CI-001D2 — Initialize and prove staging email/password Auth #671

Outcome

Initialize Firebase Authentication only in the isolated run-mprc-staging project, enable email/password sign-in with conservative defaults, and prove the resulting provider behavior using one disposable synthetic identity. The deployed Auth contract must come from an exact reviewed main commit.

Officer impact: Officers gain a staged account backend for made-up sign-in testing. This does not enable production member sign-in or change any real account.

Officer documentation: Update OFFICER_START_HERE.md, docs/officers/README.md, the affected auth/system map guide, OPERATIONS_RUNBOOK.md, SECURITY.md, SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, and GITHUB_ISSUES.md.

Deployment evidence: None at creation. Closure requires exact source commit, CI, staging Auth configuration readback, synthetic create/sign-in/delete proof, final zero-user proof, billing proof, unchanged Hosting and Firestore proof, and explicit production non-mutation.

Invariants

• Use only runmprc@gmail.com for provider work.
• Target only run-mprc-staging with every command naming the project and account.
• Keep Cloud Billing disabled before and after the change. Stop before any Identity Platform upgrade or paid feature.
• Merge the source-controlled Auth contract before provider mutation, then deploy only Auth from the exact main commit.
• Enable email/password only, with password required.
• Keep anonymous and phone sign-in disabled.
• Do not enable Google sign-in in this slice. Google OAuth branding, ownership, collision recovery, and UI belong to AUTH-006 — Offer simple email/password and Google sign-in #109 and its dependencies.
• Enable improved email privacy when supported by standard Firebase Authentication.
• Authorized redirect domains may contain only the staging Firebase and web.app domains. Do not add localhost or runmprc.com.
• Do not send verification, password-reset, or other email.
• Use one generated RFC-reserved example.invalid address and a generated password held only in process memory.
• Delete the exact synthetic user in cleanup and prove the final Auth user count is zero.
• Do not deploy Functions, Rules, indexes, Hosting, Storage, App Check, Stripe, or any production Firebase surface.
• Do not read or modify real member/customer data.

Source phase

• Add an Auth providers contract to firebase.json with emailPassword true and no anonymous or Google provider.
• Add a focused source test that fails on broader providers, a non-demo default alias, or an unexpected deploy target.
• Integrate the focused test into the relevant CI gate.
• Document current and not-yet-available states in engineering and officer surfaces.
• Open, self-review, pass CI, and merge the focused pull request.

Provider phase

• Reconfirm exact main commit, no billing, clean uninitialized Auth, zero users, and no unexpected provider state.
• Deploy only Auth using Firebase CLI 15.24.0 and a short-lived token minted by the club account.
• Read back Auth config and harden email/password, passwordRequired, anonymous, phone, authorized domains, and email privacy with a narrow update mask if needed.
• Prove email/password account creation and sign-in through the public Identity Toolkit API using the disposable identity.
• Prove anonymous signup is rejected.
• Prove non-existent and wrong-password sign-in errors do not enumerate accounts.
• Delete the disposable user even when an assertion fails, then prove final zero users.
• Reconfirm billing disabled, Firestore root collections empty, Hosting version unchanged, and production untouched.
• Record provider truth in a second documentation-only pull request, pass CI, self-review, and merge.

Acceptance criteria

• Source Auth contract is merged from a focused reviewed pull request.
• Exact deployed source commit and Firebase CLI version are recorded.
• Staging billing is false before and after.
• Auth subtype remains FIREBASE_AUTH and no paid Identity Platform upgrade occurs.
• Email/password is enabled with password required.
• Anonymous and phone sign-in are disabled.
• No Google, SAML, OIDC, or other identity provider is enabled.
• Improved email privacy is enabled if available without billing; otherwise the exact limitation is recorded and no upgrade occurs.
• Authorized domains are exactly the two staging-owned domains and exclude localhost and production.
• Synthetic create and sign-in pass.
• Anonymous signup fails safely.
• Enumeration-resistant negative behavior is recorded without exposing raw credentials or tokens.
• Synthetic user cleanup succeeds and final user count is zero.
• No email is sent.
• Firestore remains empty and staging Hosting remains on its prior version.
• Production Firebase, runmprc.com, Netlify, Functions, Rules, indexes, Storage, Stripe, and outside providers are unchanged.
• Officer and engineering documentation distinguish source merged, staging deployed, and production not available.

Stop conditions

Stop if billing is required, any existing Auth user or unexpected provider is present, any real email or member data would be needed, cleanup cannot be proved, the exact main commit is not deployable, a broad Firebase deployment would run, or any production surface would change.

Dependencies and coordination

Parent release: #136.
Protected deployment identity: #133.
Backend tracker: #105.
Google sign-in product work: #109.
This issue does not satisfy the Functions or App Check portions of #136.

Claim protocol

Creation is not a claim. Assign one agent and post CLAIMED by Codex at UTC timestamp; branch codex/issue-number-staging-auth before changing source or provider state.