WEB-001A2 — Provision isolated Firebase staging and publish an exact-source Hosting site #665

Outcome

Provision one dedicated, club-owned Firebase staging project under the already authenticated runmprc@gmail.com account and publish the exact reviewed WEB-001A1 source tree to Firebase Hosting. Verify the provider URL, static assets, SPA deep routes, responsive public UI, staging identity, and rollback/expiration evidence without touching production Hosting or production data.

Parent: #460 (WEB-001)

Exact source baseline: merge a614c68d9a1a2be631a3be874a686d61e5d170a0 / tree e518cdff884b07e74b33c0e3c915ca028c518008.

Invariant and allowed transitions

• Create exactly one staging project: run-mprc-staging, display name MPRC Staging, under the club Google account.
• Create only the staging Firebase web app and default Hosting site needed for the static preview.
• Build with complete staging Firebase browser configuration and prove no known production Firebase identity appears in executable JavaScript.
• Deploy only Hosting from the exact reviewed source tree. Do not deploy Auth, Firestore, Functions, Rules, indexes, extensions, Storage data, or production configuration.
• Do not create billing, IAM/WIF, service-account keys, legacy Firebase tokens, DNS records, custom domains, or production release branches in this child.
• Do not sign in, write data, invoke commerce/provider flows, or test production member/payment behavior.
• runmprc.com, Netlify production, Firebase production Hosting, and all production data remain unchanged.

Acceptance criteria

• The club account can read the production Firebase project and the new staging project; public evidence contains no credentials or private IAM details.
• The staging project and web app use the exact approved identifiers and no production-equal field.
• The optimized artifact passes scripts/firebase-hosting-contract.js verify build and contains only staging Firebase identity.
• Firebase Hosting serves /, static assets, and direct SPA routes from the exact source tree with no broken images or document-level horizontal overflow.
• Provider readback names the staging URL and Hosting release time; a rollback/expiration path is recorded.
• Production Hosting remains empty, Netlify remains published, and runmprc.com release-marker readback is unchanged.
• Engineering and officer docs distinguish source merged, staging project created, staging site published, production not deployed, DNS unchanged, and production behavior unverified.

Stop conditions

• The project would be created outside the club account, requires billing, or collides with an existing project.
• Any staging field equals a production Firebase identity or the artifact can fall back to production.
• A command targets production Hosting, backend resources, real data, DNS, custom domains, IAM, secrets, or credentials.
• Exact source/build identity or rollback evidence cannot be proven.

Officer impact: None live. Officers continue using the existing Netlify procedure; this creates an isolated engineering staging URL only.

Officer documentation: Update OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/SYSTEM_MAPS.md, docs/officers/ACCESS_CONTINUITY.md, and docs/officers/EMERGENCY_AND_RECOVERY.md with verified staging-only truth.

Deployment evidence: Record project/web-app/Hosting metadata, exact source tree, artifact scan, public route/UI checks, production Hosting 404, Netlify release marker, and rollback/expiration status.

Claim protocol

Creation is not a claim. Post CLAIMED by Codex at <UTC>; branch <branch>; exact base <40-character SHA> before provider or source changes.