# Ticket: Implement qualification authorization envelopes in Pi coordinator

Status: complete
Type: ticket
Updated: 2026-08-04
Next Action: none
Parent: work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md

## Problem

The deployed Pi application has immutable per-operation intents but no durable
human authorization envelope above them. HPT2 requires repeated human UI
approval for Start and Stop. Full-address scrub uses a free-form reference and
does not automatically reconcile `INTERRUPTED_UNKNOWN`. Operational wrappers
can also misclassify pre-target failures as consumed human authority.

## Expected Behavior

One exact human envelope authorizes a bounded campaign slice. The Pi mints a
fresh identity-bound machine intent for each included state-changing action,
automatically performs safe read-only continuation and reconciliation, and
asks again only when scope, identity, destructive behavior, physical action,
safety, credentials, expiry, or revocation requires it.

## Acceptance Criteria

- [x] Add an immutable authorization-envelope model with campaign/run/sample,
  controller, bundle, CID, allowed-action, expiry/revocation, and operator
  snapshots.
- [x] Link HPT2 and full-address scrub machine intents to their envelope while
  preserving legacy records.
- [x] Permit the Pi to derive unique Start/Stop intents from one approved
  matrix envelope without repeated human confirmation.
- [x] Automatically execute read-only reconciliation for an ambiguous scrub or
  HPT2 publication without authorizing or replaying a write.
- [x] Distinguish verified pre-target failure, read-only transport recovery,
  and post-write ambiguity in code, evidence, and UI.
- [x] Add tests for scope mismatch, identity drift, expiry/revocation,
  consumption boundary, bounded pre-target reconnect, no-replay, and automatic
  read-only reconciliation.
- [x] Update central and Pi policy/docs so new approval is requested only for
  physical actions, destructive scope, safety, credentials, expiry/revocation,
  identity change, or replay.
- [x] Back up the database, build and deploy one exact Pi image, run migrations,
  execute full and exact-image regression, and verify live health and envelope
  behavior without touching controller or SD media.

## Verification

Focused model/service/orchestration tests, complete Pi application tests,
exact-image tests, migration checks, database backup/restore, live container
identity and health checks, and a fixture/read-only workflow proving that one
envelope derives multiple machine intents while ambiguous writes remain
non-replayable.

Completed evidence:

- focused envelope/HPT2/scrub suite: 50/50 passed, including one matrix
  envelope deriving exact intents for two runs with distinct boot witnesses;
- non-environmental appliance aggregate: 128/128 passed;
- full suite: 141/144 passed, with three known environment-sensitive failures
  caused by the one-shot test container lacking the HPT execution-root mount
  and seeing the host clock marker;
- migration check: no changes detected;
- backup `/backups/sd-qualifier-20260804T225734Z.dump`, SHA-256
  `566b1d094f9022bf4d6df3af69988d9671cd209a138305130be3026f96398ea3`,
  restore-check passed;
- live HTTP health 200 with database, storage, clock, and workers ready;
- web and both workers run image
  `sha256:505ea42f0bc3ff561da26bcc1382d27073d750ac4aa5d9718174a38bf9f1c730`;
- no tools-profile container was left running and no controller/SD operation
  occurred during deployment.
