AUTH-001B: require verified email for Firestore roles

GITHUB_ISSUES.md

@@ -55,8 +55,8 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | 3 | SUPPLY-001 | Remove vulnerable dependency chains and stage SDK/build upgrades | P0 | L | partial: SUPPLY-001A tracked by #127; remaining upgrade/scanning slices open | CI-001 baseline |
 | 4 | SEC-001 | Replace the Firestore admin catch-all with resource-specific rules | P0 | M | source merged #123; Firebase live unproven | — |
 | 5 | CONFIG-001 | Fail closed on server environment and commerce configuration | P0 | M | CONFIG-001A merged in #149/PR #150; CONFIG-001B1 tracked in [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151); B2 blocked; not deployed | CI-001A recommended |
-| 6 | AUTH-001 | Require verified email for member and privileged claims | P0 | M | partial: #98 merged; backend live unproven; parent open | SEC-001 recommended |
-| 7 | AUTH-002 | Replace the legacy static-key membership synchronization endpoint | P0 | M | ready | AUTH-001 |
+| 6 | AUTH-001 | Require verified email for member and privileged claims | P0 | M | partial: #98 merged; Rules slice tracked in #196; Firebase live unproven; parent open | SEC-001 recommended |
+| 7 | AUTH-002 | Replace the legacy static-key membership synchronization endpoint | P0 | M | waiting on remaining AUTH-001 | AUTH-001 |
 | 8 | OAUTH-001 | Make Strava token lifecycle server-only, transactional, and auditable | P0 | M | represented by live [#88](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/88); proposed/unclaimed | SAFETY-001/#99; SEC-001 and AUTH-003 for A; staged deferral/cutover with ABUSE-001A for C |
 | 9 | AUTH-003 | Introduce scoped admin capabilities, MFA, and recent authentication | P1 | L | proposed | AUTH-001, AUTH-002, SEC-001 |
 | 10 | ABUSE-001 | Enforce native App Check and privacy-preserving abuse limits | P0 | L | partial: Enterprise browser source/tests tracked in [#159](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/159); provider config, native enforcement, rate limits, and live proof open | CI-001 baseline |
@@ -320,7 +320,7 @@ Implement only the live CONFIG child claimed in `GITHUB_ISSUE_SLICES.md`. Never
 ## AUTH-001 — Require verified email for member and privileged claims
 
 **Labels:** `priority:P0`, `type:security`, `area:auth`, `area:firebase`, `size:M`
-**Status:** Partial. AUTH-001A [#98](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/98) merged through [PR #107](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/107) as `ce22c110f2132b157bd8a0d43b065585e0b43cb5`; focused source/tests are proven, but Firebase deployment skipped and the parent scope remains open.
+**Status:** Partial. AUTH-001A [#98](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/98) merged through [PR #107](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/107) as `ce22c110f2132b157bd8a0d43b065585e0b43cb5`; its Firebase deployment skipped. AUTH-001B [#196](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/196) tracks the role-based Firestore Rules source/test slice; it has not been deployed. Neither slice is proven live. Remaining Functions/mirror/revocation work is open, and the parent is not complete.
 **Depends on:** SEC-001 recommended
 
 ### Problem
@@ -329,6 +329,8 @@ Both the legacy member synchronization function and admin role callable grant cl
 
 AUTH-001A now rejects unverified targets at the two existing role-grant endpoints. Do not duplicate that merged slice. It is not proof that Firebase production runs the new code, and it does not complete the remaining parent requirements below.
 
+AUTH-001B [#196](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/196) is the distinct Rules outcome. A `member` or `admin` role authorizes a role-based Firestore operation only when Firebase's token also carries exact boolean `email_verified == true`. Missing, false, string, numeric, or profile-mirror values deny. UID-bound profile read/update and connection-metadata read remain identity self-service so an unverified person can recover; verification never creates membership or admin authority. This source/test boundary is not Firebase deployment or live proof.
+
 Adjacent account-email recovery is represented by canonical live parent [#120](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/120), not by a new AUTH-001 role-grant child. AUTH-MAIL-002A [#145](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/145) merged the account-creation/request split as `46557c7` but is not published. AUTH-MAIL-002B [#153](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/153) merged the truthful My Account resend result and browser cooldown as `23bca8c8`, but protected release run `29252492614` stopped before build and published nothing. AUTH-MAIL-002C1 [#155](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/155) tracks one neutral password-reset request result and repeat-safe browser cooldown. AUTH-MAIL-002C2 is represented by live child [#194](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/194): a verification-only `/auth/action` source route that scrubs capability state, requires an explicit click and provider `VERIFY_EMAIL`, and exposes only fixed non-identifying results. It must not be configured as Firebase's project-wide custom handler while reset-password and recover-email modes remain unsupported. None grants membership, proves provider delivery, reconciles the Firestore verification mirror, or proves Firebase API enumeration protection.
 
 ### Scope

GITHUB_ISSUE_SLICES.md

@@ -34,6 +34,7 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 
 | ID | Status/dependency | Bounded deliverable | Close evidence |
 | --- | --- | --- | --- |
+| AUTH-001B | source/tests tracked in live [#196](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/196); #98/#100; not deployed | Require exact boolean token `email_verified == true` for every current role-based Firestore member/admin decision. Preserve public reads and UID-bound safe profile recovery; verification grants no role. | Old-Rules proof fails the explicit missing/false/string/numeric matrices; focused/full Rules emulator suites pass with every privileged test context stating verification. Firebase deployment/live behavior remain separate. |
 | AUTH-003A | proposed; AUTH-001/002, SEC-001 | Define capability matrix, additive claims, role-change audit, and idempotent legacy-admin migration. | Table-driven claim/action tests and emulator dry-run/rollback. |
 | AUTH-003B | proposed; AUTH-003A | Apply capabilities to server functions and Firestore projections/rules. | Every capability/action pair has allow/deny tests. |
 | AUTH-003C | owner_action; AUTH-003B | Enforce privileged MFA, recent-auth thresholds, revocation, and break-glass/last-admin policy. | Staging failure/success demonstrations and private owner inventory. |

IMPLEMENTATION_PLAN.md

@@ -212,7 +212,7 @@ The first tranche deliberately combines one urgent safety repair with the most c
 2. **PAY-003 — webhook event inbox and safe reducer:** PAY-003A [#101](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/101) source merged through [PR #140](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/140) as `87bd1210575882cdd06214bcb98ed38ce00f71c2`, adding event replay protection, async-aware payment confirmation, expected total/currency validation, direct metadata lookup, terminal-state guards, and lifecycle tests. Firebase and Stripe live behavior remain unproven; PAY-003B/C remain open.
 3. **SEC-001 — Firestore trust boundaries:** #100 merged through [PR #123](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/123) at `a7fc301e85b0aeabe396e771faea21d3fc8e7b2b`. Source and 295 Rules tests remove recursive browser-admin authority. Firebase deployment explicitly skipped, so deployed/live Rules remain unproven under #105.
 4. **PROMO-001 — fail-safe monetary policy:** [#102](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/102) disables promotion entry and automatic tax in both current creators, adds exact payload tests, and quarantines unknown or nonzero discount/tax/shipping adjustments on success, failure, and expiry. The private pre-change Session/provider inventory, protected deployment, provider readback, and live verification remain owner actions; no discount, tax, or shipping feature is authorized.
-5. **Identity/config next:** AUTH-001A [#98](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/98) merged at `ce22c110`, proving source/tests for unverified-target rejection at the existing role-grant endpoints. Its Firebase deployment skipped, so backend-live status is unproven and the remaining AUTH-001 parent work stays open. CONFIG-001A merged through [#149](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/149) / PR #150 as `2c62b8dd`, but remains undeployed. CONFIG-001B1 is tracked in [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151) for fail-closed read-only admission; B2 retains the protected audited operator control, provider-object recovery, and drill. Follow the live issues and do not duplicate these slices.
+5. **Identity/config next:** AUTH-001A [#98](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/98) merged at `ce22c110`, proving source/tests for unverified-target rejection at the existing role-grant endpoints. AUTH-001B [#196](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/196) tracks the next bounded source/test outcome: role-based Firestore access requires an exact verified-email token while UID-bound safe profile recovery remains available. Firebase deployment is unproven, and Functions guards, verification-mirror refresh, revocation/audit, authoritative membership, and legacy-sync retirement keep the AUTH-001 parent open. CONFIG-001A merged through [#149](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/149) / PR #150 as `2c62b8dd`, but remains undeployed. CONFIG-001B1 is tracked in [#151](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/151) for fail-closed read-only admission; B2 retains the protected audited operator control, provider-object recovery, and drill. Follow the live issues and do not duplicate these slices.
 6. **PAY-001/PAY-002:** PAY-001A source/tests are tracked in [#157](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/157) as the shared validation/logging foundation. PAY-002A1 is tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161) for pure separate state reducers and synthetic legacy classification. PAY-002B1 is tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163) for pure command/fingerprint/Stripe-key derivation. PAY-002B2A is tracked in [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165) for the immutable registered command/audit pair only. PAY-002B2B [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169) owns the separate unused lease/fence/terminal-commitment source and tests without send permission. PAY-002B2C1 [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173) owns only the unused lease-bound immutable initial plan and audit. PAY-002B2C2 [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182) owns only the unused separate pre-send marker/audit, exact-attempt retry classification, and persisted 23-hour cutoff. PAY-002B2C3A [#184](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/184) owns only the unused pure closed reconciliation decision. PAY-001B/C/D must still wire exact endpoint schemas/snapshots; C3B/C3C must persist verified reconciliation evidence and separately authorize/version safe attempt advancement; PAY-002C/D must then add persistence-first sagas; PAY-003B must adopt the shared reducer. No current endpoint imports these PAY-002 foundations, and none of #169/#173/#182/#184 deploys or configures Firebase/Stripe.
 7. **Then:** RACE-001 and MERCH-001 transactional reservations.
 

OPERATIONS_RUNBOOK.md

@@ -277,6 +277,10 @@ npm run test:rules
 
 This requires Java. Rules tests must prove both allowed behavior and explicit denial of secret/financial/arbitrary paths for browser admins.
 
+AUTH-001B [#196](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/196) adds one required role matrix to this check. Every test context using `member` or `admin` must state email verification explicitly. Exact boolean `true` permits only the operation already allowed by that role; missing, false, string, numeric, or profile-document values must not substitute. Unverified users must still be able to read and make the existing name-only update to their own profile, and must remain unable to use role-based access or another UID. Stop a release if any privileged fixture relies on an inferred verification default.
+
+Passing this local/hosted emulator suite proves the reviewed Rules source only. Under #105/#133/#136, deploy and read back the exact Rules revision before publishing a dependent website. Then use made-up accounts to verify one allowed and one denied role case. Never test with a real member/admin account, manually toggle a production role, or treat email verification as membership approval.
+
 ### Production build without changing generated sitemap during a diagnostic check
 
 ```bash