daliu · Aug 26, 2026 · Aug 26, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -39,7 +39,7 @@ jobs:
           ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/deploy.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
           ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/verify-staging-authority.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
           ruby -e 'require "yaml"; YAML.safe_load(File.read(".github/workflows/ci.yml"), permitted_classes: [], permitted_symbols: [], aliases: true)'
-          node --test tests/ci-workflow.test.js tests/release-workflow.test.js tests/firebase-release-verification.test.js tests/firebase-hosting-foundation.test.js tests/firebase-auth-staging-contract.test.js tests/staging-authority-workflow.test.js tests/test-artifact-safety.test.js tests/root-dependency-security.test.js
+          node --test tests/ci-workflow.test.js tests/release-workflow.test.js tests/firebase-release-verification.test.js tests/firebase-hosting-foundation.test.js tests/firebase-auth-staging-contract.test.js tests/firebase-profile-functions-staging-contract.test.js tests/staging-authority-workflow.test.js tests/test-artifact-safety.test.js tests/root-dependency-security.test.js
       - name: Build
         env:
           CI: 'true'

diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -146,7 +146,7 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 **Current CI-001C boundary:** CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) supplies the staging-only protected read-only OIDC proof: exact immutable repository/owner IDs, `main`, the `staging` environment, one verifier workflow, two named individual reviewers, and a keyless principal with only project-identity read permission. Parent #133 still owns Firebase deployment roles and production protection; #136 still owns an actual backend release.
 
-**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys the email/password-only Auth contract from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c`. Provider readback and disposable API/browser checks prove password-required sign-in, improved email privacy, only staging domains, no other provider, billing disabled, and final cleanup to zero users/records. Functions, App Check, provider sandboxes, reusable deploy authority, application records, and production behavior remain absent. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
+**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys the email/password-only Auth contract from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c`. Provider readback and disposable API/browser checks prove password-required sign-in, improved email privacy, only staging domains, no other provider, billing disabled, and final cleanup to zero users/records. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a source-only, argument-closed command for exactly `createMemberOnSignUp` and `ensureMemberProfile`; its tests reject broad/partial targets, another project/account, a credentials file, changed exports/scripts, extra arguments, and an unpinned CLI. Read-only preflight found project Owner authority, billing disabled, and zero open billing accounts visible to the club account. No Function/API/billing/data/provider mutation is part of #674. Functions, App Check, provider sandboxes, reusable deploy authority, application records, and production behavior remain absent. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
 
 ### Problem
 

diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -46,6 +46,8 @@ MPRC can open a race or merchandise item for sale only when the platform can:
 
 **CI-001D2 staging Auth boundary:** [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) adds `emailPassword: true` under the Firebase Auth provider source, preserves the `demo-mprc-local` default alias, and pins a guarded staging-only `--only auth` command to Firebase CLI 15.24.0. The guard requires the exact staging project, quota project, club-account declaration, Auth-only scope, and short-lived token path while rejecting an ADC override. After exact source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` reached `main`, the provider phase enabled password-required email/password only. Readback proved improved email privacy, only the two staging authorized domains, no other sign-in provider, billing disabled, and the instrumentless `IDENTITY_PLATFORM` subtype. Disposable API and browser sign-in/sign-out checks passed, requested no email/SMS, and returned Auth and Firestore to zero users/records. Functions, App Check, role/private-data behavior, reusable deployment authority, and production remain later work.
 
+**CI-001D3 staging profile-Function guard:** [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds an argument-closed source command for exactly `createMemberOnSignUp` and `ensureMemberProfile`. It validates the demo-only default alias, single reviewed Functions codebase, exact exports, lockfile Firebase CLI 15.24.0, staging project and quota project, club-account declaration, exact target list, short-lived token path, and absence of credential-file overrides before invoking Firebase. Negative tests reject missing/redirected exports, broad or partial target sets, production/cross-project context, extra arguments, changed scripts, and an unpinned CLI. Read-only provider preflight found project Owner authority but billing disabled and zero visible open billing accounts. #674 therefore enables no API, links no billing, deploys no Function, creates no record, and leaves App Check, staging E2E, reusable release authority, and production to later approved children.
+
 ## 3. Dependency map
 
 ```mermaid

diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
@@ -50,7 +50,7 @@ As of **2026-08-13**, a merge runs checks but does not start the GitHub release.
 
 As of **2026-08-14**, [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only Netlify release. Deploy `6a7ece87c5ca4d0007c1a3fc` is live from frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`; its exact 62-file marker and signed-out desktop/phone route-focus and menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` made the manifest inactive. Its attempt `6a7ed0ddb00a46000818878d` published nothing and retained the verified deploy. #623 deploy `6a7e072f8f346b0008510d29` is the recorded rollback, not current production. #659 changed no Firebase, provider configuration, account, sign-in state, production data, payment, or connected directory behavior. Officers do not run commands, sign in, enter data, or approve this as a reusable release. Follow the completed record in [Review, merge, release, and check a change](./docs/officers/PUBLISH_AND_CHECK.md).
 
-As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project and published exact source `a614c68d9a1a2be631a3be874a686d61e5d170a0` to [run-mprc-staging.web.app](https://run-mprc-staging.web.app). CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source and proves it with disposable API and browser sign-in/sign-out checks. Readback shows improved email privacy, only the two staging domains, no other provider, billing disabled, and zero users/records after cleanup. This remains an **ENGINEERING STAGING SITE ONLY**. It has no trusted Functions, App Check, outside-provider sandbox, protected automatic release, release marker, tested predecessor rollback, complete security-header policy, custom domain, or officer publish control. Officers do not sign in, enter data, run commands, or treat narrow Auth proof as a usable member backend. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty, and no DNS, GitHub Pages, Netlify, production Firebase, production data, or live website behavior changed.
+As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project and published exact source `a614c68d9a1a2be631a3be874a686d61e5d170a0` to [run-mprc-staging.web.app](https://run-mprc-staging.web.app). CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source and proves it with disposable API and browser sign-in/sign-out checks. Readback shows improved email privacy, only the two staging domains, no other provider, billing disabled, and zero users/records after cleanup. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a code guard for a future deployment of only the two profile Functions. It does not deploy them. Read-only checks found no billing account available to the club account, and Firebase requires pay-as-you-go billing for Functions. This remains an **ENGINEERING STAGING SITE ONLY**. It has no trusted Functions, App Check, outside-provider sandbox, protected automatic release, release marker, tested predecessor rollback, complete security-header policy, custom domain, or officer publish control. Officers do not sign in, enter data, run commands, attach billing, or treat a command guard as a usable member backend. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty, and no DNS, GitHub Pages, Netlify, production Firebase, production data, or live website behavior changed.
 
 The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. #623 published exactly that disabled interface as deploy `6a7e072f8f346b0008510d29`. Officers inspect the protected layouts only in synthetic local artifacts. The completed signed-out production review proved only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not sign in to production, choose a real photo, enter a real name, or treat the preview as a directory. #623 changed no Firebase, provider configuration, account, sign-in, or production data. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).
 

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -63,7 +63,7 @@ Maintain an internal inventory with project/account IDs and console links:
 | --- | --- | --- | --- | --- | --- |
 | Local source runtime | `demo-mprc-local` emulators | Providers remain separately gated | `localhost:3000` | None | Available for synthetic Firebase work after all three loopback emulators report ready |
 | CI | Separate named demo/emulator projects | Fixtures/test only | None | CI | Frontend, Functions, Rules, SPA, and commerce-journal checks run; broader gates remain partial |
-| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus deployed password-required email/password Auth; no Functions, App Check, or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static Hosting, protected project-identity proof, empty delete-protected Firestore, and disposable Auth proof are available; usable backend/provider staging remains a launch blocker |
+| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus deployed password-required email/password Auth; source-only exact two-Function guard; no Functions, App Check, or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static Hosting, protected project-identity proof, empty delete-protected Firestore, disposable Auth proof, and Function command guard are available; billing and usable backend/provider staging remain launch blockers |
 | Production | `mid-peninsula-running-club` (verify) | Live + unique endpoint | `runmprc.com` | `production` | Informational site only until gates close |
 
 WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created and provider-read back `run-mprc-staging`, one web app, and Hosting version `3ffadcf2ac8cc760` from source `a614c68d9a1a2be631a3be874a686d61e5d170a0` on 2026-08-26. Always name that project explicitly; `.firebaserc` still defaults to the demo namespace. The static host is not complete environment isolation.
@@ -76,6 +76,8 @@ CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) first
 
 The bounded provider phase ran on 2026-08-26 from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` after all five required jobs in CI run `33011780449` passed. Live readback showed the instrumentless `IDENTITY_PLATFORM` subtype with billing disabled; password-required email/password and improved email privacy were enabled; authorized domains were exactly `run-mprc-staging.firebaseapp.com` and `run-mprc-staging.web.app`; and anonymous, phone, native federated, OIDC, and SAML providers were absent. A disposable reserved-domain user passed API create/sign-in, generic invalid-credential, anonymous-denial, and browser sign-in/sign-out checks. No out-of-band email or SMS was requested. Cleanup returned Auth to zero users and Firestore to zero root collections. Hosting remained version `3ffadcf2ac8cc760`; Functions and App Check remained unavailable; production was untouched. This evidence is not a reusable officer deployment control.
 
+CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds `npm run deploy:staging-profile-functions` as a source-only, argument-closed wrapper. Before Firebase CLI it checks the demo-only default alias, one reviewed Functions codebase, both exact profile exports, lockfile CLI 15.24.0, `run-mprc-staging` as both project and quota project, `runmprc@gmail.com` as the declared operator, an in-memory short-lived token, no credential-file override, and exactly `functions:createMemberOnSignUp,functions:ensureMemberProfile`. Do not add arguments or invoke the command directly from a branch. Read-only preflight on 2026-08-26 showed the club account is project Owner, project billing is disabled, and that account can see zero open billing accounts. Firebase requires Blaze for Function deployment, so do not enable APIs or run this command until a separately approved billing account, budget/alerts, exact-main source, and provider release issue exist. The guard itself deploys nothing and does not make App Check or staging profile behavior available.
+
 The repository's only `.firebaserc` default is now `demo-mprc-local`, a deliberately non-deployable local namespace. It is an accidental-deploy brake, not staging. Every future deployment must still pass one exact privately approved project explicitly. Do not infer backend/provider isolation or release authority from the static host; #113/#133 must protect, map, and verify those remaining boundaries.
 
 ## 4. Configuration and secrets
@@ -982,6 +984,8 @@ Never use destructive Git or Firestore reset operations on production as a rollb
 
 Issue [#118](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/118) replaces manual repair with create-once signup/recovery Functions and a fail-closed account page. Do not use it as a production procedure until #105 supplies a protected staging and deployment path.
 
+Source guard #674 may be reviewed before billing exists, but it is not deployment evidence. Stop before any provider mutation unless the board/platform owner separately approves a Cloud Billing account and spending controls. A billing link changes the project to pay-as-you-go even when expected Function usage is within no-cost quotas.
+
 Required release order:
 
 1. Confirm the exact merged #100 Rules revision is the reviewed dependency.