# Inventory: SD qualification project current state

Status: complete
Result: complete; historical Aug. 13 orientation snapshot
Type: inventory
Updated: 2026-08-14
Next Action: none; use the owner campaign queue and newer evidence for current state
Campaign: 005-complete-sd-qualifier-gate2-release-plan-acceptance
Parent: work/maps/map-smi-firmware-stabilization-and-qualification.md
Canonical Truth: README.md; docs/ecr-sd-card-supply-change-resolution.md; docs/sd-card-operation-and-recovery.md; the live `srv-rpi00.local` SD Qualifier database and deployed image for runtime state

## Scope

This inventory maps the SD-card/HPT qualification project through the accepted
Aug. 10 campaign closeout at `2026-08-13T23:52:09Z`. It covers the governing qualification contract,
firmware and card identities, physical benches, current live campaign,
coordinator, evidence, active workstreams, downstream ECR/ECO work, and known
state drift.

This is an orientation artifact, not a new plan or a revised qualification
contract. The accepted closeout changed only application/report/observer state;
it issued no controller command and made no firmware, power, media, card-result,
authorization, or external controlled-document change.

## Aug. 10 campaign audit checkpoint

The restore-verified frozen audit is complete and its recommendation accepted.
Campaign `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a` is terminal `ABORTED`, presented
as closed without qualification conclusion and permanently reasoned
`INCONCLUSIVE — no card rejection`. It has zero active runs, unresolved HPT2
operations, or active coordinator tasks; all `187` runs and `361` operations
remain terminal. Both card results remain `PENDING`. The immutable manifest and
report preserve the closeout state and reason, and the retired exact observer
no longer appends read-only evidence. Evidence:
`work/evidence/sd-qualifier-aug10-campaign-inconclusive-closeout-20260813.md`.

## Project shape

The phrase **SD qualification project** currently covers four related but
different outcomes. Treating them as one undifferentiated finish line has made
status difficult to reason about.

| Layer | Outcome | Current owner / authority | Current state |
| --- | --- | --- | --- |
| Firmware/product | Frozen SMI firmware implements safe HPT media 2.0 behavior | This firmware workspace (`README.md`, `docs/`, source, builds) | Implementation and representative A/B regression substantially complete; final physical qualification gates remain |
| Qualification method | A repeatable contract defines identity, scrubs, initialization, S0-S6, recovery, regression, closeout, and disposition | Current docs, decision matrix, checklist, and runbook | Exists; it is distributed across several authoritative surfaces |
| Website-driven qualification application | An operator uses one website to create a campaign, identify and CID-bind cards, follow safe physical instructions, start qualification, monitor automated fault/endurance testing, review pass/fail evidence, and reach a final reviewed conclusion | `work/wp/active/wp-build-standalone-pi-sd-qualification-operator-application.md`; `srv-rpi00.local:~/dev/sd_qualification`, its database, and deployed image | Partially delivered: deployed; the legacy campaign is truthfully closed `INCONCLUSIVE` without card rejection, but the complete clean contract-bound journey through final disposition has not been demonstrated end to end |
| Supply change | Candidate media is accepted, sourcing/BOM decisions are made, and the ECR/ECO is released and implemented | Firmware workspace plus the SharePoint-backed `1751xxx_control_sdcards` project | Engineering procedure exists; current pair, broader retail sampling, ECO release, and implementation remain open |

## Primary delivery stage: website-driven SD-card qualification application

This is a first-class project stage and the main operator-facing product, not
merely execution infrastructure for a checklist.

### Required deployment target

The application shall run on `srv-rpi00.local`. That host is the standalone
qualification appliance and owns the production website, PostgreSQL database,
persistent coordinator, command/notification/watchdog workers, evidence
ledger, backups, and protected controller/power-service adapters.

Operators access the application at the `srv-rpi00.local` website. This Windows
firmware workspace supplies reviewed firmware bundles, contracts, and release
evidence, but it is not part of the application's runtime path and must be able
to remain disconnected during a complete qualification campaign.

### Intended operator journey

1. The authenticated operator creates or selects a card-family qualification
   campaign and the reviewed firmware/profile.
2. The website asks for the physical card's package, receipt, markings, prior
   use, expendable status, and assigned controller role.
3. The website gives the exact safe installation instruction. SD-card
   insertion, removal, or replacement occurs only with the controller powered
   off.
4. After boot, the application reads service 467 through its protected
   read-only adapter and records protocol status, CID validity,
   representative-sector readability, decoded identity, and the complete raw
   CID. The operator confirms that the observed card is the intended specimen.
5. The application checks the firmware bundle, controller, card/CID,
   authorization, backup, worker, evidence-storage, power, and safety gates.
6. The operator selects **Run full qualification** once. The persistent
   coordinator then owns all steps that do not require a genuine physical,
   safety, authority, or reviewer intervention.
7. The application exercises the card at the defined failure points: complete
   baseline read, HPT initialization, S0-S6 boundary cases, controlled
   interrupted-session recovery, representative production regression,
   post-campaign full-address read, and final CID comparison.
8. The website reports each attempt and derived `PASS`, `FAIL`, `BLOCKED`, or
   `INCONCLUSIVE` result, including the first failure, evidence identity,
   failure attribution, and exact safe next action.
9. A reviewer records the physical-card conclusions. The application then
   evaluates the paired A/B family gate and presents the final campaign
   conclusion without silently converting missing evidence into a pass.

### Delivery inventory

| Application capability | Observed status | Evidence boundary |
| --- | --- | --- |
| Authenticated website and persistent database on `srv-rpi00.local` | IMPLEMENTED | Deployed Django/PostgreSQL application is live on the required appliance host |
| Campaign, family, specimen, firmware, profile, and evidence records | IMPLEMENTED | Current KEXIN family, F1-A1/F1-B1, bundle, campaign, and immutable plan exist |
| Operator card-intake and traceability workflow | IMPLEMENTED, NOT RE-PROVEN AS A FRESH END-TO-END JOURNEY | Current cards are registered and assigned; this inventory did not replay intake |
| Guided power-off card installation/replacement | IMPLEMENTED AS GUIDANCE AND GATES | Physical action remains operator-owned; powered SD swapping is prohibited |
| Application-driven service-467 identity/CID capture | IMPLEMENTED | Current database contains valid, repeated A/B identity captures |
| Readiness and authorization gates | IMPLEMENTED | Current A/B HPT2 envelopes and exact bundle/CID snapshots are active |
| One website **Run full qualification** action | IMPLEMENTED | The current real campaign was started and is running under the durable coordinator |
| Persistent restart/no-replay coordinator | IMPLEMENTED, SUCCESSOR EVIDENCE INCOMPLETE LOCALLY | Earlier release has fixture proof; deployed `8eaa33e` needs a current evidence addendum |
| Automated S0-S6 qualification | IN PROGRESS | Current matrix is incomplete; S5/S6 producer gaps are reported |
| Automated controlled recovery | PARTIAL | A has all five cases; B does not |
| Representative regression | IMPLEMENTED/PASS FOR CURRENT PAIR | Both cards have accepted step-6 evidence |
| Post-campaign scrub and final CID comparison | NOT RUN FOR CURRENT PAIR | Protected scrub authority remains a later gate |
| Per-card pass/fail/inconclusive reporting | IMPLEMENTED | Travelers and evidence ledger exist; current cards remain pending |
| Reviewer disposition and paired family conclusion | IMPLEMENTED AS A GATED WORKFLOW, NOT PHYSICALLY COMPLETED | Fixture reached the reviewer gate; neither real card has a disposition |
| Complete new-card journey with this firmware workspace disconnected | NOT DEMONSTRATED | Existing workpackage still lists this standalone proof as incomplete |

### Stage completion gate

This application stage is complete only when a normal operator can take a new
eligible card pair from website-created campaign and guided identification,
through application-captured CID and one website Run action, through all
automated and explicitly prompted qualification operations, to reviewed
per-card and paired-family conclusions. The application must survive restart
and communication loss, preserve evidence without command replay, and require
no agent-selected case or SSH-driven campaign control. The complete acceptance
test must run on `srv-rpi00.local` without runtime dependence on this Windows
firmware workspace.

The present status is therefore **PARTIALLY DELIVERED / LIVE QUALIFICATION IN
PROGRESS**, not “application complete.”

## Governing qualification contract

There is a qualification contract. Its detailed requirements remain distributed
across mutually dependent current surfaces, while
`docs/sd-card-qualification-contract.md` now provides the governing front door,
authority order, campaign types, result layers, and evidence-admission rules.

| Contract surface | What it governs | Classification |
| --- | --- | --- |
| `docs/sd-card-qualification-contract.md` | Authority order, campaign types, phase sequence, result layers, evidence admission, retry limits, and current-campaign transition rule | Current governing front door; executable application encoding pending |
| `docs/ecr-sd-card-supply-change-resolution.md` | Candidate eligibility, controlled HPT media 2.0 procedure, per-card disposition, family lifecycle, and ECR/ECO boundary | Current engineering acceptance contract |
| `docs/hpt2-measurement-matrix-v2.md` | Selected S4 repetition policy and final-target rule; v1 remains in force for the other proof shapes | Current matrix delta contract |
| `work/checklists/checklist-hpt2-bounded-stop-recovery-and-regression-measurement.md` | Exact S0-S6 observation counts, proof, entry gates, recovery, regression, stop conditions, and exit | Active execution contract and historical log; large and append-heavy |
| `work/decisions/decision-remaining-qualification-authorization.md` | Approved scope, controller/card allocation, allowed destructive operations, stop rules, acceptance limits, release sequence, and timing estimates | Decided authority contract |
| `work/runbooks/runbook-autonomous-hpt-sd-qualification.md` | Repeatable operational order, G-PWR boundary, evidence capture, and recovery behavior | Ready operational contract |
| `work/adr/adr-commodity-retail-sd-media-policy.md` | Retail-media policy, multi-source intent, and limits of any specimen result | Accepted policy |
| SD Qualifier eight-step traveler | Operator-facing rendering of the method and evidence state for each physical card | Deployed presentation; not independently authoritative over the documents and database |

Contract boundary: the current pair can establish the first-family release gate,
but it cannot by itself prove universal retail-card reliability. Additional
retail families are rolling qualification, and the accepted policy calls for at
least two families when practical. ECR/ECO release and production implementation
are separate downstream decisions.

## Frozen identities and physical resources

| Item | Current identity | State / disposition |
| --- | --- | --- |
| Firmware bundle | `smi-00-05-00-389167c1d57f-37ff5c0c6f48-release`; manifest SHA-256 `624eff9a7b9e96e98b959727257441678d2970a94f8bcd8f3ea1b04fdea0e62d` | Bound immutably to the live campaign |
| Controller A | Assembly `1751136`, hardware variant `0`, J-Link `69664082` | Assigned F1-A1; supervisor healthy at snapshot |
| F1-A1 | KEXIN 8 GB; CID `05000C61736466672200001C8901A34F` | Current campaign result pending |
| Controller B | Assembly `1751219`, hardware variant `1`, J-Link `69660123` | Assigned F1-B1; supervisor healthy at snapshot |
| F1-B1 | KEXIN 8 GB; CID `05000C61736466672200001C8201A379` | Current campaign result pending |
| Power control | Separate HPT Lab Power Control service; G-PWR-A and G-PWR-B methods previously qualified | Available only through the applicable protected, case-authorized path |
| Card handling | Operator-owned, controller power off for every SD insertion/removal/replacement | No powered SD-card handling is permitted |

## Live campaign snapshot

| Field | Observed value |
| --- | --- |
| Campaign | `8c7a2b1a-7e67-48ac-8895-7999d76c4c2a` — KEXIN 8GB HPT2 exact-read hotfix qualification 2026-08-10 |
| Campaign state | `RUNNING` |
| Coordinator state | `RUNNING`; desired state `RUNNING`; no stop code |
| Coordinator frontier | `matrix.s1.b` |
| Deployed release | `campaign-coordinator-8eaa33e` |
| Deployed source label | `8eaa33ef508a37de71f65274c92458c53aabf283` |
| Deployed image | `sha256:1cc86d666c35bf22c683f280f3526ab6c2d56d2726031067f07eace51e71f293` |
| Service health | Web healthy; coordinator, command, notification, and watchdog containers running |
| Authorization | Current A/B immutable HPT2 Start/Stop envelopes are not revoked and expire on 2026-09-10; this is an authorization lifetime, not a predicted campaign duration |
| Runs at snapshot | 61 completed, 2 running, 3 blocked, 2 aborted |
| Card results | F1-A1 pending; F1-B1 pending; neither has final disposition |

The durable task queue was not a simple linear picture at the snapshot:

- `matrix.s0.a` was `FAILED` at attempt 4/4 even though the matrix audit credits
  A S0 as passing.
- `matrix.s0.b` was `COMPLETED` at attempt 4/4.
- `matrix.s1.a` was still `CLAIMED` at attempt 3/3.
- `matrix.s1.b` was `PENDING`, while the coordinator frontier named
  `matrix.s1.b` and a Controller B S1 run was open.
- Two runs were open: one long Controller A S1/proving run and one Controller B
  S1 run. This reflects cross-role proving/gating behavior but makes task,
  frontier, run, and traveler state difficult to read as one sequence.

These are inventory facts. They are not yet classified as defects or accepted
behavior.

## Current HPT2 matrix evidence

The live `audit_hpt2_matrix()` result at the snapshot reported
`matrix_pass=false`, 56 valid base adjudication rows, 12 valid extended rows,
and no invalid extended evidence.

| Case | Controller A | Controller B | Contract minimum |
| --- | ---: | ---: | ---: |
| S0 | 4/3 PASS | 3/3 PASS | 3 each |
| S1 | 10/10 PASS | 2/10 OPEN | 10 each |
| S2 | 4/10 OPEN | 0/10 OPEN | 10 each |
| S3 | 14/10 PASS | 8/10 OPEN | 10 each |
| S4 ordinary targets | Three isolated observations across 10080/44640 regions; no ordinary region complete | Three isolated observations across 1440/10080/44640 regions; no ordinary region complete | 3 per BEFORE/AT/AFTER region at 1440, 2880, 10080, and 44640 on each controller |
| S4 final target 129600 | BEFORE/AT/AFTER all PASS 1/1 | BEFORE/AT/AFTER all PASS 1/1 | 1 per region per controller |
| S5 | 0/10 OPEN | 0/10 OPEN | 10 each |
| S6 | 0/10 OPEN | 0/10 OPEN | 10 total with both variants and required slow-path breadth; A-local provisional rule also exists |

The audit additionally reports two implementation/evidence-producer gaps for
this campaign identity:

- `S5_PRODUCTION_QUEUE_CONTENTION_EVIDENCE_PRODUCER_REQUIRED`
- `S6_SLOW_PATH_IDENTITY_EVIDENCE_PRODUCER_REQUIRED`

Historical A S5/S6 passes exist under earlier identities, but the current
campaign audit does not credit them to this frozen bundle/campaign.

## Eight-step physical-card travelers

| Step | F1-A1 | F1-B1 |
| --- | --- | --- |
| 1. Intake/CID identity | PASS | PASS |
| 2. Baseline full-address scrub | PASS | PASS |
| 3. HPT initialization | PASS | PASS |
| 4. S0-S6 matrix | RUNNING; shared display says 10 of 42 plan leaves complete | Matrix incomplete; traveler displayed AWAITING ADMISSION while the coordinator/database also showed an open B run |
| 5. Controlled recovery | PASS, all five current-campaign cases | NOT RUN as a complete B set; traveler reports 5 of 10 combined recovery leaves complete |
| 6. Representative regression | PASS | PASS |
| 7. Post-campaign scrub/CID closeout | NOT RUN | NOT RUN |
| 8. Reviewer disposition | NOT RUN | NOT RUN |

The database/traveler mismatch around Controller B is a presentation or state
projection question to reconcile later. It does not by itself invalidate the
underlying run evidence.

## Qualification appliance inventory

| Component | Current state | Disposition |
| --- | --- | --- |
| Web-started durable coordinator | Implemented, deployed, and controlling the live campaign | Keep as current implementation; do not confuse deployment completion with campaign completion |
| Restart/no-replay behavior | Fixture-verified for the earlier `0490369` release; successor release is live | Retain evidence; local evidence needs a successor release addendum |
| Web Start/Pause/Resume | Implemented | Current control surface |
| Durable leased task runner | Implemented and actively claiming work | Current execution surface |
| A/B HPT2 authorization envelopes | Active through 2026-09-10 | Current matrix authority only |
| Controller B coordinated whole-controller cycle | Previously identified as a genuine protected capability gate | Needed for B recovery, not for the current Start/Stop matrix |
| Post-campaign scrub authority | Previously identified as a later reviewed gate | Needed only after matrix/recovery/regression are satisfied |
| Final disposition | Intentionally reviewer-owned | Must not be auto-passed |

## Active workstreams and their relationship to this campaign

| Workstream | Relationship | Current state |
| --- | --- | --- |
| `wp-build-standalone-pi-sd-qualification-operator-application.md` | Direct execution infrastructure | Active; header is stale because it still says to start a campaign that is already running |
| `wp-sd-card-accelerated-endurance-evaluator-and-media-qualification.md` | Direct physical-card/family qualification | Active; current pair and broader multi-sample program remain open |
| `wp-triple-mirrored-circular-hpt-log-store.md` | Product implementation plus release qualification dependency | Waiting on final A/B stop/recovery and returned results |
| `wp-sd-card-degraded-boot-and-logging-integrity.md` | Separate degraded-operation qualification | Firmware complete; waiting on qualifier evidence |
| `wp-mitigate-smi-firmware-code-review-findings.md` | Separate negative/recovery qualification | Firmware complete; waiting on coordinated target evidence |
| `wp-build-independent-hpt-media-validator-for-pi-qualification.md` | Independent/raw-media validation capability | Active but blocked on a separately selected card, reader, and powered-off transfer authorization |
| `wp-migrate-usb-vbus-control-out-of-ssp.md` | Adjacent USB diagnostic work | Not part of the SD-card qualification finish line |
| Deferred temperature workpackages | Separate product work | Explicitly deferred; not part of this campaign |

## Evidence and planning-state inventory

| Surface | Observed state | Classification |
| --- | --- | --- |
| `work/index.md` / `work/index.json` | Structurally valid; Tool Shed state review reported zero findings | Useful navigation, not semantic runtime truth |
| Project map | Large historical/current log; latest header still names `campaign-coordinator-0490369` and a pre-start next action | Semantically stale at the top; retain history |
| Coordinator deployment evidence | Documents `0490369` fixture verification and pre-start gates | Valid predecessor evidence, incomplete for deployed `8eaa33e` |
| Live container image labels | Identify `8eaa33e` source and exact image | Current deployment identity |
| Live database | Identifies campaign, coordinator, tasks, runs, evidence credit, travelers, and envelopes | Current runtime authority |
| Remote source checkout | Git HEAD `9d7e0f0584fd2589ba7a823d462f7ddce6e9023b`; not the packaged deployed coordinator source | Do not use checkout HEAD as deployed-release identity |
| Firmware worktree | 28 tracked modifications at inventory time, including firmware source/builds and qualification artifacts | Preserve as user/campaign work; no cleanup or broad rewrite during orientation |

## Confirmed completion and open gates

Confirmed:

- The controlled qualification procedure and acceptance rules exist.
- A/B controller, card, CID, firmware-bundle, and campaign identities are bound.
- Baseline identity, full-address scrub, and initialization pass for both cards.
- The representative A/B regression passes for both cards.
- Controller A's five current-campaign recovery cases pass.
- The web coordinator is deployed and the real campaign is running.

Open for the current pair:

- Complete and approve the current-identity S0-S6 matrix.
- Establish the production Stop deadline from accepted evidence; it remains
  unset while measurement continues.
- Complete Controller B's five recovery cases through the protected method.
- Run both post-campaign full-address scrubs and final CID observations.
- Review and record both card dispositions and the paired A/B gate.

Open beyond the current pair:

- Qualify additional retail family/sample coverage required by the sourcing
  policy and rolling approved-card pool.
- Reconcile candidate/sourcing records in the SharePoint-backed ECR project.
- Decide the part/specification treatment, approve/release the ECO, and
  implement the released change in purchasing, receiving, BOM/work
  instructions, and both production channels.
- Complete separately governed degraded-operation and firmware negative/recovery
  evidence that is not automatically satisfied by the current media pair.

## Known uncertainties to resolve before more planning

1. Whether the active task/frontier/open-run combination is intended
   coordinator semantics or an implementation-state inconsistency.
2. Why the durable `matrix.s0.a` task is failed even though current matrix
   evidence passes A S0, and whether that state affects recovery/restart.
3. Whether the current S5/S6 producer-gap report is expected for the deployed
   release or contradicts predecessor qualification evidence that should have
   been identity-validly reconciled.
4. The measured remaining wall-clock time for the actual incomplete matrix,
   especially the 24 ordinary S4 regions, rather than authorization lifetime.
5. Which outcomes are release-blocking now: first-family card qualification,
   broader retail-pool qualification, degraded-operation evidence, other
   firmware-negative cases, pilot rollout, and ECO release must remain visibly
   distinct.
6. The exact evidence and source/package record for deployed release
   `campaign-coordinator-8eaa33e` is not yet represented in this firmware
   workspace's current checkpoint artifacts.
7. The application has not yet passed its defining physical acceptance test:
   a normal operator taking a fresh eligible pair from website-created campaign
   and guided identity capture through one Run action to reviewed per-card and
   paired-family conclusions without SSH-driven case selection.

## Inventory disposition

- Keep all existing contract and evidence surfaces. The 2026-08-13 governing
  front door consolidates and orders them without replacing their detailed
  technical requirements.
- Treat the website-driven qualification application as a primary delivery
  stage with the explicit end-to-end operator journey above, rather than as a
  miscellaneous collection of infrastructure features.
- Treat the live database and exact deployed image as runtime truth for this
  snapshot.
- Treat docs and accepted decisions as qualification-policy truth.
- Treat completed artifacts as history and evidence, not current runtime state.
- Do not plan corrective work until the six uncertainties above are reconciled
  against current evidence.
- Do not delete, move, rewrite, deploy, pause, resume, or advance anything as a
  consequence of this inventory alone.

## 2026-08-14 completion disposition

The inventory's remaining stale-fixture disposition action is complete. The
Aug. 10 campaign and the remaining stale or superseded fixture campaigns are
terminal with no qualification conclusion, as recorded in
`work/evidence/sd-qualifier-nine-campaign-administrative-closeout-20260814.md`.
Current incomplete outcomes and their execution order are now represented in
`work/00-campaigns/active-queue.md`; this inventory remains a historical Aug. 13
snapshot and no longer directs execution.

## Verification

- Tool Shed work-state review returned zero findings before this inventory was
  created.
- Live state was read through the deployed Django models and
  `audit_hpt2_matrix()` without writes.
- Deployed container/image identity was read directly from Docker.
- Local tracked changes were inspected with
  `git status --untracked-files=no`; no per-file generated-evidence diff was
  requested.
- After this artifact update, regenerate the work indexes, run the stale-path
  check, and rerun the read-only work-state review.
