OBS-001A2 — Disable unapproved Firebase Analytics collection

[daliu]

Officer impact: None — this stops unapproved telemetry without changing an officer or member task.

Officer documentation: None — no officer procedure, navigation, permission, or collected field changes. Engineering architecture/security/operations evidence must distinguish source containment from website and provider behavior.

Deployment evidence: Closure must record source/tests/merge, website publication, exact runmprc.com revision, Firebase Analytics/provider behavior, and live network verification separately. A source merge is not production containment.

Problem

Ordinary hosted pages currently initialize Firebase Analytics automatically. The shared wrapper accepts arbitrary event names and parameters, and current call sites pass event identifiers/slugs, prices, and raw error messages. Waiver.jsx bypasses the wrapper and calls the Analytics SDK directly. The repository has no approved purpose, consent, parameter schema, retention, access, or deletion decision under #110.

Invariant

Until #110 records an approved Analytics policy, application runtime code must not initialize Firebase Analytics or call logEvent. Local/test and capability-callback isolation from #99 must remain unchanged. Removing telemetry must never block or alter a member flow.

Atomic outcome

Disable hosted Analytics SDK initialization, turn the existing wrapper into a no-transport compatibility no-op, remove the direct Waiver SDK bypass, and add synthetic/static tests proving no application runtime import can initialize or emit Analytics. Keep the current call sites source-compatible; a separately approved child may later replace the compatibility API with a closed event/parameter schema.

Exact implementation boundary

• src/services/analytics/analytics.ts
• src/services/analytics/analytics.test.ts (new)
• src/services/firebase/FirebaseResources.ts
• src/services/firebase/FirebaseResources.test.ts
• src/pages/joinUs/Waiver.jsx
• Minimum matching SYSTEM_DESIGN.md, SECURITY.md, and OPERATIONS_RUNBOOK.md status/diagram evidence

Excluded: Sentry, functions/signup.js, Auth/profile, Firestore Rules, Stripe/webhook, Strava, sitemap, Firebase/Sentry provider settings, consent/policy decisions, cookies/storage cleanup, and all production data.

Acceptance criteria

• Production, preview, local, test, and callback startup do not call Firebase Analytics isSupported, getAnalytics, or logEvent from application runtime code.
• FirebaseResources.analytics remains null and existing wrapper calls return without an SDK/provider call or user-flow error.
• Waiver.jsx has no direct Analytics SDK import/call and its confirmation/storage/callback behavior is unchanged.
• A repository test fails if a runtime source file directly imports/calls Firebase Analytics outside the explicitly non-runtime test boundary.
• Existing callback isolation and the complete frontend suite pass using synthetic data only and no provider traffic.
• Engineering documents state that source containment is not proof of website publication, provider collection/cookies, historical data deletion, retention/access/consent, or live behavior.

Dependencies and coordination

• Parent: OBS-001A — Remove personal data and session replay from current monitoring and logs #111.
• SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99, CI-001A — Repair the deterministic frontend test baseline #103, AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118, OBS-001A1 — Disable Sentry replay and fail closed for personal data #134, and CI-001B2 — Make releases protected, backend-first, and fail-closed #135 are complete as source outcomes; their merged behavior and deployment caveats must be preserved.
• DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 remains the owner-blocked policy gate for any future Analytics enablement. Disabling unapproved collection does not require that decision.
• PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101 exclusively owns Stripe webhook/helper/test paths. This child has no overlap.

Claim protocol

Creation is not a claim. Before editing, assign the issue, add status:in-progress, post CLAIMED by <canonical agent> at <UTC>; branch <branch>, and re-read comments. The earliest valid claim wins.

[daliu]

CLAIMED by Codex agent /root at 2026-07-13T10:28:01Z; branch codex/issue-139-disable-analytics.

Exact runtime/test ownership: src/services/analytics/analytics.ts, new src/services/analytics/analytics.test.ts, src/services/firebase/FirebaseResources.ts, src/services/firebase/FirebaseResources.test.ts, and src/pages/joinUs/Waiver.jsx. After refreshing from exact current main, I also claim only the minimum matching Analytics status/diagram hunks in SYSTEM_DESIGN.md, SECURITY.md, and OPERATIONS_RUNBOOK.md.

STOP boundaries: #101 Stripe webhook/helper/tests, Sentry, signup/profile/Auth, Firestore Rules, Strava, sitemap, provider consoles, production data, consent/policy decisions, and unrelated dirty-worktree changes are immutable/excluded. Tests use synthetic data and make no Firebase Analytics/provider call. Any overlap discovered after this marker is a stop-and-coordinate condition.

[daliu]

Implementation progress — CLAIM RETAINED / IN REVIEW

• Draft PR: OBS-001A2: disable unapproved Firebase Analytics collection #141
• Exact pushed head: a907a4c70cfaf61aacf1b26e5988ec48abbd8044
• Base: a925dbdada35b6d7ceb28f6ba2b10cc5679c9634
• Diff SHA-256: 1df5359164166e9fad4fda49fe53367981021b77be5514c679c472e6257dd81e
• Deliberate pre-fix proof: five new privacy assertions failed.
• Node 20 local proof after the fix: focused 22/22, complete frontend 72/72, callback/release gates 23/23, strict changed-file lint, diagnostic build, bundle-marker inspection, and diff check passed.

The PR remains draft while exact-head hosted CI and independent privacy/regression/SDK reviews run. No website, Firebase Analytics setting, provider data, cookie/storage state, or live behavior was changed or inspected.