CI-001B3 — Gate the commerce command journal on the Firestore emulator #167

Officer impact: Pull requests gain one clearly named safety check. Officers still review a green/red result and do not run terminal commands.

Officer documentation: Update OFFICER_START_HERE.md and docs/officers/PUBLISH_AND_CHECK.md so the plain-language checklist names this check and says what a red result means.

Deployment evidence: Closure must prove the job on the pull-request commit and the merged commit. It must separately state website, Firebase, Stripe/provider, and live behavior. This issue changes CI only.

Parent and dependency

Atomic child of #105. PAY-002B2A/#165 merged as 59aa088a50ba2934d830a460c0a865a631a293d6 and supplies the dedicated opt-in emulator suite. No live issue, claim, or pull request represents this gate.

Problem

The command journal transaction has local Firestore emulator proof for concurrency, conflicts, orphan prevention, and retries. Hosted Functions CI intentionally skips that suite because it does not start exact project demo-pay002b2-test or set REQUIRE_COMMERCE_COMMAND_JOURNAL_EMULATOR=1.

A later lease/fencing change could therefore pass hosted unit tests while breaking the real Firestore transaction boundary.

Outcome

Add one named blocking CI job: Commerce command journal emulator.

It must:

1. run on every pull request and push already covered by ci.yml;
2. use Node 20 and Java 17;
3. install only committed root and Functions lockfiles;
4. start only the Firestore emulator with exact demo project demo-pay002b2-test;
5. set the explicit journal-suite opt-in;
6. run only commerceCommandJournal.emulator.test.js in band;
7. make a guard failure or test failure fail the job;
8. use no secret, cloud credential, production project, network provider, Stripe call, or production data.

The protected release workflow must require exactly one successful result for this job both at initial preflight and after protected approval. The release must stop if the job is missing, duplicated, skipped, cancelled, stale, or failed.

Security invariants

• The project ID is a Firebase demo project so non-emulated service access fails.
• The test itself continues to require an explicit loopback host and exact opt-in.
• Use the lockfile Firebase CLI; do not install latest or a global CLI.
• Do not weaken the standard Functions or Rules jobs.
• Do not combine the Rules project with the journal project.
• Do not expose secrets, real command IDs, member data, provider IDs, Checkout URLs, or payment data.
• A green emulator job proves source behavior only. It does not prove Firebase deployment, Stripe configuration, or live behavior.

Exact source boundary

• .github/workflows/ci.yml
• .github/workflows/deploy.yml
• tests/ci-workflow.test.js
• tests/release-workflow.test.js
• SECURITY.md
• OPERATIONS_RUNBOOK.md
• GITHUB_ISSUES.md
• GITHUB_ISSUE_SLICES.md
• OFFICER_START_HERE.md
• docs/officers/PUBLISH_AND_CHECK.md

Post a scope amendment before editing packages/lockfiles, journal runtime/tests, Functions/Rules source, other workflows, environment files, provider settings, or production data.

Acceptance criteria

• PR CI shows one named Commerce command journal emulator job and it passes the exact six-test suite.
• The job uses Node 20, Java 17, committed lockfiles, exact demo project, Firestore only, explicit opt-in, and an in-band focused Jest target.
• Static tests reject a missing/renamed job, wrong project, missing opt-in, broad emulator scope, non-lockfile CLI, or omission from either protected-release recheck.
• Existing Frontend, Functions, and Rules jobs remain green.
• Protected release source requires all four named CI jobs at both checks.
• Post-merge CI proves the new job on the merge commit.
• Officer and engineering docs distinguish local proof, hosted proof, merge, deployment, provider configuration, and live behavior.
• No runtime, package, lockfile, provider, Firebase deployment, Stripe action, website publication, or live behavior is changed or claimed.

Verification

• Parse both workflow YAML files.
• Run the new static workflow tests and the existing release-verification tests.
• Run focused journal unit and dedicated emulator suites locally.
• Run Functions lint/full tests, frontend, SPA, Rules, and diagnostic build.
• Review the exact diff and sensitive patterns.
• Obtain two independent exact-snapshot reviews.

Migration and rollback

No data/schema migration. Rollback is the reviewed workflow/docs commit only, but removing the gate reopens a known concurrency-verification gap and must not be done silently.

Claim protocol

Creation is not a claim. Before editing: confirm exact current main, assign the issue, post CLAIMED by /root at <UTC> with branch codex/issue-167-journal-emulator-ci, apply status:in-progress, and use an isolated worktree.