From 656cc41113e7fdef9a0b17a9a943ab6565e6ab0b Mon Sep 17 00:00:00 2001 From: Dave Liu <7david12liu@gmail.com> Date: Wed, 14 Oct 2026 23:51:01 -0700 Subject: [PATCH] docs: record native fictional race staging acceptance --- GITHUB_ISSUES.md | 2 ++ IMPLEMENTATION_PLAN.md | 2 ++ OFFICER_START_HERE.md | 2 +- OPERATIONS_RUNBOOK.md | 2 ++ SECURITY.md | 2 ++ STRIPE_COMMERCE_DESIGN.md | 2 ++ SYSTEM_DESIGN.md | 2 ++ docs/officers/EVENTS_SHOP_MEMBERS.md | 2 +- docs/officers/README.md | 2 +- docs/officers/STAGING_COMMUNITY.md | 16 ++++++++++------ docs/officers/SYSTEM_MAPS.md | 8 ++++---- 11 files changed, 29 insertions(+), 13 deletions(-) diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index cbd04c2..7fe924d 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,5 +1,7 @@ # GitHub Issue Backlog: Secure Commerce Program +**RACE-SIM-001C / #731 — NATIVE TESTS VERIFIED, HANDOFF GATED:** actual fictional lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed on 2026-10-14, including real Auth/App Check/caller/current-authority boundaries and actual UI committed/lost-response retry. Exact retry changed none of six protected record update times; recipient-loss replay/revoke and terminal/current-revocation guards passed. Two fresh accounts/26 owned docs cleaned with fences/late absence; private browser SDK state/cache cleared, unused receiver closed/zero captures/port refused. Human permission-OFF confirmation and reviewed/current-CI handoff remain before closure or supervised use with fresh fixtures. Officer impact: verified fictional flow only; no real policy/payment/production readiness. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS, SYSTEM_MAPS and root checkpoints. Deployment evidence: existing v6/669e2fb/archive94380430 and Hosting e21be35 unchanged, [native receipt6186206758](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); no new deploy or full backend completion. Earlier #731/#732 source/anonymous-only entries below are historical. + **RACE-SIM-001C / #731 — STAGING DEPLOYED, OPEN:** PR734/merge `669e2fb`, exact PR38455181292/main38455775086 six jobs/every step, native v6/downloaded archive/resource/owner/MFA/invoker/unchanged profiles and dependent Hosting/public assets verified. Anonymous 390×844 screen passes, not signed-in lifecycle/security/cleanup. Officer impact: planned supervised fiction remains NOT AVAILABLE YET until that acceptance. Officer documentation: dated STAGING_COMMUNITY/entrypoints/maps/root checkpoint. Deployment evidence: [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731); earlier source-only/not-deployed entries are historical. No production/real payments or broader goal completion. **RACE-SIM-001C / #731 — CLIENT SOURCE PREPARED, OPEN:** closed staging request/status/ack parsing and `/community/races` screen cover synthetic signup, cancellation/full credit return, private offer/recipient waiver acceptance/revoke, exact retry and context/stale-state clearing. No migration, money/provider action, dependency/service/workflow/IAM/Rules allowance. Officer impact: planned supervised fictional screen, NOT AVAILABLE YET. Officer documentation: STAGING_COMMUNITY, entrypoints, EVENTS_SHOP_MEMBERS and SYSTEM_MAPS. Deployment evidence: local doubles/full checks only at this milestone; genuine native security, exact backend-first Function/Hosting release, actual screens and fenced cleanup remain required. #732's backend source is merged; neither source milestone closes #731 or the full backend goal. diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 2c4ae74..9e02749 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -1,5 +1,7 @@ # MPRC Secure Commerce Implementation Plan +**#731 native tests complete — 2026-10-14, handoff gated:** actual fictional lifecycle/privacy/expiry/mobile plus 38 native evaluations/27 distinct security/replay checks passed. UI response discarded only after real server commit recovered through the exact saved action with all six protected update times unchanged. Recipient-loss replay/revoke and terminal-state/caller-revocation protection passed. Two fresh accounts/26 owned records removed with fences/immediate+late absence; browser test credentials/cache cleared and unused receiver closed. Final browser-permission confirmation and reviewed documentation/current-CI receipt remain before issue closure or supervised use with fresh fixtures. No new deploy/build/service/IAM/Rules/provider/production/payment work. [Dated native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758); earlier #731/#732 source/anonymous-only milestones below are historical. Whole-backend completion is not claimed. + **#731 staging deployment checkpoint — 2026-10-13:** exact PR/main checks passed; backend v6/archive was verified before Hosting `669e2fb`. Anonymous phone-width UI/public assets pass, not signed-in acceptance. Continue genuine disposable security/lifecycle/privacy/failure/retry/expiry/mobile and fenced cleanup before closing #731. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; full backend goal/production/real payments remain separate. **#731 client milestone — SOURCE PREPARED:** strict staging client and minimal member screen now have local positive/negative/context/failure/retry/expiry tests. Review and merge this source independently of deployment. Next verify all six exact current-main jobs/every step, deploy/read back the changed backend archive first, then publish staging Hosting and finish genuine security/actual UI/mobile/failure/expiry/owned cleanup. No new service/dependency/workflow/IAM or production/payment work; #731 and the broader backend goal remain open until native acceptance. diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index e6560ff..927e0c6 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -1,6 +1,6 @@ # MPRC Website: Officer Start Here -**#731 latest checkpoint — STAGING DEPLOYED 2026-10-13, TESTS STILL OPEN:** the [current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates verified deployment from unfinished signed-in race/cleanup tests. The planned officer flow is NOT AVAILABLE YET; ask Dave/platform specialist for the later acceptance receipt and fresh private fixtures. Older source-only/not-deployed notes below are historical. No real payments or production changes. +**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** the [supervised handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) now has actual signup, fictional credit return, recipient-accepted same-bib transfer, privacy, expiry, native security and committed/lost-response retry proof. Ask Dave/platform specialist for the complete dated acceptance/cleanup receipt and fresh fake fixtures before using it. The issue remains open until those handoff gates are recorded; production and real payments are **NOT AVAILABLE YET**. Older #731/#732 source-only or anonymous-only notes below are historical. **#731 fictional race screen — SOURCE PREPARED, NOT AVAILABLE YET:** the [planned review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) covers signup, fictional credit return and private recipient-accepted bib transfer. Local screen tests are not hosted proof. Dave/platform specialist must verify staging release, security, real screens and cleanup first; production and real payments remain untouched. diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index cbc26a6..ce71526 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -1,5 +1,7 @@ # MPRC Platform Operations Runbook +**#731 native acceptance/handoff — 2026-10-14:** [current officer procedure](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) separates actual native/UI proof from final acceptance and cleanup gates. Existing v6/669e2fb/101386-byte94380430 archive and Hosting e21be35 remain unchanged; no redeploy is needed for these documentation facts. Actual lost-response retry, current authority/privacy, natural expiry and recipient-loss recovery passed. Two fresh fake accounts/26 exact owned records were removed with identity/create-time/update-time fences and immediate/late absence; private browser helper/Auth/matching staging SDK cache were cleared. The unused receiver closed with zero captures and a refused port. The specialist must record the human's temporary browser-permission OFF confirmation and owned-tab closure before final handoff. No workaround for blocked browser settings; no accounts/server left waiting for that input. Fresh fixtures, final receipt and Dave's supervision are required; production/payments stay untouched. Earlier #731/#732 source/anonymous-only notes below are historical. + **#731 staging deployment checkpoint — 2026-10-13:** existing community service v6 and Hosting `669e2fb` are verified; no additional Function build is needed for this documentation. Signed-in tests/fixture cleanup and qualified officer use remain pending. Follow the [current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared), not old source-only/not-deployed checkpoints below. Preserve exact current/rollback evidence; fixture supply, native tests/cleanup and rollback remain specialist-only. Production/real payments untouched. **#731 member screen — SOURCE PREPARED, NOT AVAILABLE YET:** use the [planned no-terminal review](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) only after the specialist supplies native release/security/UI/cleanup proof and fresh private fixtures. Keep the same fixed staging target and resource limits; no new polling, scheduler or financial provider. Account/permission/config supply, backend-first deployment/readback and fenced cleanup/rollback remain specialist-only. Existing v5/Hosting485be670 are historical deployed proof, not race-screen proof; production and real payments stay untouched. diff --git a/SECURITY.md b/SECURITY.md index 38578e1..c0f3cb7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,7 @@ # MPRC Security, Privacy, and Risk Plan +**#731 native staging security — 2026-10-14:** [native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758) records real verified password Auth and normal App Check: isolated missing/invalid Auth or attestation401, caller substitution403, extra authority/malformed input400, current/expired marker/capability and current native account denials403. Populated status omits other UIDs/contact/waiver/count/capacity. Firebase refuses unsupported tenant sign-in with INVALID_TENANT_ID; no tenant or valid nondefault-tenant token was created. Actual UI response loss after commit, exact retry without writes, terminal-state protection, recipient-loss replay/revoke and revoked-caller replay passed. No debug attestation/custom claims, new permission, Rule allowance, production or money action. Supervised use still requires the complete final cleanup/acceptance receipt and fresh fixtures. Earlier #731/#732 source/anonymous-only notes below are historical. + **#731 staging deployment checkpoint — 2026-10-13:** native v6/archive/resources/owner/MFA/invoker/unchanged profiles and website assets are verified at `669e2fb`. Two requests without Auth and with missing/invalid attestation denied; this does not isolate App Check or qualify signed-in caller/grant/privacy tests. Those and disposable cleanup remain open. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical; no production/payment/IAM authority expansion. **#731 client — SOURCE PREPARED, NOT DEPLOYED:** closed plain-object/array parsing rejects extra fields, accessors, coercions, malformed bounds and mismatched request acknowledgements before display. UI/transport bind the same verified disposable SDK account/app/default tenant; observed session epochs fence even same-UID renewals. No token extraction/logging, direct database access or runner directory. Failed/uncertain reads and known deadlines remove old controls; exact saved retries never cross account/session/provider changes. These local tests use SDK/service doubles, not genuine hosted Auth/App Check proof; server authority, native release and hosted acceptance remain required. diff --git a/STRIPE_COMMERCE_DESIGN.md b/STRIPE_COMMERCE_DESIGN.md index 75a43e9..55e6abd 100644 --- a/STRIPE_COMMERCE_DESIGN.md +++ b/STRIPE_COMMERCE_DESIGN.md @@ -1,5 +1,7 @@ # Stripe, Race Registration, and Merchandise Design +**#731 fictional native acceptance — 2026-10-14:** actual signup, full fictional credit return, same-bib recipient transfer, revoke and original credit ownership passed in staging. Native committed/lost-response retry preserved one seat/receipt/audit, did not resurrect cancellation and could not bypass current authority. [Proof and supervised gate](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). These integer-credit simulations are not provider-backed payment/refund evidence; no real policy, finance authorization, Stripe object or production launch changed. Complete acceptance/cleanup receipt and fresh fake fixtures remain prerequisites; earlier #731/#732 source-only notes below are historical. + **#731 staging deployment checkpoint — 2026-10-13:** Function v6/website `669e2fb` and their archive/public assets are verified. Fictional credits remain disconnected from Stripe and real money; signed-in race/cleanup acceptance is pending. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes are historical. No real policy, provider payment or production launch is approved. **#731 member screen — SOURCE PREPARED, NOT DEPLOYED:** UI labels all amounts and returns fictional credit, never paid/refunded money. It accepts no client price, deadline, finance role or runner profile; transfer keeps the original credit owner. No provider SDK, Checkout, payment/refund object or real rule is added. Hosted staging release/UI/security/cleanup remain open; finance/MFA/provider reconciliation and production gates are unchanged. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 84e2de2..f071771 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -1,5 +1,7 @@ # MPRC Platform System Design +**#731 native staging acceptance — 2026-10-14:** actual lifecycle/privacy/expiry/mobile and 38 native evaluations/27 distinct checks passed, including isolated Auth/App Check/caller/current-authority denials and actual UI committed/lost-response saved retry. Same existing v6/669e2fb archive and Hosting e21be35; no architecture/runtime/Rules/IAM/dependency/provider/production change. Exact owned accounts/records and browser SDK state were cleaned. Use remains gated on the complete dated acceptance/cleanup receipt and fresh fake fixtures; #731 stays open until final handoff gates are recorded. [Current officer handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier #731/#732 source/anonymous-only checkpoints below are historical, not current test status. The full backend/real-payment/public-launch objective remains incomplete. + **#731 staging deployment checkpoint — 2026-10-13:** Function v6 and the staging website use `669e2fb`; exact archive, resource/identity/security settings, unchanged profiles and public assets passed verification. Signed-in race security/lifecycle/cleanup remain unqualified. [Current handoff](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Earlier source-only/not-deployed notes below are historical checkpoints, not current deployment status. Production and real payments remain untouched. **#731 member screen — SOURCE PREPARED, NOT DEPLOYED:** a separate `/community/races` route/link uses the same staging service, exact bounded DTOs and server-supplied entry IDs/revisions. Same Auth/Functions app, verified disposable caller, default tenant and session/provider generation fences prevent late cross-context display/retry. Failed reads hide old controls; saved commands retry exactly; acceptance rereads own status without the consumed offer. Conservative deadline timers clear status without polling. No migration, runtime/Rules/IAM/service/dependency change or money action; genuine native security, backend-first release, actual screens and fenced cleanup remain open. diff --git a/docs/officers/EVENTS_SHOP_MEMBERS.md b/docs/officers/EVENTS_SHOP_MEMBERS.md index 960d397..8b683b2 100644 --- a/docs/officers/EVENTS_SHOP_MEMBERS.md +++ b/docs/officers/EVENTS_SHOP_MEMBERS.md @@ -1,6 +1,6 @@ # Events, Shop, Members, and Money -**#731 latest checkpoint — STAGING DEPLOYED 2026-10-13:** only deployment/archive/public assets and the signed-out page are verified. Signed-in race actions/security/cleanup and qualified officer use remain pending. [Current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). Older source-only/not-deployed notes are historical; do not use legacy refund/substitute controls or real details. +**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** [current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) records actual fictional signup/credit return/same-bib transfer/revoke, privacy, expiry/mobile and native security/committed lost-response retry. Use only fresh fake fixtures after Dave/specialist supplies the complete dated acceptance/cleanup receipt. #731 stays open until final handoff gates are recorded; real refunds, payments, club policy and production remain **NOT AVAILABLE YET**. Older #731/#732 source/anonymous-only notes below are historical; never use legacy controls or real details for these tests. **#731 member screen — SOURCE PREPARED, NOT AVAILABLE YET:** the [planned screen review](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) covers fictional signup, credit return and privately named bib offers/acceptance/revocation. Native staging release/security/screens/cleanup still require the specialist; local service doubles do not prove hosted behavior. No real refund, payment, club policy or production change is available. diff --git a/docs/officers/README.md b/docs/officers/README.md index d0e1400..20f853b 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -1,6 +1,6 @@ # Officer Website Handbook -**#731 latest checkpoint — 2026-10-13:** deployment/archive/public assets are verified in staging, but signed-in race security/screens and disposable cleanup remain open. Use the [current handoff](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared); its planned procedure is NOT AVAILABLE YET. Older source-only/not-deployed notes are historical. Production and real payments stay untouched. +**#731 latest checkpoint — NATIVE STAGING TESTS VERIFIED 2026-10-14:** [supervised fictional race review](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) has actual lifecycle/privacy/expiry/mobile and genuine security/committed-retry proof. A complete dated acceptance/cleanup receipt and fresh specialist-supplied fake fixtures are required before use. #731 stays open until the final handoff gates are recorded; production and real payments remain **NOT AVAILABLE YET**. Older #731/#732 source/anonymous-only notes below are historical. [#731's fictional race screen](./STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared) is source prepared, **NOT AVAILABLE YET**. A separate dated native release/security/screen/cleanup receipt is required before the planned review. No real payment, policy or production change is supplied. diff --git a/docs/officers/STAGING_COMMUNITY.md b/docs/officers/STAGING_COMMUNITY.md index 176b42e..9c73087 100644 --- a/docs/officers/STAGING_COMMUNITY.md +++ b/docs/officers/STAGING_COMMUNITY.md @@ -29,13 +29,17 @@ ## Fictional race member screen — #731 source prepared -**Status:** STAGING DEPLOYED 2026-10-13; signed-in acceptance remains open, so the planned officer flow is **NOT AVAILABLE YET**. Function v6 and the website use `669e2fb` after PR734's exact six PR/main jobs and every step passed. Fixed release and independent read-only verification both passed: downloaded 101,386-byte archive SHA-256 `94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87`; existing owner/MFA, six runtime permissions/zero user keys, min0/max2/256MB/30s, invoker bindings and profiles2/1/2843388 are verified. Hosting followed the backend; marker, actual HTML and main JavaScript bytes match. No second Function build is needed for these documentation-only changes. +**Status:** NATIVE STAGING TESTS VERIFIED 2026-10-14. The heading is retained for existing links. This is a supervised fictional test, not club launch. Use it only after Dave/platform specialist supplies the complete dated acceptance and cleanup receipt plus fresh fake fixtures. #731 remains open until its final handoff gates are recorded; production and real payments are **NOT AVAILABLE YET**. -**Actual screen proof so far:** signed-out Chrome shows fictional credits/no real money, sign-in and no mutation buttons. At 390×844 there is no horizontal overflow; viewport restored. Two requests without Auth and with missing/invalid attestation deny, which does not isolate App Check or prove signed-in identity/capability/privacy. Local 78 race tests and CI frontend1,463 pass with doubles; genuine signed-in lifecycle/security/mobile/cleanup remain #731's required gates. No disposable account/record/permission, receiver or network grant was created in this release slice. Synthetic diagnostic output was cleaned; current/rollback evidence retained. See the [dated native receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731). Earlier source-only/not-deployed paragraphs describe historical review milestones. +**Release proof:** communityActions v6 uses reviewed source `669e2fb`; the staging website uses `e21be35` after PR735's selected-offer recovery correction. Their exact PR/main six-job checks passed before release. The downloaded 101,386-byte archive SHA-256 is `94380430f7fb3bbbb1ddbf6ee8fa2a87cd9510d54810fda71ddd010a8da3fc87`; owner/MFA, six runtime permissions/zero user keys, min0/max2/256MB/30s, invoker bindings and unchanged profiles2/1/2843388 passed refreshed read-only verification. Backend release preceded Hosting. Marker, actual HTML and JavaScript were verified separately. This documentation change does not rebuild or deploy either surface. -**Purpose:** review the intended test flow without mistaking fictional credit for money. **Approver/escalation:** Dave, sole staging owner; no backup is appointed. **Prerequisites:** Dave/platform specialist must first supply dated native security, exact backend-first Function/Hosting release, disposable screen and fenced cleanup evidence. Fresh verified disposable accounts, expiring permissions and private test IDs are separate prerequisites. Until then, do not try these steps on a website. +**Actual proof:** [earlier website receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6181945856) covers signup, exact fictional credit return, same-bib recipient acceptance, owner revoke, own-vs-other privacy, failed focus/clearing, natural expiry and signed-in 390×844 layout without overflow. [Native acceptance receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/731#issuecomment-6186206758) records 38 evaluations/27 distinct checks: real Auth/App Check denials, caller binding, current/expired authority, current native account metadata, closed private responses, actual UI response discarded after server commit and exact saved retry, terminal-state protection and recipient-loss replay/revoke. Unsupported tenant sign-in was refused by Firebase without issuing a token; no tenant was created or fake claims used. Read-only acknowledgement did not add another seat/receipt/audit or change protected update times. These are separate from historical source/mock/emulator evidence. -Planned supervised screen review — **NOT AVAILABLE YET**: +**Cleanup boundary:** the earlier screen slice removed two accounts/48 owned records. The final native slice removed two fresh accounts/26 records with identity/create-time and native update-time fences; immediate/late absence included implicit profiles. The unused local receiver closed with zero token captures and a refused port. Tests completed entirely inside Chrome instead; private helper state, Auth session and the exact matching staging SDK cache were cleared, with normal sign-out visible. No raw token/password was written to evidence. The specialist's final receipt must also confirm that any temporary browser local-access permission is Block and the owned tab is closed. Do not infer that browser cleanup from server deletion or green CI. + +**Purpose:** review the verified fictional flow without mistaking credit for money. **Approver/escalation:** Dave, sole staging owner; no backup is appointed. **Prerequisites:** ask the specialist for the final dated acceptance/cleanup receipt, current reviewed source and fresh verified disposable accounts, expiring permissions, fictional events and private test IDs. The specialist handles setup; no officer uses a terminal or edits records. Do not reuse deleted fixtures or proceed with an incomplete receipt. + +Supervised screen review — staging and fictional data only: 1. Open only the supplied staging `/community/races` link. 2. Confirm **Staging test only** and fictional credit, not money. @@ -56,9 +60,9 @@ Planned supervised screen review — **NOT AVAILABLE YET**: 17. If a named offer is unavailable, select **Show only my entries**, not another guessed ID. 18. Sign out and ask for the exact disposable cleanup receipt. -**Expected result:** only your own entry or an exactly named offer to you is shown. Transfer preserves the bib and original credit owner; it creates no second place. One enrollment ever and one transfer are test limits, not club policy. Old controls disappear after a failed read or known deadline. Refresh retains the selected private offer ID after a failed lookup, never returning to the previous offer; this small #735 correction needs its own reviewed source/Hosting proof. An exact saved action may be retried only within the same account/session; fresh successful status restores controls. No polling, email, directory, card or provider payment is added. +**Expected result:** only your own entry or an exactly named offer to you is shown. Transfer preserves the bib and original credit owner; it creates no second place. One enrollment ever and one transfer are test limits, not club policy. Old controls disappear after a failed read or known deadline. Refresh retains the selected private offer ID after a failed lookup, never returning to the previous offer. An exact saved action may be retried only within the same account/session; fresh successful status restores controls. Even after a later cancellation, an old acknowledgement cannot restore an entry. No polling, email, directory, card or provider payment is added. -**Stop:** production, real person/payment information, missing permission, uncertain private ID, stale controls, real-money claims, or requests for secrets/record edits. **Success proof:** #731 must separately record source/full checks, merge, native Auth/App Check/security/archive/resource/unchanged profiles, Hosting marker, actual failure/retry/expiry/privacy/mobile screens, and fenced cleanup. This source review was read as an officer without a terminal; hosted steps are not qualified yet. **Undo:** sign out; Dave/specialist handles reviewed staging rollback or fixture cleanup. Setup, provider verification, permission revocation, cleanup and rollback remain specialist-only. Never post passwords, tokens, codes or member records to an issue or AI tool. +**Stop:** incomplete acceptance/cleanup receipt, production, real person/payment information, missing permission, uncertain private ID, stale controls, real-money claims, or requests for secrets/record edits. **Success proof:** request #731's separate source/full-check/merge, native release/security, Hosting, actual screen and cleanup evidence. A backup-officer review needs only these written steps and the specialist's receipt, never console code, credentials or record access. **Undo:** sign out; Dave/specialist handles reviewed staging rollback or exact fixture cleanup. Setup, provider verification, test tooling, browser-permission cleanup and rollback remain specialist-only. If browser tooling cannot change a permission, the human changes it directly; do not bypass that restriction. Never post passwords, tokens, codes or member records to an issue or AI tool. ## Fictional race boundary — #732 source only diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index 820cb5a..3944008 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -2,9 +2,9 @@ These diagrams show where pages, information, and deployments go. Each diagram includes a one-sentence text version. -## Fictional race member screen — #731 staging deployed, acceptance pending +## Fictional race member screen — #731 native staging tests verified -**2026-10-13 checkpoint:** native v6/archive/resources/unchanged profiles and dependent Hosting/public assets `669e2fb` are verified. Anonymous screen/phone-width proof only; signed-in security/lifecycle and cleanup remain open. Older source-only/not-deployed maps below are historical milestones. +**2026-10-14 checkpoint:** native v6/archive/resources/unchanged profiles and Hosting `e21be35` are verified separately. Actual lifecycle/privacy/expiry/mobile and genuine token-boundary/committed lost-response retry/recipient-loss checks passed. Use requires a complete dated acceptance/cleanup receipt and fresh fake fixtures; #731 stays open until final handoff gates are recorded. Production and real payments remain unavailable. Older #731/#732 source/anonymous-only maps below are historical milestones. ```mermaid flowchart LR @@ -15,10 +15,10 @@ flowchart LR Fresh --> Screen Change["Account/session change, failed read or known deadline"] --> Hide["Clear old controls; never reuse another context's action"] Hide --> Screen - Gate["Signed-in hosted UI/security and cleanup still required"] -.-> Screen + Gate["Specialist supplies final acceptance/cleanup receipt and fresh fake fixtures"] -.-> Screen ``` -Text alternative: deployed staging source submits bounded private reads and exact saved commands through the existing server boundary, rereads own status after acceptance, and clears old controls on uncertainty or context changes; deployment is verified, while signed-in hosted behavior and cleanup remain unqualified. +Text alternative: verified staging screens submit bounded private reads and exact saved commands through native server authority and clear stale controls, while supervised use remains gated on the specialist's complete acceptance/cleanup receipt and fresh fake fixtures; production and real payments remain excluded. ## Fictional race boundary — #732 source and demo only