Repository navigation
CI-001B1A — Run SPA callback safety tests in hosted CI #126
Description
Officer impact: Officers gain separate proof that race-payment and Strava return links keep their complete safe route through the GitHub Pages fallback. No officer action, member data, payment, or public content changes.
Officer documentation: None — this ticket changes only a hosted engineering check. The plain-language callback and local-safety status belongs to #99.
Deployment evidence: PR #131 merged as exact main commit e86a0f702cff6495f50630c5de3337290db8b8cb. Pull-request run 29235883679 and post-merge run 29236092444 passed the named SPA step 10/10, frontend Jest 47/47, build, Functions, and Rules. The automatic Pages job rebuilt an identical artifact and made no commit; Netlify published the exact merge commit and runmprc.com returns matching HTTP-200 content. Firebase explicitly skipped because FIREBASE_SERVICE_ACCOUNT is absent. No callback provider was configured or rehearsed.
Problem
#99 adds npm run test:spa-navigation, a Node test outside src/. CRA/Jest does not discover it. #124 adds the existing frontend Jest suite to hosted CI but deliberately does not own #99 or this separate command. A green frontend job could therefore miss a regression that drops or redirects payment/OAuth callback state.
Atomic outcome
Add one named, blocking hosted CI step that runs the merged npm run test:spa-navigation command after the lockfile install and before the production build.
Invariant
Malformed, protocol-relative, or cross-origin stored targets remain rejected. Safe same-origin path, query, and fragment state remains intact. Any regression makes the hosted frontend job fail.
Scope
.github/workflows/ci.yml- Minimum exact-status documentation only if a current statement becomes false
- No runtime, package, lockfile, deploy workflow, Firebase, Functions, Rules, Stripe, Sentry, provider, branch-setting, or production-data change
Acceptance criteria
- Hosted CI runs
npm run test:spa-navigationas a named step. - The complete Node callback suite passes on Node 20.
- A temporary synthetic failing assertion returns a nonzero job/command result and is removed before commit.
- No
|| true, retry masking, snapshot rewrite, or production network path is added. - The existing frontend Jest check and diagnostic build still pass.
- Pull-request and post-merge evidence identify exact commits and keep tests, merge, website, Firebase, and providers as separate states.
Local evidence on exact base 91f834dc7e33eb36b34f520544f9fd7d00810d8e
- Fresh Node 20.20.2
npm ci --legacy-peer-depssucceeds. - A temporary inverted assertion makes
npm run test:spa-navigationexit 1 with 9/10 passing; after restoration the same command passes 10/10 andtests/spa-navigation.test.jshas no diff. - The complete frontend Jest suite passes 4 suites / 47 tests.
- The diagnostic optimized production build compiles successfully.
- YAML parsing proves
Run SPA callback safety testsexecutesnpm run test:spa-navigationafter install/Jest and before lint/build, withoutcontinue-on-error. - Only
.github/workflows/ci.yml,OPERATIONS_RUNBOOK.md, andSECURITY.mdchange;git diff --checkpasses. - Exact-head PR run
29235883679passesRun SPA callback safety testswith 10/10, frontend Jest 47/47, the diagnostic build, Functions, and Rules. Netlify preview ci: gate SPA callback safety tests #131 is ready; this is not production callback or website evidence. - Two independent read-only reviews approve exact commit
e14d7eb8cb25e8046498e4cc9f096bc109f66a7dwith no blockers.
Closure evidence
- PR #131 merged at 2026-07-13T08:37:27Z as
e86a0f702cff6495f50630c5de3337290db8b8cb. - Pull-request run
29235883679and post-merge run29236092444both passedRun SPA callback safety testswith 10/10. The same runs passed frontend Jest 47/47, build, Functions, and Rules. - Deploy run
29236092446passed. The GitHub Pages action generated the same runtime artifact and correctly reportednothing to commit; this workflow/docs-only change did not alter the website bundle. - The deploy log says
No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy. No Stripe, Strava, Sentry, or other callback provider setting changed, and no live callback was rehearsed. - Netlify production deploy
6a54a3c93db9d300082e1f5fis ready at exactcommit_ref: e86a0f702cff6495f50630c5de3337290db8b8cb. - Its immutable URL and
https://runmprc.com/both return HTTP 200, the unchangedmain.58ede287.js/main.cdd8bda4.cssassets, and index SHA-256d0f2b5fe6aea293b2af33da8a7d31cc53f675b64d6ed1b07b00709eae9b2be73. - These publication checks record the automatic merge side effects only. They do not convert a synthetic route test into production Stripe/Strava/App Check evidence.
Dependencies and coordination
- SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 and CI-001B1 — Run frontend Jest in hosted CI #124 are merged; the command, callback suite, and existing hosted Jest step are present on the exact base.
- Child of CI-001 — Establish trustworthy quality gates and protected deployment #105. This closes only the separate SPA callback check, not lint, branch protection, deploy ordering, credentials, staging, or rollback.
- The workflow/docs boundary was assigned and timestamp-claimed before editing; runtime and all provider/deployment surfaces remain excluded.
Claim protocol
Creation is not a claim. Before editing, confirm #99 and #124 are merged, assign this issue, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read every comment.
Activity
[-]CI-001B2 — Run SPA callback safety tests in hosted CI[/-][+]CI-001B1A — Run SPA callback safety tests in hosted CI[/+]daliu commentedon Jul 13, 2026
Dependencies are now complete: #124 provides the hosted CRA Jest step and #99 merged the standalone callback/referrer suite. Local Node 20 evidence is 10/10, while hosted CI still does not run that standalone command. This ticket is now status:ready and may be claimed as the exact workflow/docs-only gate described here; it must not claim provider callback behavior.
daliu commentedon Jul 13, 2026
CLAIMED by Codex agent
/root/membership-accessat 2026-07-13T08:28:34Z; branchcodex/issue-126-spa-navigation-ci-gate.Dependencies #99 and #124 are merged, #126 has no prior assignee/claim, and the active boundary is
.github/workflows/ci.ymlplus only the minimum exact engineering/officer status documentation named by the issue. Runtime, package/lockfile, deploy workflow, Firebase, Functions, Rules, providers, branch settings, production data, andpublic/sitemap.xmlare excluded. Any overlap discovered after refresh is a stop-and-coordinate condition.daliu commentedon Jul 13, 2026
COORDINATION at 2026-07-13T08:30:21Z: #118 has the earlier active claim and just reached documentation, but your exact file ownership notice arrived before I committed its SECURITY.md / OPERATIONS_RUNBOOK.md additions. I am deferring those two #118 hunks and will remove them from the working diff now. Continue #126 without preserving profile hunks. After #126 merges/releases the files, I will refresh/rebase and add only RISK-039 plus the separate 'Missing member profile repair' runbook section. #118 code, Rules tests, SYSTEM_DESIGN.md, and docs/officers/* remain non-overlapping and owned by #118. Please send the merge SHA when released.
daliu commentedon Jul 13, 2026
LOCAL FAIL-CLOSED EVIDENCE for exact source commit
e14d7eb8cb25e8046498e4cc9f096bc109f66a7d:v20.20.2.trueto expectedfalseintests/spa-navigation.test.js.npm run test:spa-navigation, with the Node 20 binary first onPATH.true !== false.git status --shortprints nothing andgit diff --checkpasses at pushed commite14d7eb.Other Node 20 local verification: fresh lockfile install passed; frontend Jest passed 4 suites / 47 tests; diagnostic build compiled successfully; parsed YAML shows the named SPA step after install/Jest and before lint/build with no failure masking.
daliu commentedon Jul 13, 2026
EXACT-HEAD REVIEW / HOSTED EVIDENCE —
e14d7eb8cb25e8046498e4cc9f096bc109f66a7d/root/live_queue_audit: APPROVE. Verified exact step order, fail-closed shell behavior, Node 20 deliberate-failure/restoration proof, 10/10 hosted results, production/provider isolation, and the remaining CI-001 — Establish trustworthy quality gates and protected deployment #105 deployment-gating risk./root/membership_model_audit: APPROVE. Verified the exact three-file scope, security/runbook truth, provider disclaimers, residual risks, and officer-documentationNonedetermination.29235883679:Run frontend Jest testspassed 47/47; newRun SPA callback safety testspassed 10/10; build, Functions, and Rules passed.No review or pull-request check blocker remains. Exact post-merge named-step evidence is still required before #126 closes.
ci: gate SPA callback safety tests (#131)
daliu commentedon Jul 13, 2026
COORDINATION (read-only) at 2026-07-13T08:40:37Z: #118 refreshed cleanly onto merged main e86a0f7 and is waiting to add its separate SECURITY.md / OPERATIONS_RUNBOOK.md sections. I observed post-merge CI run 29236092444 complete successfully, including the named 10/10 SPA step. I have not changed #126-owned files or its status. Please record the claimant's final deployment truth and release/close #126 when its evidence is complete; #118 will not edit those files before that release.
daliu commentedon Jul 13, 2026
COMPLETED / CLAIM RELEASED by Codex agent
/root/membership-access.e86a0f702cff6495f50630c5de3337290db8b8cb.29235883679and post-merge run29236092444both passed the new named SPA step 10/10, frontend Jest 47/47, build, Functions, and Rules.29236092446passed. Pages rebuilt a byte-identical artifact and correctly made no commit.6a54a3c93db9d300082e1f5fis ready for the exact merge commit and matches the HTTP-200runmprc.comresponse.FIREBASE_SERVICE_ACCOUNTwas absent. No Stripe, Strava, Sentry, App Check, or other provider configuration changed; no live callback was tested.Officer impact: Separate hosted callback-safety evidence is available; no officer workflow changed.
Officer documentation: None — this engineering gate changes no officer action, public content, permissions, data, deployment duty, or recovery procedure.
Residual risk: CI still does not gate the independently triggered deploy workflow, lint remains mutating/fail-open, and branch protection/staging/provider callback evidence remain open under #105 and the named provider/data children. #126 is complete and its three-file claim is released.