# HPT media 2.0 v0.5.0 release and Pi fixture admission evidence

Status: complete
Type: evidence
Updated: 2026-08-02
Next Action: request separate authorization before physical read-only inspection; keep raw devices and controller access disabled
Canonical Truth: `jong@srv-rpi00.local:~/dev/HPT-Embedded-Log-Store` and `jong@srv-rpi00.local:~/dev/sd_qualification`

## Outcome

The portable HPT media-2.0 core and bounded read-only validator are published
as immutable release v0.5.0. The Pi qualifier imports and fixture-admits the
exact Linux aarch64 validator. This evidence proves software release identity,
fail-closed fixture admission, deployment, and rollback readiness only. It is
not a physical-card, controller, endurance, or media-approval result.

## HPT release identity

- Repository: `Sheldon-Mfg-Inc/HPT-Embedded-Log-Store`.
- Release: `v0.5.0`.
- Tag commit: `d7b1dbe88917e6e8afb59ca2104f6fb411b16d8d`.
- Annotated tag object: `84d1c40075c2ea134c827594e4bc32b653ccf22f`.
- Release-documentation mainline: `0705d6ef028cde31308e2277d7ead202f35ef714`.
- Release URL: `https://github.com/Sheldon-Mfg-Inc/HPT-Embedded-Log-Store/releases/tag/v0.5.0`.
- Source tar SHA-256: `361b06270f1b5ccac4afd2c8e565b6b7d7fc15bbab9c76a7c5c3db90c0801431`.
- Source zip SHA-256: `9859ac6b81d5efe825734d245c189425d8d0b31ca9e6bfa96a7f0a49b3c718c3`.
- Linux aarch64 tool archive SHA-256:
  `d6dcc0bb4dac0c679cfb8a6b110b5706a7e767f116a1806185cf7eae18ad7abc`.
- Validator executable SHA-256:
  `040b8646600ccd0784d2a24f74bbe6e78425da341363c9eb9fde5f3ff7e7d3a4`.
- Contracts: `hpt-media-validator-result/v1` and
  `hpt-media-validator-evidence-manifest/v1`.

PR #2 passed GCC, Clang, GCC/Clang sanitizer, and coverage workflows before
merge. Release packaging and extracted-bundle execution reverified hashes and
produced a complete PASS result against the release fixture. The negative
suite covers structural corruption, real read I/O failure, timeout, malformed
terminal output, bounded partial scan, missing/tampered result evidence, and
source non-modification. Conventional `CMAKE_BUILD_TYPE=Release` remains a
documented build-profile boundary; the published validator is the reviewed,
assertion-enabled GCC profile and is not a Renesas optimized-build claim.

## Pi application and deployment identity

- Repository: `PC-Redemption/sd-qualification`.
- Admission PR: #13, merge `3fb7d8a9c10306d0c9239c4ffd99fc87b39691dd`.
- Explicit audit actor PR: #14, merge
  `6abc5a5eadb4e61e06241a79b3d482453bd18ef8`.
- Accurate repeat-import state PR: #15, merge
  `d82d68932e3c0783454c4919ba2d916ebe749e0d`.
- Deployed release: `hpt-validator-admission-d82d689`.
- Deployed image:
  `sha256:ba4c80fd700c48679a2c19ee404e9b03ebcb41f66d42c7f98eb60dfc2a81f701`.
- Release package:
  `/var/tmp/sd-qualifier-final-packages/hpt-validator-admission-d82d689`.
- `image.tar` SHA-256:
  `451ce791c1ff9686b62300139720922e105b87c846250a49a1899d98526c5ae7`.
- `manifest.json` SHA-256:
  `ceef9cccff4ac208d62add9042b11cd2bf46aab8ec176b3fabc50fa976e6ef90`.
- `sbom.cdx.json` SHA-256:
  `5524212995c55cccb33529ffe6e6190ba51c910ec6c35ad75285291cd7ec7bdc`.
- `SHA256SUMS` SHA-256:
  `07b41e8541f243078932e2f134566a3ce9b489f118f84662b0757398becabd46`.

The exact image passed 64 Django tests. Fifteen repository
contract/network/package tests and 15 focused bundle/admission tests passed.
Migration `0012` passed isolated PostgreSQL apply, rollback to `0011`, and
reapply. The production migration applied after a verified pre-upgrade backup.

## Admitted validator identity

- Bundle ID: `hpt-media-validator-v0.5.0-linux-aarch64`.
- Outer offline manifest SHA-256:
  `91135e68053a0bc019cfc9e3471ba3544eb882cb16114ebede521712de76e7c7`.
- Release/source/executable: v0.5.0 /
  `d7b1dbe88917e6e8afb59ca2104f6fb411b16d8d` /
  `040b8646600ccd0784d2a24f74bbe6e78425da341363c9eb9fde5f3ff7e7d3a4`.
- Platform: Linux aarch64.
- Admission scope: `fixture`.
- Admission actor: `tool-shed-release-review`.
- Recorded authority: `controller_access_authorized=false` and
  `physical_media_authorized=false`.

Admission re-hashed the content-addressed outer bundle, validated the nested
descriptor and complete inventory, required exact `SHA256SUMS`, platform,
release, source, executable, and result/evidence contracts, and failed closed
on every tested mismatch. Repeat import and admission returned
`already-present ... admitted=true scope=fixture` and `already-admitted`.

## Runtime and recovery verification

- Health: database, evidence storage, clock, and workers pass;
  `fixture_only=true`, `fixture_ready=true`, `live_admitted=false`.
- Gate: `HPT_VALIDATOR_FIXTURE_ADMITTED` passes.
- All web, command-worker, and notification-worker containers use the exact
  deployed image with zero restarts; logs contain no traceback, exception,
  error, or critical entry for the deployment interval.
- Pre-upgrade backup: `/backups/sd-qualifier-20260802T205918Z.dump`, SHA-256
  `8d9251625351c763e5d8752854d19a675388ded96af0091a19267b96f84fc151`;
  disposable restore passed.
- Post-admission backup: `/backups/sd-qualifier-20260802T210549Z.dump`, SHA-256
  `17f0004ff13aad9df6be834eb826c5e00d5427c638118720735897eae527d4b3`;
  disposable restore passed.

## Preserved gates

- The validator has not been invoked by the Pi application yet.
- No raw block device or physical SD card was selected, mounted, read, moved,
  removed, inserted, formatted, repaired, or written.
- No controller, J-Link, USB, relay, power, or firmware operation occurred.
- Controller B remains frozen and T00 remains unresolved no-action evidence.
- Live-controller admission, the protected A/B registry, approval trust anchor,
  power/media operations, physical transfer, and endurance remain separate
  blocked or disabled gates.

## Fixture runner completion

Pi PR #16 and hardening PR #17 merged at
`d7dcd4c03c7c2192062e81a9d846b16b06ddd189` and
`2d35bc911bef3d2d0b9fa840bcd31b6ae0f5cd61`. Exact deployed release
`hpt-fixture-runner-2d35bc9` uses image
`sha256:525ce212e7c24b782ce301ace12b0fb88409a81aea3968b6726ed72972409cc7`.
All 67 Django tests pass. The server-owned sparse fixture image hashes to
`0a6fc612c75d067ebd0888f640ab48f07dd1c921c329ca1c693af0e08c8687b7`,
is mounted read-only, and has no browser-supplied path. The command worker runs
the verified copied binary only in a dedicated `exec,nosuid,nodev` tmpfs while
general `/tmp` remains non-executable. The deployed real validator returned
`PASS`, `complete=true`, `read_only=true`, and `record_count=12`; both HPT
fixture gates pass, all three services share the exact image with zero
restarts, and `live_admitted=false`. A fixture PASS explicitly leaves specimen
qualification outcome pending.
