Repository navigation
feat: scoped staging profile runtime and protected two-function release - #702
Merged
Merged
Conversation
✅ Deploy Preview for luminous-fox-7c393f ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Author
|
Maintainer review: checked the actual entrypoint, fixed file allowlist, signed-upload boundary, closed staging targets, immutable exact-main/six-job gates, native Auth/App Check preservation, explicit runtime/build identities, create-once/claims compatibility, redacted failure output and initial-baseline recovery. Local safety 153/153 and profile/App Check 45/45; CI 38175346481 passed all six jobs. No dependency/Rules/schema changes. Source is merge-ready; hosted proof remains pending on #701. Officer impact: staging-only readiness. Officer documentation: included short guides/maps. Deployment evidence: IAM preparation only; no hosted success claim. |
This was referenced Oct 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related #701; this PR does not close it until hosted proof.
Outcome
One protected manual keyless staging release for exactly two first-generation Node 22 profile Functions. Uses the supported v1 API with explicit runtime/build accounts, rather than broad default-account Firebase CLI preflight. Ten-file deterministic source bundle preserves the existing profile logic and lockfile; no prototype index, secret, payment/mail handler or production target.
Invariant / failures / compatibility
Current main + newest exact six-job CI and immutable repo/environment/identity checks before authentication and each deployment. Deployer retains no project IAM/API enabling, direct record/secret or Function-delete permission; actAs only on exact staging runtime/build accounts. Runtime: Auth get + Firestore get/create/transaction; no claims/update/delete. Build: source-object read, one repository write, logs. Existing profiles/claims unchanged; no migration. Failures produce fixed redacted codes, not raw provider errors. Initial baseline has no Functions; reviewed same-source retry/roll-forward, exact-owned removal only via Dave/specialist. Public callable transport is authenticated/attested at the SDK boundary.
Checks
Node 22 local safety suite 153 passed, 0 skips; profile/native App Check suite 45 passed; Functions lint passed; deterministic bundle and actual SDK entrypoint exports/trigger verified. Existing full six-job CI required before merge and exact-main release. Hosted checks remain pending.
Provider preparation
Only engineering staging Functions/Cloud Build/Artifact Registry APIs enabled; explicit runtime/build accounts (zero keys), four-permission runtime role, scoped build repository/source/log access, exact per-account actAs. Removed the newly auto-created default App Engine Editor grant; zero Owner/Editor service-account bindings on readback. Repository cleanup is active: keep newest two/package, older-than-seven-day delete. Trial $10 alerts are not a cap; no paid upgrade. Trust activation waits for reviewed source.
Officer impact: safer made-up staging profile checks; normal Dave approval with admin bypass disabled on production/backend-staging. Original read-only staging is unchanged. Production data/payments untouched.
Officer documentation: OFFICER_START_HERE.md, docs/officers/{README,ACCESS_CONTINUITY,LOW_COST_COMMUNITY,PUBLISH_AND_CHECK,SYSTEM_MAPS}.md; root operations/issue record.
Deployment evidence: source/runtime IAM preparation only; no Function or website deployed yet. Exact protected deployment and synthetic hosted proof will be recorded on #701, not inferred from this PR.