From 45be99b9b365c90af93f4ba72594d0ee49676603 Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Thu, 23 Jul 2026 01:11:45 -0700 Subject: [PATCH] docs: correct exact rollback parent guidance --- OPERATIONS_RUNBOOK.md | 4 +++- docs/officers/PUBLISH_AND_CHECK.md | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index 9d43a53..2e37844 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -644,10 +644,12 @@ The GitHub release workflow is now manual and exact-current-commit. After protec WEB-UX-001A [#457](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/457) used a separate temporary **web-only** Netlify release. Its manifest named the expected first parent of one `main` merge, release-specific source ref, exact reviewed source commit/tree, exact artifact file count/digest, and known rollback deploy. The release-control Deploy Preview and production both built that pinned source. Netlify continued production only for the exact-parent merge, fetched the public ref into a fresh temporary Git repository with provider/global Git configuration disabled, verified both source hashes, installed the pinned lockfile with lifecycle scripts disabled, built without the data-dependent sitemap prebuild or any React/provider variables, scanned the output for credential markers, verified the exact artifact digest, and published a public provenance marker. A wrong/missing context, branch, commit, parent, ref, tree, artifact, canonical manifest, build-hook marker, or inactive manifest stops without replacing the live deploy. This path changed no Firebase, Rules, Functions, provider configuration, or production data and did not complete WEB-001. -For #457, prepare the manifest-disable pull request and exact previous-source Git rollback projection before merging the release. The current Git/Netlify identity cannot select Netlify's atomic restore control; a Netlify team owner remains the preferred fast rollback, while the pre-reviewed Git projection pinned to `e86a0f702cff6495f50630c5de3337290db8b8cb` is the available slower fallback. Freeze unrelated `main` merges until the Netlify deploy and public smoke checks finish, because a later merge invalidates the exact-parent gate and may supersede the provider build. Verify the pinned Deploy Preview marker and artifact digest before merge; after merge verify `/.well-known/run-mprc-release.json`, the Netlify deploy record, `/events`, `/shop`, and the signed-out `/account` route on phone and desktop sizes. If the release fails before publication, leave the prior deploy live and diagnose offline. If it publishes but verification fails, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`; if that owner is unavailable, update the prepared rollback manifest's expected parent to the release merge, reverify its pinned previous-source preview, and merge it. A source-only disable is not rollback. After success, merge the disable pull request, confirm its production attempt is skipped, delete `codex/netlify-source-457-header`, and verify that ref is absent so a historical rebuild cannot fetch the hotfix source. The platform owner approves and performs this exception; officers do not run commands or handle credentials. +For #457, prepare the manifest-disable pull request and exact previous-source Git rollback projection before merging the release. The current Git/Netlify identity cannot select Netlify's atomic restore control; a Netlify team owner remains the preferred fast rollback, while the pre-reviewed Git projection pinned to `e86a0f702cff6495f50630c5de3337290db8b8cb` is the available slower fallback. Freeze unrelated `main` merges until the Netlify deploy and public smoke checks finish, because a later merge invalidates the exact-parent gate and may supersede the provider build. Verify the pinned Deploy Preview marker and artifact digest before merge; after merge verify `/.well-known/run-mprc-release.json`, the Netlify deploy record, `/events`, `/shop`, and the signed-out `/account` route on phone and desktop sizes. If the release fails before publication, leave the prior deploy live and diagnose offline. If it publishes but verification fails, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, rebase the prepared rollback projection onto the exact current `main`, set the manifest's expected parent to that same commit, and reverify its pinned previous-source preview. Confirm `main` is unchanged immediately before merging with a merge commit. Stop, refresh the projection, and rerun its checks and preview if `main` advances. A source-only disable is not rollback. After success, merge the disable pull request, confirm its production attempt is skipped, delete `codex/netlify-source-457-header`, and verify that ref is absent so a historical rebuild cannot fetch the hotfix source. The platform owner approves and performs this exception; officers do not run commands or handle credentials. Dated result: on 2026-07-23 America/Los_Angeles, Netlify deploy `6a61c544171ea80008307623` published trigger commit `4f67e6cafb975a3f985fefc67f094b3a37526702`. The public marker matched source `ed1b0833f25822cee80c99ded8753722b5608a3f`, tree `878c6628d961f4484cb49208aef53f1e9f2e3b47`, 60 files, and digest `7570955c2a00926e5813aef135f1799172cfd046072ac89fb4e492bed0797092`. Signed-out checks passed at 1280px desktop and 390px phone widths. The release source was deleted and verified absent. The rollback source remains at `e86a0f702cff6495f50630c5de3337290db8b8cb`. +Post-release control result: safety merge `04d6d2cd88dda0e6ec7e2b6a71514e6ce2e4db25` produced unpublished Netlify attempt `6a61ca460c41450008ee531d`; the published site remained deploy `6a61c544171ea80008307623`. Ordinary `main` merges are paused from publishing the website again. Any later Git rollback projection must name the exact current `main` immediately before its merge, not the original release merge. + ### Production approvals Production commerce changes require: diff --git a/docs/officers/PUBLISH_AND_CHECK.md b/docs/officers/PUBLISH_AND_CHECK.md index 816f8ed..39f2509 100644 --- a/docs/officers/PUBLISH_AND_CHECK.md +++ b/docs/officers/PUBLISH_AND_CHECK.md @@ -163,7 +163,7 @@ In words: the release preview and production must contain the same pinned fronte **Success proof:** keep the public deploy link and marker, exact hashes, check date, phone/desktop sizes, and a redacted public screenshot. Keep settings, logs, credentials, and member data out of public evidence. -**Undo:** if nothing published, leave the prior deploy live. If the wrong result published, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, set the prepared rollback manifest's expected parent to the release merge, verify its preview still pins previous source `e86a0f702cff6495f50630c5de3337290db8b8cb`, and merge that exact rollback projection. Disabling the source manifest prevents builds of later `main` commits but does not roll back an already published deploy; deleting the release-specific source ref makes a later rebuild of the old release commit fail its fetch. +**Undo:** if nothing published, leave the prior deploy live. If the wrong result published, ask a Netlify team owner to restore deploy `6a54a3c93db9d300082e1f5f`. If that owner is unavailable, rebase the prepared rollback projection onto the exact current `main`, set its expected parent to that same current `main` commit, and verify its preview still pins previous source `e86a0f702cff6495f50630c5de3337290db8b8cb`. Confirm `main` has not advanced, then merge that exact rollback projection with a merge commit. Stop, refresh the projection, and rerun its checks and preview if `main` changes at any point. Disabling the source manifest prevents builds of later `main` commits but does not roll back an already published deploy; deleting the release-specific source ref makes a later rebuild of the old release commit fail its fetch. **Escalation:** platform owner first; website/content owner second. Escalate to the security owner if private data or an unexpected application version appears.