Jam the mesh and the wake never fires. Two people moving together read as one disturbance. Re-rack a row and the fade map is wrong until you recalibrate.
Each node mints its own key over USB, in your hand. Physical possession is the root authority: a device that cannot prove physical presence is refused enrollment outright. A cloud pairing PIN is a weaker ownership claim and is never treated as liveness.
Every reading is attributable to a device id, profile id, hardware id and firmware version recorded at install and verified by mutual HMAC-SHA256 proof over an LFW1 nonce exchange. A node whose proof did not verify is marked untrusted, not merely offline.
Completing an installation is a high-risk action. It requires your explicit browser approval, an approval snapshot that still matches, an idempotency key, and heartbeats less than three minutes old. There is no silent commissioning.
How enrollment worksProperties you can map to your own controls
These are properties, not certifications. Latent does not assert compliance with any framework on your behalf.
Mapped to a shared offline runtime family and usable with a recording or compatible ESP32 CSI stream.
Published physics or adjacent results support the hypothesis; capability-specific product and site validation are still required.
Coarse occupancy estimate from calibrated multi-link field activity.
No compatible ESP32 stream is connected. Use the bundled Camera Shield recording; it demonstrates the shared Occupancy estimate runtime, not independent proof of this capability.
Intended capability
This describes the intended outcome. Readiness is shared-family mapped, evidence is class B, and a catalog mapping or recording is not proof of this outcome at a real site.
Solution blueprint
This exact kit is one of 191 first-class designs. It includes geometry, objects, nodes, wording, scenarios, installation, limitations, and catalog-bound readiness.
No rendered revision is available yet.
Bundled recording
This is one recorded vertical scenario. It is not separate validation of every capability in the catalog.
Each additional body adds independent Doppler energy and raises the rank of the dynamic CSI subspace, so two people in a zone present two separable perturbation modes where one person presents one. Rank is a robust observable — one body cannot fake two modes — but it collapses when bodies are close enough to share a Fresnel volume, which sets the honest lower bound on separation distance.
Doppler band energy + eigen-mode rank counting per zone -> occupancy count regression with a rank-2 attestation gate -> zone dwell segmentation for the pair -> compartment Kalman across adjacent zones -> per-visit attestation with an exceptions list (count dropped to one, pair split, visit window exceeded).
This is a capability design path. Components may be shared with other catalog entries; it is not presented as a unique algorithm.
Occupancy counting is already class A on our data; the new claim is pair continuity across zones. Own-hardware: 100 scripted escorted visits across a five-zone floor with deliberate separations at surveyed distances of 0.5-4 m, report separation-detection recall against distance and the false-separation rate over 40 compliant visits; WiMANS for multi-person count priors.
'Escort Witness' — the per-visit attestation an auditor asks for after a contractor visit, sold to the compliance officer with the resolution limit written into the report: two people close together may read as one, so a separation flag opens a review rather than closing a case.
A quiet reading is not an all-clear. If nodes are stale, degraded or jammed, this runtime says so explicitly. It never infers safety from missing data.