Repository navigation
CI-001D — Prove backend-first staging and deploy the profile repair #136
Description
Outcome
Use the protected release gate and short-lived deployment identity to prove the #118 profile-recovery backend in isolated staging, then deploy the exact compatible backend to the approved target Firebase project before publishing the website.
This is the actual release/evidence ticket. #135 is closed and the #118 source is merged. It is not ready to claim until #113 and #133 close and a protected Netlify production-release child under WEB-001 closes.
Officer impact: The reported profile permission failure is repaired without an officer editing a member record, deleting an account, or granting a role.
Officer documentation: Verify/update docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/EMERGENCY_AND_RECOVERY.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/SYSTEM_MAPS.md, OPERATIONS_RUNBOOK.md, and the private continuity record.
Deployment evidence: None at creation. Closure requires separate exact evidence for staging, target Rules, each target Function, website publication, runmprc.com, App Check policy, rollback, and synthetic live behavior.
Dependencies
- SEC-001 — Replace the Firestore admin catch-all with resource-specific rules #100: exact reviewed resource-specific Firestore Rules source.
- AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 / merged PR AUTH-PROFILE-001: recover missing member profiles safely #132 at
13ccc1b67dd57f69091e808b12e1287a1bc05b2f: exact create-once trigger/callable and fail-closed website source. - BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113: privately approved staging/target Firebase estate and data disposition.
- CI-001C — Configure protected short-lived Firebase deployment identity #133: protected short-lived Firebase deployment identity.
- CI-001B2 — Make releases protected, backend-first, and fail-closed #135: closed; fail-closed backend-first release workflow and owner-approved release model merged at
9eafab1217aff7058c42240aaba72d7b93f8ed24. - WEB-001 protected-release child: exact-commit Netlify production publication, deployed-commit proof, and rollback without reintroducing the Pages CNAME conflict.
- CI-001 — Establish trustworthy quality gates and protected deployment #105: parent delivery tracker and final evidence ledger.
Do not use a broad all-Functions deployment. This release is limited to the exact #100 Rules plus createMemberOnSignUp and ensureMemberProfile, followed by the dependent website. Other Functions remain outside this ticket.
Required release sequence
- Record the exact approved source commit and required green checks.
- Confirm the staging project contains no real member/customer data and all provider calls are isolated.
- Record the configured staging App Check policy.
- Deploy the exact SEC-001 — Replace the Firestore admin catch-all with resource-specific rules #100 Rules plus both revised Functions to staging as one compatible backend set.
- With made-up accounts only, prove:
- one missing profile is created with the exact pending schema;
- retries and concurrent calls preserve it byte-for-byte;
- an existing member/admin profile and custom claims never change;
- anonymous, injected-field, wrong-project, backend-down, missing-profile, Rules-denial, and cross-user paths fail safely;
- missing/invalid App Check is rejected when enforcement is enabled, or the open enforcement gate is recorded when disabled;
- name/phone edits succeed only for the caller and all protected-field/cross-user writes fail.
- Record and rehearse the last-compatible Rules/Functions/website rollback or reviewed safe roll-forward in staging.
- Obtain the named production approval through the protected environment.
- Deploy and verify the same exact Rules plus both revised Functions in the approved target Firebase project.
- If any target backend surface is skipped, partial, mismatched, or unverified, stop. Restore the reviewed backend set or safely roll forward. Do not publish the website.
- Publish the dependent website only after exact target-backend proof.
- Verify the exact website revision on the configured hosts and
runmprc.com. - Run only the approved synthetic live smoke. Never inspect or modify a real member profile.
Acceptance criteria
- Exact commit, CI checks, source review under the owner-approved sole-maintainer override, and named protected approver are recorded.
- Staging uses made-up data and isolated provider/network paths.
- Exact SEC-001 — Replace the Firestore admin catch-all with resource-specific rules #100 Rules plus both revised Functions are deployed and verified in staging before any website.
- Positive, retry/race, claim-preservation, input-injection, permission, unavailable-backend, and policy-matched App Check cases pass.
- Rollback or safe roll-forward is rehearsed and timed in staging.
- Exact target Rules and both target Functions are deployed and individually verified before website publication.
- Partial/skipped backend cannot publish the website or produce a green release.
- Exact website commit is published and
runmprc.comis checked without using a real member. - No secret, provider identifier, private URL, member data, token, or raw Firebase error appears in public evidence.
- AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 and CI-001 — Establish trustworthy quality gates and protected deployment #105 record distinct source, tests, merge, staging, target Firebase, website, provider, and live-behavior states.
Stop conditions
Stop if any dependency is open, target project/approver is uncertain, provider isolation is unproven, the deployment would include all Functions, the backend is partial, or a test needs real member data. Do not repair production data through Firebase Console.
Claim protocol
Creation is not a claim. After every dependency is closed, assign one release agent and post CLAIMED by <canonical agent> at <UTC>; exact commit <sha> before any staging action. Provider-console and production approval remain human-owner actions. Keep all sensitive evidence in the approved private continuity record.
Superseding backend ownership decision — October 11, 2026
Direct human owner instruction: continue without a backup owner. #697 records Dave Liu (daliu) as sole backend release/recovery owner. Backup-appointment/two-owner requirements in this ticket no longer gate backend setup; backup coverage remains absent. Existing staging read-only reviewers gain no broader authority. All other scope, data/policy, protected-release, least-privilege, staging, exact-source and rollback requirements remain unchanged. This amendment does not complete this issue or authorize a skipped/partial release.
Activity
daliu commentedon Jul 13, 2026
DEPENDENCY CORRECTION at 2026-07-13T09:38:16Z: #135 intentionally pauses Git-triggered Netlify production and its GitHub workflow publishes only the Pages branch after Firebase. Therefore #136 cannot satisfy its
runmprc.comacceptance from #133/#135 alone. Its live body now requires a smaller protected Netlify production-release child under WEB-001 before claim/release. This is coordination only; no hosting/provider setting was changed.daliu commentedon Jul 13, 2026
CONFIG-001A #149 is source-complete at 2c62b8d with post-merge CI 29248650885 green, but was not deployed. The current release workflow accepts only profile-recovery; it cannot deploy or verify the #149 checkout/admin/webhook/mail set. Required protected production configuration is also absent. Preserve the fixed profile-recovery scope and create a separately reviewed immutable release plan before any CONFIG-001A Firebase rollout. No provider or live tests were run.
daliu commentedon Jul 13, 2026
CONFIG-001B1/#151 merged as 7c7a41c with exact post-merge CI 29250935019 green. No staging environment/runtime control/provider state or live Function/Rules behavior was verified. #136 remains the staging/authority prerequisite for a future CONFIG-001B release plan and synthetic disable/restore drill.
daliu commentedon Jul 13, 2026
Backend-first release evidence at 2026-07-13T13:08:36Z: run 29252492614 targeted exact merged commit 23bca8c after successful CI 29252377313. It failed closed before artifact build because the protected production environment lacks the public App Check site key.
Accordingly, fixed Firebase backend deployment/readback, website publication, runmprc.com verification, and synthetic staged behavior were all skipped. #136 remains open; source-only #118/#153 behavior must remain marked NOT LIVE.
daliu commentedon Jul 13, 2026
Read-only App Check release audit — updated 2026-07-13
Protected release 29254280177 targeted exact main
594306fb06d9a6a2a44b5675b305f462f11b877d. Its exact-main and exact-CI preflight passed. It then failed closed at the first website configuration check becauseREACT_APP_RECAPTCHA_SITE_KEYresolved empty.No checkout, website build, artifact upload, Firebase deployment, or Pages publication ran in that release. This is source/CI evidence only; no website, Firebase, provider, or production behavior changed.
A redacted repository-settings audit found no repository Actions variables or secrets and only the existing
github-pagesenvironment. The workflow job that prepares the website is not currently bound to a protected staging/production environment, so under the current source the public App Check key must come from a repository or organization Actions variable. Do not add a placeholder or bypass the guard.At the audited release commit, the client instantiated reCAPTCHA v3 while the authoritative security design required Enterprise. Source-only child #159 corrected that mismatch and merged through PR #160 as exact main
317b800cd39af136828de0d4eb23fbef66c2b390; post-merge CI29259342966passed. Netlify production attempt6a54fa22230b8000085802ecfor that exact merge ended in error with no published timestamp, andrunmprc.comremains on older verified commite86a0f702cff6495f50630c5de3337290db8b8cb. No protected release, Firebase deploy, GitHub Pages run, provider configuration, callable enforcement, or live attestation occurred.Safe remaining sequence:
This comment contains no key value, secret, private locator, or production data.
2 remaining items
daliu commentedon Jul 13, 2026
Protected release evidence (2026-07-13T18:54Z): production run 29276269838 targeted exact current main acaa961 and accepted exact green CI 29276143519. It failed closed before build because the protected public REACT_APP_RECAPTCHA_SITE_KEY variable is absent; Firebase and Pages were skipped. No secret value was requested or exposed. This remains the owner/provider configuration blocker; #173 itself was unused source and is complete without a live-deployment claim.
daliu commentedon Jul 13, 2026
COORDINATION — #178 is validly claimed at 2026-07-13T20:29:16Z and temporarily pauses My Account phone collection in source/Rules while preserving existing records. Before any future #136 staged profile proof, refresh from the #178 release and update the staged profile-edit expectation from name/phone to name-only plus non-empty phone-write denial. #178 does not deploy Firebase, publish the website, configure App Check, or change provider state.
daliu commentedon Jul 13, 2026
Coordination release — #178 merged as
6017493f3366790eefba5d00baf3df7211dfc380; post-merge CI passed and its ten-path claim is released. Preserve its phone-free My Account projection and name-only owner-update Rules boundary when #136 proceeds. The #178 change is not live Firebase or website proof; deployment/readback and production verification remain pending under the protected release work.daliu commentedon Jul 13, 2026
UNCLAIMED FAIL-CLOSED PROBE — 2026-07-13T23:30:08Z
At the owner's explicit deploy request, protected production run 29293185980 targeted exact current main
aafd15c04fbcd09341092a78f23d513b09cca5d2withrelease_plan=profile-recovery. Current-main and exact successful push-CI validation passed. The next job failed before checkout/build because the required public App Check site key variable was absent; Firebase deployment and Pages publication were skipped.No #136 claim is made. The issue remains dependency-blocked exactly as written (#113, #133, staging evidence, and protected website release). No website, Firebase, provider, member-data, or live-behavior change occurred. This probe must not be counted as staging, target deployment, or production verification.
daliu commentedon Aug 14, 2026
PRE-CLAIM disjointness notice for #657, WEB-UX-004 — Move focus to main content after SPA path navigation.
Exact proposed base is main
3265a55cb92df1ebb5401f2647ff81e4ca3af0b8, tree322468cc75a57f7ea392eb9f57a201fb11c4b35a. Proposed ownership is exactly four paths:src/components/ScrollToTop.jsxonly a pathname-bound, cancelable, one-shot main-focus settlement while preserving its scroll effect;src/App.jsxonly the existing main landmark's stable target relationship andtabIndex={-1}; existingsrc/App.test.jsxonly one separately named WEB-UX-004 generated focus/race matrix and real-shell proof; anddocs/officers/PUBLISH_AND_CHECK.mdonly one separately named no-terminal route-focus verification procedure adjacent to the historical #291 keyboard procedure.There is no new test file, lint-baseline change, CSS change, root-document change, Navbar/Footer/route-page change, backend/service/Rules/Functions/index/package/workflow change, provider/account/sign-in/data action, deployment/publication action, or live claim. Released #291 visible-focus/skip-link behavior and #490 mobile disclosure/close behavior remain immutable. #504 stays the disconnected directory coordinator, #507 retains every future connection/release gate, and availability stays byte-for-byte literal false. #616 retains both Strava Function paths and its separate OAUTH/RISK-024 SECURITY hunk. #133/#136/#460 retain their separate future publication procedures; this new guide hunk is separately named.
Issue creation is not a claim. No source or documentation edit has been made. Send STOP only for an exact path/hunk collision or dependency; otherwise no reply is required. The exact issue/claim/open-PR state will be reread immediately before editing.
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination for #659 / WEB-002D. This issue uses the existing reviewed one-shot Netlify manifest/build control to publish one exact frozen web artifact, with rollback and immediate repause. It does not generalize reusable hosting, alter
.github/workflows/deploy.yml, Firebase deployment, GitHub Pages authority, DNS, secrets, provider configuration, or close #460/#133/#136. Those issues retain their automation/ownership outcomes. Send STOP for an exact release-control collision.daliu commentedon Aug 26, 2026
No-billing staging data-boundary child #669 is claimed on
codex/issue-669-staging-firestore. It provisions only empty Firestore Native Standard inus-west2with delete protection, then deploys exact-main Rules/indexes and negative-probes anonymous server-only access. Functions, Auth providers, billing, production data, and production remain out of scope.daliu commentedon Aug 26, 2026
CI-001D1 child #669 is complete through merged PR #670 (
044fc9b624334d7e560d9ee6d9d4a70fb5fe0411).run-mprc-stagingnow has an empty delete-protected Native/Standard Firestore database inus-west2, exact active Rules, matching indexes, fixed anonymous denials, and zero root collections. PR and post-merge CI both passed all five jobs; direct staging/eventsstill renders its empty state and Hosting remains unchanged.This closes only the staging data-boundary dependency. Auth test configuration, Functions, App Check, outside-provider sandboxes, reusable keyless Firebase deploy authority, synthetic signed-in E2E, release marker, rollback proof, and production remain open. Full evidence: #669.
daliu commentedon Aug 26, 2026
Child #671 is now claimed for the isolated staging Auth slice. It will merge an exact email/password-only source contract before provider mutation, keep billing disabled, use disposable synthetic proof, and leave the Functions/App Check/production portions of this parent open.
daliu commentedon Aug 26, 2026
CI-001D3 child #674 is complete. PR #675 merged as 4b8ed83; PR CI 33015854644 and post-merge exact-main CI 33016096438 passed all five required jobs. The new source wrapper can invoke only createMemberOnSignUp and ensureMemberProfile together in run-mprc-staging and rejects broad/partial targets, extra arguments/services, production context, wrong account/quota/project, credential files, changed exports/scripts, and an unpinned CLI.
This is not provider deployment evidence. Final readback remains billing false, zero visible/open billing accounts, and zero relevant Function service APIs enabled. Functions and App Check remain absent; no synthetic profile flow ran; production and runmprc.com are unchanged. #136 remains open for approved billing/spending controls, exact paired Function deployment/readback, App Check policy, disposable staging E2E, rollback proof, deployment authority, and production release prerequisites.
daliu commentedon Aug 27, 2026
Staging progress and exact remaining blocker — 2026-08-26
No-billing child #676 is complete. PR #679 merged as
667a4dc7bb4672bf63165f67ab0149e18692da5f; consistency follow-up PR #680 merged as finalmain1f27b0619c494cd3fc5e4c75dff521cffc584aae; all five jobs passed in exact-main CI run https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/33037066118. Fresh provider assertions prove one restricted App Check registration, Authentication and FirestoreENFORCEDwith replay protectionOFF, Hosting version8556fc51210bdc66, zero staging users/root collections, billing unlinked/disabled, and no Function deployment API or Function.The exact Function source was then verified without cloud credentials or provider access. Node 20 plus Java 21 Auth/Firestore emulator execution passed 70 suites and 7,570 tests, including the real Firestore parallel-create/preserve test. A separate browser pass with Auth, Firestore, and Functions all on loopback proved synthetic account creation, profile creation, the exact pending/unverified and phone-empty boundary, absence of protected membership fields, name-only edit, sign-out, fresh sign-in, and persisted profile state. The only root collection was
members. The browser signed out; all emulator/dev processes stopped; all five local ports are closed; emulator state was discarded.Hosted staging still fails closed at the account profile because
createMemberOnSignUpandensureMemberProfileare intentionally not deployed. Google Cloud reports project billingFalse, no linked billing account, and zero billing accounts visible torunmprc@gmail.com. Firebase requires Blaze for Function deployment. No billing/API/Function/IAM/provider/production mutation was attempted.#136 remains unclaimed and open: #113 and #133 are still owner-blocked, and an explicit spending authorization plus a billing account/payment method and budget-alert policy are absent. Do not attach billing or deploy the pair merely to make the profile test pass.
Officer impact: Staging Auth/Firestore/App Check are verified, and the paired profile Functions work locally, but the hosted profile remains safely unavailable. Officers do not attach billing, deploy Functions, run commands, or use a real account.
Officer documentation: Current staging state is recorded in
OFFICER_START_HERE.md,docs/officers/README.md,docs/officers/PUBLISH_AND_CHECK.md, anddocs/officers/SYSTEM_MAPS.md; PR #680 reconciles the historical #671 wording with the current #676 state.Deployment evidence: Website — staging root/Events remain 200 at Hosting version
8556fc51210bdc66;runmprc.comremains 200 from Netlify. Firebase — Auth/Firestore App Check enforcement and cleanup passed; hosted Functions remain absent. Local — synthetic paired-Function profile lifecycle passed with credential-isolated emulators. Provider/production — no outside provider or production mutation occurred.daliu commentedon Sep 7, 2026
Account setup checkpoint — 2026-09-07
The owner confirmed Firebase and signed into the club Google account. The correct native Chrome profile is authenticated. Required Google two-step verification was enabled using the account existing factors; Google confirmed activation, and Cloud Console access was verified afterward.
Cloud signup reached payment verification, but billing activation was not submitted: the offered payments profile needs owner confirmation for nonprofit use. No payment details or private account identifiers are included here. Final explicit-club-account readback shows zero visible/open Cloud Billing accounts and staging billing disabled/unlinked. The already-approved staging budget remains a pending alert configuration, not a deployed hard spending cap.
Officer impact: Google sign-in and the required security gate are resolved. Hosted profile Functions are still unavailable; this is not backend completion.
Officer documentation: The dated private conversation/continuity checkpoint records the account-security change and secure owner handoff. No public officer procedure changed because no new backend or officer workflow became available; existing access-continuity and release procedures still apply.
Deployment evidence: Google provider — two-step activation and Cloud access verified directly. Firebase — fresh billing readback disabled/unlinked; no deployment attempted. Website and runmprc.com — not redeployed or reverified in this checkpoint. Source — no code change or merge. No production data action.
This is progress only, not a claim or closure of #136. Existing release dependencies remain open. The next necessary owner input is confirmation of the billing profile authority or a club-approved payment profile supplied directly in Google, never in chat or an issue.
daliu commentedon Sep 15, 2026
Deployment preflight — 2026-09-14 Pacific
The owner requested deployment after PR #684 merged. Inspected exact current main 925a677 and its successful five-job CI run 34925782625. The requested first target is isolated staging only; no production release or broad all-Functions action was attempted.
Fresh read-only checks under the club account:
Stopped before provider mutation or workflow dispatch, per the release dependencies. The owner-authorized PR merge exception is not a bypass of cloud billing, IAM, environment or deployment gates. Next owner action is completion of the intended private billing account/card setup in Google's secure form; do not copy payment information into an issue or an AI tool. Reviewed staging authority, runtime and security readiness still need completion before the exact pair is deployed.
Officer impact: No public page, account, member record or officer procedure changed.
Officer documentation: None — preflight only; existing LOW_COST_COMMUNITY and release procedures already require these stop conditions.
Deployment evidence: Source merged and exact-main CI passed. No website publication, Firebase deployment, outside-provider configuration, payment, production-data operation or real-account test was performed. runmprc.com and hosted Function behavior were not reverified. #136 remains open.
Runtime source: https://docs.cloud.google.com/functions/docs/runtime-support
daliu commentedon Oct 11, 2026
COST-002 #693 is complete: staging is linked to the verified club Free Trial, with one monthly USD10 gross-usage alerts-only budget (50/90/100%, credits excluded, default recipients). Provider readback and Console agree; production billing remains unlinked, only the Budget API was enabled, runtime APIs remain disabled, and no paid upgrade/deployment/data/payment operation occurred. Officer handoff PR #694 merged as 50dd574 after all six exact-head CI jobs passed. Post-merge main CI 38163898310 is running, not yet claimed passed. This removes the staging billing-access prerequisite only: #113/#133 remain open and the keyless identity remains read-only. Before a later profile release, ensureMemberProfile also needs native runtime App Check enforcement; its current shared helper can return early when the environment flag is absent. No broad all-Functions deployment is authorized by this update.
daliu commentedon Oct 11, 2026
ABUSE-001A2A source prerequisite completed through PR #696, merge 81ea6d9. ensureMemberProfile now has unconditional native App Check enforcement; only its runtime options changed, preserving signup, paired limits, schema/claims and callback deferrals. Local Node22 focused45, full7594/64 integration skips, lint and 37 staging/release guard tests passed. Exact PR CI38164814554 passed all six jobs; logs confirm the new SDK request-wrapper tests executed on Node20 and Node22, with Node22 Auth/Firestore profile persistence7595/63 separate commerce skips. Token verifiers/stores are synthetic, so real token cryptography, local browser flow and hosted missing/invalid/valid proof remain unverified. Officer cost/attestation procedure and engineering status are in the merged source. No provider/API/billing/IAM/deployment/member-data/payment operation occurred. Post-merge exact-main CI38165095591 passed all six jobs; named test/build/verification steps executed, and the merged tree matches the tested PR tree. Estate #113 is restored OPEN after correction of the prior PR closing-keyword tracking error; #133 and #136 remain OPEN. No broad Functions deployment or release exception is implied.