# Program Roadmap: Firmware Candidate Identity and Exact Work5 Promotion

Status: completed
Type: program-roadmap
Updated: 2026-09-08
Project Map: MAP-0008
Source Idea: IDEA-0005
Requested Endpoint: work5
Next Action: none; all milestones and gates completed in v00.05.00

## Program outcome

Implement the MAP-0008 candidate-identity contract, freeze and qualify one exact combined candidate
containing all seven awaiting-release registrations, publish firmware `00.05.00`, verify the
publication and release benches, and reconcile the complete release cohort.

## Milestones

| ID | Milestone | Evidence gate | Depends on | State |
| --- | --- | --- | --- | --- |
| M1 | Implement candidate manifest tooling, current-candidate status, manifest-bound programming, Work-level includes, tests, and documentation | G1, G2, G3, G4, G6 | none | complete |
| M2 | Run full checks and canonical clean Debug/Release builds; commit the final content; create and validate the immutable combined candidate | G1, G2, G5, G6 | M1 | complete |
| M3 | Freeze the seven-registration cohort to the exact content commit; qualify the manifest-bound bytes on Controller A and B with required CID/readback evidence | G3, G5 | M2 | complete |
| M4 | Push the exact content commit, require its exact successful push CI run, create provenance-only release metadata, tag and publish `v00.05.00`, verify assets, reconcile owners, and finalize the cohort | G4, G5, G6 | M3 | complete |

## Gate evidence requirements

- G1 passes with a canonical manifest schema, immutable copy verification, clean-commit binding,
  and adversarial hash/staleness tests.
- G2 passes when one read-only status command reports candidate, source, hashes, endpoint,
  qualification/promotion state, and current release-cohort count without creating another queue.
- G3 passes when bench programming resolves the candidate manifest by default and all Work5 bench
  evidence names the manifest digest and exact selected artifact hash.
- G4 passes when `work/tool-shed.yaml` resolves the expected Work2-Work5 actions and all actions use
  the shared repository command.
- G5 passes only when qualification, release assets, tag provenance, and post-publication checks all
  retain the exact candidate hashes; no post-qualification build is permitted.
- G6 passes with focused tests, all applicable repository checks, canonical Debug and Release
  rebuilds, and operator documentation that distinguishes all three lifecycle terms.

## Release boundary

Work5 is authorized for the complete active cohort and GitHub release. Controller programming is
allowed only after read-only preflight proves the named bench is idle/safe and the exact manifest
passes. Any active run, controller identity mismatch, missing CID, hash mismatch, protected provider
gate, missing credential, or absent exact-SHA CI run stops the roadmap at that gate without
stranding or silently narrowing the cohort.

## Rollback

Before each bench program, retain and hash its current full internal-flash image and capture its
controller/SD identity. If the candidate fails a bounded smoke gate, restore the captured image,
verify full-flash equality, record the failed candidate evidence, and leave the cohort working.
Before publication, failure is corrected by a new content commit and a newly frozen candidate;
after publication, do not move the tag silently—publish an explicit corrective release.

## 2026-09-08 Work5 checkpoint

All four milestones and all six readiness gates passed. The remote conflicting campaign was
reconciled to supported `BLOCKED` version 7 with no nonterminal execution. Controller A and B both
passed manifest-bound Release programming, exact candidate-region readback, reboot, CID, and
representative-sector-read checks. The final frozen content commit is
`fa6f1a99099c02d8359ca6723e982ce48e4529f7`; candidate
`00.05.00-fa6f1a99099c-c33cda33c79a` has manifest SHA-256
`0380BF78B5BBFD53465AD5EF8196FED8E881A81BB3E21224E2110A14CDD948EB` and Release S-record
SHA-256 `C33CDA33C79A760BFE839503C18F5CFD4C614ADF0A00F41AF92360CF90EDB024`.

Exact-SHA Validate run `34259014471` passed 4/4. Publication run `34259240246` published stable tag
`v00.05.00`; all five downloaded release assets matched their authoritative hashes. Earlier
publication attempts failed closed before asset staging and are retained in
`work/evidence/firmware-candidate-work5-a-b-qualification-20260908.md` together with their path-case
and line-ending corrections. No post-qualification firmware build occurred.
