docs: distinguish staged officer proof from unfinished recovery

GITHUB_ISSUES.md

@@ -1,6 +1,6 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
-**COMMUNITY-003 / #711:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: source prepared; hosted release, operator/negative/race proof and owned cleanup required before closure. #114/#115/AUTH-003/ADMIN-001 remain open.
+**COMMUNITY-003 / #711, core staging verified 2026-10-11; recovery/handoff open:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified. #711/#114/#115/AUTH-003/ADMIN-001 remain open.
 
 **COMMUNITY-002 / #707:** one staging-only service/UI for pending membership requests/withdrawal, paid-term cancellation intent and free-event signup/cancellation. Dependencies: #701 hosted profiles/Auth/App Check, #705 approved paid-term policy and existing pure authority; paid activation/dues/production work stays separate. UID-only additive server collections, native identity/attestation, transaction/revision/saved-command safety and bounded reads; no payment, role, email, schedule, migration or production fallback. Officer impact: disposable staging review only. Officer documentation: STAGING_COMMUNITY plus entrypoints/maps/cost guide. Deployment evidence: version1 native archive/spec/IAM, website60435c8,38 genuine hosted checks and all four page actions verified on 2026-10-11; #707 records final website/visual/cleanup proof. #114 and production launch remain open.
 

IMPLEMENTATION_PLAN.md

@@ -109,7 +109,7 @@ Parallel work is safe only across branches that do not share schemas or security
 
 ## 4. Phases and exit gates
 
-**Bounded next community slice — #711:** source prepares synthetic membership approval and free-event management within the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races precede release. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 must separately record source, CI, merge, native archive/spec/IAM/MFA, Hosting, real browser tests and cleanup.
+**Bounded community slice — #711, core staging verified 2026-10-11; recovery/handoff open:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Fresh-after-expiry sign-in recovery and final no-terminal handoff remain unverified; do not close the issue or advertise ordinary officer access.
 
 ### Phase 0 — Stop accidental harm and establish a trustworthy baseline
 

OFFICER_START_HERE.md

@@ -16,7 +16,7 @@ Attach the exact wording, public link, or approved photo when you have it. The A
 
 ## Choose the closest task
 
-**Officer staging controls — #711, NOT AVAILABLE YET until hosted acceptance:** pending synthetic membership approval and made-up free-event management use two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-source-prepared-not-available-yet). Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched.
+**Officer staging controls — #711, core checks verified 2026-10-11; recovery/handoff open:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open) only with new specialist-supplied disposable fixtures. Fresh sign-in recovery after the ten-minute limit and final handoff are unverified; ordinary officer access is **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched.
 
 **Staging membership/free events — #707:** one isolated service and screen passed hosted pending membership signup/withdrawal, synthetic paid-term cancellation and free-event signup/cancellation checks on 2026-10-11. No paid membership activation or real payment is included. Follow the [staging-only review](./docs/officers/STAGING_COMMUNITY.md); ask the specialist for disposable fixtures. The issue records the current website, visual review and cleanup; production remains **NOT AVAILABLE YET**.
 

OPERATIONS_RUNBOOK.md

@@ -8,7 +8,7 @@ This runbook explains how to operate the website, Firebase services, and Stripe
 
 Club officers and backup maintainers should start with [OFFICER_START_HERE.md](./OFFICER_START_HERE.md). It converts this technical runbook into short request, approval, verification, access, and emergency steps without terminal commands.
 
-**#711 officer community release — NOT AVAILABLE YET until hosted proof:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-source-prepared-not-available-yet). Dave authorizes only staging under `runmprc@gmail.com`. The fixed existing community release script additionally enables optional TOTP (one adjacent interval) on already-upgraded staging Identity Platform and preserves email/password settings/domains; no SMS or billing upgrade. Runtime gains only bounded Firestore list and target Auth read. Deploy the same one Function before the website and verify native source/spec, exact IAM/no keys, existing profile versions, native Auth/App Check/MFA/capabilities, concurrency/retry, UI and exact fixture cleanup. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer.
+**#711 officer community release — core staging verified 2026-10-11; recovery/handoff open:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified-recovery-and-handoff-open). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Fresh-after-expiry sign-in recovery and final officer handoff are not verified; ordinary officer access and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer.
 
 ### Node 22 profile release prerequisite — hosted behavior NOT AVAILABLE YET
 

SECURITY.md

@@ -8,7 +8,7 @@ This is both the repository security policy and the current engineering risk reg
 
 ## 1. Production readiness decision
 
-**#707 isolated staging boundary:** one new service requires native Auth/App Check and an exact caller-account match; mutations also require verified email. It accepts closed bounded inputs and server-owned free-event/waiver/capacity state, saves command results transactionally and fences stale revisions. Browser access to new collections remains denied, including admins. The separate staging runtime has only transaction/get/create/update Firestore permissions; IAM is project-scoped, not collection-scoped. It has no Auth mutation, delete, secret, key, payment or mail permission. No claims, real membership/payment data, production fallback, raw error/body logging or legacy schema migration. Existing two profile Functions and their runtime IAM are unchanged. Native archive/spec/IAM and38 genuine hosted ownership/attestation/lifecycle checks were verified on 2026-10-11; this proves only the staged boundary, not production, financial operations or a spending cap.
+**#707 isolated staging boundary:** one new service requires native Auth/App Check and an exact caller-account match; mutations also require verified email. It accepts closed bounded inputs and server-owned free-event/waiver/capacity state, saves command results transactionally and fences stale revisions. Browser access to new collections remains denied, including admins. The first release's staging runtime had only transaction/get/create/update Firestore permissions; #711 adds exactly list and read-only Auth lookup. IAM remains project-scoped, not collection-scoped. It has no Auth mutation, delete, secret, key, payment or mail permission. No claims, real membership/payment data, production fallback, raw error/body logging or legacy schema migration. Existing two profile Functions and their runtime IAM are unchanged. Native archive/spec/IAM and38 genuine hosted ownership/attestation/lifecycle checks were verified on 2026-10-11; this proves only the staged boundary, not production, financial operations or a spending cap.
 
 The public informational website can continue operating with normal care. **Live race or merchandise payments should remain disabled until every P0 launch blocker below is closed and verified in a staging dress rehearsal.** The existing payment implementation is a useful prototype, but several correctness defects could mark unpaid transactions paid, lose payment callbacks, oversell race capacity, fail to reconcile late-payment links, or allow overly broad administrative access.
 
@@ -250,7 +250,7 @@ This is source-only attack-surface reduction. The component had no runtime route
 
 ### Authorization
 
-**#711 synthetic staging boundary (source prepared, not hosted proof):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.
+**#711 synthetic staging boundary (core hosted proof 2026-10-11; recovery/handoff open):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Fresh-after-expiry sign-in recovery and final no-terminal handoff are not verified. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.
 
 - Server code and Firestore rules check signed token capabilities; the UI is never the enforcement point.
 - Separate catalog/content editing from financial state, identity administration, exports, and secrets.