[daliu]

Outcome

Prepare a separate keyless staging profile-release identity and read-only protected authority check. Restore administrator bypass per Dave's direct instruction; preserve daliu/main and the existing #667 read-only authority.

Refs #699. This is a bounded child of #133, not production rollout or a complete backend.

Scope

• One dedicated staging deploy principal, one provider/pool and one 26-permission custom project role; zero downloaded keys, no Owner/Editor or broad Firebase administration. The pool stays disabled until exact merged main passes all six CI jobs.
• Separate backend-staging environment; immutable repo/owner/ref/workflow/environment/manual-event checks plus exact current-main/six-job verification before token exchange and again before cloud reads.
• Five-minute credential, no credential file; exact staging project metadata and read-only testIamPermissions. Required permissions must exist and ten prohibited data/admin/delete/impersonation permissions must not. Fixed redacted output; no locators or tokens in source.
• Runtime/build identities and actual two-Function/Rules deployment remain separate review. IAM creation is project-scoped, not a per-Function-name restriction; current workflow contains no deployment path.
• No package, schema, Auth/member record, production IAM/runtime, API enablement, billing upgrade, provider payment, website or runner-matching change.

Validation

• 55 focused CI/release/authority contract tests passed before final defensive validation tightening; final changed-script/release/authority tests 42/42 passed.
• Functions profile-focused suites: 45/45 passed (unit/installed-SDK synthetic tests, not hosted proof).
• YAML parse and staged diff check passed; actual authorization/redaction/target/read-only diff reviewed.
• Provider readback confirms exact trust/role/fingerprint, zero user-managed keys, no runtime/build actAs, and original read-only account policy/staging environment unchanged. Protected no-op proof still awaits merge/current-main CI and activation.
• No migration; failure performs no application/runtime write. Revoke by disabling only the dedicated profile pool or removing only its WIF binding; existing short-lived tokens expire separately.

Officer impact: Dave can approve a focused staging authority check without another owner or handling a key; it is not membership/payment operation.
Officer documentation: OPERATIONS_RUNBOOK.md, SECURITY.md, GITHUB_ISSUES.md, OFFICER_START_HERE.md, docs/officers/README.md, ACCESS_CONTINUITY.md, PUBLISH_AND_CHECK.md; separate flow/text alternative and stop/proof/undo/escalation. Procedure remains unavailable until #699 records protected proof.
Deployment evidence: GitHub environment and staging IAM configuration only; no Firebase backend or website published. Provider activation/no-op proof and remaining parent release gates are distinct. Dave's standing sole-maintainer source-review override and latest focused release approval apply.

CI integration correction

Initial run 38172680173 correctly rejected the new YAML parser/test command because the artifact-safety suite keeps an exact independent command allowlist. Updated only that expected allowlist and added negative omission cases for the new verifier parse and test. Existing skip/swallow/privilege guards remain. Final full workflow-safety command passes 146/146 locally, zero skips/failures. Federation remains disabled pending fresh exact-head PR/main checks. This correction adds one test file to the reviewed diff, not a deployment permission or runtime change.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	148108a
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6acbf36f731a59000812d93a
😎 Deploy Preview	https://deploy-preview-700--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.