Repository navigation
COST-001 — Bound the minimal profile backend and document lean community scope #683
Description
Outcome
Reduce potential resource spend for the two profile Functions without changing public pages, profile schema, authorization, or existing records. Record the owner-requested low-complexity community-first direction before any billing activation.
Dependencies: source-only #118, #674 and #676 are complete. Parent #136 release and #133 deployment authority remain separate; this child does not bypass them.
Scope and invariant
- Both createMemberOnSignUp and ensureMemberProfile receive the same explicit runtime resource settings: minInstances 0, maxInstances 2 per Function, memory 256MB, timeoutSeconds 30.
- Retain CommonJS, the current Node runtime and lockfiles, trigger identities, App Check/auth behavior, create-once/retry/claim preservation, and the exact paired staging deploy scope.
- Add real SDK endpoint-metadata tests as well as existing behavioral regression checks. Configurations bound scaling, not total dollars; document cold starts, saturation/429 and uncertain timeout outcomes.
- Document static-first public information, optional secure accounts, and no activation of custom commerce, automatic email, photo uploads or provider polling in the initial profile release. Preserve all existing source and separately owned future requirements.
- No billing/card selection, API/IAM change, deployment, real account/data test, DNS or production action.
Acceptance
- Both emitted Function endpoint manifests contain the exact four limits and unchanged trigger types.
- Removal of either limit binding fails a test; existing profile create/retry/concurrent/preserve/denial tests pass.
- Focused contract tests, Functions lint and relevant full suite pass with no cloud credentials or external provider access.
- Officer guide states purpose, approver, prerequisites, steps, expected result, stop conditions, proof, undo and escalation, and distinguishes source from live settings.
- Reviewed PR and exact-main checks recorded before source closure. Provider readback, burst/cold-start quality checks, budgets/eligible spend caps and runtime maintenance remain explicit release prerequisites.
Officer impact: Preserve the community website and account behavior while preparing a smaller, cost-conscious backend. No officer billing or terminal work is added.
Officer documentation: New docs/officers/LOW_COST_COMMUNITY.md, linked from OFFICER_START_HERE.md and docs/officers/README.md; update SYSTEM_DESIGN.md, OPERATIONS_RUNBOOK.md and GITHUB_ISSUES.md.
Deployment evidence: Source-only; no website or Firebase deployment and no outside-provider mutation. Billing state must be reported separately, not inferred from tests.
Activity
daliu commentedon Sep 12, 2026
CLAIMED by Codex for source-only COST-001 on 2026-09-11; exact baseline 1f27b06; branch codex/issue-683-low-cost-profile. No provider or payment action is part of this slice. The owner accepts using their own card as fallback, but that does not establish that the previously offered personal payments profile is theirs.
daliu commentedon Sep 12, 2026
Source implementation and review are in PR #684 at 5a2def3. All five exact-head CI jobs and their steps passed in run 34667440575: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34667440575 . The normal merge was rejected by the required approving-review rule; no admin override or protection change was used. This source issue remains OPEN until merge and exact-main checks satisfy its acceptance criteria. Provider/billing/Functions deployment and hosted quality remain separate release gates; no production change is claimed. Detailed review, test, officer and surface evidence is in the PR comments.
Bound minimal profile backend costs and document lean community scope (…
daliu commentedon Sep 15, 2026
Source completion — 2026-09-14 Pacific
PR #684 merged using Dave's explicit, one-time administrator-override authorization. Exact main commit: 925a677. Its full tree matches reviewed head 5a2def3; main is still at that merge. No new source edit or dependency/lockfile change was made during this merge turn.
Reviewed-head CI: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34667440575
Exact-main CI: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34925782625
Both runs passed all five jobs; inspected step details show every listed step succeeded, with no skipped workflow step. The jobs cover frontend lint/Jest/SPA/workflow safety/build/artifact verification, Functions lint/tests, Firestore Rules emulator, command-journal concurrency emulator, and test artifact safety. The previously documented emulator-dependent skips inside the plain Functions unit suite are not being represented as executed there; the dedicated emulator jobs ran and passed.
The merge exception did not change branch protection: one approving review remains required, with the same existing administrator exemption. No independent approval is fabricated.
Officer impact: Conservative resource settings and a community-first scope are now in main. No public feature or existing member record is removed.
Officer documentation: docs/officers/LOW_COST_COMMUNITY.md plus its two officer entry links and root design/operations/issue records were included in the merged PR. Rechecked the guide as a backup officer: purpose, approver, prerequisites, steps, proof, stop, undo and escalation are present; provider setup, release and rollback still explicitly require a specialist.
Deployment evidence: Source changed, tests passed, code merged. No website or Firebase deployment was requested/executed in this turn; runmprc.com and outside-provider state were not reverified, and no billing/card/API/IAM/DNS or production-data action was performed. The September 11 disabled/unlinked billing read is historical evidence, not a fresh September 14 check. Hosted limits, cost savings and production behavior are NOT verified by this source closure.
No migration is required; schema, claims, authorization/App Check, transactions and retry semantics are unchanged. Existing #113/#133/#136 release prerequisites, runtime maintenance, cost controls and synthetic cold-start/burst/recovery checks remain open. Close only source issue #683, not the backend-release goal.