feat(network): bound Wi-Fi credential input (NET-05)

docs/1.0_TEST_MATRIX.md

@@ -50,7 +50,7 @@ shoulder button.
 | Network services | Desired/runtime separation; carrier without IPv4 remains acquiring/not-ready; canonical DHCP restart and bounded post-address listener reconciliation; SSH shell and SFTP independent key-only states; canonical transfer roots and modes; Saves read-only; private roots denied; traversal/symlink/path bounds; same-filesystem atomic publication; authorized-key import; quiesce/health; stale FTP/Telnet/FileBrowser/inherited-Samba/WPS/hotspot flags cannot activate listeners; process-aware listener audit; Samba hidden until a materially different source-build candidate passes feasibility |
 | Wi-Fi profile store | JFFS2 private root; stdin-only bounded replacement and `bloomctl network profile upsert ID`; requested/document ID binding; explicit `network forget ID`; inactive-ID deletion with active-profile refusal; active forget only after a separately confirmed fallback connection; schema/unknown-field/count/size enforcement; WPA2-PSK, explicit open, and manual hidden WPA2; WEP and hidden open denial; unique IDs/SSIDs; redacted status; explicit local credential-free UI list with one active marker; mode-0600 atomic single-profile supplicant projection; symlink, occupied-slot, live-lock, invalid-profile, and prior-byte preservation |
 | Wi-Fi scan API | Asynchronous start; redacted status; explicit ID-scoped local results; cancel and terminal discard; one active worker; five-second rate limit; 15-second runtime; 64-KiB raw ceiling; 32 unique printable SSIDs; eight-operation history; open/WPA2-PSK/unsupported classification; duplicate signal reconciliation; backend failure, timeout, oversize, unsafe-path, stale/live-lock, and unsupported-hardware handling |
-| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
+| Wi-Fi UI | Original Mini hidden; Settings, Shell Quick Settings, and GameSwitcher Quick Settings converge on `--settings-wifi`; direct radio toggle removed; bounded fixed-argv profile-list load outside render; connection state and saved-network detail; selectable Scan/Cancel row and read-only discovered networks; active-only 100-ms SDL wake; deferred GameSwitcher until cancellation discard; single-flight nonblocking fixed-argv scan client; 16-KiB output and five-second deadline; child process-group cleanup; controller-owned start/status/results/discard and cancel-during-start sequencing; 250-ms status opportunities; exact profile/scan/ack schemas; 16 profiles and 32 networks; unique bounded IDs/SSIDs; one active profile; fixed scan phases/errors; terminal history discarded; host-only open/WPA2 profile form with shared keyboard, masked secret, fixed profile-upsert argv, escaped stdin JSON, strict ID/SSID/PSK validation, and explicit secret clearing; credential and unknown-field rejection; passwords absent from arguments, logs, screenshots, durable Shell state, and evidence |
 | GameSwitcher | MENU open/toggle; Left/Right select; L1/R1 page; A resume; X actions; START Quick Settings; B Home; no inherited brightness/view/delete behavior |
 | Apps/Tweaks | Every app disposition recorded; normal configuration requires no Tweaks; supervised launch remains bounded |
 | Persistent state | Versioned atomic publication; exact restoration across Details/game/GameSwitcher/Quick Settings; malformed/oversized/symlink input defaults without Safe Mode |

docs/ARCHITECTURE.md

@@ -574,6 +574,14 @@ GameSwitcher handoff until cancel, terminal status, and discard clear the exact
 operation. No scan command is invoked from `draw()` and no result can initiate
 association in this slice.
 
+The next host-only boundary models a selected open or WPA2-PSK network with one
+validated non-secret profile ID and the shared bounded keyboard. Password copy
+is always masked; submission invokes only fixed `bloomctl network profile
+upsert ID` arguments and writes one escaped schema-valid profile document to
+stdin. The password and temporary document are explicitly cleared on every
+success and failure path. This model has no rendered consumer and does not
+connect, project, restart, or forget a profile.
+
 Profile association reuses the one guarded network-transaction authority rather
 than adding a second recovery mechanism. `begin` copies the exact current
 supplicant file into a mode-0700 JFFS2-private transaction root, records only

docs/DEVELOPMENT.md

@@ -394,6 +394,14 @@ controller: B requests cancellation in the background, and GameSwitcher waits
 until the exact operation reaches discard. Scan result rows are deliberately
 read-only until the separate guarded association and credential slices land.
 
+Wi-Fi credential code must keep the SSID and non-secret profile ID separate from
+the password buffer. The form validates the exact store vocabulary, masks every
+password byte in display copy, JSON-escapes printable input, sends the profile
+only on stdin to fixed `network profile upsert ID` arguments, and securely clears
+both password and temporary document bytes on every path. Do not wire this
+synchronous host-tested boundary into the SDL loop; rendered submission requires
+a separate nonblocking controller before it can become reachable.
+
 The NET-04 scan slice is asynchronous and keeps result data only under `/tmp`:
 
 ```sh

docs/SECURITY.md

@@ -155,4 +155,12 @@ accepts A. A GameSwitcher request during a scan is held until the controller has
 confirmed and discarded cancellation, so a child UI cannot strand the Shell's
 operation or inherit its command pipe.
 
+The host-only Wi-Fi profile form accepts only a schema-valid non-secret profile
+ID, printable bounded SSID, open or WPA2-PSK security, and the existing hidden
+network rule. WPA2 input is masked and never appears in arguments or process
+output. The fixed upsert child reads one JSON document from stdin with stdout and
+stderr closed to `/dev/null`; parent memory explicitly clears the password and
+escaped document before returning, including validation, pipe, fork, execution,
+and timeout failures. No runtime surface can invoke this boundary yet.
+
 Security-sensitive migrations and repair operations must be bounded, logged, reversible where possible, and validated before activation.

docs/program/BloomOS_Work_Program_v3.json

@@ -885,12 +885,13 @@
         546,
         547,
         548,
-        549
+        549,
+        550
       ],
       "risk_tier": 1,
       "deployment_tier": "hot",
       "device_gate_required": true,
-      "last_audited_main": "9b3a847d99daf8baf44d953670d0ff4a18562a60",
+      "last_audited_main": "6c277d2300494ba8387accbf4bc28f4459640509",
       "evidence": [
         "issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
         "the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
@@ -902,7 +903,9 @@
         "GitHub PR #547 used risk-scoped CI: format passed in 23 seconds, 58 focused shell tests in 43 seconds, native tests in 1 minute 8 seconds, AddressSanitizer in 1 minute 12 seconds, the affected Bloom Shell ARM build in 1 minute 21 seconds, and scoped static analysis in 2 minutes 8 seconds; it merged by squash as 765f2038b7d63e61d6db8bab1a70ce750a07d088",
         "the following host-only lifecycle controller sequences start, bounded status polling, results, and terminal discard through the single-flight request client; it preserves terminal results in memory while clearing the service operation, and a cancel received during start is deferred until the exact operation ID arrives before status confirmation and discard",
         "GitHub PR #548 passed format in 18 seconds, 58 focused shell tests in 50 seconds, the affected Bloom Shell ARM build in 1 minute 11 seconds, native tests in 1 minute 20 seconds, AddressSanitizer in 1 minute 26 seconds, and scoped static analysis in 2 minutes 8 seconds; it merged by squash as 9b3a847d99daf8baf44d953670d0ff4a18562a60",
-        "GitHub PR #549 renders the bounded scan controller through a 100-ms SDL wake without invoking commands from draw or blocking input, adds a selectable Scan action and read-only bounded results, cancels in the background when leaving the panel, and defers GameSwitcher until the exact scan operation is cancelled, confirmed terminal, and discarded; association, credential entry, forget, and radio power remain absent"
+        "GitHub PR #549 renders the bounded scan controller through a 100-ms SDL wake without invoking commands from draw or blocking input, adds a selectable Scan action and read-only bounded results, cancels in the background when leaving the panel, and defers GameSwitcher until the exact scan operation is cancelled, confirmed terminal, and discarded; association, credential entry, forget, and radio power remain absent",
+        "GitHub PR #549 passed format in 40 seconds, 106 affected shell tests in 50 seconds, AddressSanitizer in 1 minute 10 seconds, the affected Bloom Shell ARM build in 1 minute 22 seconds, native tests in 1 minute 30 seconds, and scoped static analysis in 2 minutes 3 seconds; it merged by squash as 6c277d2300494ba8387accbf4bc28f4459640509",
+        "GitHub PR #550 adds a host-only credential-form boundary that accepts only bounded schema-valid open or WPA2 inputs, masks password copy, invokes fixed bloomctl network profile upsert arguments with escaped JSON only on stdin, and explicitly clears password and temporary document bytes on every path; it has no rendered consumer and cannot scan, associate, restart Wi-Fi, forget a profile, or mutate the device"
       ]
     },
     {