# Campaign 006 clean contract-bound pre-execution checkpoint

Status: complete
Result: PASS; Campaign 006 has exact A/B baseline identity and scrub evidence, runs the corrected production application, and is durably started without replay at the next operator gate
Type: evidence
Updated: 2026-08-17
Next Action: advance Campaign 009 from the coordinator's truthful `initialization.complete.a` operator gate; do not infer initialization, erasure, power, or later qualification authority from this completed campaign
Campaign: 006-start-clean-contract-bound-sd-qualification-campaign

## Normal website creation

- Authenticated operator: `admin`, through the production Front Door and normal
  SD Qualifier website workflow.
- Campaign name: `KEXIN 8GB contract-bound initial qualification 2026-08-17`.
- Campaign ID: `a17fc306-8810-4e5a-bbc4-612adc47ce7c`; current version `3`.
- Current durable state: `BASELINE_READY`; three of 70 immutable plan steps
  complete, including both baseline identity leaves; zero runs, zero campaign
  coordinators, zero coordinator tasks, and zero commands in the appliance.
- Exact newly registered firmware artifact: ID `11`,
  `smi-00-05-00-cae69f7c7943-75f108d5e2e7-release`, source/freeze commit
  `b6aadb53fbdca20d9858bd8bb463b3b504e18284`, ELF SHA-256
  `d363218f2bbead6b339a86f82f25474baeb454600af21365fb32c93572beeb06`,
  and S-record SHA-256
  `75f108d5e2e77031e107b2d71852545c9fd246b128085ccb7d4f6e256bc37462`.
- Admitted offline firmware bundle: ID `13`, the same release identity,
  canonical manifest SHA-256
  `3b3470483906ec521df4814dffdcb90e9754ca9701f36f37c6210fda700bfe12`.
- Immutable plan: `CARD_FAMILY_INITIAL`, `card-family-initial` revision 2,
  `SMI-SDQ-CONTRACT-V1`, contract SHA-256
  `865b478e21ef97f5b0b11a4b7336257e1ad68aa317276348de56e068ff11813e`,
  plan SHA-256
  `5a1608477a752148e2dccbfbebb31ad4911e1aa876439bd8861b941117bf55b6`.
- Qualification profile: `HPT2_ENDURANCE_BASELINE_V1/v1-b0d5247f`.
- Evidence policy: `srv-rpi00-sd-qualification-evidence-v1/` under
  `kexin-8gb/contract-bound-initial-20260817`.
- No prior campaign was selected as a basis or superseded; no historical rows
  were admitted as credit.

## Independent A/B assignments

| Role | Assignment | Sample | Controller assembly | Probe | Read-only endpoint |
| --- | ---: | --- | --- | --- | --- |
| A | 27 | `F1-A1` | `1751136` | `69664082` | `host.docker.internal:19120` |
| B | 28 | `F1-B1` | `1751219` | `69660123` | `host.docker.internal:19121` |

Both samples are registered KEXIN 8 GB qualification specimens, permanently
labelled, received 2026-08-03, marked new/opened and expendable, and have
append-only receipt/photo/custody evidence. The initial pair covers distinct A
and B roles. No coordinator exists, so neither lane can wait on or replay work
from the other.

## Appliance and quiescence preflight

- Health returned HTTP 200 with `status=ok`, `required_now_ready=true`, and
  database, evidence storage, clock, and workers true.
- The production UI reported zero in-process campaigns before creation and 13
  terminal history campaigns. After creation, this is the sole in-process
  campaign.
- The protected A/B registry parsed successfully and the probe endpoints were
  listening. Live action, controller/media-write, bench-power, and raw-media
  gates remain disabled; no high-level Run action was submitted.
- Both observer attempts were read-only, confirmed positive VTref and the
  exact probe/assembly role, kept the CPU running, and performed no halt,
  reset, programming, power, media, or target-memory-write action.
- No observer container remains. The temporary A-only firewall allowance was
  removed unconditionally; the final policy again contains only the existing
  B supervisor allowance and default non-loopback drop for ports 19120/19121.

## Initial fresh baseline identity attempt

The protected registry still binds both controllers to predecessor manifest
`e86b068d98938c794ec841b3de273bf211d79a227ae7bffbdc9e8afa14bacea4`.
Each exact current-flash readback instead produced
`6eef5db83ce2ae71aeb63d598ecad1cfa7d68475ebfe052301f4fc2a0f97dfc4`,
which independently matches the corrected bundle's complete expanded S-record
image. Thus both controllers already contain the exact corrected firmware, but
their protected registry binding is stale.

| Role | Observation | VTref | Classification | CID result |
| --- | --- | ---: | --- | --- |
| A | `6b38c1a3-bcbc-43cf-9add-473c804c39b1` | 3.274 V | `BLOCKED/FIRMWARE_IDENTITY_MISMATCH` | `CID unavailable`: stale protected manifest binding caused fail-closed exit before RAM/CID access |
| B | `b10e8809-b0e0-460c-a863-3a84d7381c39` | 3.309 V | `BLOCKED/FIRMWARE_IDENTITY_MISMATCH` | `CID unavailable`: stale protected manifest binding caused fail-closed exit before RAM/CID access |

The immutable observer results are under
`foundation/controller-observations/<operation-id>/result.json`; their
transcript SHA-256 values are respectively
`cc7beba15cc794836f9347556474a8be82841b4ed206d19ad6f3ab6b318e07fa`
and
`30f660d2bb1468be57d6dde090f41f954e38c8c476554a9743066bf8e4f6fefc`.
Historical CID captures were not reused as completion credit.

## Authorized protected-registry correction

The operator explicitly authorized changing only the two Controller A/B
`bundle_manifest_sha256` fields from predecessor manifest `e86b068d...` to
corrected manifest `3b347048...`, retaining rollback, and then repeating the
read-only observations. The change was applied atomically to
`/home/jong/dev/sd_qualification/config/protected/controller-registry.json`.

- Pre-change SHA-256:
  `ee0861b50dedf12af13d49e37cdcbc6272ec9ebb3ba053d1de45d0d4a7379325`.
- Exact rollback copy:
  `/home/jong/.local/share/sd-qualifier/controller-registry-backups/controller-registry.json.pre-campaign006-20260817T183933Z`,
  with the same SHA-256 as the pre-change file.
- Post-change SHA-256:
  `fed6d10fcf37f01328c2e6119f98847219233252b310b6d8d7ba52633a500896`.
- A semantic and textual comparison showed only the two approved manifest
  values changed. Controller roles, assembly IDs, probes, hardware variants,
  and `enabled_for_qualification` values remained identical.
- The live appliance reread the corrected registry without restart. Health
  remained HTTP 200 `status=ok`, and the UI reported
  `CONTROLLER_REGISTRY_READY` and `FOUNDATION_COMPATIBILITY_READY`.

## Fresh read-only A/B CID identity passes

Both repeat observations passed against the exact corrected bundle. Each
verified the complete 4 MiB flash as
`6eef5db83ce2ae71aeb63d598ecad1cfa7d68475ebfe052301f4fc2a0f97dfc4`,
kept the CPU running, obtained two stable approved RAM snapshots, and recorded
valid identity plus representative-sector access. The manufacturer code is
unmapped in the current CID decoder; the retail marking is KEXIN and is not
treated as authenticity evidence.

| Field | Controller A / `F1-A1` | Controller B / `F1-B1` |
| --- | --- | --- |
| Observation | `789b2bbf-145f-45c2-b50d-6c6db7417e7f` | `69b0d133-7264-4675-9c2f-1dfd17c73b7f` |
| Result | `PASS` | `PASS` |
| Protocol/card status | SD state `6`; detection state `5`; driver status `0` | SD state `6`; detection state `5`; driver status `0` |
| CID valid / representative read | `true` / `true` | `true` / `true` |
| Manufacturer / MID | unknown or unmapped CID manufacturer; retail brand KEXIN / `0x05` | unknown or unmapped CID manufacturer; retail brand KEXIN / `0x05` |
| OEM/application ID | raw `0x000C`; decoded non-printable `??` | raw `0x000C`; decoded non-printable `??` |
| Product / revision | `asdfg` / `2.2` | `asdfg` / `2.2` |
| Serial | `7305` (`0x00001C89`) | `7298` (`0x00001C82`) |
| Manufacturing date | `2026-03` | `2026-03` |
| Complete raw 128-bit CID | `05000C61736466672200001C8901A34F` | `05000C61736466672200001C8201A379` |
| VTref | 3.274 V | 3.303 V |
| Result SHA-256 | `178c80bdc276b8ffb7c85b979fc58c63487ffcc238144d6ff629787340a6d71e` | `00faf74ab281d54696987e7a121fe40bc3a0b91b98e668cd245c22022817529d` |
| Transcript SHA-256 | `193fd54812d1ca74e8dcc38b3d39c4d0e925bad01ed9db41e62be2c4a69a47f6` | `3ffb5ecf5f53b02fe122db654f6efcc1220cf82c2a3fde9cca180bad26e30877` |

The immutable result files are 3,049 bytes each under
`foundation/controller-observations/<operation-id>/result.json`. No observer
container remains, and the temporary A firewall allowance was removed. No
programming, power operation, SD-card movement, target write, media write, or
website Run action occurred.

## Authenticated binding repair, deployment, and production verification

The operator approved a minimal SD Qualifier repair and production
redeployment to add an authenticated, idempotent baseline-observation binding
workflow for the existing immutable results. Implementation remained in the
authoritative Pi application repository and did not change firmware or the
controller registry.

- Source branch: `codex/campaign006-baseline-binding-20260817`.
- Implementation commit: `8752e2aa8375c2a3ef74519ebb3c99222b10feb2`.
- PostgreSQL lock correction commit:
  `2d7818331eb2bdae978786b8840f90afd11fbb7f`.
- Full validation: 410 Django tests passed; system checks passed and no model
  migration was required.
- Deployed release: `campaign006-baseline-binding-2d78183`, image SHA-256
  `df0d361e9e0b1c02f30bb7ce84a4e958a719c24ebf18c9215c7f36ba7131ef51`.
- Final CycloneDX inventory SHA-256:
  `2a9510cac718b5b8e4ef995d1794982c20716048aaa17fd1ef2448be77cc77f1`;
  it records the exact release identity and source commit.
- Predeployment database backup:
  `/backups/sd-qualifier-20260817T185606Z.dump`; an isolated restore check
  passed with 14 campaign rows.
- Rollback remains available through the preceding
  `gate2-contract-plan-2e15e15` image SHA-256
  `746287c81cd178d5dd0dcb49a13b59e90df98485bf2cf0e1fe0fd674bb762ce5`
  and its retained Compose override.

The first production POST exposed a PostgreSQL-only `SELECT FOR UPDATE`
restriction on a nullable joined firmware-bundle row. It failed before any
application write: zero baseline captures, evidence rows, and binding events
were present afterward. The lock was narrowed to the campaign-sample row, a
regression test was added, the full suite was rerun, and a production-backed
transactional dry run passed and rolled back before redeployment.

The normal authenticated website then bound both exact results. The server
re-hashed each result and transcript and validated campaign time, assigned
sample and controller role, firmware bundle and manifest, complete flash,
protected controller identity, CID, and representative-sector status before
the atomic records were created.

| Role | Capture ID | Evidence ID | Operation | Result SHA-256 | CID |
| --- | ---: | ---: | --- | --- | --- |
| A / `F1-A1` | 410 | 19846 | `789b2bbf-145f-45c2-b50d-6c6db7417e7f` | `178c80bdc276b8ffb7c85b979fc58c63487ffcc238144d6ff629787340a6d71e` | `05000C61736466672200001C8901A34F` |
| B / `F1-B1` | 411 | 19847 | `69b0d133-7264-4675-9c2f-1dfd17c73b7f` | `00faf74ab281d54696987e7a121fe40bc3a0b91b98e668cd245c22022817529d` | `05000C61736466672200001C8201A379` |

Production health returned HTTP 200 with `status=ok` and
`required_now_ready=true`; database, storage, clock, and workers were true.
Both binding events are durable, both capture/evidence pairs are singular,
the UI projects three of 70 plan steps complete and two of four baseline
steps complete, and the campaign remains `BASELINE_READY` with zero runs,
coordinator tasks, and commands. Live admission and state-changing profiles
remain disabled.

## Remaining authorization boundary

The approved registry correction, fresh read-only captures, application
repair, production redeployment, and authenticated A/B binding are complete.
The next plan leaves are the Controller A and B baseline full-address read
scrubs. Each protected operation writes a one-shot command token to controller
RAM and reads the complete card address range, so it remains outside the prior
read-only authorization even though it does not intentionally write SD-card
media.

Campaign 006 therefore remains durably safe at `BASELINE_READY`. Continuing
requires explicit operator authorization naming the baseline full-address
scrub operation, Controller A / `F1-A1` and Controller B / `F1-B1`, exact
firmware bundle
`smi-00-05-00-cae69f7c7943-75f108d5e2e7-release`, the two complete expected
CIDs above, and the safety state: both cards remain inserted in their existing
powered controllers, no SD-card movement or power operation is requested, and
no state-changing command is already active. Firmware programming, controller
power changes, SD insertion/removal, SD-card media writes, and the campaign Run
action remain unauthorized and were not done.

## Authorized scrub preflight defect and safe stop

At `2026-08-17T19:12:35Z`, the operator authorized the exact Controller A /
`F1-A1` and Controller B / `F1-B1` baseline full-address read scrubs against the
recorded bundle and CIDs. The authorization allowed only each one-shot
controller-RAM command, read-only polling, evidence publication, and
reconciliation. It did not authorize programming, power changes, SD-card
movement, SD-media writes, replay, application source changes, production
redeployment, or Campaign Run.

Fresh database and UI checks immediately before preflight showed campaign
`a17fc306-8810-4e5a-bbc4-612adc47ce7c` at `BASELINE_READY` version `3`, exact
assignments `27/F1-A1/A` and `28/F1-B1/B`, latest valid CID captures `410` and
`411`, corrected bundle manifest `3b347048...bfe12`, zero scrub operations,
zero authorization envelopes, zero recorded runs, and two of four baseline
leaves complete. The protected registry still mapped A to assembly `1751136`
/ probe `69664082` and B to assembly `1751219` / probe `69660123` against the
same corrected manifest.

The independent A/B read-only scrub preflight invocations were launched, but
the application rejected them before controller access with:

```text
Baseline read-only scrub preflight requires campaign state INTAKE or RUNNING.
```

The deployed source at commit `2d7818331eb2bdae978786b8840f90afd11fbb7f`
defines `BASELINE_READY` as a durable campaign state and intentionally uses it
for authenticated baseline-observation binding. However,
`qualification/full_address_scrub.py` omits `CampaignState.BASELINE_READY`
from both the baseline read-only preflight allowlist and the BASELINE durable
operation preparation allowlist. The scrub tests cover `INTAKE` and `RUNNING`
but do not cover the normal website-created `BASELINE_READY` path.

No J-Link session began, no controller SRAM command was written, no target or
SD media was accessed, and no envelope, operation, run, command, or scrub
evidence row was created. The transient Controller A firewall allowance was
removed by its exit trap. Final firewall state again contains only the existing
Controller B supervisor allowance and the default non-loopback drop for ports
`19120/19121`; no full-address-scrub adapter container remains. Appliance
health remains HTTP 200 `status=ok`, with database, storage, clock, and workers
true, while live admission and state-changing profiles remain false.

The smallest correction is to add `CampaignState.BASELINE_READY` to exactly
those two baseline state allowlists and add focused regression coverage for
both preflight and durable preparation. That application change, validation,
rebuild, and production redeployment require separate operator authorization.
After an approved deployment, the already-scoped read-only preflights can be
repeated and the exact A/B scrub operations can resume without authorizing
Campaign Run or any physical/media action.

## Queue-item authorization and state-gate repair

The operator then stated that the approval applies to all queue-item 1 work.
This authorized the focused state-gate correction, validation, production
redeployment with rollback, the exact A/B baseline read scrubs, the normal
website transitions, and the high-level Campaign Run action required by
Campaign 006. It did not authorize Campaign 009 or any later queue item.

The application correction added `CampaignState.BASELINE_READY` to only the
baseline scrub preflight and BASELINE durable-operation preparation state
allowlists, updated their error text, and added one focused regression for
each path.

- Application commit: `137206b466e388070427aa75690b76b9fec142d0`.
- Focused scrub tests: `20/20` pass.
- Full isolated PostgreSQL suite: `412/412` pass in `135.514` seconds.
- No model migration was required; production `migrate` reported no pending
  migrations.

The first attempt to isolate the focused test through Compose exposed its
global fixed PostgreSQL volume name and was stopped immediately after the web
container failed to start on a missing fixture bind. Production PostgreSQL
remained healthy and accepting connections, its logs contained no new error,
and application health stayed green. Subsequent focused and full validation
used explicitly named, independently created PostgreSQL volumes and networks
with unconditional cleanup. A first full-suite pass then reported two
evidence-directory permission errors because the ad hoc container lacked the
normal writable evidence mount; the exact suite passed after adding an
isolated writable `/evidence` tmpfs. Neither condition was a source-test
failure, and neither test path accessed controller or production evidence.

## Corrected production deployment

- Release identity: `campaign006-baseline-ready-137206b`.
- Image SHA-256:
  `7e308a7e7ec2ec3154aac90499de0ad3902e3eb1d0ccc3cb6e4113e6457b8dc9`.
- CycloneDX inventory SHA-256:
  `4000f579844368a29ac52092152f22d94c818292ce7270b70235912adf0b87f6`.
- Predeployment backup:
  `/home/jong/.local/share/sd-qualifier/backups/sd-qualifier-20260817T192924Z.dump`,
  SHA-256
  `d1959e921f20879e4c272e810b1995bf710036de03089358ecdec116f8923ba9`.
- The backup restored successfully into an isolated PostgreSQL 17.5 instance
  and contained all `14` campaign rows.
- Retained rollback image:
  `campaign006-baseline-binding-2d78183`, SHA-256
  `df0d361e9e0b1c02f30bb7ce84a4e958a719c24ebf18c9215c7f36ba7131ef51`,
  with its prior Compose override unchanged.

All five application services run the corrected image. Health is HTTP 200
`status=ok`; database, evidence storage, clock, and workers are true. Live
admission and state-changing profiles remain false.

## Authorized A/B baseline scrub results

Corrected read-only preflight passed independently on both lanes before any
envelope or operation was created. Each preflight verified the exact complete
flash SHA-256 `6eef5db8...f97dfc4`, corrected bundle manifest
`3b347048...bfe12`, registered probe/assembly, expected CID, representative
sector-read validity, command word `0`, and idle scrub status.

| Field | Controller A / `F1-A1` | Controller B / `F1-B1` |
| --- | --- | --- |
| Envelope | `0cf1ac86-cbe2-4b62-94a6-413a8699ebfe` | `7e5994a8-0b55-4547-967a-f73703a8d6a2` |
| Operation | `1231283a-6a7d-4d76-b24d-ea80918fd94a` | `54f874fe-2891-4a35-a169-20f2ba0b890f` |
| Terminal result | `COMPLETED / FULL_ADDRESS_SCRUB_PASS` | `COMPLETED / FULL_ADDRESS_SCRUB_PASS` |
| Total/completed sectors | `15,728,640 / 15,728,640` | `15,728,640 / 15,728,640` |
| Read attempts | `245,760` | `245,760` |
| Failed / retry-recovered / identity mismatch | `0 / 0 / 0` | `0 / 0 / 0` |
| HPT / first SSP / last SSP | `0 / 0 / 0` | `0 / 0 / 0` |
| Controller run delta | `1,314` | `1,374` |
| Maximum read ticks | `3` | `3` |
| CID | `05000C61736466672200001C8901A34F` | `05000C61736466672200001C8201A379` |
| Transcript evidence / SHA-256 | `19848` / `49d9f967...f08f72f` | `19850` / `eacaae40...a47e85` |
| Result evidence / SHA-256 | `19849` / `db0b182e...5474b3` | `19851` / `ce551fbd...ea484a` |

A published the one-shot command at `2026-08-17T19:32:53Z` and reached its
stable terminal result at `19:44:01Z`; B published at `19:32:54Z` and reached
terminal at `19:44:33Z`. Automatic replay and retry remained false. No
reconciliation operation was needed. The UI truthfully advanced read-only
baseline to `4/4 PASS` and overall progress to `5/70`.

## Durable controlled campaign start

Using the normal authenticated website as `admin`, the campaign transitioned
`BASELINE_READY -> AUTHORIZED` at version `4`, then `AUTHORIZED -> RUNNING` at
version `5`. The high-level **Run full qualification** action created durable
coordinator `3` from `card-family-initial` plan revision `2`.

The coordinator immediately and correctly stopped at
`initialization.complete.a` with state `WAITING_OPERATOR`, stop code
`PLAN_NODE_REQUIRES_OPERATOR`, and detail `Plan node
initialization.complete.a has no automatic action.` Its authorization snapshot
is confined fixture execution and contains no target authority. There are zero
qualification runs, zero commands, and zero coordinator tasks, so no
initialization, whole-card erasure, later matrix action, or Campaign 009 work
occurred. Event `9` records the singular coordinator start.

Final cleanup restored the firewall to the existing Controller B supervisor
allowance plus the default non-loopback drop for ports `19120/19121`; no scrub
adapter container remains. No programming, power change, SD-card movement, or
SD-media write occurred during Campaign 006. The completion gate is met: the
campaign records immutable bundle, plan, controller, sample, and CID identity;
both baseline lanes pass; consequential work was explicitly authorized; and
the durable controlled start contains no replay or duplicate execution.
