Link fictional dues to disposable staging memberships

GITHUB_ISSUES.md

@@ -1,5 +1,7 @@
 # GitHub Issue Backlog: Secure Commerce Program
 
+**COMMUNITY-DUES-002 / #719 — SOURCE PREPARED, NOT AVAILABLE YET:** link one immutable fictional receipt to one owner-marked disposable pending account and activate its unchanged current test term. Separate v3 association capability, recent native TOTP/App Check, authoritative verified/enabled Auth, strict input/revision/marker guards, atomic uniqueness and permission-first replay. No real policy/data/money, Auth claim, IAM expansion, dependency/service/schedule or production change. Officer impact: supervised screen-only fictional linking and member verification. Officer documentation: STAGING_COMMUNITY, entrypoints, ACCESS_CONTINUITY, EVENTS_SHOP_MEMBERS, glossary and maps. Deployment evidence: source/local tests only until native #719 records exact merge, staging Function/Hosting, security/UI/race/retry/cancel/expiry and owned cleanup. #716 is historical recording-only proof; broad #115/#81 and real launch remain separate.
+
 **COMMUNITY-DUES-001 / #716 — staging verified 2026-10-12:** owner-selected fictional external dues on the existing isolated staging service. Separate exact v2 capability, server-supplied fake amount/method/short term, confirmation UUID/global duplicate fence, immutable command/audit and unlinked test authority; twenty minimal receipts per page. No real policy, account association/access, claims, provider/payment, migration, IAM expansion, service/schedule/dependency or production change. Officer impact: supervised fictional recording only. Officer documentation: STAGING_COMMUNITY, entrypoints, Events-Shop-Members, glossary and map. Deployment evidence: PR717 merged d212fab; all six exact PR/main jobs and every step passed. Native Function v3/archive and staging Hosting matched; twenty-two hosted denials, immutable retry/race, twenty-plus-one pages, actual UI/offline/390×844/revocation and 51-document/two-account cleanup passed. Release-command reporting caveat and supervised fresh-fixture handoff are recorded in STAGING_COMMUNITY; production/runmprc.com and real payments were untouched. Broad #115/#81 and real club launch remain separate; native #114's closed status is not readiness proof.
 
 **COMMUNITY-003 / #711, staging recovery and handoff verified 2026-10-12:** staging-only officer console extension to #707. One callable, two live expiring action capabilities, recent TOTP/verified Auth/native App Check, authoritative target read, configured synthetic test approval, free-only create/edit/capacity/open/close/cancel, bounded pending cursor review and immutable audited retries. No real dues/claims/production/payment/migration/export/mail. Dave selected externally confirmed dues later; policy remains separate. Officer impact: supervised disposable staging approval/event review. Officer documentation: STAGING_COMMUNITY, entrypoints and maps. Deployment evidence: Function version 2/native archive/spec/IAM/MFA and Hosting source `57261ae` verified; operator/negative/race/retry/phone/offline/natural-expiry proof and exact owned cleanup recorded in the [dated receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/711#issuecomment-6117987215). Natural expiry, denied old session, fresh native TOTP/App Check recovery, actual UI restoration, final no-terminal handoff and exact owned cleanup passed on 2026-10-12. #711 has its final bounded staging acceptance; #114/#115/AUTH-003/ADMIN-001 and ordinary production access remain separate and open.

IMPLEMENTATION_PLAN.md

@@ -1,5 +1,7 @@
 # MPRC Secure Commerce Implementation Plan
 
+**#719 focused continuation — SOURCE PREPARED, NOT AVAILABLE YET:** verified/closed #716 is the dependency. Add only fictional receipt-to-disposable-account linking and derived current test membership. Preserve receipt/term, pending revision, separate capability, authoritative Auth, transaction uniqueness, permission-first replay and cancellation-through-term policy. Complete local checks, exact source/main CI, native archive/security/resource readback, hosted positive/negative/race/retry/cancellation/expiry/UI review and exact owned cleanup before closing this child. Broad #115/#81, real rules/payments and production launch remain separate.
+
 **Status:** Approved technical sequence and assessment snapshot; GitHub issues are the live execution/status source
 **Last reviewed:** 2026-07-12
 **Live status:** [Secure Commerce & Platform Hardening milestone](https://github.com/Run-MPRC/Run-MPRC.github.io/milestone/2)

OFFICER_START_HERE.md

@@ -1,5 +1,7 @@
 # MPRC Website: Officer Start Here
 
+**Fictional account linking — #719, SOURCE PREPARED / NOT AVAILABLE YET:** a separate staging-only permission will link one fictional receipt to a specialist-marked disposable pending account. Its test access lasts only through the receipt's unchanged term, including after cancellation; no Auth role or money changes. Follow the [screen-only guide](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) only after native acceptance and fresh private test fixtures. Production and real membership rules remain unavailable.
+
 **Use this page if Dave or the usual code owner is unavailable.** You do not need to know how to code.
 
 **Google Doc entry card:** a private native Google Doc titled **MPRC Website — Officer Start Here** has been connector-readback verified with the safe request and warnings. Its private edit link is intentionally not published here. It is currently owner-only; continuity is incomplete until the board moves it to the board-owned Drive and shares it with at least two backup officers.

OPERATIONS_RUNBOOK.md

@@ -1,5 +1,7 @@
 # MPRC Platform Operations Runbook
 
+**#719 fictional linking — SOURCE PREPARED, NOT AVAILABLE YET:** reuse the same service, six-permission runtime and min0/max2/256MB/30s limits. Dave/specialist supplies only disposable verified Auth accounts, pending requests/revisions, expiring exact v3 association capabilities and six-field `communityAssociationTargets/{uid}` markers. Follow the [screen-only procedure](./docs/officers/STAGING_COMMUNITY.md#link-a-fictional-receipt--719) after native acceptance. Disable capabilities first; exact owned cleanup uses identity/update-time fences. No ordinary officer grants a role, edits records, deploys or runs a terminal. No migration/scheduler/provider/payment/production change. The existing release command's post-deploy reporting failure remains unresolved; inspect native state/archive before any retry, never blindly redeploy.
+
 **Status:** Target operating procedure; several controls are not implemented yet
 **Last reviewed:** 2026-07-12
 **Audience:** Engineers, race directors, merchandise/fulfillment leads, membership admins, treasurer/finance admins, and incident responders

SECURITY.md

@@ -1,5 +1,7 @@
 # MPRC Security, Privacy, and Risk Plan
 
+**#719 staging linking — SOURCE PREPARED, NOT AVAILABLE YET:** live expiring v3 association permission is separate from recording/approval/event access. Require recent native verified TOTP/App Check, exact caller binding, explicit test confirmation, an owner-marked disposable UID, authoritative verified/enabled Auth lookup and a pending null-authority application/revision. One receipt and one pending account can be linked only once transactionally; saved retries recheck permission before replay. Receipt/term, profiles and Auth claims stay unchanged. Receipt review exposes no target/contact data. Both new collections stay default-denied to browser admins. The six-permission project-scoped runtime gains no rights. Source/tests do not qualify native deployment or production security.
+
 **Status:** Pre-production security assessment
 **Assessment date:** 2026-07-12
 **Scope:** This repository's React application, Firebase configuration/functions/rules, Stripe integration, Strava integration, CI/CD, operational data, and documented deployment model

STRIPE_COMMERCE_DESIGN.md

@@ -1,5 +1,7 @@
 # Stripe, Race Registration, and Merchandise Design
 
+**#719 fictional activation — SOURCE PREPARED, NOT AVAILABLE YET:** a separately authorized disposable staging account may receive the unchanged test term from a fictional external-dues receipt. This does not verify a payment, reconcile Stripe, grant an Auth role, renew a term, issue a refund or approve real club policy. Receipt evidence stays immutable; association is a separate server-only record. Production and real payments remain untouched and unavailable.
+
 **Status:** Required production design; current code is a test-mode prototype
 **Last reviewed:** 2026-07-13
 **Related:** [SYSTEM_DESIGN.md](./SYSTEM_DESIGN.md), [SECURITY.md](./SECURITY.md), [OPERATIONS_RUNBOOK.md](./OPERATIONS_RUNBOOK.md)

SYSTEM_DESIGN.md

@@ -1,5 +1,7 @@
 # MPRC Platform System Design
 
+**#719 fictional account linking — SOURCE PREPARED, NOT AVAILABLE YET:** the isolated staging service adds `admin_dues_link`. A separate exact v3 `membershipAssociation` capability, recent native TOTP/App Check, authoritative verified/enabled Auth account, pending null-authority application with matching revision, and owner-supplied exact six-field disposable-target marker expiring within 24 hours are all required. One immutable fictional receipt supplies the unchanged approved current test term; an atomic transaction creates `communityDuesLinks/{membershipId}` and attaches its derived authority to `communityMemberships/{uid}`. Receipt and member uniqueness fences prevent double activation, reassignment and renewal. Saved retries recheck officer permission before replay. Recording remains unlinked; the bounded receipt view adds only a linked boolean, not a target UID. Cancellation preserves the original term; live clock expiry removes current-member status. No Auth claims/roles, real policy/data/payments, new dependency/service/schedule, IAM expansion, migration or production change. Existing default-deny browser Rules cover both new collections. Staging deployment and native acceptance remain required under #719.
+
 **Status:** Target architecture and current-state assessment
 **Last reviewed:** 2026-07-13
 **Owners:** MPRC product, engineering, operations, and finance leads

docs/officers/ACCESS_CONTINUITY.md

@@ -1,5 +1,7 @@
 # Access Continuity
 
+**#719 linking permission — SOURCE PREPARED / NOT AVAILABLE YET:** only Dave/platform specialist supplies an expiring association permission and exact disposable-target marker for the [supervised screen review](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719). Existing recording/approval/event access grants no linking authority. Do not change a role, email-match an account or share passwords/codes. Stop if the supplied account/revision is uncertain or access survives revocation. Enrollment, fixture supply, cleanup and rollback remain specialist-only; no backup appointment or production permission changes.
+
 **Purpose:** ensure at least two named officers can reach every important service if the usual owner is unavailable.
 **Status:** setup is **INCOMPLETE** until the entry document is in a board-owned Drive and two backup officers complete a sign-in drill.
 **Approver:** club president plus the officer responsible for the service.

docs/officers/EVENTS_SHOP_MEMBERS.md

@@ -1,5 +1,7 @@
 # Events, Shop, Members, and Money
 
+**#719 fictional linking — SOURCE PREPARED / NOT AVAILABLE YET:** the [supervised staging procedure](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) will deliberately connect an immutable fictional receipt to a specialist-marked disposable pending account. Test access uses only the receipt's original term; cancellation preserves it until expiry. No real dues policy/payment/claim/renewal/refund/production launch is supplied. Stop on an uncertain ID/revision or changed term and contact Dave privately.
+
 **Current status:** live commerce is **NOT AVAILABLE YET**.
 **Use this guide when:** a request touches registrations, members-only access, products, payments, refunds, waivers, or private data.
 

docs/officers/GLOSSARY.md

@@ -2,6 +2,8 @@
 
 | Word | Plain meaning |
 | --- | --- |
+| Disposable target marker | A short-lived server record the specialist uses to identify a made-up account permitted for one staging linking test. It is not an officer role or real membership. |
+| Linked test membership | A fictional receipt deliberately connected to one disposable account. Test access depends on its original current term; cancellation does not extend it and no Auth role changes. |
 | Fictional confirmation ID (UUID) | A long random test code supplied by the specialist. Reusing it cannot record the same made-up payment twice. It is not a bank reference or evidence of real money. |
 | Unlinked test membership | A made-up term and receipt not connected to any account. It grants no account access or role. |
 | AI assistant | A tool that can read instructions and help prepare a change. It still needs review and approval. |

docs/officers/README.md

@@ -1,5 +1,7 @@
 # Officer Website Handbook
 
+[#719 fictional account linking](./STAGING_COMMUNITY.md#link-a-fictional-receipt--719) is SOURCE PREPARED / NOT AVAILABLE YET. A separate permission and specialist-marked disposable account are required; do not use real members or receipts. Native deployment, screen review and exact cleanup remain required. This does not release real memberships/payments or production.
+
 **Audience:** MPRC officers and backup maintainers with little or no coding experience
 **Last checked:** 2026-07-30
 **Start page:** [OFFICER_START_HERE.md](../../OFFICER_START_HERE.md)

docs/officers/STAGING_COMMUNITY.md

@@ -10,6 +10,39 @@
 
 ## What the actions mean
 
+## Link a fictional receipt — #719
+
+**Status:** SOURCE PREPARED / **NOT AVAILABLE YET** until #719 records native staging deployment and hosted acceptance. This supplements #716 recording; it does not change its immutable receipt or approve real club policy.
+
+**Purpose:** deliberately connect one fictional receipt to one disposable pending account and verify its unchanged test term. **Approver:** Dave Liu. **Prerequisites:** the specialist supplies a verified disposable account, exact account ID and pending revision, a current unlinked fictional receipt, short test term, expiring association permission and disposable-target marker. Officer setup is separate from member sign-in. No backup owner is appointed.
+
+1. Open the supplied staging `/community/admin` link.
+2. Confirm **Staging test only** and the supplied disposable officer email.
+3. Sign in and complete the authenticator prompt.
+4. Find **Link fictional dues to a disposable account**. If absent, stop.
+5. Select the supplied unlinked **Fictional receipt to link**.
+6. Enter only the specialist-supplied **Disposable account ID**.
+7. Enter the supplied **Pending membership revision**.
+8. Check that both identifiers match the private test instructions.
+9. Select the fictional-account confirmation checkbox.
+10. Select **Link and activate test membership** once.
+11. Confirm the current receipt review reports **Linked test term**.
+12. If uncertain, use **Retry saved action**, not a new link.
+13. Sign out of the officer account.
+14. Sign in as the supplied disposable member on `/community`.
+15. Select **Refresh status** and confirm **Test membership active** and the original term end.
+16. Select **Cancel membership** and confirm cancellation requested while test access continues through that same end.
+17. After the short term ends, select **Refresh status** and confirm test membership is not active.
+18. Sign out and ask the specialist to confirm exact test cleanup.
+
+**Expected result:** one separate immutable link and one approved disposable test membership; the original receipt and term are unchanged. The test grants no Auth claim/role or real paid membership and moves no money. Recording permission alone cannot link. A linked row is not proof of current member access after expiry; use the member page.
+
+**Stop conditions:** real account/reference/member data; production URL; uncertain or wrong account/revision/receipt; missing permission/marker; unverified/disabled account; nonpending application; future/expired term; changed dates; conflicting duplicate; uncertain result that remains unresolved. Stop and contact Dave privately; do not edit records, guess another ID, renew or reassign a receipt.
+
+**Success proof:** #719 must separately record exact source/tests/merge, Function archive/resource/security/identity, Hosting marker, native attestation/MFA, actual officer/member screens, failed/duplicate/racing/retried requests, cancellation/original expiry and exact cleanup. **Undo:** sign out; the specialist disables the capability first and verifies old retries denied, then follows the reviewed staging rollback or owned-fixture cleanup. No unlink/refund/correction button is provided. **Escalation:** Dave/platform specialist. Enrollment, configuration, marker/permission supply, release and cleanup remain specialist-only; the backup-officer review needs no terminal, shared password or database editing.
+
+## Existing membership and free-event actions
+
 - Request membership: records a pending request. It does not prove dues or grant membership.
 - Withdraw membership request: withdraws a pending application.
 - Cancel membership: records a cancellation request for an already-approved synthetic membership. Access lasts through its original paid term. No refund occurs.

docs/officers/SYSTEM_MAPS.md

@@ -2,6 +2,22 @@
 
 These diagrams show where pages, information, and deployments go. Each diagram includes a one-sentence text version.
 
+## Fictional account linking — #719, source prepared only
+
+```mermaid
+flowchart LR
+    Officer["Recent native TOTP + App Check"] --> Permission["Separate expiring v3 association permission"]
+    Permission --> Service["Same staging communityActions service"]
+    Receipt["Immutable fictional receipt and original current test term"] --> Service
+    Target["Owner-marked disposable UID; verified/enabled Auth; pending revision"] --> Service
+    Service --> Atomic["Atomic separate link + associated test authority; one receipt/account"]
+    Atomic --> Member["Member page: current clock; cancellation keeps original expiry"]
+    Browser["Browser including admin"] -. "Direct writes denied" .-> Atomic
+    Atomic -. "Never" .-> Real["Auth roles, real money or production"]
+```
+
+Text alternative: separately authorized recent-MFA staging officers may atomically connect one immutable fictional current term to one owner-marked verified disposable pending account, with no roles/payments/production change; native release acceptance remains required.
+
 ## Fictional external dues — #716, staging verified 2026-10-12
 
 ```mermaid

functions/communityActions.appCheck.test.js

@@ -70,4 +70,13 @@ describe('native authenticated boundary and context binding', () => {
     expect((await request({ ...app, authorization: 'Bearer synthetic-unverified-auth' }, dues)).status).toBe(403);
     expect(admin.firestore).not.toHaveBeenCalled();
   });
+  test('linking native boundary cannot be authorized by fields, another UID or single-factor/unverified Auth', async () => {
+    const link = { action: 'admin_dues_link', accountUid: 'synthetic-uid', requestId: '123e4567-e89b-42d3-a456-426614174000', expectedRevision: 1, reason: 'synthetic_staging_review', membershipId: `stage_dues_${'a'.repeat(64)}`, targetUid: 'disposable-target', associationConfirmed: true };
+    expect((await request({ authorization: 'Bearer synthetic-auth' }, link)).status).toBe(401);
+    expect((await request({ ...app, authorization: 'Bearer synthetic-auth' }, { ...link, accountUid: 'other' })).status).toBe(403);
+    expect((await request({ ...app, authorization: 'Bearer synthetic-auth' }, link)).status).toBe(403);
+    expect((await request({ ...app, authorization: 'Bearer synthetic-unverified-auth' }, link)).status).toBe(403);
+    expect((await request({ ...app, authorization: 'Bearer synthetic-auth' }, { ...link, role: 'admin' })).status).toBe(400);
+    expect(admin.firestore).not.toHaveBeenCalled();
+  });
 });