[!IMPORTANT] This repository currently contains the normative architecture, deep Franken-suite audits, registries, schemas, and a dependency-free Rust contract skeleton. It does not yet acquire camera feeds, decode video, run models, reconstruct a property, upload archives, or deliver alerts. The boundary is explicit in IMPLEMENTATION_STATUS.md.

#The thesis

Consumer security hardware is cheap and increasingly capable, but each product is an island. A battery camera may expose only a proprietary app. A USB gimbal camera may be standards-compliant but physically tethered. A drone may provide a superb moving view while lacking a supported control SDK. Conventional NVRs can record streams, but they do not usually create a calibrated, provenance-carrying world model that an autonomous agent can query and operate safely.

FSS is intended to turn heterogeneous owner-authorized sensors into one coherent system:

cameras / microphones / manually piloted drone captures
                         │
       first-party UVC · RTSP/RTP · ONVIF · focused adapters
                         │
 packet truth + source bytes + time intervals + health receipts
                         │
              EvidenceDeltaBatch universe
                         │
       ┌─────────────────┼──────────────────┐
       │                 │                  │
 source custody      live operator      cognition
 ATP object graphs   Rust proxy/UI      Rust models + graphs
       │                 │                  │
       └─────────────────┴─────────┬────────┘
                                  │
             calibrated tracks + 3D twin + coverage
                                  │
 quality → detect → track → associate → temporal verify
                                  │
        event transaction with evidence and uncertainty
                                  │
   versioned policy → abstain / request view / alert plan
                                  │
       idempotent effect + observed/verified receipt

The radical part is not “run a VLM on camera footage.” It is the substrate beneath every model:

• Four operational planes. Packet, authority, cognition, and effect states are type-distinct. A decoded frame is not source continuity; a model score is not physical fact; a provider ACK is not a verified alert.
• One version universe. Canonical history is an ordered immutable EvidenceDeltaBatch stream. Graphs, search, subscriptions, replicas, model caches, checkpoints, and branches publish exact high-water marks instead of each inventing “current.”
• Agent cognitive operating system. The agent receives an anchor-pinned SituationCapsule, not a pile of subsystem replies. Its inner SituationFrame states what matters now; meaningful deltas, epistemic state, provenance, contradictions, obligations, resource pressure, and a nondominated affordance frontier make the next safe move legible without hidden conversational state.
• Semantic MVCC. Event and effect decisions carry positive and negative witnesses, model/ calibration/policy epochs, and revalidate before consequential publication.
• Pure-Rust production. FSS owns packet protocols, codecs, containers, model execution, graph algorithms, archive protocols, and orchestration in first-party safe Rust. FFmpeg, PyTorch/ONNX, NetworkX, C SQLite, Tantivy, browsers, and vendor applications are pinned laboratory oracles only.
• ATP object graphs. Source media, checkpoints, model packages, derived generations, exports, and releases move by verified manifest/chunk/repair graphs with resume, post-repair digest proof, and root-last publication.
• Certified graph intelligence. Cross-camera association, temporal reachability, blind-spot cuts, active perception, deletion closure, and runtime deadlock analysis use registered snapshot- pinned algorithms with canonical tie-breaks and complexity/output witnesses.
• Digital-twin calibration. A manually piloted drone or handheld camera can serve as a calibration shuttle, linking fixed camera views to a metric reconstruction and uncertainty-aware coverage model.
• Event-level epistemology. Quality is measured under realistic class imbalance with event AUPRC, recall at a false-alert budget, calibration, time-to-detect, abstention, observability, and miss bounds—not frame accuracy or a cherry-picked demo.
• Proof-carrying operations. Publication is child-first/root-last; effects use prepare → revalidate → commit → observe → verify; repair is doctor → sealed plan → apply; claims derive from retained proof roots.
• Local release authority. Doodlestein Self-Releaser executes clean-snapshot qualification on controlled local machines. GitHub workflows are portable specifications, not a required trust root.

#What “Franken” means

The first draft named the sibling projects. The second pass audits them mechanism by mechanism: what invariant each idea establishes, which FSS crate owns it, what weaker substitute is forbidden, what reference model defines it, how failure degrades, and what evidence admits it.

Start with FRANKENSTACK_DEEP_DIVE.md and the deep-dive index. The machine import ledger is architecture/franken_imports.json.

#Pure-Rust and dependency constitution

The production closure is deliberately narrow:

std/core/alloc
+ FSS workspace crates
+ Asupersync
+ exact admitted Franken-suite revisions
+ a tiny DEP-recorded foundational exception set

Every FSS crate forbids unsafe. Asupersync is the sole runtime. No Tokio, async-std, smol, Rayon- owned pool, Python/PyO3, FFmpeg/libav, OpenCV, ONNX Runtime, libtorch, CUDA runtime binding, proprietary SDK, browser engine, Node/Electron/Tauri, generic graph/search/database engine, dynamic plugin, runtime model download, or networked build script enters production.

The current default external exception candidates are only serde and serde_json, and only for bounded control/report data-shape roles. Serde never defines canonical durable bytes.

This is stricter than “a safe Rust core with unsafe helpers out of process.” A required foreign service is still a foreign production runtime. Missing first-party capability remains unsupported or fails closed; it does not silently activate a fallback.

See DEPENDENCY_CONSTITUTION.md and architecture/dependency_allowlist.toml.

#Device posture

FSS starts from replay and standards before proprietary adapters:

Insta360 Link is a useful UVC/UAC reference sensor. Wyze Cam v4 and AOSU P1 Max begin as interoperability-lab candidates unless a qualified standards/API surface is established. DJI Flip begins as manually piloted capture/import; FSS has no autonomous flight authority.

See DEVICE_ADAPTER_MATRIX.md and INTEROPERABILITY_LAB.md.

#Architecture in one page

#Agent operating membrane

The packet, authority, cognition, and effect planes remain semantically distinct. Above them, FSS provides one agent operating membrane that composes their outputs without becoming another source of truth. It owns mission/workspace continuity, situation composition, investigations, context selection, affordances, contingent plans, explanations, handoffs, and advisory learning.

Mission + ObjectiveContract
          ↓
AgentSession / explicit AgentWorkspace revision
          ↓
SituationCapsule
  ├─ SituationFrame: minimum sufficient mission-relative world model
  │    └─ WorldEnvelope: certified core + material/adversarial possibilities
  ├─ MeaningfulDelta: what changed and what that invalidated
  ├─ ContextPack + SemanticCompressionReceipt
  ├─ active cases/plans/obligations/resource pressure
  ├─ categorized control envelope: robust/conditional/probe/wait/blocked
  └─ nondominated ActionAffordance frontier
          ↓
InvestigationCase / HypothesisWorkspace / counterfactual branches
          ↓
ControlPlan → prepare → commit → wait/cancel → verify/reconcile
          ↓
ExecutionEpisode → ExperienceCapsule → reviewed learning proposal
          ↓
root-last HandoffCapsule / resumable AgentSessionCapsule

Every layer retains handles to the evidence and semantic owner below it. No mission-critical fact, assumption, obligation, lease, indeterminate effect, or next step may live only in chat history.

The parts meet through one internal CognitiveFacet narrow waist. Each subsystem contributes the same anchored coordinates—typed knowledge, coverage/health, contradictions/unknowns, evidence handles, obligations, complete cost, affordance seeds, invalidators, and recovery—so adding a new camera, model, graph algorithm, or archive backend does not add a new agent dialect.

Every public operation uses one AgentRequestEnvelope / AgentResponseEnvelope pair. Their ContractBasis pins fss/1 and the exact schema, ontology, operation, view, capability, error, cost, release, and nightly identities, so an agent never has to guess whether a familiar field still means the same thing.

The driver model uses an evidence–possibility–control envelope. WorldEnvelope records what the current anchor certifies, which materially different or adversarial worlds remain possible, and which unknown dimensions control the decision. The outer capsule categorizes next actions as robust across those worlds, conditional on named worlds, information-gathering, wait/watch, blocked, or unavailable. A rare high-loss possibility cannot disappear merely because a ranking model assigns it a low score.

See AGENT_COGNITION_AND_CONTROL.md, AGENT_COGNITIVE_CONTROL_PLANE.md, and AGENT_OPERATING_MODEL.md.

#Four planes

1. Packet: exact transport/source bytes, protocol sequence, compressed access units, time and continuity evidence.
2. Authority: identities, generations, source custody, policy, calibration/coverage, event revisions, effects, obligations, and receipts.
3. Cognition: decoded media, tensors, detections, tracks, associations, graph/search projections, digital twin, operational memory, and explanations.
4. Effect: alerts, PTZ/settings, retention/deletion/export, activation, and repair mutation.

#One ordered version universe

An immutable EvidenceDeltaBatch is the common source for history, graph/search maintenance, subscriptions, checkpoints, replicas, and branches. Every response reports:

authority anchor
search high-water
graph high-water
model-result high-water
calibration and coverage generations
staleness or gap

A caller can demand alignment, accept bounded lag, or receive an explicit stale/degraded result.

See docs/ONE_VERSION_UNIVERSE.md.

#Target crate families

Foundation:      fss-types · fss-error · fss-schema · fss-numeric · fss-identity
Runtime/fabric:  fss-runtime · fss-capability · fss-subject · fss-obligation · fss-lab · fss-decision
Device:          fss-device-core · fss-device-uvc · fss-device-rtsp · fss-device-onvif
                 fss-device-vendor · fss-drone-capture
Media:           fss-packet · fss-container · fss-codec-* · fss-audio · fss-live
Authority:       fss-ledger · fss-witness · fss-object · fss-publication · fss-checkpoint · fss-privacy
Transfer:        fss-transfer · fss-archive · fss-provider-s3 · fss-repair · fss-retrievability
Geometry:        fss-time · fss-calibration · fss-geometry · fss-twin · fss-coverage
Models:          fss-tensor · fss-operator · fss-kernel-cpu · fss-model-ir/import/runtime/registry
Cognition:       fss-quality · fss-detect · fss-track · fss-associate · fss-temporal · fss-fusion
                 fss-event · fss-policy
Knowledge:       fss-search · fss-graph/query/algorithms · fss-forge · fss-memory · fss-explain
Agent cognition: fss-agent-core · fss-knowledge · fss-situation · fss-attention · fss-investigation
                 fss-context-pack · fss-affordance · fss-query-plan · fss-agent-session
                 fss-agent-plan · fss-episode · fss-learning · fss-handoff
Effects:         fss-plan · fss-effect · fss-alert · fss-export
Presentation:    fss-api · fss-cli · fss-mcp · fss-report · fss-ops · optional fss-ui
Qualification:   fss-reference · fss-fixtures · fss-gauntlet · fss-bench · fss-release

The checked-in workspace is intentionally smaller. Empty crate theater is not implementation.

#Pure-Rust media and streaming

FSS separates source evidence, live delivery, and analysis:

• source bytes and packet/timing maps are immutable custody objects;
• live derivatives prioritize bounded latency and can reduce quality under pressure;
• analysis decodes only the frames/regions/resolutions demanded by the cascade;
• remux is preferred to transcode;
• H.264/H.265/MJPEG and required audio profiles are admitted incrementally;
• scalar parser/decoder semantics remain the oracle for safe optimized/SIMD kernels;
• frame/tensor views pin immutable or generation-leased backing storage;
• pressure follows a registered degradation ladder and never silently drops canonical evidence or committed obligations.

FFmpeg/ffprobe and browsers compare behavior in the lab. They are absent from the production closure. See docs/STREAMING_AND_MEDIA_KERNEL.md.

#Pure-Rust model runtime

Open-weight models are imported offline into immutable FSS packages containing a frozen first-party operator IR, canonical tensor objects, preprocessing/postprocessing, numeric policy, licenses, quality/conformance receipts, and repair metadata.

The runtime is CPU-first and specialized for frozen inference graphs: packed weights, cache-shaped tiling, liveness-planned scratch arenas, safe SIMD, fused preprocess/layout/early operators, and static shape-specialized dispatch. Every optimized kernel has a scalar reference and exact or tolerance-certified contract. Optional accelerators are first-party and receipt-bearing; CPU fallback remains qualified.

Python, PyTorch/ONNX Runtime, and accelerator incumbents remain lab oracles. Production does not interpret arbitrary framework graphs or download models at runtime.

See PURE_RUST_MODEL_RUNTIME.md and docs/deep-dives/FRANKENTORCH.md.

#Detection is a cascade, not a monolith

A frontier VLM is too expensive, nondeterministic, and weakly calibrated to inspect every frame or authorize alerts alone. The target cascade is:

1. sensor health, blur, darkness, obstruction, glare, replay, and tamper checks;
2. cheap activity/change/audio gates with explicit coverage state;
3. fast detector and segmenter;
4. within-camera tracking and trajectory features;
5. geometry/time-gated cross-camera association with k-best alternatives;
6. open-vocabulary unusual-object/behavior retrieval;
7. bounded temporal multimodal reasoning;
8. an independent verifier with a different failure profile;
9. conformal/sequential calibration and semantic event transaction;
10. alert, abstain, request another view, or retain silently.

Every stage emits a generation-pinned result. Later models can contradict earlier results; they cannot erase source provenance or directly authorize an effect.

#Certified graph intelligence

Graphs are operational kernels, not dashboards. Initial registered families cover:

• dynamic connectivity and temporal reachability;
• articulation points, bridges, dominators, max-flow/min-cut, and Gomory-Hu failure summaries;
• shortest/k-shortest trajectories;
• bipartite matching, k-best assignment, and min-cost flow for association;
• SCC/condensation/topological critical path for obligations and plans;
• set cover, facility location, and submodular active perception/coverage;
• PPR attention, d-separation/shared-failure analysis, factorized joins;
• canonical deletion reachability and wait-cycle detection.

Every run pins an authorized immutable projection and emits a GraphAlgorithmWitness with canonical tie-break, output digest, complexity counters, and decision path. Incremental standing predicates are checked against full recomputation.

See GRAPH_ANALYTICS_AND_SENSOR_MESH.md, docs/GRAPH_INTELLIGENCE_ARCHITECTURE.md, and registries/GRAPH_ALGORITHMS.md.

#Digital twin and calibration shuttle

The target setup avoids asking a homeowner to perform a professional survey:

1. place optional printable/illuminated calibration markers;
2. start fixed-camera capture and a calibration session;
3. manually fly or carry a camera through fixed views and overlap zones;
4. reconstruct the property and moving-camera trajectory;
5. jointly solve intrinsics, extrinsics, time offset/skew, rolling-shutter terms, scale, and trajectory;
6. compute covariance, residuals, coverage, occlusion, blind spots, and expected transit intervals;
7. publish a generation certificate with validity regions and invalidators.

A moved camera, crop/zoom/firmware change, seasonal occlusion, or residual drift degrades or invalidates the certificate. NeRF/Gaussian-splat renderings are useful views, not metric authority.

See DIGITAL_TWIN_AND_CALIBRATION.md.

#ATP archive, repair, and deletion

Source media, evidence bundles, checkpoints, model packages, graph/search/calibration/twin snapshots, replay corpora, and releases move as immutable ATP object graphs. The receiver stages children, verifies manifests and canonical digests, repairs only against exact generations, verifies closure, and publishes the root last.

“Uploaded” is not “archived.” Completion can require independent replicas and proof-of- retrievability samples. Deletion enumerates repair symbols, replicas, indexes, embeddings, caches, journals, and staging objects before publishing a tombstone root.

ATP never carries mutation authority. See ATP_AND_DISTRIBUTED_EVIDENCE.md and docs/ATP_ARCHIVE_AND_REPLICATION.md.

#The quality objective

“Never miss a true intruder” is the right motivating aspiration and the wrong unqualified claim. FSS turns it into:

• event-level AUPRC over a declared threat distribution;
• recall lower bounds at a declared false-alerts-per-property-day budget;
• time-to-detect and time-to-deliver distributions;
• probability calibration and selective-risk curves;
• distinct slices for darkness, occlusion, crawling/crouching, dark clothing, weather, foliage, wildlife, residents, delivery/service workers, children, and tampering;
• explicit not_observable accounting for failed/occluded/uncalibrated coverage;
• property/session-separated held-out evaluation;
• retained misses, near misses, false alarms, contradictions, and broken assumptions;
• claims that name shared model/sensor/clock/network/training-data failure domains.

A missing or degraded sensor is not a negative observation. FSS must say “coverage uncertified” rather than lower the score silently.

#Agent and operator surface

The public semantic protocol is intentionally small. Domain detail is expressed through typed queries, targets, intents, views, and evidence handles rather than hundreds of privileged tools:

session.open      negotiate mission, authority, privacy, budgets, views, and initial workspace
session.resume    restore a handoff/workspace root and enumerate invalidated assumptions
session.orient    return the smallest sufficient current SituationCapsule
session.follow    stream meaningful decision-impact deltas and qualified silence
query             compile/execute a bounded semantic AgentQueryPlan
investigate       create or advance a durable competing-hypothesis case
plan              compile an immutable witnessed contingent ControlPlan
commit            request execution of the exact prepared plan under current domain authority
wait              monitor expected evidence and obligations under a bounded wake contract
cancel            request drain, compensation/reconciliation, and terminalization
explain           answer why, why-not, what-changed, and what-would-change by proof handles
handoff           publish a root-last minimum-sufficient continuation graph
feedback          append evidence-linked correction/outcome proposals without silent activation
doctor            diagnose system, epistemic, plan, obligation, and continuity failures

Every nonterminal response contains either a valid typed affordance or an explicit blocked, waiting, unauthorized, terminal, redacted, indeterminate, or not-observable reason. Recommendations show value, cost, latency, risk, reversibility, prerequisites, invalidators, alternatives, expected proof, and sensitivity. They never confer effect authority.

The standard views are pulse, brief, case, forensic, operation, handoff, decision_diff, and epistemic_map. A compact response is accompanied by a SemanticCompressionReceipt naming what was selected, omitted, transformed, protected from omission, and available for priced hydration. CLI, Rust API, MCP, TUI, reports, and future desktop or mobile surfaces render the same operation/view registries and may not redefine them.

There is no generic shell, SQL, vendor-method, codec, model-prompt, object-store, or drone-control escape hatch. Free-form language compiles into an inspectable AgentQueryPlan; it cannot cross an effect boundary.

#Local qualification and release

The release authority is local:

1. create a clean immutable source snapshot;
2. capture exact clean Asupersync/Franken-suite revisions;
3. resolve locked and offline after provisioning;
4. run repository policy, Rust, deterministic lab, crash, ATP, graph, media, model, device, agent-cognition, security/privacy, performance, soak, and package lanes as required by claims;
5. retain partial target artifacts across resume but never bless them;
6. build exact assets with checksums, minisign/Ed25519 signatures, SBOM, provenance, source/ dependency and qualification manifests;
7. upload, download, and verify;
8. publish the release manifest root last.

The repository pins the latest nightly that has passed a promotion gauntlet. Releases never build against an ambient moving nightly. GitHub workflow YAML calls repository scripts and can be executed locally by DSR/compatible tooling; GitHub-hosted runners are not required.

See LOCAL_QUALIFICATION_AND_RELEASE.md.

#Repository map

#Inspect the skeleton

python3 scripts/generate-manifest.py
bash scripts/qualify.sh --lane policy
bash scripts/qualify.sh --lane rust
cargo run -p fss-cli -- capabilities --json
cargo run -p fss-cli -- doctor --json

The current artifact environment may not have the pinned Rust nightly installed; the policy and artifact checks are independently executable with Python. A passing skeleton build does not qualify any camera, codec, model, graph algorithm, archive provider, or alert path.

#Non-goals

FSS is not:

• a way to access devices, accounts, or footage without the owner’s authorization;
• a credential-bypass, exploit-distribution, or covert-monitoring toolkit;
• a public face-recognition or cross-property identity network;
• a guarantee that no intrusion can ever be missed;
• an autonomous armed, confrontational, pursuit, or drone-flight system;
• a cloud-required product or generic smart-home platform;
• a Rust supervisor around required foreign production runtimes;
• a generic shell/SQL/vendor/model/codec interface for agents;
• a benchmark leaderboard without retained semantic and statistical evidence;
• a release process dependent on GitHub-hosted Actions.

#Current status

The project remains at GATE-000: architecture constitution.

Implemented now:

• the comprehensive plan and second-pass Franken-stack constitution;
• twelve project-specific deep dives plus an adjacent-project census;
• the three-document agent operating hierarchy, public fss/1 operation/view registries, linked abstraction tower, epistemic/provenance/possible-world vocabulary, and 27 agent semantic schemas;
• machine-readable hard invariants and mechanism-level import, dependency, algorithm, publication, decision, cost, claim, readiness, schema, and local qualification registries;
• a dependency-free safe-Rust semantic skeleton;
• policy/manifest validation and local qualification wrapper;
• ADRs for pure Rust, one version universe, ATP separation, graph witnesses, local DSR authority, oracle-only foreign runtimes, and the agent cognitive operating membrane.

Not implemented now:

• real camera/drone acquisition;
• RTSP/RTP/ONVIF/UVC protocol stacks;
• codecs, containers, live proxy, or UI;
• canonical persistence and ATP cloud transport;
• tensor kernels or model inference;
• calibration, reconstruction, coverage, graph/search engines;
• detection, tracking, association, event fusion, alerts, or the agent/CLI/MCP operating layer;
• full DSR release matrix.

That gap is the ordered work—not hidden capability—described by the plan.

#License

MIT License (with OpenAI/Anthropic Rider). Device firmware, vendor applications, model weights, codecs, datasets, and cloud services keep their own licenses and terms. FSS treats license, exact bytes, firmware/app/model generations, and allowed use as runtime correctness inputs rather than paperwork deferred until release.