Full vision software: Sonic Twin, provenance, Atlas, calibration, and digital qualification

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Default ownership until subsystem maintainers are added.
+* @fraware
+
+# Empirical protocols and release authority require explicit owner review.
+/docs/GATE_*.md @fraware
+/docs/EMPIRICAL_CAMPAIGN.md @fraware
+/packages/validation/ @fraware
+/packages/dsp/ @fraware
+/apps/web/src/ReleaseApp.tsx @fraware
+/apps/web/src/CampaignAuthorApp.tsx @fraware
+/apps/web/src/CampaignCollectionApp.tsx @fraware

.github/workflows/ci.yml

@@ -3,19 +3,24 @@ name: ci
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [main, post-freeze-development]
 
 permissions:
   contents: read
 
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     env:
-      VITE_SOFTWARE_REVISION: ${{ github.sha }}
+      VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version: 22
       - name: Enable Corepack

.github/workflows/digital-twin-qualification.yml

@@ -0,0 +1,77 @@
+name: digital-twin-qualification
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/digital-twin-qualification.yml"
+      - "packages/acquisition/**"
+      - "packages/dsp/**"
+      - "packages/fingerprint/**"
+      - "packages/instrument/**"
+      - "packages/synth/**"
+      - "packages/validation/**"
+      - "apps/web/**"
+      - "scripts/**"
+      - "docs/DIGITAL_TWIN_QUALIFICATION.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: digital-twin-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qualify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: 22
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Install frozen dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm typecheck
+      - name: Test including digital twins
+        run: pnpm test
+      - name: Build
+        run: pnpm build
+      - name: Browser qualification
+        run: bash scripts/browser-smoke.sh
+      - name: Emit qualification report
+        run: |
+          cat > /tmp/everything-rings-digital-twin-qualification.json <<EOF
+          {
+            "schemaVersion": 1,
+            "qualificationContractVersion": "digital-twin-qualification-2",
+            "softwareRevision": "${VITE_SOFTWARE_REVISION}",
+            "workflowRunId": "github-run:${{ github.run_id }}",
+            "releaseGateEquivalent": false,
+            "physicalMicrophonePathTested": false,
+            "physicalObjectTested": false,
+            "layers": [
+              "frozen-dependency-install",
+              "typecheck",
+              "unit-tests",
+              "digital-twin-acoustic-stress",
+              "canonical-review-governance",
+              "build",
+              "browser-e2e"
+            ],
+            "claim": "software qualification under deterministic synthetic acoustic inputs only"
+          }
+          EOF
+          cat /tmp/everything-rings-digital-twin-qualification.json
+      - name: Upload qualification report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: digital-twin-qualification-${{ env.VITE_SOFTWARE_REVISION }}
+          path: /tmp/everything-rings-digital-twin-qualification.json
+          if-no-files-found: error

.github/workflows/full-vision-software-qualification.yml

@@ -0,0 +1,98 @@
+name: full-vision-software-qualification
+
+on:
+  pull_request:
+    branches:
+      - post-freeze-development
+  push:
+    branches:
+      - post-freeze-development
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: full-vision-software-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  VITE_SOFTWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
+
+jobs:
+  qualify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
+        with:
+          node-version: 22
+      - name: Enable Corepack
+        run: corepack enable
+      - name: Install frozen dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck all workspaces
+        run: pnpm typecheck
+      - name: Run all software and digital-twin tests
+        run: pnpm test
+      - name: Build all workspaces
+        run: pnpm build
+      - name: Browser and lifecycle qualification
+        run: bash scripts/browser-smoke.sh
+      - name: Emit machine-readable qualification report
+        run: |
+          mkdir -p qualification
+          cat > qualification/full-vision-software.json <<EOF
+          {
+            "qualificationContractVersion": "full-vision-software-qualification-2",
+            "sourceRevision": "${VITE_SOFTWARE_REVISION}",
+            "workflowRunId": "github-run:${{ github.run_id }}",
+            "qualifiedAt": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "softwareOnly": true,
+            "physicalObjectTested": false,
+            "humanPerceptualValidationPerformed": false,
+            "realPlaybackTransducerValidated": false,
+            "releaseGateEquivalent": false,
+            "checks": {
+              "frozenDependencyInstall": "pass",
+              "typecheck": "pass",
+              "unitAndDigitalTwinTests": "pass",
+              "build": "pass",
+              "browserAndLifecycleQualification": "pass"
+            },
+            "capabilityFamilies": [
+              "acquisition-software-path",
+              "er-dsp-2",
+              "research-high-resolution-estimator",
+              "modal-reconstruction",
+              "playable-instrument",
+              "measurement-provenance",
+              "artifact-integrity",
+              "nuisance-characterization",
+              "acoustic-object-model",
+              "spatial-modal-field",
+              "verification-baseline",
+              "specimen-retrieval",
+              "held-out-data-bound-calibration",
+              "risk-coverage",
+              "algorithm-promotion-governance",
+              "research-material-inference",
+              "station-calibration-contract",
+              "atlas-registry",
+              "atlas-search",
+              "atlas-snapshots",
+              "atlas-collections-and-graph",
+              "atlas-service-conformance",
+              "machine-readable-assurance",
+              "browser-twin-lab",
+              "browser-atlas-lab"
+            ]
+          }
+          EOF
+      - name: Upload qualification report
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: full-vision-software-qualification-${{ env.VITE_SOFTWARE_REVISION }}
+          path: qualification/full-vision-software.json
+          if-no-files-found: error

CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing
+
+EVERYTHING RINGS combines a consumer acoustic instrument with empirical measurement and validation infrastructure. Contributions are welcome, but changes must preserve the distinction between product behavior, research diagnostics, and evidence-eligible empirical contracts.
+
+## Development setup
+
+Use the repository-declared pnpm version and frozen lockfile:
+
+```sh
+corepack enable
+pnpm install --frozen-lockfile
+pnpm typecheck
+pnpm test
+pnpm build
+bash scripts/browser-smoke.sh
+```
+
+## Change classes
+
+### Product-only changes
+
+Consumer UI, local history, sharing, visualization, and other non-empirical features belong on the product development line. They must not be merged into a frozen empirical authority revision solely for convenience.
+
+### Research/diagnostic changes
+
+Alternative DSP configurations, digital twins, external datasets, similarity baselines, and future embeddings must clearly state whether their output is evidence-eligible. Custom analysis configurations must not claim an `er-dsp-*` canonical algorithm version unless a new algorithm contract is explicitly versioned.
+
+### Empirical-contract changes
+
+Changes to acquisition semantics, DSP parameters, evidence schemas, campaign design, gate thresholds, review-plan selection, or Release Console authority require explicit versioning and requalification before new physical evidence is accepted. Do not relax a frozen threshold or omit a failed observation to make an observed dataset pass.
+
+## Pull requests
+
+A pull request should state:
+
+- the intended change class;
+- which claim or product behavior changes, if any;
+- whether evidence semantics change;
+- tests added or updated;
+- whether a prior empirical revision must be superseded or requalified.
+
+Keep machine contracts, documentation, and advertised claims synchronized. A nearby or weaker theorem/test must not be presented as evidence for a stronger proposition.
+
+## Privacy
+
+Do not commit microphone PCM, private Gate B listening companions, device identifiers that should remain local, secrets, or user-private artifacts. Synthetic/digital-twin signals are acceptable when clearly labeled non-physical.
+
+## Licensing
+
+The repository currently has an open issue to choose an explicit project license. Until that decision is made, public repository visibility should not be interpreted as a grant of reuse rights beyond GitHub's platform terms. Contribution licensing language will be finalized with the repository license decision.

SECURITY.md

@@ -0,0 +1,25 @@
+# Security and privacy reporting
+
+EVERYTHING RINGS handles microphone access locally in the browser and intentionally separates microphone PCM from shareable evidence artifacts. Security reports that could affect microphone privacy, evidence integrity, provenance binding, artifact parsing, or release-gate correctness are treated as high priority.
+
+## Report scope
+
+Please report privately before public disclosure when an issue could:
+
+- cause microphone capture to continue after stop, cancellation, page departure, or ownership transfer;
+- upload, persist, or disclose raw microphone samples outside an explicitly local/private path;
+- bypass evidence schema validation or revision/algorithm binding;
+- forge, substitute, or mismatch Gate B listening companions or provenance digests;
+- cause the Release Console to accept an incomplete or non-canonical empirical matrix;
+- execute untrusted content through imported evidence, campaign, review-plan, Capsule, or future Atlas artifacts;
+- compromise content-addressed measurement or derivation integrity.
+
+## Reporting
+
+Use GitHub's private vulnerability reporting facility for this repository when enabled. If that facility is not enabled, contact the repository owner through a private channel rather than publishing exploit details in a public issue.
+
+Include the affected revision, browser/runtime, reproduction steps, expected and actual behavior, and whether microphone data or release evidence may have been exposed or misclassified.
+
+## Claim discipline
+
+A software security fix does not retroactively validate physical evidence. Changes to an empirical authority revision require the project's normal revision-binding and requalification process before new physical evidence is accepted.

apps/web/src/App.tsx

@@ -1,9 +1,11 @@
+import { AtlasApp } from "./AtlasApp";
 import { CampaignAuthorApp } from "./CampaignAuthorApp";
 import { CampaignCollectionApp } from "./CampaignCollectionApp";
 import { ConsumerApp } from "./ConsumerApp";
 import { LabApp } from "./LabApp";
 import { PostCollectionReviewApp } from "./PostCollectionReviewApp";
 import { ReleaseApp } from "./ReleaseApp";
+import { TwinLabApp } from "./TwinLabApp";
 import "./postCollectionReview.css";
 
 export function App() {
@@ -13,6 +15,8 @@ export function App() {
   if (params.get("gate-c") === "1") return <PostCollectionReviewApp mode="gate-c" />;
   if (params.get("campaign-author") === "1") return <CampaignAuthorApp />;
   if (params.get("campaign") === "1") return <CampaignCollectionApp />;
+  if (params.get("twin") === "1") return <TwinLabApp />;
+  if (params.get("atlas") === "1") return <AtlasApp />;
   if (params.get("lab") === "1") return <LabApp />;
   return <ConsumerApp />;
 }