CI-001C1 — Configure protected staging-only keyless Firebase authority #667

Outcome

Configure a staging-only GitHub Actions OpenID Connect path into the club-owned run-mprc-staging Google Cloud project, using a dedicated service account and no downloaded key. Add one manual protected read-only verification workflow and prove exact repository/environment/ref restrictions before any backend deployment.

This is the dependency-ready staging child of #133 and #105. It configures release identity and its no-op proof only; it does not deploy application code or close #133 production authority.

Invariants

• Trust only the immutable Run-MPRC organization/repository IDs, refs/heads/main, the staging environment, and the reviewed verification workflow.
• Use one provider in one staging pool and one dedicated staging deploy principal.
• Store provider and service-account locators as protected environment secrets; never store or create a JSON key or Firebase token.
• Require the protected staging environment and two named existing individual organization administrators as reviewers.
• Grant no project Owner/Editor role and no runtime identity role to the deploy principal.
• The verification workflow may authenticate and read the exact project identity only. It must not enable APIs, create resources, deploy, write data, inspect data, or call outside providers.
• Missing/wrong environment, project, ref, repository, provider, or service account fails before authentication or mutation.

Acceptance criteria

• staging environment exists with exact-main branch policy and two individual reviewers.
• IAM, STS, and Service Account Credentials APIs needed for WIF are enabled in staging only.
• Dedicated pool/provider uses an exact numeric owner/repository admission condition plus main/staging restrictions.
• Dedicated service account has no key and is impersonable only by the exact admitted staging principal set.
• Protected environment contains the exact Firebase project variable and two locator secrets, with no long-lived credential.
• Source tests prove the verification workflow is manual, read-only, pinned, protected, and fail-closed.
• One protected read-only GitHub run succeeds and records no sensitive provider identifier in public logs.
• Wrong-ref and missing-authority behavior is evidenced without attempting a deployment.
• Revocation and backup-officer steps are documented.

Officer impact: Two named officers can approve a staging identity check without handling a cloud key. This does not yet provide an officer backend publish button.

Officer documentation: Update docs/officers/ACCESS_CONTINUITY.md, docs/officers/PUBLISH_AND_CHECK.md, OPERATIONS_RUNBOOK.md, SECURITY.md, and the #133/#105 status evidence.

Deployment evidence: Record source, tests, merge, environment policy, WIF readback, protected no-op run, and absence of backend/provider/production changes separately.

Stop conditions

Stop if configuration needs billing, a JSON key, a Firebase token, broad Owner/Editor access, production mutation, real data, an unnamed reviewer, or an unbounded repository/ref trust rule.

Claim protocol

Assign one agent and post CLAIMED by <canonical agent> at <UTC>; branch <branch> before source or provider mutation.