[daliu]

Build opt-in runner connections for MPRC so members can find compatible running partners and occasionally broaden their circle. Related to #689; keep this PR draft and the feature disabled until the remaining integration and privacy requirements are complete.

Behavior

• Separate runner cards cover pace, distance, weekly availability, coarse areas, terrain, running style, goals, experience and optional interests. New cards require explicit 18+ self-attestation and unchecked sharing choices. No DOB or verified-age claim.
• Matching requires a feasible shared run and reciprocal experience preferences. A fixed daily selection offers at most four similar runners plus one mutually opted-in broadening suggestion from a bounded 48-entry sample. Editing, hiding and refreshing do not refill slots.
• The server checks current verified/non-revoked accounts and canonical membership. Browser roles or mirrored profiles never establish eligibility. Fresh delivery checks repeat consent, membership, feasibility and directed block checks.
• Profile saves, withdrawals and privacy choices use revision checks, stable request IDs and atomic minimal audit records. Exact retries recover uncertain outcomes. Own read/withdrawal/privacy controls remain available after membership expiry while the account is otherwise eligible.
• Hide affects one person's results; either person's block suppresses both directions. Cards exclude UID, contacts and private preferences. Storage paths deny all browser access, including administrators. Callables enforce App Check, private/no-store replies, bounded resources and separate request limits.
• The disabled interface provides exact previews, explicit consent, safe retry, account/app isolation, cleared stale results and visit-only own-choice undo. Persistent privacy-history management remains unfinished.

Integration and release boundary

The branch incorporates current main and Node 22 PR #692 at merge commit 183278803cd5e5c29b578d5974bba892dc80c247. Both security records are preserved. The test-only HTTP harness now matches the parent Node 22 engine, with a drift regression test; runner CI mutation fixtures are scoped to their own job. All six required CI jobs and both protected-release checks remain intact.

No runner handler is imported/exported by the production Functions index. The UI source gate remains false. This PR adds no dependency resolution, membership writer, real-data backfill or payment change relative to current main. It does not widen the existing two-profile-Function release scope.

Before a pilot: complete canonical membership population and UID uniqueness (#81/#114/#115), bounded persistent privacy-choice management, consent/retention/account-deletion approval, normal app sign-in/service-locator integration, hosted cryptographic Auth/App Check and CORS verification, and protected release prerequisites. A limited sample is not an exhaustive club search; point-in-time checks cannot recall delivered data.

Validation

Latest local combined-source checks:

• Node 20.19.5 and Node 22.23.3 each pass 7,669 ordinary Functions tests; 171 emulator-only cases explicitly skipped.
• Node 22/Java 21 isolated actual-client HTTP suite: 8 passed, zero skipped, followed by emulator shutdown. Covers lost committed reply/retry, denied missing tokens/membership/accounts, closed projections/cache headers, suggestions, block/undo and withdrawal.
• 140 workflow/release/staging/dependency checks, Functions lint, exact frontend lint inventory and whitespace checks pass. Lint inventory remains 127 files with unchanged 113 errors/6 warnings.
• Runtime parity and runner CI mutation tests failed before the corresponding integration fixes; no security assertion or gate was relaxed.

Exact-head CI 36496834485 passed all six jobs on 1832788. Job details/logs confirm 1,384 frontend tests, 468 Rules tests, 107 runner-emulator tests, 140 contract checks, 63 commerce-journal tests, optimized build and artifact verification executed successfully. The Node 22 integration job passed 7,777 cases with only the 63 separately tested commerce cases skipped. The preserved Node 20 Rules job ran all 8 HTTP tests with zero skips; its emulator used the Node 20 host despite the Node 22 manifest. The separate local HTTP run above used Node 22. No hosted-runtime or deployment claim follows from either.

Separate September 27 browser rehearsal used actual RunnerWorkspace/client with synthetic local Auth/Functions/Firestore: save/reload, phone suggestion/block/undo, withdrawal/reload and nonmember denial passed. No phone overflow or captured console warnings/errors. Normal zero-record cleanup and emulator shutdown were verified; forced interruption remains unproven. This is local integration evidence, not normal app login, hosted token verification or a live feature. Historical evidence and limits are preserved in docs/RUNNER_CONNECTIONS.md; existing dependency advisories remain unresolved.

Officer impact: No live change; runner connections remain NOT AVAILABLE YET.

Officer documentation: docs/officers/RUNNER_CONNECTIONS.md, handbook link, docs/RUNNER_CONNECTIONS.md, and corresponding root design/security/operations records.

Deployment evidence: Source and tests updated; this PR is not merged to main. No website release, Firebase deployment, outside-provider change or production behavior verification. An automatic PR preview is not a connected member service. Existing #113/#133/#136 release and billing prerequisites remain separate.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	1832788
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6abaf497efbc9100081884bb
😎 Deploy Preview	https://deploy-preview-690--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.