# Pi HPT2 operator UI source and release-candidate evidence

Status: accepted software-only checkpoint
Type: evidence
Updated: 2026-08-02
Next Action: none; the separately authorized fixture-only deployment completed and is recorded in `work/evidence/pi-hpt2-operator-ui-fixture-deployment-20260802.md`
Campaign Reason: Historical record from campaign 014-complete-standalone-sd-qualifier-acceptance; retained independently after campaign closure and requires no separate owner-queue execution.
Campaign: standalone
Superseded By: work/evidence/pi-hpt2-operator-ui-fixture-deployment-20260802.md

## Outcome

`PC-Redemption/sd-qualification` PR #28 is merged at
`351182d1930969c7d58cb8a262dd923d70e62b3c`. It adds an authenticated
reviewer/administrator surface that prepares an immutable HPT2 Start or Stop
operation from server-owned run, firmware-bundle, controller-registry,
boot-witness, and CID evidence and displays the operation and append-only phase
history.

The reviewer separately confirms the current non-heating safe state and
explicitly authorizes later isolated target access until the short-lived
authorization expires. Preparation itself performs no target access. The web
process has no HPT2 endpoint and exposes no publish or reconciliation action.
Only the one-shot tools service may resolve an endpoint, and it revalidates the
protected role allowlist and target binding before access. Roles and endpoints
remain empty by default, so a prepared operation cannot execute in the default
deployment state.

## Verification

- Local Windows source tests: `33/33` focused HPT2 tests and `128/128`
  application tests passed; migration drift reported no changes.
- Exact pre-merge Pi review image `sha256:a9f720e7...89e251c` from `7ade3f9`
  passed `128/128` application and `16/16` repository-interface tests.
- Exact merged Pi release-candidate image:
  `sha256:d837e727357f4f7bf5896621e7f06cb9024a831bd52bbd14a168d27fa4b40049`.
- Release identity: `hpt2-operator-ui-351182d`.
- OCI source identity:
  `351182d1930969c7d58cb8a262dd923d70e62b3c`.
- The exact merged image passed `128/128` application tests and `16/16`
  Compose/contract/release-interface tests on `srv-rpi00.local`.
- The production contract validator retained the required fail-closed result:
  seven schemas, 25 classification fixtures, and 23 executable-negative
  fixtures passed, while live admission remained `BLOCKED / NOT ADMITTED` on
  the trusted external approval and firmware-owner approval gates.

## Offline release media

The exact release was atomically packaged at:

`/home/jong/dev/sd_qualification/release-media/hpt2-operator-ui-351182d`

All entries in `SHA256SUMS` passed readback verification. Relevant identities:

- `SHA256SUMS`: `57703f0b9f1a0d89bc5af2f21c5c10baa53ec6f5449fb6cbc9bf83e67a72968c`;
- `manifest.json`: `9abe6ec54a645bddd468464e4e4c5d45a6df57847ae1fe377fe4e05572779744`;
- `image.tar`: `18fe31725e87d6c24a88b7cd80d7aaa816c711b2c71ee3b49089e84b56fe6ed7`;
- `sbom.cdx.json`: `a38421bcdafe2718892dbc285465f60b93898aa06950badae4229b04f2b0d3b2`;
- packaged size: approximately 650 MiB;
- packaged PostgreSQL runtime:
  `postgres:17.5-bookworm@sha256:fbcea1bd13b6a882cd6caa6b58db3ae5c102efe50ec625b3e2a5cbc50db5bfe4`.

## Preserved runtime boundary

The Pi source checkout is clean at the merged commit, but the running fixture
deployment was deliberately not changed. It remains healthy at source
`1b7fa39915a05310399cae1cf14b92e23f5790e3` and image
`sha256:924ff94619db643db59efb50b5877a0c69310df7488a40fbc0b7986b237907d5`.
Migration 0013 is not applied, the HPT2 tools service is not running, HPT2
roles/endpoints remain empty, live admission remains false, and neither
controller was contacted.
