# HPT2 endurance baseline v1 contract and Pi deployment evidence

Status: complete; selected contract is fixture-valid and deployed, live execution remains blocked
Type: evidence
Updated: 2026-08-02
Next Action: implement and host/model-test the firmware request/status/bounded-stop/recovery ABI; do not assign a live stop deadline until separately authorized A/B measurement and firmware-owner review
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md
Canonical Truth: docs/hpt2-endurance-baseline-v1.md

## Scope and safety result

The owner selected `HPT2_ENDURANCE_BASELINE_V1` as the first named
state-changing HPT media-2.0 profile. This work defined and fixture-validated
its contract and deployed only the Pi readiness/UI representation. It added no
Start or Stop action, controller endpoint, controller role, raw-device path,
power/reset operation, firmware programming path, or physical-card action.

Controller B was not contacted or changed. Controller A was not contacted or
changed. No SD card, USB device, target memory, relay, power service, or J-Link
endpoint was accessed. T00 remains unresolved USB architecture evidence and is
outside the profile.

## Immutable identities

- Canonical firmware-side contract:
  `docs/hpt2-endurance-baseline-v1.md`.
- Pi profile ID/version: `HPT2_ENDURANCE_BASELINE_V1` / `1`.
- Pi profile-contract SHA-256:
  `7b50e449ec875d44755bd495f8e101e3fea5518661e2bd3cad650c8d243c04b5`.
- Pi pull request: `PC-Redemption/sd-qualification#23`.
- Pi merge/source commit:
  `285a0044a465316a19e0f893f803084884cc3f7f`.
- Deployed release identity: `hpt2-baseline-contract-285a004`.
- Deployed image:
  `sha256:3254048260647cbd5ba73fcb5f7213d9915957fadcb809fb29c6a8d4e7625461`.
- Retained rollback image tag: `srv-rpi00-sd-qualifier:rollback-2b73843`.

## Validation

- Local profile fail-closed tests: `6` passed.
- Python compilation and both repository `git diff --check` gates passed.
- Exact pre-merge Pi commit in an isolated worktree/image: `92` Django tests
  passed in `42.825 s`; system check reported no issues.
- Root interface-contract tests: `9` passed.
- Compose network-policy tests: `3` passed.
- Contract validator: `7` schemas, `25` classification fixtures, and `23`
  executable-negative fixtures passed. With pending external approval allowed,
  the fixture contract was valid and explicitly `NOT ADMITTED` for live use.
- Exact merge/deployment image: `92` Django tests passed in `42.774 s` after
  clearing production-only HPT execution-root and clock-marker environment
  values for the isolated test invocation. The first Compose test attempts
  inherited those production values and failed as a harness/environment
  mismatch; no deployed database, evidence, or controller operation was
  changed. The exact same image then passed with SQLite and the test defaults.
- Django migration check: no model changes detected; migration plan empty; the
  one-shot production migration reported no migrations to apply.
- Pre-upgrade logical backup
  `/backups/sd-qualifier-20260802T230526Z.dump` passed restore-check.

## Deployed verification

The clean Pi `main` checkout equals the merge commit above. Web, command-worker,
notification-worker, and PostgreSQL are running; web and PostgreSQL report
healthy. `/sd-qualifier/healthz` reports:

```json
{
  "status": "ok",
  "fixture_only": true,
  "live_admitted": false,
  "state_changing_profiles_enabled": false,
  "bounded_stop_supported": false,
  "recovery_supported": false,
  "selected_profile_id": "HPT2_ENDURANCE_BASELINE_V1",
  "selected_profile_version": 1,
  "selected_profile_contract_valid": true,
  "selected_profile_live_ready": false,
  "clock": true,
  "workers": true
}
```

The authenticated appliance model is `appliance-status/0.2`, reports the exact
profile hash above, and retains `BOUNDED_STOP_RECOVERY_UNSUPPORTED`. This is the
intended terminal state for this slice.
