# Project Map: Firmware Service-Code SD Qualification

Status: active
Type: project-map
Updated: 2026-08-30
Next Action: resolve the firmware/Pi authority decision and freeze the shared firmware test catalog before implementation
Source Idea: IDEA-0001
Readiness Review: 7da3aeb14bb1dea6652ee5faaeeccd026392db8416b67b479216077c9437f41b

## Desired Outcome

Deliver a modular SD qualification suite in which individual service codes and
one ordered full-run service invoke the same firmware-owned leaf-test
implementations, with bounded progress, fail-closed prerequisites, safe
power-off pause/resume, CID-bound identity, and reviewable evidence. Stop at
Work2: a committed candidate deployed to one explicitly bound non-production
work environment with focused changed-behavior evidence. Production release,
physical card-family qualification, and ECR/ECO conclusions remain outside the
endpoint.

## Direction Map

```text
IDEA-0001
  |
  +--> Shared test catalog and service dispatcher ---------- G1
  |
  +--> Firmware / Pi / operator authority contract -------- G2
  |       |
  |       +--> powered-off intervention witness
  |       +--> evidence admission and final disposition
  |
  +--> Controller journal and no-replay resume ------------- G3
  |
  +--> Versioned USB evidence publication ------------------ G4
  |
  +--> Bounded-work and duration admission ----------------- G5
  |
  +--> Known non-production deployment and checks ---------- G6
          |
          +--> Work2 candidate + release cohort
```

## Workstreams

| Workstream | Current evidence | Required decision or proof | Boundary |
| --- | --- | --- | --- |
| Shared firmware engine | Existing HPT diagnostics, mailboxes, media classification, CID, scrub, wrap, power-cut, endurance, and export capabilities already exist | Freeze the smallest leaf catalog and show individual/full-run paths call one implementation | Do not duplicate diagnostic implementations |
| Authority split | `SMI-SDQ-CONTRACT-V1` currently assigns full-run advancement to the persistent Pi coordinator; IDEA-0001 identifies a firmware-sequenced hybrid as the leading possibility | Owner selects the responsibility split and a reviewed contract revision records it | No Pi workspace or runtime mutation from this workspace without explicit binding |
| Pause/resume | Existing fixed mailbox, CID, media-generation, and recovery-checkpoint surfaces provide ingredients | Select controller-owned journal placement and prove atomicity, wear, planned pause, manual continuation, and no replay | Never instruct or perform powered SD removal |
| Evidence publication | Existing FileX/USB export paths and timing/work counters provide reusable mechanisms | Freeze a versioned unique-run schema and completion-marker-last protocol | No drive-specific production behavior or optional-command requirement |
| Performance | Existing HPT2 performance-plausibility and matrix-efficiency contracts govern | Predict and measure work for every leaf on worst-supported geometry | A slow method cannot falsely fail the SD card |
| Work2 delivery | Managed build/package tooling exists; no development target is configured for this route | Bind one exact non-production target, rollback, deployment, and focused checks | No controller programming or protected remote action from an unknown target |

## Readiness Gates

- `G1-SHARED-TEST-CATALOG`: freeze services, order, prerequisites, outcomes,
  safe-stop semantics, and shared implementation proof.
- `G2-FIRMWARE-WITNESS-AUTHORITY`: settle and document firmware, Pi/web, and
  operator ownership; reconcile `SMI-SDQ-CONTRACT-V1`.
- `G3-PAUSE-RESUME-SAFETY`: prove controller journal integrity, powered-off
  intervention, pinned identity validation, manual continuation, and no replay.
- `G4-EVIDENCE-PUBLICATION`: freeze and test unique USB evidence, integrity,
  finalization, override, loss, and late-export semantics.
- `G5-PERFORMANCE-ADMISSION`: predict and measure bounded work, duration,
  progress, and no-progress behavior for every leaf.
- `G6-WORK2-DEVELOPMENT-TARGET`: bind and verify the exact non-production
  deployment target and rollback path.

## Current Ground Task

Resolve `G2-FIRMWARE-WITNESS-AUTHORITY`. Recommended direction: firmware owns
leaf-test truth, prerequisites, progress, checkpoints, and results; the Pi/web
qualifier remains the independent power witness, evidence ingester, campaign
coordinator, and reviewer surface. The owner must confirm this material
responsibility boundary before firmware or Pi implementation changes begin.

