diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md index 367875e..33ad37f 100644 --- a/GITHUB_ISSUES.md +++ b/GITHUB_ISSUES.md @@ -1,6 +1,6 @@ # GitHub Issue Backlog: Secure Commerce Program -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/IMPLEMENTATION_PLAN.md b/IMPLEMENTATION_PLAN.md index 6f29acc..9ef0ecb 100644 --- a/IMPLEMENTATION_PLAN.md +++ b/IMPLEMENTATION_PLAN.md @@ -1,6 +1,6 @@ # MPRC Secure Commerce Implementation Plan -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/OFFICER_START_HERE.md b/OFFICER_START_HERE.md index 9ef39b7..cf405ba 100644 --- a/OFFICER_START_HERE.md +++ b/OFFICER_START_HERE.md @@ -1,6 +1,6 @@ # MPRC Website: Officer Start Here -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md index a8233e5..427809e 100644 --- a/OPERATIONS_RUNBOOK.md +++ b/OPERATIONS_RUNBOOK.md @@ -1,6 +1,6 @@ # MPRC Platform Operations Runbook -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/SECURITY.md b/SECURITY.md index 130e8f8..bc73351 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,6 +1,6 @@ # MPRC Security, Privacy, and Risk Plan -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/STRIPE_COMMERCE_DESIGN.md b/STRIPE_COMMERCE_DESIGN.md index 4fa167f..e153bce 100644 --- a/STRIPE_COMMERCE_DESIGN.md +++ b/STRIPE_COMMERCE_DESIGN.md @@ -1,6 +1,6 @@ # Stripe, Race Registration, and Merchandise Design -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **#731 fictional native acceptance — 2026-10-14:** actual signup, full fictional credit return, same-bib recipient transfer, revoke and original credit ownership passed in staging. Native committed/lost-response retry preserved one seat/receipt/audit, did not resurrect cancellation and could not bypass current authority. [Proof and supervised gate](./docs/officers/STAGING_COMMUNITY.md#fictional-race-member-screen--731-source-prepared). These integer-credit simulations are not provider-backed payment/refund evidence; no real policy, finance authorization, Stripe object or production launch changed. Complete acceptance/cleanup receipt and fresh fake fixtures remain prerequisites; earlier #731/#732 source-only notes below are historical. diff --git a/SYSTEM_DESIGN.md b/SYSTEM_DESIGN.md index 0a15213..8c9fa2f 100644 --- a/SYSTEM_DESIGN.md +++ b/SYSTEM_DESIGN.md @@ -1,6 +1,6 @@ # MPRC Platform System Design -**Test annual dues — October 17, 2026, core hosted flow verified in staging:** the club sandbox, two isolated dues Functions and matching test screen are connected at `71f59e2`. Actual $25 individual/$30 family test Checkout activated each payer automatically; unpaid cancel/resume, duplicate webhook delivery, free-event admission, phone layout, failed-read recovery and access denials passed. Disposable accounts/event were removed; payment evidence was retained. [Dated evidence and remaining qualification](./docs/TEST_DUES_HOSTED_EVIDENCE.md), [officer review](./docs/officers/TEST_DUES.md). #742 remains open for the explicitly listed native failure-path checks. Real payments, production membership, family invitation enrollment and final club policies remain unavailable. Earlier checkpoints below are historical. +**Test annual dues — October 17, 2026, core and bounded native recovery verified in staging:** the club sandbox and test screen remain at application source `71f59e2`. In addition to the [core hosted checks](./docs/TEST_DUES_HOSTED_EVIDENCE.md), fresh native caller/Auth, concurrency, lost-response, missed-callback, mismatch, refund/hold, old-year and failed-card/expiration checks passed within the [dated qualification limits](./docs/TEST_DUES_NATIVE_RECOVERY.md). Eight new fictional accounts were removed; payment evidence was retained and the test webhook restored. [Officer review](./docs/officers/TEST_DUES.md). Real payments, production membership, family invitations and final club policies remain unavailable. Earlier checkpoints below are historical. **Member-screen staging checkpoint — #739, October 16, 2026:** Function v7 and Hosting source `799565e` are verified, including the downloaded archive, all 62 website files, genuine Auth/App Check and ten member/retry/expiry/cancellation checks with fresh fictional fixtures and verified cleanup. Full-site screenshots exposed a fixed-header style collision on the member navigation. The navigation correction is now published at `d08a6a3`; all 62 final assets, four deep routes, genuine sign-in, desktop/390px navigation/focus and fresh cleanup passed in [closed #739](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/739). Function v7 remains unchanged. Online dues and real membership/payments remain unavailable. [Officer review](./docs/officers/MEMBER_SCREEN.md). diff --git a/docs/TEST_DUES_ENGINEERING.md b/docs/TEST_DUES_ENGINEERING.md index 307ba88..77bc843 100644 --- a/docs/TEST_DUES_ENGINEERING.md +++ b/docs/TEST_DUES_ENGINEERING.md @@ -1,6 +1,6 @@ # Test-only annual dues runtime — #742 -This bounded staging integration consumes `membershipDuesCheckout`, `membershipDuesPayment` and `membershipAuthority`. It is isolated in `duesTestOnly.js`; neither legacy `index.js` nor `communityOnly.js` imports it. The [October 17 specialist release](./TEST_DUES_RELEASE.md) connected the club sandbox and deployed both isolated Functions plus matching Hosting. The [dated native evidence](./TEST_DUES_HOSTED_EVIDENCE.md) separates verified core behavior from remaining native failure-path qualification. Existing member/event records remain compatible; no migration or roster import. +This bounded staging integration consumes `membershipDuesCheckout`, `membershipDuesPayment` and `membershipAuthority`. It is isolated in `duesTestOnly.js`; neither legacy `index.js` nor `communityOnly.js` imports it. The [October 17 specialist release](./TEST_DUES_RELEASE.md) connected the club sandbox and deployed both isolated Functions plus matching Hosting. The [dated native evidence](./TEST_DUES_HOSTED_EVIDENCE.md) and [native failure/recovery follow-up](./TEST_DUES_NATIVE_RECOVERY.md) separate core proof, actual provider failures, injected cases and remaining qualification limits. Existing member/event records remain compatible; no migration or roster import. ## Trust and transitions diff --git a/docs/TEST_DUES_HOSTED_EVIDENCE.md b/docs/TEST_DUES_HOSTED_EVIDENCE.md index d931fe7..b49878a 100644 --- a/docs/TEST_DUES_HOSTED_EVIDENCE.md +++ b/docs/TEST_DUES_HOSTED_EVIDENCE.md @@ -1,6 +1,6 @@ # Test dues hosted evidence — October 17, 2026 -The club sandbox is connected and the core hosted dues flow works in staging. This is not a real-member or real-payment launch. #742 remains open for the native failure-path checks listed below. +The club sandbox is connected and the core hosted dues flow works in staging. This is not a real-member or real-payment launch. A separate [native failure and recovery follow-up](./TEST_DUES_NATIVE_RECOVERY.md) records the later bounded checks and qualification limits. Officer impact: verified fictional payers can use $25 individual or $30 family test Checkout and activate automatically, then sign up for free events with separate event consent. No officer membership approval follows these checks. @@ -34,11 +34,11 @@ Deployment evidence: staging website, Firebase and the club sandbox were verifie Only Stripe's documented test card details and fictional `example.test` identities were entered. Link saving and Chrome's card-storage prompts were declined. No verification email, live payment, refund, dispute or production data operation was performed. -## Remaining native qualification — #742 stays open +## Native follow-up and qualification limits -The exact source CI supplies unit and emulator coverage for account/realm/cents/currency mismatch, default tenant/caller mismatch, current Auth loss, concurrent preparation, unknown creation/binding outcomes, lost responses, missed-callback reconciliation, delayed old-year payment, async success/failure and reversal holds. This core hosted run does **not** claim independent native provider/browser execution of those cases. In particular, cancel/resume is not proof of a committed lost response, and a successful automatic webhook is not a simulated missed callback. Use fresh uniquely owned fixtures for those remaining scenarios; never recreate this run's deleted accounts or sealed #731 fixtures. +This original core run did not execute independent failure-path tests. The later [fresh native failure and recovery batch](./TEST_DUES_NATIVE_RECOVERY.md) did; it distinguishes actual Stripe Events/payments, signed synthetic callbacks, explicit fault/backdate injection and the remaining source/emulator-only claims. Never recreate either completed run or sealed #731 fixtures. -Card-only Checkout was used. Other asynchronous payment-method UI and restricted-key permission coverage were not qualified. Final waiver/privacy/retention/guardian decisions, family invitation enrollment and live-money/production release remain separate club decisions. +Card-only Checkout was used. Issued foreign-tenant credentials, actual asynchronous payment-method UI, full dispute lifecycle and restricted-key permissions were not qualified. Final waiver/privacy/retention/guardian decisions, family enrollment and live-money/production release remain separate club decisions. ## Cleanup and recovery diff --git a/docs/TEST_DUES_NATIVE_RECOVERY.md b/docs/TEST_DUES_NATIVE_RECOVERY.md new file mode 100644 index 0000000..95e7a8c --- /dev/null +++ b/docs/TEST_DUES_NATIVE_RECOVERY.md @@ -0,0 +1,59 @@ +# Test dues native failure and recovery evidence — October 17, 2026 + +The bounded failure and recovery batch passed in the club sandbox and `run-mprc-staging`. Real payments and production remain unavailable. Read this with the preceding [core hosted evidence](./TEST_DUES_HOSTED_EVIDENCE.md); neither receipt is a real-member launch approval. + +Officer impact: interrupted or late test payments retain their original purchase and evidence. Verified payment can recover after a missed callback or restored account. A refund holds membership; expired or failed payments cannot silently create another charge or extend a term. + +Officer documentation: [Test annual dues](./officers/TEST_DUES.md), the officer entrypoint, root checkpoints and specialist dues guides point to this receipt. The backup officer stops a stuck purchase and asks Dave for reconciliation. Provider operations, fixture creation and cleanup remain specialist work. + +Deployment evidence: the website, Firebase and club Stripe sandbox were checked independently. No application, Rules, IAM, secret version or production deployment changed in this batch. The disable/restore lease lasted 70,768 milliseconds; the disabled interval was inside that bound. The endpoint was restored to its original enabled configuration. + +## Source, approval and isolation + +Tests ran from clean main `b8b26ac413485fb5561d6804a908b493bbafa619`, the documentation merge following application source `71f59e26753b87f398b243cce5e995a44fcc538b`. Both already had genuine Opus 5.5 medium approval and exact PR/main six-job, every-step green CI. See the preceding receipt and [PR745](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/745). + +Genuine Opus 5.5 medium approved the exact private fixture/browser helpers, corrected failure/recovery helpers and fenced retirement helper before their external mutations. The operator checked model provenance, zero permission denials and file hashes. Two rejected recovery-helper revisions were not executed. Sixteen focused guard checks passed: eight fixture/identity checks, two atomic-write checks and six cleanup-fence checks. These are helper checks, not a replacement for application CI. + +Only eight new owner-marked fictional `example.test` accounts participated. Ordinary native browser Auth and reCAPTCHA Enterprise App Check were used in RUN (MPRC) Chrome. No debug token, custom token, emulator connection, credential export or real member data was used. The test key and signing secret stayed in process memory through their existing pinned staging Secret Manager versions. No account, permission or secret rotation was performed. Neither the earlier deleted hosted fixtures nor sealed #731 fixtures were recreated. + +## Observed failure and recovery behavior + +| Check | Native result and qualification | +| --- | --- | +| Caller binding | An ordinary authenticated caller naming another owned account received `permission-denied`. | +| Current Auth metadata | Disabling the account or removing verified-email status denied the same cached browser JWT. Restoring native Auth metadata restored access. | +| Default tenant | Native project configuration reported `allowTenants: false`; ordinary sign-in used the default tenant. A forged client `tenant` field received `invalid-argument`. This is not a test with an issued foreign-tenant JWT. | +| Concurrent preparation | Two different request IDs yielded one open order and one `already-exists` rejection. Native provider inventory found one Session for that order. | +| Committed response loss | After a real deployed prepare committed, the browser helper deliberately discarded its result. One retry and two concurrent retries of the saved request returned the same order and single native Session. This was consumer fault injection, not an observed network outage. | +| Unknown provider-create result | A private wrapper made the actual Stripe create call, then deliberately discarded the response before binding it. Native Firestore retained the prepared unbound order. The deployed callable resumed it with the original provider key and bound the same Session. | +| Closed retry horizon | A separate fixture clock was backdated six minutes. The deployed resume rejected the unbound order without a replacement create. Its one native Session was later expired normally. This did not wait six minutes or change the deployed clock. | +| Amount, currency and nonce mismatch | Three actual, unpaid sandbox Sessions differed from the persisted expectation. Test-secret-signed synthetic completion envelopes reached the deployed webhook; each returned 503 and retained a `pending` receipt, with no paid term or membership. All three Sessions were expired while the endpoint was paused. | +| Account and realm mismatch | Signed synthetic envelopes with a foreign account, live Event flag or live object flag returned 400 with no event receipt. No live Stripe object or live key was used. | +| Async and out-of-order envelopes | Signed synthetic async-success, async-failure, expiration and completion envelopes used real current Stripe Session state. Unpaid stayed unpaid; paid stayed active; replay after the real refund stayed held. Each accepted envelope returned 200 and its receipt read `processed`. These are native handler/provider-read checks, not real asynchronous payment-method transactions. | +| Missed callback | The exact isolated test endpoint was paused after excluding foreign participants/open Sessions. A genuine $25 hosted payment returned to an open purchase with no active membership shown and no completion receipt. Normal **Check payment status** retrieved provider truth and activated the payer at member/term revision 1. No Stripe event was fabricated by reconciliation. | +| Refund and retry | A full refund of that exact owned sandbox payment succeeded. Repeating the saved provider key returned the same refund. The real `charge.refunded` Event read `processed`; the order became `held`, and the matching membership became suspended at revision 2. Late synthetic completion/async callbacks did not remove that hold or change the term end. | +| Account loss during payment | A saved Checkout was paid while its fictional account was disabled. The real completion Event processed, retaining payment and term evidence as `paid_pending_activation` without canonical membership. After account restoration, normal sign-in and **Check payment status** activated the same purchase at revision 1. | +| Old-year payment | A privileged fixture used a backdated 2025 order and an explicitly adjusted current hosted Session lifetime. A genuine current sandbox payment and real completion Event retained `paid_pending_activation` for the original December 31, 2025 term, without membership or a 2026 extension. Reconciliation preserved that result. This is injected old-year state, not historical time passage. | +| Declined card | Stripe's documented insufficient-funds test card produced the native hosted decline. Its PaymentIntent remained `requires_payment_method`, received zero, and granted no membership. Link/browser card saving was declined. | +| Expiration recovery | Real expiration Events processed for four normal owned unpaid Sessions. Purchases without a PaymentIntent became expired. The failed-card Session, which retained a PaymentIntent, stayed conservatively locked and inactive. Resume did not reopen checkout or offer another purchase; specialist reconciliation is still required. | +| Restore and inventory | The original eight-event/API-version endpoint was re-enabled after 71 seconds. Reviewed restore mode subsequently verified it was already restored, without another pause. Final native inventory found ten owned Sessions: three complete and seven expired; one per normal order and three deliberate mismatch Sessions. No foreign Session was created during the batch. All eleven matching real Events had zero pending webhooks. | + +The original missed-callback completion Event was created while the endpoint was disabled and remained without a delivery receipt. Three mismatch expiration Events were also generated while disabled. Zero pending webhooks does not mean these Events were delivered or processed. The later real refund and the normal expiration Events were delivered and processed after restoration. + +## Cleanup, recovery and evidence ownership + +Both temporary staging tabs were signed out and closed. The named browser SDK app was released before closing its tab. Markers were stopped, and all eight exact fictional Auth identities were disabled and revoked before deletion. Twenty-six disposable records were deleted with identity/data/update-time fences. Final native reads confirmed all eight identities and all 32 allowed disposable paths absent. Thirty-three order, account-anchor, term and audit records matched their pre-cleanup hashes. Webhook/event evidence was retained, including the three intentional pending mismatch receipts. No financial record was deleted to conceal an unresolved state. + +The native release verifier then downloaded both ACTIVE v1 Function archives again: each was 99,003 bytes with SHA256 `c31a22edab34872dd10c3d3a44e12fdccf933dcb5659fb4db9ca99229d6c908b`. The public source marker remained `71f59e2`; runtime, secret references, keyless authority and existing community/profile targets matched the earlier verified release. No new build or deployment was required, and the preexisting local build was untouched. + +Dave retains the bounded private run manifest, exact-file approvals, selected browser/provider receipts and cleanup fences. They are historical evidence, not reusable test access. Two transient UI diagnostic outputs included test Checkout URLs. The one affected saved AX receipt was scrubbed; both Sessions are now complete/expired. A final scan of saved JSON/text receipts found no actual Checkout URL or secret. No credential, Checkout URL or raw payment/customer payload is included in this repository. + +For a future supervised run, Dave supplies new uniquely owned fixtures and a newly reviewed plan. Do not recreate deleted identities or replay this run's financial intent keys. If a purchase is held, expired with a PaymentIntent, or has an unknown outcome outside the original retry window, keep its evidence and stop for specialist reconciliation. Do not issue another charge, edit financial records or infer a refund policy. The private one-time pause harness is not an officer procedure; its interrupted/late recovery requires Dave and the original provider intent evidence. + +## Qualification limits + +This qualifies the tested card-only staging flow and the specifically labelled native failure boundaries. It does not qualify an issued foreign-tenant JWT, an actual asynchronous payment-method UI or full dispute lifecycle, restricted-key permissions, a real calendar rollover, real distributed outages or atomic Auth/Firestore revocation. The existing unit/emulator suites cover further withdrawal, suspension, revision-conflict and failed-write transitions; those are not claimed as new native tests here. + +The failed-card expiry screen still describes the saved purchase as open and cannot reopen its expired Session. This is a safe lock, not a complete self-service recovery experience. The officer guide requires stopping and escalating it. Do not describe it as automatic failed-payment recovery. + +Family invitations/other-account enrollment, approved waiver/privacy/retention/guardian wording, live payment exception policies and production/live-money approval remain separate. The connected test flow is not the completed real-member launch. diff --git a/docs/TEST_DUES_RELEASE.md b/docs/TEST_DUES_RELEASE.md index 7e3bb7d..c4a0f2f 100644 --- a/docs/TEST_DUES_RELEASE.md +++ b/docs/TEST_DUES_RELEASE.md @@ -1,6 +1,6 @@ # Connect and qualify hosted test dues — #742 -**October 17, 2026: connected and deployed in staging at `71f59e2`; core hosted flow verified.** Read the [native evidence, cleanup and remaining qualification](./TEST_DUES_HOSTED_EVIDENCE.md) before repeating any procedure. This is a specialist runbook; completed fixtures must not be recreated. Real payments and production remain unavailable. +**October 17, 2026: connected and deployed in staging at `71f59e2`; core hosted flow and bounded failure/recovery checks verified.** Read the [native evidence, cleanup and remaining qualification](./TEST_DUES_HOSTED_EVIDENCE.md) before repeating any procedure. Read the [later native failure/recovery receipt and limits](./TEST_DUES_NATIVE_RECOVERY.md). This is a specialist runbook; completed fixtures must not be recreated. Real payments and production remain unavailable. ## Authority and scope diff --git a/docs/officers/README.md b/docs/officers/README.md index 4e795d5..1ca806f 100644 --- a/docs/officers/README.md +++ b/docs/officers/README.md @@ -1,6 +1,6 @@ # Officer Website Handbook -[Test annual dues](./TEST_DUES.md) has a connected staging screen and verified core hosted flow as of October 17. Fresh specialist-provided fictional accounts are required; the completed run's accounts were removed. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). Real payments and production remain separate. +[Test annual dues](./TEST_DUES.md) has a connected staging screen and verified core hosted flow and [bounded native recovery checks](../TEST_DUES_NATIVE_RECOVERY.md) as of October 17. Fresh specialist-provided fictional accounts are required; the completed run's accounts were removed. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). Real payments and production remain separate. **October 16 member-screen preparation:** [Review membership and free events](./MEMBER_SCREEN.md). Native staging behavior, final navigation correction and cleanup passed at Hosting `d08a6a3`. No production or payment release. diff --git a/docs/officers/TEST_DUES.md b/docs/officers/TEST_DUES.md index d593431..09d751a 100644 --- a/docs/officers/TEST_DUES.md +++ b/docs/officers/TEST_DUES.md @@ -1,6 +1,6 @@ # Review annual dues in test mode -**October 17, 2026: core hosted flow verified in staging.** The [test dues screen](https://run-mprc-staging.web.app/community/dues) is connected to the club sandbox. Actual individual and family test payments activated each payer automatically. One payer then booked and cancelled a free test event. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). All four disposable accounts and the test event were removed. Ask Dave for fresh supervised test access; do not reuse old fixtures. Production and real payments remain **NOT AVAILABLE YET**. +**October 17, 2026: core hosted flow and bounded recovery checks verified in staging.** The [test dues screen](https://run-mprc-staging.web.app/community/dues) is connected to the club sandbox. Actual individual and family test payments activated each payer automatically. One payer then booked and cancelled a free test event. Read the [dated evidence and remaining qualification](../TEST_DUES_HOSTED_EVIDENCE.md). The four core accounts/event and eight later failure-test accounts were removed; payment evidence was retained. The [failure/recovery receipt](../TEST_DUES_NATIVE_RECOVERY.md) records the restored webhook, actual refund hold, late-payment guards and qualification limits. Ask Dave for fresh supervised test access; do not reuse old fixtures. Production and real payments remain **NOT AVAILABLE YET**. **Purpose:** confirm that one fictional purchase activates the payer automatically and allows free-event signup, without a second officer membership approval. @@ -22,15 +22,15 @@ 10. If the saved purchase is still open, choose Check payment status. Do not start another purchase. 11. Open Membership and free events and accept the separate event test waiver. 12. Sign up for the named free event and confirm your place. -13. Ask the specialist which failure checks are covered by the supplied native receipt. Unpaid cancel/resume, duplicate webhook delivery, failed-read recovery and revoked test access passed in the October 17 core run; the evidence page lists remaining native checks. -14. Refresh status or resume the saved checkout after an interrupted session. +13. Ask the specialist which failure checks are covered by the supplied native receipt. The dated receipts distinguish the core screens, later native failures and injected tests. They do not qualify every provider method or outage. +14. Refresh status or resume the saved checkout after an interrupted session. If it cannot reopen, stop and ask Dave for reconciliation; do not pay again. 15. Sign out and ask the specialist to remove the exact disposable accounts and event. Keep test payment evidence for reconciliation. **Expected result:** one saved purchase belongs to the payer. A return URL proves nothing. Only verified test payment for the exact account, amount, currency, order and term can activate the canonical membership used by free events. Original term and consent evidence are retained. The current screen expires within 60 seconds or sooner at a known deadline; it never polls. A family purchase creates one private Family ID and the payer's membership. Invitations and other family-account enrollment are **NOT AVAILABLE YET**; an ID alone grants nothing. **Stop conditions:** real information or money is requested; the test notice disappears; another account's state appears; an unresolved purchase offers another charge; an old term extends into a new year; a failed read leaves controls; or a provider, account, App Check or release check is missing. Near year end, checkout may be unavailable because the provider's minimum session lifetime would cross the term boundary. -**Uncertain or held purchase:** keep the saved order and ask Dave for specialist reconciliation through a tracked change. A declined-card attempt can retain a provider payment record even after checkout expires; it stays locked for specialist reconciliation. Do not pay again, edit records, grant roles, issue refunds or change provider settings. Payment received after withdrawal, suspension, account loss, conflicting revisions or term expiry is retained for reconciliation rather than overriding that state. Rechecking verified identity can finish an otherwise unchanged pending activation. Any observed test refund/dispute places a sticky defensive hold; this does not choose a real club refund policy. +**Uncertain or held purchase:** keep the saved order and ask Dave for specialist reconciliation through a tracked change. A declined-card attempt can retain a provider payment record even after checkout expires; it stays locked for specialist reconciliation. This was observed natively: the screen still says open, but its expired checkout cannot reopen. It is not self-service failed-payment recovery. Do not pay again, edit records, grant roles, issue refunds or change provider settings. Payment received after withdrawal, suspension, account loss, conflicting revisions or term expiry is retained for reconciliation rather than overriding that state. Rechecking verified identity can finish an otherwise unchanged pending activation. Any observed test refund/dispute places a sticky defensive hold; this does not choose a real club refund policy. **Success proof:** exact reviewed head and green CI, native Firestore concurrency results, actual Stripe sandbox account/webhook verification, genuine staging identity/App Check, matching Function and Hosting release receipts, dated phone/desktop checks, and exact owned cleanup. Unit doubles, generated signatures and emulator transactions do not prove native Stripe or hosted payment behavior.