TEST-001A1 — Add the fail-closed synthetic provider test harness #175

Outcome

Create one dependency-free, Functions-test-only safety harness that later Stripe/Firebase suites can reuse without real people, live credentials, production projects, or outside network access.

This is the first atomic child of catalogued TEST-001A. It deliberately excludes the build/test-artifact scrubber and its CI/release integration; publish that as TEST-001A2 after this foundation merges.

Dependency and claim

• Parent/catalog slice: TEST-001A
• Dependency: CI-001A / CI-001A — Repair the deterministic frontend test baseline #103 — complete
• Base: acaa961058177ea7266d489c9537a22802b0905e
• Canonical owner: /root
• Branch: codex/issue-175-test-safety-harness
• One outcome at a time; do not combine payment runtime, Firebase deployment, provider configuration, or artifact scanning.

Exact owned paths

• functions/testSupport/testSafety.js (new)
• functions/testSupport/jestSafetySetup.js (new)
• functions/testSupport/testSafety.test.js (new)
• functions/package.json (Jest setup registration only; no dependency or lockfile change)
• functions/stripeWebhook.test.js (adopt the shared signed-request helper only)
• SECURITY.md (minimum exact status/risk hunk)
• GITHUB_ISSUES.md (minimum child/status mapping)
• GITHUB_ISSUE_SLICES.md (minimum child/status mapping)

Everything else is immutable for this issue.

Security invariants

• Every identity/commerce fixture is deterministic, deeply frozen, and unmistakably synthetic, using reserved or non-deliverable values only; no arbitrary personal-data overrides.
• The environment guard accepts missing optional variables for pure unit tests, but any supplied Firebase project, Stripe mode/key, site origin, or emulator host must be explicitly demo/test/non-production.
• Missing required helper inputs, malformed values, production-like projects/origins, non-loopback emulator hosts, or live-mode keys fail closed with fixed errors that do not echo supplied values.
• The Jest setup installs a process-wide outbound-network guard before tests. It allows only exact loopback targets needed by opted-in emulators and blocks supported external Node transports with one fixed error.
• Guard installation is idempotent. Environment safety is checked around every test so top-level and test-local unsafe mutations fail.
• Stripe webhook signatures are generated from caller-supplied synthetic test material; no real or secret-shaped committed credential is introduced.
• The module is test-only. Runtime entry points and functions/index.js must not import/export it.

Allowed transitions and failure cases

1. Jest loads the test-only setup, validates supplied environment values, and installs the network guard once.
2. A test creates a deterministic synthetic fixture; the factory returns a fresh deeply immutable value.
3. A test makes a loopback emulator call; the supported target passes the guard.
4. A test attempts an external call through a guarded transport; it fails before DNS/provider contact.
5. A Stripe test signs deterministic raw bytes and supplies the generated header to the existing webhook test.

Reject unsafe seeds, overrides, non-demo projects, production origins, live/restricted/publishable live keys, malformed test keys, non-loopback emulator hosts, invalid timestamps/payloads/secrets, and external network targets.

Acceptance criteria

• Small deterministic member/order/contact and Stripe-event factories produce fresh deeply frozen reserved synthetic data and cannot accept arbitrary personal-data/livemode overrides.
• A shared Stripe helper returns exact raw bytes plus a valid deterministic Stripe-Signature header without logging or retaining the secret.
• A fixed environment guard positively accepts pure/synthetic cases and negatively rejects production project, live key/mode, production origin, non-loopback emulator host, malformed, and hostile cases.
• A process-wide idempotent network guard blocks fetch, HTTP/HTTPS, HTTP/2, TCP/TLS, and UDP external entry points while allowing exact loopback forms for emulator traffic.
• Deliberate negative tests prove failures and prove error/serialized text contains none of the hostile input.
• The existing webhook suite uses the shared signing helper and remains behaviorally equivalent.
• Focused and full Functions tests, Functions lint, the opt-in command-journal emulator suite, frontend Jest, SPA callback, Rules, build, link, diff, and sensitive-pattern checks pass.
• No root package, lockfile, workflow, runtime endpoint, Rules, index export, Firebase project, Stripe account, website, or provider setting changes.

Migration and compatibility

Additive test-only source plus Jest setup registration. No stored data, schema, migration, production environment, or runtime behavior changes. Later TEST-001A2 may reuse these fixed conventions while adding an artifact scrubber and named CI/release gates.

Officer impact

None. This only makes automated tests safer and more reusable; it does not change the website or an officer procedure.

Officer documentation

None — there is no officer-visible behavior, account duty, deployment step, payment operation, or data-handling procedure in this child.

Deployment evidence

Record source, tests, merge, website, Firebase, and provider states separately. Expected for this child: source/test/merge evidence only; no website publication required, no Firebase deployment, no Stripe/provider configuration, and no production behavior claim.