Activity

1. daliu

   self-assigned this

   on Oct 13, 2026
2. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Continuing this outcome in the reused clean managed worktree, from reviewed main fc310db. First connect strict native-context routing and bounded read-only fictional status, then client/screen and exact hosted acceptance. Existing community/profile behavior and six-permission/min0/max2 runtime remain in scope; no production, payments, new service/dependency/workflow or broadened IAM. Source changes are not deployed proof. Officer impact: supervised fictional race screen remains NOT AVAILABLE YET until native/UI/cleanup acceptance. Officer documentation: affected staging guide/maps and root status will distinguish source from hosted truth. Deployment evidence: none for this child yet; previous unchanged community v5/Hosting proof is historical.
3. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Review split: #732 and PR733 isolate exact callable routing, private bounded read-only status and deterministic backend archive from this parent client/native release. Final local focused 218 tests, Rules444, authority/release53 and actual demo10 pass; native HTTP verifiers are mocked and demo caller context is synthetic. No deploy/Hosting/hosted fixture/IAM/payment/production action. This parent stays OPEN for strict client/screens, exact backend-first native release/security/UI/mobile/failure/expiry/retry and fenced hosted cleanup. Officer impact: race screen still NOT AVAILABLE YET. Officer documentation: source-only guide and maps in PR733. Deployment evidence: none for the race child yet.
4. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   #731 source screen merged; native acceptance remains open

   PR734 merged669e2fb454fe46d22e0ff8c6034b694b2c7957c0 at2026-10-13T19:33:24Z, exact reviewed headf1bb18e. PR CI38455181292 passed all six exact jobs and every step, no skipped steps: frontend1,463, Rules444, Node20 Functions7,964/80 emulator-only skips, Node22 SDK7,981/63 separate-journal skips, journal63, SPA11, release192 and scrubber37. The first run's stale126-file fixture was reproduced, corrected to131 with five zero-debt assertions, and is not acceptance evidence.

   Officer impact: Fictional signup/credit-return/private transfer screen source is merged, not yet usable or hosted-qualified. No real money or club rules.
   Officer documentation: STAGING_COMMUNITY planned screen review, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and relevant root status; setup/release/security/cleanup/rollback remain specialist-only.
   Deployment evidence: Main CI38455775086 pending. Fresh native read-only owner/MFA/archive/resource/invoker/profiles/Hosting checks still prove priorv5/485be670/a4c2eefa with profiles2/1/2843388 unchanged. Auth/Firestore App Check ENFORCED. No race deployment, hosted fixture, receiver/grant or genuine race UI/security proof claimed.

   Next: exact main checks, changed backend archive first, dependent staging Hosting, genuine disposable security/screens/privacy/failure/retry/expiry/recipient-loss/mobile, then fenced owned cleanup/late absence/sign-out and no-terminal handoff. #731 and full backend goal stay open. Production and real payments untouched. Synthetic diagnostic output cleaned; reviewed source/current rollback evidence retained.
5. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   #731 staging deployment checkpoint — signed-in acceptance pending

   The fictional race source and screen are deployed in staging, not qualified for club use. Production and real payments were untouched. #731 and the full backend goal remain OPEN/ACTIVE.

   Officer impact: The anonymous fictional-race page is published; supervised signed-in signup/refund-credit/transfer acceptance is still NOT AVAILABLE YET. No real race, policy or money action.
   Officer documentation: The staged source guide/maps/entrypoints will receive this dated checkpoint; earlier SOURCE/NOT DEPLOYED paragraphs are historical source-review milestones. Fixture supply, signed-in security/tests/cleanup and rollback remain specialist-only.
   Deployment evidence: PR734 merged669e2fb454fe46d22e0ff8c6034b694b2c7957c0; exact PR38455181292/main38455775086 passed all six jobs and every step. Final frontend1,463, Rules444, Node20 ordinary7,964/80 emulator-only skips, Node22 SDK7,981/63 separate-journal skips, journal63, SPA11, release192/scrubber37 passed. The first failed126-file fixture run is not acceptance; correction is explicit and no gate weakened.

   Fixed one-Function release and independent read-only verifier both exit0. Native communityActionsv6 source669e2fb, downloaded101,386-byte archiveSHA25694380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87. Existing club owner/MFA, six runtime permissions/zero user keys, min0/max2/256MB/30s, fixed invoker bindings and unchanged profiles2/1/source2843388 passed. No new IAM authority, Function/service/dependency/workflow/scheduler or real financial provider.

   Backend verified before dependent Hosting exit0. Public marker source669e2fb/function94380430, actual/community/races HTML and main.b57aa672.js bytes match the local published build (mainSHA256500105f40cd0dbfd022c50728ae99d14dd065d7170eecb91b4c29288e33ad250). Native Auth/Firestore App Check ENFORCED on the prior-state refresh; release did not change its configuration. Two actual requests with no Auth and missing/invalid attestation returned401/UNAUTHENTICATED; that does NOT isolate attestation or qualify signed-in caller/grant/privacy tests.

   Actual Chrome signed-out page showed fictional credits/no real money, sign-in and zero mutation buttons. At390x844 scroll/client widths both390; screenshot retained, viewport restored. This is anonymous route/layout proof, NOT lifecycle/private-state/mobile-controls acceptance. No hosted fixture/account/record/permission, receiver or network grant was created in this slice. Synthetic diagnostic build removed with exact generated-path/no-open-handle checks; source/current published build/rollback evidence retained.

   Remaining: genuine disposable signed-in security/caller binding/private status and signup/cancel/offer/accept/revoke, stale/lost-response exact retry, expiry/revocation/recipient-loss/mobile, then exact owned account/document cleanup with identity/update-time fences, late absence/sign-out/tab/receiver/grant restoration and qualified no-terminal handoff. Temporary local receiver permission was requested asynchronously; do not start it without the human answer. Real policy/provider-money/production remain separate.
6. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   #731 corrected staging release; signed-in acceptance remains open

   PR734/669e2fb deployed communityActionsv6 once; exact downloaded101,386-byte94380430 archive, owner/MFA/six permissions/zero keys/min0max2/256MB30s/invoker/unchanged profiles2/1 verified. Backend before original Hosting. No production or real payments.

   PR735 corrected selected-offer recovery after its unchanged regression failed: Refresh now retains B after B's failed lookup, not previous A. Final79/type/lint/no-debt pass; exact PR38461018295/headf9c5fc6 and main38463003546/mergee21be3546b40fc1114ccce56570726644187ce4b all six jobs/every step completed success/no step skips. Full frontend1,464; ordinary7,964/80 emulator-only skips, SDK7,981/63 separate-journal skips, journal63/Rules444/release192 passed.

   Independent read-only verifier reviewede21be35/deployed669e2fb/v6 and identical94380430 archive; no repeat Function build. Corrected Hosting exit0/sourcee21be35. Public marker/route HTML/main.db8aa0ba.js bytes match; mainSHA256e586f22cd21c8e6234f0178496099f48475f863780ec9880445e5fdb30190d0b. Actual reloaded anonymous screen and390×844 no-overflow/zero-actions proof retained in final-signed-out-mobile.jpg. This is NOT genuine signed-in recovery/lifecycle/security proof.

   Officer impact: Deployed staging code, but supervised signed-in race flow NOT AVAILABLE YET pending acceptance; no real policy/refund/transfer.
   Officer documentation: Current checkpoint/procedure/maps and root/entrypoints distinguish dated deployment from remaining tests; source changes merged, website published, native backend verified, signed-in behavior unqualified. Dave/specialist still supplies fixtures/permissions, tests, cleanup and rollback.
   Deployment evidence: Exact native/CI/public-asset receipts above; prior two uncredentialed/unattested requests denied, not isolated App Check or signed-in coverage.

   Cleanup: no hosted fixture/account/document/permission/receiver/network grant created in this slice. Synthetic diagnostic build removed after exact generated-path/no-open-handle checks. Viewport reset; owned Chrome43593934 remained signed out and was closed. All release/build/watch processes completed. Useful source/current build/rollback/receipts/screenshots retained; primary/foreign changes and sitemap untouched.

   Next: human answer to the temporary local-receiver question before any such grant; otherwise website-only testing. Genuine disposable signed-in Auth/App Check/caller/marker/capability/private status and all signup/cancel/offer/accept/revoke, stale/lost-response/exact retry/expiry/revocation/recipient-loss/mobile, then fenced owned cleanup/late absence and qualified no-terminal handoff. #731 OPEN/full goal ACTIVE; production/real provider payments remain separate.
7. daliu commented on Oct 13, 2026

   

   daliu

   on Oct 13, 2026

   ContributorAuthor

   More actions

   #731 website-test preparation and cleanup — 2026-10-13

   Outcome: native fixture setup and exact cleanup are verified; signed-in race acceptance did not run. Stop before the login's “By continuing you agree” submission until the human confirms disposable staging sign-in. Terms/Privacy are labelled placeholder templates; this is not approval of real policy. Local receiver permission also remains unanswered, and no receiver/network grant was started.

   Officer impact: Fictional race flow remains NOT AVAILABLE YET for qualified officer/member use. No real race, payment/refund or legal policy decision.
   Officer documentation: Existing unavailable staging procedure remains accurate. This private setup/cleanup receipt and login screenshot identify the specific approval boundary; no officer terminal/secret/record edit.
   Deployment evidence: Current clean e21be35/nativev6/669e2fb/101,386-byte94380430 independently reverified before tests. No source, deployment, provider configuration, IAM, service, dependency, production or real payment change.

   Setup: two random-nonce example.invalid accounts, exact native UID/email/create-time readback. A random password stayed in browser/Node memory, passed only as RSA ciphertext/public key between runtimes; no credential file or plaintext/token output. Existing explicit OAuth2 Firestore client/staging quota headers performed bounded own-path reads. Generic Admin credential was rejected before mutation; VM/SDK transaction helpers failed with exact absence confirmed. Native preconditioned REST commit created exactly thirteen absent fictional event/policy/target/permission/manifest documents. No shared record was overwritten; no Auth claim/role edit or email sent. Helper defects are preparation evidence, not race-runtime failures or genuine caller proof.

   Browser: owned tab43593938 opened real staging login from the race sign-in link. No credential was typed, Sign in never submitted, and no race command executed. Public login screenshot signin-approval-2026-10-13.jpg retained with the dated written handoff. No app/token state extracted through DOM tools.

   Cleanup: disabled both own-entry permissions first using exact native update-time fences. Deleted only the two owned Auth accounts after UID/email/create-time comparisons, then thirteen owned fixtures and two implicit profiles using nanosecond update-time preconditions. Immediate and later exact Auth/document absence passed (2 accounts/15 docs). No live fixture retained while awaiting consent. Owned unsigned-in tab closed; no viewport/network override, receiver or grant. Test clients closed; password/RSA private key/credential bindings discarded. Source/current/rollback evidence retained, primary/foreign changes/sitemap untouched.

   Remaining: human confirmation of disposable sign-in at the shown agreement notice; separate temporary receiver answer before any such connection. Fresh owned fixtures required next time. Genuine signed-in Auth/App Check/private status/actions/failure/retry/expiry/revocation/recipient-loss/mobile and post-test cleanup remain open. #731 and the full backend goal stay OPEN/ACTIVE. Previous turn was real deployment progress; this turn verified native setup/cleanup and surfaced the missing approval, not completion.
8. daliu commented on Oct 15, 2026

   

   daliu

   on Oct 15, 2026

   ContributorAuthor

   More actions

   Outcome — actual fictional website flow passed; #731 remains OPEN

   On 2026-10-14 the human confirmed disposable staging sign-in. Tested the published run-mprc-staging.web.app/community/races in the in-app browser using two uniquely owned fabricated example.invalid accounts, native website email/password sign-in and normal App Check. Production and real payments were untouched. No fake claims, debug attestation, new service, local receiver, network grant or deployment.

   Officer impact: signup, simulated full credit return, private recipient-accepted same-bib transfer and owner revoke now have actual staging screen proof. Important access and expiry checks also passed. The planned officer flow remains NOT AVAILABLE YET until remaining acceptance is proved.

   Officer documentation: None — no usable procedure, source or release changed. Existing guides still correctly mark #731 unavailable. This dated receipt is the current acceptance/handoff evidence; earlier source-only/no-sign-in notes are historical.

   Deployment evidence: read-only node scripts/staging-community-release.js verify passed against clean reviewed e21be3546b40fc1114ccce56570726644187ce4b, deployed Function source 669e2fb454fe46d22e0ff8c6034b694b2c7957c0, version6, 101,386 bytes, SHA256 94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87. Existing owner/MFA/runtime/invoker/profile/resource guards passed; Hosting marker stayed e21be35. No new build/deploy or billing/IAM/provider change was made. Production/runmprc.com was not tested or changed.

   Actual proof

   • 11 successful immutable commands: four joins, three offers, one revoke, two cancellations/full credit returns and one acceptance. Owner-only readback verified the exact fictional records, receipts and audit correspondence.
   • Cancellation returned exactly 1,000 fictional cents, released the seat and offered no new signup for that prior enrollment. No money moved.
   • Recipient acceptance kept the same entry and bib, consumed the offer, preserved the original credit owner and used one seat/one transfer. Recipient cancellation preserved that credit owner and released the seat; original runner history remained transferred.
   • Recipient own status did not show the other runner's private history. Named lookup of the other's cancelled entry and a nonexistent ID produced the same unavailable message. Failure cleared old sections; Refresh retained failed lookup focus; Show only my entries recovered current own state.
   • Capability revocation rejected a stale on-screen offer without an entry change. The explicit saved retry succeeded once after restoration. This is failed-before-write retry, not proof of replay after a committed/lost acknowledgement.
   • Owner refresh/revoke still worked after the named disposable recipient's target marker and native Auth account were disabled. Current owner recovery was not blocked by recipient loss.
   • A short original event deadline set before signup/offer expired naturally. Stale acceptance sections disappeared automatically; the subsequent named refresh was denied. The original entry updateTime and offer deadline did not change across expiry.
   • With real current browser identity, marker disabled, capability absent, native email unverified and native account disabled each independently denied private own-status reads. Restoring authority restored status; final permission revocation cleared it again.
   • Actual signed-in 390×844 layout had no horizontal overflow (clientWidth=scrollWidth=390). Viewport reset, final sign-out visible and test tab closed. Existing user Chrome/cloud tabs were left alone.

   Cleanup

   Both owned permissions disabled first/read back false. Both Auth accounts checked against exact UID/email/create time before deletion. All 48 owned documents checked for ownership/create time and deleted atomically using native nanosecond updateTime preconditions: 13 seeds, two implicit profiles, four entries, five enrollment indexes, eleven receipts, eleven audits, two rate records. Immediate and late checks found no accounts and nothing at all 51 exact candidate paths (three indexes were never created). No broad account/roster query or real record used. Private credentials cleared and both kernels reset; no receiver/grant/process to revoke. Only bounded redacted test evidence/screenshots, existing build/rollback and the clean checkout remain for the open acceptance.

   Still required before closure

   1. Isolated genuine Auth/App Check missing/invalid-attestation, caller-binding and unsupported-tenant negative cases. A separate disposable REST sign-in without App Check returned HTTP401 before issuing any token; do not count it as a callable denial with valid Auth.
   2. Committed immutable replay/lost-response proof, including replay after recipient loss. The UI saved retry above is narrower evidence.
   3. Reconcile the final acceptance and no-terminal officer guide after these gates pass. Fixture supply, provider verification, controlled network/token testing and cleanup remain specialist-only; officers must not use a terminal or supply real details.

   The optional local-only receiver for disposable-account Auth/App Check credentials remains OFF and needs separate human approval. Fresh owned fixtures will be needed for later tests; do not recreate today's deleted nonce or leave accounts waiting for approval. Keep the original backend objective incomplete and #731 open.
9. daliu commented on Oct 15, 2026

   

   daliu

   on Oct 15, 2026

   Last edited by daliu

   ContributorAuthor

   More actions

   Outcome — receiver safely stopped; remaining #731 tests not completed

   The human approved a temporary local-only receiver for disposable staging Auth/App Check tokens, memory-only handling, shutdown and permission revocation. Approval is now granted; do not ask for it again for the same scope.

   Officer impact: no change to available officer/member procedures. Earlier Oct14 actual fictional lifecycle/privacy/expiry/mobile proof in receipt6181945856 remains valid, but native token-boundary and committed/lost-response replay acceptance remain unproved. #731 stays OPEN, planned officer flow NOT AVAILABLE YET, original full backend objective incomplete.

   Officer documentation: None — no procedure, source or release changed. This dated receipt records the new approval and unsuccessful test attempt separately; existing unavailable guides remain accurate.

   Deployment evidence: refreshed read-only staging-community-release.js verify passed reviewed clean e21be35/deployed669e2fb454fe46d22e0ff8c6034b694b2c7957c0/v6/101386-byte archive94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87. No new build/deployment, service, IAM, billing, dependency, production or real-payment work.

   The receiver bound only127.0.0.1 on an OS-assigned port, exact staging Origin/path, closed two-fake-UID envelope,24KB limit, no request logs and20-minute expiry. It rejected foreign Origin403/wrong method405/invalid envelope400. These are receiver checks only, not Firebase security acceptance.

   After absence checks, two fresh verified fake example.invalid accounts and nine create-only fictional fixtures were provisioned; two implicit profiles followed. Normal website sign-in/status succeeded. Chrome repeatedly switched away before the console step; an idle-tab request was submitted. No sender snippet was entered/executed. Browser security separately blocked direct site-permission settings access. That blocked action was not attempted through another surface or workaround. No local-network prompt accepted, no permission granted or changed, zero tokens captured, no negative-callable/replay tests and no race command.

   Cleanup: receiver explicitly closed and empty; both temporary permissions disabled first; exact UID/email/create-time-fenced Auth deletion; eleven owned documents atomically deleted with native updateTime preconditions. Immediate AND late absence passed for both accounts and nineteen exact candidate paths, including implicit profiles; the two owned command subcollections were empty. Former receiver port returned ECONNREFUSED. Signed out visibly, closed owned staging/empty helper tabs, preserved user tabs, cleared private credentials and reset both kernels. No fixture/server is left waiting for user input. No new local-network grant was made, so none from this attempt needed revocation; pre-existing permissions were not inspected or changed.

   Next attempt: idle dedicated Chrome tab, fresh owned fixtures, and a policy-compliant way to revoke any new local-network grant. If browser settings access remains blocked, the human must handle that step; do not circumvent the browser security policy. Keep tokens private/in memory and production/real payments untouched.
10. daliu commented on Oct 15, 2026

    

    daliu

    on Oct 15, 2026

    ContributorAuthor

    More actions

    Outcome — remaining native race tests passed; final handoff gate still open

    On 2026-10-14, 38 native check evaluations passed (27 distinct checks), including a genuine lost-response test on the published member screen. Earlier receipt6181945856 separately proves the complete fictional signup/credit return/same-bib recipient acceptance/revoke/privacy/natural-expiry/mobile flows. Production, real members, real payments and club policy remain untouched.

    Officer impact: actual staging identity and replay acceptance now exists, not just mocks or emulator proof. #731 remains OPEN until the human confirms the temporary Chrome permission is Block and the officer/root documentation is reconciled/reviewed. The published officer procedure is still NOT AVAILABLE YET; fresh specialist-supplied fake fixtures will be required for later supervised use.

    Officer documentation: None in this test-only checkpoint — native evidence is complete, but manual browser permission cleanup is awaiting confirmation. Do not relabel the existing planned procedure usable prematurely. Next documentation-only handoff must reconcile STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and affected root checkpoints without another cloud build.

    Deployment evidence: refreshed native read-only verifier succeeded on clean reviewed e21be35, deployed669e2fb454fe46d22e0ff8c6034b694b2c7957c0/communityActionsv6/101386-byte archive SHA25694380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87. Existing owner/MFA, six runtime permissions/zero keys, invoker, min0/max2/256MB/30s and unchanged profile versions passed. Earlier exact PR/main six-job evidence and Hosting/assets e21be35 remain the reviewed source/publication checkpoint; this turn ran hosted acceptance, not a new local full suite or deployment. No source, Rules, dependency, workflow, service, IAM, billing or real-provider configuration changed.

    Genuine identity and private read checks

    The official matching Firebase11.10.0 browser SDK signed in the exact verified disposable account with native email/password and normal reCAPTCHA Enterprise App Check. No custom-token identity, fake claim flag, debug attestation or production credential was used. Browser-only test code had exact staging origin/project/fake-email/UID fences. Test token maps stayed inside Chrome, never printed or sent to the receiver or written to evidence/log files. Normal SDK browser persistence was explicitly signed out/cleared at cleanup, including exact matching staging App Check cache removal/readback.

    • Valid native Auth and App Check:200. Closed status keys and populated entry projections omit contact fields, other runner/credit-owner UID fields, capacity/counts and private waiver/offer records.
    • Missing Auth with valid App Check:401 UNAUTHENTICATED.
    • Invalid Auth with valid App Check:401 UNAUTHENTICATED.
    • Valid Auth with missing App Check:401 UNAUTHENTICATED.
    • Valid Auth with invalid App Check:401 UNAUTHENTICATED.
    • Substituted accountUid:403 PERMISSION_DENIED.
    • Extra browser admin/authority field:400 INVALID_ARGUMENT.
    • Malformed named entry ID:400 INVALID_ARGUMENT.
    • Current disabled/expired caller marker, missing/expired own-entry capability, current native unverified email and disabled native Auth each independently deny403 despite otherwise valid cached native credentials. Restoration succeeds200.
    • Existing staging multi-tenancy is disabled. Native Firebase Auth rejects an unsupported tenant with400 INVALID_TENANT_ID and issues no token. This is provider-level default-tenant boundary proof; no valid nondefault-tenant token/tenant resource was created or claimed tested.
    • All initial read/negative cases left both exact fake command subcollections empty. The closed private projection and token/schema cases were repeated after private entries existed.

    Actual UI committed/lost-response retry

    1. Exact fake entry was absent before signup. A one-shot origin/endpoint/action/account/event-fenced browser fetch wrapper left the generated command untouched, let the real server return200, then discarded that response body before the member application received it. The wrapper restored normal fetch immediately; it never read or printed a bearer token or request body.
    2. Actual member screen cleared every race section and showed the uncertain-action message plus Retry saved action.
    3. Independent owner REST reads proved one committed entry/revision1, one seat, one immutable receipt and one audit before Retry.
    4. Selecting Retry saved action on the actual screen recovered the confirmed entry. All six protected native updateTimes remained unchanged: entry/event/receipt/audit/enrollment/rate. No extra seat, command or audit.
    5. Direct genuine native replay returned the exact original acknowledgement. After actual UI cancellation returned1,000 fictional cents/released its seat, replaying the original join still changed none of those six records and did not resurrect the cancelled entry. Current caller revocation later denied the committed replay.

    Screenshots: lost-response-before-retry-c1386c7962c1.jpg and lost-response-recovered-c1386c7962c1.jpg, private task evidence only, no real member/payment data.

    Recipient-loss and immutable recovery

    A separate native fake join/offer committed. The exact marked recipient's target and native Auth account were then disabled. Owner replay returned the identical original offer acknowledgement/deadline; changing content under its request ID was denied. Owner revoke still succeeded; exact revoke replay returned the same acknowledgement. The original offer receipt/audit/event/index updateTimes stayed unchanged. The entry advanced exactly once to revision3 with no offer and the original runner/credit owner retained. No second seat or extra replay receipt.

    Receiver correction and cleanup

    The approved receiver was restricted to127.0.0.1/exact staging Origin/path/two fake UIDs/bounded JSON/no logs/20-minute expiry. Its foreign-origin403/method405/envelope400 checks passed, but Chrome denied loopback requests even after the human reported enabling local access and a page reload. Zero bootstrap deliveries and zero token captures. Rather than bypass that denial, the unused receiver was closed and a materially safer browser-only harness performed the native tests; no further loopback request was needed. The previously blocked browser settings action was not attempted through another surface. Do not request receiver approval again for the same scope.

    Both fake permissions were disabled first. Two Auth accounts passed exact UID/email/create-time checks before deletion. All26 owned documents passed path/create-time/identity checks and were atomically deleted using native nanosecond updateTime preconditions:9 seeds,2 implicit profiles,2 entries,2 enrollment indexes,5 commands,5 audits,1 rate record. Immediate and late absence passed for both accounts and all29 exact candidate paths, including delayed profiles. Only the two fake command subcollections were listed, never a real roster. The former receiver port returned ECONNREFUSED; its token Map remained empty. Node credentials were cleared and its kernel reset.

    The private browser helper cleared its saved commands/token Map, restored fetch, moved its exact fake Auth session to memory before sign-out, deleted only its SDK app, removed only the matching exact staging App Check cache entry and verified absence. Normal website sign-out is visible. No credential/code/raw token was placed in a note or issue. Existing user tabs, published build and rollback are preserved. The anonymous owned staging tab may remain solely for the human's permission-off action; no account, server or token awaits that step.

    Final gates

    • Human confirmation that Apps on device/local-network permission for only the staging site is Block. Requested; do not claim it happened yet.
    • Reconcile and review the no-terminal officer/root documentation and exact current source/CI readback before closing RACE-SIM-001C — Connect fictional race staging RPC status and member screens #731. Do not rebuild/deploy unchanged runtime code merely to publish this evidence.
    • The original whole-backend goal remains incomplete. Production, provider-backed payments/refunds/transfers, real policy and public release remain separate gates.
11. daliu commented on Oct 15, 2026

    

    daliu

    on Oct 15, 2026

    ContributorAuthor

    More actions

    Outcome — native tests and merged handoff verified; browser permission confirmation remains

    Follow-up to native receipt 6186206758. PR #736 is merged at d90cb22dfab6febfaf0f0c8730fa80cf8dfc4827. Exact PR CI 38694980781 and exact push/main CI 38695547312 passed all six required jobs and every step, with no skips. Eleven documentation files changed; no runtime, Rules, workflow, dependency or production-release change.

    Officer impact: Native fictional-race security and recovery acceptance is recorded. Supervised later use still requires a complete final cleanup receipt and fresh specialist-created disposable fixtures. Real payments, real policies and production remain unavailable under this staging scope.

    Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/STAGING_COMMUNITY.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/SYSTEM_MAPS.md, and six affected root design/operations checkpoints. No-terminal readthrough completed: officers use the website; fixture creation, release, recovery, rollback and cleanup remain specialist duties. Dave remains the sole approver; no backup owner was appointed.

    Deployment evidence: The read-only verifier passed on exact merged main, reporting staging_community_verified_without_deploy. Existing communityActions v6 remains source 669e2fb454fe46d22e0ff8c6034b694b2c7957c0, 101386-byte archive SHA256 94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87; owner/MFA/runtime permissions/resource guards and unchanged profiles passed. Staging Hosting remains source e21be3546b40fc1114ccce56570726644187ce4b, served main.db8aa0ba.js SHA256 e586f22cd21c8e6234f0178496099f48475f863780ec9880445e5fdb30190d0b. No cloud build or deployment was dispatched for the documentation merge. No production data or payment action was performed; source guards are not a claim of newly verified production/provider behavior.

    Local checks: 42 focused release/workflow tests passed. The post-merge checker verified the eleven-file documentation-only scope, six added local links/anchors, procedure fields and map/text alternative. Owned checkout is clean at the merge SHA. Branch protections were not changed; the previously authorized sole-maintainer exception applied only to the exact green reviewed PR head.

    Cleanup remains as independently recorded in 6186206758: two disposable accounts and 26 owned records removed with identity/update-time fences and late absence; empty local receiver closed; token maps, private helper, fake Auth session and exact staging SDK cache disposed. The signed-out staging screen was rechecked. No disposable account, token or server remains waiting.

    Only remaining #731 gate: human confirmation that staging's temporary Apps on device/local-network permission is back to Block, then closure of the anonymous owned staging tab and final browser kernel reset. The earlier “Done — staging local access allowed” confirms Allow, not Block. The tab is retained solely for this manual action; no attempt is made to route around the blocked browser-settings action. #731 stays OPEN until that cleanup is confirmed. The whole backend/real-commerce/public-release goal is not marked complete.
12. daliu commented on Oct 15, 2026

    

    daliu

    on Oct 15, 2026

    ContributorAuthor

    More actions

    Outcome — #731 fictional staging acceptance and cleanup complete

    On October 15, 2026 (America/Los_Angeles), the human confirmed: “Done — staging local access blocked.” This is the requested Block confirmation for the staging site in the same Chrome profile, not a new Allow instruction. Permission restoration is human-confirmed, not independently inspected through a browser-settings workaround.

    The exact anonymous owned tab 43594340 was checked at https://run-mprc-staging.web.app/community/races, closed, and confirmed absent from the browser tab list. Other user tabs were not changed. The browser-control kernel was then reset. There is no remaining manual cleanup gate for this child issue.

    Officer impact: The fictional staging signup, credit-return simulation and bib-transfer slice now has native acceptance and a completed cleanup handoff. Future supervised tests require fresh specialist-created disposable fixtures; deleted fixtures must not be recreated. This is not permission to use real runner data, collect payments, issue real refunds or publish production changes.

    Officer documentation: The merged PR #736 updates OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/STAGING_COMMUNITY.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/SYSTEM_MAPS.md and six root checkpoints. The no-terminal officer readthrough is complete. Officers use the website; specialists retain fixture setup, release, recovery, rollback and cleanup. Dave remains the sole approver, with no backup owner appointed.

    Deployment evidence: The dated native receipts 6181945856, 6186206758 and 6186462983 distinguish source, merge, hosted behavior and cleanup. PR #736 merged at d90cb22dfab6febfaf0f0c8730fa80cf8dfc4827; exact PR CI 38694980781 and main CI 38695547312 passed all six required jobs and every step without skips. The read-only verifier on that merged SHA passed unchanged Function v6/source 669e2fb454fe46d22e0ff8c6034b694b2c7957c0, archive SHA256 94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87, with existing identity/resource guards and unchanged profile Functions. Hosting source e21be3546b40fc1114ccce56570726644187ce4b and served asset digest e586f22cd21c8e6234f0178496099f48475f863780ec9880445e5fdb30190d0b matched. No deployment or build was needed for this final cleanup.

    Acceptance includes actual fictional signup/cancellation/credit labels, offer/accept/same-bib/revoke, privacy, mobile layout, natural expiry, current authority revocation, recipient-loss recovery and genuine Auth/App Check denials. The final native test set passed 38 evaluations covering 27 distinct checks, including a real member-screen server-committed/lost-response retry with no duplicate mutation. Multi-tenancy remains disabled: the native Auth provider rejected an unsupported tenant without issuing a token; no valid nondefault-tenant token was created or claimed tested.

    Prior fenced cleanup removed both disposable accounts and all 26 owned documents, with immediate and late absence. The unused loopback receiver had zero captures and was closed with port-refusal proof. Token maps, fake Auth session, private browser helper and exact matching staging App Check cache were disposed. Those dated cleanup results are retained; this final step did not recreate accounts, inspect real records or rerun tests.

    All five #731 acceptance gates are satisfied across the linked receipts and this human-confirmed final cleanup. Close only #731 as completed. The broader backend, real club policy, real provider payments/refunds/transfers and production/public launch remain separate work and approval gates. No production data, real payments, IAM, billing, service, dependency or workflow change was made in this cleanup.
13. daliu

    closed this as completedon Oct 15, 2026
14. daliu

    added a commit that references this issue on Oct 16, 2026

    Require current membership for free-event signup (#738)

    ...

    c12445c