# Pi HPT2 operator UI fixture-only release deployment checklist

Status: complete
Type: checklist
Updated: 2026-08-02
Next Action: retain the exact deployed release, verified backup, and rollback image; live execution and every controller action remain separately gated
Workpackage: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Evidence: work/evidence/pi-hpt2-operator-ui-source-and-release-candidate-20260802.md
Deployment Evidence: work/evidence/pi-hpt2-operator-ui-fixture-deployment-20260802.md

## Exact candidate and rollback identities

- [x] Source is clean at merge
  `351182d1930969c7d58cb8a262dd923d70e62b3c`.
- [x] Candidate release identity is `hpt2-operator-ui-351182d`.
- [x] Candidate image is
  `sha256:d837e727357f4f7bf5896621e7f06cb9024a831bd52bbd14a168d27fa4b40049`.
- [x] Offline release media exists at
  `/home/jong/dev/sd_qualification/release-media/hpt2-operator-ui-351182d`.
- [x] Packaged `SHA256SUMS` hash is
  `57703f0b9f1a0d89bc5af2f21c5c10baa53ec6f5449fb6cbc9bf83e67a72968c`,
  and every listed member passes readback verification.
- [x] Current rollback source is
  `1b7fa39915a05310399cae1cf14b92e23f5790e3` and current rollback image is
  `sha256:924ff94619db643db59efb50b5877a0c69310df7488a40fbc0b7986b237907d5`.

## Authorization boundary

- [x] Owner explicitly authorized this fixture-only deployment.
- [x] Confirmed the authorization did not enable a controller role or endpoint,
  run the HPT2 tools service, admit live execution, contact a controller,
  program firmware, operate power, or perform a physical-media action.
- [x] Confirmed Controller B remained frozen.

## Pre-mutation gate

- [x] Rechecked clean source, exact candidate image labels, package hashes,
  current deployed image ID, service health, and empty HPT2 roles/endpoints.
- [x] Confirmed no fixture command was running or claimable; stopped command and
  notification workers before the backup window.
- [x] Created a new logical PostgreSQL backup through the existing tools
  service, recorded its exact path/hash, and passed the disposable restore check.
- [x] Recorded current database migration state and confirmed migration 0013
  was the only new application migration.
- [x] Preserved the current image ID, protected `.env`, registry, evidence,
  bundle, fixture-image, database, and backup-volume identities.

## Authorized fixture-only deployment

- [x] Retagged only the exact candidate image as the Compose `local` image after
  recording the prior tag/image binding.
- [x] Ran the one-shot migration; migration 0013 succeeded exactly
  once; the HPT2 tools profile was not started.
- [x] Recreated only `web`, `command-worker`, and `notification-worker` against
  the exact image; preserved PostgreSQL and Front Door.
- [x] Verified image labels, release/source identity, migration state, health,
  storage, clock, worker heartbeats, queue/lease state, and `/sd-qualifier/`
  routing.
- [x] Verified the exact image restricts authenticated HPT2 preparation to
  reviewer or administrator roles and presents no publish/reconcile endpoint.
- [x] Verified HPT2 roles/endpoints are empty, live admission is false, every
  state-changing profile remains disabled, and no target access occurred.
- [x] Verified SMTP configuration remains confined to `notification-worker`
  without printing or copying the credential.

## Failure and rollback readiness

- [x] Retained the prior services image under the explicit rollback tag; the
  contingency was not invoked.
- [x] Recorded that schema rollback requires the verified pre-upgrade database
  backup with the prior image and configuration; image-only rollback is not
  claimed.
- [x] No deployment failure occurred; verification findings were preserved
  without exposing credentials or raw generated evidence.
