No description
Find a file
jedarden 9c38cbb9ef fix(bf-1o7qi): bridge X-Spaxel-Token header into hello.Token for validation
The token validator reads only hello.Token (server.go:537), but spaxel-sim and
firmware following the plan.md auth contract present their token solely as the
X-Spaxel-Token upgrade-request header, omitting it from the hello JSON body. The
WS upgrade handler never read that header, so hello.Token was always "" and
every such node fell through to the migration-window branch — the dead
token-supply path.

Fix (approach A, server-side): in HandleNodeWS, after parsing hello and before
the validation check, copy X-Spaxel-Token into hello.Token when the body omits
it. The body token wins when both are present, so existing body-token clients
are unaffected. This does not weaken the validator: an empty/invalid token is
still rejected once the migration window closes (SPAXEL_MIGRATION_WINDOW_HOURS=0
or deadline past).

Test TestTokenValidation_HeaderTokenBridged wires the real
provisioning.Server.ValidateToken (HMAC-SHA256(installSecret, mac)) and mints the
token through the real HandleProvision handler, proving the bridge end-to-end:
valid header token accepted + paired with window closed; empty/invalid rejected;
body-token-wins regression.

Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-07 12:28:10 -04:00
.beads docs(bf-34lwt): close — root-cause re-verified at HEAD 402bb7b 2026-07-07 12:28:10 -04:00
.marathon chore(marathon): GLM-4.7 launcher; origin->Forgejo (mirrors to GitHub) 2026-05-24 09:37:25 -04:00
cmd/sim feat(ingestion): persist hello-announced node position in fleet registry (bf-24xp) 2026-07-03 18:42:34 -04:00
dashboard fix(bf-56uk): make blob-identity TypeScript verification compile-clean 2026-07-06 19:32:31 -04:00
docs docs(bf-29wyl): confirm token-supply path dead — header-only, unread 2026-07-07 06:55:56 -04:00
firmware test(runner): document C11 7.13.2.1 setjmp clobber audit at call site (bf-31rd) 2026-07-04 04:29:59 -04:00
mothership fix(bf-1o7qi): bridge X-Spaxel-Token header into hello.Token for validation 2026-07-07 12:28:10 -04:00
notes docs(bf-1mwy): correct coverage-gate HEAD ref to real ancestor 908adf2 2026-07-06 18:24:50 -04:00
test/acceptance test(acceptance): add IO-1 and IO-2 acceptance tests 2026-05-24 12:45:41 -04:00
tests/e2e feat: complete anomaly detection & security mode dashboard UI 2026-04-07 15:50:25 -04:00
.dockerignore feat(deploy): Docker packaging with multi-stage build and compose orchestration 2026-03-26 07:46:15 -04:00
.gitignore chore(firmware): gitignore abandoned idf.py --target linux test_apps residue 2026-07-03 13:28:21 -04:00
.golangci.yml fix(lint): resolve golangci-lint v2 failures blocking CI 2026-06-03 23:34:50 -04:00
.needle-predispatch-sha docs(bf-34lwt): close — root-cause re-verified at HEAD 402bb7b 2026-07-07 12:28:10 -04:00
.needle.yaml feat: trigger CI build and verify deployment 2026-04-06 09:54:08 -04:00
API_IMPLEMENTATION_STATUS.md docs: verify REST API implementation completeness 2026-04-09 18:18:42 -04:00
docker-compose.yml feat(deploy): Docker packaging with multi-stage build and compose orchestration 2026-03-26 07:46:15 -04:00
Dockerfile test: add firmware host tests for nvs/csi/serial_prov + wire gcc harness into CI 2026-07-03 13:21:26 -04:00
fix_ble_handlers.py feat: implement spatial quick actions with follow camera 2026-04-09 22:54:36 -04:00
go.work simulator: build and update spaxel-sim CLI tool 2026-05-06 00:26:51 -04:00
PROGRESS.md docs(bf-2hdbg): migration window (not tokens) accepts tokenless sim nodes 2026-07-07 07:24:19 -04:00
README.md docs(ci): add accessibility quality gate documentation 2026-07-06 00:32:03 -04:00
VERSION fix(provision): re-broadcast SPAXEL READY every 1s during window 2026-06-05 18:23:25 -04:00

Spaxel

WiFi CSI-based indoor positioning for self-hosted homes.

Spaxel detects and localizes people in a home using WiFi Channel State Information — no cameras, no microphones, no cloud. A single Docker container (the "mothership") runs on a home server and manages a fleet of ESP32-S3 nodes that capture and stream CSI over WiFi. The mothership fuses CSI from all links to detect presence, follow motion, and — with enough nodes — estimate 2D/3D position, rendered on a Three.js floor-plan dashboard.

Everything runs locally on hardware you own. There is no cloud relay, no account, and no RF beyond the 2.4 GHz WiFi already in your home.

What it can realistically do

Based on physics and the research in docs/research/ (see docs/research/06-accuracy-and-limits.md):

  • Presence detection — reliably, with 2+ nodes on opposite sides of a space
  • Approximate 2D position — ±0.51.0 m with 4+ nodes
  • Motion / trajectory tracking — follows moving people
  • Rough person count — distinguishes 1 vs. 2+ (degrades at 3+)
  • Rough Z-axis — ±12 m with mixed-height node placement (enables fall detection)
  • Stationary-person detection — via breathing micro-motion (0.10.5 Hz)

Not achievable with 2.4 GHz CSI: sub-10 cm accuracy, skeletal pose, reliable 5+ person tracking.

Privacy by design

Spaxel is CSI-only — it never captures camera images or audio. Detection is local: data stays on the mothership, there is no cloud relay or remote access, and no user accounts are required (a single PIN protects the dashboard). See the Non-Goals section of docs/plan/plan.md.

Repository layout

Spaxel is a Go workspace of three modules, plus ESP32 firmware and a static frontend:

Path Description
mothership/ Go backend — ingestion, signal pipeline, localizer, fleet manager, REST/WebSocket API, dashboard server (github.com/spaxel/mothership)
cmd/sim/ spaxel-sim — CSI/node simulator CLI for hardware-free development and integration tests (github.com/spaxel/sim)
test/acceptance/ Acceptance-test module (AS-1 … AS-7), driven by the simulator
firmware/ ESP-IDF (C) firmware for the ESP32-S3 node fleet
dashboard/ Vanilla JS + Three.js single-page UI (see dashboard/README.md)
docs/ Plan, notes, and research (see Documentation below)
Dockerfile, docker-compose.yml Single-container packaging
PROGRESS.md, VERSION Implementation status and current version

Quickstart

The mothership ships as a single container, published as ronaldraygun/spaxel. The bundled docker-compose.yml builds from source by default and exposes one port (8080).

git clone https://github.com/jedarden/spaxel.git
cd spaxel
docker compose up -d        # builds the mothership image, host networking
# …or skip the build and use the published image:
#   docker pull ronaldraygun/spaxel

Then open http://<server-ip>:8080, set a dashboard PIN, and use Add Node (Chrome/Edge Web Serial) to provision an ESP32-S3 over USB. The node discovers the mothership via mDNS and begins streaming CSI — zero manual IP configuration.

network_mode: host is required for mDNS multicast to reach ESP32 nodes on your LAN. If host networking isn't available, set SPAXEL_MDNS_ENABLED=false and provision nodes with a manual mothership IP (see docs/notes/mdns-override.md).

Key environment variables

Variable Default Purpose
SPAXEL_BIND_ADDR 0.0.0.0:8080 Listen address (set to 127.0.0.1:8080 behind a local reverse proxy)
SPAXEL_DATA_DIR /data Persistent storage: SQLite, baselines, floor plans, CSI replay buffer, firmware
SPAXEL_MQTT_BROKER (unset) Optional MQTT broker URL for Home Assistant integration (e.g. mqtt://homeassistant.local:1883)
TZ UTC Timezone for diurnal baselines, briefings, and quiet hours (IANA name)
SPAXEL_MDNS_ENABLED true Disable when not using host networking

The full list is in the Deployment section of docs/plan/plan.md.

Building & developing

# Mothership backend
cd mothership && go test ./... && go vet ./...

# CSI / node simulator
go build -o spaxel-sim ./cmd/sim

# Hardware-free acceptance suite (no ESP32 needed)
cd test/acceptance && go test ./...

# Dashboard unit + accessibility tests (CI quality gate)
cd dashboard && npm test && npm run test:a11y

Firmware is built with ESP-IDF 5.2.x — see the Firmware Build System section of the plan.

Documentation


Spaxel is self-hosted, CSI-only, and cloud-free by design.