# Project Map: Service 489 Unattended Run And USB Evidence

Status: active
Type: project-map
Updated: 2026-09-01
Next Action: freeze and model-test the service-489 immutable session plan and USB evidence contract
Source Idea: IDEA-0003
Readiness Review: 7667930b6dcc4dbd2c650f83a9e5bceeec136e396426f18e7c16325ac9ae9f1d
Requested Endpoint: work2

## Desired Outcome

Deliver a committed firmware candidate in which service 489 collects and durably freezes its
controller/CID-bound execution plan, explicitly includes or bypasses service 487, optionally emits
bounded standards-based USB evidence, preserves the service-486 power boundary and service-488
one-shot resume, and reports bypass or evidence loss without manufacturing qualification credit.
Deploy that exact candidate to non-production Controller A and stop at verified Work2.

## Direction Map

```text
IDEA-0003
  |
  +--> Immutable session plan and result semantics -------- G1
  |
  +--> Bounded USB evidence publication ------------------- G2
  |
  +--> 486 pause / 488 one-shot resume -------------------- G3
  |
  +--> Focused checks, managed build, packaged candidate -- G4
  |
  +--> Controller A deploy, verify, release-cohort bind --- G5
          |
          +--> Work2 complete; 487 endurance and Work5 remain open
```

## Workstreams

| Workstream | Required result | Boundary |
| --- | --- | --- |
| Session plan | Persist controller, firmware/catalog, CID, 487 selection, USB selection, override reason, and final confirmation before destructive work | A bypass is never endurance credit |
| USB evidence | Versioned JSON/NDJSON, calculated capacity bound and reserve, viability probe, one folder, incremental artifacts, hashes, manifest, marker-last finalization | USB never becomes resume authority or specimen-specific behavior |
| Recovery/resume | Keep frozen 486-before-487 order, whole-controller interruption, stable-boot validation, and atomic service-488 consumption | No powered SD movement and no automatic replay |
| Firmware candidate | Reuse the shared engine and existing FileX/USB surfaces; pass focused policy/model/regression checks and canonical build/package gates | Do not duplicate leaf implementations or broaden USB lifecycle |
| Work2 target | Bind Controller A, live CID, exact candidate and rollback; verify focused changed behavior without starting the 72-hour leaf | No Controller B, family, certification, production, or Work5 credit |

## Readiness Gates

- `G1-SESSION-PLAN-SEMANTICS`: immutable selections, persistence, confirmation, routing, and result semantics pass model and source checks.
- `G2-USB-EVIDENCE-PUBLICATION`: bounded schema, capacity, viability, streaming, loss, hashing, manifest, and finalization behavior pass.
- `G3-RECOVERY-RESUME-SAFETY`: service 486 and 488 preserve identity-bound one-shot recovery with no replay.
- `G4-WORK2-CANDIDATE`: focused checks, canonical managed Debug rebuild, packaging, and scoped product commit pass.
- `G5-WORK2-CONTROLLER-A`: exact Controller A deployment, rollback, CID, health, focused behavior, and release-cohort registration pass.

## Deferred Beyond Work2

- the actual service-487 72-hour endurance run and evidence admission;
- equivalent Controller B and paired-family qualification;
- certification signing, reviewer disposition, production push/release, and Work5.

## Current Ground Task

Freeze the session-plan and USB-evidence contracts in current project documentation and focused
model checks before changing firmware source.
