From 14a72e8ce1a76d6c1276e3ce72d12d59ecd9e5ee Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Sun, 11 Oct 2026 15:05:59 -0700 Subject: [PATCH] docs: record hosted staging profile proof and owned cleanup --- GITHUB_ISSUES.md | 2 +- IMPLEMENTATION_PLAN.md | 2 ++ OFFICER_START_HERE.md | 6 +++--- OPERATIONS_RUNBOOK.md | 2 ++ SECURITY.md | 2 ++ SYSTEM_DESIGN.md | 2 ++ docs/officers/LOW_COST_COMMUNITY.md | 20 +++++++++++++------- docs/officers/PUBLISH_AND_CHECK.md | 2 +- docs/officers/README.md | 2 +- docs/officers/SYSTEM_MAPS.md | 4 ++-- 10 files changed, 29 insertions(+), 15 deletions(-) diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index 5889c08..9bc6e94 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,6 +1,6 @@ # GitHub Issue Backlog: Secure Commerce Program -**CI-001C4 / #701 (2026-10-11):** scoped staging runtime/build permissions and protected deployment/hosted proof of `createMemberOnSignUp` and `ensureMemberProfile`. Production data, payments, website publication and parent #113/#133/#136 remain outside this slice. Initial baseline has no Functions. No schema/claims migration; create-once profiles remain unchanged. Source preparation is not hosted completion. Officer impact: staged profile readiness with normal approval and administrator bypass disabled. Officer documentation: ACCESS_CONTINUITY, LOW_COST_COMMUNITY, SYSTEM_MAPS and entrypoints. Deployment evidence: pending exact source, provider readback and made-up hosted checks on the native issue. +**CI-001C4 / #701 (2026-10-11):** exactly `createMemberOnSignUp` and `ensureMemberProfile` were deployed to isolated engineering staging by protected run 38176811598 from `2843388`, with six exact-main checks and normal delegated daliu approval. Both native source archives match the reviewed bundle; Node 22/min0/max2/256 MB/30s and explicit runtime/build identities are verified. Genuine browser App Check/Auth, seven callable denials, signup, recovery, two concurrency cases, profile/claim preservation and background replay passed. Two owned test accounts/profiles were removed; Auth count0/empty collection metadata restored. No schema migration, real data, email, payment, website publication or production deployment. Officer impact: verified staging profiles and no administrator bypass. Officer documentation: low-cost procedure, maps and entrypoints updated. Deployment evidence: native issue and dated guide. #113/#133/#136 and broader core operations stay open. **Prepared:** 2026-07-12 **Status:** Dated design/assessment catalog; GitHub is canonical for execution diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index be5b582..1e0e823 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -9,6 +9,8 @@ This plan turns the target architecture into a dependency-ordered delivery progr ### Initial profile release runtime prerequisite +**Isolated engineering proof completed, 2026-10-11 — #701:** two Node 22 staging profiles were protected-deployed from `2843388`, then tested with actual browser attestation, disposable accounts, denied requests, repeats/concurrency and background replay. Owned data was removed; no schema migration or production/website/payment release. This closes only the scoped runtime/profile proof, not #113/#133/#136 or the commerce sequence. Existing dependency advisories, legal/payment policy, production disposition/authority and full lifecycle acceptance remain separate work. + RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepares Node 22 before the two-Function profile release under #136. Keep the five existing Node 20 checks and require a sixth, separate Node 22 backend/profile-emulator job in both protected-release CI checks. Match manifest, lock metadata, deployment builder, and provider runtime readback. Preserve CommonJS, first-generation triggers, create-once behavior, schema, and #683 resource limits; no backfill is needed. A fixed immutable error stack is the only backend logic adaptation. Node 22 source and passing synthetic tests do not resolve billing, #113 estate disposition, #133 authority, hosted behavior, or existing dependency advisories. Do not merge or deploy runner matching as part of this runtime prerequisite. ## 1. Program outcome diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index 4f602d1..3cf50c0 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -10,13 +10,13 @@ Attach the exact wording, public link, or approved photo when you have it. The AI should ask questions if anything is unclear. -**Backend maintenance, 2026-09-27:** [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepares a supported server runtime, Node 22, in source. It does not publish a website, deploy Functions, or add billing. The first backend release is still on hold. Follow the [low-cost review](./docs/officers/LOW_COST_COMMUNITY.md) and ask a maintainer for separate hosted proof; no officer terminal work is needed. +**Historical runtime preparation, 2026-09-27:** #691 prepared Node 22 without deployment. #701 now verifies only two staging profiles on that runtime; production and wider club operations remain on hold. Follow the [dated low-cost proof](./docs/officers/LOW_COST_COMMUNITY.md); no officer terminal work is needed. -**Staging cost setup, 2026-10-11:** [#693](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/693) verified the club's $300 Free Trial, expiring January 10, 2027, and linked engineering staging with a monthly $10 usage-warning budget. Alerts at $5/$9/$10 ignore credits so underlying usage remains visible; they do not stop spending. No paid upgrade or production billing link occurred. Functions and member/payment workflows are still **NOT AVAILABLE YET**. The [trial review](./docs/officers/LOW_COST_COMMUNITY.md#check-the-trial-and-warnings-without-a-terminal) explains what an officer can check privately without handling payment details or using a terminal. Earlier billing-disabled staging checkpoints below are historical. +**Staging cost setup, 2026-10-11:** [#693](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/693) linked the club Free Trial (January 10, 2027 expiry) and configured monthly $10 warnings at $5/$9/$10, excluding credits. They do not stop spending or prove zero cost. No paid upgrade or production billing link occurred. #701 subsequently deployed only two staging profile Functions; wider member/payment operations remain unavailable. The [trial review](./docs/officers/LOW_COST_COMMUNITY.md#check-the-trial-and-warnings-without-a-terminal) uses private provider proof, not payment details or an officer terminal. ## Choose the closest task -**Focused staging release, 2026-10-11:** [#699](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/699) completed its protected identity proof. [#701](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/701) separately prepares two staging profile Functions and made-up hosted tests. Dave chose disabled administrator bypass for production/backend-staging; normal self-approval remains. Original read-only staging is unchanged. Follow [the staging procedure](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701), **NOT AVAILABLE YET** until #701 records hosted proof. Production/payments remain unavailable; no officer handles a key or record. +**Staging profiles verified, 2026-10-11:** [#701](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/701) deployed and tested exactly two profile Functions, using scoped identities, genuine browser App Check and made-up accounts. Signup, recovery, denied requests, retries and concurrency passed; both test accounts/profiles were removed. With Dave's delegated decision, administrator bypass is disabled for production/backend-staging; normal self-approval remains. Original read-only staging is unchanged. Follow [the dated staging proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). Production, membership, registration and payments are not launched; no officer handles a key or member record. **Backend ownership, 2026-10-11:** Dave approved continuing without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave remains the sole backend release/recovery approver; backup coverage is absent, not complete. This removes only the backup-appointment gate. Protected deployment, staging proof, rollback and all data/payment approvals remain required. See [the sole-owner procedure](./docs/officers/ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026); no officer handles keys or runs commands. diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index 583aa06..f3754f3 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -728,6 +728,8 @@ CI/staging must eventually include: ### Deployment order +**#701 hosted proof, October 11:** protected run 38176811598 deployed exactly two Node 22 staging profiles from `2843388`; normal delegated daliu approval, no administrator bypass. Both downloaded source archives match the reviewed bundle. Resource/identity readback, genuine browser App Check/Auth, negative inputs, signup/recovery, repeated/concurrent calls and background replay passed; only two owned synthetic accounts/profiles were removed, restoring count0/empty collection metadata. The initial partial release exposed an empty no-retry representation and absent SDK project context; #703 repaired both without widening authority. No provider payment/email test, website publication, production rollout or migration. The [dated officer proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701) separates those states and the specialist recovery path. + For expand-and-contract changes: **Isolated staging profiles (#701):** a separate manual `deploy-staging-profiles.yml` requires exact green main, normal backend-staging approval and thirty-minute keyless credentials. The v1 Functions API selects explicit runtime/build accounts, avoiding Firebase CLI default-account checks and unavailable custom v1 build-account selection. A deterministic ten-file bundle changes only the package entrypoint to `profileOnly.js`, keeping the reviewed dependencies/lockfile and profile logic. No prototype index or payment/mail endpoint is shipped. Runtime permissions: Auth user get, Firestore document get/create and begin/rollback transaction. These are staging project IAM, not collection rules. Build access: source-object read, one image repository write and logs. ActAs is granted only on the two exact staging accounts. Google auto-created a default App Engine Editor grant during API activation; #701 removes that new grant and never selects the account. Initial baseline is no Functions; reviewed roll-forward is preferred, and exact-owned two-Function removal requires Dave/specialist recovery authority, not the deploy principal. No schema migration or production changes. Source/CI/provider/hosted proof remain separate; #113/#133/#136 stay open. See the [officer procedure](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). diff --git a/SECURITY.md b/SECURITY.md index 9e12b32..0bd88b5 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -12,6 +12,8 @@ The public informational website can continue operating with normal care. **Live ### Runtime prerequisite — source only, 2026-09-27 +**Narrow hosted checkpoint, October 11 — #701:** both staging profiles now pass Node 22/source/resource readback and genuine browser App Check/Auth, denied inputs/cross-user reads, create-once concurrency and claim preservation. Runtime has only Auth get plus Firestore get/create/transaction; server IAM is not collection-scoped. Build has source-only read, one repository write and logs; deploy actAs is per exact account, with zero user-managed keys and no Owner/Editor service-account grant. Google's new default Editor grant was removed. Production/backend-staging administrator bypass is disabled; normal self-approval remains. No production/data/payment rollout or broad security certification is implied; all remaining launch blockers still apply. + **Owner-approved backend continuity exception, 2026-10-11:** Dave Liu authorizes Firebase backend setup and protected releases without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave (`daliu`) is the sole named release/recovery owner. Backup coverage remains absent and is no longer an appointment prerequisite for #113/#133/#136. Protected approval, reviewed exact source, least-privilege keyless deployment, MFA/recovery checks, synthetic staging, rollback, legacy-data disposition, cost controls, and payment/legal policy still apply. Existing staging read-only reviewers gain no broader authority. Other backup recommendations remain future continuity work, not this waived backend gate. RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) targets Node.js 22 without changing first-generation triggers, permissions, profile schema, deployment scope, or resource limits. [Google schedules Node 20 decommissioning for October 30, 2026](https://docs.cloud.google.com/functions/docs/runtime-support). Both protected-release CI reads now require the separate Node 22 backend/profile-persistence job, and provider verification rejects either profile Function unless its runtime is exactly `nodejs22`. The original Node 20 baseline checks remain required. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 3464173..4bf4fd3 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -10,6 +10,8 @@ The repository already contains a substantial prototype: a public React site, Fi ## 1. Goals and non-goals +**Engineering staging checkpoint, 2026-10-11 — #701:** only signup-profile creation and profile recovery are hosted and verified on Node 22. A profile-only entrypoint, explicit runtime/build accounts, scoped IAM and protected keyless deployment exclude commerce/mail/directory/Strava and website publication. Actual source archives/resource limits, genuine App Check/Auth, synthetic signup/recovery/denials/retries/concurrency and owned cleanup passed. Auth count returned to zero; no migration or production data/payment change. This supersedes source-only runtime/profile wording below only for isolated staging, not production or the target commerce platform. See the [dated officer map](./docs/officers/SYSTEM_MAPS.md#scoped-engineering-profile-release--701) and [acceptance proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). + ### Community-first cost direction — 2026-09-11 The owner requests a simpler, low-cost community experience and is willing to supply a personal card as fallback. Prioritize public run/event/join/contact information and optional secure accounts; prefer static delivery and bounded data reads. The first profile release remains only `createMemberOnSignUp` plus `ensureMemberProfile`, not the prototype's commerce, mail, photo-directory, or synchronization services. Preserve their source and security requirements for separately approved later work; this is not permission to weaken trust boundaries or remove existing club services. diff --git a/docs/officers/LOW_COST_COMMUNITY.md b/docs/officers/LOW_COST_COMMUNITY.md index f055385..6876562 100644 --- a/docs/officers/LOW_COST_COMMUNITY.md +++ b/docs/officers/LOW_COST_COMMUNITY.md @@ -4,7 +4,7 @@ **Approver:** Dave Liu for the current simplification request. Any release still uses the named platform/security reviewers. Regular club expenditure needs the club's finance approval; willingness to supply a personal card is not an unlimited club budget. -**Checked:** 2026-10-11. Trial billing and warning-budget settings below were checked directly. Profile Functions and the member/payment workflows are still **NOT AVAILABLE YET**. +**Checked:** 2026-10-11. Two profile Functions are deployed and tested in engineering staging. Production profile deployment, paid membership, event registration and payment workflows remain **NOT AVAILABLE YET**. Trial/warnings below are the earlier #693 checkpoint, not a current invoice or remaining-credit measurement. ## What we are prioritizing @@ -56,7 +56,7 @@ This is an **alerts-only budget**, not a bill ceiling or approval to spend club **Escalation:** platform maintainer for account/configuration or service failures; treasurer/finance approver for spending; cardholder for a paid-account decision. Provider setup and deployment still require a specialist. -## Cost controls in source — NOT AVAILABLE YET in hosted Functions +## Profile cost controls — VERIFIED in engineering staging, not production [Issue #683](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/683) sets the same resource options on both profile operations: @@ -69,11 +69,15 @@ This is an **alerts-only budget**, not a bill ceiling or approval to spend club These are resource settings, **not a maximum monthly bill**. Google can briefly exceed the instance limit during traffic surges. A busy HTTP operation can queue requests and return a temporary busy response. Persistent storage, deployment files, database use, and other services can still cost money. The profile remains create-once so retrying an uncertain result does not overwrite existing information or grant membership. -The #683 source change configured no budget, spending cap, artifact-cleanup policy, billing account, Function, or new host. Its 2026-09-27 billing-disabled/zero-accessible-accounts checkpoint is historical and superseded only for staging billing and the warning budget by the October 11 #693 readback above. Hosted Function limits remain unverified. Card details belong only in Google's secure payment form. +The #683 source change alone configured no provider service. Its older billing-disabled checkpoint was superseded for staging by #693. #701 now verifies all four limits on both hosted staging Functions, with separate runtime/build identities and image cleanup. No paid-account upgrade or production billing change occurred. Card details belong only in Google's secure payment form; configured limits and alerts do not prove zero charges. -[Issue #691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepares Node 22, the program that runs the server code. Google schedules the old Node 20 runtime to be taken out of service on October 30, 2026. The update keeps the same two operations and resource limits. It adds automated compatibility and made-up profile checks, but does not deploy anything or fix every dependency warning. Hosted Node 22 behavior is **NOT AVAILABLE YET**. +[Issue #691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepared Node 22, the program that runs server code, without fixing every dependency warning. #701 now proves that runtime on both staging profiles. Google schedules the old Node 20 runtime to be taken out of service on October 30, 2026. Production deployment is still unavailable; recovery must preserve the supported runtime and resource bounds. -## Profile recovery app attestation — SOURCE ONLY; NOT AVAILABLE YET + + +## Profile recovery app attestation — VERIFIED in engineering staging only + +#701 tested genuine browser reCAPTCHA Enterprise App Check and Firebase sign-in. Missing/invalid app attestation and missing/invalid sign-in returned 401. Role/user-ID injection and an array payload returned 400. Valid requests returned ready; self profile reads succeeded and another made-up user's profile read was denied. Auth and Firestore provider enforcement remain ENFORCED. This does not prove production behavior or activate other services. **Purpose:** make sure profile recovery accepts only a verified request from the club app, even if an environment setting is missing. App Check is Firebase's app-attestation check; it does not establish membership or officer permission. @@ -97,11 +101,13 @@ The #683 source change configured no budget, spending cap, artifact-cleanup poli ## Engineering staging profiles — #701 -The first protected attempt built and activated signup, but the hosted signup test exposed missing explicit SDK project context. #703 repairs that exact partial release and the provider's empty no-retry representation. Partial deployment is not proof of a working profile service. Completed proof still requires both Functions and the hosted checks below; no permission widening or production fallback is allowed. +The first protected attempt was partial and failed its hosted signup check. #703 corrected the provider's empty no-retry representation and supplied explicit staging SDK project context, without widening permissions. The subsequent protected roll-forward and both hosted operations passed. Source and resource metadata alone were not counted as working request proof. **Purpose:** prove only profile creation and recovery using made-up staging accounts. This is not membership approval, event management, a payment release or a public website launch. **Approver:** Dave Liu, sole release/recovery owner. Administrator bypass is disabled; normal self-approval remains permitted. -**Availability:** **NOT AVAILABLE YET** until #701 records exact merged source, protected deployment, actual settings and hosted checks. #113/#133/#136 remain unresolved for production; this isolated engineering proof does not waive them. +**Availability:** **VERIFIED for engineering staging only**, October 11. [Protected run 38176811598](https://github.com/Run-MPRC/Run-MPRC.github.io/actions/runs/38176811598) deployed exactly two Functions from `2843388bb063a0ab31a439c898fcd9242b98ca4c`, after six exact-main checks and normal daliu approval delegated by Dave. Both ACTIVE Functions' downloaded source archives match the reviewed 76,628-byte bundle digest `5dd349869630b3ff8af9ef3c26a116275d0cd0132f039a82675261187247685c`. #113/#133/#136 stay open; no production/website/payment release is implied. + +**Hosted results:** fresh signup created a pending profile without recovery and preserved claims; a failed initial signup was repaired by the normal Account page. Twelve direct callable checks passed, including seven denials and a three-request existing-profile burst. All existing profile fields and both claim maps stayed unchanged. Three simultaneous missing-profile requests returned ready and created one pending profile. An actual background replay preserved fields and document update time. Fresh signup became visible in about 6.5 seconds; measured callable bursts finished within 2.9 seconds. These are small checkpoint samples, not a performance guarantee. Only two owned made-up accounts/profiles were deleted afterward; aggregate Auth count returned to zero and collection metadata was empty. No email, payment or real-data test occurred. **Prerequisites:** #693 trial/warnings, #699 keyless authority, #683/#691/#695 reviewed profile source, #676 staging isolation, and all six exact-main checks. Use only **Deploy two staging profile Functions**, environment **backend-staging**. No real member, email or payment tests. 1. Open the maintainer's run link. diff --git a/docs/officers/PUBLISH_AND_CHECK.md b/docs/officers/PUBLISH_AND_CHECK.md index cec4306..e9872c0 100644 --- a/docs/officers/PUBLISH_AND_CHECK.md +++ b/docs/officers/PUBLISH_AND_CHECK.md @@ -76,7 +76,7 @@ Remote readback on 2026-09-14 found the old #473/#623/#659 hot source refs still ## The release gate -**#701 approval decision, October 11:** administrator bypass is disabled for production/backend-staging; Dave/main and normal self-approval remain configured. #699 completed its read-only identity proof. The separate **Deploy two staging profile Functions** workflow changes only two engineering staging profiles, not the website or production. Follow [the staging procedure](./LOW_COST_COMMUNITY.md#engineering-staging-profiles--701), **NOT AVAILABLE YET** until #701 records protected deployment and hosted proof. General backend/website and member/payment releases remain unavailable until their own proof. No backup appointment is required. +**#701 staged proof, October 11:** administrator bypass is disabled for production/backend-staging; Dave/main and normal self-approval remain. Protected run 38176811598 received normal delegated approval and deployed only two staging profile Functions. Resource/source readback, genuine browser recovery, denied requests, retries, concurrency and made-up-data cleanup passed. Follow [the dated staging procedure](./LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). No website or production release occurred; broader member/payment release gates stay open. No backup appointment is required. **Sole-owner backend decision, 2026-10-11:** under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697), Dave Liu (`daliu`) is the sole backend release/recovery approver. Do not wait for backup appointment or imply backup coverage. The [scoped procedure](./ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026) keeps protected approval, exact source/project/resource checks, keyless least-privilege identity, synthetic staging and reviewed recovery. It grants no broader authority to the existing staging read-only reviewers. The general release remains **NOT AVAILABLE YET** until its other gates are verified. diff --git a/docs/officers/README.md b/docs/officers/README.md index bf230e8..f7f2290 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -33,7 +33,7 @@ In words: approve the merge, request one exact release, and approve its protecte ## Short guides -**Focused backend authority, #699/#701:** #699 completed its protected identity proof. #701 separately prepares two staging profile Functions and synthetic hosted tests. Administrator bypass is disabled for production/backend-staging; Dave/main and normal self-approval remain. [The staging procedure](./LOW_COST_COMMUNITY.md#engineering-staging-profiles--701) is **NOT AVAILABLE YET** until hosted proof is recorded. Existing read-only reviewers gain no deployment access; production/payments remain untouched. +**Staging profiles verified, #701:** two scoped Node 22 Functions passed protected deployment, genuine browser App Check/Auth, signup, recovery, negative requests, retries and concurrency. Only made-up accounts/profiles were used and then removed. Administrator bypass is disabled for production/backend-staging; Dave/main and normal self-approval remain. Read [the dated proof and procedure](./LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). Existing read-only reviewers gain no deployment access; production data/payments and website publication are unchanged. Membership and registrations remain unavailable. 1. [Request a change](./REQUEST_A_CHANGE.md) 2. [Update public content](./UPDATE_PUBLIC_CONTENT.md) diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index 05ce1e5..6c589a3 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -230,11 +230,11 @@ flowchart LR Deploy --> Build["Build identity: source, images, logs only"] Build --> Two["Signup profile and profile recovery only"] Two --> Runtime["Runtime: Auth read; database get/create"] - Runtime --> Stage["Isolated staging; made-up profiles"] + Runtime --> Stage["VERIFIED staging; made-up profiles cleaned up"] Two -. "no release or access" .-> Excluded["Production, payments, email, website publication"] ``` -Text alternative: exact green main and Dave's normal approval permit one bounded staging release; separate build/runtime identities support only two profiles and synthetic staging records, excluding production, payments, email and website publication. Hosted availability needs separate #701 proof. +Text alternative: exact green main and Dave's normal approval permitted the verified two-profile staging release; separate build/runtime identities passed synthetic checks and cleanup, excluding production, payments, email and website publication. #701 records the separate hosted proof; this does not complete the broader platform. ## Emergency decision