[daliu]

Outcome

Adds the source-only Firebase Hosting foundation for WEB-001A1. Controlled optimized builds now choose staging or production explicitly, local/test remain emulator-only, and Firebase Hosting has a static SPA rewrite with a project-bound build-and-scan predeploy gate.

Closes #663. Parent #460 remains open for owned staging, protected automatic release, response headers, readback/rollback, and DNS cutover.

Safety boundary

• Missing, local, incomplete, malformed, or cross-environment hosted Firebase configuration fails before SDK service use.
• Staging requires a complete staging-named public web config and rejects every known production-equal field.
• Production accepts only the exact reviewed public web configuration.
• CI, ordinary Netlify previews, the pinned Netlify release builder, and the protected artifact build use explicit configurations and scan executable JavaScript.
• Firebase Hosting predeploy binds GCLOUD_PROJECT to the selected browser project, rebuilds, and scans before upload.
• .firebaserc defaults to demo-mprc-local; no deploy-capable production default remains.
• No dependency, Function, Rule, index, schema, provider configuration, account, production-data, or policy change is included.

Verification

• Node 20 frontend: 18 suites, 1,346 tests passed.
• Node 20 workflow/release/hosting/artifact/dependency guards: 102 tests passed; both workflow YAML files parsed.
• Standalone SPA navigation: 11 tests passed.
• Functions lint passed; 69 active suites / 7,569 tests passed, with 2 suites / 64 tests intentionally skipped by their existing gates.
• Java 21 Firestore Rules emulator: 5 suites / 418 tests passed on demo-rules-test.
• Java 21 commerce concurrency emulator: 63 tests passed on demo-pay002b2-test.
• Frontend lint exact baseline passed: 120 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.
• Synthetic staging and exact production optimized builds compiled and passed executable identity verification.
• Hosting emulator on demo-mprc-local served the real main asset and rewrote /events, /shop/mprc-hat, and /account to the SPA index; no browser code was executed.
• git diff --check passed.
• Hosted PR run 32663839787: all five GitHub jobs passed. Netlify header/redirect checks passed, its Pages-change check was neutral, and its existing integration published deploy preview 664 with the sanitized synthetic staging configuration.
• Production-only audits remain non-green without dependency changes: root 4 findings (1 high, 2 moderate, 1 low); Functions 8 moderate. No forced audit fix was applied.

The first local Rules command started only the demo emulator but failed before tests because its restricted PATH hid nested Node. The corrected explicit Node 20/Java 21 invocation produced the complete 418-test pass above.

Release state

• Source changed: yes, commit e0c459f.
• Tests passed: yes, locally and in hosted CI.
• Code merged: no; independent review is required.
• Netlify PR preview published: yes, ephemeral preview 664 with synthetic staging configuration only.
• Production website published: no.
• runmprc.com verified for this change: no; it remains on the documented production Netlify deploy.
• Firebase deployed: no.
• Firebase Hosting staging/production site or channel created: no.
• Outside provider configuration changed: no.
• DNS/TLS/custom domain changed: no.
• Production behavior verified: no.

The authenticated Google identity sees only disposable testproject-1c263, not MPRC production or an approved club-owned staging project. Provider work therefore stopped at the required owner gate.

Officer impact: None live. Officers continue using the documented production Netlify site; Firebase Hosting is not an available publish or recovery control. The PR preview is for public, signed-out source review only.

Officer documentation: OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/SYSTEM_MAPS.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/EMERGENCY_AND_RECOVERY.md, and docs/officers/GLOSSARY.md.

Deployment evidence: Local synthetic/exact artifacts, demo-only emulators, hosted CI, and the automatic synthetic Netlify PR preview above. No Firebase project, Firebase Hosting resource, provider configuration, DNS, production data, runmprc.com, or production behavior changed.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e0c459f
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8b54d06b0d6e0008c68d87
😎 Deploy Preview	https://deploy-preview-664--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

HOSTED EVIDENCE FINAL — 2026-08-23

GitHub Actions run 32663839787 completed with all five jobs successful. Netlify's header and redirect checks succeeded; its Pages-change check was neutral; the existing integration published ephemeral preview 6a8b54d06b0d6e0008c68d87.

A static-only readback of https://deploy-preview-664--luminous-fox-7c393f.netlify.app fetched /, /shop/mprc-hat, and the referenced JavaScript without executing browser code. The deep route matched the root SPA document, executable JavaScript contained mprc-staging-ci, and the known production project/sender identities were absent.

This proves only the PR preview artifact. It does not prove an owned Firebase staging project, Firebase deployment, provider configuration, merge, runmprc.com, DNS/TLS, production data, or production behavior. Independent review is still required.

[daliu]

Final self-review: no blocking findings.

• Reconciled against current main (230d73894a69c3f5f5fda05e319fb7b9d63e3d69); mergeable and git diff --check is clean.
• All five required GitHub CI jobs passed; Netlify header, redirect, and deploy-preview checks passed.
• Re-ran npm run test:firebase-hosting: 7/7 passed.
• Reviewed the Hosting target binding, explicit production/staging Firebase selection, emitted-artifact identity scan, credential-marker handling, CI/release workflow changes, and Netlify build isolation. No authorization, secret/PII, production-fallback, or deployment-target defect found.
• Visually verified the hosted root and direct /events route at desktop width: no broken images, horizontal overflow, or console errors. The lone warning is the expected App Check-disabled signal in the synthetic preview.
• Production runmprc.com remains unchanged; Firebase Hosting has not yet been deployed because the currently authenticated Firebase/Google identities do not have access to mid-peninsula-running-club.

Officer impact: Firebase Hosting source support is safe to merge, but officers must continue using the existing Netlify publishing procedure until a separately evidenced Firebase deployment/cutover.

Officer documentation: OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, docs/officers/SYSTEM_MAPS.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/EMERGENCY_AND_RECOVERY.md, and docs/officers/GLOSSARY.md.

Deployment evidence: Netlify preview verified; current Netlify production compared and unchanged; Firebase Hosting and DNS not deployed or verified.