CI-001D3 — Guard staging-only profile Functions deployment #674

Outcome

Add a fail-closed source contract for deploying only the two reviewed profile Functions, createMemberOnSignUp and ensureMemberProfile, to the isolated run-mprc-staging project. Prove the contract in CI and document the current billing prerequisite without enabling APIs, linking billing, or deploying a Function.

This is a source-only dependency child of #136, #133, and #105. It does not satisfy the staged Function deployment, App Check, synthetic E2E, production authority, or production release portions of those issues.

Invariants

• The only allowed cloud target is run-mprc-staging and the only allowed operator account is runmprc@gmail.com.
• The only allowed deploy scope is functions:createMemberOnSignUp,functions:ensureMemberProfile.
• The repository default alias remains demo-mprc-local.
• Missing or mismatched project, quota project, account, deploy scope, short-lived token, source exports, or lockfile CLI must fail before Firebase CLI.
• A credentials file, broad functions target, Firestore, Auth, Hosting, Storage, production project, or extra Function must be rejected.
• Failure output is fixed and cannot echo supplied context.
• This issue performs no provider mutation, API enablement, billing action, deployment, data write, synthetic account creation, or production action.
• Record billing as a separate financial authorization gate. Do not create or link a Cloud Billing account in this issue.

Acceptance criteria

• A small contract validates the exact source exports, demo-only default alias, staging project/account/quota context, exact two-Function scope, and short-lived in-memory token requirement.
• Package scripts pin the focused contract test, predeploy check, lockfile Firebase CLI, exact Function names, exact staging project, and non-interactive mode.
• Negative tests reject every broader Function scope, production target, wrong account/project/quota project, credentials file, missing token, unexpected arguments, and changed source export.
• CI runs the focused contract test without any cloud credential or deployment.
• Current provider preflight records only redacted facts: the club account has project authority, billing is disabled, and zero open billing accounts are visible.
• Engineering and officer documentation distinguish guard merged, billing not authorized, Functions not deployed, App Check not configured, website unchanged, and production unchanged.
• Focused checks and the applicable full local suites pass; pull-request and post-merge CI pass before closure.

Officer impact: The repository gains a safe staging-only command shape, but officers still cannot publish the profile backend. Billing approval and the protected provider release remain NOT AVAILABLE YET.

Officer documentation: Update OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, and the matching engineering runbook/security/status records.

Deployment evidence: Source and test evidence only. Explicitly record that Firebase Functions, APIs, billing, Firestore, Auth, Hosting, outside providers, production Firebase, and runmprc.com are unchanged.

Stop conditions

Stop if work would create or link billing, enable a cloud API, grant IAM, deploy any Function, alter data, use a real user, expose provider locators or tokens, require a broad Functions target, or touch production.

Claim protocol

Assign one agent and post CLAIMED by Codex at UTC timestamp; branch codex/issue-number-staging-profile-functions-guard before editing.