CI-001 — Establish trustworthy quality gates and protected deployment

[daliu]

Outcome

Create a trustworthy delivery pipeline in which non-mutating lint, frontend tests/build, Functions lint/tests, Firestore Rules tests, dependency/secret checks, and exact-commit staging evidence gate any deployment. Remove service-account material from frontend builds and move toward least-privilege OIDC/WIF with protected approval.

Why this is a tracker

This is cross-boundary delivery and external IAM work. Assign only atomic children.

Children

• CI-001A — Repair the deterministic frontend test baseline #103 — CI-001A: repair the deterministic frontend test baseline (merged to main and closed)
• CI-001B1 — Run frontend Jest in hosted CI #124 — CI-001B1: run the complete frontend Jest suite as a job-failing hosted CI step (merged to main and closed)
• CI-001B1A — Run SPA callback safety tests in hosted CI #126 — run the standalone SPA callback suite as a named, job-failing hosted CI step (merged to main and closed)
• CI-001B2 — Make releases protected, backend-first, and fail-closed #135 — CI-001B2: protected backend-first fail-closed gate merged as 9eafab1217aff7058c42240aaba72d7b93f8ed24; safe negative probes published nothing
• CI-001C — Configure protected short-lived Firebase deployment identity #133 — CI-001C: configure protected short-lived OIDC/WIF deployment authority (blocked on owner/IAM configuration)
• CI-001D — Prove backend-first staging and deploy the profile repair #136 — CI-001D: prove compatible backend-first staging and deploy the profile repair (CI-001B2 — Make releases protected, backend-first, and fail-closed #135 closed and AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 source merged; still waits for BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113, CI-001C — Configure protected short-lived Firebase deployment identity #133, and protected Netlify release)

System acceptance

• The exact commit cannot deploy until every required check passes.
• Lint never rewrites files or hides failures.
• Frontend builds receive no server credential.
• Missing deployment authority/config fails visibly.
• Backend/rules/index changes precede dependent frontend code.
• Production requires named approval and staging evidence.

Dependencies

SAFETY-001 (#99) is the local-safety foundation. External IAM/environment work requires an authorized owner.

Claim rule

Do not claim this tracker. Claim exactly one dependency-ready child, assign it, and post the repository-standard timestamped CLAIMED marker before editing.

[daliu]

DELIVERY EVIDENCE (not a claim): after #107 merged at ce22c11, post-merge CI passed, and the deploy workflow itself concluded success. However, the Firebase step logged No FIREBASE_SERVICE_ACCOUNT secret; skipping Firebase deploy; only the GitHub Pages artifact published.

This is current evidence for CI-001C/CI-001D and the tracker acceptance item “Missing deployment authority/config fails visibly”: missing backend deployment authority currently produces an overall green workflow while skipping Functions/Rules deployment. No secret values or production changes were inspected.

[daliu]

Privacy/security coordination note: #110–#112 cover data decisions, current telemetry redaction, and private incident intake. Continuous secret scanning, dependency scanning/update policy, SBOM/provenance, protected environments, and deployment IAM remain under CI-001/SUPPLY work represented by this tracker; no duplicate scanning ticket was created.