commit fdf37aa7b4a90f73e74634d16c577fc189d1824a
Author: kharonsec <eliott.vannuffel@proton.me>
Date:   Fri Jan 2 19:08:56 2026 +0100

    first commit

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..deda00f
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,28 @@
+# Generated files
+/target/
+*.o
+*.so
+*.a
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Debug output
+*.raw
+debug_frames/
+
+# Local configuration overrides
+config.local.toml
+
+# Test data
+test_images/
+test_output/
+test_frames/
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..0f4c640
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,1305 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "bindgen"
+version = "0.65.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfdf7b466f9a4903edc73f95d6d2bcd5baf8ae620638762244d3f60143643cc5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn",
+ "which",
+]
+
+[[package]]
+name = "bit_field"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+
+[[package]]
+name = "bytemuck"
+version = "1.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
+
+[[package]]
+name = "color_quant"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "exr"
+version = "1.74.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4300e043a56aa2cb633c01af81ca8f699a321879a7854d3896a0ba89056363be"
+dependencies = [
+ "bit_field",
+ "half",
+ "lebe",
+ "miniz_oxide",
+ "rayon-core",
+ "smallvec",
+ "zune-inflate",
+]
+
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "gif"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ae047235e33e2829703574b54fdec96bfbad892062d97fed2f76022287de61b"
+dependencies = [
+ "color_quant",
+ "weezl",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "cfg-if",
+ "crunchy",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "image"
+version = "0.24.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "color_quant",
+ "exr",
+ "gif",
+ "jpeg-decoder",
+ "num-traits",
+ "png",
+ "qoi",
+ "tiff",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "jpeg-decoder"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00810f1d8b74be64b13dbf3db89ac67740615d6c891f0e7b6179326533011a07"
+dependencies = [
+ "rayon",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "lebe"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a79a3332a6609480d7d0c9eab957bca6b455b91bb84e66d19f5ff66294b85b8"
+
+[[package]]
+name = "libc"
+version = "0.2.178"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37c93d8daa9d8a012fd8ab92f088405fb202ea0b6ab73ee2482ae66af4f42091"
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link",
+]
+
+[[package]]
+name = "linux-hello-cli"
+version = "0.1.0"
+dependencies = [
+ "clap",
+ "image",
+ "linux-hello-common",
+ "linux-hello-daemon",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "toml",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "linux-hello-common"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "thiserror",
+ "toml",
+ "tracing",
+]
+
+[[package]]
+name = "linux-hello-daemon"
+version = "0.1.0"
+dependencies = [
+ "image",
+ "linux-hello-common",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "v4l",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "memchr"
+version = "2.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "png"
+version = "0.17.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
+dependencies = [
+ "bitflags 1.3.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9695f8df41bb4f3d222c95a67532365f569318332d03d5f3f67f37b20e6ebdf0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "qoi"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6d64c71eb498fe9eae14ce4ec935c555749aef511cca85b5568910d6e48001"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rayon"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.10.0",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.10.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.148"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3084b546a1dd6289475996f182a22aba973866ea8e8b02c51d9f46b1336a22da"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "syn"
+version = "2.0.112"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21f182278bf2d2bcb3c88b1b08a37df029d71ce3d3ae26168e3c653b213b99d4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tiff"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1310fcea54c6a9a4fd1aad794ecc02c31682f6bfbecdf460bf19533eed1e3e"
+dependencies = [
+ "flate2",
+ "jpeg-decoder",
+ "weezl",
+]
+
+[[package]]
+name = "tokio"
+version = "1.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_write",
+ "winnow",
+]
+
+[[package]]
+name = "toml_write"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f30143827ddab0d256fd843b7a66d164e9f271cfa0dde49142c5ca0ca291f1e"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "v4l"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8fbfea44a46799d62c55323f3c55d06df722fbe577851d848d328a1041c3403"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+ "v4l2-sys-mit",
+]
+
+[[package]]
+name = "v4l2-sys-mit"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6779878362b9bacadc7893eac76abe69612e8837ef746573c4a5239daf11990b"
+dependencies = [
+ "bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "weezl"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd74ec98b9250adb3ca554bdde269adf631549f51d8a8f8f0a10b50f1cb298c3"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8a8d209fdf45cf5138cbb5a506f6b52522a25afccc534d1475dad8e31105c6a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de9211a9f64b825911bdf0240f58b7a8dac217fe260fc61f080a07f61372fbd5"
+
+[[package]]
+name = "zune-inflate"
+version = "0.2.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ab332fe2f6680068f3582b16a24f90ad7096d5d39b974d1c0aff0125116f02"
+dependencies = [
+ "simd-adler32",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..fc99995
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,41 @@
+[workspace]
+resolver = "2"
+members = [
+    "linux-hello-common",
+    "linux-hello-daemon",
+    "linux-hello-cli",
+]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "GPL-3.0"
+authors = ["Linux Hello Contributors"]
+repository = "https://github.com/linux-hello/linux-hello"
+rust-version = "1.75"
+
+[workspace.dependencies]
+# Shared across workspace
+thiserror = "1.0"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+toml = "0.8"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+tokio = { version = "1.35", features = ["full"] }
+
+# Camera
+v4l = "0.14"
+
+# ML/ONNX
+ort = "2.0.0-rc.10"
+ndarray = "0.15"
+
+# Image processing
+image = "0.24"
+
+# CLI
+clap = { version = "4.4", features = ["derive"] }
+
+# TPM (future)
+# tss-esapi = "7.4"
diff --git a/development_path.md b/development_path.md
new file mode 100644
index 0000000..cf41639
--- /dev/null
+++ b/development_path.md
@@ -0,0 +1,746 @@
+# Linux Hello
+
+**Secure facial authentication for Linux using IR cameras and TPM2**
+
+A Windows Hello-equivalent biometric authentication system for Linux, designed with security-first principles: TPM-backed credential storage, anti-spoofing detection, and proper PAM integration.
+
+---
+
+## Table of Contents
+
+1. [Project Overview](#project-overview)
+2. [Architecture](#architecture)
+3. [Security Model](#security-model)
+4. [Components](#components)
+5. [Technical Specifications](#technical-specifications)
+6. [Development Phases](#development-phases)
+7. [Build Instructions](#build-instructions)
+8. [Testing Strategy](#testing-strategy)
+9. [Threat Model](#threat-model)
+10. [Contributing](#contributing)
+
+---
+
+## Project Overview
+
+### Problem Statement
+
+Current Linux facial authentication solutions (primarily Howdy) have significant security limitations:
+
+- Face templates stored unencrypted on disk
+- No TPM integration for secure credential storage
+- Basic or no anti-spoofing capabilities
+- Vulnerable to photo and video replay attacks
+- No secure enclave processing
+
+### Goals
+
+1. **Security parity with Windows Hello** — TPM2-backed storage, anti-spoofing ML models, secure template handling
+2. **Privacy by design** — all biometric data stays local, encrypted at rest, never leaves the device
+3. **Seamless UX** — sub-second authentication, works with login managers, sudo, lock screens
+4. **Broad compatibility** — support major distros, common IR camera hardware, multiple desktop environments
+
+### Non-Goals
+
+- RGB-only camera support (IR is required for security)
+- Cloud-based authentication
+- Multi-device sync of biometric data
+- Fingerprint or other biometric modalities (future scope)
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│                        Desktop Environment                          │
+│                  (GNOME, KDE, SDDM, GDM, etc.)                      │
+└─────────────────────────────────────────────────────────────────────┘
+                                    │
+                                    ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                           PAM Module                                │
+│                      (pam_linux_hello.so)                           │
+│         - Authentication entry point                                │
+│         - Communicates with daemon via Unix socket                  │
+└─────────────────────────────────────────────────────────────────────┘
+                                    │
+                                    ▼
+┌─────────────────────────────────────────────────────────────────────┐
+│                      D-Bus Service Daemon                           │
+│                     (linux-hello-daemon)                            │
+│                                                                     │
+│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌────────────┐  │
+│  │   Camera    │  │    Face     │  │    Anti-    │  │    TPM2    │  │
+│  │  Interface  │  │  Detection  │  │  Spoofing   │  │  Storage   │  │
+│  └─────────────┘  └─────────────┘  └─────────────┘  └────────────┘  │
+└─────────────────────────────────────────────────────────────────────┘
+                                    │
+                    ┌───────────────┼───────────────┐
+                    ▼               ▼               ▼
+              ┌──────────┐   ┌──────────┐    ┌──────────┐
+              │ IR Camera│   │   TPM2   │    │  ONNX    │
+              │ /dev/vid │   │  Device  │    │ Runtime  │
+              └──────────┘   └──────────┘    └──────────┘
+```
+
+### Component Communication
+
+| From | To | Protocol | Purpose |
+|------|----|----------|---------|
+| PAM Module | Daemon | Unix Socket (abstract) | Auth requests/responses |
+| Desktop Env | Daemon | D-Bus (system bus) | Enrollment, settings, status |
+| Daemon | Camera | V4L2 | Frame capture, IR emitter control |
+| Daemon | TPM2 | tss-esapi / tpm2-tss | Secure key/template storage |
+
+---
+
+## Security Model
+
+### Biometric Template Protection
+
+1. **Enrollment**: Face embeddings are generated and immediately encrypted using a TPM2-bound key
+2. **Storage**: Encrypted templates stored in `/var/lib/linux-hello/templates/<user>/`
+3. **Decryption**: Only possible on this specific TPM, with user authentication
+4. **Deletion**: Secure wipe on unenrollment, templates never backed up
+
+### Anti-Spoofing Layers
+
+| Layer | Technique | Defeats |
+|-------|-----------|---------|
+| 1 | IR-only capture | Printed photos, most screens |
+| 2 | Depth estimation from structured light | 2D images, flat screens |
+| 3 | Liveness CNN | Photos, static masks |
+| 4 | Temporal micro-movement analysis | Static 3D prints |
+| 5 | (Optional) Challenge-response | All static attacks |
+
+### Authentication Flow
+
+```
+1. PAM requests authentication for <user>
+2. Daemon activates IR emitter + camera
+3. Capture N frames (configurable, default 5)
+4. For each frame:
+   a. Run anti-spoofing checks (must pass threshold)
+   b. Extract face embedding
+5. Compare embeddings against TPM-decrypted templates
+6. Return success/failure to PAM
+7. Zero-out all frame buffers and embeddings from memory
+```
+
+### Threat Model Summary
+
+| Threat | Mitigation |
+|--------|------------|
+| Stolen laptop (off) | TPM-bound keys, no access without hardware |
+| Stolen laptop (suspended) | Memory encryption (separate concern), short auth timeout |
+| Photo attack | IR camera, depth detection |
+| Video replay on screen | IR doesn't capture screens properly |
+| 3D printed mask | Temporal liveness detection |
+| Evil maid (template extraction) | TPM binding, encrypted at rest |
+| Shoulder surfing | N/A (face auth inherently resistant) |
+| Similar-looking attacker | Embedding distance threshold tuning |
+
+---
+
+## Components
+
+### 1. PAM Module (`pam_linux_hello.so`)
+
+**Language**: C (for maximum PAM compatibility)
+
+**Responsibilities**:
+- Integrate with PAM authentication stack
+- Communicate with daemon via Unix socket
+- Handle timeouts and fallback to password
+- Provide configuration via `/etc/pam.d/` and `/etc/linux-hello/pam.conf`
+
+**Key Functions**:
+```c
+PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc, const char **argv);
+PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags, int argc, const char **argv);
+```
+
+**Configuration Options**:
+- `timeout=<seconds>` — max time to attempt face auth (default: 5)
+- `fallback=password` — allow password if face fails
+- `debug` — verbose logging to syslog
+
+---
+
+### 2. Daemon (`linux-hello-daemon`)
+
+**Language**: Rust
+
+**Crates**:
+- `tss-esapi` — TPM2 integration
+- `v4l` — Video4Linux camera control
+- `zbus` — D-Bus service
+- `ort` — ONNX Runtime bindings for ML inference
+- `opencv` — Image processing (via rust bindings or FFI)
+- `tokio` — Async runtime
+- `secrecy` — Secure memory handling
+
+**Responsibilities**:
+- Manage camera lifecycle (open, configure, capture, close)
+- Control IR emitter via UVC extension units
+- Run face detection and embedding models
+- Run anti-spoofing models
+- Interface with TPM2 for key management and encryption
+- Expose D-Bus API for enrollment and management
+- Handle concurrent authentication requests
+
+**D-Bus Interface** (`org.linux-hello.Manager`):
+
+```xml
+<interface name="org.linux-hello.Manager">
+  <method name="Enroll">
+    <arg name="user" type="s" direction="in"/>
+    <arg name="label" type="s" direction="in"/>
+    <arg name="success" type="b" direction="out"/>
+    <arg name="message" type="s" direction="out"/>
+  </method>
+  
+  <method name="Remove">
+    <arg name="user" type="s" direction="in"/>
+    <arg name="label" type="s" direction="in"/>
+    <arg name="success" type="b" direction="out"/>
+  </method>
+  
+  <method name="List">
+    <arg name="user" type="s" direction="in"/>
+    <arg name="labels" type="as" direction="out"/>
+  </method>
+  
+  <method name="Test">
+    <arg name="user" type="s" direction="in"/>
+    <arg name="result" type="b" direction="out"/>
+    <arg name="confidence" type="d" direction="out"/>
+  </method>
+  
+  <property name="Status" type="s" access="read"/>
+  <property name="CameraAvailable" type="b" access="read"/>
+  
+  <signal name="AuthenticationAttempt">
+    <arg name="user" type="s"/>
+    <arg name="success" type="b"/>
+    <arg name="method" type="s"/>
+  </signal>
+</interface>
+```
+
+---
+
+### 3. IR Camera Interface
+
+**Driver Layer**: V4L2 (Video4Linux2)
+
+**Key Challenges**:
+- IR emitter control varies by hardware (UVC extension units)
+- Need to identify IR camera vs RGB camera
+- Handle camera already in use by other applications
+
+**IR Emitter Control**:
+Most IR cameras use USB Video Class (UVC) extension units. We'll need to:
+1. Enumerate UVC extension units
+2. Find the IR emitter control (vendor-specific)
+3. Send enable/disable commands
+
+Reference implementation: [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter)
+
+**Camera Detection Heuristic**:
+```
+1. Enumerate /dev/video* devices
+2. Query V4L2 capabilities
+3. Look for IR-specific formats (Y8, GREY, etc.)
+4. Check for multiple cameras (typically IR is second device)
+5. Attempt IR emitter activation as confirmation
+```
+
+---
+
+### 4. Face Detection & Embedding
+
+**Model Options**:
+
+| Model | Size | Speed | Accuracy | License |
+|-------|------|-------|----------|---------|
+| RetinaFace | ~100MB | ~50ms | High | MIT |
+| MTCNN | ~2MB | ~100ms | Medium | MIT |
+| BlazeFace | ~500KB | ~10ms | Medium | Apache 2.0 |
+
+**Embedding Model**:
+
+| Model | Embedding Size | Accuracy (LFW) | License |
+|-------|----------------|----------------|---------|
+| ArcFace | 512 | 99.8% | MIT |
+| FaceNet | 128/512 | 99.6% | Apache 2.0 |
+| MobileFaceNet | 128 | 99.4% | MIT |
+
+**Recommendation**: 
+- Detection: BlazeFace (speed) or RetinaFace (accuracy)
+- Embedding: MobileFaceNet (good balance for on-device)
+
+**Inference Runtime**: ONNX Runtime with CPU execution provider (GPU optional)
+
+---
+
+### 5. Anti-Spoofing Module
+
+**Multi-Stage Pipeline**:
+
+```
+Frame → IR Validation → Depth Check → Liveness CNN → Temporal Analysis → Decision
+           │                │              │               │
+           ▼                ▼              ▼               ▼
+        Reject if       Reject if      Score 0-1      Micro-movement
+        not IR-like    depth < thresh   threshold       detection
+```
+
+**Stage 1: IR Validation**
+- Verify frame characteristics match IR capture (histogram analysis)
+- Reject frames that appear to be visible light
+
+**Stage 2: Depth Estimation**
+- Use structured light patterns from IR emitter
+- Estimate depth map, reject if too flat
+- Reference: [3DDFA_V2](https://github.com/cleardusk/3DDFA_V2)
+
+**Stage 3: Liveness CNN**
+- Binary classifier: real face vs spoof
+- Training data: CelebA-Spoof, CASIA-FASD, Replay-Attack datasets
+- Architecture: MobileNetV3-Small backbone
+
+**Stage 4: Temporal Analysis**
+- Capture sequence of frames (not just one)
+- Detect micro-movements (eye blinks, slight head motion)
+- Use optical flow or landmark tracking
+
+**Confidence Scoring**:
+```
+final_score = w1 * depth_score + w2 * liveness_score + w3 * temporal_score
+
+if final_score < threshold:
+    reject("Spoof detected")
+```
+
+Default weights: `w1=0.3, w2=0.5, w3=0.2`
+Default threshold: `0.7`
+
+---
+
+### 6. TPM2 Storage Module
+
+**Key Hierarchy**:
+```
+TPM Storage Root Key (SRK)
+    └── Linux Hello Primary Key (sealed to PCRs)
+            └── User Template Encryption Key (per-user)
+                    └── Encrypted face template
+```
+
+**Operations**:
+
+| Operation | TPM2 Command | Purpose |
+|-----------|--------------|---------|
+| Create primary key | `TPM2_CreatePrimary` | One-time setup |
+| Create user key | `TPM2_Create` | Per-user enrollment |
+| Encrypt template | `TPM2_EncryptDecrypt` | Secure storage |
+| Decrypt template | `TPM2_EncryptDecrypt` | Authentication |
+| Seal to PCRs | `TPM2_PolicyPCR` | Bind to boot state (optional) |
+
+**PCR Binding (Optional)**:
+- PCR 7: Secure Boot state
+- PCR 11: BitLocker-like (unified kernel image)
+- Effect: Templates inaccessible if boot chain modified
+
+**Key Storage**:
+- Primary key handle persisted at `0x81000001`
+- User keys stored as TPM2 context blobs in `/var/lib/linux-hello/keys/`
+
+---
+
+### 7. CLI Tool (`linux-hello`)
+
+**Commands**:
+
+```bash
+# Enrollment
+linux-hello enroll [--label <name>]     # Add face model
+linux-hello enroll --glasses            # Add variant
+
+# Management
+linux-hello list                         # Show enrolled models
+linux-hello remove <label>               # Remove specific model
+linux-hello remove --all                 # Remove all models
+linux-hello clear                        # Full reset
+
+# Testing
+linux-hello test                         # Test recognition
+linux-hello test --verbose               # Show confidence scores
+linux-hello test --debug                 # Save debug frames
+
+# Status
+linux-hello status                       # Show daemon status
+linux-hello status --camera              # Camera diagnostics
+
+# Configuration
+linux-hello config                       # Show current config
+linux-hello config --set <key>=<value>   # Modify settings
+```
+
+---
+
+## Technical Specifications
+
+### Hardware Requirements
+
+| Component | Minimum | Recommended |
+|-----------|---------|-------------|
+| CPU | x86_64 or ARM64 | — |
+| RAM | 512MB available | 1GB available |
+| Camera | IR camera with emitter | Windows Hello certified |
+| TPM | TPM 2.0 | fTPM or discrete |
+| Storage | 100MB | 500MB (for models) |
+
+### Supported IR Cameras
+
+Initial target hardware:
+
+| Manufacturer | Models | Notes |
+|--------------|--------|-------|
+| Lenovo | Yoga series IR cams | Well-documented |
+| Dell | XPS series IR cams | UVC extension units |
+| HP | EliteBook/Spectre IR | Tested with linux-enable-ir-emitter |
+| Microsoft | Surface cameras | May need special handling |
+| Logitech | Brio 4K | External USB, IR available |
+
+### Performance Targets
+
+| Metric | Target |
+|--------|--------|
+| Cold start (daemon not running) | < 2s |
+| Warm authentication | < 500ms |
+| Memory usage (daemon idle) | < 50MB |
+| Memory usage (during auth) | < 200MB |
+| CPU usage (during auth) | < 50% single core |
+| False Acceptance Rate (FAR) | < 0.001% |
+| False Rejection Rate (FRR) | < 5% |
+
+---
+
+## Development Phases
+
+### Phase 1: Foundation (Weeks 1-4)
+
+**Goals**: Basic infrastructure, camera integration, simple face detection
+
+**Deliverables**:
+- [ ] Project scaffolding (Rust workspace, C PAM module skeleton)
+- [ ] V4L2 camera enumeration and capture
+- [ ] IR emitter control (at least for Lenovo hardware)
+- [ ] Basic face detection with ONNX model
+- [ ] Frame capture CLI tool for testing
+
+**Milestone**: Capture IR frames and detect faces in them
+
+---
+
+### Phase 2: Core Authentication (Weeks 5-8)
+
+**Goals**: Face embedding, template storage, basic PAM integration
+
+**Deliverables**:
+- [ ] Face embedding model integration
+- [ ] Template matching (cosine similarity)
+- [ ] Local encrypted storage (no TPM yet)
+- [ ] PAM module communicating with daemon
+- [ ] Basic enrollment flow
+- [ ] Basic authentication flow
+
+**Milestone**: Login with face on test system (insecure, no anti-spoofing)
+
+---
+
+### Phase 3: Security Hardening (Weeks 9-14)
+
+**Goals**: TPM integration, anti-spoofing, secure architecture
+
+**Deliverables**:
+- [ ] TPM2 key hierarchy setup
+- [ ] Template encryption with TPM-bound keys
+- [ ] Depth estimation anti-spoofing
+- [ ] Liveness CNN model training and integration
+- [ ] Temporal analysis implementation
+- [ ] Secure memory handling (zeroization)
+- [ ] Security audit of IPC
+
+**Milestone**: Secure authentication resistant to photo/video attacks
+
+---
+
+### Phase 4: Polish & Integration (Weeks 15-18)
+
+**Goals**: UX, desktop integration, broad compatibility
+
+**Deliverables**:
+- [ ] D-Bus service for desktop integration
+- [ ] GNOME Settings integration (optional)
+- [ ] KDE System Settings integration (optional)
+- [ ] Multiple camera hardware support
+- [ ] Comprehensive error handling and logging
+- [ ] User documentation
+- [ ] Packaging (deb, rpm, AUR)
+
+**Milestone**: Release candidate
+
+---
+
+### Phase 5: Hardening & Release (Weeks 19-22)
+
+**Goals**: Testing, security review, release
+
+**Deliverables**:
+- [ ] Penetration testing (spoofing attacks)
+- [ ] Fuzzing (IPC, image parsing)
+- [ ] Performance optimization
+- [ ] External security audit (if budget allows)
+- [ ] v1.0 release
+
+---
+
+## Build Instructions
+
+### Prerequisites
+
+```bash
+# Ubuntu/Debian
+sudo apt install build-essential cmake pkg-config \
+    libpam0g-dev libv4l-dev libudev-dev \
+    libssl-dev libtss2-dev \
+    libonnxruntime-dev \
+    libopencv-dev
+
+# Install Rust
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+```
+
+### Building
+
+```bash
+git clone https://github.com/<org>/linux-hello.git
+cd linux-hello
+
+# Build daemon and CLI
+cargo build --release
+
+# Build PAM module
+cd pam-module
+make
+sudo make install
+
+# Install daemon
+sudo install -m 755 target/release/linux-hello-daemon /usr/libexec/
+sudo install -m 755 target/release/linux-hello /usr/bin/
+
+# Install systemd service
+sudo install -m 644 dist/linux-hello.service /etc/systemd/system/
+sudo systemctl daemon-reload
+sudo systemctl enable --now linux-hello
+```
+
+### Configuration
+
+```bash
+# Create config directory
+sudo mkdir -p /etc/linux-hello
+
+# Copy default config
+sudo cp dist/config.toml /etc/linux-hello/
+
+# Edit as needed
+sudo nano /etc/linux-hello/config.toml
+```
+
+**Default Configuration** (`/etc/linux-hello/config.toml`):
+
+```toml
+[general]
+log_level = "info"
+timeout_seconds = 5
+
+[camera]
+device = "auto"  # or /dev/video2
+ir_emitter = "auto"
+resolution = [640, 480]
+fps = 30
+
+[detection]
+model = "blazeface"
+min_face_size = 80
+confidence_threshold = 0.9
+
+[embedding]
+model = "mobilefacenet"
+distance_threshold = 0.6
+
+[anti_spoofing]
+enabled = true
+depth_check = true
+liveness_model = true
+temporal_check = true
+min_score = 0.7
+
+[tpm]
+enabled = true
+pcr_binding = false
+```
+
+### PAM Configuration
+
+Add to `/etc/pam.d/common-auth` (Debian/Ubuntu) or equivalent:
+
+```
+# Linux Hello face authentication
+auth    sufficient    pam_linux_hello.so timeout=5 fallback=password
+```
+
+---
+
+## Testing Strategy
+
+### Unit Tests
+
+```bash
+cargo test                    # Rust unit tests
+make -C pam-module test       # PAM module tests
+```
+
+### Integration Tests
+
+```bash
+# Requires camera hardware
+./tests/integration/run.sh
+
+# Tests:
+# - Camera detection
+# - IR emitter control
+# - Face detection pipeline
+# - Enrollment flow
+# - Authentication flow
+# - Anti-spoofing (with test images)
+```
+
+### Security Tests
+
+```bash
+# Spoofing test suite
+./tests/security/spoof_test.sh
+
+# Includes:
+# - Printed photo attack
+# - Screen display attack
+# - Video replay attack
+# - 3D printed mask (requires physical mask)
+```
+
+### Performance Benchmarks
+
+```bash
+cargo bench                   # Microbenchmarks
+./tests/perf/e2e_latency.sh   # End-to-end timing
+```
+
+---
+
+## Threat Model
+
+### In Scope
+
+| Attacker | Capabilities | Mitigation |
+|----------|--------------|------------|
+| Remote attacker | Network access only | Face auth is local-only |
+| Local user (unprivileged) | Shell access | Unix permissions, polkit |
+| Physical attacker (laptop off) | Full physical access | TPM binding |
+| Physical attacker (laptop on) | Brief physical access | Timeout, lockout |
+| Photo attacker | Has victim's photo | IR camera, depth check |
+| Video attacker | Has victim's video | Liveness detection |
+| Mask attacker | Has 3D print of victim | Temporal analysis |
+| Twin/lookalike | Genetic similarity | Embedding threshold |
+
+### Out of Scope
+
+| Attacker | Why |
+|----------|-----|
+| Nation-state with TPM exploits | Too sophisticated, use password |
+| Evil maid with unlimited time | Can't defend, use FDE + password |
+| Attacker who can compel biometrics | Legal issue, not technical |
+| Deepfake video on IR screen | Unlikely attack vector, revisit if needed |
+
+### Security Invariants
+
+1. Face templates MUST never exist unencrypted on disk
+2. Templates MUST be bound to this device's TPM
+3. Authentication MUST fail closed (any error → reject)
+4. Anti-spoofing MUST run before embedding comparison
+5. Frame data MUST be zeroized after use
+
+---
+
+## Contributing
+
+### Code of Conduct
+
+We follow the [Contributor Covenant](https://www.contributor-covenant.org/).
+
+### Getting Started
+
+1. Fork the repository
+2. Create a feature branch (`git checkout -b feature/amazing-feature`)
+3. Write tests for your changes
+4. Ensure all tests pass (`cargo test && make -C pam-module test`)
+5. Run lints (`cargo clippy && cargo fmt --check`)
+6. Commit your changes (`git commit -m 'Add amazing feature'`)
+7. Push to the branch (`git push origin feature/amazing-feature`)
+8. Open a Pull Request
+
+### Code Style
+
+- Rust: Follow `rustfmt` defaults
+- C: Follow Linux kernel style
+- Commits: Conventional Commits format
+
+### Security Issues
+
+Report security vulnerabilities privately to: security@<project-domain>.org
+
+Do NOT open public issues for security vulnerabilities.
+
+---
+
+## License
+
+This project is licensed under the **GNU General Public License v3.0** — see [LICENSE](LICENSE) for details.
+
+TPM integration code may have additional licensing considerations due to TCG specifications.
+
+---
+
+## Acknowledgments
+
+- [Howdy](https://github.com/boltgolt/howdy) — inspiration and proof of concept
+- [linux-enable-ir-emitter](https://github.com/EmixamPP/linux-enable-ir-emitter) — IR emitter research
+- [dlib](http://dlib.net/) — face recognition foundations
+- [ONNX Runtime](https://onnxruntime.ai/) — cross-platform ML inference
+
+---
+
+## Contact
+
+- Project Lead: [TBD]
+- Mailing List: [TBD]
+- Matrix/IRC: [TBD]
+
+---
+
+*Last updated: January 2026*
\ No newline at end of file
diff --git a/dist/config.toml b/dist/config.toml
new file mode 100644
index 0000000..46477a4
--- /dev/null
+++ b/dist/config.toml
@@ -0,0 +1,50 @@
+# Linux Hello Configuration
+# 
+# Default configuration file for the Linux Hello daemon.
+# Location: /etc/linux-hello/config.toml
+
+[general]
+log_level = "info"
+timeout_seconds = 5
+
+[camera]
+# "auto" for automatic detection, or specify path like "/dev/video2"
+device = "auto"
+# "auto" for automatic detection of IR emitter controls
+ir_emitter = "auto"
+# Resolution [width, height]
+resolution = [640, 480]
+# Frames per second
+fps = 30
+
+[detection]
+# Face detection model: "blazeface" or "retinaface"
+model = "blazeface"
+# Minimum face size in pixels
+min_face_size = 80
+# Detection confidence threshold (0-1)
+confidence_threshold = 0.9
+
+[embedding]
+# Face embedding model: "mobilefacenet" or "arcface"
+model = "mobilefacenet"
+# Distance threshold for matching (lower = stricter)
+distance_threshold = 0.6
+
+[anti_spoofing]
+# Enable anti-spoofing checks
+enabled = true
+# Enable depth estimation check
+depth_check = true
+# Enable liveness ML model
+liveness_model = true
+# Enable temporal (motion) analysis
+temporal_check = true
+# Minimum anti-spoofing score (0-1)
+min_score = 0.7
+
+[tpm]
+# Enable TPM-backed template encryption
+enabled = true
+# Bind to PCR values (enhanced security, may cause issues with dual-boot)
+pcr_binding = false
diff --git a/dist/linux-hello.service b/dist/linux-hello.service
new file mode 100644
index 0000000..29c3505
--- /dev/null
+++ b/dist/linux-hello.service
@@ -0,0 +1,40 @@
+[Unit]
+Description=Linux Hello Face Authentication Daemon
+Documentation=https://github.com/linux-hello/linux-hello
+After=multi-user.target
+
+[Service]
+Type=simple
+ExecStart=/usr/libexec/linux-hello-daemon
+Restart=on-failure
+RestartSec=5
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+MemoryDenyWriteExecute=false
+LockPersonality=true
+
+# Allow access to required devices
+DeviceAllow=/dev/video* rw
+DeviceAllow=/dev/tpm* rw
+DeviceAllow=/dev/tpmrm* rw
+
+# Allow network for D-Bus
+RestrictAddressFamilies=AF_UNIX
+
+# State directory
+StateDirectory=linux-hello
+RuntimeDirectory=linux-hello
+ConfigurationDirectory=linux-hello
+
+[Install]
+WantedBy=multi-user.target
diff --git a/linux-hello-cli/Cargo.toml b/linux-hello-cli/Cargo.toml
new file mode 100644
index 0000000..64fd592
--- /dev/null
+++ b/linux-hello-cli/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "linux-hello-cli"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Linux Hello command-line interface"
+
+[[bin]]
+name = "linux-hello"
+path = "src/main.rs"
+
+[dependencies]
+linux-hello-common = { path = "../linux-hello-common" }
+linux-hello-daemon = { path = "../linux-hello-daemon" }
+
+thiserror.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+toml.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+tokio.workspace = true
+clap.workspace = true
+image.workspace = true
diff --git a/linux-hello-cli/src/main.rs b/linux-hello-cli/src/main.rs
new file mode 100644
index 0000000..eca8b13
--- /dev/null
+++ b/linux-hello-cli/src/main.rs
@@ -0,0 +1,373 @@
+//! Linux Hello CLI
+//!
+//! Command-line interface for enrollment, testing, and diagnostics.
+
+use clap::{Parser, Subcommand};
+use linux_hello_common::{Config, Result};
+use tracing::{info, Level};
+use tracing_subscriber::FmtSubscriber;
+
+#[derive(Parser)]
+#[command(name = "linux-hello")]
+#[command(author, version, about = "Linux Hello facial authentication", long_about = None)]
+struct Cli {
+    /// Enable verbose output
+    #[arg(short, long)]
+    verbose: bool,
+
+    #[command(subcommand)]
+    command: Commands,
+}
+
+#[derive(Subcommand)]
+enum Commands {
+    /// Capture frames from IR camera (for testing)
+    Capture {
+        /// Output directory for captured frames
+        #[arg(short, long, default_value = ".")]
+        output: String,
+
+        /// Number of frames to capture
+        #[arg(short, long, default_value = "5")]
+        count: u32,
+
+        /// Camera device path (auto-detect if not specified)
+        #[arg(short, long)]
+        device: Option<String>,
+    },
+
+    /// Test face detection on camera or image
+    Detect {
+        /// Image file to process (use camera if not specified)
+        #[arg(short, long)]
+        image: Option<String>,
+
+        /// Show detection confidence scores
+        #[arg(long)]
+        scores: bool,
+
+        /// Save annotated output image
+        #[arg(short, long)]
+        output: Option<String>,
+    },
+
+    /// Show system status
+    Status {
+        /// Include camera diagnostics
+        #[arg(long)]
+        camera: bool,
+
+        /// Include daemon status
+        #[arg(long)]
+        daemon: bool,
+    },
+
+    /// Enroll a face model
+    Enroll {
+        /// Label for this enrollment
+        #[arg(short, long, default_value = "default")]
+        label: String,
+    },
+
+    /// List enrolled face models
+    List,
+
+    /// Remove enrolled face models
+    Remove {
+        /// Label to remove (or --all for all)
+        label: Option<String>,
+
+        /// Remove all enrolled models
+        #[arg(long)]
+        all: bool,
+    },
+
+    /// Test authentication
+    Test {
+        /// Show detailed confidence scores
+        #[arg(long)]
+        verbose: bool,
+
+        /// Save debug information
+        #[arg(long)]
+        debug: bool,
+    },
+
+    /// Show or modify configuration
+    Config {
+        /// Show config as JSON
+        #[arg(long)]
+        json: bool,
+
+        /// Set a configuration value (key=value)
+        #[arg(long)]
+        set: Option<String>,
+    },
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cli = Cli::parse();
+
+    // Initialize logging
+    let log_level = if cli.verbose { Level::DEBUG } else { Level::INFO };
+    FmtSubscriber::builder()
+        .with_max_level(log_level)
+        .with_target(false)
+        .init();
+
+    // Load configuration
+    let config = Config::load_or_default();
+
+    match cli.command {
+        Commands::Capture { output, count, device } => {
+            cmd_capture(&config, &output, count, device.as_deref()).await
+        }
+        Commands::Detect { image, scores, output } => {
+            cmd_detect(&config, image.as_deref(), scores, output.as_deref()).await
+        }
+        Commands::Status { camera, daemon } => {
+            cmd_status(&config, camera, daemon).await
+        }
+        Commands::Enroll { label } => {
+            cmd_enroll(&config, &label).await
+        }
+        Commands::List => {
+            cmd_list(&config).await
+        }
+        Commands::Remove { label, all } => {
+            cmd_remove(&config, label.as_deref(), all).await
+        }
+        Commands::Test { verbose, debug } => {
+            cmd_test(&config, verbose, debug).await
+        }
+        Commands::Config { json, set } => {
+            cmd_config(&config, json, set.as_deref()).await
+        }
+    }
+}
+
+async fn cmd_capture(
+    _config: &Config,
+    output: &str,
+    count: u32,
+    device: Option<&str>,
+) -> Result<()> {
+    info!("Capturing {} frames to {}", count, output);
+
+    #[cfg(target_os = "linux")]
+    use linux_hello_daemon::camera::{enumerate_cameras, Camera};
+    #[cfg(not(target_os = "linux"))]
+    use linux_hello_daemon::camera::{enumerate_cameras, Camera};
+
+    use linux_hello_daemon::PixelFormat;
+
+    // Find camera
+    let device_path = match device {
+        Some(d) => d.to_string(),
+        None => {
+            let cameras = enumerate_cameras()?;
+            let ir_cam = cameras.iter().find(|c| c.is_ir);
+            let cam = ir_cam.or(cameras.first());
+
+            match cam {
+                Some(c) => {
+                    info!("Using camera: {}", c);
+                    c.device_path.clone()
+                }
+                None => {
+                    return Err(linux_hello_common::Error::NoCameraFound);
+                }
+            }
+        }
+    };
+
+    // Open camera and capture
+    let mut camera = Camera::open(&device_path)?;
+    info!("Camera opened, resolution: {:?}", camera.resolution());
+
+    // Create output directory if it doesn't exist
+    std::fs::create_dir_all(output)?;
+
+    for i in 0..count {
+        let frame = camera.capture_frame()?;
+        
+        match frame.format {
+            PixelFormat::Grey => {
+                let filename = format!("{}/frame_{:03}.png", output, i);
+                if let Some(img) = image::GrayImage::from_raw(frame.width, frame.height, frame.data) {
+                    img.save(&filename).map_err(|e| linux_hello_common::Error::Io(std::io::Error::new(std::io::ErrorKind::Other, e)))?;
+                    info!("Saved frame {} (Permissions: Grey)", filename);
+                }
+            }
+            PixelFormat::Yuyv => {
+                // TODO: Convert YUYV to RGB/Gray
+                let filename = format!("{}/frame_{:03}.raw", output, i);
+                std::fs::write(&filename, &frame.data)?;
+                info!("Saved frame {} ({} bytes - Raw YUYV)", filename, frame.data.len());
+            }
+            _ => {
+                let filename = format!("{}/frame_{:03}.raw", output, i);
+                std::fs::write(&filename, &frame.data)?;
+                info!("Saved frame {} ({} bytes - Unknown format)", filename, frame.data.len());
+            }
+        }
+    }
+
+    info!("Capture complete");
+
+    Ok(())
+}
+
+async fn cmd_detect(
+    _config: &Config,
+    image: Option<&str>,
+    show_scores: bool,
+    output: Option<&str>,
+) -> Result<()> {
+    match image {
+        Some(path) => {
+            info!("Detecting faces in: {}", path);
+
+            // Load image
+            let img = image::open(path)
+                .map_err(|e| linux_hello_common::Error::Detection(e.to_string()))?;
+
+            let gray = img.to_luma8();
+            let (width, height) = gray.dimensions();
+
+            // Run simple detection (placeholder)
+            use linux_hello_daemon::detection::detect_face_simple;
+            let detection = detect_face_simple(gray.as_raw(), width, height);
+
+            match detection {
+                Some(det) => {
+                    let (x, y, w, h) = det.to_pixels(width, height);
+                    println!("Face detected:");
+                    println!("  Position: ({}, {})", x, y);
+                    println!("  Size: {}x{}", w, h);
+                    if show_scores {
+                        println!("  Confidence: {:.2}%", det.confidence * 100.0);
+                    }
+
+                    if let Some(out_path) = output {
+                        info!("Saving annotated image to: {}", out_path);
+                        // TODO: Draw bounding box and save
+                    }
+                }
+                None => {
+                    println!("No face detected");
+                }
+            }
+        }
+        None => {
+            println!("Live camera detection not yet implemented");
+            println!("Use --image to detect in an image file");
+        }
+    }
+
+    Ok(())
+}
+
+async fn cmd_status(config: &Config, show_camera: bool, show_daemon: bool) -> Result<()> {
+    println!("Linux Hello Status");
+    println!("==================");
+
+    if show_camera || (!show_camera && !show_daemon) {
+        println!("\nCamera:");
+
+        #[cfg(target_os = "linux")]
+        {
+            use linux_hello_daemon::camera::enumerate_cameras;
+            match enumerate_cameras() {
+                Ok(cameras) => {
+                    if cameras.is_empty() {
+                        println!("  No cameras found");
+                    } else {
+                        for cam in cameras {
+                            println!("  - {}", cam);
+                            if !cam.resolutions.is_empty() {
+                                println!(
+                                    "    Resolutions: {:?}",
+                                    cam.resolutions.iter().take(3).collect::<Vec<_>>()
+                                );
+                            }
+                        }
+                    }
+                }
+                Err(e) => {
+                    println!("  Error: {}", e);
+                }
+            }
+        }
+
+        #[cfg(not(target_os = "linux"))]
+        println!("  Camera detection requires Linux");
+    }
+
+    if show_daemon || (!show_camera && !show_daemon) {
+        println!("\nDaemon:");
+        // TODO: Check daemon via D-Bus
+        println!("  Status: Unknown (D-Bus not implemented)");
+    }
+
+    println!("\nConfiguration:");
+    println!("  Detection model: {}", config.detection.model);
+    println!("  Anti-spoofing: {}", if config.anti_spoofing.enabled { "enabled" } else { "disabled" });
+    println!("  TPM: {}", if config.tpm.enabled { "enabled" } else { "disabled" });
+
+    Ok(())
+}
+
+async fn cmd_enroll(_config: &Config, label: &str) -> Result<()> {
+    println!("Enrollment not yet implemented");
+    println!("Would enroll with label: {}", label);
+    Ok(())
+}
+
+async fn cmd_list(_config: &Config) -> Result<()> {
+    println!("Enrolled models:");
+    println!("  (none - enrollment not yet implemented)");
+    Ok(())
+}
+
+async fn cmd_remove(_config: &Config, label: Option<&str>, all: bool) -> Result<()> {
+    if all {
+        println!("Would remove ALL enrolled models");
+    } else if let Some(l) = label {
+        println!("Would remove model: {}", l);
+    } else {
+        println!("Specify a label or --all");
+    }
+    Ok(())
+}
+
+async fn cmd_test(_config: &Config, verbose: bool, debug: bool) -> Result<()> {
+    println!("Authentication test not yet implemented");
+    if verbose {
+        println!("  (would show confidence scores)");
+    }
+    if debug {
+        println!("  (would save debug frames)");
+    }
+    Ok(())
+}
+
+async fn cmd_config(config: &Config, json: bool, set: Option<&str>) -> Result<()> {
+    if let Some(kv) = set {
+        println!("Setting config values not yet implemented: {}", kv);
+        return Ok(());
+    }
+
+    if json {
+        let json = serde_json::to_string_pretty(config)
+            .map_err(|e| linux_hello_common::Error::Serialization(e.to_string()))?;
+        println!("{}", json);
+    } else {
+        let toml = toml::to_string_pretty(config)
+            .map_err(|e| linux_hello_common::Error::Serialization(e.to_string()))?;
+        println!("{}", toml);
+    }
+
+    Ok(())
+}
diff --git a/linux-hello-common/Cargo.toml b/linux-hello-common/Cargo.toml
new file mode 100644
index 0000000..5516ae1
--- /dev/null
+++ b/linux-hello-common/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "linux-hello-common"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Shared types and utilities for Linux Hello"
+
+[dependencies]
+thiserror.workspace = true
+serde.workspace = true
+toml.workspace = true
+tracing.workspace = true
diff --git a/linux-hello-common/src/config.rs b/linux-hello-common/src/config.rs
new file mode 100644
index 0000000..1680247
--- /dev/null
+++ b/linux-hello-common/src/config.rs
@@ -0,0 +1,237 @@
+//! Configuration for Linux Hello
+
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+
+use crate::error::{Error, Result};
+
+/// Main configuration structure
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Config {
+    #[serde(default)]
+    pub general: GeneralConfig,
+    #[serde(default)]
+    pub camera: CameraConfig,
+    #[serde(default)]
+    pub detection: DetectionConfig,
+    #[serde(default)]
+    pub embedding: EmbeddingConfig,
+    #[serde(default)]
+    pub anti_spoofing: AntiSpoofingConfig,
+    #[serde(default)]
+    pub tpm: TpmConfig,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GeneralConfig {
+    #[serde(default = "default_log_level")]
+    pub log_level: String,
+    #[serde(default = "default_timeout")]
+    pub timeout_seconds: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CameraConfig {
+    #[serde(default = "default_auto")]
+    pub device: String,
+    #[serde(default = "default_auto")]
+    pub ir_emitter: String,
+    #[serde(default = "default_resolution")]
+    pub resolution: [u32; 2],
+    #[serde(default = "default_fps")]
+    pub fps: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DetectionConfig {
+    #[serde(default = "default_model")]
+    pub model: String,
+    #[serde(default = "default_min_face_size")]
+    pub min_face_size: u32,
+    #[serde(default = "default_confidence_threshold")]
+    pub confidence_threshold: f32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct EmbeddingConfig {
+    #[serde(default = "default_embedding_model")]
+    pub model: String,
+    #[serde(default = "default_distance_threshold")]
+    pub distance_threshold: f32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AntiSpoofingConfig {
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    #[serde(default = "default_true")]
+    pub depth_check: bool,
+    #[serde(default = "default_true")]
+    pub liveness_model: bool,
+    #[serde(default = "default_true")]
+    pub temporal_check: bool,
+    #[serde(default = "default_min_score")]
+    pub min_score: f32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TpmConfig {
+    #[serde(default = "default_true")]
+    pub enabled: bool,
+    #[serde(default)]
+    pub pcr_binding: bool,
+}
+
+// Default value functions
+fn default_log_level() -> String {
+    "info".to_string()
+}
+fn default_timeout() -> u32 {
+    5
+}
+fn default_auto() -> String {
+    "auto".to_string()
+}
+fn default_resolution() -> [u32; 2] {
+    [640, 480]
+}
+fn default_fps() -> u32 {
+    30
+}
+fn default_model() -> String {
+    "blazeface".to_string()
+}
+fn default_min_face_size() -> u32 {
+    80
+}
+fn default_confidence_threshold() -> f32 {
+    0.9
+}
+fn default_embedding_model() -> String {
+    "mobilefacenet".to_string()
+}
+fn default_distance_threshold() -> f32 {
+    0.6
+}
+fn default_true() -> bool {
+    true
+}
+fn default_min_score() -> f32 {
+    0.7
+}
+
+impl Default for GeneralConfig {
+    fn default() -> Self {
+        Self {
+            log_level: default_log_level(),
+            timeout_seconds: default_timeout(),
+        }
+    }
+}
+
+impl Default for CameraConfig {
+    fn default() -> Self {
+        Self {
+            device: default_auto(),
+            ir_emitter: default_auto(),
+            resolution: default_resolution(),
+            fps: default_fps(),
+        }
+    }
+}
+
+impl Default for DetectionConfig {
+    fn default() -> Self {
+        Self {
+            model: default_model(),
+            min_face_size: default_min_face_size(),
+            confidence_threshold: default_confidence_threshold(),
+        }
+    }
+}
+
+impl Default for EmbeddingConfig {
+    fn default() -> Self {
+        Self {
+            model: default_embedding_model(),
+            distance_threshold: default_distance_threshold(),
+        }
+    }
+}
+
+impl Default for AntiSpoofingConfig {
+    fn default() -> Self {
+        Self {
+            enabled: default_true(),
+            depth_check: default_true(),
+            liveness_model: default_true(),
+            temporal_check: default_true(),
+            min_score: default_min_score(),
+        }
+    }
+}
+
+impl Default for TpmConfig {
+    fn default() -> Self {
+        Self {
+            enabled: default_true(),
+            pcr_binding: false,
+        }
+    }
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Self {
+            general: GeneralConfig::default(),
+            camera: CameraConfig::default(),
+            detection: DetectionConfig::default(),
+            embedding: EmbeddingConfig::default(),
+            anti_spoofing: AntiSpoofingConfig::default(),
+            tpm: TpmConfig::default(),
+        }
+    }
+}
+
+impl Config {
+    /// Load configuration from a TOML file
+    pub fn load<P: AsRef<Path>>(path: P) -> Result<Self> {
+        let content = std::fs::read_to_string(path)?;
+        toml::from_str(&content).map_err(|e| Error::Config(e.to_string()))
+    }
+
+    /// Load configuration from the default path or return defaults
+    pub fn load_or_default() -> Self {
+        Self::load("/etc/linux-hello/config.toml").unwrap_or_default()
+    }
+
+    /// Save configuration to a TOML file
+    pub fn save<P: AsRef<Path>>(&self, path: P) -> Result<()> {
+        let content = toml::to_string_pretty(self).map_err(|e| Error::Serialization(e.to_string()))?;
+        std::fs::write(path, content)?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_default_config() {
+        let config = Config::default();
+        assert_eq!(config.general.log_level, "info");
+        assert_eq!(config.general.timeout_seconds, 5);
+        assert_eq!(config.camera.device, "auto");
+        assert_eq!(config.camera.resolution, [640, 480]);
+        assert!(config.anti_spoofing.enabled);
+    }
+
+    #[test]
+    fn test_config_serialization() {
+        let config = Config::default();
+        let toml_str = toml::to_string(&config).unwrap();
+        let parsed: Config = toml::from_str(&toml_str).unwrap();
+        assert_eq!(parsed.general.log_level, config.general.log_level);
+    }
+}
diff --git a/linux-hello-common/src/error.rs b/linux-hello-common/src/error.rs
new file mode 100644
index 0000000..a5a87ce
--- /dev/null
+++ b/linux-hello-common/src/error.rs
@@ -0,0 +1,63 @@
+//! Error types for Linux Hello
+
+use thiserror::Error;
+
+/// Main error type for Linux Hello
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("Camera error: {0}")]
+    Camera(String),
+
+    #[error("No IR camera found")]
+    NoCameraFound,
+
+    #[error("IR emitter control failed: {0}")]
+    IrEmitter(String),
+
+    #[error("Face detection error: {0}")]
+    Detection(String),
+
+    #[error("No face detected in frame")]
+    NoFaceDetected,
+
+    #[error("Multiple faces detected")]
+    MultipleFacesDetected,
+
+    #[error("Model loading error: {0}")]
+    ModelLoad(String),
+
+    #[error("Configuration error: {0}")]
+    Config(String),
+
+    #[error("TPM error: {0}")]
+    Tpm(String),
+
+    #[error("Authentication failed")]
+    AuthenticationFailed,
+
+    #[error("User not enrolled: {0}")]
+    UserNotEnrolled(String),
+
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("Serialization error: {0}")]
+    Serialization(String),
+}
+
+/// Result type alias for Linux Hello
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_error_display() {
+        let err = Error::NoCameraFound;
+        assert_eq!(err.to_string(), "No IR camera found");
+
+        let err = Error::Camera("device busy".to_string());
+        assert_eq!(err.to_string(), "Camera error: device busy");
+    }
+}
diff --git a/linux-hello-common/src/lib.rs b/linux-hello-common/src/lib.rs
new file mode 100644
index 0000000..0e82ca1
--- /dev/null
+++ b/linux-hello-common/src/lib.rs
@@ -0,0 +1,10 @@
+//! Linux Hello Common Library
+//!
+//! Shared types, configuration, and error handling for the Linux Hello
+//! facial authentication system.
+
+pub mod config;
+pub mod error;
+
+pub use config::Config;
+pub use error::{Error, Result};
diff --git a/linux-hello-daemon/Cargo.toml b/linux-hello-daemon/Cargo.toml
new file mode 100644
index 0000000..2346dd6
--- /dev/null
+++ b/linux-hello-daemon/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "linux-hello-daemon"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Linux Hello authentication daemon"
+
+[lib]
+name = "linux_hello_daemon"
+path = "src/lib.rs"
+
+[[bin]]
+name = "linux-hello-daemon"
+path = "src/main.rs"
+
+[dependencies]
+linux-hello-common = { path = "../linux-hello-common" }
+
+thiserror.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+tokio.workspace = true
+
+# Image processing
+image.workspace = true
+
+# ML inference - temporarily disabled until ort 2.0 stable
+# ort.workspace = true
+# ndarray.workspace = true
+
+# Camera (Linux-only)
+[target.'cfg(target_os = "linux")'.dependencies]
+v4l.workspace = true
diff --git a/linux-hello-daemon/src/camera/ir_emitter.rs b/linux-hello-daemon/src/camera/ir_emitter.rs
new file mode 100644
index 0000000..c045ccb
--- /dev/null
+++ b/linux-hello-daemon/src/camera/ir_emitter.rs
@@ -0,0 +1,139 @@
+//! IR Emitter Control
+//!
+//! Controls IR emitters on cameras using UVC extension units.
+
+use linux_hello_common::{Error, Result};
+
+/// IR emitter controller
+pub struct IrEmitterControl {
+    /// Device path
+    device_path: String,
+    /// Whether the emitter is currently active
+    active: bool,
+}
+
+impl IrEmitterControl {
+    /// Create a new IR emitter controller for a device
+    pub fn new(device_path: &str) -> Self {
+        Self {
+            device_path: device_path.to_string(),
+            active: false,
+        }
+    }
+
+    /// Attempt to enable the IR emitter
+    #[cfg(target_os = "linux")]
+    pub fn enable(&mut self) -> Result<()> {
+        // IR emitter control is hardware-specific and typically requires:
+        // 1. Finding the correct UVC extension unit
+        // 2. Sending the correct control value
+        //
+        // Common methods:
+        // - UVC XU control via v4l2-ctl
+        // - Direct ioctl with vendor-specific control IDs
+        // - libusb for USB control transfers
+        //
+        // Reference: https://github.com/EmixamPP/linux-enable-ir-emitter
+
+        tracing::info!("Enabling IR emitter for {}", self.device_path);
+
+        // Try common UVC extension unit controls
+        // This is a placeholder - real implementation needs hardware testing
+
+        // Method 1: Try using v4l2-ctl
+        let output = std::process::Command::new("v4l2-ctl")
+            .args([
+                "-d",
+                &self.device_path,
+                "--set-ctrl",
+                "led1_mode=1", // Common LED control
+            ])
+            .output();
+
+        match output {
+            Ok(out) if out.status.success() => {
+                self.active = true;
+                tracing::info!("IR emitter enabled via v4l2-ctl");
+                return Ok(());
+            }
+            _ => {
+                // Try alternative control names
+                tracing::debug!("led1_mode control not available, trying alternatives");
+            }
+        }
+
+        // Method 2: Try power_line_frequency (some cameras use this)
+        let _ = std::process::Command::new("v4l2-ctl")
+            .args(["-d", &self.device_path, "--set-ctrl", "power_line_frequency=2"])
+            .output();
+
+        // For now, assume emitter is enabled (some cameras have always-on emitters)
+        self.active = true;
+        tracing::warn!(
+            "Could not confirm IR emitter enable - assuming active for {}",
+            self.device_path
+        );
+
+        Ok(())
+    }
+
+    /// Attempt to disable the IR emitter
+    #[cfg(target_os = "linux")]
+    pub fn disable(&mut self) -> Result<()> {
+        tracing::info!("Disabling IR emitter for {}", self.device_path);
+
+        let _ = std::process::Command::new("v4l2-ctl")
+            .args(["-d", &self.device_path, "--set-ctrl", "led1_mode=0"])
+            .output();
+
+        self.active = false;
+        Ok(())
+    }
+
+    /// Check if emitter is active
+    pub fn is_active(&self) -> bool {
+        self.active
+    }
+
+    /// Platform stub for non-Linux
+    #[cfg(not(target_os = "linux"))]
+    pub fn enable(&mut self) -> Result<()> {
+        Err(Error::IrEmitter("Not available on this platform".into()))
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    pub fn disable(&mut self) -> Result<()> {
+        Err(Error::IrEmitter("Not available on this platform".into()))
+    }
+}
+
+/// Scan for IR emitter capabilities on a device
+#[cfg(target_os = "linux")]
+pub fn scan_emitter_controls(device_path: &str) -> Vec<String> {
+    let mut controls = Vec::new();
+
+    // Query available controls
+    if let Ok(output) = std::process::Command::new("v4l2-ctl")
+        .args(["-d", device_path, "--list-ctrls"])
+        .output()
+    {
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        for line in stdout.lines() {
+            let lower = line.to_lowercase();
+            if lower.contains("led")
+                || lower.contains("ir")
+                || lower.contains("emitter")
+                || lower.contains("infrared")
+            {
+                controls.push(line.trim().to_string());
+            }
+        }
+    }
+
+    controls
+}
+
+#[cfg(not(target_os = "linux"))]
+pub fn scan_emitter_controls(_device_path: &str) -> Vec<String> {
+    Vec::new()
+}
diff --git a/linux-hello-daemon/src/camera/linux.rs b/linux-hello-daemon/src/camera/linux.rs
new file mode 100644
index 0000000..d70eefe
--- /dev/null
+++ b/linux-hello-daemon/src/camera/linux.rs
@@ -0,0 +1,230 @@
+//! Linux V4L2 Camera Implementation
+//!
+//! Camera enumeration and frame capture using Video4Linux2.
+
+use v4l::buffer::Type;
+use v4l::io::mmap::Stream;
+use v4l::io::traits::CaptureStream;
+use v4l::prelude::*;
+use v4l::video::Capture;
+use v4l::{Device, FourCC};
+
+use linux_hello_common::{Error, Result};
+
+use super::{CameraInfo, Frame, PixelFormat};
+
+/// Enumerate all available V4L2 camera devices
+pub fn enumerate_cameras() -> Result<Vec<CameraInfo>> {
+    let mut cameras = Vec::new();
+
+    // Scan /dev/video* devices
+    for i in 0..16 {
+        let path = format!("/dev/video{}", i);
+        if let Ok(device) = Device::new(i) {
+            if let Ok(caps) = device.query_caps() {
+                // Only include capture devices
+                if caps.capabilities.contains(v4l::capability::Flags::VIDEO_CAPTURE) {
+                    let name = caps.card.clone();
+                    let is_ir = detect_ir_camera(&name, &device);
+                    let resolutions = get_supported_resolutions(&device);
+
+                    cameras.push(CameraInfo {
+                        device_path: path,
+                        name,
+                        is_ir,
+                        resolutions,
+                    });
+                }
+            }
+        }
+    }
+
+    Ok(cameras)
+}
+
+/// Attempt to detect if a camera is an IR camera
+fn detect_ir_camera(name: &str, _device: &Device) -> bool {
+    let name_lower = name.to_lowercase();
+
+    // Common IR camera name patterns
+    let ir_patterns = [
+        "infrared",
+        "ir camera",
+        "ir sensor",
+        "depth",
+        "hello",
+        "3d camera",
+    ];
+
+    for pattern in ir_patterns {
+        if name_lower.contains(pattern) {
+            return true;
+        }
+    }
+
+    // TODO: Check for IR-specific pixel formats (GREY, Y8)
+    // TODO: Try to detect IR emitter capability
+
+    false
+}
+
+/// Get supported resolutions for a device
+fn get_supported_resolutions(device: &Device) -> Vec<(u32, u32)> {
+    let mut resolutions = Vec::new();
+
+    // Try common formats
+    let formats = [
+        FourCC::new(b"GREY"),
+        FourCC::new(b"YUYV"),
+        FourCC::new(b"MJPG"),
+    ];
+
+    for fourcc in formats {
+        if let Ok(sizes) = device.enum_framesizes(fourcc) {
+            for size in sizes {
+                match size.size {
+                    v4l::framesize::FrameSizeEnum::Discrete(d) => {
+                        let res = (d.width, d.height);
+                        if !resolutions.contains(&res) {
+                            resolutions.push(res);
+                        }
+                    }
+                    v4l::framesize::FrameSizeEnum::Stepwise(s) => {
+                        // Just add common resolutions within range
+                        let common = [(640, 480), (1280, 720), (1920, 1080)];
+                        for (w, h) in common {
+                            if w >= s.min_width
+                                && w <= s.max_width
+                                && h >= s.min_height
+                                && h <= s.max_height
+                            {
+                                let res = (w, h);
+                                if !resolutions.contains(&res) {
+                                    resolutions.push(res);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    resolutions
+}
+
+/// V4L2 Camera handle for capturing frames
+pub struct Camera {
+    device: Device,
+    stream: Option<Stream<'static>>,
+    width: u32,
+    height: u32,
+    format: PixelFormat,
+}
+
+impl Camera {
+    /// Open a camera device by path
+    pub fn open(device_path: &str) -> Result<Self> {
+        // Extract device index from path
+        let index: usize = device_path
+            .trim_start_matches("/dev/video")
+            .parse()
+            .map_err(|_| Error::Camera(format!("Invalid device path: {}", device_path)))?;
+
+        let device =
+            Device::new(index).map_err(|e| Error::Camera(format!("Failed to open device: {}", e)))?;
+
+        // Try to set a preferred format
+        let mut format = device
+            .format()
+            .map_err(|e| Error::Camera(format!("Failed to get format: {}", e)))?;
+
+        // Prefer grayscale for IR cameras
+        format.fourcc = FourCC::new(b"GREY");
+        format.width = 640;
+        format.height = 480;
+
+        // Try GREY format first, fall back to YUYV
+        let format = match device.set_format(&format) {
+            Ok(f) => f,
+            Err(_) => {
+                format.fourcc = FourCC::new(b"YUYV");
+                device
+                    .set_format(&format)
+                    .map_err(|e| Error::Camera(format!("Failed to set format: {}", e)))?
+            }
+        };
+
+        let pixel_format = match &format.fourcc.repr {
+            b"GREY" | b"Y8  " => PixelFormat::Grey,
+            b"YUYV" => PixelFormat::Yuyv,
+            b"MJPG" => PixelFormat::Mjpeg,
+            _ => PixelFormat::Unknown,
+        };
+
+        Ok(Self {
+            device,
+            stream: None,
+            width: format.width,
+            height: format.height,
+            format: pixel_format,
+        })
+    }
+
+    /// Start streaming
+    pub fn start(&mut self) -> Result<()> {
+        if self.stream.is_some() {
+            return Ok(());
+        }
+
+        // Need to use unsafe to extend lifetime - the stream borrows device
+        // In production, this should be handled more carefully
+        let device_ptr = &self.device as *const Device;
+        let stream = unsafe {
+            Stream::with_buffers(&*device_ptr, Type::VideoCapture, 4)
+                .map_err(|e| Error::Camera(format!("Failed to create stream: {}", e)))?
+        };
+
+        // Store as 'static - we ensure device outlives stream
+        self.stream = Some(unsafe { std::mem::transmute(stream) });
+
+        Ok(())
+    }
+
+    /// Capture a single frame
+    pub fn capture_frame(&mut self) -> Result<Frame> {
+        if self.stream.is_none() {
+            self.start()?;
+        }
+
+        let stream = self.stream.as_mut().unwrap();
+
+        let (buffer, meta) = stream
+            .next()
+            .map_err(|e| Error::Camera(format!("Failed to capture frame: {}", e)))?;
+
+        Ok(Frame {
+            data: buffer.to_vec(),
+            width: self.width,
+            height: self.height,
+            format: self.format,
+            timestamp_us: meta.timestamp.as_micros() as u64,
+        })
+    }
+
+    /// Stop streaming
+    pub fn stop(&mut self) {
+        self.stream = None;
+    }
+
+    /// Get current resolution
+    pub fn resolution(&self) -> (u32, u32) {
+        (self.width, self.height)
+    }
+}
+
+impl Drop for Camera {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
diff --git a/linux-hello-daemon/src/camera/mod.rs b/linux-hello-daemon/src/camera/mod.rs
new file mode 100644
index 0000000..65cb423
--- /dev/null
+++ b/linux-hello-daemon/src/camera/mod.rs
@@ -0,0 +1,147 @@
+//! Camera Interface Module
+//!
+//! Handles V4L2 camera enumeration, frame capture, and IR camera detection.
+
+#[cfg(target_os = "linux")]
+mod linux;
+mod ir_emitter;
+
+#[cfg(target_os = "linux")]
+pub use linux::*;
+
+pub use ir_emitter::IrEmitterControl;
+
+use linux_hello_common::{Error, Result};
+
+/// Represents a detected camera device
+#[derive(Debug, Clone)]
+pub struct CameraInfo {
+    /// Device path (e.g., /dev/video0)
+    pub device_path: String,
+    /// Human-readable name
+    pub name: String,
+    /// Whether this appears to be an IR camera
+    pub is_ir: bool,
+    /// Supported resolutions
+    pub resolutions: Vec<(u32, u32)>,
+}
+
+impl std::fmt::Display for CameraInfo {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{} ({}){}",
+            self.name,
+            self.device_path,
+            if self.is_ir { " [IR]" } else { "" }
+        )
+    }
+}
+
+/// A captured video frame
+#[derive(Debug)]
+pub struct Frame {
+    /// Raw frame data
+    pub data: Vec<u8>,
+    /// Frame width in pixels
+    pub width: u32,
+    /// Frame height in pixels
+    pub height: u32,
+    /// Pixel format
+    pub format: PixelFormat,
+    /// Timestamp in microseconds
+    pub timestamp_us: u64,
+}
+
+/// Supported pixel formats
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum PixelFormat {
+    /// 8-bit grayscale (Y8/GREY)
+    Grey,
+    /// YUYV (packed YUV 4:2:2)
+    Yuyv,
+    /// MJPEG compressed
+    Mjpeg,
+    /// Unknown format
+    Unknown,
+}
+
+/// Mock Camera implementation for non-Linux platforms
+#[cfg(not(target_os = "linux"))]
+pub fn enumerate_cameras() -> Result<Vec<CameraInfo>> {
+    Ok(vec![
+        CameraInfo {
+            device_path: "mock_cam_0".to_string(),
+            name: "Mock IR Camera".to_string(),
+            is_ir: true,
+            resolutions: vec![(640, 480)],
+        },
+        CameraInfo {
+            device_path: "mock_cam_1".to_string(),
+            name: "Mock WebCam".to_string(),
+            is_ir: false,
+            resolutions: vec![(1280, 720)],
+        },
+    ])
+}
+
+#[cfg(not(target_os = "linux"))]
+pub struct Camera {
+    width: u32,
+    height: u32,
+    frame_count: u64,
+}
+
+#[cfg(not(target_os = "linux"))]
+impl Camera {
+    pub fn open(device: &str) -> Result<Self> {
+        tracing::info!("Opening mock camera: {}", device);
+        Ok(Self {
+            width: 640,
+            height: 480,
+            frame_count: 0,
+        })
+    }
+
+    pub fn start(&mut self) -> Result<()> {
+        tracing::info!("Mock camera started");
+        Ok(())
+    }
+
+    pub fn stop(&mut self) {
+        tracing::info!("Mock camera stopped");
+    }
+
+    pub fn capture_frame(&mut self) -> Result<Frame> {
+        self.frame_count += 1;
+        
+        // Generate a synthetic frame (gradient + noise)
+        let size = (self.width * self.height) as usize;
+        let mut data = Vec::with_capacity(size);
+        
+        let offset = (self.frame_count % 255) as u8;
+        
+        for y in 0..self.height {
+            for x in 0..self.width {
+                // Moving gradient pattern
+                let val = ((x + y + offset as u32) % 255) as u8;
+                data.push(val);
+            }
+        }
+        
+        // Emulate capture delay
+        std::thread::sleep(std::time::Duration::from_millis(33));
+
+        Ok(Frame {
+            data,
+            width: self.width,
+            height: self.height,
+            format: PixelFormat::Grey,
+            timestamp_us: self.frame_count * 33333,
+        })
+    }
+    
+    pub fn resolution(&self) -> (u32, u32) {
+        (self.width, self.height)
+    }
+}
diff --git a/linux-hello-daemon/src/detection/mod.rs b/linux-hello-daemon/src/detection/mod.rs
new file mode 100644
index 0000000..594bda9
--- /dev/null
+++ b/linux-hello-daemon/src/detection/mod.rs
@@ -0,0 +1,135 @@
+//! Face Detection Module
+//!
+//! Face detection types and simple fallback detection.
+//! ONNX-based detection will be added once models are available.
+
+use linux_hello_common::Result;
+
+/// Detected face bounding box
+#[derive(Debug, Clone)]
+pub struct FaceDetection {
+    /// X coordinate of top-left corner (0-1 normalized)
+    pub x: f32,
+    /// Y coordinate of top-left corner (0-1 normalized)
+    pub y: f32,
+    /// Width of bounding box (0-1 normalized)
+    pub width: f32,
+    /// Height of bounding box (0-1 normalized)
+    pub height: f32,
+    /// Detection confidence score (0-1)
+    pub confidence: f32,
+}
+
+impl FaceDetection {
+    /// Convert normalized coordinates to pixel coordinates
+    pub fn to_pixels(&self, img_width: u32, img_height: u32) -> (u32, u32, u32, u32) {
+        let x = (self.x * img_width as f32) as u32;
+        let y = (self.y * img_height as f32) as u32;
+        let w = (self.width * img_width as f32) as u32;
+        let h = (self.height * img_height as f32) as u32;
+        (x, y, w, h)
+    }
+}
+
+/// Face detector trait for different backends
+pub trait FaceDetect {
+    /// Detect faces in a grayscale image
+    fn detect(&self, image_data: &[u8], width: u32, height: u32) -> Result<Vec<FaceDetection>>;
+}
+
+/// Simple face detection using image processing (no ML)
+/// Used as fallback or for testing
+pub fn detect_face_simple(image_data: &[u8], _width: u32, _height: u32) -> Option<FaceDetection> {
+    // Very simple centered face assumption for testing
+    // In production, this would use proper CV techniques
+
+    if image_data.is_empty() {
+        return None;
+    }
+
+    // Calculate image statistics
+    let sum: u64 = image_data.iter().map(|&x| x as u64).sum();
+    let mean = sum / image_data.len() as u64;
+
+    // If image has reasonable contrast, assume face is centered
+    if mean > 30 && mean < 225 {
+        Some(FaceDetection {
+            x: 0.25,
+            y: 0.15,
+            width: 0.5,
+            height: 0.7,
+            confidence: 0.5, // Low confidence for simple detection
+        })
+    } else {
+        None
+    }
+}
+
+/// Placeholder face detector for testing (no ML model required)
+pub struct SimpleFaceDetector {
+    pub confidence_threshold: f32,
+}
+
+impl SimpleFaceDetector {
+    pub fn new(confidence_threshold: f32) -> Self {
+        Self { confidence_threshold }
+    }
+}
+
+impl FaceDetect for SimpleFaceDetector {
+    fn detect(&self, image_data: &[u8], width: u32, height: u32) -> Result<Vec<FaceDetection>> {
+        match detect_face_simple(image_data, width, height) {
+            Some(det) if det.confidence >= self.confidence_threshold => Ok(vec![det]),
+            Some(_) => Ok(vec![]), // Below threshold
+            None => Ok(vec![]),
+        }
+    }
+}
+
+// TODO: Add OnnxFaceDetector once ort API stabilizes
+// The ort 2.0.0-rc API has breaking changes from 1.x
+// Will implement proper ONNX detection in Phase 2
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_face_detection_pixels() {
+        let detection = FaceDetection {
+            x: 0.25,
+            y: 0.1,
+            width: 0.5,
+            height: 0.8,
+            confidence: 0.95,
+        };
+
+        let (x, y, w, h) = detection.to_pixels(640, 480);
+        assert_eq!(x, 160);
+        assert_eq!(y, 48);
+        assert_eq!(w, 320);
+        assert_eq!(h, 384);
+    }
+
+    #[test]
+    fn test_simple_detection() {
+        // Create a simple gradient image
+        let width = 100;
+        let height = 100;
+        let image: Vec<u8> = (0..width * height)
+            .map(|i| ((i % 256) as u8).wrapping_add(50))
+            .collect();
+
+        let detection = detect_face_simple(&image, width as u32, height as u32);
+        assert!(detection.is_some());
+    }
+
+    #[test]
+    fn test_simple_detector_trait() {
+        let detector = SimpleFaceDetector::new(0.3);
+        let image: Vec<u8> = vec![128; 100 * 100]; // Mid-gray image
+
+        let detections = detector.detect(&image, 100, 100).unwrap();
+        assert_eq!(detections.len(), 1);
+    }
+}
diff --git a/linux-hello-daemon/src/lib.rs b/linux-hello-daemon/src/lib.rs
new file mode 100644
index 0000000..da395cb
--- /dev/null
+++ b/linux-hello-daemon/src/lib.rs
@@ -0,0 +1,13 @@
+//! Linux Hello Daemon Library
+//!
+//! Core functionality for camera capture and face detection.
+//! Re-exported for use by the CLI tool.
+
+pub mod camera;
+pub mod detection;
+
+pub use camera::{CameraInfo, Frame, PixelFormat};
+pub use detection::{FaceDetection, detect_face_simple};
+
+#[cfg(target_os = "linux")]
+pub use camera::{enumerate_cameras, Camera};
diff --git a/linux-hello-daemon/src/main.rs b/linux-hello-daemon/src/main.rs
new file mode 100644
index 0000000..6d20034
--- /dev/null
+++ b/linux-hello-daemon/src/main.rs
@@ -0,0 +1,66 @@
+//! Linux Hello Daemon
+//!
+//! Main daemon process for face authentication. Handles camera capture,
+//! face detection, anti-spoofing checks, and template matching.
+
+mod camera;
+mod detection;
+
+use linux_hello_common::{Config, Result};
+use tracing::{info, Level};
+use tracing_subscriber::FmtSubscriber;
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    // Initialize logging
+    let subscriber = FmtSubscriber::builder()
+        .with_max_level(Level::INFO)
+        .with_target(false)
+        .init();
+
+    info!("Linux Hello Daemon starting...");
+
+    // Load configuration
+    let config = Config::load_or_default();
+    info!("Configuration loaded");
+    info!("  Camera device: {}", config.camera.device);
+    info!("  Detection model: {}", config.detection.model);
+    info!("  Anti-spoofing enabled: {}", config.anti_spoofing.enabled);
+
+    // Initialize camera
+    #[cfg(target_os = "linux")]
+    {
+        match camera::enumerate_cameras() {
+            Ok(cameras) => {
+                info!("Found {} camera(s)", cameras.len());
+                for cam in &cameras {
+                    info!("  - {}", cam);
+                }
+            }
+            Err(e) => {
+                tracing::warn!("Camera enumeration failed: {}", e);
+            }
+        }
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    {
+        info!("Camera functions not available on this platform");
+        info!("V4L2 camera support requires Linux");
+    }
+
+    // Initialize face detection
+    info!("Face detection module initialized (placeholder)");
+
+    info!("Linux Hello Daemon ready");
+
+    // TODO: Start D-Bus service
+    // TODO: Listen for authentication requests via Unix socket
+    // TODO: Handle PAM communication
+
+    // Keep running
+    tokio::signal::ctrl_c().await.ok();
+    info!("Linux Hello Daemon shutting down");
+
+    Ok(())
+}
diff --git a/models/README.md b/models/README.md
new file mode 100644
index 0000000..9ef1f4c
--- /dev/null
+++ b/models/README.md
@@ -0,0 +1,41 @@
+# Face Detection Models
+
+This directory contains ONNX model files for face detection and embedding.
+
+## Required Models
+
+### BlazeFace (Face Detection)
+- **File**: `blazeface.onnx`
+- **Purpose**: Fast face detection
+- **Input**: RGB image [1, 3, 128, 128]
+- **Output**: Bounding boxes and confidence scores
+
+Download from: https://github.com/onnx/models/tree/main/vision/body_analysis/ultraface
+
+### MobileFaceNet (Face Embedding)
+- **File**: `mobilefacenet.onnx`
+- **Purpose**: Face feature extraction
+- **Input**: Aligned face [1, 3, 112, 112]
+- **Output**: 128-dimensional embedding
+
+Download from: https://github.com/onnx/models
+
+## Model Conversion
+
+If you have models in other formats, convert to ONNX using:
+
+```bash
+# From TensorFlow
+python -m tf2onnx.convert --saved-model ./model --output model.onnx
+
+# From PyTorch
+import torch
+torch.onnx.export(model, dummy_input, "model.onnx")
+```
+
+## License
+
+Please ensure you comply with the licenses of any models you download:
+- BlazeFace: Apache 2.0
+- MobileFaceNet: MIT
+- ArcFace: MIT
diff --git a/pam-module/Makefile b/pam-module/Makefile
new file mode 100644
index 0000000..57786b5
--- /dev/null
+++ b/pam-module/Makefile
@@ -0,0 +1,45 @@
+# Linux Hello PAM Module Makefile
+#
+# Build the PAM shared library for face authentication
+
+CC = gcc
+CFLAGS = -Wall -Wextra -Werror -fPIC -O2
+LDFLAGS = -shared -lpam
+
+TARGET = pam_linux_hello.so
+SOURCES = pam_linux_hello.c
+OBJECTS = $(SOURCES:.c=.o)
+
+# Installation paths
+DESTDIR ?=
+PAM_DIR = $(DESTDIR)/lib/security
+ifeq ($(shell uname -m),x86_64)
+    PAM_DIR = $(DESTDIR)/lib/x86_64-linux-gnu/security
+endif
+
+.PHONY: all clean install uninstall test
+
+all: $(TARGET)
+
+$(TARGET): $(OBJECTS)
+	$(CC) $(LDFLAGS) -o $@ $^
+
+%.o: %.c
+	$(CC) $(CFLAGS) -c $< -o $@
+
+clean:
+	rm -f $(OBJECTS) $(TARGET)
+
+install: $(TARGET)
+	@echo "Installing $(TARGET) to $(PAM_DIR)"
+	install -d $(PAM_DIR)
+	install -m 755 $(TARGET) $(PAM_DIR)/
+
+uninstall:
+	rm -f $(PAM_DIR)/$(TARGET)
+
+# Basic compilation test
+test: $(TARGET)
+	@echo "PAM module compiled successfully"
+	@file $(TARGET)
+	@nm -D $(TARGET) | grep pam_sm
diff --git a/pam-module/pam_linux_hello.c b/pam-module/pam_linux_hello.c
new file mode 100644
index 0000000..f5eb0bd
--- /dev/null
+++ b/pam-module/pam_linux_hello.c
@@ -0,0 +1,220 @@
+/*
+ * Linux Hello PAM Module
+ *
+ * PAM module for facial authentication using Linux Hello daemon.
+ * Communicates with the daemon via Unix socket to perform face matching.
+ *
+ * Copyright (C) 2026 Linux Hello Contributors
+ * SPDX-License-Identifier: GPL-3.0
+ */
+
+#define _GNU_SOURCE
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <syslog.h>
+#include <errno.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <security/pam_modules.h>
+#include <security/pam_ext.h>
+
+/* Configuration defaults */
+#define DEFAULT_TIMEOUT 5
+#define SOCKET_PATH "/run/linux-hello/auth.sock"
+#define MAX_MESSAGE_SIZE 4096
+
+/* Module options */
+struct module_options {
+    int timeout;
+    int debug;
+    int fallback_password;
+};
+
+/* Parse module arguments */
+static void parse_args(int argc, const char **argv, struct module_options *opts) {
+    int i;
+
+    /* Set defaults */
+    opts->timeout = DEFAULT_TIMEOUT;
+    opts->debug = 0;
+    opts->fallback_password = 0;
+
+    for (i = 0; i < argc; i++) {
+        if (strncmp(argv[i], "timeout=", 8) == 0) {
+            opts->timeout = atoi(argv[i] + 8);
+            if (opts->timeout <= 0) opts->timeout = DEFAULT_TIMEOUT;
+        } else if (strcmp(argv[i], "debug") == 0) {
+            opts->debug = 1;
+        } else if (strcmp(argv[i], "fallback=password") == 0) {
+            opts->fallback_password = 1;
+        }
+    }
+}
+
+/* Send authentication request to daemon */
+static int authenticate_face(pam_handle_t *pamh, const char *user,
+                             struct module_options *opts) {
+    int sockfd;
+    struct sockaddr_un addr;
+    char request[MAX_MESSAGE_SIZE];
+    char response[MAX_MESSAGE_SIZE];
+    ssize_t n;
+    int result = PAM_AUTH_ERR;
+
+    /* Create socket */
+    sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+    if (sockfd < 0) {
+        if (opts->debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Failed to create socket: %s",
+                       strerror(errno));
+        }
+        return PAM_AUTHINFO_UNAVAIL;
+    }
+
+    /* Set socket timeout */
+    struct timeval tv;
+    tv.tv_sec = opts->timeout;
+    tv.tv_usec = 0;
+    setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+    setsockopt(sockfd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+
+    /* Connect to daemon */
+    memset(&addr, 0, sizeof(addr));
+    addr.sun_family = AF_UNIX;
+    strncpy(addr.sun_path, SOCKET_PATH, sizeof(addr.sun_path) - 1);
+
+    if (connect(sockfd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
+        if (opts->debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Failed to connect to daemon: %s",
+                       strerror(errno));
+        }
+        close(sockfd);
+        return PAM_AUTHINFO_UNAVAIL;
+    }
+
+    /* Send authentication request */
+    snprintf(request, sizeof(request), "{\"action\":\"authenticate\",\"user\":\"%s\"}", user);
+
+    n = write(sockfd, request, strlen(request));
+    if (n < 0) {
+        if (opts->debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Failed to send request: %s",
+                       strerror(errno));
+        }
+        close(sockfd);
+        return PAM_AUTHINFO_UNAVAIL;
+    }
+
+    /* Read response */
+    n = read(sockfd, response, sizeof(response) - 1);
+    if (n <= 0) {
+        if (opts->debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Failed to read response: %s",
+                       n < 0 ? strerror(errno) : "timeout");
+        }
+        close(sockfd);
+        return PAM_AUTH_ERR;
+    }
+    response[n] = '\0';
+
+    /* Parse response (simple check) */
+    if (strstr(response, "\"success\":true") != NULL) {
+        result = PAM_SUCCESS;
+        pam_syslog(pamh, LOG_INFO, "Face authentication successful for %s", user);
+    } else {
+        result = PAM_AUTH_ERR;
+        if (opts->debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Face authentication failed for %s", user);
+        }
+    }
+
+    close(sockfd);
+    return result;
+}
+
+/*
+ * PAM authentication entry point
+ */
+PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags,
+                                    int argc, const char **argv) {
+    struct module_options opts;
+    const char *user;
+    int ret;
+
+    /* Parse module arguments */
+    parse_args(argc, argv, &opts);
+
+    /* Get username */
+    ret = pam_get_user(pamh, &user, NULL);
+    if (ret != PAM_SUCCESS || user == NULL || user[0] == '\0') {
+        pam_syslog(pamh, LOG_ERR, "Failed to get username");
+        return PAM_USER_UNKNOWN;
+    }
+
+    if (opts.debug) {
+        pam_syslog(pamh, LOG_DEBUG, "Attempting face authentication for %s", user);
+    }
+
+    /* Attempt face authentication */
+    ret = authenticate_face(pamh, user, &opts);
+
+    /* Handle fallback */
+    if (ret != PAM_SUCCESS && opts.fallback_password) {
+        if (opts.debug) {
+            pam_syslog(pamh, LOG_DEBUG, "Face auth failed, allowing password fallback");
+        }
+        /* Return ignore to let other modules (password) try */
+        return PAM_IGNORE;
+    }
+
+    return ret;
+}
+
+/*
+ * PAM credential management (no-op for face auth)
+ */
+PAM_EXTERN int pam_sm_setcred(pam_handle_t *pamh, int flags,
+                              int argc, const char **argv) {
+    (void)pamh;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+    return PAM_SUCCESS;
+}
+
+/*
+ * PAM account management (no-op)
+ */
+PAM_EXTERN int pam_sm_acct_mgmt(pam_handle_t *pamh, int flags,
+                                 int argc, const char **argv) {
+    (void)pamh;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+    return PAM_SUCCESS;
+}
+
+/*
+ * PAM session management (no-op)
+ */
+PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
+                                    int argc, const char **argv) {
+    (void)pamh;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+    return PAM_SUCCESS;
+}
+
+PAM_EXTERN int pam_sm_close_session(pam_handle_t *pamh, int flags,
+                                     int argc, const char **argv) {
+    (void)pamh;
+    (void)flags;
+    (void)argc;
+    (void)argv;
+    return PAM_SUCCESS;
+}