Skip to content

docs(program): record NET-05 recovery evidence #587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
boburning merged 1 commit into from
Aug 30, 2026
Merged

docs(program): record NET-05 recovery evidence #587

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions docs/program/BloomOS_Work_Program_v3.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,12 +254,13 @@
523,
525,
571,
573
573,
586
],
"risk_tier": 1,
"deployment_tier": "host",
"device_gate_required": false,
"last_audited_main": "36373d6c6d4c062d8f18d4a79ca4e74d03a9f9f0",
"last_audited_main": "94104f65ab78117960093cbbbc4f7f9eaf44475c",
"evidence": [
"PR #440 merged green as 92cb43e4f8bfed5ab0d44e0e6ddb886d9819c023",
"PR #439 merged as 409359639089da6f9bc82d7e7ee4f32c14174402 with the repository-owned v3 program and live ledger",
Expand All @@ -280,7 +281,8 @@
"GitHub PR #571 narrows Bloom Shell Wi-Fi affected-component cppcheck to the changed implementation plus the sole production header consumer while retaining exhaustive native, AddressSanitizer, ARM, Shell, full-source, merge-group, and manual gates; hosted static analysis fell from 3 minutes 18 seconds on PR #570 to 15 seconds, and the other required gates passed in 35 seconds to 1 minute 53 seconds",
"GitHub PR #571 merged by squash as 9557c01120bd0d7e104eaf12ecb9c70f74291454 with a tree identical to reviewed head 96ae831af55ea38562fdfb5ba76062ffaac62601; its host-only CI change performed no device deployment or runtime certification and left the online Mini Plus untouched on its retained known-good image",
"GitHub PR #573 maps affected Bloom Shell Wi-Fi implementation and header changes to the owning implementation file for reduced pull-request cppcheck while the affected ARM build still compiles the sole production header consumer and exhaustive integration, full-source, merge-group, scheduled, and manual gates remain unchanged",
"GitHub PR #573 passed formatting in 14 seconds, static analysis in 14 seconds, the affected ARM build in 35 seconds, native tests in 1 minute 35 seconds, AddressSanitizer in 1 minute 46 seconds, and all 58 affected Shell tests in 2 minutes 11 seconds; it merged by squash as 36373d6c6d4c062d8f18d4a79ca4e74d03a9f9f0 with a tree identical to reviewed head ced81a9957b601ec90519afbb105216a585728a0, performed no device deployment or runtime certification, and left the online Mini Plus untouched on its retained known-good image"
"GitHub PR #573 passed formatting in 14 seconds, static analysis in 14 seconds, the affected ARM build in 35 seconds, native tests in 1 minute 35 seconds, AddressSanitizer in 1 minute 46 seconds, and all 58 affected Shell tests in 2 minutes 11 seconds; it merged by squash as 36373d6c6d4c062d8f18d4a79ca4e74d03a9f9f0 with a tree identical to reviewed head ced81a9957b601ec90519afbb105216a585728a0, performed no device deployment or runtime certification, and left the online Mini Plus untouched on its retained known-good image",
"GitHub PR #586 maps an entrypoint-only src/bloomShell/main.c pull-request change to its owning translation unit for reduced cppcheck while retaining the complete Bloom Shell ARM target, affected native and AddressSanitizer coverage, focused Shell integration ownership, and exhaustive merge-group and manual gates; the exact policy candidate passed static analysis in 17 seconds versus 3 minutes 24 seconds on PR #584, the no-op ARM scope in 34 seconds, native tests in 1 minute 47 seconds, AddressSanitizer in 1 minute 51 seconds, and all 741 Shell tests in 2 minutes 15 seconds, then merged by squash as 94104f65ab78117960093cbbbc4f7f9eaf44475c without touching the online Mini Plus"
]
},
{
Expand Down Expand Up @@ -931,12 +933,14 @@
580,
581,
582,
583
583,
584,
585
],
"risk_tier": 1,
"deployment_tier": "hot",
"device_gate_required": true,
"last_audited_main": "3c503197bceb7c7c150b0d655e0545685858f415",
"last_audited_main": "94104f65ab78117960093cbbbc4f7f9eaf44475c",
"evidence": [
"issue #544 tracks NET-05 on current main after merged NET-04A-D and UI-05; the audit found that Bloom Shell still treats Wi-Fi as an inline toggle whose A and left/right handlers synchronously call bloom-network enable or disable instead of opening the bounded profile and scan UI",
"the first host-safe slice adds an explicit local credential-free projection of at most 16 validated profile IDs, printable SSIDs, security classes, hidden flags, and one active marker; the private service never returns a PSK and the Shell model rejects unknown or credential-bearing fields",
Expand Down Expand Up @@ -1047,7 +1051,12 @@
"GitHub PR #582 passed formatting in 15 seconds, scoped static analysis in 18 seconds, the affected Shell gate in 57 seconds, the affected ARM build in 1 minute 20 seconds, native tests in 1 minute 24 seconds, and AddressSanitizer in 1 minute 38 seconds; it merged by squash as 3c503197bceb7c7c150b0d655e0545685858f415 with a tree identical to reviewed head 15905a61a9bc3faf99269fe19bd26263a37684be",
"the post-#582 current-main audit found the complete guarded lifecycle and exact action projection still disconnected from Bloom Shell; this host-only runtime slice renders only the fixed projected action on saved-profile rows, dispatches A only through the selected owned action, polls the lifecycle and its independent deadline from the existing 100-ms Wi-Fi event, reloads canonical settings, observed network status, and profiles only after terminal closure, and defers Back, MENU, hardware GameSwitcher, and SDL quit until confirmed or rolled back; recovery-required state remains visible with explicit Retry Cancel and cannot be torn down, while no direct transaction alias, credential, Wi-Fi disable, reboot, update, deployment, or device action is added",
"the runtime candidate passed all 48 focused BloomShellWifiUi tests in 5.161 seconds natively and 7.054 seconds under AddressSanitizer, including deterministic cancellation requested during an ambiguous confirm acknowledgement; all 588 native tests passed in 15.552 seconds and all 588 AddressSanitizer tests passed in 28.631 seconds; the 81-test risk-selected Shell gate passed after one 332-component manifest, seven-component provenance, six-root transfer, and 314688405-byte dependency preflight, while host main syntax, clang-format 21.1.8, focused cppcheck 2.19, ledger JSON, CI scope, and diff checks passed; the affected ARM build remains delegated to required PR CI because C is below the 60-GiB no-new-storage gate, and the Mini Plus remains untouched on its retained known-good image",
"GitHub PR #583 publishes the guarded Wi-Fi connect runtime directly on current main at https://github.com/boburning/BloomOS/pull/583; its body records the exact merged #582 dependency, selected-row action boundary, continuous deadline and closure polling, deferred navigation and teardown rules, ambiguous-confirm cancellation correction, focused and complete host validation, deliberate device non-evidence, signed checkpoint limitation, and issue #544"
"GitHub PR #583 publishes the guarded Wi-Fi connect runtime directly on current main at https://github.com/boburning/BloomOS/pull/583; its body records the exact merged #582 dependency, selected-row action boundary, continuous deadline and closure polling, deferred navigation and teardown rules, ambiguous-confirm cancellation correction, focused and complete host validation, deliberate device non-evidence, signed checkpoint limitation, and issue #544",
"GitHub PR #583 passed formatting in 18 seconds, the affected Shell gate in 48 seconds, the affected ARM build in 1 minute 36 seconds, native tests in 1 minute 16 seconds, AddressSanitizer in 1 minute 48 seconds, and scoped static analysis in 2 minutes 53 seconds; it merged by squash as 2933f706c67195d82abfd5f06422b15e9137a15d and became the coherent signed Mini Plus checkpoint base",
"the signed #584 corrective candidate used source commit 7bf5930eaf03478dcf8a865dcbf8bf4606fd7df9, version 0.1.0-dev-7bf5930e, archive SHA-256 fd5db4ed66e5bacf4b561b703b4a2b0f965fdd52da803b2518f3827bd9c3b217, and bloom-shell SHA-256 9c9c6d38ab01743047dc306b83b0ec20e7b57f4f70365c18518e3a83e79c2516; the guarded Hot overlay remained associated on the existing Mini Plus route, reached structured Shell ready state, retained an IDLE session and clean reviewed key-only SSH listener, and changed no Wi-Fi radio, profile, credential, key, listener, route, or update transaction state",
"GitHub PR #584 keeps the Wi-Fi timer inside SDL 1.2's valid user-event range with a compile-time bound, passed formatting in 15 seconds, the affected Shell gate in 43 seconds, the affected ARM build in 1 minute 14 seconds, AddressSanitizer in 1 minute 24 seconds, native tests in 1 minute 40 seconds, static analysis in 3 minutes 24 seconds, and the signed hardware workflow in 8 minutes 15 seconds, then merged by squash as 4941cd8bb247bb2fcf0294dcaa5ef74133bcf0a9",
"GitHub PR #585 hardens unattended Hot and Warm recovery by escalating only the exact retained Bloom Shell or keymon PID after a bounded TERM grace; all 741 local Shell tests passed with a 97-second slowest shard, hosted Shell CI passed in 2 minutes 22 seconds, and it merged by squash as 25e1e2030b2cf2e18ac7d04c1be15410ce80a5ea; the active signed #584 Shell overlay was left untouched and read-only follow-up confirmed known-good update state, healthy aggregate status, ready Shell guard, IDLE session, associated Wi-Fi with default route, idle network transaction, no pending Shell signal, and only the reviewed key-only SSH listener",
"NET-05 remains in progress because the profile store is intentionally empty and the final privacy-safe physical Quick Settings and Wi-Fi-detail walkthrough has not yet been observed; remote framebuffer, process, session, resource, association, route, listener, and signed-artifact evidence does not certify physical controls, LCD appearance, Original Mini variants, or Flip hardware"
]
},
{
Expand Down