CI-001B2: protect backend-first releases

[daliu]

Refs #135

Outcome

A merge now runs CI only. Releasing is a separate manual operation for one full commit at the current tip of main. The gate fails closed, uses a fixed profile-recovery target set, waits for protected approval, rechecks current main and the newest exact CI run, verifies the retained artifact, obtains short-lived cloud authority only inside the backend job, and permits Pages publication only after exact Firebase provider readback.

Git-triggered Netlify production builds are paused while public read-only previews remain available. Future Pages artifacts no longer contain a runmprc.com CNAME. This source change does not clear the existing Pages provider setting or create a protected Netlify publication path.

Security invariants

• Require the exact current main commit and the newest exact push CI run; queued, running, failed, or superseded runs fail.
• Recheck current main, CI jobs, request age, and artifact availability after the protected-environment wait and before OIDC.
• Reject release requests older than 24 hours.
• Do not accept a typed Firebase project, Function name, release plan, or deployment scope.
• Deploy only Firestore Rules, createMemberOnSignUp, and ensureMemberProfile for this plan.
• Use the lockfile Firebase CLI and full-SHA-pinned release Actions.
• Keep WIF identifiers and authority out of dependency installation, website preparation, and website publication.
• Keep artifact scans quiet so a matched credential line cannot be copied into logs.
• Query the default Rules release through cloud.firestore/(default), validate its canonical cloud.firestore response identity, and require one exact firestore.rules source.
• Permit an idempotent Rules no-op only when the approved source was already live.
• Require both Functions to be ACTIVE with exact identity/runtime/trigger plus strictly advanced revision evidence.
• Never report a successful backend skip; failed/partial/unreadable state blocks Pages.
• Keep staging deliberately unavailable until BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113/CI-001C — Configure protected short-lived Firebase deployment identity #133 name and protect an isolated project.
• Stop Netlify production and unknown build contexts; allow only deploy previews and branch previews.
• Publish the future Pages branch without claiming Netlify's runmprc.com domain.

Verification

Exact source commit: 4da12d6f3dea8559a2d30a0453dd1c20c2c758ac

• Node 20 release/provider tests: 13/13
• Node 20 frontend Jest: 47/47
• Node 20 SPA callback safety: 10/10
• Node 20 Functions tests: 17/17
• Functions lint: pass
• Java 17 Firestore Rules: 295/295
• Diagnostic optimized frontend build: pass
• actionlint 1.7.12: both workflow files pass
• Ruby keyword-style safe YAML parse: pass locally and on the prior hosted portability rerun
• Diff, relative-link, and sensitive-pattern checks: pass
• Exact-head hosted CI: pass — run 29240317299 (frontend/build, Functions, and Rules)

External-state boundary

No Firebase, Pages, Netlify production, runmprc.com, Stripe, email, DNS, or member-data operation was run. The repository default branch was separately verified and corrected to canonical main; legacy dev was not deleted.

GitHub currently has no configured protected staging/production environments, WIF authority, or public browser variable. The release remains NOT AVAILABLE YET until #133 and #136. The Pages API still reports runmprc.com as its custom domain and the default Pages URL redirects there; removing public/CNAME changes future source only. A protected WEB-001 child is now an explicit dependency of #136 for exact-commit Netlify publication and rollback.

The committed Firebase CLI is 13.7.0. Its (default) Rules release naming is now explicit. #133 must still prove ADC/WIF behavior in isolated staging or open a separate reviewed tooling-upgrade issue.

This PR intentionally uses Refs, not Closes: after merge and exact main-push CI, #135 still requires a safe negative dispatch showing missing configuration/authority is red and publishes neither Firebase, Pages, nor Netlify. Only then may #135 close.

Officer handoff

Officer impact: Merging, requesting a release, and approving the protected backend are separate. Missing authority, a stale commit/CI run, an expired request/artifact, wrong project/scope, failed Firebase deployment, or failed provider verification becomes a red stop before publication.

Officer documentation: OFFICER_START_HERE.md, OFFICER_HANDBOOK.md, SYSTEM_DESIGN.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/REQUEST_A_CHANGE.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/SYSTEM_MAPS.md, and docs/officers/GLOSSARY.md.

Deployment evidence: Source/tests only. No website, Firebase, Netlify, provider, CNAME setting, or production behavior is claimed live. runmprc.com remains the separately hosted Netlify surface.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	4da12d6
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54b3ca1f342e00073621a4
😎 Deploy Preview	https://deploy-preview-138--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.