# Pi authorization-envelope migration deployment manifest — 2026-08-04

Status: complete
Type: evidence
Updated: 2026-08-04
Next Action: none
Parent: work/tickets/ticket-implement-qualification-authorization-envelopes-in-pi-coordinator.md

## Authority

- Operator approval: `approved ts:plan, build, deploy, ship`
- Governing ADR: `work/adr/adr-qualification-authorization-envelopes-and-machine-intents.md`
- Implementation ticket: `work/tickets/ticket-implement-qualification-authorization-envelopes-in-pi-coordinator.md`
- Scope: make one reviewed human envelope plus separate non-replayable machine intents the standard Pi qualification authorization boundary; make read-only continuation automatic.

## Exact source and image

- Pi repository: `jong@srv-rpi00.local:~/dev/sd_qualification`
- Migration/base commit: `16d7d04fb416872192711f9766e20c1d42db3c08`
- Final matrix-scope commit: `1e62f33`
- Final release identity: `authorization-envelopes-1e62f33`
- Final image: `sha256:505ea42f0bc3ff561da26bcc1382d27073d750ac4aa5d9718174a38bf9f1c730`
- Rollback tag: `srv-rpi00-sd-qualifier:rollback-d7eb2da-pre-auth-envelope-20260804`

## Exact migration

- Apply only: `qualification.0015_authorizationenvelope`
- File: `qualification/migrations/0015_authorizationenvelope.py`
- SHA-256: `8af9f8f0eb2d7df621e4a842f0361e8531e0ec9f9d9bd0326f0413f14c8f1155`
- `makemigrations --check --dry-run`: no changes detected

## Verified archive

- Backup: `/backups/sd-qualifier-20260804T225734Z.dump`
- SHA-256: `566b1d094f9022bf4d6df3af69988d9671cd209a138305130be3026f96398ea3`
- Restore check: passed
- Pre-apply qualification migration rows reported by restore check: `5`

## Apply and verification sequence

1. Stop command and notification workers.
2. Run the one-shot `migrate` service from the exact image above.
3. Recreate web, command worker, and notification worker from that image.
4. Verify migration `0015`, release/source identity, health endpoint, worker health, and absence of tools-profile containers.
5. Smoke-test the envelope model and read-only policy without creating a live controller operation.

No controller endpoint, J-Link target command, SD-card write, power operation, or destructive qualification action is included in this deployment manifest.

## Deployment result

- Migration `qualification.0015_authorizationenvelope`: applied.
- Web, command worker, and notification worker: healthy on exact image
  `sha256:505ea42f0bc3ff561da26bcc1382d27073d750ac4aa5d9718174a38bf9f1c730`.
- Runtime release/source: `authorization-envelopes-1e62f33` / `1e62f33`.
- Live health: HTTP 200; database, storage, clock, and workers ready.
- Tools-profile containers running after deployment: zero.
- Exact-image focused regression: 50/50 passed, including cross-run matrix
  envelope derivation with per-run boot identity.
- Non-environmental aggregate regression: 128/128 passed.
- Existing scrub operation `6279f027-759c-46be-b3ce-ad70766c5707`
  remains `INTERRUPTED_UNKNOWN`; deployment did not contact or mutate the
  controller or SD card.
- Rollback image remains available as
  `srv-rpi00-sd-qualifier:rollback-d7eb2da-pre-auth-envelope-20260804`, image
  `sha256:09225b099791081ac06e822a7b03520795e21281ca03c9e489242f2610b8fae6`.
- A post-migration rollback point is also available as
  `srv-rpi00-sd-qualifier:rollback-16d7d04-run-envelope-20260804`.
