daliu · Aug 27, 2026 · Aug 27, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -146,7 +146,7 @@ Do not redesign routing or hosting in this issue; WEB-001 owns that. WEB-001A1 [
 
 **Current CI-001C boundary:** CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) supplies the staging-only protected read-only OIDC proof: exact immutable repository/owner IDs, `main`, the `staging` environment, one verifier workflow, two named individual reviewers, and a keyless principal with only project-identity read permission. Parent #133 still owns Firebase deployment roles and production protection; #136 still owns an actual backend release.
 
-**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys the email/password-only Auth contract from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c`. Provider readback and disposable API/browser checks prove password-required sign-in, improved email privacy, only staging domains, no other provider, billing disabled, and final cleanup to zero users/records. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a source-only, argument-closed command for exactly `createMemberOnSignUp` and `ensureMemberProfile`; its tests reject broad/partial targets, another project/account, a credentials file, changed exports/scripts, extra arguments, and an unpinned CLI. Read-only preflight found project Owner authority, billing disabled, and zero open billing accounts visible to the club account. No Function/API/billing/data/provider mutation is part of #674. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merges its argument-closed Hosting command through PR #677 as exact source `bce911a7083201cfe2141edaa9660f210287bf57`; all five post-main CI jobs passed. The bounded provider checkpoint enabled only Firebase App Check and reCAPTCHA Enterprise, created exactly one score-based key restricted to the two staging hosts, registered it to the one web app with a one-hour token lifetime, and configured Authentication plus Firestore as `UNENFORCED` with replay protection off. The guarded Hosting-only path published that exact source as version `8556fc51210bdc66`; root/direct Events, empty Firestore, layout, and browser warning/error checks passed. The issue remains open because the new disposable Auth browser proof, atomic `ENFORCED` readback, missing-token denial, final token-bearing replay, cleanup, and completion evidence remain unfinished. Billing is disabled, user/root-collection counts are zero, no Functions-related API or Function exists, and production is unchanged. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
+**Current CI-001D boundary:** CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) supplies the first staging data boundary: empty Native/Standard `(default)` Firestore in `us-west2`, delete protection enabled, PITR disabled, and exact Rules/indexes from `ee16bd16220ab58bd3a2add80dd2f39a1d514dd7`. The 418-case Rules suite passed, provider definitions matched, fixed anonymous server-only reads were denied, and root collection count remained zero. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys the email/password-only Auth contract from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c`. Provider readback and disposable API/browser checks prove password-required sign-in, improved email privacy, only staging domains, no other provider, billing disabled, and final cleanup to zero users/records. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a source-only, argument-closed command for exactly `createMemberOnSignUp` and `ensureMemberProfile`; its tests reject broad/partial targets, another project/account, a credentials file, changed exports/scripts, extra arguments, and an unpinned CLI. Read-only preflight found project Owner authority, billing disabled, and zero open billing accounts visible to the club account. No Function/API/billing/data/provider mutation is part of #674. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merges its argument-closed Hosting command through PR #677 as exact source `bce911a7083201cfe2141edaa9660f210287bf57`; all five post-main CI jobs passed. The bounded provider phase enabled only Firebase App Check and reCAPTCHA Enterprise, created exactly one score-based key restricted to the two staging hosts, registered it to the one web app with a one-hour token lifetime, and published that exact source as Hosting version `8556fc51210bdc66`. A reserved-domain disposable browser identity proved create, sign-out, fresh sign-in, and post-enforcement sign-in; token-bearing Events reads stayed successful signed in and signed out. Authentication plus Firestore now read `ENFORCED` with replay protection `OFF`; tokenless Auth and Firestore probes were rejected with HTTP 401 and 403. Cleanup returned users and root collections to zero. Billing is disabled, no Functions-related API or Function exists, the account profile remains fail-closed until those Functions are deployed, and production is unchanged. Parent #133 still owns keyless Firebase deployment roles and production protection; #136 still owns the compatible synthetic backend release.
 
 ### Problem
 

diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md
@@ -48,7 +48,7 @@ MPRC can open a race or merchandise item for sale only when the platform can:
 
 **CI-001D3 staging profile-Function guard:** [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds an argument-closed source command for exactly `createMemberOnSignUp` and `ensureMemberProfile`. It validates the demo-only default alias, single reviewed Functions codebase, exact exports, lockfile Firebase CLI 15.24.0, staging project and quota project, club-account declaration, exact target list, short-lived token path, and absence of credential-file overrides before invoking Firebase. Negative tests reject missing/redirected exports, broad or partial target sets, production/cross-project context, extra arguments, changed scripts, and an unpinned CLI. Read-only provider preflight found project Owner authority but billing disabled and zero visible open billing accounts. #674 therefore enables no API, links no billing, deploys no Function, creates no record, and leaves App Check, staging E2E, reusable release authority, and production to later approved children.
 
-**CI-001D4 staging App Check monitoring checkpoint:** [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merges a source-only, argument-closed Hosting command for `run-mprc-staging`. It validates the demo-only default alias, exact Hosting predeploy chain, Firebase CLI 15.24.0, staging project and quota project, club-account declaration, Hosting-only scope, short-lived token path, absence of credential-file overrides, and one bounded non-placeholder Enterprise site key; the executable artifact check must also find that key. After exact source `bce911a7083201cfe2141edaa9660f210287bf57` passed all five post-main CI jobs, the bounded provider phase enabled only Firebase App Check and reCAPTCHA Enterprise, created one score-based key restricted to the two staging hosts, registered it to the one web app with a one-hour token lifetime, and set Auth plus Firestore to monitoring mode with replay protection off. The guarded command published the same exact source as Hosting version `8556fc51210bdc66`; public root/direct-route, empty Firestore, layout, and browser warning/error checks passed. This is not enforcement completion: the new disposable Auth browser proof, atomic `ENFORCED` readback, missing-token denial, token-bearing replay, final cleanup/evidence, Functions, billing, reusable authority, and production remain pending or unchanged.
+**CI-001D4 staging App Check enforcement:** [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) merges a source-only, argument-closed Hosting command for `run-mprc-staging`. It validates the demo-only default alias, exact Hosting predeploy chain, Firebase CLI 15.24.0, staging project and quota project, club-account declaration, Hosting-only scope, short-lived token path, absence of credential-file overrides, and one bounded non-placeholder Enterprise site key; the executable artifact check must also find that key. After exact source `bce911a7083201cfe2141edaa9660f210287bf57` passed all five post-main CI jobs, the bounded provider phase enabled only Firebase App Check and reCAPTCHA Enterprise, created one score-based key restricted to the two staging hosts, registered it to the one web app with a one-hour token lifetime, and published the same exact source as Hosting version `8556fc51210bdc66`. A reserved-domain disposable browser identity proved create, sign-out, fresh sign-in, and post-enforcement sign-in; signed-in and signed-out token-bearing Events reads remained successful. Auth plus Firestore now read `ENFORCED` with replay protection `OFF`; tokenless Auth and Firestore requests returned HTTP 401 and 403 respectively. Cleanup returned users and root collections to zero. Functions, billing, reusable authority, provider sandboxes, and production remain pending or unchanged.
 
 ## 3. Dependency map
 

diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md
@@ -50,7 +50,7 @@ As of **2026-08-13**, a merge runs checks but does not start the GitHub release.
 
 As of **2026-08-14**, [#659](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/659) completed one accessibility-only Netlify release. Deploy `6a7ece87c5ca4d0007c1a3fc` is live from frozen source `7496fe0881fb52908c4ff2f40f488df09c94c908`; its exact 62-file marker and signed-out desktop/phone route-focus and menu checks passed. Repause merge `3138a00c1c48e1d5d1dcda0b44722b09a2194ff7` made the manifest inactive. Its attempt `6a7ed0ddb00a46000818878d` published nothing and retained the verified deploy. #623 deploy `6a7e072f8f346b0008510d29` is the recorded rollback, not current production. #659 changed no Firebase, provider configuration, account, sign-in state, production data, payment, or connected directory behavior. Officers do not run commands, sign in, enter data, or approve this as a reusable release. Follow the completed record in [Review, merge, release, and check a change](./docs/officers/PUBLISH_AND_CHECK.md).
 
-As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project. CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source and proves it with disposable API and browser sign-in/sign-out checks. Readback shows improved email privacy, only the two staging domains, no other provider, billing disabled, and zero users/records after cleanup. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a code guard for a future deployment of only the two profile Functions. It does not deploy them, and billing remains unapproved. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) has now reached its monitoring checkpoint: exact merged source `bce911a7083201cfe2141edaa9660f210287bf57` is live at [run-mprc-staging.web.app](https://run-mprc-staging.web.app) as Hosting version `8556fc51210bdc66`; one score-based App Check key is restricted to only the two staging hosts and registered to the one web app for one-hour tokens; and Authentication plus Firestore are monitoring requests with replay protection off. Public root and Events checks passed, the empty Events result rendered correctly, and browser warnings/errors were absent. This remains an **ENGINEERING STAGING SITE ONLY**: the new disposable browser Auth proof, App Check enforcement/readback, missing-token denial, final token-bearing replay, Functions, outside-provider sandbox, protected automatic release, release marker, tested rollback, complete security headers, custom domain, and officer publish control are still **NOT AVAILABLE YET**. Officers do not sign in, enter data, run commands, configure providers, attach billing, or treat this checkpoint as a usable member backend. Users and root collections remain zero; Netlify still answers `runmprc.com`; production Firebase Hosting remains empty; and DNS, GitHub Pages, Netlify, production Firebase, production data, and live website behavior are unchanged.
+As of **2026-08-26**, WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) is merged, and WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created the club-owned `run-mprc-staging` project. CI-001C1 [#667](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/667) adds a separate protected read-only identity check: Dave Liu or Jeff Chang reviews exact `main`, and a keyless five-minute identity may read only the staging project identity. It cannot deploy Firebase. CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) adds an empty, delete-protected staging Firestore database and the exact reviewed Rules/index definitions. Anonymous reads of three fixed server-only paths were denied, and the database still had zero root collections after verification. CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) deploys password-required email/password Auth from exact merged source and proves it with disposable API and browser sign-in/sign-out checks. Readback shows improved email privacy, only the two staging domains, no other provider, billing disabled, and zero users/records after cleanup. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds a code guard for a future deployment of only the two profile Functions. It does not deploy them, and billing remains unapproved. CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) now enforces App Check on staging Authentication and Firestore: exact source `bce911a7083201cfe2141edaa9660f210287bf57` is live at [run-mprc-staging.web.app](https://run-mprc-staging.web.app) as Hosting version `8556fc51210bdc66`; one score-based key is restricted to only the two staging hosts and registered to the one web app for one-hour tokens; and both services read `ENFORCED` with replay protection `OFF`. A made-up browser account completed create, sign-out, fresh sign-in, and post-enforcement sign-in; token-bearing empty Events reads worked signed in and signed out without browser warnings/errors. Requests without App Check were denied by Auth and Firestore, and cleanup returned users and root collections to zero. This remains an **ENGINEERING STAGING SITE ONLY**: Functions, outside-provider sandboxes, protected automatic release, release marker, tested rollback, complete security headers, custom domain, and officer publish control are still **NOT AVAILABLE YET**. The account page therefore shows a safe unavailable profile state. Officers do not sign in, enter data, run commands, configure providers, attach billing, or treat App Check as a complete member backend. Netlify still answers `runmprc.com`; production Firebase Hosting remains empty; and DNS, GitHub Pages, Netlify, production Firebase, production data, and live website behavior are unchanged.
 
 The optional profile-photo and officer People-finder functions are still **NOT AVAILABLE YET**. #621 makes the frontend default an inert preview: My Account shows the future photo and separate finder-choice controls disabled, while the People finder stays behind the administrator guard and shows its name field and Search button disabled. The preview reads no saved photo or setting, accepts or uploads no photo, searches no name, and saves nothing; it shows no people or sample results. #623 published exactly that disabled interface as deploy `6a7e072f8f346b0008510d29`. Officers inspect the protected layouts only in synthetic local artifacts. The completed signed-out production review proved only the exact revision, normal sign-in and administrator guards, and absence of a member-directory network request. Do not sign in to production, choose a real photo, enter a real name, or treat the preview as a directory. #623 changed no Firebase, provider configuration, account, sign-in, or production data. #507 must later prove the privacy, authorization, staging, backend-first deployment, and readback gates before a separate reviewed source change may connect it. Follow the preview and source-review procedure in [Events, shop, members, and money](./docs/officers/EVENTS_SHOP_MEMBERS.md).