[daliu]

Closes #202

Outcome

Pins the Firebase browser SDK to 11.10.0 and @firebase/rules-unit-testing to 4.0.1. The root production audit falls from 19 findings (1 critical, 5 high) to 6 (0 critical, 3 high). A dedicated Jest environment supplies Node 20 native web APIs so the upgraded Rules helper reaches the loopback emulator; application behavior and provider settings do not change.

Security invariants

• One supported compatibility boundary only; Firebase 12 and backend SDKs are excluded.
• Auth, Firestore, Functions, and App Check application wiring is unchanged.
• Rules tests use project demo-rules-test and loopback Firestore only.
• No production secret, member/customer data, provider console, or live Firebase resource was used.
• No forced audit upgrade or direct transitive override was added.

Evidence

• Focused Firebase/Auth/App Check: 3 suites, 71/71.
• Full frontend: 11 suites, 198/198.
• Firestore Rules: 4 suites, 348/348.
• Functions: 1,077/1,077 applicable unit tests; 32 emulator-only tests remain explicitly skipped in the ordinary unit command.
• SPA callback safety: 11/11.
• Workflow/release safety: 42/42.
• Functions lint passed.
• Frontend lint matched the reviewed baseline (125 configured errors and 7 warnings); no new, removed, moved, or changed finding.
• Diagnostic production build passed without changing public/sitemap.xml.
• Built-output server-module/credential signature scan returned no paths.
• Root production audit: 19 total / 1 critical / 5 high -> 6 total / 0 critical / 3 high.
• Dependency tree contains one Firebase 11.10.0 instance shared with Rules helper 4.0.1.
• Root production protobufjs resolves to 7.6.5; Firebase root undici path is removed. Older protobufjs@7.2.4 and undici@6.25.0 remain only under dev tooling and are documented as residual.
• Reproducible clean builds: main.fdd058b4.js 252.12 kB -> main.56edbdb7.js 260.41 kB CRA gzip report (+8.29 kB/about 3.3%); total build output 18,836 -> 19,016 KiB (+180 KiB/about 1.0%).
• Exact source head: 30e560bd1492c1ba2f691ad0f7216a00bf59184f.
• Exact base: caae31ff427e91325d34a6c901faf81ad1dc49df.
• Diff SHA-256: df343d36a6dc7cb2bb4577dabf52d89b580bd67e3748b67e5caa6ea13034022e.

Independent review

Three independent reviewers APPROVED the exact head:

• Dependency/lock/security: clean install and lock integrity; registry metadata and peer compatibility; audit/tree; clean base/head builds; source-map and credential/server-module scans.
• Rules/emulator isolation: 348/348; stock Jest fails at discovery; missing emulator fails closed; allow/deny cases load committed Rules on the demo loopback project.
• Documentation/deployment truth: numerical consistency, residual risks, links, scope, officer impact, and no false merge, website, Firebase, provider, or live claim.

The clean-build reviewer found and caused correction of stale-cache bundle figures before approval.

Residual risk

Six root and nine Functions production audit findings remain open. Firebase Admin/Functions, the unmaintained build chain, continuous scanning, and provider/live release proof remain separate SUPPLY/CI work. The Jest bridge is a test harness, not a production security boundary.

Officer impact: No visible or procedural change. This reduces a known website dependency risk while preserving the current pages and account flows.

Officer documentation: None — no public content, navigation, data collection, permissions, deployment step, external account, payment, refund, incident, backup, or recovery procedure changed. Engineering security and operations truth is updated in SECURITY.md, OPERATIONS_RUNBOOK.md, GITHUB_ISSUES.md, and GITHUB_ISSUE_SLICES.md.

Deployment evidence: Source and synthetic tests only. Website not published; runmprc.com not verified; Firebase not deployed; outside providers not configured; production behavior not tested.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	30e560b
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5593ef0b049300084d2224
😎 Deploy Preview	https://deploy-preview-203--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

FINAL PRE-MERGE EVIDENCE

Exact head: 30e560bd1492c1ba2f691ad0f7216a00bf59184f
Exact diff SHA-256: df343d36a6dc7cb2bb4577dabf52d89b580bd67e3748b67e5caa6ea13034022e

Three independent exact-head reviews: APPROVED, no remaining findings.

Exact-head CI run 29299213783: Frontend lint/build/tests/SPA/release validation passed; Functions lint/tests passed; Firestore Rules 348/348 passed; commerce-journal emulator passed; artifact scrubber passed. Netlify PR preview 6a5593ef0b049300084d2224 is ready and its applicable redirect check passed; skipped header/page contexts are neutral.

This proves reviewed source, synthetic tests, hosted checks, and a temporary PR preview only. It does not prove a production website release, runmprc.com, Firebase deployment, outside-provider configuration, or production behavior.