# HPT pre-initialization scrub bundle Pi import and campaign binding — 2026-08-04

Status: software handoff complete; canonical Controller A read-only identity reconfirmed; programming not authorized or run
Type: evidence
Updated: 2026-08-04
Next Action: obtain explicit authorization to rebind/program Controller A with the exact reviewed bundle, then capture a fresh post-program boot-relevant CID block before any scrub operation; do not initialize or write `F1-A1`
Campaign Reason: Historical record from campaign 013-close-hpt-media-2-initial-release-qualification; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Parent: work/tickets/ticket-hpt-bounded-full-address-read-scrub.md
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md

## Result

The exact reviewed firmware bundle
`smi-00-05-00-868598ee08d9-404826a5be8e-release` was transferred to
`srv-rpi00.local`, independently validated by the deployed Pi contract code,
imported into the hardened content-addressed store, and imported a second time
as an idempotent readback check. A new change-impact campaign was then created
and immutably bound to that exact bundle. The prior failed campaign and scrub
operation remain preserved and non-replayable.

No code flash, VEEPROM, option memory, SD media, power state, or qualification
outcome was changed. The only controller access was a separately bounded
read-only observation after the owner reported that canonical Controller A had
been reconnected to J-Link A.

## Exact bundle import

- Bundle ID:
  `smi-00-05-00-868598ee08d9-404826a5be8e-release`.
- Transferred raw `bundle-manifest.json` SHA-256:
  `b4422747feaad383df398becda58b94e20fbc5aa0ca5ccde2bf4a7ef415da3e2`.
- Pi canonical-manifest/content address:
  `0fdff39a47a2aeb9a22fe574e83242b322a2a9fafd812020ead5e056f9182761`.
- Importer: `sdq-bundle-importer/1`.
- Import actor: `owner-continuation-reviewed-scrub-bundle-20260804`.
- Import result: first pass `imported`; second pass `already-present` with the
  same content address.
- Database state: `valid=true`, `admitted=false`, admission scope `none`.
- Stored permissions: directories `0555`; manifest and all six members `0444`.
- Production structural validator: six declared members, `25,530,579` member
  bytes, exact hashes and sizes, no extra files, no symbolic links: PASS.
- Deployed scrub contract loader: command `0x20055F80`, status `0x20055F90`,
  exact map/S-record bindings: PASS.
- Expanded 4 MiB code-flash image SHA-256:
  `2236f68b720dc9824001597860603c91883bdb4636d5c46a5af41d6b3258a166`.

## Immutable campaign binding

- Preserved prior campaign:
  `49024955-703c-4990-bed8-225ff3ef8434`.
- Prior campaign state: `BLOCKED`, version `3`; its Controller A assignment is
  `FAILED_NON_REPLAYABLE` and names operation
  `e36882de-ebf5-4b35-93ef-698e352a553c` as the preserved failure.
- New campaign:
  `d2263f26-6ac7-4a90-ad80-8875c0c24d2a`.
- New campaign state: fixture-only `INTAKE`, version `2`, qualification reason
  `change-impact`, linked through `based_on_campaign` to the prior campaign.
- Firmware artifact: ID `5`, exact ELF
  `10840281efd9fc53b0e42447f2af241ea2e4140d09a96b89c254c41ad4cacb78`
  and S-record
  `404826a5be8e318683157e838595cd82ae8cb36b6222115e707ef3debc99baf5`.
- Assignments: ID `7`, `F1-A1` / Controller A; ID `8`, `F1-B1` /
  Controller B.
- The campaign contains zero operation-admitted `CardIdentityCapture` records.
  This intentionally preserves the fresh post-program CID gate.

## Canonical Controller A read-only reconfirmation

- Operation: `55333d3c-d9ab-45a7-b78f-151ae9439481`, PASS.
- Assembly: `1751136`; hardware variant `0`; J-Link probe `69664082`;
  VTref `3.283 V`.
- CPU was running before and after both observation phases.
- Installed firmware remains the prior fixed-mailbox bundle
  `smi-00-05-00-bc0b6ce4d066-release`, content address
  `5df475bd0b2de8792f40bc2bd49efde37fce66f9b80bd24b4bb2e675fc1176ce`.
- Expected and observed complete code-flash SHA-256:
  `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`.
- Protocol card status: detection state `4` (`NEEDS_INITIALIZATION`), SD state
  `3`, driver status `0`.
- CID-valid status: true.
- Representative-sector-read status: true.
- Manufacturer name: unknown CID manufacturer; retail brand KEXIN.
- MID: `0x05`; OEM/application ID: raw bytes `0x000C`.
- Product name: `asdfg`; revision `2.2`; serial `7305` (`0x00001C89`).
- Manufacturing date: March 2026.
- Complete raw CID: `05000C61736466672200001C8901A34F`.
- Result:
  `foundation/controller-observations/55333d3c-d9ab-45a7-b78f-151ae9439481/result.json`,
  SHA-256
  `ae7136dcf9d8492730b0c33b8ce1a9cccebe0162a79a5afb5730baaf0aba9671`.
- Transcript SHA-256:
  `d26dcaa1bb4e7bb8bee43ab9eef1c13aa5c8c5c06bf1420400f89f4c4c9bde7d`.
- Pi evidence ID `11` links the immutable result to the new campaign as
  pre-program identity evidence only. Event sequence `4` explicitly records
  `operation_admitted_cid_capture=false`.

CID is identity evidence, not proof of authenticity.

## Preserved gates

- The protected registry still binds A and B to the prior
  `5df475bd...176ce` bundle and both roles remain disabled for qualification.
- No programmer, observer, or scrub tools container remains running.
- The temporary A-only firewall rule was removed; only the default
  non-loopback drop for J-Link ports `19120` and `19121` remains.
- Web, command worker, notification worker, PostgreSQL, clock, and storage
  health pass. The web service was restarted only after the host's
  systemd-timesyncd synchronization marker became available following reboot.
- Controller A has not been rebound or programmed with the reviewed candidate.
- `F1-A1` remains uninitialized and unwritten. No full-address scrub command
  was issued.

The next action crosses the explicit code-flash mutation authorization
boundary. After that exact programming operation, a new read-only observation
must prove the reviewed complete flash and capture a fresh boot-relevant CID
block before any baseline scrub preflight or command.
