daliu · Aug 26, 2026 · Aug 26, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -146,7 +146,7 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 **Current CI-001C boundary:** CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) supplies the staging-only protected read-only OIDC proof: exact immutable repository/owner IDs, `main`, the `staging` environment, one verifier workflow, two named individual reviewers, and a keyless principal with only project-identity read permission. Parent #133 still owns Firebase deployment roles and production protection; #136 still owns an actual backend release.
 
-**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) adds an email/password-only Auth source contract plus an exact staging/account/scope deployment guard; its first phase does not initialize Auth or create a user. Functions, App Check, provider sandboxes, reusable deploy authority, application records, and production behavior remain absent. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
+**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys the email/password-only Auth contract from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c`. Provider readback and disposable API/browser checks prove password-required sign-in, improved email privacy, only staging domains, no other provider, billing disabled, and final cleanup to zero users/records. Functions, App Check, provider sandboxes, reusable deploy authority, application records, and production behavior remain absent. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
 
 ### Problem
 

diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -44,7 +44,7 @@ MPRC can open a race or merchandise item for sale only when the platform can:
 
 **CI-001D1 empty staging Firestore boundary:** [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) provisions `(default)` as an empty Native/Standard database in `us-west2`, enables delete protection, keeps PITR disabled, and deploys only exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7` with Firebase CLI 15.24.0. The Node 20/Java 21 Rules suite passes 418/418; provider readback matches the active Rules digest, four composite indexes, and 28 field overrides; fixed anonymous server-only reads are denied; root collection count remains zero. This completes only the first staging data boundary. Auth test configuration, Functions, App Check, outside-provider sandboxes, keyless Firebase deployment roles, synthetic signed-in flows, website republication, production protection, and production behavior remain later children of #105/#133/#136.
 
-**CI-001D2 staging Auth source contract:** [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) adds only `emailPassword: true` under the Firebase Auth provider source, preserves the `demo-mprc-local` default alias, and pins a guarded staging-only `--only auth` command to Firebase CLI 15.24.0. The guard requires the exact staging project, quota project, club-account declaration, Auth-only scope, and short-lived token path while rejecting an ADC override. This source phase does not initialize Auth, enable a provider, create a user, send email, configure Google sign-in, change billing, deploy Functions, or prove signed-in behavior. Provider deployment and disposable create/sign-in/delete evidence follow only after this source reaches exact `main`.
+**CI-001D2 staging Auth boundary:** [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) adds `emailPassword: true` under the Firebase Auth provider source, preserves the `demo-mprc-local` default alias, and pins a guarded staging-only `--only auth` command to Firebase CLI 15.24.0. The guard requires the exact staging project, quota project, club-account declaration, Auth-only scope, and short-lived token path while rejecting an ADC override. After exact source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` reached `main`, the provider phase enabled password-required email/password only. Readback proved improved email privacy, only the two staging authorized domains, no other sign-in provider, billing disabled, and the instrumentless `IDENTITY_PLATFORM` subtype. Disposable API and browser sign-in/sign-out checks passed, requested no email/SMS, and returned Auth and Firestore to zero users/records. Functions, App Check, role/private-data behavior, reusable deployment authority, and production remain later work.
 
 ## 3. Dependency map
 

diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
@@ -50,7 +50,7 @@ As of **2026-08-13**, a merge runs checks but does not start the GitHub release.
 
 As of **2026-08-14**, [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only Netlify release. Deploy `6a7ece87c5ca4d0007c1a3fc` is live from frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`; its exact 62-file marker and signed-out desktop/phone route-focus and menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` made the manifest inactive. Its attempt `6a7ed0ddb00a46000818878d` published nothing and retained the verified deploy. #623 deploy `6a7e072f8f346b0008510d29` is the recorded rollback, not current production. #659 changed no Firebase, provider configuration, account, sign-in state, production data, payment, or connected directory behavior. Officers do not run commands, sign in, enter data, or approve this as a reusable release. Follow the completed record in [Review, merge, release, and check a change](./docs/officers/PUBLISH_AND_CHECK.md).
 
-As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project and published exact source `a614c68d9a1a2be631a3be874a686d61e5d170a0` to [run-mprc-staging.web.app](https://run-mprc-staging.web.app). CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) first adds only the reviewed email/password Auth source and a fixed staging-only guard; that source does not initialize Auth or create a user. This remains an **ENGINEERING STAGING SITE ONLY**. It has no deployed Auth proof, Functions, App Check, provider sandbox, protected automatic release, release marker, tested predecessor rollback, security-header policy, custom domain, or officer publish control. Officers do not sign in, enter data, run commands, or treat the empty database or Auth source as a usable backend. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty, and no DNS, GitHub Pages, Netlify, production Firebase, production data, or live website behavior changed.
+As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project and published exact source `a614c68d9a1a2be631a3be874a686d61e5d170a0` to [run-mprc-staging.web.app](https://run-mprc-staging.web.app). CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source and proves it with disposable API and browser sign-in/sign-out checks. Readback shows improved email privacy, only the two staging domains, no other provider, billing disabled, and zero users/records after cleanup. This remains an **ENGINEERING STAGING SITE ONLY**. It has no trusted Functions, App Check, outside-provider sandbox, protected automatic release, release marker, tested predecessor rollback, complete security-header policy, custom domain, or officer publish control. Officers do not sign in, enter data, run commands, or treat narrow Auth proof as a usable member backend. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty, and no DNS, GitHub Pages, Netlify, production Firebase, production data, or live website behavior changed.
 
 The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. #623 published exactly that disabled interface as deploy `6a7e072f8f346b0008510d29`. Officers inspect the protected layouts only in synthetic local artifacts. The completed signed-out production review proved only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not sign in to production, choose a real photo, enter a real name, or treat the preview as a directory. #623 changed no Firebase, provider configuration, account, sign-in, or production data. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
 

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -63,7 +63,7 @@ Maintain an internal inventory with project/account IDs and console links:
 | --- | --- | --- | --- | --- | --- |
 | Local source runtime | `demo-mprc-local` emulators | Providers remain separately gated | `localhost:3000` | None | Available for synthetic Firebase work after all three loopback emulators report ready |
 | CI | Separate named demo/emulator projects | Fixtures/test only | None | CI | Frontend, Functions, Rules, SPA, and commerce-journal checks run; broader gates remain partial |
-| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus an email/password-only Auth source contract that is not deployed; no Functions, App Check, or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static signed-out Hosting, protected project-identity proof, empty delete-protected Firestore, and reviewed Auth source are available; usable backend/provider staging remains a launch blocker |
+| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus deployed password-required email/password Auth; no Functions, App Check, or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static Hosting, protected project-identity proof, empty delete-protected Firestore, and disposable Auth proof are available; usable backend/provider staging remains a launch blocker |
 | Production | `mid-peninsula-running-club` (verify) | Live + unique endpoint | `runmprc.com` | `production` | Informational site only until gates close |
 
 WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created and provider-read back `run-mprc-staging`, one web app, and Hosting version `3ffadcf2ac8cc760` from source `a614c68d9a1a2be631a3be874a686d61e5d170a0` on 2026-08-26. Always name that project explicitly; `.firebaserc` still defaults to the demo namespace. The static host is not complete environment isolation.
@@ -72,7 +72,9 @@ CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds
 
 CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) provisioned only the staging `(default)` Firestore database and deployed exact Rules/indexes from source `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. Readback on 2026-08-26 showed Native mode, Standard edition, `us-west2`, delete protection enabled, PITR disabled, Rules SHA-256 `fe3f53302db76df5febf7e9d242d82a6b6bec0c0b574ecc8253f1034f1a77dba`, four matching composite indexes, 28 matching field overrides, and zero root collections. Anonymous reads of fixed nonexistent `mail`, `stripeEvents`, and `auditEvents` documents returned `403`. The Rules emulator suite passed 418/418 before provider mutation. No application record, Auth provider/test user, Function, App Check setting, Storage data, outside provider, Hosting version, production Firebase surface, or website changed.
 
-CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) first adds the source contract for standard Firebase Authentication: only `emailPassword: true`, with no anonymous, Google, or phone provider in source. `npm run deploy:staging-auth` is fixed to Firebase CLI 15.24.0, `--only auth`, and `run-mprc-staging`; its lifecycle guard also requires that exact cloud/quota project, the declared `runmprc@gmail.com` account, a short-lived `FIREBASE_TOKEN`, no ADC file override, and the unchanged demo default alias. Do not run that command from a branch. Merge and verify the exact source first. The source phase does not initialize Auth, configure a provider, create a user, send email, change billing, or authorize sign-in.
+CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) first adds the source contract for Firebase Authentication: only `emailPassword: true`, with no anonymous, Google, or phone provider in source. `npm run deploy:staging-auth` is fixed to Firebase CLI 15.24.0, `--only auth`, and `run-mprc-staging`; its lifecycle guard also requires that exact cloud/quota project, the declared `runmprc@gmail.com` account, a short-lived `FIREBASE_TOKEN`, no ADC file override, and the unchanged demo default alias. Do not run that command from a branch. Merge and verify the exact source first.
+
+The bounded provider phase ran on 2026-08-26 from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` after all five required jobs in CI run `33011780449` passed. Live readback showed the instrumentless `IDENTITY_PLATFORM` subtype with billing disabled; password-required email/password and improved email privacy were enabled; authorized domains were exactly `run-mprc-staging.firebaseapp.com` and `run-mprc-staging.web.app`; and anonymous, phone, native federated, OIDC, and SAML providers were absent. A disposable reserved-domain user passed API create/sign-in, generic invalid-credential, anonymous-denial, and browser sign-in/sign-out checks. No out-of-band email or SMS was requested. Cleanup returned Auth to zero users and Firestore to zero root collections. Hosting remained version `3ffadcf2ac8cc760`; Functions and App Check remained unavailable; production was untouched. This evidence is not a reusable officer deployment control.
 
 The repository's only `.firebaserc` default is now `demo-mprc-local`, a deliberately non-deployable local namespace. It is an accidental-deploy brake, not staging. Every future deployment must still pass one exact privately approved project explicitly. Do not infer backend/provider isolation or release authority from the static host; #113/#133 must protect, map, and verify those remaining boundaries.
 
@@ -101,7 +103,7 @@ REACT_APP_STRAVA_CLIENT_ID
 
 The Firebase web configuration is public application configuration. It must still be environment-specific and paired with Auth restrictions, Firestore rules, and App Check. WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) makes controlled optimized builds choose `staging` or `production`; staging project IDs must include a distinct `staging` segment and the complete artifact check rejects known production identities. Production accepts only the exact reviewed public values. These values are not server credentials, but do not paste provider-console screenshots, private links, tokens, or any server credential into source or an issue.
 
-`firebase.json` has a Hosting block for `build/` and missing-path SPA rewrites. Its predeploy chain rejects a Firebase CLI project that differs from the selected browser project, then rebuilds and scans executable JavaScript before upload. It also has the #671 email/password-only Auth source block; that block is configuration intent, not provider evidence. **Static engineering staging, a protected read-only authority check, an empty Rules-protected Firestore boundary, and the reviewed Auth source contract are available; a usable backend and production publication are NOT AVAILABLE YET.** #665 used the Hosting chain for the first `run-mprc-staging` release. #667's WIF identity can read only the project identity; it cannot deploy. #669 was a separate bounded database/Rules/index operation and did not grant reusable authority. #671 provider deployment must wait for exact-main source and use its guarded Auth-only command. No protected Firebase deploy role, deployed Auth proof, Function, App Check enforcement, provider sandbox, production authority, custom domain, release marker, tested rollback, production release, or DNS/TLS change exists.
+`firebase.json` has a Hosting block for `build/` and missing-path SPA rewrites. Its predeploy chain rejects a Firebase CLI project that differs from the selected browser project, then rebuilds and scans executable JavaScript before upload. It also has the #671 email/password-only Auth source block; source remains configuration intent, while the separate provider evidence proves the live narrow Auth boundary. **Static engineering staging, a protected read-only authority check, an empty Rules-protected Firestore boundary, and disposable email/password Auth proof are available; a usable backend and production publication are NOT AVAILABLE YET.** #665 used the Hosting chain for the first `run-mprc-staging` release. #667's WIF identity can read only the project identity; it cannot deploy. #669 and #671 were separate bounded provider operations and did not grant reusable authority. No protected Firebase deploy role, Function, App Check enforcement, provider sandbox, production authority, custom domain, release marker, tested rollback, production release, or DNS/TLS change exists.
 
 ### App Check release state — NOT AVAILABLE YET