Record fictional external dues in isolated staging

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**COMMUNITY-DUES-001 / #716 — source prepared, NOT AVAILABLE YET:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: must separately verify exact tests/CI/merge, native Function/archive/limits/security, staging Hosting/UI/denials/retries/race/cleanup; source is not live proof. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof.
+
 **COMMUNITY-003 / #711, staging recovery and handoff verified 2026-10-12:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Natural expiry, denied old session, fresh native TOTP/App Check recovery, actual UI restoration, final no-terminal handoff and exact owned cleanup passed on 2026-10-12. #711 has its final bounded staging acceptance; #114/#115/AUTH-003/ADMIN-001 and ordinary production access remain separate and open.
 
 **COMMUNITY-002 / #707:** one staging-only service/UI for pending membership requests/withdrawal, paid-term cancellation intent and free-event signup/cancellation. Dependencies: #701 hosted profiles/Auth/App Check, #705 approved paid-term policy and existing pure authority; paid activation/dues/production work stays separate. UID-only additive server collections, native identity/attestation, transaction/revision/saved-command safety and bounded reads; no payment, role, email, schedule, migration or production fallback. Officer impact: disposable staging review only. Officer documentation: STAGING_COMMUNITY plus entrypoints/maps/cost guide. Deployment evidence: version1 native archive/spec/IAM, website60435c8,38 genuine hosted checks and all four page actions verified on 2026-10-11; #707 records final website/visual/cleanup proof. #114 and production launch remain open.

IMPLEMENTATION_PLAN.md

@@ -109,6 +109,8 @@ Parallel work is safe only across branches that do not share schemas or security
 
 ## 4. Phases and exit gates
 
+**Bounded #716 fictional external dues — source prepared, hosted proof pending:** consume completed #395/#208/#451 contracts and #711's hosted service/MFA foundation. Record one immutable externally-confirmed test receipt for an unlinked membership; no account association or entitlement. Separate v2 dues capability, server-owned fake policy, global confirmation uniqueness, immutable retry and bounded no-profile review; no new IAM/service/dependency/schedule. Owner chose fictional values, not actual dues policy. Gate source/positive-negative/retry/race tests, exact PR/main checks/merge, fixed staging Function/Hosting readback, genuine native MFA/App Check/UI/offline/cleanup and the no-terminal handoff independently. Broad #81/#115, real policy/association/renewal and production remain separate. Native #114 closed status is not proof those gates are complete.
+
 **Bounded community slice — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser attestation, cleared/restored privileged UI and the no-terminal handoff passed on 2026-10-12. Record the final dated acceptance and documentation merge before closing #711. Ordinary officer access and production are not available.
 
 ### Phase 0 — Stop accidental harm and establish a trustworthy baseline

OFFICER_START_HERE.md

@@ -16,6 +16,8 @@ Attach the exact wording, public link, or approved photo when you have it. The A
 
 ## Choose the closest task
 
+**Fictional external dues — #716, NOT AVAILABLE YET:** a separate staging-only permission records made-up off-platform dues for an unlinked test membership, with no money movement, account access or Auth role. Dave selected fictional amounts/methods/short terms, not the club's actual dues policy. The [short dues review](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) requires specialist-supplied fixtures and separate hosted proof. Production/real dues/association remain unavailable; no officer uses a terminal, bank reference or real member detail.
+
 **Officer staging controls — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified) only with new specialist-supplied disposable fixtures. After the ten-minute limit, sign out and sign in again with a fresh authenticator code; this recovery and the no-terminal handoff passed on 2026-10-12. A denied refresh hides the protected sections. Ordinary officer access and recovery without the authenticator are **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched.
 
 **Staging membership/free events — #707:** one isolated service and screen passed hosted pending membership signup/withdrawal, synthetic paid-term cancellation and free-event signup/cancellation checks on 2026-10-11. No paid membership activation or real payment is included. Follow the [staging-only review](./docs/officers/STAGING_COMMUNITY.md); ask the specialist for disposable fixtures. The issue records the current website, visual review and cleanup; production remains **NOT AVAILABLE YET**.

OPERATIONS_RUNBOOK.md

@@ -8,6 +8,8 @@ This runbook explains how to operate the website, Firebase services, and Stripe
 
 Club officers and backup maintainers should start with [OFFICER_START_HERE.md](./OFFICER_START_HERE.md). It converts this technical runbook into short request, approval, verification, access, and emergency steps without terminal commands.
 
+**#716 fictional dues — NOT AVAILABLE YET; source prepared:** the specialist supplies only disposable MFA identity, an expiring v2 dues capability, a fictional UUID confirmation and exact ten-field server test policy. Reuse the one community service and its existing six-permission runtime; never widen a browser role or use a real payment/member. Follow the [dues staging handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) only after exact native Function/Hosting/security/UI/cleanup proof. Recording leaves the term unlinked; account association/activation and corrections/refunds are unavailable. Disable the capability to stop both new commands and saved retries, then use an exact reviewed staging rollback; v1 capabilities remain compatible. No automatic expiry/deletion job or new service is added. Provider setup/configuration, fixture cleanup and rollback remain specialist-only. Real policy and production remain on hold.
+
 **#711 officer community release — staging recovery and handoff verified 2026-10-12:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser App Check and final no-terminal handoff passed on 2026-10-12. Ordinary officer access, lost-authenticator recovery and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer.
 
 ### Node 22 profile release prerequisite — hosted behavior NOT AVAILABLE YET

SECURITY.md

@@ -250,6 +250,8 @@ This is source-only attack-surface reduction. The component had no runtime route
 
 ### Authorization
 
+**#716 fictional dues source boundary — staging only, hosted proof pending:** `duesRecording` is separate from approval/event permissions and exists only in exact seven-field capability schema v2; v1 never acquires it. Native verified TOTP within ten minutes and native App Check remain mandatory. Every transaction reads current capability before immutable retry replay. Server-only synthetic policy fixes amount/currency/method/term; request accepts only a UUID confirmation, true test attestation, zero create revision and expected policy revision. A global server-hashed confirmation key prevents cross-officer duplicates; no arbitrary evidence/notes, bank refs, profiles, email, uploads or export. Receipt terms remain unlinked and cannot grant entitlement/claims. New collections are denied by existing default Rules, including browser admins. No new runtime permission, production fallback, provider call, real payment evidence or schema migration. #716 must separately verify native deployment/denials/UI/cleanup before availability.
+
 **#711 synthetic staging boundary (hosted proof and expired-session recovery verified 2026-10-12):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Natural expiry, cleared privileged UI and fresh native TOTP sign-in recovery passed on 2026-10-12, with independently renewed genuine browser App Check and native server acceptance. The no-terminal handoff and exact disposable cleanup passed; this is not lost-authenticator recovery or ordinary production access. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test.
 
 - Server code and Firestore rules check signed token capabilities; the UI is never the enforcement point.

STRIPE_COMMERCE_DESIGN.md

@@ -8,6 +8,8 @@ This document defines how MPRC should configure Stripe and how race-registration
 
 ## 1. Launch status
 
+**#716 is fictional external-dues recording, not payment processing:** server-approved synthetic amount/method/short term and an officer's test attestation produce an unlinked test receipt. No Stripe identifiers/state, charge, refund, bank credential, real dues policy, payment-provider reconciliation or account activation. Real plan/term/method/confirming-officer policy stays unset. Production and real payment blockers remain unchanged; staged source availability does not imply hosted or financial proof.
+
 **#711 remains nonfinancial staging only:** officer approval simulates a configured synthetic test term, never a paid or manually confirmed real dues receipt. Dave chose externally confirmed dues for a later separately approved command; accepted methods, term, plan and confirmers are unresolved. Free-event management never calls Stripe, claims a payment, issues refunds or changes real records. No existing commerce blocker is closed by this slice.
 
 **#707 exception is nonfinancial staging only:** pending membership requests and zero-price free-event registrations use a separate service/collections, never `createCheckoutSession`, legacy admin cancellation, Stripe, mail or payment state. Free registrations store `paymentStatus=not_required`, never paid/comp money evidence. Approved membership cancellation does not trigger a refund or alter a term. All live-payment blockers below remain unchanged.