[daliu]

Outcome

The Strava callback now returns to My Account only after the browser receives and canonically admits the exact documented two-field success confirmation; malformed fulfilled answers stay on the cleaned fixed-failure page.

Closes #612
Parent: #88

Scope

• Issue: OAUTH-001C1J — Require exact Strava exchange client confirmation #612 (OAUTH-001C1J).
• What changed: stravaExchangeCode admits only an exact plain two-own-enumerable-data-field { ok: true, athleteId: positive safe integer } result, returns a fresh frozen projection, and maps malformed fulfillment/reflection to one fixed local error while preserving transport-rejection identity. Focused service/callback tests, the RISK-009/RISK-024 ledger, and the existing officer callback-failure procedure cover the boundary.
• What did not change: callback component source, Functions, Rules, workflows, packages, schemas, migrations, Firebase, Strava settings, production data, provider exchange/persistence/scope decisions, deployment, or live behavior.

Trustworthy RED

• Exact base: 63d29bedf379a857421501a5c0938c2901618095.
• Test-only binary diff SHA-256: ddcdfb68ec47f40c9d8a38c30d463ac7bf8ed2b51d130a338ce6a65b9cc53875.
• Node 20 exact-base result: 52 failed, 188 skipped, 1 passed, 241 total. Old source admitted { data: { ok: false, athleteId: 612 } }; real callback composition navigated instead of retaining fixed failure. Transport-rejection identity was the one compatible pass.
• Corrected evidence: OAUTH-001C1J — Require exact Strava exchange client confirmation #612 (comment)

Verification

• Focused OAUTH-001C1J — Require exact Strava exchange client confirmation #612 service and composition set: 53/53 passed.
• Account suite: 241/241 passed.
• Full frontend: 1,040/1,040 passed across 18 suites.
• Direct ESLint on both changed TypeScript/test paths: passed.
• Hosted lint baseline: passed; 118 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.
• Production diagnostic build: passed under Node 20.
• Functions lint: passed; Functions tests: 7,524 passed with 64 intended skips, 69/71 suites.
• Static workflow/safety: 93/93; Rules: 418/418; commerce emulator: 63/63; SPA navigation: 11/11.
• git diff --check: passed.
• Root audit remains 59 total (23 high, 23 moderate, 13 low); production root remains 4 (1 high, 2 moderate, 1 low). Functions remains 8 moderate for both all/prod. No package or lockfile changed and no audit finding was introduced by this PR.

Review and residual risk

• Pre-commit independent runtime/security/lifecycle/privacy review: GO.
• Pre-commit independent RED/test-quality review: GO after correcting five legacy impossible success mocks and regenerating exact-base RED.
• Pre-commit backup-officer review: GO after making the text alternative failure-complete and splitting three officer actions.
• Full binary diff SHA-256: b5b08f101adb6f8712ea8bc4f03847fdab99f8759d5c1c185d4f1262127d769f.
• Exact head: 07237d570ccba266dd48a265fd22b7d9ddb10365; exact-head reviews and hosted checks are pending.
• A transparent Proxy that faithfully presents the contract is indistinguishable in browser JavaScript, so the received object is not retained. Same-realm replacement of built-in reflection/numeric/freeze methods and a compromised server/browser remain outside this acknowledgement boundary. This does not prove provider origin, exchange, paired persistence, athlete ownership, approved scopes, deployment, or live behavior.

Officer handoff

• Officer impact: A member will no longer see a false successful Strava callback transition when the website receives an invalid fulfilled confirmation. The fixed retry instruction remains visible.
• Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md existing Strava callback-failure procedure.
• Approving role: membership lead plus platform/security owner.
• Preview or redacted screenshot: None — this is source-only acknowledgement validation and continuity documentation; no new rendered UI state is introduced.
• Screenshot checked at: Not applicable.
• Plain-language undo plan: Before publication, use one reviewed frontend revert or safe roll-forward. After publication, use the protected website release path and verify the replacement revision on runmprc.com.
• Deployment evidence: Source and synthetic tests only. Website publication, runmprc.com, Firebase, Strava/provider, production data, and live behavior are not performed or verified.

Proof by surface

• Source changed: yes — exact head and four paths above.
• Tests passed: yes — synthetic local checks above.
• Code merged: not yet.
• Website published: not yet.
• Netlify intended commit verified: not yet / unknown.
• runmprc.com verified: not yet.
• Firebase deployed: not relevant; not performed.
• Outside provider configured: not relevant; not performed.
• Outside provider verified: not performed.
• Production behavior verified: not performed.

Safety review

• No secrets, recovery codes, private member data, or payment data are included.
• Planned behavior is marked NOT AVAILABLE YET.
• Skipped checks or deployments are reported as incomplete, not green/live.
• The local received-answer decision path has a Mermaid diagram and matching text alternative; full topology is unchanged.
• A backup officer reviewed the affected guide without a terminal, with specialist publication/verification roles explicit.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	07237d5
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6ef803662161000886623a
😎 Deploy Preview	https://deploy-preview-613--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Exact-head self-review — GO

Reviewed base 63d29bedf379a857421501a5c0938c2901618095 → head 07237d570ccba266dd48a265fd22b7d9ddb10365 (tree 031b49e53a5b728944c2abeac18d58ffcd6f1a6d; binary diff SHA-256 b5b08f101adb6f8712ea8bc4f03847fdab99f8759d5c1c185d4f1262127d769f). The remote PR contains exactly the four claimed paths.

No actionable findings remain.

• Authorization/App Check: no boundary or ordering change; the existing cleaned callback and lifecycle gates remain intact.
• Input/result bounds: exact own enumerable data fields, primitive true, and positive safe integer are required; no coercion, serialization, or retained received object.
• Failure transitions: malformed fulfilled results and reflection failures use one fixed local error; the callback remains on the fixed cleaned failure screen without navigation. Callable transport rejection remains uninspected and identity-preserving.
• Privacy/logging: no supplied detail is displayed or logged; tests use synthetic values only.
• Idempotency/impossible states: no server/external transition or persistence change; stale and unmounted completions retain their existing inert behavior.
• Production fallback: no Firebase, provider, schema, workflow, package, production-data, deployment, or live mutation.
• Documentation: the backup-officer procedure has the required purpose, approver, prerequisites, one-action steps, expected result, stop conditions, proof, undo, escalation, Mermaid, text alternative, and separate source/test/merge/site/Firebase/provider/data/live surfaces.

Independent exact-head runtime/security/lifecycle/privacy review: GO. Independent RED/test-quality review: GO. Independent backup-officer/documentation review: GO. All reviewers confirmed a clean worktree and no remote mutation. Hosted CI and Netlify checks must still finish before merge.

[daliu]

Pre-merge hosted evidence — GO

• Exact head: 07237d570ccba266dd48a265fd22b7d9ddb10365.
• CI run 30738759163: all five jobs passed — Frontend lint + build, Test artifact scrubber, Cloud Functions lint + test, Commerce command journal emulator, and Firestore security-rules tests.
• Netlify deploy-preview 6a6ef803662161000886623a: ready, exact commit_ref above, deploy-preview context, published_at: null, no error. Header/redirect checks passed; Pages changed was neutral as expected.
• GitHub deployments for the head: [].
• Exact-head runtime/security/lifecycle/privacy review: GO.
• Exact-head RED/test-quality review: GO.
• Exact-head backup-officer/documentation review: GO.
• Exact-head self-review: GO with no actionable findings.

This proves a source/test preview gate only. It does not prove website publication, runmprc.com, Firebase deployment, Strava/provider configuration, production-data action, or live behavior.

[daliu]

Post-merge release audit

COMPLETE / CLOSED / CLAIM RELEASED for #612.

• Squash merge and exact main: 644d9f1fe3e6c06427412fd3ae37973dbbfeca20.
• Main tree: 031b49e53a5b728944c2abeac18d58ffcd6f1a6d, exactly the reviewed head tree.
• Exact-main CI 30738868932: all five jobs passed.
• GitHub deployments: [].
• Main Netlify attempt 6a6ef8d14154fc0008c2aabb: error and unpublished.
• Existing WEB-002A — Publish bounded Shop and Events permissions containment #473 control deploy 6a6dc9ea588b0c0008036312 remains published.
• Website publication, runmprc.com verification for this change, Firebase, provider, production data, and live behavior: not performed.

No residual source-review finding blocks closure. Remaining parent work stays under #88.