feat: add verified NeuroSleep qEEG research ingestion (ADR-051)

[ruvnet]

Implements the Helix side of ADR-051: verified ingestion of signed derived NeuroSleep bundles (H1), a physically separate research WASM artifact (H2), and a deterministic research panel (H3). Every capability is off by default.

Pairs with the upstream contract released as ruv-neural-core 0.2.0-alpha.1 (ruvnet/ruv-neural#5, #6, #7).

What this is — and is not

This ingests a sleep and qEEG phenotype. It does not produce an Alzheimer's estimate, a microglial claim, a health score, a treatment recommendation, or a participant alert, and there is no code path by which it could: the output model has no such field, and a static gate fails the build if one appears.

The underlying finding is a preclinical APP/PS1 mouse study. The UI says "change from personal baseline associated with emerging research" and carries an explicit preclinical caveat; it never implies a human clinical marker.

Trust boundary

Helix verifies signatures itself rather than delegating across the repository boundary, against a separately enrolled trust key — a self-supplied trust root is rejected. Ingestion binds signer, study, subject, and consent scope; rejects replay; and seals derived records atomically under participant-opaque identifiers. Raw EEG never crosses into this repository — only versioned, signed, derived bundles.

The dependency is pinned exactly (=0.2.0-alpha.1), not by range. Helix verifies what the upstream signer produced; a compatible-looking version carrying a changed schema or extractor would silently reinterpret already-stored records without a new fingerprint.

The research build is separated by construction

helix-neurosleep gates all verification, trust, and storage behind a default native-ingest feature. The separation is machine-checkable, not asserted:

$ cargo tree -p helix-neurosleep --no-default-features -e normal
helix-neurosleep v0.1.2
├── serde
└── serde_json

No ruv-neural-core, no helix-vault, no sha2/hmac. The research artifact links no attestation or key-custody code at all.

helix-neurosleep-wasm accepts only identity-free verified nights plus the four flags. It has no API to enroll a signer, set policy, or submit a bundle. Its view type uses deny_unknown_fields, so a payload carrying a study id, subject pseudonym, recording id, or nonce is rejected, not ignored. Every user-visible string is a &'static str constant. The UI renders via textContent/createElement only — no innerHTML anywhere.

A safety gate that was silently passing

Both static safety scripts were failing open. They invoked rg inside an if condition; rg was not installed, so every check exited 127, every condition evaluated false, and each script printed clean having tested nothing. This voided the AT-10 prohibited-claim evidence recorded earlier in the requirement trace.

They now use grep, treat a tool error as a failure, refuse to pass vacuously when an expected path is missing, and cover helix-neurosleep-wasm (which holds the user-facing copy). Both were re-verified by negative control — an injected microglial activation detected string produces exit 1. The requirement trace records the withdrawal explicitly rather than quietly amending the affected rows.

New CI jobs run both gates and cargo deny on every change so this cannot rot unnoticed again.

Verification

cargo fmt --all -- --check                                   # clean
cargo clippy --workspace --all-targets --all-features -D warnings   # exit 0
cargo test --workspace --all-features                        # 232 passed, 0 failed
cargo build -p helix-wasm            --target wasm32-unknown-unknown --release
cargo build -p helix-neurosleep-wasm --target wasm32-unknown-unknown --release
npm test --prefix ui                                         # 8/8
cargo audit                                                  # 234 deps, 0 vulnerabilities
cargo deny check                                             # advisories/bans/licenses/sources ok
./validation/neurosleep/check_safety_boundary.sh             # clean (negative control verified)
./validation/neurosleep/check_forbidden_claims.sh            # clean (negative control verified)

Not claimed

ADR-051 and AT-01 through AT-12 are not complete. Numeric parity against the frozen reference (AT-02/AT-03) is unproven — no pinned SciPy/FOOOF fixtures exist. Sealed storage is in-memory, so withdrawal, deletion, export ledger, and post-ingest revocation quarantine are absent. The WASM view lacks authenticated native provenance, so it is a trusted-host visualization adapter rather than independent verified ingestion. Sleep-EDF evidence, executed fuzz reports, and browser execution tests remain outstanding.

docs/validation/ADR-051-requirement-evidence.md tracks all of this per requirement and per acceptance test.