docs: verified staging profiles, low-cost controls and cleanup

GITHUB_ISSUES.md

@@ -1,6 +1,6 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
-**CI-001C4 / #701 (2026-10-11):** scoped staging runtime/build permissions and protected deployment/hosted proof of `createMemberOnSignUp` and `ensureMemberProfile`. Production data, payments, website publication and parent #113/#133/#136 remain outside this slice. Initial baseline has no Functions. No schema/claims migration; create-once profiles remain unchanged. Source preparation is not hosted completion. Officer impact: staged profile readiness with normal approval and administrator bypass disabled. Officer documentation: ACCESS_CONTINUITY, LOW_COST_COMMUNITY, SYSTEM_MAPS and entrypoints. Deployment evidence: pending exact source, provider readback and made-up hosted checks on the native issue.
+**CI-001C4 / #701 (2026-10-11):** exactly `createMemberOnSignUp` and `ensureMemberProfile` were deployed to isolated engineering staging by protected run 38176811598 from `2843388`, with six exact-main checks and normal delegated daliu approval. Both native source archives match the reviewed bundle; Node 22/min0/max2/256 MB/30s and explicit runtime/build identities are verified. Genuine browser App Check/Auth, seven callable denials, signup, recovery, two concurrency cases, profile/claim preservation and background replay passed. Two owned test accounts/profiles were removed; Auth count0/empty collection metadata restored. No schema migration, real data, email, payment, website publication or production deployment. Officer impact: verified staging profiles and no administrator bypass. Officer documentation: low-cost procedure, maps and entrypoints updated. Deployment evidence: native issue and dated guide. #113/#133/#136 and broader core operations stay open.
 
 **Prepared:** 2026-07-12
 **Status:** Dated design/assessment catalog; GitHub is canonical for execution

IMPLEMENTATION_PLAN.md

@@ -9,6 +9,8 @@ This plan turns the target architecture into a dependency-ordered delivery progr
 
 ### Initial profile release runtime prerequisite
 
+**Isolated engineering proof completed, 2026-10-11 — #701:** two Node 22 staging profiles were protected-deployed from `2843388`, then tested with actual browser attestation, disposable accounts, denied requests, repeats/concurrency and background replay. Owned data was removed; no schema migration or production/website/payment release. This closes only the scoped runtime/profile proof, not #113/#133/#136 or the commerce sequence. Existing dependency advisories, legal/payment policy, production disposition/authority and full lifecycle acceptance remain separate work.
+
 RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepares Node 22 before the two-Function profile release under #136. Keep the five existing Node 20 checks and require a sixth, separate Node 22 backend/profile-emulator job in both protected-release CI checks. Match manifest, lock metadata, deployment builder, and provider runtime readback. Preserve CommonJS, first-generation triggers, create-once behavior, schema, and #683 resource limits; no backfill is needed. A fixed immutable error stack is the only backend logic adaptation. Node 22 source and passing synthetic tests do not resolve billing, #113 estate disposition, #133 authority, hosted behavior, or existing dependency advisories. Do not merge or deploy runner matching as part of this runtime prerequisite.
 
 ## 1. Program outcome

OFFICER_START_HERE.md

@@ -10,13 +10,13 @@
 
 Attach the exact wording, public link, or approved photo when you have it. The AI should ask questions if anything is unclear.
 
-**Backend maintenance, 2026-09-27:** [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) prepares a supported server runtime, Node 22, in source. It does not publish a website, deploy Functions, or add billing. The first backend release is still on hold. Follow the [low-cost review](./docs/officers/LOW_COST_COMMUNITY.md) and ask a maintainer for separate hosted proof; no officer terminal work is needed.
+**Historical runtime preparation, 2026-09-27:** #691 prepared Node 22 without deployment. #701 now verifies only two staging profiles on that runtime; production and wider club operations remain on hold. Follow the [dated low-cost proof](./docs/officers/LOW_COST_COMMUNITY.md); no officer terminal work is needed.
 
-**Staging cost setup, 2026-10-11:** [#693](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/693) verified the club's $300 Free Trial, expiring January 10, 2027, and linked engineering staging with a monthly $10 usage-warning budget. Alerts at $5/$9/$10 ignore credits so underlying usage remains visible; they do not stop spending. No paid upgrade or production billing link occurred. Functions and member/payment workflows are still **NOT AVAILABLE YET**. The [trial review](./docs/officers/LOW_COST_COMMUNITY.md#check-the-trial-and-warnings-without-a-terminal) explains what an officer can check privately without handling payment details or using a terminal. Earlier billing-disabled staging checkpoints below are historical.
+**Staging cost setup, 2026-10-11:** [#693](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/693) linked the club Free Trial (January 10, 2027 expiry) and configured monthly $10 warnings at $5/$9/$10, excluding credits. They do not stop spending or prove zero cost. No paid upgrade or production billing link occurred. #701 subsequently deployed only two staging profile Functions; wider member/payment operations remain unavailable. The [trial review](./docs/officers/LOW_COST_COMMUNITY.md#check-the-trial-and-warnings-without-a-terminal) uses private provider proof, not payment details or an officer terminal.
 
 ## Choose the closest task
 
-**Focused staging release, 2026-10-11:** [#699](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/699) completed its protected identity proof. [#701](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/701) separately prepares two staging profile Functions and made-up hosted tests. Dave chose disabled administrator bypass for production/backend-staging; normal self-approval remains. Original read-only staging is unchanged. Follow [the staging procedure](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701), **NOT AVAILABLE YET** until #701 records hosted proof. Production/payments remain unavailable; no officer handles a key or record.
+**Staging profiles verified, 2026-10-11:** [#701](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/701) deployed and tested exactly two profile Functions, using scoped identities, genuine browser App Check and made-up accounts. Signup, recovery, denied requests, retries and concurrency passed; both test accounts/profiles were removed. With Dave's delegated decision, administrator bypass is disabled for production/backend-staging; normal self-approval remains. Original read-only staging is unchanged. Follow [the dated staging proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). Production, membership, registration and payments are not launched; no officer handles a key or member record.
 
 **Backend ownership, 2026-10-11:** Dave approved continuing without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave remains the sole backend release/recovery approver; backup coverage is absent, not complete. This removes only the backup-appointment gate. Protected deployment, staging proof, rollback and all data/payment approvals remain required. See [the sole-owner procedure](./docs/officers/ACCESS_CONTINUITY.md#sole-owner-backend-exception--approved-october-11-2026); no officer handles keys or runs commands.
 

OPERATIONS_RUNBOOK.md

@@ -728,6 +728,8 @@ CI/staging must eventually include:
 
 ### Deployment order
 
+**#701 hosted proof, October 11:** protected run 38176811598 deployed exactly two Node 22 staging profiles from `2843388`; normal delegated daliu approval, no administrator bypass. Both downloaded source archives match the reviewed bundle. Resource/identity readback, genuine browser App Check/Auth, negative inputs, signup/recovery, repeated/concurrent calls and background replay passed; only two owned synthetic accounts/profiles were removed, restoring count0/empty collection metadata. The initial partial release exposed an empty no-retry representation and absent SDK project context; #703 repaired both without widening authority. No provider payment/email test, website publication, production rollout or migration. The [dated officer proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701) separates those states and the specialist recovery path.
+
 For expand-and-contract changes:
 
 **Isolated staging profiles (#701):** a separate manual `deploy-staging-profiles.yml` requires exact green main, normal backend-staging approval and thirty-minute keyless credentials. The v1 Functions API selects explicit runtime/build accounts, avoiding Firebase CLI default-account checks and unavailable custom v1 build-account selection. A deterministic ten-file bundle changes only the package entrypoint to `profileOnly.js`, keeping the reviewed dependencies/lockfile and profile logic. No prototype index or payment/mail endpoint is shipped. Runtime permissions: Auth user get, Firestore document get/create and begin/rollback transaction. These are staging project IAM, not collection rules. Build access: source-object read, one image repository write and logs. ActAs is granted only on the two exact staging accounts. Google auto-created a default App Engine Editor grant during API activation; #701 removes that new grant and never selects the account. Initial baseline is no Functions; reviewed roll-forward is preferred, and exact-owned two-Function removal requires Dave/specialist recovery authority, not the deploy principal. No schema migration or production changes. Source/CI/provider/hosted proof remain separate; #113/#133/#136 stay open. See the [officer procedure](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701).

SECURITY.md

@@ -12,6 +12,8 @@ The public informational website can continue operating with normal care. **Live
 
 ### Runtime prerequisite — source only, 2026-09-27
 
+**Narrow hosted checkpoint, October 11 — #701:** both staging profiles now pass Node 22/source/resource readback and genuine browser App Check/Auth, denied inputs/cross-user reads, create-once concurrency and claim preservation. Runtime has only Auth get plus Firestore get/create/transaction; server IAM is not collection-scoped. Build has source-only read, one repository write and logs; deploy actAs is per exact account, with zero user-managed keys and no Owner/Editor service-account grant. Google's new default Editor grant was removed. Production/backend-staging administrator bypass is disabled; normal self-approval remains. No production/data/payment rollout or broad security certification is implied; all remaining launch blockers still apply.
+
 **Owner-approved backend continuity exception, 2026-10-11:** Dave Liu authorizes Firebase backend setup and protected releases without a backup owner under [#697](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/697). Dave (`daliu`) is the sole named release/recovery owner. Backup coverage remains absent and is no longer an appointment prerequisite for #113/#133/#136. Protected approval, reviewed exact source, least-privilege keyless deployment, MFA/recovery checks, synthetic staging, rollback, legacy-data disposition, cost controls, and payment/legal policy still apply. Existing staging read-only reviewers gain no broader authority. Other backup recommendations remain future continuity work, not this waived backend gate.
 
 RUNTIME-001 [#691](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/691) targets Node.js 22 without changing first-generation triggers, permissions, profile schema, deployment scope, or resource limits. [Google schedules Node 20 decommissioning for October 30, 2026](https://docs.cloud.google.com/functions/docs/runtime-support). Both protected-release CI reads now require the separate Node 22 backend/profile-persistence job, and provider verification rejects either profile Function unless its runtime is exactly `nodejs22`. The original Node 20 baseline checks remain required.

SYSTEM_DESIGN.md

@@ -10,6 +10,8 @@ The repository already contains a substantial prototype: a public React site, Fi
 
 ## 1. Goals and non-goals
 
+**Engineering staging checkpoint, 2026-10-11 — #701:** only signup-profile creation and profile recovery are hosted and verified on Node 22. A profile-only entrypoint, explicit runtime/build accounts, scoped IAM and protected keyless deployment exclude commerce/mail/directory/Strava and website publication. Actual source archives/resource limits, genuine App Check/Auth, synthetic signup/recovery/denials/retries/concurrency and owned cleanup passed. Auth count returned to zero; no migration or production data/payment change. This supersedes source-only runtime/profile wording below only for isolated staging, not production or the target commerce platform. See the [dated officer map](./docs/officers/SYSTEM_MAPS.md#scoped-engineering-profile-release--701) and [acceptance proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701).
+
 ### Community-first cost direction — 2026-09-11
 
 The owner requests a simpler, low-cost community experience and is willing to supply a personal card as fallback. Prioritize public run/event/join/contact information and optional secure accounts; prefer static delivery and bounded data reads. The first profile release remains only `createMemberOnSignUp` plus `ensureMemberProfile`, not the prototype's commerce, mail, photo-directory, or synchronization services. Preserve their source and security requirements for separately approved later work; this is not permission to weaken trust boundaries or remove existing club services.