# Controller A corrected-firmware and qualification authorization

Date: 2026-08-04
Status: active, conditional, Controller A only
Authorization reference: `owner-a-corrected-envelope-20260804`

## Bound identities

- Controller role: `A`
- Assembly: `1751136`
- Variant: `0`
- J-Link probe serial: `69664082`
- J-Link endpoint: `srv-rpi00.local:19120`
- Corrected immutable bundle: `smi-00-05-00-868598ee08d9-404826a5be8e-release`
- Pi bundle content address: `0fdff39a47a2aeb9a22fe574e83242b322a2a9fafd812020ead5e056f9182761`
- S-record SHA-256: `404826a5be8e318683157e838595cd82ae8cb36b6222115e707ef3debc99baf5`
- Expected expanded complete-flash SHA-256: `2236f68b720dc9824001597860603c91883bdb4636d5c46a5af41d6b3258a166`
- Expected pre-program complete-flash SHA-256: `68029e19efcc409f878b2f43371ee48d823ffff2d7a4f4c0b349176b6077bb28`
- Corrected campaign: `d2263f26-6ac7-4a90-ad80-8875c0c24d2a`
- Sample: `F1-A1`
- Baseline CID expected before any card-changing operation: `05000C61736466672200001C8901A34F`

## Owner authorization

The owner explicitly pre-authorized the following bounded sequence:

1. Rebind only Controller A to the corrected bundle and perform one program,
   verify, reset, and run operation on code flash. VEEPROM and option memory must
   remain unchanged. Automatic rollback is permitted only inside that same
   operation.
2. Independently verify complete flash, capture mapped state, and capture a fresh
   boot-relevant CID after programming.
3. If and only if the promotion and observation pass, perform a new F1-A1
   baseline full-address scrub using a new operation UUID, the exact campaign,
   bundle, and CID, and the single SRAM command word. SD media remains read-only.
4. If and only if the scrub passes, initialize the explicitly expendable F1-A1
   card as HPT media 2.0. This is a separate destructive operation.
5. Complete the post-initialization gate with a fresh CID, three active lanes,
   reopen proof, and no replacement request.
6. Execute the exact bounded-stop S0-S6 measurement cases and interrupted-session
   recovery. The Pi must mint a distinct short-lived intent for every Start and
   Stop; no operation may be replayed.
7. Execute the named active-run G-PWR whole-controller interruption as a separate
   operation from ordinary Start and Stop.
8. Execute normal logging, configuration, and export regression, followed by an
   independent-reader transfer: power Controller A off, remove the identified
   card, validate it read-only in the identified Pi reader, reinsert it only
   while Controller A remains powered off, then capture a fresh CID after boot.

## Conditions and limits

- Each later stage is conditional on direct passing evidence from every required
  preceding gate.
- Any ambiguous or failed hardware attempt consumes the authority for that exact
  operation. It must not be retried without fresh owner approval.
- Failed scrub operation `e36882de-ebf5-4b35-93ef-698e352a553c` is historical
  evidence and must never be replayed.
- This envelope does not authorize Controller B, arbitrary J-Link access,
  powered SD removal or insertion, or retries after failure or ambiguity.
- Physical card moves require operator intervention. Execution must stop at the
  first such move and present the required power-off instruction explicitly.
- The promotion envelope may combine programming with its independent
  post-program observation, but the observer must remain independently scoped
  and produce separate immutable evidence.

## Immediate execution gate

Proceed with the one-shot Controller A promotion only after revalidating the Pi,
probe/role identity, immutable bundle, registry transaction, and rollback
prerequisites. Stop immediately on any mismatch.

## Minted operation identities

- A/F1-A1 baseline full-address scrub:
  `fbfb1b52-e79c-4ffc-8e54-d34fd4102659`
- Purpose: `BASELINE`
- Replay permitted: no
