# CSI sensing project stages

Ladder of increasing difficulty for WiFi sensing on hardware we own
(MT3000 router, Android phones, AX211 laptop — no purchases required).
Every rung ends in something visible or verifiable. Deterministic signal
processing throughout; ML appears only as classifiers labeling measured
features — no image synthesis, no "guessed" renderings (project rule).

Context: docs/directions.md (capability directions), docs/findings.md
(firmware facts). Key enabler already established: the stock MT7981
firmware registers CSI command handlers (0xc2/0xc3/0xc4 — F9 data), and
MediaTek authored a driver-side CSI patch (2022, never mainlined).

## Stage 0 — pipeline rehearsal, zero firmware work (tonight)

Laptop + phone only. Data is coarse (RSSI: one strength number per
packet), but the tooling built here is reused by every later stage.

- 0.1 RSSI motion logger: phone streams UDP (iperf), laptop logs signal
  strength at high rate into Python.
- 0.2 Dashboard: streaming line plot + waterfall renderer.

Done when: waving at the phone visibly moves the plot; crossing the room
leaves a streak.

## Stage 1 — first real CSI (router powered again)

- 1.1 Router online; pull its exact firmware blobs; diff against
  linux-firmware copies (ground truth).
- 1.2 Port MediaTek's 2022 CSI patch to the router's OpenWrt mt76;
  rebuild, flash (U-Boot recovery available).
- 1.3 Verify firmware answers: 0xc2 CSI events flowing (RE says the
  handlers exist — prove live).
- 1.4 Collector: netlink → Python → live CSI heatmap (the barcode),
  phone as talker.

Done when: empty-room barcode sits still; walking through breaks it.

## Stage 2 — clean physics, deterministic DSP

- 2.1 Phase cleaning (conjugate-multiply across packets).
- 2.2 Live Doppler spectrogram (speed-labeled streaks).
- 2.3 Breathing extraction: bandpass 0.1–0.6 Hz; verify breaths/min
  against a stopwatch.
- 2.4 Distance slices: tone-axis transform; verify at marked positions
  (2 m / 4 m / 6 m) against the ~2 m resolution budget.
- 2.5 Event detectors: entry/exit, travel direction, two-person counting
  (thresholds, no guessing).

Done when: views match physical reality checkable with tape measure and
stopwatch.

## Stage 3 — firmware upgrades (the RE project pays off)

- 3.1 Crank measurement rate: dedicated sounding traffic instead of
  borrowed network traffic.
- 3.2 CSI on every frame + ambient/monitor capture, not just the
  associated client.
- 3.3 Channel hopping across the 5 GHz band: synthesize ~555 MHz →
  ~10-inch distance slices. Verify at marked positions.
- 3.4 Dual-band simultaneous capture (2.4 + 5 GHz).

Done when: slice resolution measurably improves; the firmware's rate
ceiling is documented and its patch location known.

## Stage 4 — state of the art, deterministic only

- 4.1 Full range-Doppler radar screen (live, both transforms).
- 4.2 Gesture vocabulary: ~6 dynamic hand signs classified from measured
  Doppler streak shapes (small classifier on measured features; per-user
  training; honest accuracy reporting).
- 4.3 Transmitter voiceprinting: classify devices by RF signature; detect
  a MAC-spoofed clone.
- 4.4 Through-wall characterization: detection reliability vs distance
  through a known wall.
- 4.5 Optional (later hardware): second capture node → floor-plan
  overlay; SAR rail for outline imaging.

Out of scope per project rule: skeleton/pose renderings, point clouds,
any network-invented pixels.

## Gates

- Physical: router must be powered (unblocks Stage 1).
- Long grind: Stage 3 firmware work — same RE as the main project, now
  with concrete purpose; benefits from the dispatch/handler maps already
  built.