# Program Roadmap: Firmware Candidate Identity and Exact Work5 Promotion

Status: approved
Type: program-roadmap
Updated: 2026-09-08
Project Map: MAP-0008
Source Idea: IDEA-0005
Requested Endpoint: work5
Next Action: commit the final validated content, then create and validate the immutable combined candidate

## Program outcome

Implement the MAP-0008 candidate-identity contract, freeze and qualify one exact combined candidate
containing all seven awaiting-release registrations, publish firmware `00.05.00`, verify the
publication and release benches, and reconcile the complete release cohort.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Implement candidate manifest tooling, current-candidate status, manifest-bound programming, Work-level includes, tests, and documentation | G1, G2, G3, G4, G6 | none | complete |
| M2 | Run full checks and canonical clean Debug/Release builds; commit the final content; create and validate the immutable combined candidate | G1, G2, G5, G6 | M1 | working |
| M3 | Freeze the seven-registration cohort to the exact content commit; qualify the manifest-bound bytes on Controller A and B with required CID/readback evidence | G3, G5 | M2 | waiting |
| M4 | Push the exact content commit, require its exact successful push CI run, create provenance-only release metadata, tag and publish `v00.05.00`, verify assets, reconcile owners, and finalize the cohort | G4, G5, G6 | M3 | waiting |

## Gate evidence requirements

- G1 passes with a canonical manifest schema, immutable copy verification, clean-commit binding,
  and adversarial hash/staleness tests.
- G2 passes when one read-only status command reports candidate, source, hashes, endpoint,
  qualification/promotion state, and current release-cohort count without creating another queue.
- G3 passes when bench programming resolves the candidate manifest by default and all Work5 bench
  evidence names the manifest digest and exact selected artifact hash.
- G4 passes when `work/tool-shed.yaml` resolves the expected Work2-Work5 actions and all actions use
  the shared repository command.
- G5 passes only when qualification, release assets, tag provenance, and post-publication checks all
  retain the exact candidate hashes; no post-qualification build is permitted.
- G6 passes with focused tests, all applicable repository checks, canonical Debug and Release
  rebuilds, and operator documentation that distinguishes all three lifecycle terms.

## Release boundary

Work5 is authorized for the complete active cohort and GitHub release. Controller programming is
allowed only after read-only preflight proves the named bench is idle/safe and the exact manifest
passes. Any active run, controller identity mismatch, missing CID, hash mismatch, protected provider
gate, missing credential, or absent exact-SHA CI run stops the roadmap at that gate without
stranding or silently narrowing the cohort.

## Rollback

Before each bench program, retain and hash its current full internal-flash image and capture its
controller/SD identity. If the candidate fails a bounded smoke gate, restore the captured image,
verify full-flash equality, record the failed candidate evidence, and leave the cohort working.
Before publication, failure is corrected by a new content commit and a newly frozen candidate;
after publication, do not move the tag silently—publish an explicit corrective release.
