# Program Roadmap: Firmware Service-Code SD Qualification

Status: blocked
Type: program-roadmap
Updated: 2026-08-31
Project Map: MAP-0004
Source Idea: IDEA-0001
Outcome Cycle: cec58490-b533-46a7-bbe5-10e7addba684
Requested Endpoint: work2
Next Action: bind the exact non-production controller, installed expendable SD specimen, deployment and rollback identities, focused checks, and explicit programming/destructive-leaf authority for M4

## Program Outcome

Produce a committed firmware candidate in which individual SD qualification
services and one ordered full-run service use one shared leaf-test engine, then
deploy that exact commit to an explicitly bound non-production work target and
prove its changed behavior. Preserve powered-removal safety, CID-bound run
identity, no-replay recovery, standards-based USB publication, bounded-work
evidence, and independent final qualification authority.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Freeze the qualification authority and shared test catalog | `G1-SHARED-TEST-CATALOG`, `G2-FIRMWARE-WITNESS-AUTHORITY` | none | complete; Option A, contract disposition, and catalog frozen |
| M2 | Prove pause/resume and evidence contracts in a target-independent reference model | `G3-PAUSE-RESUME-SAFETY`, `G4-EVIDENCE-PUBLICATION` | M1 | complete; eight model tests and policy checks pass |
| M3 | Integrate the shared engine, service dispatcher, journal, and publication path; build and verify bounded work | `G5-PERFORMANCE-ADMISSION` | M2 | complete; candidate `3df82f32b997022efeaba97561d7a2320dcf7997` built and packaged |
| M4 | Deploy the exact candidate to the bound development target, run focused changed-behavior/rollback checks, and register the Work2 release cohort | `G6-WORK2-DEVELOPMENT-TARGET` | M3 | blocked; D2 target and consequential-action authority are absent |

## M1 — Authority And Catalog Freeze

### Owner decision D1 — Option A selected 2026-08-31

- **A — Recommended hybrid:** firmware owns leaf-test truth, prerequisites,
  progress, safe-stop checkpoints, and technical results; the Pi/web qualifier
  owns campaign sequencing across controllers, independent power witnessing,
  evidence ingestion/admission, and reviewer/family disposition.
- **B — Firmware owns the full campaign:** simplifies offline execution but
  moves cross-controller, review, persistent evidence, and power-witness burden
  into the controller and weakens independent observation.
- **C — Pi owns the full-run order:** stays closest to the current governing
  contract but does not deliver IDEA-0001's firmware full-run service unless
  that service becomes a thin, Pi-directed leaf sequence.

The owner selected Option A. Firmware is authoritative for shared leaf-test
execution, prerequisites, progress, safe-stop checkpoints, and technical
results. The Pi/web qualifier is authoritative for cross-controller campaign
sequencing, independent power witnessing, evidence ingestion/admission, and
reviewer/family disposition. Record this split in the disposition of
`SMI-SDQ-CONTRACT-V1`. Freeze the exact 480–489 allocation only after confirming
dispatcher availability. The catalog must reuse existing CID, media
classification, scrub, lane, wrap/reclaim, recovery, endurance, export, and
mailbox mechanisms rather than create parallel test implementations.

### M1 completion evidence

- `docs/sd-card-qualification-contract.md` records selected Option A.
- `qualification/profiles/sd-qualification-service-catalog-v1.json` and
  `docs/sd-qualification-service-catalog-v1.md` freeze the 480–489 service
  allocation, seven shared leaves, ten-step order, prerequisites, safety,
  progress, stop, and result semantics.
- `script/check-sd-qualification-service.ps1` proves dispatcher completeness
  and shared individual/full-run implementation routing.
- Result: `G1-SHARED-TEST-CATALOG` and
  `G2-FIRMWARE-WITNESS-AUTHORITY` pass.

## M2 — Safety And Evidence Reference Model

- The durable journal uses the existing mirrored configuration persistence and
  binds format/state, mode, step, completion mask, run identity, firmware and
  catalog identity, and raw 128-bit CID.
- An active interruption becomes blocked and never replays automatically.
  Manual service 488 continuation is accepted only from a planned pause after
  firmware, catalog, CID, representative-sector, and media checks pass.
- Workflow, technical result, method disposition, and evidence admission are
  separate. Firmware cannot claim Pi evidence admission.
- `script/test-sd-qualification-service-model.py` passes eight tests covering
  catalog identity, shared order, external power pause, active-reset no replay,
  identity-bound manual resume, separate results, independent evidence
  admission, and bounded leaf budgets.
- Result: firmware-side `G3-PAUSE-RESUME-SAFETY` and
  `G4-EVIDENCE-PUBLICATION` contracts pass; live Pi ingestion remains M4 proof.

## M3 — Firmware Candidate

- Shared state machine, dispatcher, catalog, journal, UI safety gates, status,
  progress, and result surfaces are integrated without specimen-specific SD or
  USB production behavior.
- All new policy/model checks and the existing SD safety, scrub,
  initialization, endurance, and commissioning suites pass.
- The canonical managed clean Debug rebuild and artifact packaging passed.
- ELF SHA-256:
  `E9AF2BAF44A43FABBE58F69B0D22D6E14A34691DC955E848668C3E737E3FC08E`.
- S-record SHA-256:
  `CE2A5D2337D49CC437BFDA0C6A14BB21CD07937947AF9B6EE0DD1B4889790490`.
- Map SHA-256:
  `8A6C169C12C2F0BCA72E3769651C801045D2A71301E5E94E88A6A4B435778CC2`.
- Scoped candidate commit:
  `3df82f32b997022efeaba97561d7a2320dcf7997`; unrelated dirty work remains
  outside the commit.
- Full evidence: `docs/sd-qualification-work2-candidate-evidence-20260831.md`.
- Result: repository-side `G5-PERFORMANCE-ADMISSION` passes.

## M4 — Work2 Delivery

### Material target decision D2

Bind the exact non-production target, media specimen, deployment mechanism,
rollback identity, and focused checks. The current repository does not define
such a target. Controller A/B programming, remote Pi mutation, destructive
media work, and physical SD intervention require their own exact authority and
instructions.

M4 is blocked at D2. No controller was programmed, no SD or USB media was
changed, and no target-side or Pi-side state was mutated during M1–M3.

After binding, deploy the exact candidate commit, repeat the complete CID
identity block at the required baseline/reboot points, run focused
changed-behavior and rollback checks, write a fresh ignored
`tool-shed-target-evidence` envelope, and use Work2 orchestration closeout to
register the candidate and this open outcome chain in the release cohort.

## Deferred Beyond Work2

- production push, tag, release, or promotion;
- card-family qualification credit or final family disposition;
- ECR/ECO, sourcing, BOM, pilot, or rollout decisions;
- physical destructive qualification not separately authorized.
