CI-001D3: guard staging profile Functions deployment

[daliu]

Outcome

The repository now has a fail-closed, staging-only wrapper for a future paired deployment of createMemberOnSignUp and ensureMemberProfile. It does not enable billing, enable APIs, deploy a Function, configure App Check, or change any hosted surface.

Closes #674

What changed

• Validate the exact demo default alias, single reviewed Functions codebase, two profile exports, package scripts, and Firebase CLI 15.24.0 lockfile before deployment.
• Require exact run-mprc-staging project/quota context, declared runmprc@gmail.com operator, exact paired Function scope, and an in-memory short-lived token.
• Reject production/cross-project context, broad or partial target sets, extra Function/services, appended arguments, changed exports/scripts, unpinned tooling, service-account material, and ADC/GitHub/gcloud credential-file overrides.
• Run the focused contract in hosted CI and preserve the exact workflow-safety mutation tests.
• Record the current billing gate and unavailable Function/App Check state in engineering and officer continuity documentation.

Verification

• Node 20.19.5 focused contract: 8/8 passed.
• Node 20.19.5 protected source/release suites: 121/121 passed.
• Non-mutating frontend lint: 120 files; existing 113 errors and 6 warnings matched exactly.
• Frontend Jest: 18 suites, 1,346/1,346 passed.
• SPA navigation: 11/11 passed.
• Functions lint passed.
• Functions Jest: 69 suites, 7,569/7,569 passed; 2 emulator-only suites skipped by the standard command.
• Firestore Rules emulator with Java 21: 5 suites, 418/418 passed.
• Diagnostic production build compiled and the staging artifact contract passed.
• Markdown fences balanced; git diff --check passed; added-diff credential-shape scan returned zero.
• Production dependency audit is unchanged by this dependency-free slice: root 4 findings (1 high, 2 moderate, 1 low); Functions 8 moderate.

Security review

• Authorization boundary: staging project/account/quota are exact and the default alias remains demo-mprc-local.
• Deploy boundary: only both named profile Functions together; no broad Functions, Firestore, Auth, Hosting, Storage, Stripe, email, Strava, or production target.
• Credential boundary: no credential is committed; preflight requires the short-lived token path and rejects credential files.
• Data/PII: no user, record, provider call, email, SMS, or outside-provider action.
• App Check: still not configured or enforced in staging; documentation keeps this explicit.
• Billing: read-only preflight found billing disabled and zero open billing accounts visible to the club account. No billing action is authorized by this pull request.

Officer impact: Officers gain no new publish action. The source guard reduces the future staging release scope, while billing approval and the hosted backend remain NOT AVAILABLE YET.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md.

Deployment evidence: Source commit 43ffa6c; local checks above. Website unchanged; Firebase Hosting, Auth, Firestore Rules/indexes, Functions, App Check, APIs, IAM, billing, outside providers, production Firebase, and runmprc.com unchanged.

Residual gate

Firebase requires the Blaze plan for Functions. A separate approved issue must create or select a Cloud Billing account, define spending controls, merge exact source, enable only required APIs, deploy/read back both Functions, configure/prove App Check policy, and run disposable staging E2E. This pull request stops before every one of those actions.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	43ffa6c
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8f5b7c59625b0008480a27
😎 Deploy Preview	https://deploy-preview-675--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Self-review — 2026-08-26

Reviewed exact head 43ffa6c after hosted CI run 33015854644 completed successfully.

Findings: none.

• Authorization and target scope fail closed to runmprc@gmail.com, run-mprc-staging, the matching quota project, and both named profile Functions together.
• The wrapper accepts no caller arguments and verifies Firebase CLI 15.24.0 before invoking the exact fixed command.
• Broad Functions, partial Function sets, extra services/endpoints, production, alternate codebases, changed exports/scripts, and credential-file overrides are covered by negative tests.
• No runtime Function, Firestore Rule, frontend behavior, schema, dependency, secret, log payload, user data, or provider state changed.
• Documentation states App Check is not configured, billing is disabled, zero open billing accounts are visible, and no hosted Function exists.
• No production fallback exists; the default Firebase alias remains demo-mprc-local.
• Hosted CI: all five required jobs passed. Netlify preview/header/redirect checks passed; Pages-change check was neutral as expected.

Officer impact: no officer action is enabled.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md.

Deployment evidence: source/tests only. Website, Firebase, billing, IAM, APIs, outside providers, production, and runmprc.com unchanged.

Residual risk: deploying Functions still requires separately approved billing/spending controls, provider API setup, exact readback, App Check policy, and disposable staging E2E.