NET-05A: add credential-free Wi-Fi UI model

build/dependencies.lock

@@ -209,7 +209,7 @@ manifest = "build/legacy-manifest.json"
 schema = 1
 component_count = 332
 file_count = 2131
-byte_count = 314682516
+byte_count = 314683902
 source_build_components = 228
 unresolved_components = 104
 inherited_baseline = "07505ea58c7bba698d6b9220ff43946a43cac76b"

build/legacy-manifest.json

@@ -995,8 +995,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloom-wifi-profiles",
       "file_count": 1,
-      "byte_count": 14104,
-      "tree_sha256": "07502370e9ac8bc9a6df02a732bdf60ecf362f620641b0f659c734a40ff6552a",
+      "byte_count": 15282,
+      "tree_sha256": "c66a44035c6e6678b1b051ed49145d6df6aedb19dfb6e147f6408ad13bbfa605",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",
@@ -1021,8 +1021,8 @@
       "kind": "runtime",
       "path": "static/build/.tmp_update/bin/bloomctl",
       "file_count": 1,
-      "byte_count": 39469,
-      "tree_sha256": "8342402e14fa666f3d5472d4b3546d89bc6f47e518a01402785c004fc1178b60",
+      "byte_count": 39677,
+      "tree_sha256": "ec2d7df4e4286896130d576d562e20078600dc623309f0b84731b0473665b725",
       "source": "https://github.com/boburning/BloomOS",
       "source_revision": "release-commit",
       "license": "GPL-3.0-only",

docs/1.0_TEST_MATRIX.md

@@ -48,8 +48,9 @@ shoulder button.
 | Settings | One sectioned surface; inline values; capability filtering; one-layer details; hidden Developer section; optional overlapping L1/R1 list paging |
 | Quick Settings | START from core surfaces; immediate brightness/volume/mute; capability-gated Wi-Fi; qualified Plus remains toggleable while a powered-off radio has no `wlan0`; Off-to-On reaches the fixed backend; readable battery; B/START close |
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
-| Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
+| Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
+| Wi-Fi UI | Original Mini hidden; exact profile/scan schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

docs/ARCHITECTURE.md

@@ -501,7 +501,10 @@ reader remains only as that fail-closed migration path.
 schema-1 store lives below the internal JFFS2 `/appconfigs` boundary, is
 limited to 16 profiles and 16 KiB, and accepts a complete replacement only on
 stdin. Profile IDs are non-secret stable handles; status reports only counts
-and managed/unmanaged state. SSIDs and credentials are never returned. The
+and managed/unmanaged state. An explicit local `list --json` projection serves
+the on-device Wi-Fi UI with at most 16 IDs, printable SSIDs, security classes,
+hidden flags, and one active marker. It validates the private store again and
+never returns a PSK or an unknown field. The
 initial security vocabulary is WPA2-PSK plus an explicitly created open
 profile. A hidden profile must be WPA2-PSK. WEP, unknown security modes,
 duplicate IDs or SSIDs, control characters, links, extra fields, and unsafe
@@ -535,6 +538,13 @@ and classify only explicit open, WPA2-PSK, or unsupported security. A caller
 can cancel active work and explicitly discard any terminal result. The scanner
 does not change a profile, preference, association, DHCP client, or listener.
 
+NET-05 consumes those two credential-free projections through a bounded Shell
+model. It accepts only exact schema-1 service identities, 16 unique stored
+profiles, 32 unique scan results, printable 32-byte SSIDs, fixed security and
+operation states, one active profile, and one 18–32 byte scan ID. Unknown
+fields—including any credential-like field—make the snapshot unusable. This
+first model slice adds no direct radio toggle or arbitrary command boundary.
+
 Profile association reuses the one guarded network-transaction authority rather
 than adding a second recovery mechanism. `begin` copies the exact current
 supplicant file into a mode-0700 JFFS2-private transaction root, records only

docs/DEVELOPMENT.md

@@ -337,6 +337,7 @@ bloom-wifi-profiles replace < synthetic-profiles.json
 bloom-wifi-profiles upsert fixture-profile-id < synthetic-profile.json
 bloom-wifi-profiles delete inactive-fixture-profile-id
 bloom-wifi-profiles status --json
+bloom-wifi-profiles list --json
 bloom-wifi-profiles project fixture-profile-id
 ```
 
@@ -359,6 +360,12 @@ may inspect only filesystem type, mode, byte count, structural counts, and
 redacted health. NET-04 orchestration retains stdin or an equivalent fixed
 private input boundary and the existing rollback rules.
 
+`list --json` is a local on-device UI projection, not a diagnostic or export
+surface. It contains non-secret IDs and SSIDs but must never contain `psk` or
+unknown fields. Keep its output out of shell history, screenshots, logs,
+support bundles, and validation evidence. Exercise it only with synthetic
+profiles in host or `/tmp` fixtures until the NET-05 UI gate is reached.
+
 The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
 
 ```sh

docs/SECURITY.md

@@ -95,8 +95,8 @@ process arguments.
 
 Wi-Fi profiles follow that same boundary. `bloom-wifi-profiles replace` reads
 one bounded schema-1 document from stdin and publishes it mode 0600 below a
-mode-0700 `/appconfigs/bloom-network` root. It exposes no export or raw-list
-command. Public status contains only the profile count and whether the current
+mode-0700 `/appconfigs/bloom-network` root. It exposes no credential export or
+raw-store command. Public status contains only the profile count and whether the current
 supplicant file carries Bloom's managed marker. Projection accepts only a
 non-secret profile ID, revalidates the store, and atomically publishes a
 single-network mode-0600 configuration with `update_config=0`, preventing
@@ -111,6 +111,14 @@ handle, revalidates the resulting complete store, and publishes atomically.
 the managed supplicant projection. Neither operation scans, associates,
 restarts Wi-Fi, or exposes an SSID or credential.
 
+The explicit local `list --json` operation exists only for the on-device
+NET-05 consumer. It revalidates the complete private store and emits only the
+bounded profile ID, printable SSID, security class, hidden flag, and active
+marker. Its JSON shape cannot contain a PSK, and the Shell rejects unknown
+fields so a credential-bearing response cannot cross into UI state. Do not
+capture this local SSID list in diagnostics, screenshots, logs, or durable
+evidence.
+
 Wi-Fi scan status and logs never contain SSIDs. An explicit local results call
 may return at most 32 printable SSIDs for the future on-device UI, but that
 ephemeral mode-0600 result is excluded from diagnostics, support exports,

docs/program/BloomOS_Work_Program_v3.json

@@ -215,7 +215,7 @@
       "id": "REC-02",
       "track": "Recovery",
       "title": "Repair failing existing branches #443 and #429, then propagate dependents",
-      "status": "merge_ready",
+      "status": "merged",
       "dependencies": [
         "REC-01"
       ],
@@ -454,7 +454,7 @@
       "id": "CORE-04",
       "track": "Core",
       "title": "System Emulator UI and exact RA capability badges",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "CORE-03"
       ],
@@ -479,7 +479,7 @@
       "id": "CORE-05",
       "track": "Core",
       "title": "Generic Auto and effective RA resolution; remove GBA hardcode",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "CORE-03",
         "CORE-04"
@@ -505,7 +505,7 @@
       "id": "CORE-06",
       "track": "Core",
       "title": "Save/state compatibility groups and trusted migrations",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "CORE-03"
       ],
@@ -695,7 +695,7 @@
       "id": "CORE-08",
       "track": "Core",
       "title": "System-family emulator/core qualification trains",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "CORE-03",
         "CORE-06"
@@ -734,7 +734,7 @@
       "id": "PLAT-01",
       "track": "Platform",
       "title": "Granular SSD202D device capability registry",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "REC-07"
       ],
@@ -757,7 +757,7 @@
       "id": "NET-01",
       "track": "Network",
       "title": "Network service v2 and non-secret settings authority",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "PLAT-01",
         "REC-04"
@@ -782,7 +782,7 @@
       "id": "NET-02",
       "track": "Network",
       "title": "Canonical transfer/share policy",
-      "status": "merge_ready",
+      "status": "merged",
       "dependencies": [
         "NET-01"
       ],
@@ -822,7 +822,7 @@
       "id": "NET-03",
       "track": "Network",
       "title": "Bloom Wi-Fi secret profile store and runtime projection",
-      "status": "merge_ready",
+      "status": "merged",
       "dependencies": [
         "NET-01"
       ],
@@ -875,7 +875,7 @@
       "id": "NET-05",
       "track": "Network",
       "title": "First-class Wi-Fi UI",
-      "status": "planned",
+      "status": "in_progress",
       "dependencies": [
         "NET-04",
         "UI-05"
@@ -884,8 +884,12 @@
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "3a7e78290285806e1ce3eb0c126887644ff665f2",
-      "evidence": []
+      "last_audited_main": "dbe30da0a2fe9ee2a5211ce471988f132026e759",
+      "evidence": [
+        "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
+        "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
+        "the bounded Shell model accepts at most 32 unique scan results, one 18-32 byte operation ID, fixed scan phases and errors, integral timestamps and signal values, and exact schema-1 service identities; this slice adds no rendered surface, radio toggle, scan, association, profile transition, listener mutation, reboot, update, or device mutation"
+      ]
     },
     {
       "id": "NET-06",
@@ -1676,7 +1680,7 @@
       "id": "META-09",
       "track": "Metadata",
       "title": "Provider UX, storage controls, resource and fault hardening",
-      "status": "published",
+      "status": "merged",
       "dependencies": [
         "META-05"
       ],
@@ -1687,7 +1691,7 @@
       "risk_tier": 2,
       "deployment_tier": "warm",
       "device_gate_required": true,
-      "last_audited_main": "f9fbedf5f2bdb258c644609f5098def5c55d58ad",
+      "last_audited_main": "dbe30da0a2fe9ee2a5211ce471988f132026e759",
       "evidence": [
         "issue #541 tracks META-09 after merged META-05 and audits current main as already owning durable job state, field resolution, downloaded-media storage and GC, and local-only metadata actions but lacking one provider-neutral operations projection, bounded review/retry controls, downloaded-media policy controls, Shell progress/background/review UX, and a consolidated fault/resource gate",
         "META-09 is split at the risk boundary: Slice A publishes the host-testable job/progress/review/storage authority and narrowly bounded controls; dependent Slice B adds the Bloom Shell consumer and owns the signed ARM and Mini Plus Warm checkpoint, so the package remains incomplete until both slices finish",
@@ -1700,7 +1704,8 @@
         "Slice B host validation passed strict gnu18 -Wall -Wextra -Werror syntax compilation, focused cppcheck 2.19, CI-scope regression, all 8 affected native and AddressSanitizer tests, 100 repeated snapshots in 70 milliseconds native and 291 milliseconds under AddressSanitizer, all 540 native tests in 11.42 seconds, and all 540 AddressSanitizer tests in 21.36 seconds; the Windows archive-mode correction passed all 29 focused bloom-device shell cases",
         "hardware workflow 33287065389 passed for exact Slice B implementation source 19d2fff334edc6ceb88b4870d522767a48124d53; the 199827820-byte signed release SHA-256 is f31afcdba141da13ab203f7cfd8b6afcfe4e53b87ad17d3c70bf35bc53f7d09b, its Ed25519 signature and release metadata verified, and its extracted 440932-byte ARM bloom-shell SHA-256 is 68372100e31d94c1ea9e4548a7da5fdd927210cd6d81c2cb5b9edebe8aba8ae5",
         "the Mini Plus Warm checkpoint staged the exact complete six-file Shell bundle, opened Library > Background Tasks, proved fail-closed stale-schema handling and explicit retry, rendered zero-job and storage aggregates without provider/network activity, held one PID with 3 threads, 9-12 descriptors, and a 4 KiB RSS/VmSize range across 31 one-second samples, and restored the exact pre-test root framebuffer; runtime rollback restored all signed hashes while Wi-Fi stayed associated, the network transaction stayed idle, and listener audit remained clean",
-        "the checkpoint also exposed that ordinary development file-overlay rollback does not own a catalog migration: after exact local and device backups, the zero-row schema 9-13 additions were transactionally reversed and the signed schema-8 Library again reported ready with 53 systems, 22 games, 23 apps, zero favorites, and 12 recents; sanitized evidence and the explicit limitation are recorded in docs/validation/library/plus-meta09-operations-20260829.json"
+        "the checkpoint also exposed that ordinary development file-overlay rollback does not own a catalog migration: after exact local and device backups, the zero-row schema 9-13 additions were transactionally reversed and the signed schema-8 Library again reported ready with 53 systems, 22 games, 23 apps, zero favorites, and 12 recents; sanitized evidence and the explicit limitation are recorded in docs/validation/library/plus-meta09-operations-20260829.json",
+        "GitHub PR #543 passed format in 17 seconds, native in 1 minute 5 seconds, AddressSanitizer in 1 minute 13 seconds, static analysis in 1 minute 41 seconds, the corrected 735-test shell gate in 2 minutes 4 seconds, and the exhaustive ARM build in 4 minutes 34 seconds; it merged by squash as dbe30da0a2fe9ee2a5211ce471988f132026e759"
       ]
     },
     {