TheUnboundDeveloper/AM-Reaper v3.6.0-beta-RT-BE88U

Reaper v3.6.0-beta — RT-BE88U

on GitHub

v3.6.0 — Asuswrt-Merlin 3006.102.10 (ASUS GPL 102_40585) for four models, custom-script output kept, your own Wallguard and Dreadwatch sources, Bastion

Everything in v3.5.0 is included.

• New base for the RT-BE96U, RT-BE86U, RT-BE88U and GT-BE98 Pro: Asuswrt-Merlin 3006.102.10 (ASUS GPL 102_40585).
  The Reaper series was rebased from
  3006.102.8-beta2 (a7ebfa133a) onto Merlin main at ca72a61f8bc (untagged upstream). The firmware line is
  now 3006.102.10_Reaper_v<X>; image names carry 3006_102.10. Every Reaper change was replayed; where upstream
  had fixed the same defect its fix was kept - the asus_openssl_crypt injection (C6), IPsec profile parsing
  (H6/M2) and the miniupnpd 2.3.10 carry now come from upstream. A file-by-file audit of the result against the
  pre-rebase tree found the Reaper fixes the replay had undone (four shipped stock pages, the multi-WAN DNS check)
  and restored them, and seven stock pages Reaper deletes (app installer, AiCloud / WebDAV, the AiDisk wizard,
  AiProtection groups, Alexa / IFTTT) stay deleted - the rebase had re-created them. The AiMesh MAC checks are
  upstream's isValidMacAddress() now, hardened to refuse any character but hex digits and separators. The patch series is regenerated from the new base: 855 patches, numbered from 0001.
• GT-BE98, GT-BE19000, ZenWiFi BQ16 and ZenWiFi BQ16 Pro stay on 3006.102.8. ASUS has not published a 102_40585-era GPL for them, and the
  40585 source calls closed components their 102_39274 / 102_39256 releases do not have (the clean-room build
  stopped at MISC_INFO_WIFI_GEN). Their v3.6.0 is built from the 3006.102.8 base, image names 3006_102.8,
  from the Dev-102.8 branch, and carries every Reaper change below; what they do not get is the new base and
  the items marked for the 3006.102.10 models. isValidMacAddress() is hardened the same way on both bases.
  They move to the new base when ASUS publishes one.
• libnvram / libwlcsm: ASUS's 40585 pair. Same netlink socket-leak fix as the 42015 pair Reaper carried since
  v3.1.8, plus ASUS's caller check in nvram_set() for sshd_enable, sshd_port, sshd_pass, sshd_authkeys
  and ookla_quota. On the RT-BE96U a root shell's nvram set of those keys still works (tested on the router);
  every Reaper writer of them is httpd or rc either way. GT-BE98, GT-BE19000, BQ16 and BQ16 Pro keep the 42015
  pair: their platform trees predate the caller check.
• OpenVPN server certificates on Easy-RSA 3 (3006.102.10 models). On OpenSSL 3 builds 40585 stages easyrsa and no pkitool. The
  server-certificate repair imports the CA the router already holds into a fresh PKI and issues the server leaf
  with easyrsa; reaper_verify (ovpn-pki) runs the first-time and the repair chains on the image's own openssl.
• Custom scripts keep their output and say when they fail. rc runs /jffs/scripts/* as before, but under a
  watcher: the first 64 KB of a script's output is kept in /tmp/reaper/script-<name>.log (last run) and one
  syslog line reports a non-zero exit with the last thing it printed. A script with Windows line endings is named
  as such. reaper_diag v1.3.51 section 13 reports each script (executable, CRLF, last outcome).
• Wallguard and Dreadwatch: removable built-in lists, your own sources, API sources. Every list can be removed,
  including the ones the router sets up; your own lists are a text list at an https:// address or a supplier's
  API (GET or POST, a JSON field, one header). API keys are write-only (/jffs/wallguard/keys,
  /jffs/rwarden/dnskeys, root 0600) and reach curl only through a root-only config file. Dreadwatch fetches
  through Wallguard's code path.
• Bastion. The menu that holds Warden, Dreadwatch, Wallguard and Encrypted DNS is named Bastion; the Warden tab
  keeps its name. The four tools no longer gate each other: Dreadwatch runs without Warden.
• WAN 802.1Q only where the firmware can tag the WAN. GT-BE98, GT-BE19000, BQ16 and BQ16 Pro build without
  Multi-Service WAN, so the switch was dropped on save, the router rebooted and came back with no connection. The
  page now shows the switch only with mswan support and points the others to LAN > IPTV (Internet VID / PRIO).
• Backups carry every option and keep the DDNS hostname. The settings file now includes Wallguard and
  Dreadwatch's sources; a restore no longer brings Wallguard back on with no lists. The hostname is no longer
  blanked (Reaper has no ASUS DDNS, so every hostname is the operator's own).
• Browsers see a new page after a flash or a setting change. Every ETag carries the build, stylesheets and
  Reaper scripts answer Cache-Control: no-cache, and a page with server-side values gets no ETag.
• Settings written into page scripts are escaped (nvram_get_js): a value holding ' or \ can no longer end
  a script string early on Reaper pages.
• Translated labels fit. A label too long for its space is shortened with "..." and shows the whole word on
  hover; only shortened labels get the tooltip.
• Wireless Log: one box per network inside each radio (main, guests, the AiMesh backhaul), named.
• Fixes: the Internet Speed Test tab opens at once under the Reaper shell (it waited ~5 s for a stock menu
  height; 3006.102.10 models); rwatch stands down during a firmware upgrade (a tick in the upgrade's teardown reported the missing
  firewall chains as a failure and restarted rpunctd); USB start no longer logs a failed tfs_linux modprobe on
  4.19-kernel models (3006.102.10 models); httpd bounds the model name it lower-cases for the product image; the Feedback page's
  Inner Version follows the running image instead of the image the router was first set up on; the About page
  reads the base version from the firmware.

Images & checksums (RT-BE88U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

This is a beta release. Its filename carries _BETA and the router reports the same string on the dashboard and the About page, so you can always tell which channel a flashed image came from. Stable releases carry no marker.

Verify a download against the attached SHA256SUMS-RT-BE88U-Reaper_v3.6.0.txt.

Corresponding source & reproducibility

The RT-BE88U image for v3.6.0-beta is built from this repository at tag v3.6.0-beta-RT-BE88U: the pinned Asuswrt-Merlin base (3006.102.10, ca72a61f8bc) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/
• Provenance record: provenance/manifest.json
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.6.0-beta-RT-BE88U (patches + docs).