[daliu]

Closes #157

Outcome

Adds the shared PAY-001A server safety foundation for future race, merchandise, refund, lookup, and admin endpoint migrations.

• Strict configured-root object validation rejects arrays-as-objects, instances, proxies, symbols, accessors, inherited enumerable fields, dangerous keys, unknown configured root keys, unsafe values, cycles, and over-budget input.
• Raw and parsed array trees are independently bounded before/after a trusted pure synchronous item parser.
• Scalar helpers cover bounded normalized strings, nonnegative integer cents, launch currency usd, canonical calendar dates, canonical HTTPS DNS URLs plus explicit loopback development URLs, and conservative ASCII email syntax.
• Fixed frozen validation errors do not echo supplied values.
• Safe logging produces only a frozen null-prototype projection of five fixed low-cardinality fields and never accepts bodies, arbitrary keys, IDs, URLs, contact data, Stripe/OAuth material, or raw errors.
• New outputs are deeply frozen; caller input is not modified.
• Root design/status documents preserve PAY-001 as partial and explicitly say endpoint adoption, nested schemas, snapshots, deployment, and live protection remain NOT AVAILABLE YET.

Security invariants reviewed

• Descriptor-first inspection; no getter or Proxy trap execution.
• Early object/array/string/key limits and one tree-wide entry/depth budget.
• Independent 64 KiB raw and output serialization ceilings without invoking inherited toJSON.
• Fixed errors recaptured outside supplied callback frames.
• Strict canonical URL encoding; URL syntax is not an SSRF/origin allowlist.
• Email syntax is not identity, membership, or delivery proof.
• Numeric JavaScript 1e2 is indistinguishable from 100; exponent-form strings are rejected and endpoints receive integer values only.
• The libraries themselves have no Firebase, Stripe, provider, logger, network, clock, or random dependency/call. Endpoint-owned item parsers must remain trusted, pure, and synchronous.

Verification

Node 20.19.5:

• node_modules/jest/bin/jest.js --runInBand requestValidation.test.js safeLogging.test.js — 2 suites / 179 tests passed.
• node_modules/jest/bin/jest.js --runInBand from functions/ — 11 suites passed, 1 intentionally skipped; 457 tests passed, 1 skipped.
• node_modules/eslint/bin/eslint.js . from functions/ — passed.
• git diff --cached --check — passed before commit.
• Secret-shaped credential/private-key scan — no live pattern found.
• Three independent reviews approved the exact final code/security, adversarial tests, and documentation semantics.

Officer impact

No current officer screen, duty, or procedure changes. Later endpoint-wiring work will update the affected officer guides.

Officer documentation

None — this pull request adds a pure server library that no current endpoint imports.

Deployment evidence

Source, tests, review, and merge/hosted-CI evidence only. This pull request does not wire or deploy a Function and does not change a website, Firebase, Stripe, provider, or production behavior. A green deploy workflow must not be described as endpoint deployment.

Remaining work

PAY-001B/C/D must add exact endpoint and nested schemas, business-specific limits, server event/custom-field validation, immutable schema/price/waiver snapshots, no-side-effect endpoint tests, protected deployment, and staged/live verification.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	0a912d4
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54f57a00be0c00083bc845
😎 Deploy Preview	https://deploy-preview-158--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Exact-head merge gate

• Head: 0a912d421e36cecd84ace4db2b5dc0809d2836eb
• Reviewed staged diff fingerprint: 508145eaefc972fd6bcc0b2778961c3091f0a032
• Three independent code/security, adversarial-test, and documentation reviews approved.
• GitHub Actions 29257925973 completed successfully at this exact head: Frontend, Cloud Functions, and Firestore Rules all passed.
• Netlify deploy preview passed at the exact head; redirect checks passed and non-applicable header/page checks completed neutral.
• The PR is mergeable and blocked only by the review/branch gate. The user explicitly authorized agents to merge and deploy.
• Scope remains source-only primitives. Merge does not prove endpoint adoption, Firebase deployment, Stripe configuration, or live protection.