RF-Gated Camera Wake: Cameras Dark Until the Room Says Otherwise
Cameras stay off until the room notices someone, so there is no video stream to attack most of the day.
Feasibility path · not a production offer
This offer is scoped to this capability only. It does not promote sibling catalog entries or replace physical deployment validation.
Contested Space · Contested capability
Latent emits a reading. It does not switch cameras, unlock cages, cut power or open a ticket. Your VMS, PoE switch or access controller does that, on your side of the boundary. A Latent blueprint contains no executable code, no remote URLs and no device secrets — by schema, not by policy.
No face, no plate, no MAC, no device identity, no payload. A movement signature is a shape moving through a room, not a person. Nothing stored here resolves to an individual.
Jam the mesh and the wake never fires. Cameras must be configured to wake on mesh silence, degraded link health or a missed heartbeat — not only on a detection event. And a camera cold boot costs 2–10 seconds; those seconds are never on glass.
Across Camera Shield Jam the mesh and the wake never fires. Two people moving together read as one disturbance. Re-rack a row and the fade map is wrong until you recalibrate.
Each node mints its own key over USB, in your hand. Physical possession is the root authority: a device that cannot prove physical presence is refused enrollment outright. A cloud pairing PIN is a weaker ownership claim and is never treated as liveness.
Every reading is attributable to a device id, profile id, hardware id and firmware version recorded at install and verified by mutual HMAC-SHA256 proof over an LFW1 nonce exchange. A node whose proof did not verify is marked untrusted, not merely offline.
Completing an installation is a high-risk action. It requires your explicit browser approval, an approval snapshot that still matches, an idempotency key, and heartbeats less than three minutes old. There is no silent commissioning.
How enrollment worksProperties you can map to your own controls
These are properties, not certifications. Latent does not assert compliance with any framework on your behalf.
Mapped to a shared offline runtime family and usable with a recording or compatible ESP32 CSI stream.
Published physics or adjacent results support the hypothesis; capability-specific product and site validation are still required.
Calibrated motion and presence score from CSI variance and change statistics.
No compatible ESP32 stream is connected. Use the bundled Camera Shield recording; it demonstrates the shared Presence runtime, not independent proof of this capability.
Intended capability
This describes the intended outcome. Readiness is shared-family mapped, evidence is class B, and a catalog mapping or recording is not proof of this outcome at a real site.
Solution blueprint
This exact kit is one of 191 first-class designs. It includes geometry, objects, nodes, wording, scenarios, installation, limitations, and catalog-bound readiness.
No rendered revision is available yet.
Bundled recording
This is one recorded vertical scenario. It is not separate validation of every capability in the catalog.
Two independent physical channels affirm the same quiet. A human-scale body moving through a calibrated zone perturbs CSI amplitude across the links that cross it, detectable at the mesh's ~6.6 Hz ambient rate; the same body inside the radar's aimed cone returns 24 GHz energy — down to the micro-motion of someone standing still — over a short serial cable that owes nothing to the 2.4 GHz band. An attacker must now defeat both: jamming the mesh blinds the zone gate but not the radar, while a 24 GHz jammer or an out-of-cone approach blinds the radar but not the mesh. The security property is narrow and real: a camera that is not powered has no IP stream to intercept, deauth or enumerate. The mesh and the radar still radiate, so the site is not RF-silent; only the camera's stream is absent.
Per-zone CSI amplitude variance + Doppler band energy -> adaptive PCA baseline against the zone's own quiet window -> CSI presence verdict with hysteresis, joined over a short serial cable by the radar's moving/static target report -> sleep permitted only while both verdicts affirm quiet -> wake event emitted on presence from either sensor OR on mesh-health loss (silence, rate deficit, missed heartbeat), the mesh-loss wake carrying the radar's occupied/empty verdict -> external relay integration consumes the event outside the blueprint.
This is a capability design path. Components may be shared with other catalog entries; it is not presented as a unique algorithm.
Presence detection is already class A in open rooms; what needs our own trial is the gate's failure behaviour, not its detection. Own-hardware: four nodes covering an approach corridor and a camera on a switched relay, 200 scripted approaches at three walking speeds plus 20 deliberate sub-threshold slow approaches; report wake latency including camera boot, missed-wake rate on slow movers, and verified wake-on-silence under a scripted mesh blackout.
'Dark Camera' — cuts the hours a camera spends powered and reachable, sold to the physical-security chief at Plus tier with the radar in the contract: quiet is affirmed on two independent bands, so jamming the mesh no longer buys a dark room — it wakes the cameras with a room verdict attached. The old condition still stands in writing: cameras wake on mesh silence as well as on detection, always. The radar narrows the attacker's options; it does not retire the rule.
A quiet reading is not an all-clear. If nodes are stale, degraded or jammed, this runtime says so explicitly. It never infers safety from missing data.