From f4b3d40c3f0fd3ed91d081403a5edc0eff8a7301 Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Mon, 12 Oct 2026 13:58:36 -0700 Subject: [PATCH] docs: record verified fictional dues staging handoff --- GITHUB_ISSUES.md | 2 +- IMPLEMENTATION_PLAN.md | 2 +- OFFICER_START_HERE.md | 2 +- OPERATIONS_RUNBOOK.md | 2 +- SECURITY.md | 2 +- STRIPE_COMMERCE_DESIGN.md | 2 +- SYSTEM_DESIGN.md | 4 ++-- docs/officers/ACCESS_CONTINUITY.md | 2 +- docs/officers/EVENTS_SHOP_MEMBERS.md | 4 ++-- docs/officers/README.md | 2 +- docs/officers/STAGING_COMMUNITY.md | 8 +++++++- docs/officers/SYSTEM_MAPS.md | 4 ++-- 12 files changed, 21 insertions(+), 15 deletions(-) diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index 661abe4..23c9f5e 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,6 +1,6 @@ # GitHub Issue Backlog: Secure Commerce Program -**COMMUNITY-DUES-001 / #716 — source prepared, NOT AVAILABLE YET:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: must separately verify exact tests/CI/merge, native Function/archive/limits/security, staging Hosting/UI/denials/retries/race/cleanup; source is not live proof. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof. +**COMMUNITY-DUES-001 / #716 — staging verified 2026-10-12:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: PR717 merged d212fab; all six exact PR/main jobs and every step passed. Native Function v3/archive and staging Hosting matched; twenty-two hosted denials, immutable retry/race, twenty-plus-one pages, actual UI/offline/390×844/revocation and 51-document/two-account cleanup passed. Release-command reporting caveat and supervised fresh-fixture handoff are recorded in STAGING_COMMUNITY; production/runmprc.com and real payments were untouched. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof. **COMMUNITY-003 / #711, staging recovery and handoff verified 2026-10-12:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Natural expiry, denied old session, fresh native TOTP/App Check recovery, actual UI restoration, final no-terminal handoff and exact owned cleanup passed on 2026-10-12. #711 has its final bounded staging acceptance; #114/#115/AUTH-003/ADMIN-001 and ordinary production access remain separate and open. diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 8a2a04b..3e19b04 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -109,7 +109,7 @@ Parallel work is safe only across branches that do not share schemas or security ## 4. Phases and exit gates -**Bounded #716 fictional external dues — source prepared, hosted proof pending:** consume completed #395/#208/#451 contracts and #711's hosted service/MFA foundation. Record one immutable externally-confirmed test receipt for an unlinked membership; no account association or entitlement. Separate v2 dues capability, server-owned fake policy, global confirmation uniqueness, immutable retry and bounded no-profile review; no new IAM/service/dependency/schedule. Owner chose fictional values, not actual dues policy. Gate source/positive-negative/retry/race tests, exact PR/main checks/merge, fixed staging Function/Hosting readback, genuine native MFA/App Check/UI/offline/cleanup and the no-terminal handoff independently. Broad #81/#115, real policy/association/renewal and production remain separate. Native #114 closed status is not proof those gates are complete. +**Bounded #716 fictional external dues — staging verified 2026-10-12:** consume completed #395/#208/#451 contracts and #711's hosted service/MFA foundation. Record one immutable externally-confirmed test receipt for an unlinked membership; no account association or entitlement. Separate v2 dues capability, server-owned fake policy, global confirmation uniqueness, immutable retry and bounded no-profile review; no new IAM/service/dependency/schedule. Owner chose fictional values, not actual dues policy. Source/tests and all six exact PR/main checks passed; PR717 merged d212fab, native Function v3/archive and staging Hosting matched. Genuine native MFA/App Check, twenty-two denials, immutable retries/cross-officer race, bounded pages, actual UI/offline/mobile/revocation and exact cleanup passed. The no-terminal handoff remains supervised with fresh specialist-supplied fixtures. Broad #81/#115, real policy/association/renewal and production remain separate. Native #114 closed status is not proof those gates are complete. **Bounded community slice — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and free-event management use the one existing staging callable. Dependencies #707/#701 are hosted-proven. Stage-only action capabilities, recent TOTP, authoritative target read, immutable/retry-safe audit, bounded cursor review and capacity/revision races passed hosted checks, along with phone/offline behavior and natural sign-in expiry. Real off-platform dues confirmation is Dave's selected later direction, not implemented or enabled here. Term/plan/method/approver decisions, renewal/import, production AUTH-003/ADMIN-001 and live #114/#115 remain separate. Officer impact: supervised disposable admin review only. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: #711 separately records exact source/CI/merge, native Function version 2/archive/spec/IAM/MFA, Hosting source `57261ae`, real browser tests and exact owned cleanup. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser attestation, cleared/restored privileged UI and the no-terminal handoff passed on 2026-10-12. Record the final dated acceptance and documentation merge before closing #711. Ordinary officer access and production are not available. diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index 8e13657..1a44baa 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -16,7 +16,7 @@ Attach the exact wording, public link, or approved photo when you have it. The A ## Choose the closest task -**Fictional external dues — #716, NOT AVAILABLE YET:** a separate staging-only permission records made-up off-platform dues for an unlinked test membership, with no money movement, account access or Auth role. Dave selected fictional amounts/methods/short terms, not the club's actual dues policy. The [short dues review](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) requires specialist-supplied fixtures and separate hosted proof. Production/real dues/association remain unavailable; no officer uses a terminal, bank reference or real member detail. +**Fictional external dues — #716, staging verified 2026-10-12:** a separate staging-only permission records made-up off-platform dues for an unlinked test membership, with no money movement, account access or Auth role. Dave selected fictional amounts/methods/short terms, not the club's actual dues policy. The [short dues review](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) requires fresh specialist-supplied fixtures; native deployment, UI/security/retry/race and cleanup passed. Production/real dues/association remain unavailable; no officer uses a terminal, bank reference or real member detail. **Officer staging controls — #711, staging recovery and handoff verified 2026-10-12:** synthetic membership approval and made-up free-event management passed hosted checks using two narrow expiring permissions and authenticator sign-in, not the broad admin role. Use the [supervised staging checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified) only with new specialist-supplied disposable fixtures. After the ten-minute limit, sign out and sign in again with a fresh authenticator code; this recovery and the no-terminal handoff passed on 2026-10-12. A denied refresh hides the protected sections. Ordinary officer access and recovery without the authenticator are **NOT AVAILABLE YET**. Do not use Gmail credentials for the website test. Externally confirmed real dues are a later separately approved workflow; production and real payments remain untouched. diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index cc48d2c..ca3436f 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -8,7 +8,7 @@ This runbook explains how to operate the website, Firebase services, and Stripe Club officers and backup maintainers should start with [OFFICER_START_HERE.md](./OFFICER_START_HERE.md). It converts this technical runbook into short request, approval, verification, access, and emergency steps without terminal commands. -**#716 fictional dues — NOT AVAILABLE YET; source prepared:** the specialist supplies only disposable MFA identity, an expiring v2 dues capability, a fictional UUID confirmation and exact ten-field server test policy. Reuse the one community service and its existing six-permission runtime; never widen a browser role or use a real payment/member. Follow the [dues staging handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) only after exact native Function/Hosting/security/UI/cleanup proof. Recording leaves the term unlinked; account association/activation and corrections/refunds are unavailable. Disable the capability to stop both new commands and saved retries, then use an exact reviewed staging rollback; v1 capabilities remain compatible. No automatic expiry/deletion job or new service is added. Provider setup/configuration, fixture cleanup and rollback remain specialist-only. Real policy and production remain on hold. +**#716 fictional dues — staging verified 2026-10-12:** the specialist supplies only disposable MFA identity, an expiring v2 dues capability, a fictional UUID confirmation and exact ten-field server test policy. Reuse the one community service and its existing six-permission runtime; never widen a browser role or use a real payment/member. Follow the [dues staging handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-external-dues--716) with fresh disposable fixtures. Native Function v3/archive and Hosting d212fab, hosted security/retry/race/pagination/UI/offline/mobile/revocation and exact cleanup passed. The Function release command reported a generic failure after provider deployment; independent checks qualified the result without redeploy or bypass. Its reporting cause remains unqualified; never infer success or repeat a release without provider readback. Recording leaves the term unlinked; account association/activation and corrections/refunds are unavailable. Disable the capability to stop both new commands and saved retries, then use an exact reviewed staging rollback; v1 capabilities remain compatible. No automatic expiry/deletion job or new service is added. Provider setup/configuration, fixture cleanup and rollback remain specialist-only. Real policy and production remain on hold. **#711 officer community release — staging recovery and handoff verified 2026-10-12:** use the no-terminal [staging officer checklist](./docs/officers/STAGING_COMMUNITY.md#officer-review--711-staging-verified). Dave authorizes only staging under `runmprc@gmail.com`. Function version 2/native archive/spec/IAM and Hosting source `57261ae` are verified, with genuine Auth/App Check/MFA, permission denials, concurrency/retry, phone/offline, natural sign-in expiry and exact owned cleanup recorded in #711. Natural expiry and sign-out/fresh native TOTP recovery, renewed genuine browser App Check and final no-terminal handoff passed on 2026-10-12. Ordinary officer access, lost-authenticator recovery and production remain NOT AVAILABLE YET. The fixed release command reported an unexplained failure after provider completion; independent native checks, Hosting's source gate and later read-only postchecks passed. No unchanged redeploy was performed. Optional TOTP (one adjacent interval) is enabled on already-upgraded staging Identity Platform, preserving email/password settings/domains; no SMS or billing upgrade. Runtime gained only bounded Firestore list and target Auth read. Keep Auth/Firestore App Check enforced; never use debug attestation, custom token MFA, real identities or financial evidence. A specialist supplies/enrolls/removes disposable fixtures; the officer signs in and uses the screen. Disable the staged officer capability to stop new admin actions and replay immediately; function rollback uses the previous reviewed source and must account for the changed staging MFA/runtime policy. Restore the prior MFA/runtime configuration only after all task-owned MFA accounts are removed; do not disable MFA for an enrolled surviving officer. diff --git a/SECURITY.md b/SECURITY.md index 9044de5..19b0aa2 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -250,7 +250,7 @@ This is source-only attack-surface reduction. The component had no runtime route ### Authorization -**#716 fictional dues source boundary — staging only, hosted proof pending:** `duesRecording` is separate from approval/event permissions and exists only in exact seven-field capability schema v2; v1 never acquires it. Native verified TOTP within ten minutes and native App Check remain mandatory. Every transaction reads current capability before immutable retry replay. Server-only synthetic policy fixes amount/currency/method/term; request accepts only a UUID confirmation, true test attestation, zero create revision and expected policy revision. A global server-hashed confirmation key prevents cross-officer duplicates; no arbitrary evidence/notes, bank refs, profiles, email, uploads or export. Receipt terms remain unlinked and cannot grant entitlement/claims. New collections are denied by existing default Rules, including browser admins. No new runtime permission, production fallback, provider call, real payment evidence or schema migration. #716 must separately verify native deployment/denials/UI/cleanup before availability. +**#716 fictional dues boundary — staging verified 2026-10-12:** `duesRecording` is separate from approval/event permissions and exists only in exact seven-field capability schema v2; v1 never acquires it. Native verified TOTP within ten minutes and native App Check remain mandatory. Every transaction reads current capability before immutable retry replay. Server-only synthetic policy fixes amount/currency/method/term; request accepts only a UUID confirmation, true test attestation, zero create revision and expected policy revision. A global server-hashed confirmation key prevents cross-officer duplicates; no arbitrary evidence/notes, bank refs, profiles, email, uploads or export. Receipt terms remain unlinked and cannot grant entitlement/claims. New collections are denied by existing default Rules, including browser admins. No new runtime permission, production fallback, provider call, real payment evidence or schema migration. #716 verified native Function v3/archive and Hosting d212fab, twenty-two hosted negative cases, retry/race/pagination, actual UI/offline/mobile/revocation and exact fixture cleanup. Rules430 checks passed. Fresh specialist-supplied fixtures and separate real-policy/production approval remain necessary. **#711 synthetic staging boundary (hosted proof and expired-session recovery verified 2026-10-12):** no generic admin-role shortcut. Every officer request requires native App Check, verified recent (ten-minute) TOTP Auth and a current enabled, expiring action capability read transactionally before receipt replay. Owner-only capability provisioning/revocation is outside the callable; no route grants roles or changes accounts. Approval verifies target UID/verified/enabled Auth state read-only, permits only a null-authority pending request and supplies a server-owned explicitly synthetic test term. Immutable receipts record actor, capability/revision, action, target, fixed test reason, before/after state, result and time without profiles or payment data. The runtime's two additional permissions are `datastore.entities.list` for <=21-record cursor queries and `firebaseauth.users.get` for one selected target, at staging-project scope. No delete, Auth mutation, secret or provider/payment permission. Native version 2/Hosting source `57261ae`, capability/identity denial matrix, race/retry/phone/offline checks, natural ten-minute expiry and exact owned cleanup are recorded in #711. Auth and Firestore App Check remain ENFORCED. Natural expiry, cleared privileged UI and fresh native TOTP sign-in recovery passed on 2026-10-12, with independently renewed genuine browser App Check and native server acceptance. The no-terminal handoff and exact disposable cleanup passed; this is not lost-authenticator recovery or ordinary production access. Production AUTH-003/MFA/admin-policy and #114/#115 are not completed by this test. diff --git a/STRIPE_COMMERCE_DESIGN.md b/STRIPE_COMMERCE_DESIGN.md index acb5ce1..a8e5502 100644 --- a/STRIPE_COMMERCE_DESIGN.md +++ b/STRIPE_COMMERCE_DESIGN.md @@ -8,7 +8,7 @@ This document defines how MPRC should configure Stripe and how race-registration ## 1. Launch status -**#716 is fictional external-dues recording, not payment processing:** server-approved synthetic amount/method/short term and an officer's test attestation produce an unlinked test receipt. No Stripe identifiers/state, charge, refund, bank credential, real dues policy, payment-provider reconciliation or account activation. Real plan/term/method/confirming-officer policy stays unset. Production and real payment blockers remain unchanged; staged source availability does not imply hosted or financial proof. +**#716 is fictional external-dues recording, not payment processing:** server-approved synthetic amount/method/short term and an officer's test attestation produce an unlinked test receipt. No Stripe identifiers/state, charge, refund, bank credential, real dues policy, payment-provider reconciliation or account activation. Real plan/term/method/confirming-officer policy stays unset. Production and real payment blockers remain unchanged; fictional staging acceptance passed under #716, but it is not real financial evidence or permission for production. **#711 remains nonfinancial staging only:** officer approval simulates a configured synthetic test term, never a paid or manually confirmed real dues receipt. Dave chose externally confirmed dues for a later separately approved command; accepted methods, term, plan and confirmers are unresolved. Free-event management never calls Stripe, claims a payment, issues refunds or changes real records. No existing commerce blocker is closed by this slice. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 69741b4..3764e5f 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -10,7 +10,7 @@ The repository already contains a substantial prototype: a public React site, Fi ## 1. Goals and non-goals -**Fictional external dues — #716, staging source prepared; NOT AVAILABLE YET:** Dave chose fictional test amounts/methods/short terms on October 12. The existing isolated service gains only `admin_dues_record` and a bounded receipt projection. A separate expiring `duesRecording` permission in exact capability schema v2 is required; v1 retains its six-field behavior and denies this action. Server-only `communityConfig/duesTestTerm` supplies the fictional amount/currency/method/term/revision. One confirmation UUID creates a stable non-email membership ID, an unlinked authority/test term via the existing manual-evidence contract and an immutable `communityDues` receipt plus command audit. No UID association, entitlement/claim grant, member-record edit, Stripe/payment state, real policy, migration or provider action. Same-command retry is immutable; global confirmation uniqueness prevents another command/officer double-recording it. Only twenty minimal receipts per page; no profile/contact/bank data or exports. Runtime/IAM/cost limits are unchanged. Source/tests/merge, native deployment/Hosting/attestation/UI and exact owned cleanup require separate #716 proof; production remains unavailable. +**Fictional external dues — #716, staging verified 2026-10-12:** Dave chose fictional test amounts/methods/short terms on October 12. The existing isolated service gains only `admin_dues_record` and a bounded receipt projection. A separate expiring `duesRecording` permission in exact capability schema v2 is required; v1 retains its six-field behavior and denies this action. Server-only `communityConfig/duesTestTerm` supplies the fictional amount/currency/method/term/revision. One confirmation UUID creates a stable non-email membership ID, an unlinked authority/test term via the existing manual-evidence contract and an immutable `communityDues` receipt plus command audit. No UID association, entitlement/claim grant, member-record edit, Stripe/payment state, real policy, migration or provider action. Same-command retry is immutable; global confirmation uniqueness prevents another command/officer double-recording it. Only twenty minimal receipts per page; no profile/contact/bank data or exports. Runtime/IAM/cost limits are unchanged. Source PR717/merge d212fab and all six exact PR/main jobs passed; native Function v3/archive, staging Hosting, genuine attestation/TOTP, UI/offline/race/pagination/revocation and exact 51-document/two-account cleanup passed. See the staging guide for release-command caveat and fresh-fixture handoff; production remains unavailable. **Staging officer extension — #711, hosted checks and expired-session recovery verified 2026-10-12:** the same isolated `communityActions` service admits only exact admin commands with native attestation, verified recent TOTP sign-in and live expiring `communityOfficers/{uid}` capabilities. Browser `admin` is not sufficient. `membershipApproval` returns at most 20 pending UID/status/revision projections per cursor and approves only a pending request with no prior authority, after read-only authoritative Auth verification. An owner-configured, explicitly synthetic <=24-hour term supplies all approval evidence; no real dues, renewal, claim, payment or off-platform evidence is written. Dave selected externally confirmed dues for later work; its actual plan/term/method/approver policy remains undecided. `freeEventManagement` creates closed zero-price test events, edits only unbooked content, changes capacity no lower than bookings and opens/closes/finally cancels signup. Member registration/cancellation keeps using the shared capacity transaction. New server-only officer permissions, rate and immutable command/audit records are additive; no legacy migration. Exactly Firestore list and Auth read are added to the existing runtime, not write/delete/grant rights. Optional TOTP is enabled only on already-upgraded staging Identity Platform; no SMS, billing upgrade or production change. Function version 2 and Hosting source `57261ae`, native Auth/App Check/MFA, capability/race/retry/phone/offline/real-clock expiry and owned cleanup are recorded in #711 and the [staging guide](./docs/officers/STAGING_COMMUNITY.md). On 2026-10-12, natural ten-minute expiry denied the unchanged session; sign-out and fresh native TOTP sign-in restored the actual officer view, and a new genuine native App Check token passed the same server boundary. The no-terminal handoff and exact disposable cleanup passed. This is supervised synthetic staging only; ordinary officer access, lost-authenticator recovery and production are NOT AVAILABLE YET. @@ -815,7 +815,7 @@ The module is imported by no runtime or Functions index. It reads no clock or en ### 8.0b Officer manual off-platform dues-evidence command — PRODUCTION UNUSED -**#716 isolated staging adoption prepared:** the pure contract below is now imported only by `communityDues.js` for explicitly fictional, unlinked test terms. Its old source-only statements are historical outside that one staging path. No production authority, payment policy or account association is enabled; hosted availability requires #716's separate deployment/UI/cleanup evidence. +**#716 isolated staging adoption verified 2026-10-12:** the pure contract below is now imported only by `communityDues.js` for explicitly fictional, unlinked test terms. Its old source-only statements are historical outside that one staging path. No production authority, payment policy or account association is enabled; #716 records native v3/Hosting d212fab, genuine hosted security/UI and exact cleanup evidence. Fresh specialist-supplied fixtures remain necessary. MEMBERS-ADMIN-001A [#395](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/395) defines one unused pure contract for the first MEMBERS-ADMIN-001 [#115](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/115) behavior: recording an owner-approved off-platform dues confirmation for a membership term without creating or claiming a Stripe payment. It turns one exact officer-audit envelope into the exact approved `record_term_decision` command the §8.0a reducer already accepts, plus a paired immutable audit record stamped with an off-platform provenance. It decides no policy; every owner-meaningful value is carried through as an opaque token. diff --git a/docs/officers/ACCESS_CONTINUITY.md b/docs/officers/ACCESS_CONTINUITY.md index 4b0afa5..a7b614e 100644 --- a/docs/officers/ACCESS_CONTINUITY.md +++ b/docs/officers/ACCESS_CONTINUITY.md @@ -6,7 +6,7 @@ ## Sole-owner backend exception — approved October 11, 2026 -**Fictional dues permission — #716 source prepared, NOT AVAILABLE YET:** only Dave/platform specialist supplies an explicitly disposable staging officer and separate expiring dues-recording permission for the [supervised test](./STAGING_COMMUNITY.md#fictional-external-dues--716). Existing approval/event permissions do not gain this access. No ordinary officer, shared Gmail password or browser admin role can grant it. Test configuration/enrollment, revocation, exact cleanup and rollback remain specialist-only. Stop and contact Dave privately if access is absent or survives revocation; do not edit records or share passwords/codes. This changes no backup appointment, real officer authority or production permission. +**Fictional dues permission — #716 staging verified 2026-10-12:** only Dave/platform specialist supplies an explicitly disposable staging officer and separate expiring dues-recording permission for the [supervised test](./STAGING_COMMUNITY.md#fictional-external-dues--716). Existing approval/event permissions do not gain this access. No ordinary officer, shared Gmail password or browser admin role can grant it. Test configuration/enrollment, revocation, exact cleanup and rollback remain specialist-only. Stop and contact Dave privately if access is absent or survives revocation; do not edit records or share passwords/codes. This changes no backup appointment, real officer authority or production permission. **Purpose:** allow backend setup and protected releases without appointing a backup. **Approver:** Dave Liu (`daliu`), the sole backend release/recovery owner. diff --git a/docs/officers/EVENTS_SHOP_MEMBERS.md b/docs/officers/EVENTS_SHOP_MEMBERS.md index d4f220b..55eafab 100644 --- a/docs/officers/EVENTS_SHOP_MEMBERS.md +++ b/docs/officers/EVENTS_SHOP_MEMBERS.md @@ -10,9 +10,9 @@ The repository contains screens for these jobs. Their presence does not prove th There is currently no proven no-code switch that safely stops all new Stripe payments. Hiding a button, closing an event, or marking a product sold out may leave an already-created Stripe Checkout page payable. -## Fictional external dues — #716, NOT AVAILABLE YET +## Fictional external dues — #716, staging verified 2026-10-12 -Dave approved fictional amounts/methods/short terms for this staging-only recording test, not real dues rules. Use the [short supervised guide](./STAGING_COMMUNITY.md#fictional-external-dues--716) only after its separate hosted acceptance. It records an unlinked test term, moves no money and grants no account access or role. Real club prices/terms/methods/confirmers, deliberate account association, renewal, corrections and refunds need separate approved work. The specialist handles fixtures/permissions/provider proof/cleanup; an officer does not change a role, record or payment directly. +Dave approved fictional amounts/methods/short terms for this staging-only recording test, not real dues rules. Hosted acceptance passed on October 12; use the [short supervised guide](./STAGING_COMMUNITY.md#fictional-external-dues--716) only with fresh specialist-supplied disposable fixtures. It records an unlinked test term, moves no money and grants no account access or role. Real club prices/terms/methods/confirmers, deliberate account association, renewal, corrections and refunds need separate approved work. The specialist handles fixtures/permissions/provider proof/cleanup; an officer does not change a role, record or payment directly. ## Membership cancellation — POLICY APPROVED, NOT AVAILABLE YET diff --git a/docs/officers/README.md b/docs/officers/README.md index 921baf8..bef21bd 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -33,7 +33,7 @@ In words: approve the merge, request one exact release, and approve its protecte ## Short guides -[#716 fictional external-dues recording](./STAGING_COMMUNITY.md#fictional-external-dues--716) is source prepared, **NOT AVAILABLE YET**. It keeps test receipts unlinked and moves no money. A separate permission and specialist-provided fake configuration are required; source/green checks do not prove deployment or availability. +[#716 fictional external-dues recording](./STAGING_COMMUNITY.md#fictional-external-dues--716) passed native staging deployment, hosted UI/security/retry/race and exact cleanup on 2026-10-12. It keeps test receipts unlinked and moves no money. A separate permission and fresh specialist-provided fake configuration/account are required; the test fixtures were removed. Production and real dues remain unavailable. Core staging officer approval/free-event management checks passed on 2026-10-11 under [#711](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711). Expired-session recovery and the no-terminal handoff passed on 2026-10-12: sign out, sign in again and enter a fresh authenticator code. Follow the [supervised staging checklist](./STAGING_COMMUNITY.md#officer-review--711-staging-verified) only with new specialist-supplied disposable fixtures; ordinary officer access, real dues and production remain **NOT AVAILABLE YET**. diff --git a/docs/officers/STAGING_COMMUNITY.md b/docs/officers/STAGING_COMMUNITY.md index 6845850..d61b050 100644 --- a/docs/officers/STAGING_COMMUNITY.md +++ b/docs/officers/STAGING_COMMUNITY.md @@ -53,7 +53,13 @@ The specialist's Hosting release uses Dave's existing club login for a short-liv ## Fictional external dues — #716 -**Status:** SOURCE PREPARED — **NOT AVAILABLE YET** until #716 records native staging deployment, website and disposable-test acceptance. Real club rules remain unset. Recording does not associate an account, grant access/roles or move money. +**Status:** STAGING VERIFIED on 2026-10-12 under #716. Source PR717 merged as `d212fab`; all six exact PR/main jobs and every step passed. Native Function version 3 and staging Hosting use that source; the downloaded 90,117-byte archive matches SHA-256 `7498d65c0f3f6dcdad1ccdbdbedd9d7c09d6f839424d1c8d2a3bb2922b611174`. Real club rules remain unset. Recording does not associate an account, grant access/roles or move money. Production and real dues are **NOT AVAILABLE YET**. + +**Hosted acceptance:** two disposable native TOTP officers and genuine App Check passed recording, immutable replay, conflicting/duplicate confirmation and cross-officer race checks. Twenty-two negative cases passed, including unverified/single-factor/mismatched callers, missing/invalid attestation, forged fields, old/revoked/expired/malformed permissions and missing/stale/invalid/expired policy. Twenty-one fictional receipts proved twenty-plus-one pagination with no overlap. The actual website passed native MFA sign-in, recording, offline uncertainty/saved retry, page navigation and revocation clearing. At 390×844 the page had no horizontal overflow; dues inputs/buttons were at least 45 pixels tall. Profiles, membership documents and Auth roles did not change. + +**Cleanup and handoff:** all 51 exact owned documents and both disposable accounts were removed and their absence checked, including a later profile check. The local test receiver closed; Chrome's temporary Apps on device permission reads OFF. The officer session signed out. New reviews need fresh specialist-supplied fixtures; no test account or policy was left available. This procedure was reviewed as a backup officer without a terminal: sign-in, confirmation, saved retry, page navigation, revoked-access stop and sign-out use the screen. Provisioning, authenticator enrollment, policy/permission supply, cleanup and rollback still need the specialist. Lost-authenticator recovery is **NOT AVAILABLE YET**. + +**Release caveat:** the fixed Function release command ended with a generic failure after provider deployment. Independent native resource, downloaded archive, invoker, security, unchanged-profile and hosted behavior checks qualified the deployed result; there was no repeat deployment or bypass. The command's reporting cause remains unqualified. Staging Hosting's release command completed successfully. Do not infer success or rerun a failed release from its labels alone. **Purpose:** rehearse one fictional externally confirmed dues receipt and safe retry. **Approver:** Dave, sole staging owner. **Prerequisites:** the specialist supplies the reviewed staging link, disposable MFA officer, separate expiring dues permission, fictional confirmation ID and made-up amount/method/short term. No real details or bank references. diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index ad63f47..a9b5acc 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -2,7 +2,7 @@ These diagrams show where pages, information, and deployments go. Each diagram includes a one-sentence text version. -## Fictional external dues — #716, source prepared; NOT AVAILABLE YET +## Fictional external dues — #716, staging verified 2026-10-12 ```mermaid flowchart LR @@ -15,7 +15,7 @@ flowchart LR Browser["Browser including admin"] -. "Direct writes denied" .-> Receipt ``` -Text alternative: a recent authenticated officer with a separate expiring dues permission uses the existing service and server-owned fictional policy to record one globally unique, immutable unlinked test receipt and audit, with bounded review and no direct browser write, account access or money movement. Native deployment/UI/cleanup proof is still required. +Text alternative: a recent authenticated officer with a separate expiring dues permission uses the existing service and server-owned fictional policy to record one globally unique, immutable unlinked test receipt and audit, with bounded review and no direct browser write, account access or money movement. Native Function version 3 and Hosting `d212fab` passed hosted UI/security/cleanup checks; fresh specialist-supplied fixtures are required, and real dues/production remain unavailable. ## Staging community lifecycle — #707, first hosted release verified 2026-10-11