[daliu]

Closes #149

Outcome

Current checkout, admin-commerce, webhook, and confirmation-mail entry points now require one typed server configuration at each invocation. Missing or mismatched settings stop with a fixed nonsecret result before rate-limit, business-data, mail, event-ledger, or Stripe side effects.

Safety boundary

• local: exact loopback HTTP or HTTPS origin, test Stripe mode, test server key
• test: canonical HTTPS synthetic .test DNS origin, test mode, test key
• staging: exact https://dev.runmprc.com, test mode, test key
• production: exact https://runmprc.com, live mode, live key
• Returned configuration is frozen and contains no key.
• Errors and logs contain fixed reason codes, never supplied values.
• App Check and admin authorization still run first.
• Webhook method and signature checks still run first.
• Irrelevant mail events remain no-ops.
• Webhook and mail functions do not bind or require the Stripe API key.
• CONFIG-001B remains separate and still owns a future commerce stop switch.

Verification

• Node 20 focused Functions: 5 suites, 196 tests passed
• Full Functions: 7 suites, 226 tests passed; one emulator-only test skipped
• Functions lint passed
• Frontend Jest: 9 suites, 113 tests passed
• SPA callback suite: 10 tests passed
• Diagnostic frontend build passed
• Diff, links, and sensitive-pattern review passed
• Local Rules were unavailable because this Mac has no Java runtime; no Rules file changed, and hosted Rules CI is required before merge
• Two independent reviews approved exact source commit 41c0304

Rollout and rollback

This source is safe only when the protected environment supplies the documented settings. Revert this PR to roll back source. Never restore a default production website address. Firebase parameters, Secret Manager bindings, Stripe provider mode, and protected deployment require separate private evidence.

Officer impact: Releases with missing or mismatched server settings stop before registrations, orders, refunds, mail, or Stripe work. Officers never handle or copy a Stripe key.

Officer documentation: docs/officers/PUBLISH_AND_CHECK.md

Deployment evidence: Source and local tests only at PR creation. Firebase deployment, website publication, Stripe or Firebase provider configuration, and production behavior are unproven. No production payment, email, member data, secret, or provider setting was used.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	41c0304
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54d46c5cd3930008ad208c
😎 Deploy Preview	https://deploy-preview-150--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Post-merge evidence: squash commit 2c62b8d; exact main-push CI run 29248650885 passed all required frontend, Functions, and Rules jobs. Firebase deployment was not attempted because the only reviewed workflow plan is profile-recovery and does not include this PR Function set; the required protected production/public configuration is also absent. Website, Firebase, Stripe provider state, payment, email, and production behavior remain unproven.