[daliu]

Outcome

Profile recovery now requires native Firebase App Check independently of the optional environment flag. Only ensureMemberProfile gains enforceAppCheck: true; signup, resource limits, Auth/schema/claims and all other callables remain unchanged.

Closes #695 (source/test outcome only). Related deployment work #113, #133 and #136 remains open.

Officer impact: The future recovery service rejects unverified app requests before profile work even if an environment setting is absent/false. This does not activate a hosted member feature.
Officer documentation: docs/officers/LOW_COST_COMMUNITY.md includes the read-only attestation review, stop/proof/undo/escalation and matching release diagram. Engineering: SECURITY.md, OPERATIONS_RUNBOOK.md, GITHUB_ISSUES.md.
Deployment evidence: None. No Google/Firebase API, billing, IAM, Auth/Firestore data, Function, website, DNS, Stripe, token or provider configuration changed in this source slice. #693 trial billing/alerts remain a separate verified prerequisite.

Defect and validation

• Before the fix, installed-SDK request-wrapper regressions showed missing/invalid app tokens admitted profile work with ENFORCE_APP_CHECK absent or false. With true, the shared helper rejected later with a different error; this was not native enforcement.
• Added 18 socket-free SDK request-wrapper cases across absent/false/true flags: missing/invalid App Check, valid recovery, anonymous/invalid Auth, and injected profile fields. SDK remains real; token verifiers and profile stores are synthetic. These tests do not prove Google token cryptography, a local browser/emulator flow or hosted behavior.
• Node22 focused checks: 45 passed; full Functions suite: 7,594 passed / 64 skipped (Auth/Firestore and separate commerce integration not run locally). Functions lint passed.
• Exact staging/deployment safety suites: 37 passed. git diff --check passed.
• Existing CI supplies independent Node20 and Node22/full-emulator source evidence after this PR opens; no new workflow or dependency is added.

Review / compatibility

One runtime option is added to the exact callable. CommonJS, first generation, min0/max2/256MB/30 seconds, create-once transactions, pending schema and claim preservation remain unchanged. No migration/backfill or new secret/permission is needed. Shared requireAppCheck and callback-dependent lookupRegistration, lookupOrder and stravaExchangeCode are untouched. Tests use only synthetic values; no credential or provider network is used. Local requests without attestation must also fail rather than falling back to production. Future hosted rollout must prove denial/valid recovery and use a compatible rollback that preserves enforcement.

This is a prerequisite repair, not completion of the full membership/events/MPRC-race payment/cancellation/bib-transfer/refund goal.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	050a30f
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6acbd826213b7e00083ff8db
😎 Deploy Preview	https://deploy-preview-696--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Reviewed the full six-path diff: one native runtime option on the exact recovery callable, 18 real-SDK request-wrapper regressions with synthetic verifiers/stores, and focused officer/engineering handoff. No provider, dependency, schema, shared helper, callback, role, resource-limit or logging change. All six exact-head CI jobs in run 38164814554 succeeded; test/build steps actually ran. Closing-issue references contain only #695. Using the existing sole-maintainer review override for merge; no test, release gate or hosted verification is waived.