Apply approved sole-owner backend release governance

GITHUB_ISSUES.md

@@ -154,6 +154,8 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 ## CI-001 — Repair test gates and secure the deployment pipeline
 
+**CI-001C2 owner decision, 2026-10-11:** [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697) applies Dave's direct approval to continue Firebase backend setup without a backup owner. Dave (`daliu`) is the sole release/recovery owner. Backup appointment and two-person ownership are no longer backend prerequisites; absence of backup remains documented risk. #113/#133/#136 retain their other inventory, authority, exact-source, staging, policy and rollback requirements. Jeff's #667 read-only staging role does not expand. This decision is not Firebase deployment or live payment approval.
+
 **COST-001 source child:** [#683](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/683) binds only the two profile Functions to zero reserved instances, max two each, 256 MB and 30 seconds, with actual SDK metadata tests and matching fail-closed provider readback validation. It records the community-first minimal-service direction and officer review procedure without changing schema, privileges, deployment scope, billing, providers, or public pages. This is source preparation, not reduced-bill or hosted quality evidence; #113/#133/#136 retain release prerequisites, synthetic cold-start/burst/recovery proof and compatible rollback.
 
 **Labels:** `priority:P0`, `type:security`, `type:testing`, `area:ci`, `size:L`, `needs-external-config`

OFFICER_START_HERE.md

@@ -16,6 +16,8 @@ Attach the exact wording, public link, or approved photo when you have it. The A
 
 ## Choose the closest task
 
+**Backend ownership, 2026-10-11:** Dave approved continuing without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave remains the sole backend release/recovery approver; backup coverage is absent, not complete. This removes only the backup-appointment gate. Protected deployment, staging proof, rollback and all data/payment approvals remain required. See [the sole-owner procedure](./docs/officers/ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026); no officer handles keys or runs commands.
+
 | What you need | Open this short guide |
 | --- | --- |
 | Ask for any website change | [Request a change](./docs/officers/REQUEST_A_CHANGE.md) |

OPERATIONS_RUNBOOK.md

@@ -20,6 +20,8 @@ Read-only check on 2026-09-27: `runmprc@gmail.com` could access zero billing acc
 
 ## 1. Ownership roster
 
+**Backend owner exception, 2026-10-11:** Dave Liu (`daliu`) explicitly accepts operating Firebase/backend releases with no backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). The backup entries below are the desired continuity model, not an appointment gate for #113/#133/#136. Dave is the sole backend release/recovery approver; backup recovery coverage is absent. Keep protected approval, least-privilege short-lived identity, exact source/target checks, synthetic staging and rollback. This changes no finance, policy, data-disposition or payment-launch approval. Jeff's existing staging read-only role is unchanged. See the [sole-owner procedure](./docs/officers/ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026).
+
 Complete this table in the private operations system before live payments. Do not put personal phone numbers or recovery codes in this public repository.
 
 | Area | Primary role | Backup role | Required access |
@@ -40,6 +42,8 @@ Review access quarterly, when an officer changes, and after every incident. Remo
 
 ## 2. Emergency controls
 
+**#697 provider readback, 2026-10-11:** GitHub `production` now has one required reviewer (`daliu`), a branch-only `main` policy, self-approval allowed, and administrator bypass disabled. The existing read-only `staging` settings are unchanged. No cloud IAM/API/billing, Firebase or website deployment occurred; a protected no-op/release run and deployment identity remain separate #133 proof.
+
 ### Commerce pause — B1 source only, operator control NOT AVAILABLE YET
 
 CONFIG-001B1 [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151) adds the read-only server enforcement layer. It does not deploy that layer, create its runtime record, or provide a safe way for an officer to change it.

SECURITY.md

@@ -12,6 +12,8 @@ The public informational website can continue operating with normal care. **Live
 
 ### Runtime prerequisite — source only, 2026-09-27
 
+**Owner-approved backend continuity exception, 2026-10-11:** Dave Liu authorizes Firebase backend setup and protected releases without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave (`daliu`) is the sole named release/recovery owner. Backup coverage remains absent and is no longer an appointment prerequisite for #113/#133/#136. Protected approval, reviewed exact source, least-privilege keyless deployment, MFA/recovery checks, synthetic staging, rollback, legacy-data disposition, cost controls, and payment/legal policy still apply. Existing staging read-only reviewers gain no broader authority. Other backup recommendations remain future continuity work, not this waived backend gate.
+
 RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) targets Node.js 22 without changing first-generation triggers, permissions, profile schema, deployment scope, or resource limits. [Google schedules Node 20 decommissioning for October 30, 2026](https://docs.cloud.google.com/functions/docs/runtime-support). Both protected-release CI reads now require the separate Node 22 backend/profile-persistence job, and provider verification rejects either profile Function unless its runtime is exactly `nodejs22`. The original Node 20 baseline checks remain required.
 
 The dual-runtime run exposed a Node 22 error-stack accessor that remained writable despite `Object.freeze`. The unused Checkout observation projector now replaces that accessor with a fixed non-enumerable, non-writable data property before freezing; the regression test also rejects a stack-formatting hook. No raw provider value or stack frame is retained in that diagnostic. Existing malformed-input, proxy/getter, no-output, and redaction tests remain intact. This is runtime compatibility, not payment activation or a dependency-audit fix. #113/#133/#136, existing dependency findings, and hosted verification remain separate release gates.

docs/officers/ACCESS_CONTINUITY.md

@@ -4,6 +4,41 @@
 **Status:** setup is **INCOMPLETE** until the entry document is in a board-owned Drive and two backup officers complete a sign-in drill.
 **Approver:** club president plus the officer responsible for the service.
 
+## Sole-owner backend exception — approved October 11, 2026
+
+**Purpose:** allow backend setup and protected releases without appointing a backup.
+**Approver:** Dave Liu (`daliu`), the sole backend release/recovery owner.
+**Status:** owner decision approved under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Backup coverage remains **INCOMPLETE**. The general backend release remains **NOT AVAILABLE YET** until #113/#133/#136 supply their other proof.
+
+This dated exception supersedes this guide's two-owner appointment and approval requirements only for Firebase/backend estate review, release authority and recovery. It does not appoint Jeff or broaden his staging read-only role. It does not remove finance, legal, data-disposition, MFA, least-privilege, staging or rollback safeguards. If Dave is unavailable, stop new releases; no substitute approver is implied.
+
+**Prerequisites:** a maintainer supplies a reviewed exact commit, successful required checks, one fixed project/resource set, private redacted evidence and a recovery plan. Protected release authority must be configured and verified first.
+
+**GitHub configuration readback, October 11:** the `production` environment now requires `daliu`, admits only branch `main`, and disables administrator bypass. Self-approval remains allowed so the sole owner can approve their own request. The existing `staging` read-only environment is unchanged. This verifies approval settings only, not a release run, cloud deploy authority or account recovery.
+
+```mermaid
+flowchart LR
+    Request["Reviewed exact backend request"] --> Dave{"Dave approves fixed release?"}
+    Dave -- "No or unavailable" --> Stop["Stop; no substitute owner"]
+    Dave -- "Yes" --> Gate["Protected keyless identity and target checks"]
+    Gate --> Proof["Synthetic staging and rollback proof"]
+    Proof --> Release["Separate approved target release"]
+```
+
+Text alternative: Dave alone may approve the fixed backend request; a protected keyless identity and staging/recovery proof must still pass, and Dave's absence stops rather than appoints a replacement.
+
+1. Open the maintainer's reviewed release request.
+2. Confirm its exact commit, fixed project and named resources.
+3. Confirm required checks and the staged recovery evidence passed.
+4. Approve the protected request as Dave only when those facts match.
+5. Ask the maintainer for separate backend and website verification.
+
+**Expected result:** a named protected approval without a downloaded cloud key or an invented backup owner.
+**Success proof:** record Dave's approval, exact commit, environment, run link and fixed verification result; never copy credentials or member records.
+**Stop conditions:** missing/mismatched evidence, unfamiliar target, broad Functions deployment, real-data testing, unavailable Dave or a failed recovery check. Missing backup appointment alone is not a stop condition.
+**Undo:** Dave may reject an unstarted release or ask the maintainer to revoke the dedicated identity or restore the reviewed backend set. Restoring the two-owner model requires a named appointment and verified access; do not silently grant it.
+**Escalation:** Dave for backend/release decisions; club president for provider-assisted recovery if Dave cannot be reached. No emergency cloud access is presumed.
+
 ## Entry document and private locator
 
 A private Google Doc titled **MPRC Website — Officer Start Here** has been created and connector-readback verified. Its private link is intentionally absent from this public repository. Metadata currently reports owner-only access, so backup-officer sharing is not complete. It contains no passwords or member/payment data.
@@ -228,7 +263,7 @@ For each system, record only:
 
 ## Stop conditions
 
-Stop if a service has only one owner, uses Dave's personal recovery channel, has no tested rollback, or asks for a password/code in a shared document. Also stop if a merge can publish unexpectedly, a server credential reaches a website job, a project/scope can be typed freely, a green backend skip is possible, or a website can publish before backend verification. Do not remove an account, token, integration, fork, or billing method until two owners complete a dependency check.
+Outside the approved sole-owner backend exception, stop if a service has only one owner. Always stop if recovery access is unverified, there is no tested rollback, or anyone asks for a password/code in a shared document. Also stop if a merge can publish unexpectedly, a server credential reaches a website job, a project/scope can be typed freely, a green backend skip is possible, or a website can publish before backend verification. Do not remove an account, token, integration, fork, or billing method until its authorized owner completes a dependency check; use two owners outside the scoped exception.
 
 Also stop if a role-bearing Firebase account can see member/admin website controls, open private member/admin data, call an admin Function, receive member checkout treatment, or export registrations before its email is verified. Do not work around that result by editing a profile, changing a role, or using Firebase Console. Record only the fixed test result and exact tested revision, then escalate to the platform/security owner.
 

docs/officers/PUBLISH_AND_CHECK.md

@@ -76,6 +76,8 @@ Remote readback on 2026-09-14 found the old #473/#623/#659 hot source refs still
 
 ## The release gate
 
+**Sole-owner backend decision, 2026-10-11:** under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697), Dave Liu (`daliu`) is the sole backend release/recovery approver. Do not wait for backup appointment or imply backup coverage. The [scoped procedure](./ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026) keeps protected approval, exact source/project/resource checks, keyless least-privilege identity, synthetic staging and reviewed recovery. It grants no broader authority to the existing staging read-only reviewers. The general release remains **NOT AVAILABLE YET** until its other gates are verified.
+
 ```mermaid
 flowchart TD
     Review["Preview and checks"] --> Merge{"Approve merge?"}
@@ -87,7 +89,7 @@ flowchart TD
     Preflight -- "Yes" --> Prepare["Prepare credential-free website artifact"]
     Prepare --> WebConfig{"Explicit web environment and artifact identity valid?"}
     WebConfig -- "No" --> Stop
-    WebConfig -- "Yes" --> Release{"Approve protected environment?"}
+    WebConfig -- "Yes" --> Release{"Dave approves protected backend release?"}
     Release -- "No" --> Stop
     Release -- "Yes" --> Gate{"Project, scope, and authority valid?"}
     Gate -- "No" --> Stop