# Program Roadmap: Firmware Service-Code SD Qualification

Status: approved
Type: program-roadmap
Updated: 2026-08-30
Project Map: MAP-0004
Source Idea: IDEA-0001
Outcome Cycle: cec58490-b533-46a7-bbe5-10e7addba684
Requested Endpoint: work2
Next Action: owner selects the firmware/Pi authority split in M1; then freeze the shared test catalog

## Program Outcome

Produce a committed firmware candidate in which individual SD qualification
services and one ordered full-run service use one shared leaf-test engine, then
deploy that exact commit to an explicitly bound non-production work target and
prove its changed behavior. Preserve powered-removal safety, CID-bound run
identity, no-replay recovery, standards-based USB publication, bounded-work
evidence, and independent final qualification authority.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze the qualification authority and shared test catalog | `G1-SHARED-TEST-CATALOG`, `G2-FIRMWARE-WITNESS-AUTHORITY` | none | blocked on material owner decision |
| M2 | Prove pause/resume and evidence contracts in a target-independent reference model | `G3-PAUSE-RESUME-SAFETY`, `G4-EVIDENCE-PUBLICATION` | M1 | waiting |
| M3 | Integrate the shared engine, service dispatcher, journal, and publication path; build and verify bounded work | `G5-PERFORMANCE-ADMISSION` | M2 | waiting |
| M4 | Deploy the exact candidate to the bound development target, run focused changed-behavior/rollback checks, and register the Work2 release cohort | `G6-WORK2-DEVELOPMENT-TARGET` | M3 | waiting |

## M1 — Authority And Catalog Freeze

### Material decision D1

- **A — Recommended hybrid:** firmware owns leaf-test truth, prerequisites,
  progress, safe-stop checkpoints, and technical results; the Pi/web qualifier
  owns campaign sequencing across controllers, independent power witnessing,
  evidence ingestion/admission, and reviewer/family disposition.
- **B — Firmware owns the full campaign:** simplifies offline execution but
  moves cross-controller, review, persistent evidence, and power-witness burden
  into the controller and weakens independent observation.
- **C — Pi owns the full-run order:** stays closest to the current governing
  contract but does not deliver IDEA-0001's firmware full-run service unless
  that service becomes a thin, Pi-directed leaf sequence.

The choice changes product responsibility and `SMI-SDQ-CONTRACT-V1`; autonomy
cannot make it implicitly. After D1, freeze the exact 480–489 allocation only
after confirming dispatcher availability. The catalog must reuse existing CID,
media classification, scrub, lane, wrap/reclaim, recovery, endurance, export,
and mailbox mechanisms rather than create parallel test implementations.

### M1 completion evidence

- reviewed authority table and governing-contract disposition;
- stable service catalog and order;
- leaf prerequisites, destructive classification, progress/work counters,
  safe-stop point, and result dimensions;
- source-level call graph or model proof that individual and full-run entry
  invoke the same leaf implementations.

## M2 — Safety And Evidence Reference Model

- Select a controller journal location only after its atomicity, integrity,
  wear, compatibility, and rollback rules are evidenced.
- Require manual continuation after reboot; validate run/profile, firmware,
  checkpoint, raw CID, representative-sector readability, and media state.
- Never automatically replay an incomplete destructive phase.
- Model planned pause, unexpected reset, CID mismatch, journal corruption,
  missing USB, USB loss, explicit evidence-only override, and late export.
- Freeze a unique run directory with manifest, append-only events, per-test
  summaries, and a completion marker published last.

## M3 — Firmware Candidate

- Add the shared state machine and service dispatch without specimen-specific
  SD or USB behavior.
- Preserve fixed-width mailbox/API compatibility and normal production paths.
- Add target-independent model and repository policy checks.
- Predict and measure reads, writes, flushes, retries, elapsed time, progress,
  and no-progress behavior for every leaf.
- Run the canonical managed Debug rebuild and package/hash validation.
- Create one scoped local candidate commit; do not include unrelated pre-existing
  worktree changes.

## M4 — Work2 Delivery

### Material target decision D2

Bind the exact non-production target, media specimen, deployment mechanism,
rollback identity, and focused checks. The current repository does not define
such a target. Controller A/B programming, remote Pi mutation, destructive
media work, and physical SD intervention require their own exact authority and
instructions.

After binding, deploy the exact candidate commit, repeat the complete CID
identity block at the required baseline/reboot points, run focused
changed-behavior and rollback checks, write a fresh ignored
`tool-shed-target-evidence` envelope, and use Work2 orchestration closeout to
register the candidate and this open outcome chain in the release cohort.

## Deferred Beyond Work2

- production push, tag, release, or promotion;
- card-family qualification credit or final family disposition;
- ECR/ECO, sourcing, BOM, pilot, or rollout decisions;
- physical destructive qualification not separately authorized.

