Repository navigation
CI-001 — Establish trustworthy quality gates and protected deployment #105
Description
Outcome
Create a trustworthy delivery pipeline in which non-mutating lint, frontend tests/build, Functions lint/tests, Firestore Rules tests, dependency/secret checks, and exact-commit staging evidence gate any deployment. Remove service-account material from frontend builds and move toward least-privilege OIDC/WIF with protected approval.
Why this is a tracker
This is cross-boundary delivery and external IAM work. Assign only atomic children.
Children
- CI-001A — Repair the deterministic frontend test baseline #103 — CI-001A: repair the deterministic frontend test baseline (merged to
mainand closed) - CI-001B1 — Run frontend Jest in hosted CI #124 — CI-001B1: run the complete frontend Jest suite as a job-failing hosted CI step (merged to
mainand closed) - CI-001B1A — Run SPA callback safety tests in hosted CI #126 — run the standalone SPA callback suite as a named, job-failing hosted CI step (merged to
mainand closed) - CI-001B2 — Make releases protected, backend-first, and fail-closed #135 — CI-001B2: protected backend-first fail-closed gate merged as
9eafab1217aff7058c42240aaba72d7b93f8ed24; safe negative probes published nothing - CI-001C — Configure protected short-lived Firebase deployment identity #133 — CI-001C: configure protected short-lived OIDC/WIF deployment authority (blocked on owner/IAM configuration)
- CI-001D — Prove backend-first staging and deploy the profile repair #136 — CI-001D: prove compatible backend-first staging and deploy the profile repair (CI-001B2 — Make releases protected, backend-first, and fail-closed #135 closed and AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 source merged; still waits for BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113, CI-001C — Configure protected short-lived Firebase deployment identity #133, and protected Netlify release)
System acceptance
- The exact commit cannot deploy until every required check passes.
- Lint never rewrites files or hides failures.
- Frontend builds receive no server credential.
- Missing deployment authority/config fails visibly.
- Backend/rules/index changes precede dependent frontend code.
- Production requires named approval and staging evidence.
Dependencies
SAFETY-001 (#99) is the local-safety foundation. External IAM/environment work requires an authorized owner.
Claim rule
Do not claim this tracker. Claim exactly one dependency-ready child, assign it, and post the repository-standard timestamped CLAIMED marker before editing.
Activity
daliu commentedon Jul 12, 2026
DELIVERY EVIDENCE (not a claim): after #107 merged at ce22c11, post-merge CI passed, and the deploy workflow itself concluded success. However, the Firebase step logged
No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy; only the GitHub Pages artifact published.This is current evidence for CI-001C/CI-001D and the tracker acceptance item “Missing deployment authority/config fails visibly”: missing backend deployment authority currently produces an overall green workflow while skipping Functions/Rules deployment. No secret values or production changes were inspected.
daliu commentedon Jul 12, 2026
Privacy/security coordination note: #110–#112 cover data decisions, current telemetry redaction, and private incident intake. Continuous secret scanning, dependency scanning/update policy, SBOM/provenance, protected environments, and deployment IAM remain under CI-001/SUPPLY work represented by this tracker; no duplicate scanning ticket was created.
daliu commentedon Jul 12, 2026
DELIVERY EVIDENCE from #104 / PR #108:
0e03ac145f410b210419efdc9026a52205e110f1.npm run build, publish directorybuild,NPM_FLAGS=--legacy-peer-deps, and the duplicate webpack-ESLint suppression already used by GitHub CI.6a541615a1293800083f6f50published the exact merge commit andrunmprc.comreturned HTTP 200 with the approved bundle.No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy.Therefore the Netlify install/build blocker is resolved, but CI-001 acceptance is not complete: missing Firebase authority still produces a green workflow and no backend deployment. That fail-closed authority work remains here and was not claimed by #104.
daliu commentedon Jul 12, 2026
Fresh backend evidence for CI-001:
mid-peninsula-running-clubis active and its Firestore indexes are visible, butupdateMemberRole,setMemberRole, andlistMyRegistrationsendpoints return HTTP 404, while prior deploy runs skipped Firebase for absent backend credentials. #113 owns read-only estate/disposition verification; this tracker retains deploy identity, fail-closed credential gating, backend-first release, and exact deployed-revision proof.daliu commentedon Jul 13, 2026
ACTIVE USER IMPACT / DELIVERY EVIDENCE (2026-07-12; not a claim): a signed-in user now reports profile save failing with Firestore
permission-denied. Source Rules/tests allow the exact self-edit, but the cutover deploys repeatedly skipped Firebase, known Functions on the new project return 404, and account setup depends on an Auth-triggered Function plus Rules. This turns the backend deployment gap from latent risk into an observed account failure; live cause still requires private read-only provider verification under #113.#118 owns the functional profile bootstrap/UI outcome. #119 owns Auth-email sender/DNS configuration. Both depend on a protected staging/backend release path here.
CI-001C/CI-001D must fail visibly when authority is missing, deploy the exact tested #100 Rules and minimal Functions backend before dependent frontend, use synthetic staging accounts, record rollback, and distinguish Rules/Functions/App Check/website/provider states. Do not solve this with a broad current-main production deploy: current Rules still contain the #100 admin catch-all and current Functions logging still has #111 privacy work.
daliu commentedon Jul 13, 2026
Coordination-only child completion sync — 2026-07-13T07:00Z
Agent:
/root/membership-access. This is not a claim on the tracker.mainatbb9ae29da49e3e439776440ca80153f9389a792band CI-001A — Repair the deterministic frontend test baseline #103 is closed.6a548c0111edfc0008307115reachedready.FIREBASE_SERVICE_ACCOUNTwas empty, but the fallback step first rannpm install -g firebase-tools@latest; that install failed withECONNRESETbefore the no-authority check.firebase deploywas never invoked.CI-001B should make the frontend Jest suite a required hosted check and evaluate/validate deployment authority before any mutable network install, so missing authority fails visibly and deterministically. No CI-001B child is claimed by this comment.
SEC-001: replace recursive Firestore admin access (#123)
35 remaining items
daliu commentedon Jul 22, 2026
SUPPLY-001D8 (#453) completed by PR #454 at merge commit 8a5b0cc. The vulnerable Babel SystemJS transform path is pinned to 7.29.7; root production audit moved from 3 high/1 low to 2 high/1 low. PR CI run 29922843376 and exact-main CI run 29923048129 both passed all five jobs. No deployment workflow or GitHub Deployment exists for this commit; this is source/CI evidence only. Parent #105 remains open for the remaining dependency slices.
daliu commentedon Jul 22, 2026
Claimed atomic P0 supply-chain child #455 (SUPPLY-001D9) at exact base 8a5b0cc. Scope is the committed Firebase CLI 15.24.0 graph plus Java 21 emulator compatibility and exact CI/release/static-test evidence. No IAM, deployment, provider, or production access is in scope.
daliu commentedon Jul 22, 2026
P0 child #455 is complete through PR #456 at exact main
491cc22d80de1faae1960bd63c80ce62e648397b.The committed Firebase CLI is now exact 15.24.0, both hosted emulator gates use Java 21, and their complete parsed jobs are read-only, credential-free, demo-project-bound, lifecycle-disabled, and fail closed against skipped/ignored/extra/floating execution paths. The two critical full-root audit groups under the old CLI are gone.
Exact PR CI
29926297611and exact-main CI29926592423passed all five jobs and every declared step. No release workflow or GitHub Deployment exists for the merge commit. The Netlify artifact was PR preview-only; no production website, Firebase, provider, production-data, or live-behavior change was performed or verified.This closes only the #455 source/toolchain slice. #105 remains open for its other CI, protected-authority, deployment, and production-evidence outcomes.
daliu commentedon Aug 1, 2026
SUPPLY-001D12 / #524 is complete and released at exact main
2196db8d56e46023ce09b0824507a3670554c3ee. PR CI30711989000and exact-main CI30712092177passed all five jobs; exact-main deployments are[]. The sole Functions dev-onlybrace-expansionnode is now1.1.18with lock-topology and bounded public-consumer regression coverage. The three D12 path/hunk claims are released. Residual dependency findings remain separate; no website, Firebase, provider, data, or live action occurred.daliu commentedon Aug 1, 2026
Atomic P0 child #555 / CI-001B5 is assigned and CLAIMED by
/rootat2026-08-01T20:44:03Zoncodex/issue-555-functions-ci-least-privilege, exact base35ce7beac81386ad63060c42bb213d0b64ea34af.It owns only explicit read-only permissions and credential-free checkout for the Functions CI job, a separately named parsed-workflow guard, and the matching root-runbook current-truth hunk. Live repository defaults are already read-only, so this is settings-drift defense-in-depth, not a current-write exposure claim. #133, repository settings, release/deploy workflows, Firebase/provider/data/live state, and active #553/#554 paths remain excluded.
daliu commentedon Aug 1, 2026
CHILD COMPLETE / CLAIM RELEASED: CI-001B5 #555 merged through PR #558 as exact
main6e60124a7a86e014d9e0658be3409d1948f7a4c8.The Functions CI job now declares exact
contents: readauthority and uses credential-free checkout. Exact-head CI30718228542and exact-main CI30718340016each passed all five jobs. Independent security/test/documentation reviews are GO. Exact merged child patch SHA-256:149db8c04c2ae3ffe0d0a3688365eaf2e62cfde08b2492ea3590e5b6eac12f6c.GitHub deployments for the merge SHA are
[]; no production website/runmprc.com publication, Firebase deployment, outside-provider configuration, production-data mutation, or live verification is claimed. Child paths and claim are released. Parent #105 remains open for its other source and external-configuration outcomes.daliu commentedon Aug 1, 2026
SUPPLY-001D15 child #573 is COMPLETE/CLOSED/CLAIM RELEASED at exact main
8f238e57574b2913f0563727ce8dedfb6a6f1876. PR #574 preserved the reviewed tree and exact three-file patch; PR CI30721874627and exact-main CI30721997726passed all five jobs. The Functions full and production audits each changed from 9 to 8 moderate findings with noprotobufjsresult. GitHub deployments are empty, the exact Netlify main attempt failed unpublished, Firebase was not deployed, and the public #473 marker is unchanged. Durable completion: #573 (comment)The remaining eight moderate Firebase Admin/Google SDK/
uuidfindings remain open and are not accepted as safe.daliu commentedon Aug 2, 2026
WEB-PRIVACY-001AA / #582 is COMPLETE, CLOSED, and CLAIM RELEASED.
PR #583 merged as exact main
4b2e144deaaa79439a5f47dd50028405ad018eb5; exact-main CI30724502070passed all five jobs. The executable Netlify release wrapper now uses an unbound catch and fixednetlify_release_build_failed, with hostile message/getter/Proxy tests. Inherited child/Git diagnostics remain a named residual.GitHub deployments are empty. Netlify attempt
6a6e893c95ceae0008a012bafailed unpublished; the public host and marker remain the earlier bounded #473 release. Firebase, provider configuration, production data, and live behavior were not changed or verified.Released paths:
scripts/netlify-release-build.js, the named #582 block/helpers intests/test-artifact-safety.test.js, the named runbook paragraph, and the named officer-guide procedure.daliu commentedon Aug 2, 2026
WEB-PRIVACY-001AB / #596 is COMPLETE, CLOSED, and CLAIM RELEASED.
PR #597 merged as exact main d462ff6 with the exact reviewed tree and patch. PR CI 30731525676 and exact-main CI 30731648519 passed all five jobs.
The temporary Netlify release builder now discards generic helper input/output and retains only required Git commit/tree values internally. Exit failure, signal termination, Git-read failure, and invalid captured identity expose only the fixed parent failure code. The initial backup-officer diagram STOP was corrected and re-reviewed GO before merge.
GitHub deployments are empty. Netlify exact-main attempt 6a6ec1367bc81e0008784c82 failed unpublished, and the public #473 marker remains live. Firebase, provider configuration, production data, and live behavior were not changed or verified.
Released paths: scripts/netlify-release-build.js, the named #596 helpers/test block in tests/test-artifact-safety.test.js, the named runbook paragraph, and the named officer-guide procedure hunk. Parent #105 remains open for its separate owner/external configuration and protected-release outcomes.
daliu commentedon Aug 26, 2026
CI-001C staging child #667 is now claimed. It will configure and prove keyless protected staging authentication only; no backend deploy or production change is in scope.
daliu commentedon Aug 26, 2026
Pipeline progress: CI-001C1 #667 completed through PR #668, merge
ee16bd16220ab58bd3a2add80dd2f39a1d514dd7, post-merge CI run33006701237, protected staging identity run33006732455, and wrong-ref rejection run33006901957.This closes only the staging read-only keyless identity proof. #133 still owns Firebase deployment roles and production protection; #136 still owns an actual backend release. Branch-required checks, scanning, backend/provider staging, protected live publication, and production proof remain open.
daliu commentedon Aug 26, 2026
CI-001D1 child #669 is complete through merged PR #670 (
044fc9b624334d7e560d9ee6d9d4a70fb5fe0411). The first empty staging Firestore Rules/index boundary is verified: 418/418 emulator checks, exact provider definitions, every index READY, three fixed anonymous denials, zero root collections, and green PR/post-merge CI.The overall CI-001 tracker remains open. Auth, Functions, App Check, provider isolation, reusable keyless Firebase deployment, branch/production protection, synthetic signed-in E2E, rollback, and production verification are not completed by this child. Full evidence: #669.
daliu commentedon Aug 26, 2026
Backend staging progress continues in #671: email/password-only Firebase Auth source, exact-main deployment, synthetic create/sign-in/delete proof, and final zero-user verification. Functions and App Check remain separate open work.
daliu commentedon Aug 26, 2026
CI-001D3 child #674 is merged and closed through PR #675 at 4b8ed83. PR and post-merge CI passed all five required jobs. This adds only the fail-closed staging two-Function command contract; it performs no deployment.
Current provider truth remains billing disabled, zero visible/open billing accounts, zero relevant Function service APIs enabled, and no hosted Function/App Check backend. #105 remains open for deploy authority, approved billing/spending controls, staged provider proof, protected backend-first release, rollback, and production evidence.
daliu commentedon Oct 11, 2026
Scoped staging authority child complete
#699 completed via PR #700, merge ce7102b, with six green PR/main jobs and protected no-op run 38173389908 approved by daliu. A separate staging-only keyless principal/custom 26-permission role/trust is active; zero user-managed keys, no runtime/build actAs or direct account/data/secret privileges, no production project binding. Original #667 read-only authority/Jeff permissions unchanged. Administrator bypass restored at owner request; the proof used normal named approval, not bypass.
This completes only the narrow engineering authority child. #133 remains OPEN for runtime/build separation, the actual fixed-target staging deployment path, full negative/revocation/recovery proof and production authorization. #113/#136 and broader core operation remain OPEN. No Firebase runtime, Rules, website, payment, member data, API enablement or paid upgrade occurred.
Officer impact: An engineering identity check is verified, not a usable member backend.
Officer documentation: PR #700 access/publish/entry/runbook/security/status guides and conditional acceptance record.
Deployment evidence: GitHub/staging IAM and protected read-only verification; no application deployment.