OBS-001A — Remove personal data and session replay from current monitoring and logs

[daliu]

Officer impact: None — member and officer screens/tasks are unchanged; this tracker removes or proves containment of diagnostic payloads.

Officer documentation: None — no officer procedure, navigation, permission, collected field, deployment duty, or external account changed. Engineering evidence is in SECURITY.md and OPERATIONS_RUNBOOK.md.

Deployment evidence: Closure records source/tests/merge separately from website publication, exact runmprc.com, Firebase deployment, outside-provider configuration, and live behavior. Source completion does not prove any production surface.

Problem

Current source sent a signed-in user's email to Sentry user context, enabled Sentry replay for every captured error, and logged the raw signup email in functions/signup.js. Authentication, member, event, registration, payment, and account screens can contain personal data or capability-bearing URL state. Firebase Analytics was also enabled without a repository-proven event allowlist, consent decision, payload audit, or retention decision.

This created avoidable exposure to logs and monitoring vendors even when the underlying feature worked correctly.

Atomic outcome

Make the existing frontend monitoring, analytics wrapper, Auth signup logging, and covered browser diagnostics fail closed for personal data, with synthetic tests that inspect the emitted payloads. This issue removes current exposure; it does not build the broader payment metrics/SLO program or approve future telemetry.

Scope

• Remove raw email and other direct member identifiers from Sentry user context.
• Disable Sentry session replay, tracing, client reports, default PII, breadcrumbs, attachments, transactions, and unapproved integrations.
• Positively project only bounded Sentry error metadata; drop query strings, fragments, form values, provider responses, tokens, addresses, DOB, emergency contacts, emails, phones, request bodies, and unknown fields.
• Replace raw signup email/error logging with one fixed failure outcome and prove success silence plus failure redaction across standard console levels.
• Remove Firebase Analytics runtime initialization/emission and keep the compatibility wrapper transport-free.
• Route the covered browser console failures through a closed five-outcome helper.
• Add focused synthetic tests that fail if representative sensitive values reach Sentry, Analytics, signup logs, or covered browser diagnostics.
• Document the residual production/provider decisions that require the approved matrix from DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.

Acceptance criteria

• No raw email, phone, address, DOB, emergency contact, OAuth/Auth token, provider response, password/reset material, capability-bearing query/fragment, arbitrary form value, or request body is sent by the covered code.
• Sentry replay is off, or sensitive-route exclusion and masking are verified by payload inspection with no form text or URL state visible.
• Signup success/failure logs contain only allowlisted event/result identifiers and sanitized codes.
• Analytics accepts only documented low-cardinality event names/parameters and rejects or drops unknown/sensitive fields.
• Synthetic canary values are absent from captured Sentry events/replays, Analytics calls, console/function logs, test artifacts, and CI output.
• Local and CI tests make no production network calls and use synthetic identities only.
• External Sentry/Firebase retention, consent, access, and deletion configuration remains explicitly unproven until owner evidence is supplied under DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.

Completed atomic children

• AUTH-PROFILE-001 — Restore safe profile setup and editing after the Firebase cutover #118 / PR AUTH-PROFILE-001: recover missing member profiles safely #132 — signup/profile source, including fixed no-PII signup failure handling; merged as 13ccc1b67dd57f69091e808b12e1287a1bc05b2f.
• OBS-001A1 — Disable Sentry replay and fail closed for personal data #134 / PR OBS-001A1: fail closed for Sentry personal data #137 — Sentry containment and synthetic payload inspection; merged as a925dbdada35b6d7ceb28f6ba2b10cc5679c9634.
• OBS-001A2 — Disable unapproved Firebase Analytics collection #139 / PR OBS-001A2: disable unapproved Firebase Analytics collection #141 — Firebase Analytics runtime removal and default-deny compatibility wrapper; merged as 36b531c8e741442af7c688c23a780d2dcd4ed374.
• OBS-001A3 — Remove raw frontend error objects from browser logs #142 / PR OBS-001A3: remove raw frontend console error payloads #143 — closed browser diagnostic helper plus whole-runtime console guard; merged as f2caaae3b3f25adfd4fc552008871408f18e5931.
• OBS-001A4 — Prove signup failure logs stay free of member data #146 / PR test: prove signup logs redact private data #147 — hostile-canary signup Function log regression; merged as 8d250073d8911d42031fa694c8c0e784911461b0.

Dependencies and coordination

• SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 and CI-001A — Repair the deterministic frontend test baseline #103 are complete.
• PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101 Stripe webhook logging, STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 Strava/OAuth behavior, unrelated legacy Functions logs, provider consoles, production data, and Firestore Rules remain excluded.
• DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 owns approved purposes, vendor disclosures, retention, consent, access, deletion, and any decision to re-enable telemetry. A future implementation requires a new claimed/reviewed issue.
• Broader metrics, alerting, payment reconciliation, and incident SLOs remain under the existing OBS/commerce program.

Explicitly out of scope

• Adding new analytics, advertising, fingerprinting, or replay vendors.
• Designing dashboards, payment metrics, alerts, or incident response.
• Changing membership authority, OAuth scopes, Firestore authorization, data retention jobs, or the public privacy policy.
• Enabling monitoring in local/test or contacting live services from tests.

Claim protocol

Creation is not a claim. Do not edit files until dependencies are complete, the issue is assigned, and a timestamped CLAIMED by <canonical agent> at <UTC>; branch <branch> comment is posted and re-read. Earliest valid claim wins.