[daliu]

Outcome

Prepare a small, cost-conscious community backend without changing public pages or member records. This is source-only work for #683; it does not enable billing or deploy anything.

Changes and invariants

• Bind only createMemberOnSignUp and ensureMemberProfile to minInstances 0, maxInstances 2 each, memory 256MB, and timeoutSeconds 30.
• Test actual installed-SDK endpoint metadata, unchanged trigger identities, and existing create-once/recovery behavior.
• Require matching resource settings in safe provider readback. Google's proto3 API can omit a zero minimum; record that documented encoding explicitly. Missing maximum/memory/timeout or malformed values still fail.
• Document public run/event/join/contact priorities, optional accounts, and keeping custom commerce/mail/uploads/synchronization out of the initial deployment.
• Preserve schema, claims, authorization/App Check behavior, existing data, Node runtime, dependencies/lockfiles and the exact two-Function deployment scope. No migration.

Verification

• Regression-first: resource metadata tests failed before the bindings; negative release-limit test failed before validation; omitted-zero compatibility tests failed before the API decoding fix.
• Node 20.20.2 lockfile installs. Credential-free tests with external-network guard.
• Functions lint passed. Full Functions suite: 70 passed / 2 skipped suites; 7,572 passed / 64 skipped tests. The skipped suites require emulators; no production access.
• Focused profile + resource metadata: 24 passed.
• Full nine source safety suites: 132 passed.
• Frontend reviewed lint baseline passed (120 files; 113 existing errors / 6 warnings unchanged).
• Diagnostic optimized frontend build passed with synthetic staging configuration; no sitemap regeneration.
• git diff --check passed. No dependency, lockfile or sitemap changes.
• Hosted CI and exact-main result will be recorded before source closure.

Review, compatibility and remaining release gates

Auth, claims, App Check, Firestore Rules, transaction behavior, retries and log content remain unchanged. No catch-all permission, new dependency, API/IAM grant or additional deployment target. Readback emits only safe allowlisted metadata.

Zero warm instances can cause cold starts; capped scaling can cause temporary busy responses; timeouts can leave an uncertain committed result. Staging must prove cold-start, small concurrent burst, retry/recovery and public-page availability before release. These settings are not a monthly spending cap; transient scaling, storage and deployment artifacts can still cost money.

#113/#133/#136 release dependencies, runtime maintenance, least-authority provider configuration, budgets/eligible service caps and cleanup remain open. No actual hosted resource limits or savings are claimed.

Officer impact: Keep a useful public community site and optional accounts while preparing a smaller backend; no public feature or existing record is removed.

Officer documentation: docs/officers/LOW_COST_COMMUNITY.md, docs/officers/README.md, OFFICER_START_HERE.md, SYSTEM_DESIGN.md, OPERATIONS_RUNBOOK.md and GITHUB_ISSUES.md. Backup-officer review: scope/proof/stop/undo steps are readable without a terminal; a platform specialist is explicitly still required for provider setup, release and rollback.

Deployment evidence: Source changed and local tests passed. Not merged at submission; website not published by this change; runmprc.com not reverified; Firebase Functions not deployed; no outside-provider configuration changed. Separate read-only staging billing check on 2026-09-11 returned disabled/unlinked; no card or billing action.

References: v1 API schema, documented omitted-zero JSON encoding.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	5a2def3
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6aa4b72fd5920c0008354eff
😎 Deploy Preview	https://deploy-preview-684--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Review and CI follow-up: the first hosted run exposed a self-containment problem in the new actual-SDK test, not a backend regression. The Auth metadata getter needs GCLOUD_PROJECT; the local invocation had supplied a demo value. Reproduced the failure with an empty environment, then fixed only the fixture to install/restore demo-mprc-local. No workflow credentials or cloud access were added. Full Functions suite now also passes from an empty environment (7,572 passed / 64 existing skips), and Functions lint passes.

Reviewed the complete scoped diff for authorization, App Check, input bounds, PII/logs, retry/idempotency and production fallback: the runtime bindings and safe metadata verifier do not change handler transitions or data. Source max/min/memory/timeout assertions use the actual SDK; missing/wrong provider settings are covered, including the documented omitted-zero minimum. No migration or new dependency.

Officer review: the guide distinguishes source from hosted state, explains cold-start/saturation/timeout and monetary-limit caveats, provides a no-terminal proof/stop/undo path, and explicitly names the remaining specialist dependency. Existing release gates remain in force. Awaiting exact revised-head CI before merge.

[daliu]

Final source review evidence (2026-09-11 Pacific):

Exact head 5a2def3 passed CI run 34667440575: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34667440575 . Inspected job and step details: all five jobs and every listed step succeeded; no skipped test/build step. These include frontend lint/Jest/SPA/safety/build/artifact checks, Functions lint/tests, Firestore Rules emulator, command-journal concurrency emulator, and artifact scrubber. The earlier run's metadata-fixture failure is repaired, not bypassed.

The ordinary exact-head squash merge was attempted and GitHub rejected it because main requires one approving review. The repository owner's admin exemption exists, but no override or branch-protection change was used. Self-review is recorded above; it is not being represented as a separate GitHub approver. PR and #683 remain open pending the required review or an explicit owner decision about the existing admin merge exemption. No exact-main success or issue completion is claimed.

Officer impact: Initial scope and resource settings are prepared; public pages, existing profiles and club services are not removed.
Officer documentation: The new LOW_COST_COMMUNITY guide, officer entry links and root design/operations/issue records are included in this PR. Specialist setup/release/rollback remains explicit.
Deployment evidence: Source changed, local tests passed, exact PR CI passed, code not merged. Existing Netlify integration reports a successful synthetic deploy-preview (not visually reverified here); no production website release, runmprc.com verification, Firebase Functions deployment, billing/card/API/IAM/DNS configuration, or production-data action was performed. Hosted resource settings, cost controls and quality evidence remain future release work.

[daliu]

Owner-authorized merge exception — 2026-09-14: Dave explicitly authorized using the existing administrator override for this reviewed, source-only PR as the sole maintainer. Rechecked exact head 5a2def3 and unchanged base 1f27b06. All five jobs and every listed step in CI run 34667440575 succeeded. The exception is for this merge only; no branch-protection settings, environment approvals, billing, deployment authority or provider configuration will be changed. Self-review is not represented as another approving reviewer. Exact-main CI will be checked before source issue closure.

[daliu]

Source completion — 2026-09-14 Pacific

PR #684 merged using Dave's explicit, one-time administrator-override authorization. Exact main commit: 925a677. Its full tree matches reviewed head 5a2def3; main is still at that merge. No new source edit or dependency/lockfile change was made during this merge turn.

Reviewed-head CI: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34667440575
Exact-main CI: https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/34925782625

Both runs passed all five jobs; inspected step details show every listed step succeeded, with no skipped workflow step. The jobs cover frontend lint/Jest/SPA/workflow safety/build/artifact verification, Functions lint/tests, Firestore Rules emulator, command-journal concurrency emulator, and test artifact safety. The previously documented emulator-dependent skips inside the plain Functions unit suite are not being represented as executed there; the dedicated emulator jobs ran and passed.

The merge exception did not change branch protection: one approving review remains required, with the same existing administrator exemption. No independent approval is fabricated.

Officer impact: Conservative resource settings and a community-first scope are now in main. No public feature or existing member record is removed.
Officer documentation: docs/officers/LOW_COST_COMMUNITY.md plus its two officer entry links and root design/operations/issue records were included in the merged PR. Rechecked the guide as a backup officer: purpose, approver, prerequisites, steps, proof, stop, undo and escalation are present; provider setup, release and rollback still explicitly require a specialist.
Deployment evidence: Source changed, tests passed, code merged. No website or Firebase deployment was requested/executed in this turn; runmprc.com and outside-provider state were not reverified, and no billing/card/API/IAM/DNS or production-data action was performed. The September 11 disabled/unlinked billing read is historical evidence, not a fresh September 14 check. Hosted limits, cost savings and production behavior are NOT verified by this source closure.

No migration is required; schema, claims, authorization/App Check, transactions and retry semantics are unchanged. Existing #113/#133/#136 release prerequisites, runtime maintenance, cost controls and synthetic cold-start/burst/recovery checks remain open. Close only source issue #683, not the backend-release goal.