[daliu]

Closes #126.

Outcome

Add Run SPA callback safety tests as a separate named, blocking step in the hosted frontend CI job. It runs the merged npm run test:spa-navigation command after the lockfile install/frontend Jest suite and before lint/build.

Officer impact: Officers gain separate hosted proof that the tested GitHub Pages callback bridge preserves safe route state and rejects unsafe targets. No officer action, member-facing behavior, data, payment, or public content changes.

Officer documentation: None — this is an engineering-only hosted test gate. The existing officer guides already distinguish tests, merge, website publication, Firebase deployment, and providers; the plain-language callback behavior belongs to #99.

Deployment evidence: PR head e14d7eb8cb25e8046498e4cc9f096bc109f66a7d passed run 29235883679 and merged as e86a0f702cff6495f50630c5de3337290db8b8cb. Post-merge run 29236092444 passed the named SPA step 10/10, frontend Jest 47/47, build, Functions, and Rules. Deploy run 29236092446 rebuilt a byte-identical Pages artifact and made no commit. Netlify deploy 6a54a3c93db9d300082e1f5f is ready for the exact merge commit and matches runmprc.com HTTP-200 content. Firebase explicitly skipped because FIREBASE_SERVICE_ACCOUNT is absent; no callback provider was configured or rehearsed.

Invariant and failure behavior

• Safe same-origin callback path, query, and fragment state remains intact.
• Malformed, protocol-relative, and cross-origin targets remain rejected.
• Any suite regression returns a nonzero command result and blocks the frontend job.
• No || true, continue-on-error, retry masking, snapshot rewrite, or production network path is added.
• No migration or compatibility action is required; reverting this commit removes only the hosted step and its exact-status documentation.

Verification

• Fresh Node 20.20.2 npm ci --legacy-peer-deps — passed.
• Deliberate-failure proof: a temporary inverted assertion made npm run test:spa-navigation exit 1 with 9/10 passing; after restoration, the command passes 10/10 and the test file has no diff.
• CI=true npm test -- --watchAll=false --runInBand — 4 suites, 47/47 tests passed.
• CI=true DISABLE_ESLINT_PLUGIN=true react-scripts build — compiled successfully.
• YAML parse/structure check — exact named command is after install/Jest and before lint/build, with no continue-on-error.
• git diff --check — passed.

Scope and residual risk

• Changed only .github/workflows/ci.yml, OPERATIONS_RUNBOOK.md, and SECURITY.md.
• No runtime, package/lockfile, deploy workflow, Functions, Rules, Firebase, provider, branch-setting, production-data, or public-asset change.
• This closes only the standalone SPA callback CI gap. Mutating/fail-open lint, branch protection, protected/backend-first deployment, credentials, staging, and rollback remain open under CI-001 — Establish trustworthy quality gates and protected deployment #105.
• A green callback suite does not prove a real Stripe/Strava callback, App Check handoff, website publication, or provider configuration.

Review and release

• Two independent read-only reviews APPROVED exact commit e14d7eb8cb25e8046498e4cc9f096bc109f66a7d with no blockers. They independently checked workflow ordering/fail-closed behavior, production isolation, documentation truth, and officer impact.
• Exact-head run 29235883679 passed Run SPA callback safety tests with 10/10, frontend Jest 47/47, build, Functions, and Rules; Netlify preview ci: gate SPA callback safety tests #131 is ready.
• Exact merge run 29236092444 passed Run SPA callback safety tests 10/10, frontend Jest 47/47, build, Functions, and Rules.
• The automatic publication attempt made no website artifact change; Netlify published the exact merge commit, while Firebase explicitly skipped and callback providers remained unchanged. These are separate release facts, not production callback evidence.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e14d7eb
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54a2f6315e6600080b2477
😎 Deploy Preview	https://deploy-preview-131--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

EXACT-HEAD REVIEW / HOSTED EVIDENCE — e14d7eb8cb25e8046498e4cc9f096bc109f66a7d

• /root/live_queue_audit: APPROVE. Verified exact step order, fail-closed shell behavior, Node 20 deliberate-failure/restoration proof, 10/10 hosted results, production/provider isolation, and the remaining CI-001 — Establish trustworthy quality gates and protected deployment #105 deployment-gating risk.
• /root/membership_model_audit: APPROVE. Verified the exact three-file scope, security/runbook truth, provider disclaimers, residual risks, and officer-documentation None determination.
• Hosted run 29235883679: Run frontend Jest tests passed 47/47; new Run SPA callback safety tests passed 10/10; build, Functions, and Rules passed.
• Netlify preview ci: gate SPA callback safety tests #131 is ready. It is separate preview evidence, not a production callback/provider claim.

No review or pull-request check blocker remains. Exact post-merge named-step evidence is still required before #126 closes.