# Campaign: Deliver Exact Firmware Candidate and Work5 Release

Status: working
Type: campaign
Updated: 2026-09-08
Program Roadmap: PRM-0009
Project Map: MAP-0008
Source Idea: IDEA-0005
Requested Endpoint: work5
Milestone: M1-M4
Unlocks: G1-CANDIDATE-MANIFEST, G2-CURRENT-CANDIDATE, G3-MANIFEST-BOUND-CONSUMERS, G4-WORK-LEVEL-INTEGRATION, G5-EXACT-BYTE-PROMOTION, G6-REGRESSION-AND-DOCUMENTATION
Next Action: reconcile remote SD Qualifier campaign 609d6df0-37f6-4556-bd66-538c226be217, then repeat fresh A/B preflight before programming

## Objective

Implement and prove the MAP-0008 identity model, then release and production-verify the complete
seven-registration Work5 cohort as firmware 00.05.00 without rebuilding after qualification.

## Scope

- Add the tracked manifest contract, shared PowerShell tooling, focused tests, documentation, and
  Work2-Work5 configuration includes.
- Make the serial-confirmed bench programmer manifest-bound by default while retaining explicit
  path-plus-hash compatibility for exceptional historical workflows.
- Run full repository validation and canonical managed Debug/Release rebuilds, commit the final
  content, and create one clean immutable combined candidate.
- Perform guarded cohort freeze, exact-candidate Controller A/B release qualification, exact-SHA
  push CI, provenance-only tag/release publication, published-asset verification, outcome
  reconciliation, and cohort finalization.

## Completion gate

All six readiness gates pass; the exact candidate manifest and hashes are recorded in durable
evidence; the active seven-registration cohort is frozen, released, reconciled, and finalized; the
published GitHub Release and both qualification benches verify the same S-record bytes; no
unrelated user change is included.

## Failure controls

- Stale or tampered artifacts: hash every source before use and fail closed before programming or
  publication.
- Unsafe bench interruption: read-only preflight each named controller, retain its full-flash
  rollback image and CID identity, and stop if an active governed run or identity mismatch exists.
- Wrong release provenance: bind the cohort to one clean content SHA, require exact-SHA push CI,
  and verify release assets after publication; never move a published tag silently.

## Work5 checkpoint — 2026-09-08

M1 and the build portion of M2 are complete. Initial frozen commit
`a34690ff2720a906ef58bc06073b40f67385a44b` was rejected before qualification when release
preflight exposed a dirty-path parser defect. The exact failure and no-action boundary are recorded
in `work/evidence/firmware-candidate-work5-prequalification-20260908.md`; the corrected final
content commit must replace that initial freeze before qualification.

M3 is blocked before programming because the remote SD Qualifier still owns a `RUNNING` A/B
campaign for different firmware bytes. Its latest A and B runs and supervisors are blocked pending
recovery/regression and fresh snapshots. Preserve the frozen cohort; do not push, tag, publish, or
program until that remote campaign is explicitly reconciled and a new read-only preflight passes.
