Skip to content

CI-001D1 — Provision empty staging Firestore and deploy exact Rules/indexes #669

Closed
#670
Closed
CI-001D1 — Provision empty staging Firestore and deploy exact Rules/indexes#669
#670
Assignees
daliu
Labels
area:firebaseFirebase services and dataneeds-external-configRequires provider console or external configurationpriority:P0Launch blocker or urgent security risksize:SSmall focused issuetype:operationsOperational setup or runbooktype:securitySecurity or privacy boundary

Description

@daliu
daliu
opened on Aug 26, 2026

Outcome

Provision the empty (default) Cloud Firestore database in the club-owned run-mprc-staging project and deploy only the exact reviewed Firestore Rules and indexes from current main. Prove the hosted browser boundary is fail-closed without creating real or synthetic application records.

This is the no-billing data-boundary child of #136, #133, and #105. It does not deploy Functions, configure sign-in providers, migrate production data, or make the static staging website safe for private use.

Location and safety decision

  • Use Firestore Native, Standard edition, (default), in us-west2, matching the already-existing production default database region.
  • Enable database delete protection.
  • Keep point-in-time recovery disabled because billing is not approved.
  • Never inspect, export, copy, or migrate a production document.

Invariants

  • Every command names run-mprc-staging explicitly; .firebaserc remains the non-deployable demo default.
  • Deploy only firestore:rules,firestore:indexes from one exact current-main commit with the lockfile Firebase CLI.
  • No Function, Hosting, Auth provider, App Check, Storage, outside provider, billing, DNS, Netlify, Pages, or production mutation.
  • Run the complete Rules emulator suite before provider mutation.
  • Prove the database is empty before any optional synthetic test.
  • Anonymous reads and writes to server-only control, secret, financial, audit, and rate-limit paths remain denied.
  • Public logs and issues contain no token, private provider locator, response body, application data, or credential.

Acceptance criteria

  • Firestore API is enabled in staging only.
  • (default) database readback is Native/Standard, us-west2, ACTIVE, delete protection enabled, and PITR disabled.
  • Exact-main Rules and indexes deploy successfully with Firebase CLI 15.24.0.
  • Provider readback records the active Rules release and index state without application data.
  • Emulator Rules suite passes under Node 20 and Java 21.
  • Anonymous hosted negative probes return denial for fixed nonexistent server-only paths and create no document.
  • Database count/readback confirms no application records were created.
  • Engineering and officer docs distinguish database provision, Rules deployment, backend Functions, website publication, and production behavior.

Officer impact: Staging receives a protected empty database boundary. Officers still do not sign in, enter data, run commands, or publish a backend.

Officer documentation: Update OPERATIONS_RUNBOOK.md, OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/README.md.

Deployment evidence: Record exact source commit, emulator tests, database configuration, Rules/index readback, negative probes, and every unchanged surface separately.

Stop conditions

Stop if creation needs billing, a different or ambiguous region, production data, a Firestore mode other than Native Standard, disabled delete protection, a broad Firebase deploy, a Function/Hosting/Auth/provider change, a real user record, or weakened Rules.

Claim protocol

Assign one agent and post CLAIMED by <canonical agent> at <UTC>; branch <branch> before source or provider mutation.

Activity

  1. daliu
    self-assigned this
    on Aug 26, 2026
  2. daliu
    added
    priority:P0Launch blocker or urgent security risk
    type:securitySecurity or privacy boundary
    type:operationsOperational setup or runbook
    area:firebaseFirebase services and data
    size:SSmall focused issue
    needs-external-configRequires provider console or external configuration
    on Aug 26, 2026

  3. daliu commented on Aug 26, 2026

    @daliu
    daliu
    on Aug 26, 2026
    ContributorAuthor

    CLAIMED by Codex at 2026-08-26T19:49:27Z; branch codex/issue-669-staging-firestore

  4. daliu
    closed this as completedin #670on Aug 26, 2026

  5. daliu commented on Aug 26, 2026

    @daliu
    daliu
    on Aug 26, 2026
    ContributorAuthor

    CI-001D1 completed on 2026-08-26.

    Source and merge

    Firebase readback

    • Account used: club-owned runmprc@gmail.com.
    • Project: only run-mprc-staging.
    • Database: (default), Firestore Native, Standard edition, us-west2.
    • Delete protection: enabled.
    • Point-in-time recovery: disabled; billing was not enabled or requested.
    • Create operation completed, and subsequent database GET, Rules, index, and collection-list operations succeeded.
    • Active one-file Rules content exactly matched the reviewed SHA-256 and reported zero compile issues.
    • Composite indexes: 4/4 definitions matched and 4/4 READY.
    • Field overrides: 28/28 definitions matched; all 17 explicit single-field index entries READY.
    • Fixed anonymous reads of nonexistent mail, stripeEvents, and auditEvents documents each returned 403.
    • Final root collection count: 0; no pagination token.

    Test and UI evidence

    • Local Node 20.19.5 / Java 21.0.12 / Firebase CLI 15.24.0 Rules run: 5 suites, 418/418 passed.
    • Firebase Hosting source suite: 7/7 passed.
    • Staging authority source suite: 6/6 passed.
    • PR CI run 33009052983: all five required jobs passed on exact head.
    • Post-merge CI run 33009341323: all five required jobs passed on exact merge.
    • Direct https://run-mprc-staging.web.app/events rendered the normal empty state with no browser error. The only warning was the documented disabled App Check boundary.
    • Staging Hosting remained unchanged at version 3ffadcf2ac8cc760.

    Containment and unchanged surfaces

    • A Firebase CLI diagnostic exposed token-bearing account output; both affected OAuth grants were immediately revoked. Only the club account was used for the provider operation. No token value was copied into source, the PR, or this evidence.
    • No application record, Auth provider/test user, Function, App Check setting, Storage data, provider sandbox, Hosting release, production Firebase surface, Netlify/Pages/DNS setting, production data, or runmprc.com behavior changed.
    • Staging is still signed-out engineering review only. Auth, Functions, App Check, providers, reusable keyless Firebase deployment authority, and synthetic signed-in E2E remain NOT AVAILABLE YET.

    Officer impact: staging has a protected empty database boundary. Officers still do not sign in, enter data, run commands, edit Firebase, or publish a backend.

    Officer documentation: OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/README.md updated in PR #670.

    Deployment evidence: website, Firebase, and unchanged provider surfaces are recorded separately above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:firebaseFirebase services and dataneeds-external-configRequires provider console or external configurationpriority:P0Launch blocker or urgent security risksize:SSmall focused issuetype:operationsOperational setup or runbooktype:securitySecurity or privacy boundary

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions