[boburning]

Summary

• add a fixed bloom-ssh-gate for every authenticated developer SSH shell, exec, and subsystem request
• start interactive /bin/sh without login semantics and with ENV=/dev/null, preventing inherited /etc/profile from automatically reactivating Telnet
• preserve authenticated non-interactive command behavior and exact dispatch to the confined SFTP gate
• fail closed when the gate is absent, including the transaction-owned shadow listener
• include the gate in platform capability detection, the sealed network-helper bundle, risk-scoped CI, provenance inventory, and security/test contracts

Closes #645.

Base

Current origin/main was merged into the branch at 3a828a298d92dc5072fdb28e458414e981aee03e. The only merge conflict was the generated dependency inventory, regenerated from the merged manifest.

Host validation

• focused SSH/listener/network/deploy/platform/manifest selection: 127/127 after initializing the exact pinned provenance submodules
• CI scope and ARM orchestration checks: passed
• final hosted implementation head 3a828a298d92dc5072fdb28e458414e981aee03e: all five required workflows passed (824/824 shell integration plus ARM/package, static, native, and AddressSanitizer)
• final evidence-only head 0a093ca13a7868244420a15e3dbba6799fb3f26c: shell integration, static, native, and AddressSanitizer passed; ARM/package is the remaining required check
• git diff --check: passed

Signed device validation

The signed Full hardware workflow for exact implementation commit 3a828a298d92dc5072fdb28e458414e981aee03e passed. Its archive was independently checked for exact commit identity, manifest integrity, payload integrity, and Ed25519 signature before staging.

On the Miyoo Mini Plus:

• the guarded Full update activated and returned automatically within the 20-minute reboot window
• installed version matched v0.1.0-dev-3a828a29
• installed hashes for bloom-dev-ssh, bloom-ssh-gate, bloom-platform, and bloom-dev-deploy matched the reviewed sources
• a real forced-PTY, no-command login completed through the gate with ENV=/dev/null
• non-interactive command dispatch passed
• password-only authentication was refused
• the disabled SFTP handoff was refused
• the independent listener audit remained clean with only key-only SSH reviewed and no Telnet listener
• the sole authorized key and pinned host key were unchanged
• final health was green; update transaction, recovery lease, developer overlay, and transfer staging were inactive/clean
• five retained recovery snapshots verified
• the candidate was confirmed known-good as 0.1.0-dev-3a828a29

Durable hardware evidence is recorded in docs/validation/network/plus-interactive-ssh-lockdown-20260831.json and linked from the support matrix and work-program ledger.

Scope boundary

The signed checkpoint also found inactive upgrade remnants at the retired File Browser/bftpd configuration paths. No retired executable, enablement flag, or corresponding listener was present. Issue #629 owns upgrade-safe removal of those preserved config remnants; this does not weaken the interactive SSH gate or its clean listener result.

No hardware claim is made for Mini V1-V4 or Mini Flip.

[boburning]

Resumed after PR #644 completed its physical gate and merged.

• Merged current origin/main (35ca0698) into this branch as 3a828a29; the only conflict was the generated dependency inventory, resolved from the merged canonical manifest (327 components, 1,968 files, 260,664,576 bytes).
• Security-focused shell selection passed 114/115 initially. The sole failure was the isolated worktree missing CI's four pinned PixelReader provenance submodules, not a changed assertion or runtime failure.
• After initializing only those exact locked submodules, the manifest rerun passed 13/13 and CI-scope/ARM orchestration assertions passed.
• All other 114 selected SSH gate, key-only transport, listener lockdown, network service, deployment, platform, CLI, manifest, and transfer-policy cases passed on the merged tree.
• Shell syntax and git diff --check pass.

The device remains on confirmed known-good v0.1.0-dev-c1fc6624. I will start the signed Mini Plus integration checkpoint only after this updated head's required CI is green.

[boburning]

Signed Mini Plus gate: PASS

• Exact candidate v0.1.0-dev-3a828a29 from 3a828a298d92dc5072fdb28e458414e981aee03e; workflow 33464738492.
• Archive: 185,667,740 bytes, SHA-256 bef1ee7c8d95ca5e5ea614820290fa6386b7619800651392e06a32952f892427; metadata, payload inventory, and Ed25519 signature verified.
• Installed after snapshot 20260901T032842Z-pre-update-3039, returned automatically in 362 seconds, and confirmed known-good after one boot.
• A fresh no-command interactive key-only request entered non-login /bin/sh with ENV=/dev/null.
• Non-interactive exec passed; password-only authentication and disabled SFTP were refused.
• Immediate independent listener audit found no Telnet process or listener and only reviewed key-only SSH.
• The sole authorized key and pinned host key remained unchanged; installed helper hashes matched the reviewed tree.
• Final aggregate health, five verified snapshots, idle network transaction, inactive recovery lease, inactive development overlay, and transfer cleanup were green.

Structured evidence: docs/validation/network/plus-interactive-ssh-lockdown-20260831.json

Separate follow-up: the Full checkpoint found inactive legacy config/filebrowser, config/bftpd.conf, and config/bftpdauth.conf remnants. Their executables and all stale enablement flags are absent. Issue #629 remains open for upgrade-safe cleanup; PR #646 does not claim NET-10 completion.