docs(network): Network bounded context, ADR 0031, and the secure-WiFi refresh plan (EN 18031) - #634
Draft
brickbots wants to merge 2 commits into
Draft
docs(network): Network bounded context, ADR 0031, and the secure-WiFi refresh plan (EN 18031)#634brickbots wants to merge 2 commits into
brickbots wants to merge 2 commits into
Conversation
… plan (EN 18031) WS1 of the PR #311 refresh. Adds the Network bounded context glossary (WiFi mode, provisioning tokens, new unit vs field-upgraded unit, the Connect WiFi screen, recovery reset), ADR 0031 recording that new units ship with an encrypted AP and per-unit random passphrase for EN 18031 compliance (reversing #311's opt-in default), the CONTEXT-MAP entry and relationships, and the full release-readiness plan for refreshing #311. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W6UPq3yDJTqti9kgQXA7NZ
Collaborator
|
Needed work, had been thinking about it when doing the recent file explorer in the web and also some web refactoring. Wifi qrcode would be great for discover ability. |
Owner
Author
|
Thanks @mrosseel! I was indeed hoping this could wait until after the NixOS migration, but it seems like it's a blocking requirement for selling PiFinders in the EU. Maybe we should have an offline discussion about the timeline for NixOS migration as there are some things that may help compliance simply by doing the migration 🤔 |
`0031` was claimed independently by this branch and by the chart center-object readout. That one merged first (#633, 3f94f65), so it is the incumbent and this ADR is the latecomer. Per the project's tiebreak rule the most-referenced file keeps the number, weighting references from shipping code and tests: the chart ADR is cited from chart.py, center_object.py and test_chart_center_object.py, while every reference here is prose. Both criteria point the same way. 0034 is the lowest globally-free slot — a census of origin/main, origin/release and every remote branch puts the claimed ceiling at 0033 (0032 ubx-parser, 0033 equipment-measurements). Renames the file and updates all 14 inbound references in CONTEXT-MAP.md, docs/ax/network/CONTEXT.md and secure-wifi-refresh-plan.md. No content changes to the ADR itself. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KatPziEfc4Mo72chQHTFZL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
WS1 of the plan to refresh #311 ("[BETA] More secure WiFi configuration", implements #179) and get it released. Docs only — the code refresh follows as its own PR, reviewed against the vocabulary and decisions this PR puts on record.
Why now
EN 18031 (the EU RED cybersecurity regulations) requires new units to ship with an encrypted AP and a per-unit random WiFi password. That reverses the opt-in posture #311 settled on in 2025 — and, notably, lands on the posture #179 originally asked for. The decision, its history, and its consequences are recorded in ADR 0031 so the compliance trail exists before any code changes.
Contents
docs/ax/network/CONTEXT.md— new Network bounded context: WiFi mode, Access Point, provisioning tokens (CHANGEME/ENCRYPTME), new unit vs field-upgraded unit (the compliance boundary — upgrades never force-encrypt), AP passphrase, Connect WiFi screen, WiFi QR code, recovery reset.docs/adr/0031-ap-provisioning-ssid-tokens-encrypted-default.md— why tokens live in the SSID, why the default flipped, considered options, consequences (including: the recovery config must not carryENCRYPTME, or a recovered unit re-locks itself on the next boot).CONTEXT-MAP.md— Network context entry + relationships (Network → UI, Network → NixOS migration seam).secure-wifi-refresh-plan.md— the full release-readiness plan: drift analysis of [BETA] More secure WiFi configuration #311 vs today's main (Bottle→Flask port, docs restructure, three panel geometries, i18n), the defect list found reading the diff, and workstreams WS2–WS8 through hardware validation.Open questions (deliberately not settled — grill fodder)
ENCRYPTMEalone is the opt-in path for field units)Side finding
CONTEXT-MAP.mdalready referenceddocs/ax/nixos/CONTEXT.mdanddocs/ax/nixos.md, neither of which exists on main. Not touched here — worth a separate tiny fix.Refs #179, #311.
🤖 Generated with Claude Code
https://claude.ai/code/session_01W6UPq3yDJTqti9kgQXA7NZ