WEB-001A2: record isolated Firebase staging deployment

AGENTS.md

@@ -114,7 +114,7 @@ The deterministic frontend Jest baseline is available through the command above.
 
 For Firebase-backed local development, run `npm run emulators` first and wait until Auth, Firestore, and Functions are ready under `demo-mprc-local`. In a second terminal, run `npm start` and use `http://localhost:3000`. Stop if any browser Firebase request uses a non-loopback host. The emulator suite does not isolate Stripe, Strava, email, or other provider calls made by Functions; those flows remain forbidden until their test configuration and safe sink are separately proven.
 
-Optimized builds must explicitly select `staging` or `production`. WEB-001A1 #663 provides and tests that source boundary, but it does not create an owned staging project or isolate outside providers. Do not sign in, open private/admin pages, or exercise Firebase/provider behavior in a preview until the protected staging and provider evidence required by #105/CONFIG exists.
+Optimized builds must explicitly select `staging` or `production`. WEB-001A1 #663 provides and tests that source boundary. WEB-001A2 #665 adds the owned `run-mprc-staging` static Hosting surface, but it does not configure a staging backend, protected release authority, or isolated outside providers. Do not sign in, open private/admin pages, or exercise Firebase/provider behavior in a preview until the protected backend and provider evidence required by #105/CONFIG exists.
 
 For Stripe lifecycle work, tests must include relevant negative and retry cases: invalid signature, duplicate/out-of-order Event, unpaid completion, amount/currency/environment mismatch, terminal-state protection, async success/failure, expiration, cancellation, and refund retry. Capacity/inventory work must include concurrent final-unit tests.
 

GITHUB_ISSUES.md

@@ -77,7 +77,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | 21 | DATA-002 | Create immutable, truthful waiver evidence | P1 | M | blocked_owner_decision | RACE-001, LEGAL-001 decision |
 | 22 | ADMIN-001 | Move sensitive admin operations behind scoped APIs and durable audit | P1 | L | proposed | SEC-001, AUTH-003, PAY-002 |
 | 23 | MERCH-002 | Configure shipping, tax, returns, and order communications | P1 | L | blocked_owner_decision | MERCH-001, LEGAL-001 |
-| 24 | WEB-001 | Move to controlled hosting and add browser security policy | P1 | L | source foundation in progress through #460/#663; not deployed | SAFETY-001, CI-001 |
+| 24 | WEB-001 | Move to controlled hosting and add browser security policy | P1 | L | static staging active through #460/#663/#665; production cutover blocked | SAFETY-001, CI-001 |
 | 25 | OBS-001 | Add payment observability, alerts, SLOs, and redaction | P1 | M | proposed | PAY-003, PAY-005 |
 | 26 | RESILIENCE-001 | Establish backup, restore, retention, and audited repair | P1 | L | proposed | DATA-001, PAY-005 |
 | 27 | TEST-001 | Build the Stripe/Firebase security integration and E2E suite | P0 | L | in progress through #177; most children proposed | core security/payment/data children |
@@ -134,7 +134,7 @@ GitHub Pages routes unknown SPA paths through `public/404.html`. The original br
 
 ### Agent handoff
 
-Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) now makes ordinary optimized previews select a reserved synthetic staging configuration, but private preview behavior remains blocked because no owned staging project or provider isolation is verified under #105/CONFIG. Firebase emulators do not make Stripe, Strava, or email safe. ABUSE-001A must explicitly defer App Check enforcement on `lookupRegistration`, `lookupOrder`, and `stravaExchangeCode` while the initial capability guard is active. DATA-001A owns the two payment-confirmation handoffs; OAUTH-001C within live [#88](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/88) owns the Strava exchange handoff. Do not weaken the guard. Do not include any real callback token in fixtures. #118 still owns the reported profile failure.
+Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) makes ordinary optimized previews select a reserved synthetic staging configuration. WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) adds an owned static Hosting stage, but private preview behavior remains blocked because its backend and outside-provider isolation are not configured under #105/CONFIG. Firebase emulators do not make Stripe, Strava, or email safe. ABUSE-001A must explicitly defer App Check enforcement on `lookupRegistration`, `lookupOrder`, and `stravaExchangeCode` while the initial capability guard is active. DATA-001A owns the two payment-confirmation handoffs; OAUTH-001C within live [#88](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/88) owns the Strava exchange handoff. Do not weaken the guard. Do not include any real callback token in fixtures. #118 still owns the reported profile failure.
 
 ---
 
@@ -468,7 +468,7 @@ Use OAUTH-001A/B/C as bounded outcomes within canonical tracker [#88](https://gi
 ## AUTH-003 — Introduce scoped admin capabilities, MFA, and recent authentication
 
 **Labels:** `priority:P1`, `type:security`, `area:auth`, `area:firebase`, `size:L`, `needs-migration`, `needs-external-config`
-**Status:** In progress through tracker [#460](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/460). Source-only child WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) adds environment-explicit builds, artifact checks, and inert Firebase Hosting SPA configuration; no staging/production Hosting site, headers, release authority, deployment, domain, or cutover is verified.
+**Status:** Proposed. WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) adds static website staging only; it does not deploy or verify scoped capabilities, MFA, recent authentication, Rules, Functions, or operator behavior.
 **Depends on:** AUTH-001, AUTH-002, SEC-001
 
 ### Problem
@@ -1171,7 +1171,7 @@ Do not enable Stripe Tax, Canada shipping, or collect additional addresses until
 ## WEB-001 — Move to controlled hosting and add browser security policy
 
 **Labels:** `priority:P1`, `type:security`, `type:maintenance`, `area:web`, `size:L`, `needs-external-config`
-**Status:** Proposed
+**Status:** In progress through tracker [#460](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/460), source foundation [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663), and static staging [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665). Production cutover remains blocked.
 **Depends on:** SAFETY-001, CI-001
 
 ### Problem
@@ -1383,7 +1383,7 @@ Repository code cannot prove external production configuration. MPRC needs owned
 ### Scope
 
 - Complete the ownership roster in `OPERATIONS_RUNBOOK.md` with primary/backup and least privilege.
-- Create/verify dedicated staging Firebase project and Stripe test/sandbox endpoint; keep production isolated.
+- Extend the dedicated `run-mprc-staging` static project into a protected backend test environment, create and verify the Stripe test/sandbox endpoint, and keep production isolated.
 - Configure Secret Manager bindings, expected livemode/origin, commerce kill switch, App Check Enterprise/enforcement, TTL, budgets, IAM, protected GitHub environments/OIDC, email domain, Sentry redaction, backups, DNS/hosting, and Stripe event allowlist.
 - Verify Stripe account legal/support/statement/payout settings, team MFA/passkeys/roles, Radar, tax/shipping decisions, webhook secret rotation, alert ownership, and reconciliation schedule.
 - Run full staging dress rehearsal and incident/kill-switch/restore drills.

GITHUB_ISSUE_SLICES.md

@@ -138,7 +138,7 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | MERCH-002B | proposed; A, MERCH-001B | Apply server shipping/tax config and actual total snapshots/reconciliation. | Test-mode taxable/pickup/shipping/mismatch fixtures. |
 | MERCH-002C | proposed; A/B, ADMIN-001C | Add fulfillment/return/restock state and audited operator actions. | Forbidden transitions and stock adjustment tests. |
 | MERCH-002D | proposed; A–C, MAIL-001B | Add minimum customer communications/UI and address minimization. | Lifecycle/email/PII projection tests. |
-| WEB-001A | owner_action; source foundation tracked by [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663); CI-001B2 | #663 adds environment-explicit builds, executable artifact checks, a demo-only CLI default, and inert Hosting rewrites. An authorized owner must still provision isolated staging hosting, short-lived authority, canonical/sitemap behavior, deploy, readback, and rollback. | #663 source tests and synthetic Hosting-emulator deep routes are not a hosted stage; later ADR plus exact deployed staging/readback/rollback evidence is required. |
+| WEB-001A | in progress through source foundation [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) and static staging [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665); CI-001B2 | #663 adds environment-explicit builds, executable artifact checks, a demo-only CLI default, and inert Hosting rewrites. #665 provisions isolated static staging, publishes exact source, and verifies public readback. Protected short-lived authority, backend/provider isolation, application headers, a release marker, tested rollback, and production cutover remain. | #665 provider evidence must name exact source/version, signed-out desktop/phone/deep-route readback, and the absent controls. Later evidence must prove protected authority, backend/provider isolation, security headers, marker, predecessor rollback, canonical production DNS/TLS, and cutover. |
 | WEB-001B | proposed; A | Add CSP/HSTS/frame/referrer/permissions/MIME/cache policy. | Automated header/CSP and browser flow smoke. |
 | WEB-001C | partial source retirement tracked by [#492](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/492); remaining work proposed; A/B, PAY-001A | Keep the dormant legacy raw-HTML renderer/parser removed, then migrate any legacy stored content to the structured #83 contract and validate external URLs. | #492 no-manifest/no-lock/no-source guard plus later XSS/protocol/legacy-content migration fixtures. No route, data, Rules, hosting, or live change is proved by #492. |
 | WEB-001D | owner_action; A–C | Execute controlled DNS cutover/rollback and retire old deploy path without enabling commerce. | Dated owner-approved cutover evidence. |

IMPLEMENTATION_PLAN.md

@@ -38,6 +38,8 @@ MPRC can open a race or merchandise item for sale only when the platform can:
 
 **WEB-001A1 Firebase Hosting source foundation:** [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is the first bounded child of #460. It makes controlled optimized builds environment-explicit, keeps local/test on the demo emulators, requires complete staging-named public Firebase configuration, rejects production identities in staging, scans the executable synthetic CI artifact, changes the unqualified CLI default to `demo-mprc-local`, and adds the inert `build/` Hosting rewrite. It deliberately does not provision staging, configure short-lived authority or branch/environment protection, deploy Hosting/Firebase, automate `production-web`, add release readback/rollback/headers, alter Netlify/Pages, or touch DNS/TLS. Source/tests/merge and a synthetic build are not staging or production evidence.
 
+**WEB-001A2 isolated static staging:** [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) creates the club-owned `run-mprc-staging` Firebase project, one web app, and the static [run-mprc-staging.web.app](https://run-mprc-staging.web.app) Hosting site from exact merged source `a614c68d9a1a2be631a3be874a686d61e5d170a0`. The executable artifact scanner found the staging identity and rejected known production identities; provider, direct-route, desktop, and phone readback passed. This is signed-out visual staging only. It does not configure App Check, Auth test users, Firestore, Functions, Rules, indexes, Storage data, provider sandboxes, protected short-lived authority, a release marker, tested predecessor rollback, security headers, `production-web`, custom domains, DNS/TLS, or production publication.
+
 ## 3. Dependency map
 
 ```mermaid

OFFICER_START_HERE.md

@@ -50,7 +50,7 @@ As of **2026-08-13**, a merge runs checks but does not start the GitHub release.
 
 As of **2026-08-14**, [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only Netlify release. Deploy `6a7ece87c5ca4d0007c1a3fc` is live from frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`; its exact 62-file marker and signed-out desktop/phone route-focus and menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` made the manifest inactive. Its attempt `6a7ed0ddb00a46000818878d` published nothing and retained the verified deploy. #623 deploy `6a7e072f8f346b0008510d29` is the recorded rollback, not current production. #659 changed no Firebase, provider configuration, account, sign-in state, production data, payment, or connected directory behavior. Officers do not run commands, sign in, enter data, or approve this as a reusable release. Follow the completed record in [Review, merge, release, and check a change](./docs/officers/PUBLISH_AND_CHECK.md).
 
-As of **2026-08-23**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) adds source checks for an explicit staging-or-production website build and a Firebase Hosting SPA rewrite. This is **SOURCE ONLY, NOT LIVE**. There is no club-owned staging Hosting site, protected automatic Firebase Hosting release, custom domain, or officer publish control yet. Netlify still answers `runmprc.com`; a green #663 test or merged source change does not mean Firebase Hosting, Firebase backend services, DNS, GitHub Pages, Netlify, or the public website changed.
+As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project and published exact source `a614c68d9a1a2be631a3be874a686d61e5d170a0` to [run-mprc-staging.web.app](https://run-mprc-staging.web.app). This is an **ENGINEERING STAGING SITE ONLY**. Desktop and phone public-route checks passed, but staging has no approved backend/provider test estate, App Check key, protected automatic release, release marker, tested predecessor rollback, security-header policy, custom domain, or officer publish control. Do not sign in or enter real information there. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty, and no DNS, GitHub Pages, Netlify, backend, or production-data change occurred.
 
 The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. #623 published exactly that disabled interface as deploy `6a7e072f8f346b0008510d29`. Officers inspect the protected layouts only in synthetic local artifacts. The completed signed-out production review proved only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not sign in to production, choose a real photo, enter a real name, or treat the preview as a directory. #623 changed no Firebase, provider configuration, account, sign-in, or production data. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).