OBS-001A3 — Remove raw frontend error objects from browser logs

[daliu]

Officer impact: None — this removes private diagnostic payloads without changing an officer or member task.

Officer documentation: None — no navigation, permission, collected field, or officer procedure changes. Engineering security/operations evidence must distinguish source containment from publication and live behavior.

Deployment evidence: Closure must record source/tests/merge, website publication, exact runmprc.com revision, Firebase deployment, outside-provider configuration, and live behavior separately.

Problem

The completed #118, #134, and #139 slices fail closed inside signup, Sentry, and Analytics, but #111's closure audit found four remaining browser console sinks that pass raw caught error objects to console; ErrorBoundary also passes the React component stack. Firebase/Auth/Firestore/App Check errors and rendering errors can contain email, token, provider-response, URL, form, or member-context values. The current tests do not inspect those console payloads.

Invariant

Application runtime console diagnostics may contain only fixed, low-cardinality outcome identifiers selected by source code. A caught error, message, stack, component stack, response, request, URL, form value, account/member value, or provider object must never be passed to a browser console method. Removing raw logging must not change the affected user flow or bypass #134's Sentry sanitizer.

Atomic outcome

Route the four raw frontend error-console paths through one fail-closed diagnostic helper with a closed outcome set. Add synthetic canary and whole-runtime-source tests proving raw console calls cannot recur. Preserve existing failure UI/state, promise behavior, and ErrorBoundary Sentry capture.

Exact implementation boundary

• src/services/monitoring/clientDiagnostics.ts (new)
• src/services/monitoring/clientDiagnostics.test.ts (new)
• src/components/ErrorBoundary.tsx
• src/services/identity/Identity.ts
• src/components/MembersOnly.jsx
• src/services/firebase/FirebaseResources.ts
• Minimum matching OBS-001A — Remove personal data and session replay from current monitoring and logs #111 status evidence in SECURITY.md and OPERATIONS_RUNBOOK.md

Excluded: Sentry sanitizer/config, Analytics, signup/profile/Auth Functions, Stripe/webhooks, Strava/OAuth, Firestore Rules, provider consoles, cookies/history, production data, and public/sitemap.xml.

Acceptance criteria

• The render, verification-email, members-only fetch, and App Check initialization failure paths never pass a caught error or component stack to console.
• The existing constant App Check-not-configured diagnostic also uses the same closed helper; no application/public runtime path calls console directly outside that helper.
• Unknown, object, coercing, getter-backed, and sensitive-string diagnostic inputs fail closed without throwing or logging.
• Synthetic email, phone, address, DOB, emergency-contact, token, request/response, URL/query/fragment, form, stack, and provider canaries are absent from serialized console arguments.
• ErrorBoundary still passes the original error to OBS-001A1 — Disable Sentry replay and fail closed for personal data #134's Sentry wrapper, while its console output is one fixed identifier.
• Identity registration, members-only loading/error state, Firebase resource initialization, local emulator isolation, and callback isolation remain unchanged.
• Focused tests, the complete frontend suite, callback/release gates, strict changed-file lint, and diagnostic build pass on Node 20 with no production/provider traffic.
• Engineering evidence states that source/merge do not prove website publication, exact runmprc.com, Firebase/provider configuration, console history, or live behavior.

Dependencies and coordination

• Parent: OBS-001A — Remove personal data and session replay from current monitoring and logs #111.
• AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118, OBS-001A1 — Disable Sentry replay and fail closed for personal data #134, and OBS-001A2 — Disable unapproved Firebase Analytics collection #139 are complete source outcomes and their exact boundaries must be preserved.
• PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101 owns Stripe webhook/helper/test paths; STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 owns Strava/OAuth provider behavior. Neither may be touched.
• This child needs no owner policy decision because it only removes raw diagnostic payloads. DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 still owns any future telemetry purpose, consent, retention, access, and deletion decision.

Claim protocol

Creation is not a claim. Before editing, assign the issue, add status:in-progress, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read comments. Earliest valid claim wins.

[daliu]

CLAIMED by Codex agent /root at 2026-07-13T10:54:03Z; branch codex/issue-142-console-privacy.

Exact runtime/test ownership: new src/services/monitoring/clientDiagnostics.ts and .test.ts; src/components/ErrorBoundary.tsx; src/services/identity/Identity.ts; src/components/MembersOnly.jsx; src/services/firebase/FirebaseResources.ts; and only the minimum #142 status hunks in SECURITY.md and OPERATIONS_RUNBOOK.md.

STOP boundaries: #134 Sentry sanitizer/config, #139 Analytics, #118 signup/profile/Auth Functions, #101 Stripe/webhook, #88 Strava/OAuth, Firestore Rules, provider consoles, production data, cookies/history, and public/sitemap.xml are immutable/excluded. Tests use synthetic canaries and make no provider call. Any overlap discovered after this marker is a stop-and-coordinate condition.

[daliu]

Implementation complete; claim retained for exact-head review.

• Draft PR: OBS-001A3: remove raw frontend console error payloads #143
• Branch: codex/issue-142-console-privacy
• Exact local head: 4aa7e941a550d6fdf4439f8ed661aaa7bf226169
• Base: 36b531c8e741442af7c688c23a780d2dcd4ed374
• Diff SHA-256: c3405313f2e9410b9adaca73e5e56385fc48d35c2d903c469afd38636fa3239e
• Deliberate pre-fix proof: the new guard identified all four raw-console paths and failed 1/4 assertions.
• Node 20 local proof after the fix: focused 49/49, complete frontend 94/94, callback/release gates 23/23, strict changed-file lint, diagnostic build, and diff check passed.

The PR will remain draft while exact-head hosted CI and independent privacy/regression reviews run. No website, runmprc.com, Firebase deployment, outside-provider setting, production record, or live console history was changed or inspected.

[daliu]

REVIEW-DRIVEN TEST SCOPE AMENDMENT at 2026-07-13T11:02Z — claim retained.

Two exact-head reviewers found that the first recurrence guard missed valid JavaScript console access forms and that three caller failure paths were only statically inspected. I am adding only existing src/services/firebase/FirebaseResources.test.ts to the claimed test boundary; Identity and MembersOnly caller canaries remain inside the already claimed clientDiagnostics.test.ts. No additional runtime or documentation file is claimed.

The new proof will use TypeScript syntax-tree inspection plus optional-chain, parenthesized/commented, alias/destructure, computed-global, and escaped-identifier fixtures, and will execute Identity registration, members-only fetch failure, and both App Check failure cases. All original STOP boundaries remain unchanged.