ABUSE-001A1 — Use reCAPTCHA Enterprise for browser App Check #159

Officer impact: No current officer screen or procedure changes. This source-only slice aligns the browser App Check provider with the approved reCAPTCHA Enterprise design so a later protected release can use the correct public site key.

Officer documentation: None — no officer action is usable after this slice. Provider creation, allowed domains, protected configuration, staged metrics, enforcement, deployment, and live verification remain owner/operations work under #113, #133, #136, ABUSE-001A2, and ABUSE-001C.

Deployment evidence: None at issue creation. Closure proves source, tests, review, merge, and exact-commit CI only. It must not claim a site key, provider-console configuration, callable enforcement, website/Firebase publication, or live App Check behavior.

Parent and dependencies

Atomic source child of catalogued ABUSE-001 / ABUSE-001A.

• CI source/test baseline is merged.
• Browser callback/local isolation from SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99/CI-001B1A — Run SPA callback safety tests in hosted CI #126 is merged and must be preserved.
• OBS-001 source removed Analytics and must be preserved.
• The protected release currently fails closed because REACT_APP_RECAPTCHA_SITE_KEY is absent.
• A read-only release audit recorded that current source instantiates ReCaptchaV3Provider, while SECURITY.md requires Enterprise.
• Firebase web SDK 10.14.1 already exports ReCaptchaEnterpriseProvider; no dependency change is needed.

This child only corrects the browser provider class. Native callable enforcement must be a separate ABUSE-001A2 slice after safe callback handoffs.

Problem

The browser source imports and instantiates the v3 provider. The approved security architecture and planned provider configuration require reCAPTCHA Enterprise. Supplying an Enterprise key to the v3 provider would be a configuration mismatch and could make a protected release fail or silently lack the intended control.

Atomic outcome

• Replace the browser App Check v3 provider import/constructor with ReCaptchaEnterpriseProvider.
• Preserve local/test shutdown, capability-callback shutdown, missing-key fixed diagnostic, token auto-refresh, and generic initialization failure behavior.
• Add focused tests proving Enterprise is used exactly once for an ordinary production page with a configured synthetic public key and v3 is absent/not called.
• Keep every provider key, console/IAM setting, enforcement choice, and deployment outside this pull request.
• Update only the minimum authoritative security/operations/status documentation.

Security invariants

• Never add, request, print, commit, or invent a real site key, debug token, service credential, or provider response.
• App Check does not replace Auth, verified membership, capability checks, Rules, strict schemas, rate limits, or fraud controls.
• Development/test must not initialize App Check or exchange a debug token.
• Initial Stripe/Strava/capability callback URLs must not initialize App Check or outside telemetry.
• Missing key and initialization failure use existing fixed diagnostics without provider details or tokens.
• Only an ordinary production page with a configured synthetic key may construct the Enterprise provider in tests.
• A source import/constructor change does not prove provider configuration, enforcement, token acceptance, or deployment.

Exact source boundary

• src/services/firebase/FirebaseResources.ts
• src/services/firebase/FirebaseResources.test.ts
• Minimum exact status/design hunks only in:
  • SECURITY.md
  • OPERATIONS_RUNBOOK.md
  • GITHUB_ISSUES.md
  • GITHUB_ISSUE_SLICES.md

Post a scope amendment before editing Functions, workflows, environment files, package/lockfiles, Firebase configuration values, provider settings, Rules, client screens, officer guides, or production data.

Acceptance criteria

• Production with a configured synthetic public key constructs ReCaptchaEnterpriseProvider and passes it to initializeAppCheck with token auto-refresh unchanged.
• No production source import or constructor reference to ReCaptchaV3Provider remains.
• Development and test construct neither Enterprise nor v3 providers and retain demo-only Auth/Firestore/Functions emulators.
• Every existing capability callback variant constructs neither provider and does not initialize App Check or Analytics.
• Missing-key and initialization-failure tests retain fixed redacted diagnostics and no hostile canary.
• No real key, debug token, credential, private locator, provider response, or production data appears in source, tests, docs, logs, issue, or PR.
• Node 20 focused FirebaseResources tests, full frontend Jest, standalone SPA callback tests, changed-file lint, diagnostic build, hosted CI, diff/sensitive-pattern review, and independent review pass.
• Root docs distinguish source changed, merged, provider configured, website published, callable enforcement enabled, and live behavior verified.
• No workflow, package/lock, Function, Rule, environment, provider, or production setting changes.

Excluded

• Creating or configuring a reCAPTCHA Enterprise key/project/domain policy.
• Adding a key to GitHub/Netlify/Firebase/provider settings.
• Native enforceAppCheck: true callable migration or staged metrics (ABUSE-001A2).
• Callback handoff changes (DATA-001A and OAUTH-001C/STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88).
• HMAC rate limits/TTL/alerts (ABUSE-001B/C).
• Protected deployment identity/environment or website/Firebase release (CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136/WEB-001).
• Profile/email/event behavior, Stripe behavior, dependency changes, or production testing.

Claim protocol

Creation is not a claim. Before editing: confirm exact current main, assign the issue, post CLAIMED by /root at <UTC>; branch codex/issue-<number>-app-check-enterprise, apply status:in-progress, and use an isolated worktree.