CI-001D4: record staging App Check enforcement evidence

[daliu]

Closes #676.

Outcome

Records the completed no-billing staging App Check boundary. Authentication and Firestore now enforce App Check with replay protection off. Tokenless synthetic requests were denied after propagation, the genuine browser path continued to work, and cleanup returned the isolated staging project to zero users and zero Firestore root collections.

This documentation-only completion change does not mutate Firebase, Hosting, billing, IAM, Functions, production, DNS, Netlify, GitHub Pages, or data.

Evidence

• Source guard: PR CI-001D4: guard staging App Check Hosting deploy #677 merged as exact source bce911a7083201cfe2141edaa9660f210287bf57; all five jobs passed in exact-main CI run 33018136439.
• Provider: one score-based key restricted to the two staging hosts; one matching staging web-app registration; one-hour token lifetime.
• Website: exact source remains staging Hosting version 8556fc51210bdc66; root and direct Events checks passed, the empty state rendered, and browser warnings/errors were absent.
• Enforcement: Authentication and Firestore read ENFORCED; replay protection reads OFF; tokenless Auth and Firestore probes returned HTTP 401 and 403.
• Browser: one reserved-domain disposable identity passed create, sign-out, fresh sign-in, post-enforcement sign-in, and signed-in/signed-out token-bearing empty Events reads.
• Cleanup: the disposable identity was deleted; final Auth users and Firestore root collections are zero.
• Remaining boundary: billing is disabled; no Functions-related API or Function exists; the account profile fails closed while profile Functions are absent.
• Production: production Firebase Hosting, runmprc.com, Netlify, DNS, GitHub Pages, and production data are unchanged.

No token, credential, site key, key/provider locator, provider response body, disposable email, local user identifier, or production data is included.

Verification

• Node 20 focused staging contract suite: 34/34 passed.
• Documentation diff check, fence balance, officer-link anchor, stale-state scan, and sensitive-value review passed.
• Manual review found no authorization expansion, App Check overclaim, billing/Functions mutation, PII, secret, production fallback, or impossible state transition.

Officer impact: Backup officers can verify that staging Authentication and Firestore enforce App Check, while clearly seeing that Functions and a usable member backend remain unavailable. Officers do not sign in, run commands, configure providers, attach billing, or handle credentials.

Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/PUBLISH_AND_CHECK.md, and docs/officers/SYSTEM_MAPS.md; current root state also updated in README.md, SYSTEM_DESIGN.md, SECURITY.md, IMPLEMENTATION_PLAN.md, OPERATIONS_RUNBOOK.md, and GITHUB_ISSUES.md.

Deployment evidence: Website — exact source bce911a7083201cfe2141edaa9660f210287bf57 remains staging Hosting version 8556fc51210bdc66, with browser/UI checks passed. Firebase — Auth and Firestore are ENFORCED/replay-OFF, tokenless denial and token-bearing browser behavior passed, and cleanup returned users/root collections to zero. Provider — one restricted score key and matching one-hour web-app registration remain configured. Functions/billing — absent/disabled. Production — unchanged.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	98a980d
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8faf2c4b7ff400083e2931
😎 Deploy Preview	https://deploy-preview-679--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Self-review of exact head 98a980d found no findings. The change is documentation-only; it preserves the distinction between App Check attestation and authorization, records zero-count cleanup and fail-closed Functions behavior, discloses no credential/key/user value, and makes no billing, IAM, provider, Hosting, production, or data mutation.