From d70bbde5cd9fbc4e35f3cbd71418c7e1fc208b58 Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Sun, 11 Oct 2026 22:05:12 -0700 Subject: [PATCH] docs: record verified staging officer checks and open recovery gate --- GITHUB_ISSUES.md | 2 +- IMPLEMENTATION_PLAN.md | 2 +- OFFICER_START_HERE.md | 2 +- OPERATIONS_RUNBOOK.md | 2 +- SECURITY.md | 4 ++-- SYSTEM_DESIGN.md | 4 ++-- docs/officers/README.md | 2 +- docs/officers/STAGING_COMMUNITY.md | 18 ++++++++++++------ docs/officers/SYSTEM_MAPS.md | 6 +++--- 9 files changed, 24 insertions(+), 18 deletions(-) diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index e78dc2a..767fe4b 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,6 +1,6 @@ # GitHub Issue Backlog: Secure Commerce Program -**COMMUNITY-003 / #711:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: source prepared; hosted release, operator/negative/race proof and owned cleanup required before closure. #114/#115/AUTH-003/ADMIN-001 remain open. +**COMMUNITY-003 / #711, core staging verified 2026-10-11; recovery/handoff open:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified. #711/#114/#115/AUTH-003/ADMIN-001 remain open. **COMMUNITY-002 / #707:** one staging-only service/UI for pending membership requests/withdrawal, paid-term cancellation intent and free-event signup/cancellation. Dependencies: #701 hosted profiles/Auth/App Check, #705 approved paid-term policy and existing pure authority; paid activation/dues/production work stays separate. UID-only additive server collections, native identity/attestation, transaction/revision/saved-command safety and bounded reads; no payment, role, email, schedule, migration or production fallback. Officer impact: disposable staging review only. Officer documentation: STAGING_COMMUNITY plus entrypoints/maps/cost guide. Deployment evidence: version1 native archive/spec/IAM, website60435c8,38 genuine hosted checks and all four page actions verified on 2026-10-11; #707 records final website/visual/cleanup proof. #114 and production launch remain open. diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 1049a5a..3690f05 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -109,7 +109,7 @@ Parallel work is safe only across branches that do not share schemas or security ## 4. Phases and exit gates -**Bounded next community slice — #711:** source prepares synthetic membership approval and free-event management within the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races precede release. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 must separately record source, CI, merge, native archive/spec/IAM/MFA, Hosting, real browser tests and cleanup. +**Bounded community slice — #711, core staging verified 2026-10-11; recovery/handoff open:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified; do not close the issue or advertise ordinary officer access. ### Phase 0 — Stop accidental harm and establish a trustworthy baseline diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index c96c21c..a60168a 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -16,7 +16,7 @@ Attach the exact wording, public link, or approved photo when you have it. The A ## Choose the closest task -**Officer staging controls — #711, NOT AVAILABLE YET until hosted acceptance:** pending synthetic membership approval and made-up free-event management use two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-source-prepared-not-available-yet). Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched. +**Officer staging controls — #711, core checks verified 2026-10-11; recovery/handoff open:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open) only with new specialist-supplied disposable fixtures. Fresh sign-in recovery after the ten-minute limit and final handoff are unverified; ordinary officer access is **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched. **Staging membership/free events — #707:** one isolated service and screen passed hosted pending membership signup/withdrawal, synthetic paid-term cancellation and free-event signup/cancellation checks on 2026-10-11. No paid membership activation or real payment is included. Follow the [staging-only review](./docs/officers/STAGING_COMMUNITY.md); ask the specialist for disposable fixtures. The issue records the current website, visual review and cleanup; production remains **NOT AVAILABLE YET**. diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index 1ba2da8..65583bd 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -8,7 +8,7 @@ This runbook explains how to operate the website, Firebase services, and Stripe Club officers and backup maintainers should start with [OFFICER_START_HERE.md](./OFFICER_START_HERE.md). It converts this technical runbook into short request, approval, verification, access, and emergency steps without terminal commands. -**#711 officer community release — NOT AVAILABLE YET until hosted proof:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-source-prepared-not-available-yet). Dave authorizes only staging under `runmprc@gmail.com`. The fixed existing community release script additionally enables optional TOTP (one adjacent interval) on already-upgraded staging Identity Platform and preserves email/password settings/domains; no SMS or billing upgrade. Runtime gains only bounded Firestore list and target Auth read. Deploy the same one Function before the website and verify native source/spec, exact IAM/no keys, existing profile versions, native Auth/App Check/MFA/capabilities, concurrency/retry, UI and exact fixture cleanup. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer. +**#711 officer community release — core staging verified 2026-10-11; recovery/handoff open:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Fresh-after-expiry sign-in recovery and final officer handoff are not verified; ordinary officer access and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer. ### Node 22 profile release prerequisite — hosted behavior NOT AVAILABLE YET diff --git a/SECURITY.md b/SECURITY.md index 30abd98..655697c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,7 @@ This is both the repository security policy and the current engineering risk reg ## 1. Production readiness decision -**#707 isolated staging boundary:** one new service requires native Auth/App Check and an exact caller-account match; mutations also require verified email. It accepts closed bounded inputs and server-owned free-event/waiver/capacity state, saves command results transactionally and fences stale revisions. Browser access to new collections remains denied, including admins. The separate staging runtime has only transaction/get/create/update Firestore permissions; IAM is project-scoped, not collection-scoped. It has no Auth mutation, delete, secret, key, payment or mail permission. No claims, real membership/payment data, production fallback, raw error/body logging or legacy schema migration. Existing two profile Functions and their runtime IAM are unchanged. Native archive/spec/IAM and38 genuine hosted ownership/attestation/lifecycle checks were verified on 2026-10-11; this proves only the staged boundary, not production, financial operations or a spending cap. +**#707 isolated staging boundary:** one new service requires native Auth/App Check and an exact caller-account match; mutations also require verified email. It accepts closed bounded inputs and server-owned free-event/waiver/capacity state, saves command results transactionally and fences stale revisions. Browser access to new collections remains denied, including admins. The first release's staging runtime had only transaction/get/create/update Firestore permissions; #711 adds exactly list and read-only Auth lookup. IAM remains project-scoped, not collection-scoped. It has no Auth mutation, delete, secret, key, payment or mail permission. No claims, real membership/payment data, production fallback, raw error/body logging or legacy schema migration. Existing two profile Functions and their runtime IAM are unchanged. Native archive/spec/IAM and38 genuine hosted ownership/attestation/lifecycle checks were verified on 2026-10-11; this proves only the staged boundary, not production, financial operations or a spending cap. The public informational website can continue operating with normal care. **Live race or merchandise payments should remain disabled until every P0 launch blocker below is closed and verified in a staging dress rehearsal.** The existing payment implementation is a useful prototype, but several correctness defects could mark unpaid transactions paid, lose payment callbacks, oversell race capacity, fail to reconcile late-payment links, or allow overly broad administrative access. @@ -250,7 +250,7 @@ This is source-only attack-surface reduction. The component had no runtime route ### Authorization -**#711 synthetic staging boundary (source prepared, not hosted proof):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test. +**#711 synthetic staging boundary (core hosted proof 2026-10-11; recovery/handoff open):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Fresh-after-expiry sign-in recovery and final no-terminal handoff are not verified. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test. - Server code and Firestore rules check signed token capabilities; the UI is never the enforcement point. - Separate catalog/content editing from financial state, identity administration, exports, and secrets. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index ad15634..925eac7 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -10,9 +10,9 @@ The repository already contains a substantial prototype: a public React site, Fi ## 1. Goals and non-goals -**Staging officer extension — #711, source prepared; NOT AVAILABLE YET:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Hosted proof remains required in #711. +**Staging officer extension — #711, core hosted checks verified 2026-10-11; recovery/handoff open:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Function version 2 and Hosting source `57261ae`, native Auth/App Check/MFA, capability/race/retry/phone/offline/real-clock expiry and owned cleanup are recorded in #711 and the [staging guide](./docs/officers/STAGING_COMMUNITY.md). Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified; production is NOT AVAILABLE YET. -**Isolated nonfinancial lifecycle — #707, staging only:** `communityOnly.js` exports only `communityActions`, outside the prototype index. Native Auth/App Check, exact account binding and verified email protect mutations. UID-only pending membership requests never grant dues/roles; cancellation preserves an approved synthetic authority record and its original expiry. Server-owned zero-price events/waiver snapshots and UID registrations share one capacity transaction. Per-account command results/revision fences prevent old cancellation retries changing a later signup. New `communityMemberships`, `communityEvents`, `communityCommands`, `communityLimits` and `communityConfig` collections are server-only; no migration or legacy commerce adoption. A separate runtime has exactly Firestore transaction/get/create/update permissions at staging-project scope. UI and server fail closed outside staging. The existing pure authority is now consumed only by this isolated staging service; earlier unused-runtime statements below remain historical outside this scope. No role/dues activation, Stripe/mail, officer admin endpoint, schedule or production release is included. First native hosted acceptance was verified on 2026-10-11; see the [officer staging guide](./docs/officers/STAGING_COMMUNITY.md) and #707 for current website/cleanup proof, not production availability. +**Isolated nonfinancial lifecycle — #707, staging only:** `communityOnly.js` exports only `communityActions`, outside the prototype index. Native Auth/App Check, exact account binding and verified email protect mutations. UID-only pending membership requests never grant dues/roles; cancellation preserves an approved synthetic authority record and its original expiry. Server-owned zero-price events/waiver snapshots and UID registrations share one capacity transaction. Per-account command results/revision fences prevent old cancellation retries changing a later signup. New `communityMemberships`, `communityEvents`, `communityCommands`, `communityLimits` and `communityConfig` collections are server-only; no migration or legacy commerce adoption. The first release's separate runtime had exactly Firestore transaction/get/create/update permissions at staging-project scope; #711 adds only list and read-only Auth lookup as described above. UI and server fail closed outside staging. The existing pure authority is now consumed only by this isolated staging service; earlier unused-runtime statements below remain historical outside this scope. This original slice included no role/dues activation, Stripe/mail, officer admin endpoint, schedule or production release. First native hosted acceptance was verified on 2026-10-11; see the [officer staging guide](./docs/officers/STAGING_COMMUNITY.md) and #707 for current website/cleanup proof, not production availability. **Engineering staging checkpoint, 2026-10-11 — #701:** only signup-profile creation and profile recovery are hosted and verified on Node 22. A profile-only entrypoint, explicit runtime/build accounts, scoped IAM and protected keyless deployment exclude commerce/mail/directory/Strava and website publication. Actual source archives/resource limits, genuine App Check/Auth, synthetic signup/recovery/denials/retries/concurrency and owned cleanup passed. Auth count returned to zero; no migration or production data/payment change. This supersedes source-only runtime/profile wording below only for isolated staging, not production or the target commerce platform. See the [dated officer map](./docs/officers/SYSTEM_MAPS.md#scoped-engineering-profile-release--701) and [acceptance proof](./docs/officers/LOW_COST_COMMUNITY.md#engineering-staging-profiles--701). diff --git a/docs/officers/README.md b/docs/officers/README.md index f1c4b45..c4321af 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -33,7 +33,7 @@ In words: approve the merge, request one exact release, and approve its protecte ## Short guides -Staging officer approval/free-event management is prepared under [#711](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711), not hosted-proven yet. Follow the [staging officer checklist](./STAGING_COMMUNITY.md#officer-review--711-source-prepared-not-available-yet) after its acceptance; no real dues or production procedure is included. +Core staging officer approval/free-event management checks passed on 2026-10-11 under [#711](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711). Fresh sign-in recovery after expiry and final handoff remain unverified. Follow the [supervised staging checklist](./STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open) only with new specialist-supplied disposable fixtures; ordinary officer access, real dues and production remain **NOT AVAILABLE YET**. For the isolated membership/free-event staging test, use [Staging community actions](./STAGING_COMMUNITY.md). Its status distinguishes source preparation from hosted proof; it is not a production procedure. diff --git a/docs/officers/STAGING_COMMUNITY.md b/docs/officers/STAGING_COMMUNITY.md index 37fb7a1..981065c 100644 --- a/docs/officers/STAGING_COMMUNITY.md +++ b/docs/officers/STAGING_COMMUNITY.md @@ -47,15 +47,21 @@ The first verified backend is version 1 from `7e3dc451368c70e4b63805927b12d413e8 The specialist's Hosting release uses Dave's existing club login for a short-lived credential kept in memory. It does not require a new saved Firebase CLI login or key file. A later documentation or release-script fix may reuse the Function only after its downloaded source exactly matches the reviewed bundle; it does not silently deploy more backend code. -**Escalation:** Dave/platform specialist for deployment, access, uncertain results or recovery. Future officer dues confirmation, event editing, paid registration/refunds, and production release require separate work. The specialist still provisions and removes test fixtures; officers do not use a terminal or change source. +**Escalation:** Dave/platform specialist for deployment, access, uncertain results or recovery. Real dues confirmation, paid registration/refunds and production release require separate work. Synthetic officer approval and free-event editing are described below. The specialist still provisions and removes test fixtures; officers do not use a terminal or change source. ## Cost and scope -## Officer review — #711 source prepared, NOT AVAILABLE YET + + +## Officer review — #711 staging verified; recovery and handoff open + +**Status checked 2026-10-11:** core hosted staging checks passed. [#711's dated acceptance receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215) records native authenticator sign-in, approval/event actions, denied requests, retries, booking races, phone/offline behavior and natural ten-minute sign-in expiry. Fresh sign-in recovery after that expiry and the final no-terminal handoff remain **NOT AVAILABLE YET / unverified**. #711 stays open. Production and real dues are not available. + +**Release proof:** the Function and staging website were verified from `57261aed111976718ba8c04515e38394e4e0d2c8`. The community Function is version 2. Its 85,371-byte downloaded archive matched SHA-256 `d71690088e6ca8f5ac29cf9a0179ec17fe2d39b2e126a7776b657ffe5b699ab2`. The release command reported an unexplained failure despite completed provider deployment; independent archive/resource checks, Hosting's source gate and later read-only postchecks passed. Do not treat that command as a successful release or redeploy unchanged code to hide the error. All owned test accounts and records were removed, temporary local access was turned off and the test receiver was closed. New fixtures are needed for another review. These dated proofs do not publish `runmprc.com` or verify production behavior. **Purpose:** review synthetic membership approval and free-event management. These controls are not a real dues procedure. Dave selected externally confirmed dues for later work; no real payment method, annual plan, term or confirmation authority has been chosen here. -**Approver:** Dave, sole staging/recovery owner. **Prerequisites:** #711 must record hosted acceptance. The specialist supplies an explicitly disposable verified officer account, authenticator setup, expiring approval/event permission and a short server-configured synthetic term. It is not an ordinary browser admin role. No officer changes permissions, source or records directly. +**Approver:** Dave, sole staging/recovery owner. **Prerequisites for a supervised staging review:** the specialist supplies an explicitly disposable verified officer account, authenticator setup, expiring approval/event permission and a short server-configured synthetic term. It is not an ordinary browser admin role. No officer changes permissions, source or records directly. A Google Cloud or Gmail login is not a website test account; do not enter your Gmail password here. Do not rely on the unfinished recovery procedure for ordinary officer access. 1. Open the supplied staging `/community/admin` link. 2. Confirm **Staging test only** and the staging address. @@ -77,14 +83,14 @@ The specialist's Hosting release uses Dave's existing club login for a short-liv 18. Confirm the booked member can still cancel their own signup and release the place. 19. Use **Retry saved action** for an uncertain result; do not repeatedly create new requests. 20. Use **Refresh officer status** to read current state. A successful refresh clears the saved request before a new action. -21. Sign out and sign in with the authenticator again after ten minutes, or if access is denied. +21. Stop if ten minutes pass or access is denied, and ask the specialist to end the review. Fresh sign-in recovery still needs its own verified test. 22. Sign out at the end and ask the specialist to remove all owned fixtures. **Expected result:** one nonfinancial test approval and coherent free-event changes/counts. Editing booked event content is blocked. A cancelled event cannot reopen. At most twenty configured events are supported; old event archival is not included. Pending review shows twenty opaque test account IDs per page, no profiles/emails or export. **Stop:** production address, real data/dues, payment, absent authenticator gate, permission unexpectedly surviving revocation, lost bookings, stale result, or a request to edit records/share secrets. Tell Dave privately. -**Proof:** exact source/CI/merge, native archive/spec/runtime plus optional TOTP and unchanged sign-in/domain/App Check settings, two capability denial matrix, membership/withdrawal and capacity/closure races, replay/expiry/revocation, actual screen/mobile/offline checks and exact disposable cleanup. Before closing #711, review these steps without a terminal; test enrollment/permission setup and cleanup remain specialist-only. +**Proof:** #711 records exact source/CI/merge, native archive/resource/runtime checks, optional authenticator setup and unchanged sign-in/domain settings. Auth and Firestore App Check remain enforced. Hosted evidence covers both permission types, denied target verification, approval/withdrawal and capacity/closure races, immutable retries, expiry/revocation, actual phone/offline screens and exact disposable cleanup. Remaining acceptance is fresh sign-in recovery with new native attestation, followed by review of these steps without a terminal. Test enrollment, permission setup and cleanup remain specialist-only; they are not officer self-service. **Undo:** stop testing. Ask Dave/specialist to disable the staged capability first and verify old requests are denied, then use the reviewed staged rollback if needed. Do not try to reopen a cancelled event or change membership/payment evidence yourself. **Escalation:** Dave/platform specialist for access, deployment, uncertain results or recovery. @@ -92,4 +98,4 @@ The specialist's Hosting release uses Dave's existing club login for a short-liv One new staging Function has zero reserved instances, at most two instances, 256 MB memory and a 30-second limit. The page reads at most 20 configured events and does not poll. Successful new commands are limited to 12 per account per minute; native Auth/App Check and request bounds are also required. These controls and the existing $10 warning budget are not a bill ceiling. -The separate runtime account has only Firestore transaction/get/create/update permissions, at project scope—not per collection. It has no Auth-user administration, deletes, secret access, key, payment or mail permission. Browser access to all new collections remains denied, including for admins. Existing profile Functions, runtime permissions, production and payment integrations are unchanged. +The community runtime now has exactly six permissions: Firestore database transaction/get, entity get/create/update/list, and read-only Auth-user lookup. They are at staging-project scope—not per collection. It cannot change Auth users or claims, delete records, read secrets, use a user-managed key, or make payments/send mail. Browser access to all new collections remains denied, including for admins. Existing profile Functions and their separate runtime permissions, production and payment integrations are unchanged. diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index 14168b4..deaa164 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -4,11 +4,11 @@ These diagrams show where pages, information, and deployments go. Each diagram i ## Staging community lifecycle — #707, first hosted release verified 2026-10-11 -The #711 officer extension below is source prepared, **NOT AVAILABLE YET** until its issue records staging deployment/acceptance. +Core hosted staging checks for the #711 officer extension below passed on 2026-10-11. Function version 2 and Hosting source `57261ae` are recorded in the [staging guide](./STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open). Fresh sign-in recovery after expiry and final handoff remain unverified; ordinary officer access and production are **NOT AVAILABLE YET**. ```mermaid flowchart LR - Officer["/community/admin; staging only"] --> MFA["Verified recent authenticator sign-in + native App Check"] + Officer["/community/admin; core staging verified; recovery open"] --> MFA["Verified recent authenticator sign-in + native App Check"] MFA --> Cap["Live expiring approval / free-event permission"] Cap --> One["Same communityActions service; no new reserved instance"] One --> Review["20 pending UID/revision requests per page; no profiles"] @@ -19,7 +19,7 @@ flowchart LR Browser["Browser including broad admin"] -. "Denied direct access and capability writes" .-> Cap ``` -Text alternative: staged officer tools require recent authenticator sign-in and current action permission, then use the same bounded service for synthetic approval, booking-safe free-event edits and immutable receipts; the browser cannot grant access or write records, and real dues/production remain unavailable. +Text alternative: core staged officer checks passed using recent authenticator sign-in and current action permission with the same bounded service for synthetic approval, booking-safe free-event edits and immutable receipts; the browser cannot grant access or write records, and fresh sign-in recovery, ordinary officer access and real dues/production remain unavailable. ```mermaid flowchart LR