# Project Executive Intent: SMI Firmware

Status: active
Type: decision
Role: project-executive-intent-v1
Updated: 2026-09-22

## North Star

Deliver dependable SMI oven firmware that keeps control, monitoring, and alarms operating through storage faults, and releases only behavior proven on both controller assemblies.

## Current Completion Horizon

Complete the SMI 00-05-01 and DisplayTest 01-01 or later transition through an evidence-backed release decision. "Done" requires the return path, the ordinary personality update floor, direct service rollback to any valid SMI image, explicit in-place FAT32 or HPT2 card preparation as applicable, and forward, return, refusal, and rollback tests on both assemblies. A passing build alone does not close this horizon.

## Strategic Context

SMI 00-05-00 introduced HPT2 logging, but lacks the proposed ordinary-update downgrade guard. Production DisplayTest hands off FAT32 media, while SMI prepares HPT2 media explicitly. A rare recovery may need direct installation of older SMI firmware; the installed SD card is not field accessible for replacement, so FAT32-era rollback requires a controlled in-place format. Service 471 can explicitly reinitialize HPT2 if current SMI remains bootable after a pre-flash failure. Internal-flash failure risk applies to upgrades and downgrades. Firmware candidate identity and exact-byte release controls are established; the full HPT2 claim and SD-card family qualification have separate evidence gates.

The SMI ordinary updater owns the 00-05-01 personality floor while HPT2 media may remain installed. The DisplayTest 01-01 return floor is distinct: revised DisplayTest must tolerate HPT2 on startup and verify FAT32 before its normal production test or personality install. Its own fixture-to-fixture floor is 01-01, and it may install a valid older SMI after FAT32 handoff. Read-only DisplayTest source and Controller B records support that path, but do not close the SMI two-controller transition gate.

## Current Priorities

- Review the SMI 00-05-01 source candidate under MAP-0009 and IDEA-0007, using IDEA-0006 for the technical contract. Ordinary Title floors, service rollback, and CID-checked FAT32 preparation now build.
- Retain immutable candidate `00.05.01-77495a3715ff-5a30dd9eacda` and the exact Controller A program/readback evidence.
- Verify Controller A visual boot, touch, SMI identity, and FAT32 warning, then establish correct SMI QSPI resources and generate the controlled IMX.
- Continue the authorized A-first/B-second forward, return, ordinary refusal, and controlled rollback matrix; make the later release decision from exact candidate evidence.

## Deliberate Non-Goals

- No automatic SD-card conversion or erase, and no field SD-card swap as a rollback workflow.
- No claim that the update Title authenticates its publisher.
- No automatic CVO/DVO release, SD-family approval, ECO, or customer rollout from the SMI transition result.

## Decisions Needed

- Select exact DisplayTest 01-01 or later and representative SMI IMX specimens for qualification, with hashes and media requirements. These are test evidence, not image allowlists.
- Decide when to resume bench transition testing.
- A later release decision must identify the exact qualified candidate.
- Complete the current Controller A visual observation and select the controlled SMI resource/image path before service 150.

## Review Triggers

- A DisplayTest 01-01 or later candidate is qualified for safe HPT2 startup and FAT32 handoff.
- Controller A visual boot or storage evidence contradicts the read-only target capture.
- Either assembly produces contradictory transition evidence.
- The in-place FAT32 preparation or service-471 recovery path produces contradictory evidence.
- An exact candidate reaches release qualification.
- The SD qualification or supply-change scope changes.
