Skip to content

Prepare bounded fictional race callable and private status - #733

Merged
daliu merged 1 commit into
mainfrom
codex/fictional-race-staging-rpc
Oct 13, 2026
Merged

daliu merged 1 commit into
mainfrom
codex/fictional-race-staging-rpc

Conversation

@daliu

@daliu daliu commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

Outcome

Prepare a private bounded fictional race backend in the existing staging service. Exact native-context routes, current disposable authority/metadata, read-only own status and the deterministic source archive are reviewed separately from #731's client and actual hosted release. Related #732; parent #731 remains open.

Officer impact: The fictional race screen remains NOT AVAILABLE YET. No live refund, real payment, policy or production change.
Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, STAGING_COMMUNITY.md, EVENTS_SHOP_MEMBERS.md, SYSTEM_MAPS.md; affected root design/security/plan/runbook/backlog. Source/demo proof is distinct from deployed behavior. Provider/fixture/release/cleanup/rollback remains specialist-only; no-terminal source review supplied.
Deployment evidence: None from this PR. No cloud build, Function deploy, Hosting publication, hosted fixture, IAM/API/service/billing or provider payment action. Genuine native Auth/App Check/security/UI/release/cleanup remains #731 acceptance. Existing #724 v5/Hosting proof is historical, not new race proof.

Invariant and compatibility

  • Same existing callable and min0/max2/256MB/30s scope. Platform supplies UID/claims and App Check; exact bound requests and recent verified default-tenant password context, current own-entry permission/marker and native enabled/verified metadata still decide admission. No admin/claim/price/target/deadline override.
  • Clone input before routing; only race_status/join/cancel/offer/accept/revoke are supported. Existing membership/free-event/officer v1-v3/dues behavior preserved. The selected SDK app explicitly names the exact project, never a production/default fallback.
  • Closed manifest lists at most twenty events; status uses SDK read-only transactions and exact point reads, one native caller lookup, no roster/query/poll. Only own entry/history and exactly named incoming offer; no other UID/contact/waiver/count/capacity/history/financial totals. Missing and unrelated incoming IDs share a fixed denial. Server supplies opaque signup ID, fictional price/waiver/window and response-only controls; mutation revalidates all actual authority/state.
  • Fresh post-read time fences permission/window/offer expiry. One enrollment ever/one recipient-accepted transfer are technical fictional test rules, not actual club policy. Original credit/bib/waiver/index history and immutable saved retries remain intact. Owner read/revoke does not require continued recipient access.
  • Complete deterministic archive with all relative imports; still only communityActions, no prototype/provider handlers or tests. No dependency/lockfile, new workflow/job/service, runtime permission or browser Rules allowance.
  • Additive communityConfig/fictionalRaces; absence/corruption denies discovery/status, with no migration/backfill. Auth metadata is outside Firestore's transaction, not instantaneous distributed revocation proof.

Checks and review

  • Final focused six suites: 218 tests pass. Full ordinary backend checkpoint: 81 suites / 7,963 pass / 80 emulator-only skipped; one later additional route-lifecycle test separately passed. Exact final CI must qualify all source, not that earlier checkpoint alone.
  • Actual local Auth/Firestore demo tests: 10/10 pass after explicit SDK readOnly option; exact content/nanosecond update-time invariance, privacy, disabled/unverified/revoked/expired admission, owner recovery, final-seat/competing transitions and saved retry/lost-ack recovery. Context is synthetic; native HTTP verifier mocks prove wiring only, not genuine hosted tokens/attestation.
  • Full Rules 444/444; new manifest root/children anonymous/member/verified-browser-admin operations deny. Rules source unchanged.
  • Existing staging-authority/release contracts 53/53, lint and whitespace pass. CI runs existing Node20/22 checks; local Node20 is unavailable and no installation was added.
  • Reviewed request bounds/discriminants, caller/App Check/tenant binding, exact SDK realm, privacy, all point-read ceilings, live authority/time, idempotency/state/credit preservation, safe errors/no logging, archive imports and production fallback. Test-only unused-variable lint issue corrected without a runtime guard change.
  • Successful owned demo Auth users/records and exact manifest removed with absence checks. Emulators stopped; no listeners or log handles on 8080/9099/9150. Final 166,790-byte passing owned log removed after checks. Active reused checkout, current/rollback artifacts retained; foreign changes/worktrees untouched.

No parent or full-goal closure is requested. #731 still requires strict typed client/screen/context fences and actual backend-first staging/security/UI/mobile/expiry/retry/owned cleanup.

Final source-only receipt

Merged2026-10-13T18:09:39Z as6eb30f64949cd229942585bbc8b4dd426d834a38. Exact PR38443654974/main38444490349 completed/success, all six jobs/every step success/no skips. Final CI ordinary7,964/80 emulator-only skips, Node22 actual SDK7,981/63 separate-journal skips/new native suite pass; separatejournal63/frontend1,385/Rules444/protected-release191. #732 body has four criteria checked, CLOSED18:14:46Z/receipt6152138659. Fresh read-only existing native Functionv5/archivea4c2eefa/profiles2/1/2843388/TOTP/Hosting485be670 matches; new race source NOT deployed. #731 and the broad goal remain open/active. Officer source handoff used the supplied plain-language style; source/demo, native release and usable screens remain separate, with specialist-only tasks named.

@netlify

netlify Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for luminous-fox-7c393f ready!

Name Link
🔨 Latest commit be608f9
🔍 Latest deploy log https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6ace726c4d6cb2fa57c3bc51
😎 Deploy Preview https://deploy-preview-733--luminous-fox-7c393f.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@daliu
daliu merged commit 6eb30f6 into main Oct 13, 2026
10 checks passed
@daliu
daliu deleted the codex/fictional-race-staging-rpc branch October 13, 2026 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant