[boburning]

Summary Implements the host-safe NET-03 Wi-Fi secret-store foundation after merged NET-02 (#483). - adds one schema-1 Bloom-owned private profile authority under internal JFFS2 /appconfigs - bounds the complete store to 16 profiles and 16 KiB and accepts replacement only on stdin - supports WPA2-PSK, explicitly created open profiles, and manual hidden WPA2 - rejects WEP, hidden open profiles, unknown fields/security, duplicate IDs/SSIDs, control characters, links, unsafe paths, oversized stores, and occupied atomic slots - publishes only redacted count/managed status; no export or raw-list operation exists - projects one explicitly selected non-secret profile ID through a mode-0600 same-directory candidate, sync, and atomic rename with update_config=0 - does not scan, associate, change the Wi-Fi preference, restart the radio, reconcile listeners, or perform a remote network mutation - integrates the schema, payload inventory/provenance, dependency totals, documentation, adversarial tests, and v3 ledger ## Dependency and issue links Base: main at 5852e08bb31b9d539999fec08992dfac19b0d143 (merged NET-02, #483). This PR is not stacked on an unmerged branch. Closes #484. Parent program: #434. ## Validation - focused Wi-Fi profile-store gate: 13/13 passed - fail-fast preflight before Bats: canonical legacy manifest, full file-backed provenance, canonical transfer policy, and exact dependency inventory passed - exact dependency aggregate: 331 components, 2,130 files, 314,646,675 bytes, 227 source-build and 104 unresolved inherited components

• risk-scoped shell workflow 33170790616: passed in 1m33s on bf2280480d44087f368805ce946a72f902269e53
• the prior run 33170145418 failed only because two exact legacy-inventory assertions still expected 330/53; the focused 13-test provenance/manifest file then passed in 271s before correction bf228048 was pushed - FAT payload validation, POSIX syntax, JSON parsing, schema/semantic bounds, and diff checks passed - adversarial fixtures cover WPA2, raw PSK, explicit open, hidden WPA2, WEP/unknown denial, duplicates, malformed credentials, count/byte bounds, symlink and dangling-symlink refusal, occupied-slot preservation, stale/live locks, unknown IDs, invalid commands, redacted output, and quoted metacharacter injection resistance - bloom-wifi-profiles: 9,043 bytes, SHA-256 b812644ae75139dd92df6e24b31904b67433a58d9db2d8d07f06210be159de2f - versioned schema: 1,551 bytes, SHA-256 77c5417ae6f375ffac65ff4c74c3bd6e2eaa81ebda4a1db4758759c52f2322db ## Mini Plus evidence and limitations Read-only strict key-only SSH preflight confirmed /appconfigs is writable JFFS2, /mnt/SDCARD is VFAT, /bin/sync and the shipped jq are available, and the current supplicant configuration is a regular non-symlink file. Only mount type, mode, byte count, network-block count, and required header presence were inspected. No SSID, credential, live config contents, address, key, or unrestricted log was read into evidence or included here. The exact 9,043-byte PR helper (SHA-256 b812644ae75139dd92df6e24b31904b67433a58d9db2d8d07f06210be159de2f) was transferred through strict key-only SSH and exercised only with synthetic profiles under /tmp/bloom-net03-fixture-bf228048. It produced a mode-0700 root, mode-0600 store and projected config, exactly one managed network, and redacted status. The live /appconfigs/wpa_supplicant.conf hash remained d7fbadd510e76c423638513337620e17944d51b4505ff314354971d97114bdef before and after; all temporary state was removed and aggregate device health remained green.

No live profile was created or projected. No association, Wi-Fi toggle, reboot, listener change, update, activation, installation, or network transaction was attempted. This is a privacy-bounded Mini Plus hardware-boundary fixture, not physical certification and not Mini V1-V4 or Mini Flip/my285 evidence. NET-04 remains responsible for scan/connect/forget orchestration and must retain stdin or another fixed private secret boundary plus existing rollback safeguards. ## Storage hygiene Reused the single D:-based implementation worktree and existing pinned shell-test image. Focused containers used --rm; no clone, worktree, WSL build directory, named Docker volume, or build cache was created. C: briefly crossed the configured floor to 59.99 GiB; the self-removing focused container exited cleanly and C: recovered above 60 GiB. No further large local build/storage creation is planned; remaining repeated validation runs on GitHub CI. No unrelated worktree, image, volume, branch, or recovery evidence was removed.