# HPT initialization readiness software continuation evidence

Status: PASS for all currently unblocked software, build, packaging, and fixture-deployment gates
Type: evidence
Date: 2026-08-05
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Outcome

Software work continued beyond the first initialization-adapter checkpoint.
This slice corrected the final known HPT diagnostic-contract defect, produced
and imported a superseding firmware bundle, implemented the protected external
approval trust store, and added authenticated initialization-envelope and
immutable-status UI support. No controller, SD card, J-Link endpoint, power
service, or raw-device path was accessed.

## Firmware diagnostic correction

`HPT_DIAG_MULTI_BLOCK_REJECTED` was obsolete after bounded multi-block reads
became supported in HPT v0.5. Worse, its live two-block call supplied a
one-sector stack buffer. The diagnostic now defines bit 3 as
`HPT_DIAG_MULTI_BLOCK_READ_SUPPORTED`, requires `HPT_STATUS_OK`, and reads into
a static, word-aligned 1,024-byte destination. This removes the false
`DiagnosticsFailed=8` classification and the latent buffer overrun without
hiding or remapping the raw diagnostic masks.

- Expanded commissioning/source invariants: `96/96` pass.
- Canonical managed Debug rebuild: pass.
- Canonical managed Release rebuild: pass.
- Initialization mailbox invariants remain `15/15` pass.
- `git diff --check`: pass.

Superseding Release bundle:

- Bundle ID: `smi-00-05-00-b845d4b9bcfe-4f37e97877d8-release`.
- Source base: `dd99776ad6c1ee67bcf1b2f30721f5f60f644a7b`.
- Reviewed source snapshot SHA-256:
  `b845d4b9bcfec96900687ffb01e676f19184443fe4624bd031b387b2322d7d28`.
- ELF SHA-256: `1ba22aa22d1c583a0804415ee898c6ec71630a8154ddf167bf3889be14c3a73a`.
- S-record SHA-256:
  `4f37e97877d851b583db7590ea464a15ccbb9943af1377ffe25d4e686d4a263b`.
- Mapping SHA-256:
  `0c0aefb6ddf00e1388e1b110971e01f43e285e3797002d365b325a2a0c8a1bbe`.
- Pi import manifest SHA-256:
  `a858c703f1ba4ebd10e2d5c6c804c501bfb22a7480f011d907226bc13da00c94`.
- Imported state: valid, `admitted=false`, scope `none`.

This bundle supersedes
`smi-00-05-00-c9ada4d5122b-e51ae77e9fab-release` for any future programming.

## Protected approval trust store

Pi commit `58f4acf7ca5c0a2eb4ee1fcf69c594b734b9fb16` implements a
bounded read-only trust-store parser and integrates its result into appliance
readiness. The store is external to requests, bundles, evidence, and the
browser. It fails closed for relative paths, missing/nonregular/symlinked files,
oversize or malformed JSON, unknown fields, duplicate hashes, and non-uppercase
SHA-256 values. Canonical approval checks also reject synthetic, pending,
rejected, and revoked documents. Health exposes only the anchor count, never
the hashes.

Installing a trust anchor passes only that gate; it cannot admit a bundle,
enable an endpoint or profile, or create an operation. The deployed protected
file is currently absent, so readiness reports
`APPROVAL_TRUST_STORE_MISSING/BLOCKED` rather than pretending an approval
exists.

## Initialization authorization UI

Pi commit `d7547a48fdbd53c57401b32f8dd2663372e66dd9` adds:

- an authenticated reviewer/administrator form deriving the exact campaign,
  sample, bundle, controller role, and latest complete CID from server records;
- explicit stable/non-heating and whole-card-erasure confirmations;
- rejection of duplicate active initialization envelopes;
- append-only authorization events with `target_access_started=false`;
- read-only display of the active envelope and immutable initialization
  operation/phase/terminal state;
- no browser route for preflight, machine-intent creation, publication,
  execution, or reconciliation.

PostgreSQL testing exposed and corrected a nullable-outer-join `FOR UPDATE`
defect in initialization-envelope creation. The final query locks only the
campaign row, matching the established PostgreSQL-safe pattern.

- Initialization/HPT2/trust/appliance focused tests: `57/57` pass.
- Compose boundary tests: `6/6` pass.
- Migration drift: no changes detected.
- Full generic-container suite: `161 passed, 3 environment-dependent failures`
  out of 164. The same two missing HPT-exec-mount cases and one host-clock
  marker expectation remain; there is no new product regression.

Final deployed fixture-only release:

- Release: `hpt-initialization-ui-d7547a4`.
- Source commit: `d7547a48fdbd53c57401b32f8dd2663372e66dd9`.
- Image: `sha256:a999e305b2d00ebcf2e08b0899a38c3fa565630072d1fd44d61b9e50e8838243`.
- HTTP health: `status=ok`; database, storage, clock, and workers ready.
- `fixture_only=true`, `live_admitted=false`, state-changing profiles false.
- No observer, programmer, HPT2 command, or HPT initialization tools container
  is running.
- Rollback images retained: `rollback-1572ed3-pre-approval-trust` and
  `rollback-58f4acf-pre-init-ui`.

## Remaining boundary

All currently specified software that can be validated without a live target
is complete. The powered-off transfer/reader workflow deliberately follows a
qualified power-off operation and exact media custody/reader admission; its
live identities and operations cannot be fabricated in fixture software.

The next executable campaign sequence begins by installing the superseding
firmware on Controller A, followed by a fresh full-flash/CID observation and a
new baseline scrub. Only then can the new UI envelope and protected one-shot
initialization adapter be used. Earlier scrub evidence remains valid history
for the prior installed image but is not transferable to this candidate.
