docs: capability directions — what full firmware access buys (sense/identify/encrypt/reach) and the RE targeting consequence

docs/directions.md

@@ -0,0 +1,77 @@
+# What full firmware access buys: capability directions
+
+Why this project exists, in plain terms. The radio's sound stays WiFi-shaped
+(fixed silicon), but everything about how the radio *behaves* — measures,
+steers, times, chooses — is firmware, and we're writing the manual for it.
+These are the directions that manual unlocks, ordered by what they take
+rather than what they politely yield.
+
+## Sense — the router as an instrument
+
+- **Motion through walls.** WiFi passes through drywall; people don't. The
+  router hears the difference: presence, counting, tracking in rooms it
+  can't see into.
+- **Fine enough to see breathing.** Chest-scale motion measurably shifts the
+  signal. Firmware-grade measurement = continuous presence at that scale —
+  sleep monitoring, "is grandma moving today."
+- **A camera made of radio.** Several boxes on different sides of a space,
+  each reading signal fade through it; combined, a live occupancy map. No
+  lens, no light, works through smoke and dark (radio tomography — nobody
+  sells it).
+- **Perimeter radar.** The AP illuminates; moving reflectors — drones,
+  vehicles, people — return Doppler fingerprints. Private motion-sensing
+  perimeter from commodity WiFi.
+- **Indoor GPS.** Timing accurate enough to place devices (and reflecting
+  people) within a room.
+
+## Identify — physics as a lie detector
+
+- **Evil-twin detection that works.** A rogue AP clones name and MAC, but
+  not its transmitter's RF voiceprint (manufacturing imperfections no
+  software fakes). Detect forgery by physics, not by trusting packets.
+- **Countersurveillance.** Always-on full-spectrum ear: every nearby
+  transmitter fingerprinted, logged, flagged when a new voice appears.
+  Bug-sweeping as a background service.
+- **Spectrum observatory.** Who transmits, when, how strong, from where,
+  at what signal quality — the whole radio neighborhood, instrumented.
+
+## Encrypt — physics as an uncopyable key
+
+- **Keys from thin air.** Two radios that talked measured a channel
+  slightly different from what any third radio sees; that difference is
+  shared secret material. Two of our devices derive encryption keys from
+  the fading of the air between them, in real time. The eavesdropper two
+  meters away reads a different channel and gets different bits
+  (information-theoretic key agreement — real research field, needs exactly
+  the low-level channel control we're building).
+- **Aim silence at the snooper.** Antenna steering puts full signal on our
+  client and a deliberate null — a cone of near-silence — exactly where the
+  eavesdropper sits.
+- **Vanishing links.** Per-frame frequency hopping + power control: the
+  link looks like background noise unless you know the dance. Hard to
+  intercept, hard to jam.
+
+## Reach — the far end of the menu
+
+- **Farthest link this silicon can legally make.** Slowest mode, full
+  calibrated power, narrowest channel, dish antennas — multi-km
+  experimental links on commodity hardware. Same trade LoRa makes (speed
+  for distance), less of it on offer.
+- **Per-device brute optimization.** Stock firmware is conservative for a
+  million strangers; ours knows its clients and pushes each to its true
+  physical limit every transmission.
+
+## Hard walls (unchanged)
+
+Waveform is fixed (no arbitrary signals, no chirps); the receiver locks
+only on WiFi preambles; power ceilings are regulatory; sensing items are
+research-grade — but researchers are starving for exactly the measurement
+control this platform can have.
+
+## RE targeting consequence
+
+Sensing, fingerprinting, channel-keys, and null-steering all consume the
+same primitive: **rich per-packet channel measurement** (CSI/RX-vector
+capture and control). That makes the RX measurement path — how the firmware
+collects and reports channel state — the highest-value first reverse
+engineering target beyond the dispatch layer already mapped.