# Pi standalone operator frontend Stage 3 deployment evidence

Status: accepted
Type: evidence
Updated: 2026-08-02
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Scope

This records the fixture-only integration, packaging, migration, deployment,
and runtime verification of Stage 3 in
`jong@srv-rpi00.local:~/dev/sd_qualification`. It is application readiness
evidence only. No controller command, programming, power operation, physical
media operation, or destructive qualification was performed or authorized.

## Integrated identity

- Stage 3 frontend PR: `PC-Redemption/sd-qualification#7`, merged as
  `b2f5884eb308317451a41309cdd9596be5a4e57f`.
- PostgreSQL notification-worker correction PR:
  `PC-Redemption/sd-qualification#8`, merged as
  `6809dce532624226c8a71580d8211128c54ac2f6`.
- Final deployed repository state: clean `main` at `6809dce532624226c8a71580d8211128c54ac2f6`.
- Final image ID:
  `sha256:6ba95a734ba87ae3c52188ff27efb614d82a253071f01571c24c308d7b21d87f`.
- Retained release: `/var/tmp/sdq-release-operator-frontend-stage3-6809dce`.
- Retained rollback: Stage 2 image and release identity
  `standalone-foundation-stage2-9327e28`.

## Verified behavior and gates

- Exact final image: 62 Django tests and 12 repository contract/package tests
  passed.
- Disposable PostgreSQL 17.5 migration gates passed for `0008 -> 0009 -> 0008`
  and `0009 -> 0010 -> 0009`; deployed migrations `0008`, `0009`, and `0010`
  are applied.
- Stage 3 provides immutable firmware-bundle campaign binding, append-only
  certification metadata/review, physical sample inventory and CID history,
  bounded intervention types, non-resuming acknowledgement, card-swap
  safe-state enforcement, lifecycle gates, and report/evidence-integrity
  downloads.
- Certificate retrieval is bounded by a protected hostname policy and fails
  closed into an intervention when that policy is absent or retrieval fails.
- The first Stage 3 deployment exposed a PostgreSQL-only `SELECT FOR UPDATE`
  failure caused by joining nullable notification-run data. PR #8 removed the
  nullable join from the locked claim and added a runless-notification
  PostgreSQL regression. No retry, delay, device rule, or controller behavior
  was added.
- After final recreation, `web`, `command-worker`, and
  `notification-worker` all used the exact final image, were running with zero
  restarts, and produced no traceback/error/exception log matches.
- `/sd-qualifier/healthz` returned `status=ok`, database/storage/clock/workers
  true, `fixture_only=true`, and `live_admitted=false`. The application root
  redirected to authenticated login, and `manage.py check` reported no issue.

## Release and recovery identities

- `image.tar` SHA-256:
  `1ed44dd1e0e124e740bba97573e5ab0772495816fb15bbdd32f3cb5fe3a9e6f6`.
- `manifest.json` SHA-256:
  `be2fd9f5de9f19511e36b4b7cb50aed2adac01e23e80d7937b798bd2737f9c4b`.
- `sbom.cdx.json` SHA-256:
  `3753b7af85104758f613a2927c8dd3fb26548b2e1117442cb18a4093a9025056`.
- `SHA256SUMS` SHA-256:
  `87ee3b510f826d13bd4271ee039906852a6fc1bea9bc49fce1460679f37ebb27`.
- Pre-upgrade backup:
  `/backups/sd-qualifier-20260802T184931Z.dump`, SHA-256
  `9526b30eddb29f8def4fef6a09c732ee3ff5e59675d4285ee78f8146e8b685a7`;
  restore-check passed before migration.
- Post-deploy backup:
  `/backups/sd-qualifier-20260802T185807Z.dump`, SHA-256
  `35aecb013a2c76c2c2d91fe79d16eae371d0ec21c9e2696fa5bdc17e53a654a5`;
  restore-check passed after migration and final deployment.

## Retention and next gate

Superseded Stage 3 draft images and the pre-hotfix Stage 3 package were removed
after confirming no container used them. The final Stage 3 release and Stage 2
rollback remain. Merged Stage 3 branches and their temporary worktree were
removed locally and from GitHub; source remains in merged history.

Stage 4 cannot be qualified from repository defaults. It requires owner-approved
protected SMTP transport/sender/recipient/escalation settings and a reviewed
certificate-fetch hostname policy. Credentials must not enter Git, logs, or
this evidence artifact. Controller execution and live admission remain blocked.
