Repository navigation
CI-001C3 — Scoped staging profile deployment identity and no-op proof #699
Description
Outcome
Establish a separate keyless staging profile deployment identity and prove exact-main authority with a protected read-only check. Apply Dave's October 11 approval to allow administrator bypass again while retaining named approval and main-only policy. This is a narrow child of #133, not the general release or production estate cutover.
Approved scope / dependencies
- CI-001C2 — Apply owner-approved single-owner backend release governance #697 completed sole-owner authority; Dave explicitly approved releases and this focused identity/testing work.
- Previously verified run-mprc-staging synthetic isolation is sufficient for this IAM-only child; BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113 remains open for production/legacy disposition.
- Preserve the existing CI-001C1 — Configure protected staging-only keyless Firebase authority #667 staging project-read-only identity and Jeff's authority unchanged.
- Create a separate backend-staging GitHub environment, one dedicated deploy principal, one exact GitHub OIDC provider, and reviewed staging-only deployment permissions. No downloaded keys.
- Bind exact immutable repository/owner IDs, main ref, workflow, environment and manual event. Protected source must reject stale/non-main source and mismatched/missing authority before authentication.
- Authorize only the reviewed staging project. No production IAM, Functions, Rules, Auth data, payment/provider or website change. Runtime/build identities and first hosted profile release remain a separate reviewed step.
- The workflow is a no-op project metadata/permission check only; no deployment inputs or writes. Additional deployment capability requires separate reviewed source.
- Permissions must match two first-generation profile Functions and Rules, not Owner/Editor, Firebase Admin, Secret Manager, real account/data or billing administration. Document permission reasons and bounds.
Acceptance
- Minimum permissions/source contract reviewed with pinned CLI and current official IAM documentation.
- Native GitHub/cloud readback confirms separate staging-only identity/trust and zero user-managed keys.
- Production bypass restored per owner; required reviewer/main policy and existing staging unchanged.
- Wrong repo/owner/ref/workflow/event/environment/project/authority and stale source tests fail closed before authentication.
- Protected exact-main no-op proves short-lived credentials with fixed redacted output and no data or runtime writes.
- Runtime/deploy/build separation and revocation recorded; remaining BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113/CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136 gates not falsely closed.
- Focused/backend tests and relevant CI pass; officer procedure updated with current availability and limitations.
Officer impact: Dave may approve one focused staging authority check; no officer handles credentials or production records.
Officer documentation: ACCESS_CONTINUITY.md, PUBLISH_AND_CHECK.md, OPERATIONS_RUNBOOK.md and entry/status documents.
Deployment evidence: None at creation. Provider IAM/approval proof must be reported separately from backend deployment.
Invariant: this manual workflow performs reads only against engineering staging; no trusted principal or reviewer from #667 is broadened, and no production record or payment is touched. Failure leaves no backend or website released. No schema migration.
Private no-secret evidence: bounded task-owned .codex/artifacts staging-authority handoff and provider configuration; never public locator/policy/token dumps.
Activity
daliu commentedon Oct 11, 2026
CLAIMED by Codex at 2026-10-11 UTC; branch codex/699-staging-profile-authority. Existing managed worktree reused. Allowed changes: scoped staging authority workflow/guards/tests and officer/runbook status; staging IAM and GitHub approval metadata only. Production runtime/data, payments and existing read-only staging identity excluded.
daliu commentedon Oct 11, 2026
Source merged; protected proof pending
PR #700 head 148108a merged as ce7102b; exact merge tree equals the reviewed PR tree. All six exact-head PR CI jobs passed in 38172961799, with no skipped steps. Local full workflow-safety command: 146 passed/0 skipped; profile-focused suites: 45 passed. Initial exact-command safety failure was corrected with a narrowly updated expected parser/test list and two omission regressions; no guard bypass.
Provider configuration readback confirms the dedicated staging principal/custom role (26 reviewed permissions), exact trust/fingerprint and zero user-managed keys. Existing #667 account policy and staging environment remained unchanged. New pool remains disabled while exact-main CI is pending. Runtime/build actAs and direct Auth/Firestore data/secret permissions are absent. Fresh count-only staging Auth is 0; root-collection metadata is empty; Functions/Cloud Build/Artifact Registry APIs remain DISABLED. No user/document read or backend deployment.
Production retains daliu/main/self-approval, with administrator bypass restored per direct owner approval. backend-staging separately uses daliu/main and allows administrator bypass. Normal approval versus override will be recorded accurately.
Officer impact: The focused staging authority check is prepared; no member/payment operation is available.
Officer documentation: updated entry, access/publish, runbook/security/status documents in PR #700; private no-secret runtime/build/revocation handoff retained.
Deployment evidence: Source merged and staging IAM/GitHub configuration read back. Exact-main CI, activation and actual protected no-op proof remain to verify; no Firebase/website/data/payment release. #699 remains OPEN for proof; #113/#133/#136 remain OPEN.
daliu commentedon Oct 11, 2026
Verified completion — October 11
The separate staging profile identity and protected no-op are verified. PR #700 head 148108a merged as ce7102b; exact merge tree matches reviewed PR tree. All six jobs and steps passed in final PR run 38172961799 and exact-main run 38173141201, with no skipped steps. Full local workflow-safety command: 146/146, no failures/skips; profile-focused backend suites: 45/45 (synthetic/unit, not hosted profiles). The initial exact-command guard failure was corrected with a targeted allowlist update plus omission regressions, not a skipped check.
Protected manual run 38173389908 used exact main ce7102b, required backend-staging approval, and records approval by daliu under the owner's explicit focused release authorization. Administrator bypass was available but not used. Every job step passed. Actual Google federation issued the requested five-minute credential with no credential-file configuration. Both fixed context/cloud success markers were verified. All 26 required project permissions were returned; all ten prohibited data/admin/delete/impersonation permissions were absent. No account, document, Function execution, payment or deployment was part of the check. Run-log review found no raw provider path, project-number fragment or deploy-account address.
Final native readback: dedicated pool ACTIVE/enabled, one exact provider/fingerprint/trust, exact 26-permission custom project role, zero user-managed keys, one workloadIdentityUser binding, one scoped staging project role, zero production project bindings for this new principal, and no runtime/build actAs grant. Existing #667 read-only account policy and staging environment were preserved. Production and backend-staging retain daliu/main/self-approval with administrator bypass true per owner instruction. Staging Auth remains count-only 0/root collections empty at the last metadata checkpoint; runtime APIs remain disabled. No real account/document was read.
Backup-officer procedure review: an officer can inspect the fixed run/source/environment and success result without terminal, credentials or member records. Identity revocation, explicit runtime/build permission review and later deployment remain specialist/maintainer steps; no substitute owner is implied. Revocation is disabling only this dedicated pool or removing its WIF binding; already-issued tokens can survive until expiry. Private no-secret acceptance/recovery handoff retained.
Officer impact: A focused engineering staging authority check is now usable once the maintainer confirms current source and unchanged permissions. Member/profile operations and payments remain NOT AVAILABLE YET.
Officer documentation: PR #700 updates entry/access/publish/runbook/security/status guides and the matching flow/text alternative; their conditional #699 proof is now recorded here.
Deployment evidence: Source merged, PR/main CI passed, staging IAM/GitHub settings verified and actual protected keyless no-op passed. Firebase runtime/Rules/index/Auth configuration, website/runmprc.com publication, billing/paid upgrade, production data and payment change: none in this child.
#113/#133/#136 remain OPEN. Next bounded step is explicit least-privilege runtime/build identities and a fixed staging-only deployment of createMemberOnSignUp plus ensureMemberProfile, followed by actual synthetic hosted behavior and recovery proof. Project-level creation permission is not a per-Function-name IAM boundary; the current read-only workflow does not deploy any Function. Full backend/member/commerce delivery remains incomplete.