# Project Map: Firmware Service-Code SD Qualification

Status: complete
Type: project-map
Updated: 2026-09-03
Next Action: none; PRM-0006 completed the requested Work2 endpoint and later corrections or Work5 remain separately owned
Source Idea: IDEA-0001
Readiness Review: 7da3aeb14bb1dea6652ee5faaeeccd026392db8416b67b479216077c9437f41b

## Desired Outcome

Deliver a modular SD qualification suite in which individual service codes and
one ordered full-run service invoke the same firmware-owned leaf-test
implementations, with bounded progress, fail-closed prerequisites, safe
power-off pause/resume, CID-bound identity, and reviewable evidence. Stop at
Work2: a committed candidate deployed to one explicitly bound non-production
work environment with focused changed-behavior evidence. Production release,
physical card-family qualification, and ECR/ECO conclusions remain outside the
endpoint.

## Direction Map

```text
IDEA-0001
  |
  +--> Shared test catalog and service dispatcher ---------- G1
  |
  +--> Firmware / Pi / operator authority contract -------- G2
  |       |
  |       +--> powered-off intervention witness
  |       +--> evidence admission and final disposition
  |
  +--> Controller journal and no-replay resume ------------- G3
  |
  +--> Versioned USB evidence publication ------------------ G4
  |
  +--> Bounded-work and duration admission ----------------- G5
  |
  +--> Known non-production deployment and checks ---------- G6
          |
          +--> Work2 candidate + release cohort
```

## Workstreams

| Workstream | Current evidence | Required decision or proof | Boundary |
| --- | --- | --- | --- |
| Shared firmware engine | Existing HPT diagnostics, mailboxes, media classification, CID, scrub, wrap, power-cut, endurance, and export capabilities already exist | Freeze the smallest leaf catalog and show individual/full-run paths call one implementation | Do not duplicate diagnostic implementations |
| Authority split | Owner selected Option A on 2026-08-31: firmware owns leaf-test truth and the Pi/web qualifier owns campaign orchestration and evidence admission | A reviewed governing-contract revision records the selected split | No Pi workspace or runtime mutation from this workspace without explicit binding |
| Pause/resume | Existing fixed mailbox, CID, media-generation, and recovery-checkpoint surfaces provide ingredients | Select controller-owned journal placement and prove atomicity, wear, planned pause, manual continuation, and no replay | Never instruct or perform powered SD removal |
| Evidence publication | Existing FileX/USB export paths and timing/work counters provide reusable mechanisms | Freeze a versioned unique-run schema and completion-marker-last protocol | No drive-specific production behavior or optional-command requirement |
| Performance | Existing HPT2 performance-plausibility and matrix-efficiency contracts govern | Predict and measure work for every leaf on worst-supported geometry | A slow method cannot falsely fail the SD card |
| Work2 delivery | Managed build/package tooling exists; no development target is configured for this route | Bind one exact non-production target, rollback, deployment, and focused checks | No controller programming or protected remote action from an unknown target |

## Readiness Gates

- `G1-SHARED-TEST-CATALOG`: freeze services, order, prerequisites, outcomes,
  safe-stop semantics, and shared implementation proof.
- `G2-FIRMWARE-WITNESS-AUTHORITY`: settle and document firmware, Pi/web, and
  operator ownership; reconcile `SMI-SDQ-CONTRACT-V1`.
- `G3-PAUSE-RESUME-SAFETY`: prove controller journal integrity, powered-off
  intervention, pinned identity validation, manual continuation, and no replay.
- `G4-EVIDENCE-PUBLICATION`: freeze and test unique USB evidence, integrity,
  finalization, override, loss, and late-export semantics.
- `G5-PERFORMANCE-ADMISSION`: predict and measure bounded work, duration,
  progress, and no-progress behavior for every leaf.
- `G6-WORK2-DEVELOPMENT-TARGET`: bind and verify the exact non-production
  deployment target and rollback path.

## Completion Result

PRM-0006 completed the requested Work2 endpoint. All G1 through G6 gates are
accepted, the exact candidate was deployed and proved on the bound
non-production Controller A target, and the IDEA-0001 outcome cycle is
terminal, satisfied, and reconciled. Production release remains owned by the
separate active release cohort. Later firmware corrections, qualification, or
Work5 activity do not reopen this completed map and require their own current
outcome ownership.
