Reaper v2.7.6 — RT-BE96U

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (RT-BE96U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE96U_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	8f9f195d1ab91c8cb840865548cfd9460cee8801f81095a3471a07f7fe79784a
Standard	RT-BE96U_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	c1b5472a0fb32fce1fa6889fe0713c9ce7eba0df7c22186bd1fa143af93dfd80

Verify a download against the attached SHA256SUMS-RT-BE96U-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The RT-BE96U image for v2.7.6 is built from this repository at tag v2.7.6-RT-BE96U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-RT-BE96U (patches + docs).

Reaper v2.7.6 — RT-BE88U

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (RT-BE88U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE88U_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	6699f1b5a548c03f81267dbec1891325940d07556801985c493bf41a9e061091
Standard	RT-BE88U_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	0bf557b9dbf3f56c99c1fbf6bf227ec7301796c12541d2f1a3dc1b5f7df0da0d

Verify a download against the attached SHA256SUMS-RT-BE88U-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The RT-BE88U image for v2.7.6 is built from this repository at tag v2.7.6-RT-BE88U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-RT-BE88U (patches + docs).

Reaper v2.7.6 — RT-BE86U

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE86U_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	130c6b175025e5754bb44d8277a4f8316215c5584d64a414f70d2d64275d90cb
Standard	RT-BE86U_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	f9491bbf6064ca7d6b5025a3906afc6d92c2035bb90e8792b011ab8451766df6

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The RT-BE86U image for v2.7.6 is built from this repository at tag v2.7.6-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-RT-BE86U (patches + docs).

Reaper v2.7.6 — GT-BE98_PRO

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (GT-BE98_PRO)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	GT-BE98_PRO_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	4dd78eab8a112dd3f8ec4faf47a78b638fd42a70d78df7945887f2fec0c0f0a3
Standard	GT-BE98_PRO_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	aab7de4d573713f6e0142012b83a7fd360d39c8b78751031f0c4f2cea1894d03

Verify a download against the attached SHA256SUMS-GT-BE98_PRO-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The GT-BE98_PRO image for v2.7.6 is built from this repository at tag v2.7.6-GT-BE98_PRO: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-GT-BE98_PRO (patches + docs).

Reaper v2.7.6 — GT-BE98

v2.7.6 — Policy Routing survives a reboot, Warden never fails silently

This rung folds the v2.7.4–v2.7.6 field-fix work (patches 0529–0535) into one fleet cut across
all five 96813GW models; RT-BE92U (BCM6765) carries the same shared changes on its own branch.

• Policy Routing comes up complete after a reboot — no UI Apply needed. A rule that matches an
  address set could not load until that set existed, and at boot the set was sometimes a moment
  late, leaving the REAPER_PBR mark chain short until someone re-applied from the page. The
  routing apply script now materialises its own object sets first, and the firewall re-applies the
  chain under the firewall lock, so a fresh boot brings the whole chain up on its own.
• A 40-domain object saves in one paste. The Firewall/Policy-Routing list editor is now
  paste-tolerant (whitespace- and newline-normalised), shows a persistent error instead of a
  silent drop, and its buffers were widened — a large domain object saves in a single paste rather
  than a few entries at a time.
• The Warden page never fails silently. Under load it now shows “Stats unavailable — retrying”
  instead of dead placeholder numbers, and the stats collector’s lock wait was shortened. The
  firewall-layer re-apply (Gatekeeper / Warden / engine) now runs under the firewall lock, and the
  Policy-Routing teardown deletes only the rules carrying Reaper’s own fwmark, so a co-installed
  add-on’s routing rules are left alone.
• About page “Patches applied” shows a number again (build-side fix). The count is stamped by
  the build, which read the series version from the last patch’s filename — empty on any rung
  whose tip is a feature patch rather than the version bump (as this one’s is), so the page showed
  a dash. The stamp now takes the highest reaper_v version across the whole series, so it reads
  “535 — series as of v2.7.6” on a local image and the plain count on a matching CI image. Fixes
  both local and CI builds.

---

Images & checksums (GT-BE98)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	GT-BE98_3006_102.8_Reaper_v2.7.6_nand_squashfs.pkgtb	4c6ff3529681af26f02dfa635bef5f2096f9cdab76e8a39b681aece7a4fbf3a2
Standard	GT-BE98_3006_102.8_Reaper_v2.7.6_noMCP_nand_squashfs.pkgtb	604489731f6aae4824591aaefa1187f67c16affc1cb0e0604a91e6cad36f6100

Verify a download against the attached SHA256SUMS-GT-BE98-Reaper_v2.7.6.txt.

---

Corresponding source & reproducibility

The GT-BE98 image for v2.7.6 is built from this repository at tag v2.7.6-GT-BE98: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0535)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 70468ae755280dd884e4bf7604fed6f04b863dcd -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.6-GT-BE98 (patches + docs).

Work to add RT-BE92U to the supported devices.

What v2.7.6 carries over v2.7.5 (canon c793b26229 + f1faad50c6, bump 71a4fd46ca; rt-be92u 598d814177 + 5b1fe5cf4c, bump 23bb050c54):

• Policy Routing apply.sh now builds its object ipsets itself on every apply, so a reboot can no longer leave the mangle chain short until a UI Apply; failed rules are named in syslog.
• 40-domain object pastes: tolerant normaliser, persistent error naming every offender, no silent truncation; plus the rfw_obj_set buffer bug that made a ≥768-byte object's firewall rules match nothing.
• Warden page shows "Stats unavailable – retrying" instead of dead placeholders; stats.sh waits 2 s not 5.
• All Reaper layer re-applies after restart_firewall run under the firewall lock (firewall-start addon hooks are fire-and-forget).
• PBR teardown deletes only ip rules carrying our fwmark — an addon's rules (domain_vpn_routing) survive.
• Metal owed: reboot → full REAPER_PBR chain with no Apply; a 40-domain paste saving in one go; Warden page under load; an addon ip rule in 9001–9115 surviving restart_firewall.

Expanding Supported Devices

Root cause (all models, not just BE92U): state.js first-run gate 3 used sdn_rl === factory default as "Wi-Fi never configured". sdn_rl only grows when a guest/SDN network is created, so any box with no guest network tripped it forever: every framed page → top-bounce to Reaper_FirstBoot.asp → its leave-guard (creds + w_Setting set) → straight back to the dashboard. That's the half-second "Secure Your Router" flash. Dev units all had guest networks, so it was never seen. Fix: gate 3 deleted; w_Setting (already used by gate 2, httpd, dashboard, wizard) is the one signal.

Two snags hit and fixed along the way: the engine reads release/src-rt/version.conf, not the src-rt-5.04behnd.4916 copy (first launch came up tagged v2.7.3 — killed, bump corrected, nothing shipped); and a nohup under a one-shot wsl call dies with the session — relaunched with setsid. Both noted in memory/postgres.

Reaper v2.7.3 — RT-BE96U

v2.7.3 — polish pass + Gatekeeper learns AiMesh exists (in progress, not yet built)

Firmware-update manifest signing — built, and shelved inert for now (owner decision). The
full machinery exists: the manifest can be signed (RSA-4096/SHA-256) with a key that exists only
offline — deliberately not in the repository and not in CI — and the router can verify the
signature against a public key baked into the firmware before honouring a single field, refusing a
missing or invalid signature outright. For this release the enforcement ships disabled: the
verify code, embedded public key, signing tooling and CI checks are all present but inert behind
two explicit switches (REAPER_SIG_ENFORCE in the check script — a rebuild, deliberately — and
build-scripts/signing.conf for the tooling/CI side), so it can be turned on end-to-end later
without rework.
(Key note: the shipped OpenSSL 1.1.1 CLI has no one-shot Ed25519, so RSA via dgst is the
primitive; if the tree later moves to Merlin's OpenSSL 3.x-with-shim arrangement, the documented
rotation path can move the key to Ed25519.)

A refused signature explains itself: instead of the generic "check failed", the Firmware page
says the update list failed authentication, that this is briefly expected right after a release is
published, and that a persistent failure can mean a compromised source. Beside it, an explicit
Override exists for the operator who knows what they are doing: a danger dialog whose confirm
button only unlocks after typing OVERRIDE, arming a one-shot flag the next check consumes — the
overridden offer then stays visibly branded UNVERIFIED, and the override is loudly logged. It can
never happen by accident, and it never persists.

rwatch's self-heals now run under the firewall lock. The policy-routing and Warden chain
re-asserts used to run the (idempotent) apply scripts outside rc's firewall lock — at worst a
transient inconsistency, but shell flock can't take rc's POSIX fcntl lock, so a small rc applet
now takes the real lock and runs the (allow-listed) heal script; a heal that races a firewall
rebuild serializes behind it.

AiMesh onboarding and mesh nodes are now exempt from Gatekeeper. A full review of the
add-node/search path (prompted by contradictory field reports) proved the search/add chain itself
is byte-for-byte stock — but no Reaper enforcement layer knew AiMesh existed: with Gatekeeper in
default-deny mode, a joining node got its DHCP lease and then every packet to the router's mesh
controller was dropped, so adding a node stalled right after association — and enabling
default-deny on an existing mesh silently cut the nodes' control traffic. Now the mesh's own
pairing registry exempts node MACs from every Gatekeeper surface (ahead of per-device rules, so a
mis-filed entry can never sever a live backhaul), the exemptions refresh automatically when a node
joins or leaves, and while an add is actually in progress the quarantine gate is held open for
router-bound traffic only — time-boxed, and closed within seconds of the add finishing. The
diagnostic's Gatekeeper section now shows the registry and window state.

• Full-backup card alignment: the new card on the Administration page now sits flush with the
  stock table under it instead of floating centered.
• USB format confirmation (and Safely Remove) now use a Reaper-themed dialog instead of the
  browser's stock popup. Formatting requires a deliberate click — Enter does not confirm it. The
  themed dialog is a shared helper other pages will adopt over time.
• The owner's guide is one click away everywhere: a ? in the shell and dashboard topbars opens
  docs/REAPER-GUIDE.md; the Firewall, Gatekeeper, Warden, Storage and USB pages deep-link their own
  guide sections beside the page title; the About page carries an "Owner's Guide" button; the
  first-boot page mentions it. External links only — the router never fetches anything.
• Flash page "Cancel leaves the buttons dead": a harness executing the page's real script shows
  every Cancel path in current firmware leaves the page fully usable — the report matches the
  pre-v2.3.4 polling bug that was fixed then. One residual wedge (an error thrown between arming
  and the overlay painting) is now cleared automatically. If it recurs on v2.7.x, exact steps
  would pin it.

---

---

Images & checksums (RT-BE96U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE96U_3006_102.8_Reaper_v2.7.3_nand_squashfs.pkgtb	e84ff66230974cbfb639b060339f18f46815e0f32acb473480eb1300dc2fe6f7
Standard	RT-BE96U_3006_102.8_Reaper_v2.7.3_noMCP_nand_squashfs.pkgtb	a100ffc6a1e8c9033488f7c6481fee350ad413ba069f0ed6431bcc563b4dad0b

Verify a download against the attached SHA256SUMS-RT-BE96U-Reaper_v2.7.3.txt.

---

Corresponding source & reproducibility

The RT-BE96U image for v2.7.3 is built from this repository at tag v2.7.3-RT-BE96U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0528)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): c28247589b990ffa335f6b4e793624691bd59af5 -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.3-RT-BE96U (patches + docs).

Reaper v2.7.3 — RT-BE88U

v2.7.3 — polish pass + Gatekeeper learns AiMesh exists (in progress, not yet built)

Firmware-update manifest signing — built, and shelved inert for now (owner decision). The
full machinery exists: the manifest can be signed (RSA-4096/SHA-256) with a key that exists only
offline — deliberately not in the repository and not in CI — and the router can verify the
signature against a public key baked into the firmware before honouring a single field, refusing a
missing or invalid signature outright. For this release the enforcement ships disabled: the
verify code, embedded public key, signing tooling and CI checks are all present but inert behind
two explicit switches (REAPER_SIG_ENFORCE in the check script — a rebuild, deliberately — and
build-scripts/signing.conf for the tooling/CI side), so it can be turned on end-to-end later
without rework.
(Key note: the shipped OpenSSL 1.1.1 CLI has no one-shot Ed25519, so RSA via dgst is the
primitive; if the tree later moves to Merlin's OpenSSL 3.x-with-shim arrangement, the documented
rotation path can move the key to Ed25519.)

A refused signature explains itself: instead of the generic "check failed", the Firmware page
says the update list failed authentication, that this is briefly expected right after a release is
published, and that a persistent failure can mean a compromised source. Beside it, an explicit
Override exists for the operator who knows what they are doing: a danger dialog whose confirm
button only unlocks after typing OVERRIDE, arming a one-shot flag the next check consumes — the
overridden offer then stays visibly branded UNVERIFIED, and the override is loudly logged. It can
never happen by accident, and it never persists.

rwatch's self-heals now run under the firewall lock. The policy-routing and Warden chain
re-asserts used to run the (idempotent) apply scripts outside rc's firewall lock — at worst a
transient inconsistency, but shell flock can't take rc's POSIX fcntl lock, so a small rc applet
now takes the real lock and runs the (allow-listed) heal script; a heal that races a firewall
rebuild serializes behind it.

AiMesh onboarding and mesh nodes are now exempt from Gatekeeper. A full review of the
add-node/search path (prompted by contradictory field reports) proved the search/add chain itself
is byte-for-byte stock — but no Reaper enforcement layer knew AiMesh existed: with Gatekeeper in
default-deny mode, a joining node got its DHCP lease and then every packet to the router's mesh
controller was dropped, so adding a node stalled right after association — and enabling
default-deny on an existing mesh silently cut the nodes' control traffic. Now the mesh's own
pairing registry exempts node MACs from every Gatekeeper surface (ahead of per-device rules, so a
mis-filed entry can never sever a live backhaul), the exemptions refresh automatically when a node
joins or leaves, and while an add is actually in progress the quarantine gate is held open for
router-bound traffic only — time-boxed, and closed within seconds of the add finishing. The
diagnostic's Gatekeeper section now shows the registry and window state.

• Full-backup card alignment: the new card on the Administration page now sits flush with the
  stock table under it instead of floating centered.
• USB format confirmation (and Safely Remove) now use a Reaper-themed dialog instead of the
  browser's stock popup. Formatting requires a deliberate click — Enter does not confirm it. The
  themed dialog is a shared helper other pages will adopt over time.
• The owner's guide is one click away everywhere: a ? in the shell and dashboard topbars opens
  docs/REAPER-GUIDE.md; the Firewall, Gatekeeper, Warden, Storage and USB pages deep-link their own
  guide sections beside the page title; the About page carries an "Owner's Guide" button; the
  first-boot page mentions it. External links only — the router never fetches anything.
• Flash page "Cancel leaves the buttons dead": a harness executing the page's real script shows
  every Cancel path in current firmware leaves the page fully usable — the report matches the
  pre-v2.3.4 polling bug that was fixed then. One residual wedge (an error thrown between arming
  and the overlay painting) is now cleared automatically. If it recurs on v2.7.x, exact steps
  would pin it.

---

---

Images & checksums (RT-BE88U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE88U_3006_102.8_Reaper_v2.7.3_nand_squashfs.pkgtb	fab8350e1afc0d9d96cd03a75625bb6b8d7c3dce0de47222076cd13f26367cae
Standard	RT-BE88U_3006_102.8_Reaper_v2.7.3_noMCP_nand_squashfs.pkgtb	ff18a2743945f85db5918e48822aeb8695a9255952e1618722c42232d103c0b6

Verify a download against the attached SHA256SUMS-RT-BE88U-Reaper_v2.7.3.txt.

---

Corresponding source & reproducibility

The RT-BE88U image for v2.7.3 is built from this repository at tag v2.7.3-RT-BE88U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0528)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): c28247589b990ffa335f6b4e793624691bd59af5 -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.3-RT-BE88U (patches + docs).

Reaper v2.7.3 — RT-BE86U

v2.7.3 — polish pass + Gatekeeper learns AiMesh exists (in progress, not yet built)

Firmware-update manifest signing — built, and shelved inert for now (owner decision). The
full machinery exists: the manifest can be signed (RSA-4096/SHA-256) with a key that exists only
offline — deliberately not in the repository and not in CI — and the router can verify the
signature against a public key baked into the firmware before honouring a single field, refusing a
missing or invalid signature outright. For this release the enforcement ships disabled: the
verify code, embedded public key, signing tooling and CI checks are all present but inert behind
two explicit switches (REAPER_SIG_ENFORCE in the check script — a rebuild, deliberately — and
build-scripts/signing.conf for the tooling/CI side), so it can be turned on end-to-end later
without rework.
(Key note: the shipped OpenSSL 1.1.1 CLI has no one-shot Ed25519, so RSA via dgst is the
primitive; if the tree later moves to Merlin's OpenSSL 3.x-with-shim arrangement, the documented
rotation path can move the key to Ed25519.)

A refused signature explains itself: instead of the generic "check failed", the Firmware page
says the update list failed authentication, that this is briefly expected right after a release is
published, and that a persistent failure can mean a compromised source. Beside it, an explicit
Override exists for the operator who knows what they are doing: a danger dialog whose confirm
button only unlocks after typing OVERRIDE, arming a one-shot flag the next check consumes — the
overridden offer then stays visibly branded UNVERIFIED, and the override is loudly logged. It can
never happen by accident, and it never persists.

rwatch's self-heals now run under the firewall lock. The policy-routing and Warden chain
re-asserts used to run the (idempotent) apply scripts outside rc's firewall lock — at worst a
transient inconsistency, but shell flock can't take rc's POSIX fcntl lock, so a small rc applet
now takes the real lock and runs the (allow-listed) heal script; a heal that races a firewall
rebuild serializes behind it.

AiMesh onboarding and mesh nodes are now exempt from Gatekeeper. A full review of the
add-node/search path (prompted by contradictory field reports) proved the search/add chain itself
is byte-for-byte stock — but no Reaper enforcement layer knew AiMesh existed: with Gatekeeper in
default-deny mode, a joining node got its DHCP lease and then every packet to the router's mesh
controller was dropped, so adding a node stalled right after association — and enabling
default-deny on an existing mesh silently cut the nodes' control traffic. Now the mesh's own
pairing registry exempts node MACs from every Gatekeeper surface (ahead of per-device rules, so a
mis-filed entry can never sever a live backhaul), the exemptions refresh automatically when a node
joins or leaves, and while an add is actually in progress the quarantine gate is held open for
router-bound traffic only — time-boxed, and closed within seconds of the add finishing. The
diagnostic's Gatekeeper section now shows the registry and window state.

• Full-backup card alignment: the new card on the Administration page now sits flush with the
  stock table under it instead of floating centered.
• USB format confirmation (and Safely Remove) now use a Reaper-themed dialog instead of the
  browser's stock popup. Formatting requires a deliberate click — Enter does not confirm it. The
  themed dialog is a shared helper other pages will adopt over time.
• The owner's guide is one click away everywhere: a ? in the shell and dashboard topbars opens
  docs/REAPER-GUIDE.md; the Firewall, Gatekeeper, Warden, Storage and USB pages deep-link their own
  guide sections beside the page title; the About page carries an "Owner's Guide" button; the
  first-boot page mentions it. External links only — the router never fetches anything.
• Flash page "Cancel leaves the buttons dead": a harness executing the page's real script shows
  every Cancel path in current firmware leaves the page fully usable — the report matches the
  pre-v2.3.4 polling bug that was fixed then. One residual wedge (an error thrown between arming
  and the overlay painting) is now cleared automatically. If it recurs on v2.7.x, exact steps
  would pin it.

---

---

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant	File	SHA-256
+ AI Advisor	RT-BE86U_3006_102.8_Reaper_v2.7.3_nand_squashfs.pkgtb	b00073665f6c766abf49f4b0cd0f249f273744231b7ad2241de9271512becf9c
Standard	RT-BE86U_3006_102.8_Reaper_v2.7.3_noMCP_nand_squashfs.pkgtb	77476841a65fb4877433c7553ebfcdc916a110808bd40ae357043ed8a09a54f4

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v2.7.3.txt.

---

Corresponding source & reproducibility

The RT-BE86U image for v2.7.3 is built from this repository at tag v2.7.3-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0528)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): c28247589b990ffa335f6b4e793624691bd59af5 -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.3-RT-BE86U (patches + docs).