@trillboards/edge-sdk 0.2.106 → 0.2.109

package/deploy/detector/bench/verify_litert_twin_parity.py

@@ -143,22 +143,44 @@ def main() -> int:
     out_details = interp.get_output_details()
     shape = tuple(int(v) for v in in_detail["shape"])
 
-    # Both runtimes take NCHW here — the LiteRT export of an ultralytics detect
-    # model is NOT NHWC. Transposing "because LiteRT is channels-last" silently
-    # feeds a rotated image and every residual then looks like export noise.
-    if len(shape) != 4 or shape[1] != 3:
-        raise ParityError(f"expected an NCHW [1,3,H,W] input, got {shape}")
-    imgsz = shape[2]
+    # READ THE INPUT LAYOUT OFF THE GRAPH, the same rule this file already applies
+    # to outputs. It used to assert NCHW and refuse anything else, on the reasoning
+    # that "the LiteRT export of an ultralytics detect model is NOT NHWC". That is
+    # true of the toolchain the 21 committed twins were exported with and it is NOT
+    # a property of LiteRT: `onnx2tf` transposes to channels-last by design, and an
+    # export made with ultralytics 8.3.145 declares [1,640,640,3]. The assertion
+    # fired on a real, correct twin (gh_fall_tonlong, 2026-08-26).
+    #
+    # The warning it carried is still right and is why this branches on the DECLARED
+    # shape rather than on a flag: transposing "because LiteRT is channels-last"
+    # feeds a rotated image to a model that wanted NCHW, and every residual then
+    # looks like export noise. Both runtimes must receive the SAME IMAGE, each in
+    # the layout its own graph declares — never the same buffer.
+    if len(shape) != 4:
+        raise ParityError(f"expected a 4-D [1,3,H,W] or [1,H,W,3] input, got {shape}")
+    if shape[1] == 3 and shape[3] != 3:
+        litert_layout, imgsz = "nchw", shape[2]
+    elif shape[3] == 3 and shape[1] != 3:
+        litert_layout, imgsz = "nhwc", shape[1]
+    elif shape[1] == 3 and shape[3] == 3:
+        # [1,3,H,3] is ambiguous and no real detector input is 3 px wide.
+        raise ParityError(f"input {shape} is ambiguous between NCHW and NHWC")
+    else:
+        raise ParityError(f"no channel axis of size 3 in {shape}")
 
     if args.image:
         from PIL import Image
 
         pixels = np.asarray(Image.open(args.image).convert("RGB").resize((imgsz, imgsz)))
-        x = (pixels.astype(np.float32) / 255.0).transpose(2, 0, 1)[None]
+        nchw = (pixels.astype(np.float32) / 255.0).transpose(2, 0, 1)[None]
     else:
-        x = np.random.default_rng(args.seed).random(shape).astype(np.float32)
+        nchw = np.random.default_rng(args.seed).random((1, 3, imgsz, imgsz)).astype(np.float32)
+
+    # ONNX always gets NCHW; LiteRT gets whatever it declared, from the same pixels.
+    x = nchw
+    x_litert = nchw if litert_layout == "nchw" else nchw.transpose(0, 2, 3, 1).copy()
 
-    interp.set_tensor(in_detail["index"], x)
+    interp.set_tensor(in_detail["index"], x_litert)
     interp.invoke()
     litert_out = interp.get_tensor(out_details[0]["index"])
 
@@ -173,11 +195,13 @@ def main() -> int:
     result["reason"] = why
     result["onnx"] = Path(args.onnx).name
     result["litert"] = Path(args.litert).name
+    result["litert_input_layout"] = litert_layout
 
     if args.json:
         print(json.dumps(result, indent=2))
     else:
-        print(f"{'PASS' if ok else 'FAIL'}  {result['onnx']}  layout={layout}  {why}")
+        print(f"{'PASS' if ok else 'FAIL'}  {result['onnx']}  layout={layout}  "
+              f"litert_in={litert_layout}  {why}")
         print(f"  box  x{result['box_scale_applied']:g}: {result['box_residual_px']:.4g} px"
               f"   (unscaled {result['box_residual_unscaled']:.4g})")
         print(f"  cls           : {result['cls_residual']:.4g}")

package/deploy/detector/tests/test_regrade_control_selection.py

@@ -0,0 +1,120 @@
+"""A regrade that writes `UNRESOLVED` must reproduce it, not harden it.
+
+`regrade_control_selection.py --apply` writes its verdict back into the
+adjudication it read. That makes the tool its own input, and the branch that
+emits `UNRESOLVED PENDING REMEASURE` was originally gated on
+`prior == "PUBLISH"` — so a second run saw `prior == "UNRESOLVED …"`, took the
+gate as false, and replaced a careful "we do not know" with a definitive
+`NO MODEL CLEARS BAR`, on exactly the same evidence the first run had refused to
+conclude from. Nothing downstream would have caught it: the `positive-control-grade`
+guard audits PUBLISH rows only, and both states are non-PUBLISH.
+
+The other half is the mirror error. A prior that was ALREADY a measured
+`NO MODEL CLEARS BAR` came out of a run that scored more controls than this tool
+holds for an elided row, so softening it to `UNRESOLVED` would be the tool
+asserting its own blindness over a measurement.
+
+STDLIB ONLY — the detector CI lane runs `python3 -m unittest discover` with no
+pip install, and `regrade_control_selection.py` imports nothing but the stdlib
+for that reason.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+import unittest
+
+sys.path.insert(0, str(pathlib.Path(__file__).resolve().parent.parent / "bench"))
+
+from regrade_control_selection import (  # noqa: E402
+    PRESERVE_ON_BLOCKING,
+    UNRESOLVED,
+    rateable_controls,
+    regrade_capability,
+)
+
+CTLQ = {
+    "big": {"grade": "good"},
+    "tiny": {"grade": "good_small_n"},
+    "junk": {"grade": "DISCARDED"},
+}
+BAR = {"recall_retention": 0.5, "off_target_mean": 0.1}
+
+
+def _cap(prior, *, rateable_rate=0.4, with_elided=True):
+    """One capability whose rateable control FAILS and whose 2nd row is elided."""
+    cands = [{
+        "model": "m1", "class": "fire", "quiet_t": 0.25,
+        "off_target_mean": 0.0, "n_valid_negatives": 100,
+        "by_bucket": {}, "best_control": "big", "control_n": 9,
+        "control_rate_025": rateable_rate, "control_rate_at_quiet_t": rateable_rate,
+        "per_control": {
+            "big": {"n": 9, "rate_025": rateable_rate, "rate_at_quiet_t": rateable_rate},
+            "tiny": {"n": 5, "rate_025": 0.9, "rate_at_quiet_t": 0.9},
+        },
+    }]
+    if with_elided:
+        cands.append({
+            "model": "m2", "class": "fire", "quiet_t": 0.25,
+            "off_target_mean": 0.0, "n_valid_negatives": 100,
+            "by_bucket": {"_elided": "summary row"},
+            "best_control": "tiny", "control_n": 5,
+            "control_rate_025": 0.9, "control_rate_at_quiet_t": 0.9,
+            "per_control": {},
+        })
+    return {"capability": "fire",
+            "decision": {"decision": prior, "control": "tiny", "control_n": 5},
+            "candidates": cands}
+
+
+class TestRegradeControlSelection(unittest.TestCase):
+
+    def test_liveness_only_and_unusable_grades_cannot_rate_a_class(self):
+        per = {"big": {"n": 9}, "tiny": {"n": 5}, "junk": {"n": 26}}
+        self.assertEqual(sorted(rateable_controls(per, CTLQ)), ["big"])
+
+    def test_a_publish_on_a_liveness_only_set_is_withdrawn_not_failed(self):
+        out = regrade_capability(_cap("PUBLISH"), CTLQ, BAR)
+        self.assertEqual(out["regraded_decision"], UNRESOLVED)
+        self.assertTrue(out["candidates_unknown"], "the elided row must be named")
+        self.assertTrue(out["changed"])
+
+    def test_rerunning_over_its_own_output_reproduces_unresolved(self):
+        first = regrade_capability(_cap("PUBLISH"), CTLQ, BAR)
+        second = regrade_capability(_cap(first["regraded_decision"]), CTLQ, BAR)
+        self.assertEqual(
+            second["regraded_decision"], UNRESOLVED,
+            "a second --apply hardened an unknown into a definitive verdict")
+        self.assertFalse(second["changed"], "a settled UNRESOLVED must not read as changed")
+
+    def test_a_measured_failure_is_left_alone(self):
+        out = regrade_capability(_cap("NO MODEL CLEARS BAR"), CTLQ, BAR)
+        self.assertEqual(out["regraded_decision"], "NO MODEL CLEARS BAR")
+        self.assertFalse(out["changed"])
+
+    def test_with_no_elided_row_the_verdict_is_definitive(self):
+        out = regrade_capability(_cap("PUBLISH", with_elided=False), CTLQ, BAR)
+        self.assertEqual(out["regraded_decision"], "NO MODEL CLEARS BAR")
+        self.assertEqual(out["status"], "proven")
+
+    def test_a_candidate_that_clears_on_the_rateable_set_still_publishes(self):
+        out = regrade_capability(_cap("PUBLISH", rateable_rate=0.8), CTLQ, BAR)
+        self.assertEqual(out["regraded_decision"], "PUBLISH")
+        self.assertEqual(out["winner"]["control"], "big")
+        self.assertEqual(out["winner"]["control_n"], 9)
+
+    def test_the_preserve_set_names_both_states_and_nothing_else(self):
+        self.assertEqual(sorted(PRESERVE_ON_BLOCKING), sorted(["PUBLISH", UNRESOLVED]))
+
+    def test_branches_resolved_before_a_control_is_read_are_untouched(self):
+        for prior in ("NO CANDIDATE", "NOT SCREENABLE HERE"):
+            out = regrade_capability(
+                {"capability": "x", "decision": {"decision": prior}, "candidates": []},
+                CTLQ, BAR)
+            self.assertEqual(out["regraded_decision"], prior)
+            self.assertEqual(out["status"], "not_affected")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/deploy/detector/tests/test_venue_adjudication_grades.py

@@ -0,0 +1,83 @@
+"""An ungraded control must stop the run, not quietly become eligible to decide.
+
+`liveness_only` and `unusable` are both built by MEMBERSHIP of a grade set, so a
+control with no grade at all falls through both and is treated as able to rate a
+class — the flattering direction. The committed-artifact guard catches it
+downstream, but by then a wrong number exists and may have been quoted.
+
+The same asymmetry is why `--control-quality` defaults to the COMPLETE sorted set
+rather than to one file: the grades live in dated files (the 2026-08-25 record is
+pinned by the score cards that cite it), and a run reading a subset would give the
+sets graded in the omitted file exactly that benefit of the doubt.
+
+STDLIB ONLY — this lane runs `python3 -m unittest discover` with no pip install,
+and `venue_adjudication.py` imports numpy at module scope, so it is loaded here
+with `importlib` under a guard and the whole module is SKIPPED if numpy is absent
+rather than erroring the lane during discovery.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import pathlib
+import unittest
+
+BENCH = pathlib.Path(__file__).resolve().parent.parent / "bench"
+MODULE_PATH = BENCH / "venue_adjudication.py"
+
+
+def _load():
+    spec = importlib.util.spec_from_file_location("venue_adjudication_under_test", MODULE_PATH)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+try:
+    VA = _load()
+except ImportError:  # numpy absent on this runner
+    VA = None
+
+
+@unittest.skipIf(VA is None, "numpy is not installed on this runner")
+class TestControlGradeCompleteness(unittest.TestCase):
+
+    def test_an_ungraded_control_that_is_used_refuses_the_run(self):
+        with self.assertRaises(SystemExit) as caught:
+            VA.assert_every_control_is_graded(
+                ["fire_cctv", "fire_firesense"], {"fire_firesense": {"grade": "good"}})
+        self.assertIn("fire_cctv", str(caught.exception))
+
+    def test_a_fully_graded_set_passes(self):
+        VA.assert_every_control_is_graded(
+            ["fire_cctv", "fire_firesense"],
+            {"fire_cctv": {"grade": "good"}, "fire_firesense": {"grade": "good"}})
+
+    def test_a_set_no_class_references_is_not_required_to_be_graded(self):
+        # `pos_sets` carries every scored set, including off-target ones that no
+        # CLASS_CONTROL entry names. Those cannot become `best_control`, so
+        # demanding a grade for them would refuse runs for no reason.
+        VA.assert_every_control_is_graded(["some_off_target_set"], {})
+
+    def test_discovery_finds_every_dated_grade_file(self):
+        found = [os.path.basename(p) for p in VA.discover_control_quality()]
+        self.assertTrue(found, "no positive-control-quality-*.json discovered")
+        self.assertEqual(found, sorted(found), "discovery must be sorted so later files win")
+        for name in found:
+            self.assertTrue(name.startswith("positive-control-quality-"))
+            self.assertTrue(name.endswith(".json"))
+        # The two the repo carries today. A third is fine; fewer is not.
+        self.assertIn("positive-control-quality-2026-08-25.json", found)
+        self.assertIn("positive-control-quality-2026-08-27.json", found)
+
+    def test_discovery_of_a_missing_directory_is_empty_not_an_exception(self):
+        self.assertEqual(VA.discover_control_quality("/nonexistent/grade/dir"), [])
+
+    def test_the_grade_lists_stay_disjoint(self):
+        # A grade in both lists would make the refusal order-dependent.
+        self.assertFalse(set(VA.LIVENESS_ONLY_GRADES) & set(VA.UNUSABLE_GRADES))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/deploy/detector/trillboards_detector/labels.py

@@ -523,7 +523,58 @@ PPE_KILLUMINATI_19CLS_V8S = ModelVocabulary(
 #: this artifact as the fixture that exercises `_verify_class_axis_width`, where
 #: `4 + 7 = 11` matches its real `[1, 11, 8400]` head and `4 + 6 = 10` would
 #: reject it.
-BUILTIN_VOCABULARIES: "tuple[ModelVocabulary, ...]" = (RFDETR_MEDIUM, GH_FORKLIFT_COMBINE, PPE_VYRA_14CLS_V8M, PPE_CONSTRUCTION_17CLS_V8N, PPE_KILLUMINATI_19CLS_V8S,)
+#: Person Down Detector — published 2026-08-27 by
+#: scripts/sensing/publish-sensing-model.js. The class list is the artifact's own
+#: (graph metadata key 'names'); the footprint is MEASURED, 817.3594 MiB after a
+#: probe inference via rusage-maxrss, not an estimate from the file size.
+#: Coordinate space MEASURED, not assumed: max|box channel| = 1.5467 over 94 real frames; / imgsz 640 = 0.0024. pixels at >= 0.2, normalized at <= 0.02, refused in between.
+FALL_1CLS_11X_CLASS_NAMES: "MappingProxyType[int, str]" = MappingProxyType({
+    0: "fall detected",
+})
+
+FALL_1CLS_11X = ModelVocabulary(
+    model_name="fall_1cls_11x",
+    slot_names=FALL_1CLS_11X_CLASS_NAMES,
+    logit_slots=1,
+    approx_ram_bytes=857063451,
+    onnx_variant=VariantContract(
+        output_layout="anchor_4_plus_nc",
+        box_units="normalized",
+        box_scale_to_pixels=640.0,
+    ),
+)
+
+#: Heavy Machinery Detector (venue-adjudicated) — published 2026-08-27 by
+#: scripts/sensing/publish-sensing-model.js. The class list is the artifact's own
+#: (graph metadata key 'names'); the footprint is MEASURED, 593.3125 MiB after a
+#: probe inference via rusage-maxrss, not an estimate from the file size.
+#: Coordinate space MEASURED, not assumed: max|box channel| = 1825.6333 over 120 real frames; / imgsz 640 = 2.8526. pixels at >= 0.2, normalized at <= 0.02, refused in between.
+GH_PPE_VINAYAK_L_CLASS_NAMES: "MappingProxyType[int, str]" = MappingProxyType({
+    0: "hardhat",
+    1: "mask",
+    2: "no hardhat",
+    3: "no mask",
+    4: "no safety vest",
+    5: "person",
+    6: "safety cone",
+    7: "safety vest",
+    8: "machinery",
+    9: "vehicle",
+})
+
+GH_PPE_VINAYAK_L = ModelVocabulary(
+    model_name="gh_ppe_vinayak_l",
+    slot_names=GH_PPE_VINAYAK_L_CLASS_NAMES,
+    logit_slots=10,
+    approx_ram_bytes=622133248,
+    onnx_variant=VariantContract(
+        output_layout="anchor_4_plus_nc",
+        box_units="pixels",
+        box_scale_to_pixels=1.0,
+    ),
+)
+
+BUILTIN_VOCABULARIES: "tuple[ModelVocabulary, ...]" = (RFDETR_MEDIUM, GH_FORKLIFT_COMBINE, PPE_VYRA_14CLS_V8M, PPE_CONSTRUCTION_17CLS_V8N, PPE_KILLUMINATI_19CLS_V8S, FALL_1CLS_11X, GH_PPE_VINAYAK_L,)
 
 
 class ClassIndex:
@@ -617,6 +668,8 @@ class ClassIndex:
 
 
 __all__ = [
+    "GH_PPE_VINAYAK_L",
+    "FALL_1CLS_11X",
     "PPE_KILLUMINATI_19CLS_V8S",
     "PPE_CONSTRUCTION_17CLS_V8N",
     "PPE_VYRA_14CLS_V8M",

package/dist/EdgeAgent.js

@@ -44,7 +44,7 @@ const edge_ads_1 = require("@trillboards/edge-ads");
 const CommandRouter_1 = require("./CommandRouter");
 const config_1 = require("./config");
 const dataDir_1 = require("./dataDir");
-const SDK_VERSION = '0.2.106';
+const SDK_VERSION = '0.2.109';
 class EdgeAgent extends events_1.EventEmitter {
     constructor(config, deps) {
         super();

package/dist/diagnose.d.ts

@@ -31,7 +31,7 @@ export interface DiagnosticReport {
         skipped: number;
     };
 }
-declare const SDK_VERSION = "0.2.106";
+declare const SDK_VERSION = "0.2.109";
 declare function checkNodeVersion(): CheckResult;
 declare function checkPlatform(): CheckResult;
 declare function checkMemory(): CheckResult;

package/dist/diagnose.js

@@ -63,7 +63,7 @@ const localNetworkAccess_1 = require("./localNetworkAccess");
 // ---------------------------------------------------------------------------
 // SDK version — mirrors package.json; kept in sync by CI
 // ---------------------------------------------------------------------------
-const SDK_VERSION = '0.2.106';
+const SDK_VERSION = '0.2.109';
 exports._SDK_VERSION = SDK_VERSION;
 // ---------------------------------------------------------------------------
 // ANSI helpers (no external deps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillboards/edge-sdk",
-  "version": "0.2.106",
+  "version": "0.2.109",
   "description": "Composable cross-platform Edge AI SDK for audience sensing on DOOH/CTV devices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",