# Pi automatic certification-file retrieval removal

Status: complete
Type: evidence
Updated: 2026-08-02
Next Action: use the manual append-only certification evidence workflow; finish and publish the pinned HPT validator release before Pi fixture admission
Project Map: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth: `jong@srv-rpi00.local:~/dev/sd_qualification` at `34dc4233dfa36b1bfdefbb7ecfa9a3bd5233b602`

## Decision and scope

The owner removed automatic certification-file retrieval rather than supplying
or maintaining a provider-hostname allowlist. The Pi application no longer
makes network requests for certification documents. Manual append-only
certification records remain and continue to capture source reference, exact
file size, media type, SHA-256, immutable evidence path, claimed identity,
actor, review, and supersession history. `CERTIFICATE_REQUIRED` remains an
operator intervention; `CERTIFICATE_FETCH_FAILED` is removed.

No Controller A/B, J-Link, power, SD-card, USB-device, or destructive operation
was performed.

## Source and review

- Repository: `PC-Redemption/sd-qualification`.
- PR: `#12`, **Remove automatic certificate fetching**.
- Source commit: `9d84a9dd2c439029544df4acc435bdb2c11b6408`.
- Merge commit: `34dc4233dfa36b1bfdefbb7ecfa9a3bd5233b602`.
- Removed surfaces: fetch module and tests, URL endpoint, form, family-page UI,
  deployment setting/check, Compose policy reference, policy example, release
  package input, fixture mapping, documentation, and fetch-failure choice.
- Retained surfaces: manual certification document model/form/route, immutable
  metadata, review and supersession history, and `CERTIFICATE_REQUIRED`.

## Verification

- Focused manual-certification, deployment-check, and campaign-notification
  tests passed.
- Full Django suite: `58` tests passed.
- Repository contract, network-policy, and release-package suite: `15` tests
  passed.
- `makemigrations --check --dry-run` reported no missing migration.
- Production configuration check passed with only the already accepted
  trusted-LAN HTTP warning.
- Disposable PostgreSQL 17.5 migration gate passed
  `0010 -> 0011 -> 0010 -> 0011`.
- The committed pre-merge image and package passed identity and checksum
  verification before PR integration.

## Final release and deployment

- Release identity: `certificate-fetch-removed-34dc423`.
- Exact image:
  `sha256:e034a7b2b858a132bcaf4117afde62f15de9558992fe113e85f4a7ffefba514b`.
- Final release package:
  `/var/tmp/sd-qualifier-final-packages/certificate-fetch-removed-34dc423`.
- Package hashes:
  - `image.tar`:
    `916c0756728901af194b77507d76a2e218c796ea8b69909c8e31506f50386de8`;
  - `manifest.json`:
    `d38ddeb2199cda07f1a62eb8441a27cd5a06dc388f9fab56becf03c1ad941e53`;
  - `sbom.cdx.json`:
    `5838ce2862f1548652390e36958f39e4fbde7acefdccd723c9394da82ae2cb93`;
  - `SHA256SUMS`:
    `444d56dfae3616295297418889cf60005aee0ab51ffa792b2345b7ffbf70cf0a`.
- Pre-deploy backup:
  `/backups/sd-qualifier-20260802T202426Z.dump`, SHA-256
  `68796dc7c574fb8be26c6048e0f535b1f4ed745937fa93d05a0fff1cacedbd2b`;
  disposable restore-check passed.
- Post-deploy backup:
  `/backups/sd-qualifier-20260802T202615Z.dump`, SHA-256
  `e28c2408b53211da0b437c759ed6bc3dfd3735adb9d7b1f42c86255cdc66f0ad`;
  disposable restore-check passed.

## Deployed result

- `web`, `command-worker`, and `notification-worker` all run the exact final
  image with zero restarts.
- `/sd-qualifier/healthz` reports database, evidence storage, clock, and
  workers healthy, with `fixture_only=true` and `live_admitted=false`.
- The former fetch endpoint returns HTTP `404`.
- The manual certification-add route remains available.
- Migration `0011` is applied.
- No active code, configuration, protected policy file, Compose setting, or
  packaged source file references automatic certificate fetching outside the
  historical `0010` migration.
- No application traceback, exception, or error was present after deployment.

## Planning consequence

Certificate-provider hostnames are no longer a task or readiness gate. The
next Pi dependency is the immutable HPT media-2.0 validator release and its
fixture admission. Live controller execution remains separately blocked by the
live adapter, authorized read-only A/B identity gate, stop/recovery, and
evidence-path readiness.
