Repository navigation
CI-001C4 — Scoped runtime and hosted two-profile-Function staging proof #701
Description
Parent #136. This is an isolated engineering staging slice, not approval or completion of production estate migration, payments, or public release.
Human authorization October 11: scoped runtime permissions, deploy and test exactly createMemberOnSignUp and ensureMemberProfile in run-mprc-staging, disposable data only; leave production and payments untouched. Dave remains sole approver/recovery owner. Disable administrator bypass for production/backend-staging while retaining self-approval, reviewer and main-only restrictions; historical read-only staging stays unchanged.
Dependencies for this slice: #693 staging trial/alerts, #699 protected scoped deployment identity, #691 Node 22, #683 resource bounds, #695 native App Check, #676 hosted staging isolation. Parent #113/#133/#136 and commerce remain open.
Invariant: two first-generation Node 22 profile Functions only; create-once unverified member profiles; callable native App Check + Auth; no existing-role/claim overwrite, emails, payments, production data, broad runtime Owner/Editor or default account workaround. Runtime can only get/create staged profiles and read Auth users; build can only read source, write build images/logs. Deployer actAs only on these exact staging accounts.
Acceptance: reviewed profile-only bundle from exact current main with all six CI jobs; protected manual keyless release; actual IAM/resource/provenance readback; hosted synthetic signup, recovery, retries/concurrency and negative App Check/Auth/input checks; dispose only owned synthetic records; dated officer procedure and recovery plan; report any pending hosted proof accurately.
Officer impact: no production/member payment change; safer staged profile readiness and ordinary approval rather than administrator bypass.
Officer documentation: docs/officers/LOW_COST_COMMUNITY.md, ACCESS_CONTINUITY.md, SYSTEM_MAPS.md and publishing/entrypoint status as applicable.
Deployment evidence: pending; runtime/provider and both Functions must be verified separately from source/CI.
Activity
daliu commentedon Oct 11, 2026
Staging preparation verified: runtime custom role has only 4 permissions; build has source-only object read, one profile image repository write and log write; deployment actAs is bound to only these exact accounts. All three have zero user-managed keys; zero Owner/Editor service-account grants remain after removing Google’s new default Editor grant. Images use active keep-two/older-than-seven-day cleanup. Admin bypass is disabled on production/backend-staging, original read-only staging unchanged. PR #702 merged as 3edffdf after six-job CI; exact-main CI 38175575349 passed. Protected run 38175760640 received normal daliu approval (delegated by the user), no bypass. It built/activated only signup and then failed the empty no-retry readback. First owned synthetic signup separately caught missing explicit SDK project context before a profile write. PR #703 corrects those two adapter gaps without expanding permissions, retries or profile logic; hosted success is still pending. One disposable staging Auth fixture is owned by this task; no real data, mail, production, payments or website publication was touched. Officer impact: safer staged readiness, not a usable member/payment launch. Officer documentation: included guides and partial-state repair note. Deployment evidence: partial initial signup only; issue stays open.
daliu commentedon Oct 11, 2026
Completed scoped engineering staging outcome, October 11. PR702/703 merged; exact deployed source2843388 passed PR/main six-job CI (latest main38176576872). Protected run38176811598 succeeded with normal delegated daliu approval, no admin bypass. Exactly two ACTIVE Functions; Node22/min0/max2/256MB/30s and explicit runtime/build identities verified. Both downloaded archives equal reviewed SHA2565dd349869630b3ff8af9ef3c26a116275d0cd0132f039a82675261187247685c (76,628 bytes). Auth/Firestore App Check ENFORCED. Runtime has 4 permissions, per-account actAs only, scoped build source/repository/logs, zero user-managed keys and zero Owner/Editor service-account grants. Image cleanup keep-two/package and older-than-seven-day eligibility active; alerts are not a cap or invoice proof. Fresh signup without callable fallback, actual Account UI recovery, 12 real-browser-attestation callable cases (7 denials/5 successes), self200/cross403, field/claim preservation, existing-profile burst, three simultaneous missing-profile recoveries/one pending profile, and background replay/update-time preservation passed. The initial replay diagnostic compared unstable JSON field order; canonical fields and update time passed without any backend modification. Initial partial release and narrow SDK-context/no-retry corrections remain recorded; no failures concealed as success. Signed out and removed only two exact owned Auth accounts and profiles with ownership/update-time guards; aggregate Auth0/empty collection metadata restored. No real data, email, payments, production deployment/billing or website publication. Public website marker41a9ae4 matches inactive website-release manifest. Officer impact: verified staging profiles only, normal self-approval and bypass disabled; wider membership/registration/payment operations remain unavailable. Officer documentation: PR704 merged204f392 after six green PR jobs38179103409; dated short guides/maps/root proof. This docs-only merge does not change deployed Function source. Backup-officer review: no terminal/key/data-edit procedure assigned; provider setup, release/rollback and identity revocation still require Dave/platform specialist. Dave remains sole owner, no backup appointed. Deployment evidence: exact native protected run, independent source/resource/provider readback, genuine hosted tests, synthetic-only UI screenshot and owned cleanup. Closing only #701; #113/#133/#136 and the full core-platform goal stay open.