CI-001D1: provision empty staging Firestore boundary

[daliu]

Outcome

Provisioned the empty staging Firestore boundary and recorded its verified state. The (default) database in club-owned run-mprc-staging is Firestore Native, Standard edition, us-west2, delete-protected, PITR disabled, and still contains zero root collections. Only exact Rules and indexes from source ee16bd16220ab58bd3a2add80dd2f39a1d514dd7 were deployed.

Closes #669.

Provider change

• Enabled firestore.googleapis.com only in run-mprc-staging.
• Created only (default) with the reviewed irreversible location and protection settings.
• Deployed only firestore:rules,firestore:indexes with Node 20 and lockfile Firebase CLI 15.24.0.
• Active Rules SHA-256 exactly matches fe3f53302db76df5febf7e9d242d82a6b6bec0c0b574ecc8253f1034f1a77dba.
• All 4 composite indexes and all 17 explicit single-field index entries are READY; provider definitions exactly match the 4 composites and 28 field overrides in source.
• No application document, Auth provider/test user, Function, App Check setting, Storage data, outside provider, Hosting release, production Firebase surface, or website release was created or changed.

Verification

• npm run test:rules — 5 suites, 418/418 tests passed under Node 20.19.5, Java 21.0.12, Firebase CLI 15.24.0.
• npm run test:firebase-hosting — 7/7 passed.
• npm run test:staging-authority — 6/6 passed.
• Provider readback — exact database configuration; active one-file Rules release with zero compile issues; exact Rules digest; exact composite and field-override definitions; every index READY.
• Anonymous web-API reads of fixed nonexistent mail, stripeEvents, and auditEvents documents each returned 403.
• Final listCollectionIds readback returned zero collections and no pagination token.
• Deployed direct /events UI rendered the normal empty state with no browser error. The only console warning was the already-documented disabled App Check boundary.
• Staging Hosting remains unchanged at version 3ffadcf2ac8cc760.
• git diff --check passed.

Safety review

• Every cloud command named run-mprc-staging and the club account explicitly.
• No production document was inspected, copied, or migrated.
• No broad Firebase deploy was run.
• A local Firebase CLI diagnostic emitted token-bearing account objects. Both affected OAuth grants were immediately revoked. The deploy then used a freshly verified short-lived runmprc@gmail.com access token; no token value appears in source, this pull request, or issue evidence.
• Database location is permanent by design; delete protection is enabled. PITR remains off because billing is not approved.
• Roll forward only: if Rules or indexes differ, stop use and deploy one reviewed known-good source. Do not delete the database or edit Rules ad hoc.

Officer impact: Staging now has a protected empty database boundary. Officers still do not sign in, enter data, run commands, edit Firebase, or use staging as an application backend.

Officer documentation: OFFICER_START_HERE.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/README.md; engineering truth is updated in SYSTEM_DESIGN.md, SECURITY.md, IMPLEMENTATION_PLAN.md, OPERATIONS_RUNBOOK.md, README.md, and GITHUB_ISSUES.md.

Deployment evidence: Website — staging Hosting version 3ffadcf2ac8cc760 unchanged and direct /events empty UI verified. Firebase — empty delete-protected staging database, exact active Rules digest, exact index definitions, all indexes READY, three anonymous denials, and zero root collections verified. Provider surfaces — only the staging Firestore API/database/Rules/indexes changed; Auth, Functions, App Check, Storage, outside providers, production Firebase, Netlify, GitHub Pages, DNS, and runmprc.com were unchanged.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	07b2296
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8f483424f1460008ce8b37
😎 Deploy Preview	https://deploy-preview-670--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Independent second-pass review completed against head 07b229644b40467556940da59274021b676bea84 and exact base ee16bd16220ab58bd3a2add80dd2f39a1d514dd7.

No blocking findings.

• Scope is exactly nine documentation files; Rules, indexes, Firebase configuration, workflows, application code, dependencies, and generated artifacts are unchanged.
• Added credential-shape scan found zero Google access-token, refresh-token, JWT, API-key, private-key, or bearer-token value patterns.
• Markdown fences are balanced, the new officer procedure contains purpose, approver, prerequisites, steps, expected result, stop conditions, success proof, undo, and escalation, and both permission/data diagrams have text alternatives.
• Fresh provider comparison still shows the exact active Rules digest, 4/4 composite indexes READY with matching definitions, 28/28 matching field overrides with all 17 explicit index entries READY, three fixed anonymous denials, and zero root collections.
• Staging Hosting remains version 3ffadcf2ac8cc760; direct /events renders the expected empty state without a browser error.
• Hosted CI run 33009052983 passed all five required jobs for this exact head. Netlify preview/header/redirect checks also completed without a failure.
• Residual boundary is explicit: no Auth test setup, Functions, App Check, provider sandbox, reusable Firebase deploy role, signed-in staging flow, website release, or production change is claimed.

GitHub does not accept approval from the pull request author, so this comment records the user-requested self-review evidence before merge.