Repository navigation
OBS-001A — Remove personal data and session replay from current monitoring and logs #111
Description
Officer impact: None — member and officer screens/tasks are unchanged; this tracker removes or proves containment of diagnostic payloads.
Officer documentation: None — no officer procedure, navigation, permission, collected field, deployment duty, or external account changed. Engineering evidence is in SECURITY.md and OPERATIONS_RUNBOOK.md.
Deployment evidence: Closure records source/tests/merge separately from website publication, exact runmprc.com, Firebase deployment, outside-provider configuration, and live behavior. Source completion does not prove any production surface.
Problem
Current source sent a signed-in user's email to Sentry user context, enabled Sentry replay for every captured error, and logged the raw signup email in functions/signup.js. Authentication, member, event, registration, payment, and account screens can contain personal data or capability-bearing URL state. Firebase Analytics was also enabled without a repository-proven event allowlist, consent decision, payload audit, or retention decision.
This created avoidable exposure to logs and monitoring vendors even when the underlying feature worked correctly.
Atomic outcome
Make the existing frontend monitoring, analytics wrapper, Auth signup logging, and covered browser diagnostics fail closed for personal data, with synthetic tests that inspect the emitted payloads. This issue removes current exposure; it does not build the broader payment metrics/SLO program or approve future telemetry.
Scope
- Remove raw email and other direct member identifiers from Sentry user context.
- Disable Sentry session replay, tracing, client reports, default PII, breadcrumbs, attachments, transactions, and unapproved integrations.
- Positively project only bounded Sentry error metadata; drop query strings, fragments, form values, provider responses, tokens, addresses, DOB, emergency contacts, emails, phones, request bodies, and unknown fields.
- Replace raw signup email/error logging with one fixed failure outcome and prove success silence plus failure redaction across standard console levels.
- Remove Firebase Analytics runtime initialization/emission and keep the compatibility wrapper transport-free.
- Route the covered browser console failures through a closed five-outcome helper.
- Add focused synthetic tests that fail if representative sensitive values reach Sentry, Analytics, signup logs, or covered browser diagnostics.
- Document the residual production/provider decisions that require the approved matrix from DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.
Acceptance criteria
- No raw email, phone, address, DOB, emergency contact, OAuth/Auth token, provider response, password/reset material, capability-bearing query/fragment, arbitrary form value, or request body is sent by the covered code.
- Sentry replay is off, or sensitive-route exclusion and masking are verified by payload inspection with no form text or URL state visible.
- Signup success/failure logs contain only allowlisted event/result identifiers and sanitized codes.
- Analytics accepts only documented low-cardinality event names/parameters and rejects or drops unknown/sensitive fields.
- Synthetic canary values are absent from captured Sentry events/replays, Analytics calls, console/function logs, test artifacts, and CI output.
- Local and CI tests make no production network calls and use synthetic identities only.
- External Sentry/Firebase retention, consent, access, and deletion configuration remains explicitly unproven until owner evidence is supplied under DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.
Completed atomic children
- AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 / PR AUTH-PROFILE-001: recover missing member profiles safely #132 — signup/profile source, including fixed no-PII signup failure handling; merged as
13ccc1b67dd57f69091e808b12e1287a1bc05b2f. - OBS-001A1 — Disable Sentry replay and fail closed for personal data #134 / PR OBS-001A1: fail closed for Sentry personal data #137 — Sentry containment and synthetic payload inspection; merged as
a925dbdada35b6d7ceb28f6ba2b10cc5679c9634. - OBS-001A2 — Disable unapproved Firebase Analytics collection #139 / PR OBS-001A2: disable unapproved Firebase Analytics collection #141 — Firebase Analytics runtime removal and default-deny compatibility wrapper; merged as
36b531c8e741442af7c688c23a780d2dcd4ed374. - OBS-001A3 — Remove raw frontend error objects from browser logs #142 / PR OBS-001A3: remove raw frontend console error payloads #143 — closed browser diagnostic helper plus whole-runtime console guard; merged as
f2caaae3b3f25adfd4fc552008871408f18e5931. - OBS-001A4 — Prove signup failure logs stay free of member data #146 / PR test: prove signup logs redact private data #147 — hostile-canary signup Function log regression; merged as
8d250073d8911d42031fa694c8c0e784911461b0.
Dependencies and coordination
- SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 and CI-001A — Repair the deterministic frontend test baseline #103 are complete.
- PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101 Stripe webhook logging, STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 Strava/OAuth behavior, unrelated legacy Functions logs, provider consoles, production data, and Firestore Rules remain excluded.
- DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 owns approved purposes, vendor disclosures, retention, consent, access, deletion, and any decision to re-enable telemetry. A future implementation requires a new claimed/reviewed issue.
- Broader metrics, alerting, payment reconciliation, and incident SLOs remain under the existing OBS/commerce program.
Explicitly out of scope
- Adding new analytics, advertising, fingerprinting, or replay vendors.
- Designing dashboards, payment metrics, alerts, or incident response.
- Changing membership authority, OAuth scopes, Firestore authorization, data retention jobs, or the public privacy policy.
- Enabling monitoring in local/test or contacting live services from tests.
Claim protocol
Creation is not a claim. Do not edit files until dependencies are complete, the issue is assigned, and a timestamped CLAIMED by <canonical agent> at <UTC>; branch <branch> comment is posted and re-read. Earliest valid claim wins.
Activity
daliu commentedon Jul 13, 2026
OWNERSHIP COORDINATION from #99 at 2026-07-13T07:23:07Z (not a claim): #99 must preserve query/fragment state for Pages callbacks. It retains only a fail-closed startup guard that skips Sentry initialization when the initial URL is /account/strava/callback, /register/success, or /shop/purchase/success with query/fragment state.\n\nReason: the bridge restores capability state before initSentry runs, so merging the bridge alone could newly expose that URL to monitoring/replay. #111 continues to own the complete hosted telemetry outcome: general URL/event/log redaction, already-initialized SPA transitions, replay/consent/retention policy, payload inspection, and provider evidence. The narrow #99 guard may be replaced by #111 after equivalent or stronger scrubbing is proven.
daliu commentedon Jul 13, 2026
IMPLEMENTATION SPLIT / OVERLAP RESOLUTION (2026-07-13) — planning update, not a claim on the parent.
#111 spans three independently testable runtimes and cannot be safely reviewed as one focused pull request:
functions/signup.jsas part of profile self-bootstrap. Its draft removes the raw email/raw-error logs; do not create a duplicate signup-log child. Count that acceptance slice only after AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 is merged and deployment truth is recorded.#118 also temporarily owns root
SECURITY.md/OPERATIONS_RUNBOOK.mdhunks. #134 may implement and test only its two Sentry paths until #118 merges and explicitly releases those docs. #101 Stripe webhook hunks and #88 Strava provider behavior remain excluded.daliu commentedon Jul 13, 2026
Atomic-child status update
13ccc1b67dd57f69091e808b12e1287a1bc05b2f; Firebase deployment and live behavior remain unproven.a925dbdada35b6d7ceb28f6ba2b10cc5679c9634; exact-merge CI passed, but the website/provider behavior was not published or verified.CLAIMEDby/rootoncodex/issue-139-disable-analytics. It owns only the five stated runtime/test paths plus narrow Analytics engineering-document hunks. It explicitly excludes PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101, Sentry, signup/profile/Auth, Rules, provider consoles, and policy decisions.Parent #111 stays open/proposed. #139 removes current unapproved collection without inventing a consent/retention policy; #110 still gates any future Analytics enablement and any closed event/parameter schema.
daliu commentedon Jul 13, 2026
OBS-001A2 source outcome is complete without overlapping #118 or #101.
36b531c8e741442af7c688c23a780d2dcd4ed374; exact post-merge CI29243808591passed.runmprc.comrevision verification, Firebase deployment, Analytics console/config review, history/cookie cleanup, or live-network check occurred.#111 remains open for any separately bounded, dependency-cleared privacy work. #110 remains the policy owner for any future telemetry purpose, consent, schema, retention, access, or deletion decision. The #139 source/test/doc claim is released.
7 remaining items
daliu commentedon Jul 13, 2026
CLAIMED by Codex agent
/rootat 2026-07-13T11:13:16Z; branchcodex/issue-111-closure-audit.This is a second read-only source/acceptance/closure audit on exact
mainf2caaae3b3f25adfd4fc552008871408f18e5931, after residual child #142 joined completed children #118, #134, and #139. No runtime or documentation file is claimed or may be edited. I will verify each parent acceptance criterion against merged source/tests and child evidence, distinguish source from every deployment/provider surface, and either close the tracker with exact proof or release it with a narrowly stated residual blocker. Any newer conflicting claim is a stop-and-coordinate condition.daliu commentedon Jul 13, 2026
PARENT SOURCE AUDIT COMPLETE — 2026-07-13
Completed atomic source boundaries:
13ccc1b67dd57f69091e808b12e1287a1bc05b2fa925dbdada35b6d7ceb28f6ba2b10cc5679c963436b531c8e741442af7c688c23a780d2dcd4ed374f2caaae3b3f25adfd4fc552008871408f18e5931; post-merge CI 29245372365 passedThe source acceptance audit now finds no covered raw email/phone/address/token/provider/form/request payload flowing to Sentry, Firebase Analytics, signup logs, or the four audited browser console paths. Tests use synthetic canaries and no production provider calls.
Deployment/provider boundary: no exact website revision was published or verified on
runmprc.com; Sentry/Firebase provider configuration, transport, historical data/cookies, retention, consent, access, deletion, and live behavior remain unproven and owner-controlled under #110. Closing this source tracker does not approve or re-enable analytics/replay.daliu commentedon Jul 13, 2026
CORRECTION — reopening after the second independent closure audit found one remaining proof gap.
Exact source
f2caaae3b3f25adfd4fc552008871408f18e5931is fail-closed by inspection:functions/signup.jsignores the caught object, emits one fixed phrase on failure, emits nothing on success, and returns a generic error. However, parent acceptance criterion 5 requires synthetic canary evidence for the covered signup/function log sink. Existing signup tests exercise only successful create/preserve behavior; no test makes profile creation reject and inspects the resulting console arguments.The earlier closure comment therefore overstates test coverage. #111 is reopened with its existing
/rootaudit claim retained. I will split one test-only child that owns only the minimum Functions test path, after checking live claims. Runtime signup code, #118 behavior, Sentry, Analytics, frontend diagnostics, Stripe, Strava, Rules, providers, production data, and root documents remain immutable. No human policy decision is required.All source-vs-deployment caveats remain unchanged: website publication, exact
runmprc.com, Firebase deployment, provider settings/history/cookies, and live behavior are unproven.daliu commentedon Jul 13, 2026
Residual signup-log proof is split into #146 and validly claimed by
/rootoncodex/issue-146-signup-log-testfrom exact basef2caaae3b3f25adfd4fc552008871408f18e5931.The child owns only
functions/ensureMemberProfile.test.js. It will add hostile-canary failure-log and no-success-log assertions without touchingfunctions/signup.jsor any other runtime/documentation path. #145's frontend/Auth-mail paths do not overlap. Parent #111 remains open/in progress until #146 merges and the final audit is rerun.test: prove signup logs redact private data (#146)
daliu commentedon Jul 13, 2026
AUTOMATION CORRECTION — PR #147's merge sentence matched GitHub's issue-closing parser and auto-closed #111 at 2026-07-13T11:24:54Z before the final parent checklist/evidence update.
Reopening the tracker briefly with the existing
/rootread-only claim retained. Exactmainis now8d250073d8911d42031fa694c8c0e784911461b0; #146 and exact-merge CI29246166838are complete. No runtime or documentation file is claimed. Two independent auditors will confirm the full #118/#134/#139/#142/#146 acceptance chain before the intentional close.All deployment/provider caveats remain unchanged and unproven.
daliu commentedon Jul 13, 2026
INTENTIONAL FINAL CLOSURE — all seven acceptance criteria pass on exact
main8d250073d8911d42031fa694c8c0e784911461b0.Completed source chain:
13ccc1b67dd57f69091e808b12e1287a1bc05b2f; exact-merge CI29241524287passed.a925dbdada35b6d7ceb28f6ba2b10cc5679c9634; exact-merge CI29242595272passed.36b531c8e741442af7c688c23a780d2dcd4ed374; exact-merge CI29243808591passed.f2caaae3b3f25adfd4fc552008871408f18e5931; exact-merge CI29245372365passed.329b58808b8e09d0f284c2f6b7369920aa6afdc6, merge8d250073d8911d42031fa694c8c0e784911461b0; exact-head CI29246004213and exact-merge CI29246166838passed.Two independent final read-only audits approved the complete range. Sentry keeps only a strict bounded error projection with replay/tracing/sessions/client reports/default PII/breadcrumbs/attachments/transactions disabled. Analytics has no runtime transport and reads no inputs. Covered browser diagnostics accept only five fixed outcomes. Signup success is silent across
debug,error,info,log, andwarn; hostile failure emits exactly one fixed one-argument error and returns only the genericinternalresponse. Synthetic canaries cover email, phone, address, DOB, emergency contact, UID/name, Auth/OAuth/reset/capability tokens, provider responses, form/request data, URL query/fragment state, and stacks. Exact CI logs contain none of the searched canaries.Deployment truth:
main.mainis8d250073d8911d42031fa694c8c0e784911461b0.runmprc.comverified: no exact revision was checked live.#110 remains the policy owner. Closing #111 does not approve or re-enable telemetry; any future implementation requires a new claimed/reviewed issue. #88 Strava and unrelated legacy Functions remain excluded.
Officer impact: None — member and officer tasks/screens are unchanged.
Officer documentation: None — no officer procedure changed; engineering evidence remains in
SECURITY.mdandOPERATIONS_RUNBOOK.md.