ruview @ v0.12.0

Five small commits since v0.11.0 — the HOMECORE web UI is no longer an empty shell, and the project's Trust Kill Switch now verifies every layer of the stack with a single command.

What changed

HOMECORE web UI is functional (was: empty shell)

The Lit + Vite frontend shipped in v0.10.0 had registered components but no pages mounted, so operators saw the appbar + nav but nothing in <main>. Browser-driven testing this session caught it; this release fixes it end-to-end.

• frontend/src/pages/Dashboard.ts — new <hc-dashboard> Lit component. Reads bearer from localStorage["homecore.token"] (or ?token=, or <meta>, with dev-token fallback). Fetches /api/config + /api/states, renders a .meta line + responsive grid of <hc-state-card>. Polls every 5 s. Surfaces structured backend-unreachable errors instead of a blank page.
• frontend/src/pages/States.ts — full HA-style table view of every entity (entity_id / state / last_changed / attributes). 5 s auto-refresh.
• frontend/src/pages/Services.ts — domain-grouped service registry from /api/services. Friendly empty state when no services are registered (matches a vanilla plugin-less boot).
• frontend/src/pages/Settings.ts — backend config readout (location / version / state / components) + bearer-token editor that writes to localStorage["homecore.token"].
• frontend/src/main.ts — tiny router: AppShell's hc-navigate events swap the page element. Default first paint = Dashboard.
• scripts/homecore-seed.sh — populates 10 representative entities (RuView sensing-derived + conventional HA fixtures) so a fresh homecore-server boot has demo content. Idempotent. Pulls live numbers from the RuView sensing-server when RUVIEW_URL is reachable.

Browser-verified all 4 nav clicks swap the rendered page correctly. Zero console errors.

Trust Kill Switch covers v1 + v2 + HOMECORE

The original verify script only validated the v1 Python signal-processing proof. After v0.9.0 (ADR-125) and v0.10.0/v0.11.0 (HOMECORE), the stack has six more proof boundaries. verify now runs 9 phases in one command:

PASS Phase 1: v1 pipeline hash matches expected
PASS Phase 2: no random generators in production code
PASS Phase 3: 2,263 Rust workspace tests pass (real number, no agent claim)
PASS Phase 4: wifi-densepose-py PyO3 binding compiles
PASS Phase 5: ADR-125 §2.1.d invariant — identity_risk_score is None
PASS Phase 6: 12/12 crates on crates.io
PASS Phase 7: @ruvnet/rvagent v0.1.0 on npm
PASS Phase 8: multi-arch (amd64 + arm64) Docker manifest live
SKIP Phase 9: docker pull (skip when CLI absent)

Each phase reports PASS / FAIL / SKIP independently. SKIP is honest — no false green when an optional tool (cargo / docker / curl) is absent. Flags: --quick, --rust-only, --docker-only, plus the pre-existing --verbose, --audit, --generate-hash pass-through.

Pydantic + Windows + numpy-drift fixes

• archive/v1/src/config/settings.py — extra="ignore" so the v1 proof tolerates unrelated .env keys (NPM_TOKEN, DOCKER_HUB_TOKEN, etc.) used by other tooling. Closes a real secret-leak path where pydantic's error message echoed the offending token value.
• archive/v1/data/proof/expected_features.sha256 — regenerated per the documented verify.py --generate-hash procedure to match the current numpy/scipy combo.
• verify Phase 3 — fixed three subtle bugs (pipefail killing the script, 0\n0 arithmetic poisoning, Windows file-lock on cog-pose-estimation's smoke test) so the 2,263-test pass count actually surfaces.

Reproduce

./verify         # full 9-phase proof
./verify --quick # skip slow phases (Rust workspace tests + Docker pull)

Local witness log saved at dist/verify-witness-9a09d186c.log (5.8 KB).

References

• Previous releases: v0.11.0, v0.10.0, v0.9.0
• ADR-125 / ADR-127 / ADR-130 / ADR-132 — the foundations this release builds on

Co-Authored-By: claude-flow ruv@ruv.net