From 39d017249143784af53da22259fe832c715c59c2 Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Wed, 26 Aug 2026 20:36:37 -0700 Subject: [PATCH] docs: reconcile current App Check status --- OPERATIONS_RUNBOOK.md | 4 ++-- README.md | 2 +- SYSTEM_DESIGN.md | 6 +++--- docs/officers/PUBLISH_AND_CHECK.md | 6 +++--- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index 2b3e3f5..5949345 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -63,7 +63,7 @@ Maintain an internal inventory with project/account IDs and console links: | --- | --- | --- | --- | --- | --- | | Local source runtime | `demo-mprc-local` emulators | Providers remain separately gated | `localhost:3000` | None | Available for synthetic Firebase work after all three loopback emulators report ready | | CI | Separate named demo/emulator projects | Fixtures/test only | None | CI | Frontend, Functions, Rules, SPA, and commerce-journal checks run; broader gates remain partial | -| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus deployed password-required email/password Auth; source-only exact two-Function guard; no Functions, App Check, or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static Hosting, protected project-identity proof, empty delete-protected Firestore, disposable Auth proof, and Function command guard are available; billing and usable backend/provider staging remain launch blockers | +| Staging | `run-mprc-staging` | Empty Firestore Rules/index boundary plus deployed password-required email/password Auth and enforced App Check for Auth/Firestore; source-only exact two-Function guard; no Functions or provider sandbox | `run-mprc-staging.web.app`; `dev.runmprc.com` not configured | `staging`: two reviewers, exact `main`, read-only OIDC verifier | Static Hosting, protected project-identity proof, empty delete-protected Firestore, disposable Auth/App Check proof, and Function command guard are available; billing and usable backend/provider staging remain launch blockers | | Production | `mid-peninsula-running-club` (verify) | Live + unique endpoint | `runmprc.com` | `production` | Informational site only until gates close | WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) created and provider-read back `run-mprc-staging`, one web app, and Hosting version `3ffadcf2ac8cc760` from source `a614c68d9a1a2be631a3be874a686d61e5d170a0` on 2026-08-26. Always name that project explicitly; `.firebaserc` still defaults to the demo namespace. The static host is not complete environment isolation. @@ -74,7 +74,7 @@ CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) provi CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) first adds the source contract for Firebase Authentication: only `emailPassword: true`, with no anonymous, Google, or phone provider in source. `npm run deploy:staging-auth` is fixed to Firebase CLI 15.24.0, `--only auth`, and `run-mprc-staging`; its lifecycle guard also requires that exact cloud/quota project, the declared `runmprc@gmail.com` account, a short-lived `FIREBASE_TOKEN`, no ADC file override, and the unchanged demo default alias. Do not run that command from a branch. Merge and verify the exact source first. -The bounded provider phase ran on 2026-08-26 from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` after all five required jobs in CI run `33011780449` passed. Live readback showed the instrumentless `IDENTITY_PLATFORM` subtype with billing disabled; password-required email/password and improved email privacy were enabled; authorized domains were exactly `run-mprc-staging.firebaseapp.com` and `run-mprc-staging.web.app`; and anonymous, phone, native federated, OIDC, and SAML providers were absent. A disposable reserved-domain user passed API create/sign-in, generic invalid-credential, anonymous-denial, and browser sign-in/sign-out checks. No out-of-band email or SMS was requested. Cleanup returned Auth to zero users and Firestore to zero root collections. Hosting remained version `3ffadcf2ac8cc760`; Functions and App Check remained unavailable; production was untouched. This evidence is not a reusable officer deployment control. +The bounded provider phase ran on 2026-08-26 from exact merged source `42542303d043f87a8f1a04be2f0b4f2a88e0318c` after all five required jobs in CI run `33011780449` passed. Live readback showed the instrumentless `IDENTITY_PLATFORM` subtype with billing disabled; password-required email/password and improved email privacy were enabled; authorized domains were exactly `run-mprc-staging.firebaseapp.com` and `run-mprc-staging.web.app`; and anonymous, phone, native federated, OIDC, and SAML providers were absent. A disposable reserved-domain user passed API create/sign-in, generic invalid-credential, anonymous-denial, and browser sign-in/sign-out checks. No out-of-band email or SMS was requested. Cleanup returned Auth to zero users and Firestore to zero root collections. At that #671 checkpoint, Hosting remained version `3ffadcf2ac8cc760`, Functions and App Check were unavailable, and production was untouched; #676 separately records the later Hosting version and current App Check enforcement. This evidence is not a reusable officer deployment control. CI-001D3 [#674](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/674) adds `npm run deploy:staging-profile-functions` as a source-only, argument-closed wrapper. Before Firebase CLI it checks the demo-only default alias, one reviewed Functions codebase, both exact profile exports, lockfile CLI 15.24.0, `run-mprc-staging` as both project and quota project, `runmprc@gmail.com` as the declared operator, an in-memory short-lived token, no credential-file override, and exactly `functions:createMemberOnSignUp,functions:ensureMemberProfile`. Do not add arguments or invoke the command directly from a branch. Read-only preflight on 2026-08-26 showed the club account is project Owner, project billing is disabled, and that account can see zero open billing accounts. Firebase requires Blaze for Function deployment, so do not enable APIs or run this command until a separately approved billing account, budget/alerts, exact-main source, and provider release issue exist. The guard itself deploys nothing and does not make App Check or staging profile behavior available. diff --git a/README.md b/README.md index 4d509a8..442dba2 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ npm start Open only `http://localhost:3000`. Stop if Firebase traffic uses a non-loopback host. Use synthetic records only. This does **not** make checkout, refunds, email, Strava, or other outside-provider calls safe; follow [OPERATIONS_RUNBOOK.md](./OPERATIONS_RUNBOOK.md) before any provider test. -Do not use a Netlify preview, locally served optimized `build/`, or `run-mprc-staging` with real identities, private/member records, admin work, or outside-provider actions. WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) makes optimized builds choose `staging` or `production` explicitly. WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) verifies the owned static stage, CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) verifies its empty Firestore Rules/index boundary, and CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) proves only bounded disposable email/password Auth behavior. Functions, App Check, and outside providers are still not isolated for end-to-end use. +Do not use a Netlify preview, locally served optimized `build/`, or `run-mprc-staging` with real identities, private/member records, admin work, or outside-provider actions. WEB-001A1 [#663](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/663) makes optimized builds choose `staging` or `production` explicitly. WEB-001A2 [#665](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/665) verifies the owned static stage, CI-001D1 [#669](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/669) verifies its empty Firestore Rules/index boundary, CI-001D2 [#671](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/671) proves bounded disposable email/password Auth behavior, and CI-001D4 [#676](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/676) enforces App Check for Authentication plus Firestore. Functions and outside providers are still not isolated for end-to-end use; App Check does not authorize member, admin, payment, or provider behavior. ## Verification diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 99a9401..73b61c9 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -270,10 +270,10 @@ flowchart LR Deploy --> Readback["Provider/domain/privacy readback"] Readback --> Synthetic["Disposable API + browser proof\nthen zero users"] Broader["Anonymous, Google, phone,\nproduction, ADC, or broad scope"] --> Stop["Reject"] - Synthetic -. "No Functions, App Check, or real data" .-> Stop + Synthetic -. "#671 excludes Functions, App Check,\nand real data" .-> Stop ``` -Text alternative: exact reviewed source permits only a guarded Auth deployment to staging; live readback proves password-required email/password, improved email privacy, only staging domains, no other provider, and zero users after disposable API and browser checks. Functions, App Check, production, and real data remain outside the boundary. +Text alternative: exact reviewed source permits only a guarded Auth deployment to staging; live readback proves password-required email/password, improved email privacy, only staging domains, no other provider, and zero users after disposable API and browser checks. Functions, App Check, production, and real data were outside the #671 boundary; #676 separately proves current App Check enforcement for Auth plus Firestore. ## 4. Target deployment topology @@ -1785,7 +1785,7 @@ Text alternative: the local browser uses only the three loopback Firebase emulat Optimized builds must select `staging` or `production` explicitly. WEB-001A1 #663 rejects missing, local, incomplete, or cross-environment Firebase web configuration, and its artifact check rejects known production identities from a staging executable. Ordinary Netlify deploy previews receive and scan only the reserved synthetic configuration; `run-mprc-staging.web.app` receives and scans the real isolated staging web-app identity; the pinned release builder receives and scans the exact reviewed public production web configuration. The owned staging project now has an empty Rules-protected Firestore boundary, verified password-required email/password Auth with improved email privacy, and App Check enforced for Auth plus Firestore. #671's disposable API/browser checks and #676's browser/denial/enforcement checks each returned the project to zero users and records. #674 narrows the future manual Function command to both profile Functions together, but billing is unapproved and no Function is deployed. The project still lacks Functions and outside-provider isolation. Netlify previews remain public, signed-out, read-only visual review only; the Firebase staging host permits only issue-scoped disposable engineering checks until #105/CONFIG supplies complete backend/provider evidence. Never use a real identity, private/admin record, or outside-provider action there. -`SITE_ORIGIN`, Firebase project IDs, App Check keys, Stripe keys, webhook endpoints, Sentry environments, and email providers must be environment-scoped. Live and test webhook secrets are never interchangeable. `run-mprc-staging` now supplies the public web app, Hosting, empty Firestore Rules/index boundary, and deployed/verified narrow Auth boundary. The #674 source guard is not a hosted backend. End-to-end rollout still needs approved billing, Functions, App Check, deployment authority, and outside-provider configuration and evidence. +`SITE_ORIGIN`, Firebase project IDs, App Check keys, Stripe keys, webhook endpoints, Sentry environments, and email providers must be environment-scoped. Live and test webhook secrets are never interchangeable. `run-mprc-staging` now supplies the public web app, Hosting, empty Firestore Rules/index boundary, deployed/verified narrow Auth, and App Check enforcement for Auth plus Firestore. The #674 source guard is not a hosted backend. End-to-end rollout still needs approved billing, deployed Functions with callable App Check enforcement, deployment authority, and outside-provider configuration and evidence. CONFIG-001A [#149](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/149) adds the source boundary for current commerce and confirmation-mail Functions: local is exact loopback, tests use HTTPS `.test`, staging is exactly `https://dev.runmprc.com`, and production is exactly `https://runmprc.com`. Test/live expected mode must match the server-key marker on the four key-bound Functions. Webhook and mail receive no Stripe API key, and invalid settings stop before rate-limit, business, mail, event-ledger, or Stripe writes. This source boundary does not create staging, configure Secret Manager or Stripe, deploy Firebase, enable commerce, or prove live behavior. diff --git a/docs/officers/PUBLISH_AND_CHECK.md b/docs/officers/PUBLISH_AND_CHECK.md index 3c0f378..3ec67d1 100644 --- a/docs/officers/PUBLISH_AND_CHECK.md +++ b/docs/officers/PUBLISH_AND_CHECK.md @@ -516,11 +516,11 @@ Text alternative: exact reviewed source and a narrow club-account Auth operation 5. Confirm anonymous, phone, native federated, OIDC, and SAML providers are absent; multi-tenancy and blocking triggers are absent; and MFA is disabled. 6. Confirm the instrumentless Identity Platform subtype has billing disabled. Treat its no-cost daily limit as a ceiling, not approval to attach billing or add enterprise providers. 7. Confirm disposable API signup/sign-in, anonymous denial, generic invalid-credential behavior, and browser sign-in/sign-out passed without requesting email or SMS. -8. Confirm the final Auth user count and Firestore root collection count are both zero, and Hosting remains version `3ffadcf2ac8cc760`. -9. Confirm Functions, App Check, outside providers, production Firebase, production data, DNS, Netlify, and `runmprc.com` are recorded separately as unchanged or unavailable. +8. Confirm the #671 evidence ended with zero Auth users, zero Firestore root collections, and then-current Hosting version `3ffadcf2ac8cc760`. Do not mistake that historical Hosting version for the later #676 release. +9. Confirm Functions, App Check, outside providers, production Firebase, production data, DNS, Netlify, and `runmprc.com` were recorded separately as unchanged or unavailable at the #671 checkpoint. Then use the [current App Check review](#review-staging-app-check-enforcement--available-after-676) for the later enforcement state. 10. Record the issue, pull requests, exact commits, check date, approver, and any mismatch. Do not paste a token, account record, console response, or private screenshot. -**Expected result:** a backup officer can confirm narrow staging Auth works for disposable engineering checks and can distinguish it from a usable member backend. Functions, App Check, roles, profiles, real identities, provider integrations, and production remain unavailable. +**Expected result:** a backup officer can confirm the narrow #671 staging Auth proof and distinguish it from the current environment and a usable member backend. #676 now separately verifies App Check for Auth plus Firestore; Functions, roles, profiles, real identities, provider integrations, and production remain unavailable. **Stop conditions:** stop if a provider, domain, project, account, commit, billing state, user count, record count, Hosting version, or remaining-gap statement differs; if evidence relies only on source or CI; or if anyone asks an officer to sign in, create a user, run a command, handle a credential, or inspect an account.