diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index 1a955fd..367875e 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,6 +1,6 @@ # GitHub Issue Backlog: Secure Commerce Program -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index f840c63..6f29acc 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -1,6 +1,6 @@ # MPRC Secure Commerce Implementation Plan -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index a2e81f4..9ef39b7 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -1,6 +1,6 @@ # MPRC Website: Officer Start Here -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target packaging, restricted sandbox keys and backend-first publication checks are prepared for review. Club sign-in, private provider setup and hosted checkout proof remain pending. [Specialist handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index bfd2984..a8233e5 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -1,6 +1,6 @@ # MPRC Platform Operations Runbook -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/SECURITY.md b/SECURITY.md index 8480cb7..130e8f8 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ # MPRC Security, Privacy, and Risk Plan -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/STRIPE_COMMERCE_DESIGN.md b/STRIPE_COMMERCE_DESIGN.md index f40c62f..4fa167f 100644 --- a/STRIPE_COMMERCE_DESIGN.md +++ b/STRIPE_COMMERCE_DESIGN.md @@ -1,6 +1,6 @@ # Stripe, Race Registration, and Merchandise Design -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **#731 fictional native acceptance — 2026-10-14:** actual signup, full fictional credit return, same-bib recipient transfer, revoke and original credit ownership passed in staging. Native committed/lost-response retry preserved one seat/receipt/audit, did not resurrect cancellation and could not bypass current authority. [Proof and supervised gate](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). These integer-credit simulations are not provider-backed payment/refund evidence; no real policy, finance authorization, Stripe object or production launch changed. Complete acceptance/cleanup receipt and fresh fake fixtures remain prerequisites; earlier #731/#732 source-only notes below are historical. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index fa89255..0a15213 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -1,6 +1,6 @@ # MPRC Platform System Design -**Test annual dues — #742, source preparation only:** a separate, default-disabled test checkout now saves one server-priced purchase per fictional account and activates the payer from verified Stripe test state. No manual membership approval follows satisfied checks. No sandbox connection, dues Function/webhook deployment or dues Hosting publication is supplied; real payments and family invitation enrollment remain unavailable. [Officer review](./docs/officers/TEST_DUES.md), [engineering boundary](./docs/TEST_DUES_ENGINEERING.md). **October 17 release preparation:** fixed-target source packaging, pinned test-secret/runtime checks and backend-first Hosting guards are prepared for review. Restricted sandbox keys are supported. Club sign-in/provider setup and actual hosted checkout verification remain pending; no cloud/provider mutation is supplied. [Specialist release handoff](./docs/TEST_DUES_RELEASE.md). +**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/docs/TEST_DUES_ENGINEERING.md b/docs/TEST_DUES_ENGINEERING.md index 977929f..307ba88 100644 --- a/docs/TEST_DUES_ENGINEERING.md +++ b/docs/TEST_DUES_ENGINEERING.md @@ -1,6 +1,6 @@ # Test-only annual dues runtime — #742 -This bounded staging integration consumes `membershipDuesCheckout`, `membershipDuesPayment` and `membershipAuthority`. It is isolated in `duesTestOnly.js`; neither legacy `index.js` nor `communityOnly.js` imports it. No provider connection or deployment is supplied. The separate [October 17 release preparation](./TEST_DUES_RELEASE.md) adds fixed-target source/secret/runtime/Hosting checks for review; actual native setup remains pending. Existing member/event records remain compatible; no migration or roster import. +This bounded staging integration consumes `membershipDuesCheckout`, `membershipDuesPayment` and `membershipAuthority`. It is isolated in `duesTestOnly.js`; neither legacy `index.js` nor `communityOnly.js` imports it. The [October 17 specialist release](./TEST_DUES_RELEASE.md) connected the club sandbox and deployed both isolated Functions plus matching Hosting. The [dated native evidence](./TEST_DUES_HOSTED_EVIDENCE.md) separates verified core behavior from remaining native failure-path qualification. Existing member/event records remain compatible; no migration or roster import. ## Trust and transitions @@ -16,6 +16,6 @@ Server-only collections: `membershipTestOrders`, `membershipTestAccounts`, `memb ## Release still required -A separate reviewed release must package the isolated entrypoint, bind only the test Secret Manager references and club-owned account, qualify minimum runtime/IAM/secret access, webhook subscription and retry/reconciliation operation, prove raw-body signature handling and normal Auth/App Check on the hosted Function, then publish matching test-only Hosting. No secrets belong in tickets/chat/logs. The separate `staging-test-dues-release.js` path packages only this entrypoint and requires existing verified private setup. Ordinary community release scripts do not deploy it; the explicit test-dues Hosting mode requires matching dues backend/archive/authority readback before enabling its flag. Use a fresh fictional marker/account/event and exact-owned cleanup; never reuse #731. Actual sandbox/live evidence, provider changes, real policy approval and production rollout remain separate. +For a future release, the reviewed path must package the isolated entrypoint, bind only the test Secret Manager references and club-owned account, qualify minimum runtime/IAM/secret access, webhook subscription and retry/reconciliation operation, prove raw-body signature handling and normal Auth/App Check on the hosted Function, then publish matching test-only Hosting. No secrets belong in tickets/chat/logs. The separate `staging-test-dues-release.js` path packages only this entrypoint and requires existing verified private setup. Ordinary community release scripts do not deploy it; the explicit test-dues Hosting mode requires matching dues backend/archive/authority readback before enabling its flag. Use a fresh fictional marker/account/event and exact-owned cleanup; never reuse #731. Actual sandbox/live evidence, provider changes, real policy approval and production rollout remain separate. Local tests use transactional doubles and the installed SDK's real signature verifier, with no outside network. Hosted Node22 CI runs `testMembershipDues.emulator.test.js` under native Firestore/Auth emulators and a synthetic provider: it proves native order/activation races and free-event admission, not Stripe API behavior. Frontend tests cover consent, account/session fences, unknown responses, expiry without polling, saved retry/reload and verified test URL navigation. diff --git a/docs/TEST_DUES_HOSTED_EVIDENCE.md b/docs/TEST_DUES_HOSTED_EVIDENCE.md new file mode 100644 index 0000000..d931fe7 --- /dev/null +++ b/docs/TEST_DUES_HOSTED_EVIDENCE.md @@ -0,0 +1,49 @@ +# Test dues hosted evidence — October 17, 2026 + +The club sandbox is connected and the core hosted dues flow works in staging. This is not a real-member or real-payment launch. #742 remains open for the native failure-path checks listed below. + +Officer impact: verified fictional payers can use $25 individual or $30 family test Checkout and activate automatically, then sign up for free events with separate event consent. No officer membership approval follows these checks. + +Officer documentation: `OFFICER_START_HERE.md`, `docs/officers/TEST_DUES.md`, `MEMBER_SCREEN.md`, `README.md`, `SYSTEM_MAPS.md`, the root checkpoints and specialist dues guides now distinguish this core native result from unfinished qualification. + +Deployment evidence: staging website, Firebase and the club sandbox were verified independently. Production and `runmprc.com` were not tested or changed in this run. + +## Source and release + +- Reviewed source `6cf7cbb281f7713e4ce05c84829f6dd2a24c6a20`; merged source `71f59e26753b87f398b243cce5e995a44fcc538b`, identical tree `2a786fad33f5f32b557df279317544f17ef18ea9`. Genuine Opus 5.5 medium full and final-delta reviews approved. [Delegated approval](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/744#issuecomment-6231457515). +- Exact PR CI `39015312687` and merged-main CI `39015563777`: all six jobs and every step succeeded. This documentation follow-up does not redeploy the application. +- `membershipTestDues` and `membershipTestDuesWebhook`: ACTIVE v1, Node 22, 256 MB, 30 seconds, min 0/max 2. Both downloaded native source archives matched SHA256 `c31a22edab34872dd10c3d3a44e12fdccf933dcb5659fb4db9ca99229d6c908b`, 99,003 bytes. +- The dedicated keyless runtime has the reviewed six-permission role and access to only the two pinned staging secrets. Both use enabled version 1. The owner explicitly approved transfer of the existing sandbox key; a restricted key was not provisioned or qualified. No secret value belongs in this receipt. +- Existing community v7 and profile v2/v1 Functions were unchanged. Hosting marker source is `71f59e2`, with matching community and dues bundle hashes. All 62 published files and five deep routes matched local generated bytes. The preexisting 62-file local build was restored by hash; the new generated build was removed. +- The native club account showed a Sandbox banner. One enabled ordinary-account webhook uses API `2023-10-16` and exactly the eight reviewed checkout/reversal events. Both original completion deliveries and one requested resend returned HTTP 200 `received`. The native provider readback showed test mode, paid Sessions, succeeded PaymentIntents and paid, undisputed, unrefunded Charges at the exact USD amounts. + +## Actual core behavior + +| Native check | Observed result | +| --- | --- | +| Normal club-profile browser sign-in and App Check | Fresh fictional verified accounts loaded the server's offers. No debug token, custom-token bypass or headless driver. | +| Individual test Checkout | Exactly 2,500 USD cents; automatic payer activation on return without clicking reconcile. | +| Family test Checkout | Exactly 3,000 USD cents; automatic payer activation and one Family ID. The screen explains that invitations are unavailable and an ID grants no access by itself. | +| Unpaid cancel and resume | Returned to one open purchase with no second offer, then resumed the same Session. Provider listing found exactly one Session per owned order. | +| Free-event eligibility | Unpaid account could not accept the event waiver or sign up. Paid current member accepted the separate synthetic event waiver, obtained a confirmed place, then cancelled through the normal screen; count returned to zero. | +| Duplicate provider delivery | Requested resend of the actual individual completion event received HTTP 200. Both member revisions and term revisions stayed at 1; original term ends remained unchanged. Both durable event receipts read `processed`. | +| Failed status read | Temporary browser offline mode hid the active badge and saved purchase. After restoring normal networking, a successful refresh restored verified status. | +| Email and marker denials | Unverified email showed the verify/sign-in message and no checkout. Verified email without a participant marker failed closed. Expiring the payer markers denied refresh and hid purchase controls. | +| Public HTTP boundaries | Missing/invalid App Check callable requests returned 401; missing/invalid raw-body webhook signatures returned 400. | +| Layout | Actual desktop screen and Chrome's 390×844 responsive viewport were inspected; the long Family ID wrapped and notices remained readable. Network settings and viewport were restored; task network logs cleared. | + +Only Stripe's documented test card details and fictional `example.test` identities were entered. Link saving and Chrome's card-storage prompts were declined. No verification email, live payment, refund, dispute or production data operation was performed. + +## Remaining native qualification — #742 stays open + +The exact source CI supplies unit and emulator coverage for account/realm/cents/currency mismatch, default tenant/caller mismatch, current Auth loss, concurrent preparation, unknown creation/binding outcomes, lost responses, missed-callback reconciliation, delayed old-year payment, async success/failure and reversal holds. This core hosted run does **not** claim independent native provider/browser execution of those cases. In particular, cancel/resume is not proof of a committed lost response, and a successful automatic webhook is not a simulated missed callback. Use fresh uniquely owned fixtures for those remaining scenarios; never recreate this run's deleted accounts or sealed #731 fixtures. + +Card-only Checkout was used. Other asynchronous payment-method UI and restricted-key permission coverage were not qualified. Final waiver/privacy/retention/guardian decisions, family invitation enrollment and live-money/production release remain separate club decisions. + +## Cleanup and recovery + +All four fresh disposable Auth users were signed out, disabled/revoked, deleted and checked absent. Their member, canonical membership, rate-limit, participant and command records were checked absent. The owned cancelled registration and free event were removed; the events manifest was restored exactly. Both paid test orders, their account anchors, term receipts and family record were re-read and retained; audit/event evidence and provider configuration were untouched. This is a dated absence check, not a claim that every staging collection is empty. + +Genuine Opus 5.5 medium reviewed the provider setup, fixture creation and cleanup helpers. It rejected an initial cleanup retry gap before execution; the corrected helper passed six regression/negative checks and received exact-file approval before use. No rejected cleanup ran. Private, bounded receipts are retained by the task owner; no credentials, Checkout URLs or raw payment/customer payloads are in this repository. + +If test operation must stop, Dave stops new test access and uses the reviewed no-dues Hosting mode. Keep endpoint/secret versions and payment evidence until reconciliation is settled. A backup officer follows [Test annual dues](./officers/TEST_DUES.md) and escalates provider, release, fixture and cleanup work to Dave; no terminal, credential or database editing is required of the officer. diff --git a/docs/TEST_DUES_RELEASE.md b/docs/TEST_DUES_RELEASE.md index e950e5b..7e3bb7d 100644 --- a/docs/TEST_DUES_RELEASE.md +++ b/docs/TEST_DUES_RELEASE.md @@ -1,6 +1,6 @@ # Connect and qualify hosted test dues — #742 -**October 17, 2026: release preparation only. NOT DEPLOYED.** Stripe sign-in is waiting for the club owner. Native read-only inspection found only the existing three staging Functions; Secret Manager is disabled. No Stripe account, key, webhook or hosted dues behavior has been qualified. This document is a specialist handoff, not an officer terminal procedure. +**October 17, 2026: connected and deployed in staging at `71f59e2`; core hosted flow verified.** Read the [native evidence, cleanup and remaining qualification](./TEST_DUES_HOSTED_EVIDENCE.md) before repeating any procedure. This is a specialist runbook; completed fixtures must not be recreated. Real payments and production remain unavailable. ## Authority and scope @@ -13,7 +13,7 @@ The new release path ships only `duesTestOnly.js` and its closed dependency list 1. The owner finishes Google/Stripe sign-in and MFA in the club's browser session. Never put passwords, codes or keys in chat, GitHub, logs or screenshots. 2. Identify the club account. Open its dedicated general sandbox and verify the sandbox banner. Stop if account ownership or isolation is uncertain. Stripe recommends a separate sandbox for new integrations because its data and settings are isolated from live mode: [Stripe keys](https://docs.stripe.com/keys), [sandbox management](https://docs.stripe.com/sandboxes/dashboard/manage). 3. Record only the sandbox's nonsecret `acct_…` identifier and its dashboard location in the private release receipt. No account creation, agreement acceptance or broader access is implied by reaching sign-in. The owner performs new credential creation privately; browser security grants require confirmation at action time. -4. Prepare a service-specific restricted sandbox key. The runtime supports `rk_test_` and the existing `sk_test_` format, never live, publishable or organization keys. Prefer the restricted key. The adapter's required operations are `GET /v1/account`, create/retrieve/list Checkout Sessions, retrieve PaymentIntents with expanded latest Charge, and retrieve Charges. Configure the matching minimum Dashboard permissions and qualify each native operation; do not guess success from a permission label. No refund, payout, subscription, webhook-management or general account-write permission is needed by the runtime. See [restricted keys](https://docs.stripe.com/keys/restricted-api-keys). +4. Prefer a service-specific restricted sandbox key for future owner-managed credential replacement. The October 17 connection used the owner-approved existing full-access test key; a restricted-key permission matrix was not natively qualified. The runtime supports `rk_test_` and the existing `sk_test_` format, never live, publishable or organization keys. Prefer the restricted key. The adapter's required operations are `GET /v1/account`, create/retrieve/list Checkout Sessions, retrieve PaymentIntents with expanded latest Charge, and retrieve Charges. Configure the matching minimum Dashboard permissions and qualify each native operation; do not guess success from a permission label. No refund, payout, subscription, webhook-management or general account-write permission is needed by the runtime. See [restricted keys](https://docs.stripe.com/keys/restricted-api-keys). 5. Configure one sandbox-only webhook destination at `https://us-central1-run-mprc-staging.cloudfunctions.net/membershipTestDuesWebhook`. Use API version `2023-10-16`, ordinary account events, and exactly: `checkout.session.completed`, `checkout.session.async_payment_succeeded`, `checkout.session.async_payment_failed`, `checkout.session.expired`, `charge.refunded`, `charge.dispute.created`, `charge.dispute.updated`, `charge.dispute.closed`. Do not subscribe to all events or a live account. Creation can precede deployment; delivery is not qualified until the receiver is live. See [Stripe webhooks](https://docs.stripe.com/webhooks). 6. The owner privately stores the test API key and that endpoint's signing secret in the two staging secrets below. The release scripts inspect metadata only and never fetch secret payloads. A successful signature test using another endpoint's secret is not proof for this endpoint. diff --git a/docs/officers/MEMBER_SCREEN.md b/docs/officers/MEMBER_SCREEN.md index 4054ace..57371c5 100644 --- a/docs/officers/MEMBER_SCREEN.md +++ b/docs/officers/MEMBER_SCREEN.md @@ -2,7 +2,7 @@ **Status, October 16, 2026:** native member behavior is staging-verified from `799565e`: Function v7/archive/settings, all 62 Hosting files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks passed. Fresh fictional fixtures were removed and their absence checked. A full-site visual check found member links inheriting the fixed site header styles. The correction is published at `d08a6a3`; all 62 final file hashes, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed. Use [the final #739 receipt](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739) before reviewing the screen. Production and real payments are **NOT AVAILABLE YET**. Earlier local-only screenshots are historical. -The specialist's native checks used ordinary browser attestation and separately supplied synthetic terms. They do not prove email delivery, online dues, officer MFA, Stripe or production behavior. All permissions and resource limits remain unchanged. +The earlier #739 checks used ordinary browser attestation and separately supplied synthetic terms. The separate [October 17 dues checkpoint](../TEST_DUES_HOSTED_EVIDENCE.md) now proves actual sandbox Checkout, automatic payer activation and free-event admission at Hosting source `71f59e2`; community Function v7 remains unchanged. Email delivery, officer MFA and production behavior are not established by that checkpoint. **Purpose:** check that members understand their status and can safely sign up, cancel or recover after an uncertain request. diff --git a/docs/officers/README.md b/docs/officers/README.md index 3fe60e7..4e795d5 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -1,6 +1,6 @@ # Officer Website Handbook -[Test annual dues](./TEST_DUES.md) is source prepared and **NOT AVAILABLE YET**. The club-owned sandbox and isolated dues release are still required; real payments remain separate. October 17 release checks are source prepared; club Stripe sign-in, private setup and hosted checkout proof are still pending. +[Test annual dues](./TEST_DUES.md) has a connected staging screen and verified core hosted flow as of October 17. Fresh specialist-provided fictional accounts are required; the completed run's accounts were removed. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). Real payments and production remain separate. **October 16 member-screen preparation:** [Review membership and free events](./MEMBER_SCREEN.md). Native staging behavior, final navigation correction and cleanup passed at Hosting `d08a6a3`. No production or payment release. diff --git a/docs/officers/SYSTEM_MAPS.md b/docs/officers/SYSTEM_MAPS.md index 88ee0b7..06e87c3 100644 --- a/docs/officers/SYSTEM_MAPS.md +++ b/docs/officers/SYSTEM_MAPS.md @@ -430,23 +430,23 @@ flowchart TD In words: stop and escalate anything involving privacy, access, money, or secrets; otherwise use one reviewed rollback and check every affected service. -## Test annual dues — #742 source only, NOT AVAILABLE YET +## Test annual dues — core staging flow verified October 17 ```mermaid flowchart LR A[Verified fictional account and current private marker] --> B[Native Auth and App Check test dues boundary] B --> C[Saved order and one account purchase lock] - C --> D[Club Stripe sandbox - not connected] + C --> D[Connected club Stripe sandbox - test only] D --> E[Signed receipt and verified current test payment] E --> F[Atomic term receipt and payer membership] F --> G[Existing current-member free-event gate] F --> H[Private family root - invitations unavailable] ``` -Text alternative: a marked fictional account prepares one saved test purchase; only verified sandbox payment can atomically activate the payer for free events, and family invitations remain separate. Source and emulator proof do not prove provider configuration or deployment. +Text alternative: a marked fictional account prepares one saved test purchase; only verified sandbox payment can atomically activate the payer for free events, and family invitations remain separate. The October 17 native run verified this core flow; the [dated evidence](../TEST_DUES_HOSTED_EVIDENCE.md) lists remaining qualification. -### Planned isolated test-dues release — October 17, NOT DEPLOYED +### Isolated test-dues release — deployed October 17 ```mermaid flowchart LR diff --git a/docs/officers/TEST_DUES.md b/docs/officers/TEST_DUES.md index d101ee4..d593431 100644 --- a/docs/officers/TEST_DUES.md +++ b/docs/officers/TEST_DUES.md @@ -1,6 +1,6 @@ # Review annual dues in test mode -**October 17, 2026: source and release preparation only; NOT AVAILABLE YET.** #742 adds a separate, disabled test-only checkout and payer activation flow. The club's Stripe sandbox has not been identified or connected; club sign-in is waiting for the owner. The [specialist release handoff](../TEST_DUES_RELEASE.md) now describes isolated packaging, minimum access, private key entry and hosted acceptance. This is preparation, not a working review link. No dues Function, webhook, secret access or dues screen is deployed by this change. The existing member/free-event staging release remains qualified by [#739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). +**October 17, 2026: core hosted flow verified in staging.** The [test dues screen](https://run-mprc-staging.web.app/community/dues) is connected to the club sandbox. Actual individual and family test payments activated each payer automatically. One payer then booked and cancelled a free test event. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). All four disposable accounts and the test event were removed. Ask Dave for fresh supervised test access; do not reuse old fixtures. Production and real payments remain **NOT AVAILABLE YET**. **Purpose:** confirm that one fictional purchase activates the payer automatically and allows free-event signup, without a second officer membership approval. @@ -8,9 +8,9 @@ **Prerequisites:** the specialist supplies the exact staging release receipt, a club-owned Stripe sandbox, its matching test webhook, a fresh owner-marked fictional verified account and ordinary App Check. Every test account needs a current private test-participant marker. The specialist verifies all deployed surfaces before supplying a review link. Do not use the sealed #731 fixtures or real information. -## Planned screen review — NOT AVAILABLE YET +## Supervised staging screen review -1. Ask the specialist to connect and qualify the sandbox through the club's private provider setup. +1. Ask Dave for the current release receipt and fresh fictional test access. 2. Open the supplied staging dues link and confirm the test-only notice. 3. Sign in with the supplied fictional account. 4. Read the two server offers: $25 individual or $30 family in test USD. @@ -18,13 +18,13 @@ 6. Read the synthetic waiver and deliberately accept it. 7. Continue to the selected Stripe test checkout. 8. Use only the specialist's provider-approved test instructions. -9. Return to the dues page and choose Check payment status. -10. Wait for verified active test membership. +9. Return to the dues page and read the verified status. +10. If the saved purchase is still open, choose Check payment status. Do not start another purchase. 11. Open Membership and free events and accept the separate event test waiver. 12. Sign up for the named free event and confirm your place. -13. Ask the specialist to demonstrate a lost response, a duplicate request, unpaid checkout, expired term and revoked test access. +13. Ask the specialist which failure checks are covered by the supplied native receipt. Unpaid cancel/resume, duplicate webhook delivery, failed-read recovery and revoked test access passed in the October 17 core run; the evidence page lists remaining native checks. 14. Refresh status or resume the saved checkout after an interrupted session. -15. Sign out and ask the specialist to remove the exact new fixtures. +15. Sign out and ask the specialist to remove the exact disposable accounts and event. Keep test payment evidence for reconciliation. **Expected result:** one saved purchase belongs to the payer. A return URL proves nothing. Only verified test payment for the exact account, amount, currency, order and term can activate the canonical membership used by free events. Original term and consent evidence are retained. The current screen expires within 60 seconds or sooner at a known deadline; it never polls. A family purchase creates one private Family ID and the payer's membership. Invitations and other family-account enrollment are **NOT AVAILABLE YET**; an ID alone grants nothing.