daliu · Jul 13, 2026 · Jul 13, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -15,6 +15,7 @@ Published foundation mapping:
 - PROMO-001 → [#102](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/102)
 - CI-001A → [#103](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/103)
 - CI-001B1 → [#124](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/124)
+- SUPPLY-001A → [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127)
 - ARCH-001 documentation → [#104](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/104)
 - CI-001 tracker → [#105](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/105)
 - PAY-003 tracker → [#106](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/106)
@@ -51,7 +52,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | ---: | --- | --- | --- | --- | --- | --- |
 | 1 | SAFETY-001 | Preserve commerce/OAuth callbacks and isolate local Firebase Functions | P0 | S | source/test complete under #99; provider/live callback unproven | — |
 | 2 | CI-001 | Repair test gates and secure the deployment pipeline | P0 | L | partial: #103 baseline + #124 hosted Jest; #126 SPA gate and remaining gates open | SAFETY-001 |
-| 3 | SUPPLY-001 | Remove vulnerable dependency chains and stage SDK/build upgrades | P0 | L | ready | CI-001 baseline |
+| 3 | SUPPLY-001 | Remove vulnerable dependency chains and stage SDK/build upgrades | P0 | L | partial: SUPPLY-001A tracked by #127; remaining upgrade/scanning slices open | CI-001 baseline |
 | 4 | SEC-001 | Replace the Firestore admin catch-all with resource-specific rules | P0 | M | source merged #123; Firebase live unproven | — |
 | 5 | CONFIG-001 | Fail closed on server environment and commerce configuration | P0 | M | ready | CI-001A recommended |
 | 6 | AUTH-001 | Require verified email for member and privileged claims | P0 | M | partial: #98 merged; backend live unproven; parent open | SEC-001 recommended |
@@ -185,18 +186,18 @@ Repository changes can implement tests/workflow shape, but OIDC/IAM/environment
 ## SUPPLY-001 — Remove vulnerable dependency chains and stage SDK/build upgrades
 
 **Labels:** `priority:P0`, `type:maintenance`, `type:security`, `area:web`, `area:firebase`, `area:stripe`, `size:L`
-**Status:** Ready after CI baseline
+**Status:** Partial; SUPPLY-001A is published as [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127), with the remaining upgrade/scanning slices open
 **Depends on:** CI-001A
 
 ### Problem
 
-The 2026-07-12 production audit reports 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). The direct router and Firebase client need patches; Firebase Admin needs a staged major upgrade. Unused `gpxparser` pulls obsolete `jsdom/request/form-data`. Create React App is unmaintained and contributes legacy dependency pressure.
+The 2026-07-12 baseline production audit reported 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). SUPPLY-001A/#127 removes the unused `gpxparser` and obsolete `jsdom/request/form-data` chain; on a fresh Node 20 install, the root production audit falls to 22 advisories (1 critical, 8 high) while production bundle hashes remain identical. The direct router and Firebase client still need patches, Firebase Admin needs a staged major upgrade, and Create React App remains unmaintained.
 
 ### Scope
 
 Deliver as small ordered PRs:
 
-1. Prove `gpxparser` is unused, remove it, refresh lockfile, and retest route behavior.
+1. [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127): prove `gpxparser` is unused, remove it, refresh only its lockfile graph, and retest route behavior.
 2. Upgrade `react-router-dom` to the safe compatible 6.x release; test all redirects/navigation.
 3. Upgrade Firebase web SDK within compatibility, then evaluate/stage the next supported major.
 4. Upgrade Firebase Admin/Functions with emulator and Auth/Firestore trigger tests.
@@ -218,10 +219,11 @@ Deliver as small ordered PRs:
 - Before/after `npm audit --omit=dev` for both lockfiles.
 - Full CI and test-mode Stripe/Firebase smoke suite at every upgrade boundary.
 - Bundle/dependency diff and SBOM artifact.
+- SUPPLY-001A/#127: source search finds no runtime use; a fresh Node 20 lockfile install contains no `gpxparser`; 50 entries are removed with no retained package identity change; the root production audit changes from 33 to 22; all 47 frontend and 10 standalone SPA tests pass; and optimized JS/CSS asset hashes match the baseline exactly.
 
 ### Agent handoff
 
-Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. Stop if a major provider SDK change needs a product/runtime decision.
+Never use `npm audit fix --force`. Do not combine all upgrades in one unreviewable lockfile diff. SUPPLY-001A is represented by #127; do not publish a duplicate. Stop if a major provider SDK change needs a product/runtime decision.
 
 ---
 

diff --git a/GITHUB_ISSUE_SLICES.md b/GITHUB_ISSUE_SLICES.md
@@ -20,7 +20,7 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | CI-001B1 | merged/closed as #124; CI-001A | Run the complete committed frontend Jest suite as a named blocking step in the hosted frontend CI job; update exact officer/engineering truth. | Exact pull-request and post-merge hosted steps passed; Firebase skipped and Netlify exact production commit remained unverified. |
 | CI-001B1A | published as #126; #99 and CI-001B1 | Run the standalone same-origin SPA callback suite as a separate blocking hosted frontend step. | Local deliberate-failure proof plus the named hosted step passing on the exact pull-request and post-merge commits; no provider callback claim. |
 | CI-001B2 | owner_action; CI-001B1 | Protect backend-first staging/production deployment; make lint/remaining checks fail closed; pin tools/Actions; remove frontend service-account JSON; configure OIDC/WIF, approvals, missing-config failure, smoke and roll-forward. | Required PR gate and negative credential run; private two-owner IAM review; staging deployment evidence. |
-| SUPPLY-001A | ready; CI-001A | Prove `gpxparser` unused and remove its obsolete transitive chain. | `rg`/tree proof, before/after audits, root lockfile diff, full frontend checks. |
+| SUPPLY-001A | published as [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127); CI-001A | Prove `gpxparser` unused and remove its obsolete transitive chain. | `rg`/tree proof, before/after audits, root lockfile diff, full frontend checks. |
 | SUPPLY-001B | ready; CI-001A | Patch React Router within compatible 6.x and resolve/test future flags without route redesign. | Navigation/callback tests, audit delta, build. |
 | SUPPLY-001C | proposed; CI-001A | Upgrade Firebase web SDK within one compatibility boundary. | Auth/Firestore/Functions/App Check/emulator tests and bundle/audit diff. |
 | SUPPLY-001D | proposed; CI-001A | Upgrade Firebase Admin/Functions in one supported set. | Node 20 lint/unit/emulator/trigger tests and deploy compatibility notes. |

diff --git a/SECURITY.md b/SECURITY.md
@@ -51,7 +51,7 @@ The findings below describe the repository at the start of the 2026-07-12 assess
 | RISK-011 | Local cancellation only changes Firestore; it does not expire the active Stripe Session. The webhook can later move a cancelled record back to paid. | Customers can pay a supposedly cancelled registration/order; capacity/inventory and support state diverge. | Add explicit cancellation saga with Stripe Session expiry and allowed-state transitions. |
 | RISK-012 | Late registration creates reusable Stripe Payment Links, but records have no Session ID and the webhook searches only by Session/PaymentIntent. | Late payments do not reconcile; reuse can produce multiple charges/Sessions for one logical registration. | Replace with one-off idempotent Checkout Sessions or fully constrain/map Payment Links. |
 | RISK-013 | `allow_promotion_codes: true` permits Stripe discounts while Firestore stores base price and webhook does not validate/store discount/actual total. | Reporting, refund limits, and local payment confirmation can be wrong. | Disable promotions until a server-approved discount and total-reconciliation model exists. |
-| RISK-014 | Production dependency audit reports 33 root advisories (3 critical, 9 high) and 9 Functions advisories (1 high). Direct affected dependencies include the router, Firebase client, and Firebase Admin; unused `gpxparser` pulls obsolete `request/jsdom/form-data`. | Known vulnerable or unmaintained runtime/build chains increase XSS, request, DoS, and supply-chain exposure. | Remove unused dependency chains, patch direct dependencies, then stage SDK/build-system upgrades with tests and continuous scanning. |
+| RISK-014 | The 2026-07-13 Node 20 root production audit reports 22 advisories (1 critical, 8 high) after #127 removes unused `gpxparser` and its obsolete `request/jsdom/form-data` chain; the Functions audit still reports 9 advisories (1 high). Direct affected dependencies still include the router, Firebase client, and Firebase Admin. | Known vulnerable or unmaintained runtime/build chains increase XSS, request, DoS, and supply-chain exposure. | Patch direct dependencies, then stage SDK/build-system upgrades with tests and continuous scanning. |
 | RISK-015 | `Privacy.jsx` and `Terms.jsx` explicitly say `REPLACE WITH DATE` and `Placeholder template`; tax, refund, shipping, waiver, retention, and customer-support policies are not approved. | Users are asked for sensitive data and money without final disclosures/policies; disputes and regulatory obligations are unmanaged. | Obtain appropriate legal/tax/insurance review, approve versioned policies, and block live-mode configuration until complete. |
 
 ### P1 high-priority risks
@@ -99,6 +99,7 @@ These entries are implementation evidence, not a production risk-acceptance deci
 | RISK-010 | #99 uses a fully synthetic `demo-mprc-local` configuration, connects Functions/Auth/Firestore to loopback in development/test, routes the direct CSV Function URL locally, fails startup on connector errors, and completed a demo-only three-port CLI smoke. | Current optimized previews still target production; provider calls are not isolated by Firebase. Add protected staging/config and test-provider/sink evidence before end-to-end flows. |
 | Part of RISK-007 | AUTH-001A [#98](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/98) was merged through [PR #107](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/107) as `ce22c110f2132b157bd8a0d43b065585e0b43cb5`. Source and focused tests reject unverified targets at the two existing role-grant endpoints. | The workflow skipped Firebase because `FIREBASE_SERVICE_ACCOUNT` was absent, so backend-live behavior is unproven. Remaining AUTH-001 guards, Rules, verification mirror/refresh, demotion propagation, audit, and authoritative membership work stay open. |
 | RISK-013 | PROMO-001 sets both current Checkout creators to `allow_promotion_codes: false`; the webhook quarantines nonzero discounts plus unconfigured tax/shipping totals. | Add exact creator-payload tests, inventory pre-change Sessions/provider promotion configuration, keep the guard through staging/deploy, and implement an authoritative discount/tax/shipping contract before ever enabling it. |
+| Part of RISK-014 | SUPPLY-001A [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127) removes the unused direct `gpxparser` dependency and 50 lockfile entries without changing any retained package version, source URL, or integrity hash. A fresh Node 20 install lowers the root production audit from 33 findings (3 critical, 9 high) to 22 (1 critical, 8 high), and the optimized production asset hashes remain identical. | Remediate or time-bound the remaining root and Functions findings through the separately tested router, Firebase, Stripe, build-system, and scanning slices; do not use a forced audit upgrade. |
 | Part of RISK-024 | SEC-001 protects token documents from every browser client. | OAUTH-001 must still add transactional refresh/versioning, scope/account binding, disconnect/revocation, IAM/encryption decision, and redacted lifecycle audit. |
 | Part of RISK-027 | #99 keeps App Check, Firebase Analytics, and Sentry from initializing in local/test even when public provider configuration is present. Initial capability callback routes also fail closed before App Check, Firebase Analytics, or Sentry startup. | #111 still owns general hosted URL/event/log redaction, already-initialized SPA transitions, replay/consent/retention policy, payload inspection, and provider evidence. ABUSE-001A must defer the three callback callables; DATA-001A and OAUTH-001C within canonical tracker [#88](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/88) own their safe protected handoffs. |
 | Part of RISK-035 | The Jest environment is repaired, the stale frontend smoke test is replaced, and #124 adds the complete frontend suite as a named blocking step in the hosted frontend CI job. | Keep exact hosted evidence on #124; make lint non-mutating/fail-closed, prove required branch checks, and add the broader TEST-001 suite. |