[boburning]

Summary

• continues NET-05 after merged PR feat(network): poll Wi-Fi profile submission (NET-05) #551 by mapping one bounded scan result into the existing host-only profile form
• requires a current, internally consistent credential-free profile snapshot before mapping
• reuses an existing profile ID only for an exact saved SSID and matching security class
• assigns new networks a collision-checked wifi- handle containing 104 bits from a no-follow /dev/urandom character device
• fails closed for malformed or duplicate snapshot state, unsupported security, hidden-open state, a full store, security mismatch, entropy failure, or bounded collision exhaustion
• records the contract in architecture, security, the 1.0 test matrix, and the v3 work-program ledger

Dependency and scope

Base: current main at 49f0a8096bff9a9157e4ce176201d2f532bb74dd.

Dependency: PR #551 is merged into the base. This is the next independent host-only NET-05 slice tracked by #544. It is not stacked on an unmerged branch.

The helper has no rendered or runtime consumer in this PR. It cannot scan, associate, restart or disable Wi-Fi, write a credential, forget a profile, reboot a device, or activate an update.

Validation

• 13/13 focused BloomShellWifiUi* native tests passed; 557 ms test execution
• 13/13 focused BloomShellWifiUi* AddressSanitizer tests passed; 715 ms test execution
• 58/58 affected shell tests passed in one invocation covering platform, core policy, critical surfaces, profile service, and scan service
• legacy manifest, provenance policy with required files, transfer policy, and dependency inventory passed once as part of that shell invocation
• changed C and header files passed clang-format 21.1.8 dry-run with --Werror
• the changed C module passed GNU C18 -Wall -Wextra -Werror host compilation
• focused cppcheck 2.19 passed, and the CI-equivalent src/bloomShell scope completed successfully with only existing informational/style findings
• BloomOS_Work_Program_v3.json passed JSON parsing
• git diff --check passed

Current-head GitHub CI passed: formatting in 13 seconds, all affected shell tests in 45 seconds, the ARM/check build in 1 minute 12 seconds, native tests in 1 minute 15 seconds, AddressSanitizer in 1 minute 22 seconds, and scoped static analysis in 1 minute 45 seconds.

Device evidence

No device candidate was built, installed, or activated for this host-only slice. The connected Mini Plus was intentionally left on its known-good signed baseline; no SSH command, Wi-Fi transition, profile mutation, reboot, or update was performed. This PR therefore makes no physical-hardware certification claim.

Limitations and follow-up

• /dev/urandom must be available as a no-follow character device when a new ID is required; failure is terminal and leaves the form cleared
• the bounded random collision retry is covered structurally, while an actual 104-bit collision is not practical to force through the production entropy source
• rendering, input focus, association, recovery, and physical controls remain follow-up NET-05 work under NET-05: replace direct Wi-Fi toggle with bounded profile UI #544 and require their own gates
• the user-observed Mini Plus charging/boot screens and online state are evidence for the installed baseline, not evidence for this host-only delta

Issue: #544
Parent program: #434