[boburning]

Work-program mapping

• Implements NET-05 Slice A from the v3 work program; NET-05 remains in progress.
• Tracks NET-05: replace direct Wi-Fi toggle with bounded profile UI #544 and parent program issue Long-term SSD202D autonomous implementation program #434.
• Base: main at dbe30da0a2fe9ee2a5211ce471988f132026e759.
• Dependencies: NET-04A-D (NET-04A: add atomic private profile mutations #487, NET-04B: add bounded asynchronous Wi-Fi scan #488, NET-04C: add rollback-bounded Wi-Fi profile connect #489, NET-04D: expose guarded profile and forget operations #490) and UI-05 (UI-05: shared deterministic component library #502), all merged before this slice.

Summary

• Add an explicit local bloom-wifi-profiles list --json projection for at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker.
• Route that projection through bloomctl network profile list without exposing the raw profile store or any credential.
• Add a bounded Bloom Shell Wi-Fi model that accepts exact profile and asynchronous-scan schemas, at most 16 profiles and 32 networks, one 18-32 byte operation ID, fixed phases/errors, integral timestamps/signals, unique IDs/SSIDs, and matching terminal result counts.
• Reject unknown fields, credential-bearing responses, mismatched operation IDs, malformed values, duplicate identities, multiple active profiles, and stale/inconsistent scan results.
• Add risk-scoped CI routing, policy/manifest inventory updates, documentation, and v3 ledger reconciliation.

Validation

• clang-format 21.1.8 --dry-run --Werror: pass.
• Strict host syntax compile (gnu18, -Wall -Wextra -Werror): pass.
• Focused exhaustive cppcheck 2.19: pass.
• CI-scope orchestration and selector tests: pass; affected paths select BloomShellWifiUi*, wifi_profiles.bats, and wifi_scan.bats at risk 2.
• Final focused native rebuild: 3/3 pass.
• Final focused AddressSanitizer rebuild: 3/3 pass.
• Full native baseline plus this model: 543/543 pass in 11.4 seconds; the post-review parser correction was then covered by the final focused rebuild.
• Full AddressSanitizer baseline plus this model: 543/543 pass in 21.7 seconds; the post-review parser correction was then covered by the final focused rebuild.
• Canonical shell gate: 736/736 pass across eight bounded shards in 186.6 seconds.
• Legacy manifest: 332 components, 2,131 files, 314,683,902 bytes.
• Provenance policy: 7 components, pass with required files.
• Transfer policy: 6 roots (5 read-write, Saves read-only), pass.
• Focused profile/bloomctl/platform/core/critical-surface shell gate: 79/79 pass.

Device evidence

None for this slice. Validation used synthetic profile and scan fixtures only. The online Mini Plus was deliberately left on its installed known-good signed baseline; this candidate was not transferred, executed, or installed on it.

Limitations and safety boundary

• This is the credential-free data-model slice, not the rendered Wi-Fi surface and not NET-05 completion.
• It does not scan a real network, start or stop Wi-Fi, associate, change DHCP, create/update/delete/connect a live profile, change a network preference, mutate SSH/SFTP/listeners/keys, reboot, install an update, or touch user data.
• SSIDs are local UI data and remain excluded from diagnostics, logs, screenshots, support bundles, and retained evidence.
• Original Mini capability hiding and the physical Mini Plus UI/control checkpoint belong to the later rendered-surface slice.
• No physical behavior, controls, LCD output, networking transition, or other device-family certification is claimed.

Storage hygiene

• Reused the single implementation worktree and single build workspace under D:\BloomOS-Work\plat01-e965215.
• Created no clone, worktree, Docker image, named volume, or persistent WSL clone.
• Temporary shell containers used --rm; shell output stayed on D:.
• C: was already below the 60 GiB creation gate; the full shell run changed observed free space only from 49.88 GiB to 49.82 GiB and created no new C:-resident build workspace.