OBS-001A1: fail closed for Sentry personal data

[daliu]

Outcome

The frontend Sentry source now fails closed for member data: session replay, tracing, browser sessions, client reports, breadcrumbs, attachments, user identity, and unknown integrations are disabled or removed before transport. Only generic error classes, tightly bounded CRA bundle locations, and strictly validated non-content event metadata remain. This wording describes the branch source, not deployed behavior.

#135 and #118 are merged. This branch is rebased on resulting main commit 13ccc1b67dd57f69091e808b12e1287a1bc05b2f and includes the released SECURITY.md / OPERATIONS_RUNBOOK.md status updates. Exact final-head hosted CI and both follow-up reviews are complete.

Tracks #134. Parent tracker: #111. Keep #134 open after merge until the affected release surfaces are recorded truthfully.

Security invariant and failure behavior

• No direct member identifier, request/form body, query/fragment, raw message, arbitrary tag/extra/context, breadcrumb, function name, source context, or attachment reaches the returned Sentry event.
• Only GlobalHandlers and TryCatch survive the default-integration allowlist; every unknown future default drops.
• Events carrying attachments, malformed values, coercing objects, throwing getters, or repeated-read/overridden-array-method attempts drop or sanitize safely rather than bypassing the boundary.
• Local/test and initial capability-callback startup isolation from SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99 is unchanged.
• A future SDK name or CRA bundle-name change can reduce diagnostics, but fails safe by dropping data.

Scope

• src/services/monitoring/sentry.ts
• src/services/monitoring/sentry.test.ts
• SECURITY.md (one remediation-ledger row)
• OPERATIONS_RUNBOOK.md (one evidence-boundary paragraph)

Excluded: Analytics, functions/signup.js, Auth/profile code, Firestore Rules, Stripe/webhook, Strava, sitemap, external Sentry settings, and all #118 runtime/profile paths. #118 merged the separate signup-log slice as source only; its provider deployment remains unproven.

Test evidence

Node 20.20.2 on exact final head a0c9065635046c948f1ba92fdf1fe8175b693c40:

• Deliberate pre-fix run: focused suite failed the three new privacy assertions (12 passed / 3 failed).
• Focused Sentry suite: 19/19 passed after reviewer-requested overridden-array, attachment, and SDK second-read regressions.
• Complete frontend suite: 6 suites / 69 tests passed with only existing React Router future warnings.
• SPA callback plus protected-release Node gates: 23/23 passed.
• Changed-file ESLint with --max-warnings=0: passed.
• Diagnostic production build: compiled successfully.
• git diff --check: passed.
• Three independent reviewers approved the original two-file source diff. Final-head reviewers then found misleading cardinality wording, missing attachment-failure coverage, overridable untrusted-array methods, and an attachment-getter second-read race. Exact head a0c9065635046c948f1ba92fdf1fe8175b693c40 fixes those findings; both follow-up reviewers approved that exact head with no remaining blocker. The final diff SHA-256 is 7aa64a7636e9257f457002978d6783747c2e459abbce477652df77efa6cd24ee.
• Hosted CI run 29242490328 passed frontend tests/callback and release gates/build, Functions lint/tests, and Firestore Rules on that exact head. Netlify's exact-head preview completed, but is not production evidence.

Tests mock Sentry and use synthetic canaries only. They make no Firebase, Sentry, or other provider call.

Compatibility / rollback

No schema, route, dependency, provider, or API change. Existing ErrorBoundary capture remains. Rollback is the single source commit; doing so would restore the known PII/replay exposure and therefore requires a security review.

Officer impact

None — no officer/member procedure, navigation, permission, or collected field changes.

Officer documentation

None — this is an internal telemetry safety boundary. Engineering evidence boundaries are updated in SECURITY.md and OPERATIONS_RUNBOOK.md; no officer task guide changed.

Deployment evidence

• Source: final head a0c9065635046c948f1ba92fdf1fe8175b693c40 is committed and pushed; not merged.
• Website: not published or verified. Any preview is production-configured and restricted to public read-only review.
• Firebase: no backend change or deployment.
• Sentry/provider: no outside setting inspected or changed; provider IP handling, retention, access, consent, and deletion remain unproven under DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	a0c9065
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54bc44b9c4470008e9530a
😎 Deploy Preview	https://deploy-preview-137--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Hosted draft verification for exact source commit 0ea0fcbe118a1a465648b7380f0757e81d99e41f:

• CI run 29238022309: success.
• Frontend Jest gate, SPA callback safety gate, and production build: passed.
• Cloud Functions lint/tests: passed.
• Firestore Rules emulator tests: passed.
• Netlify deploy preview: ready; this is not production evidence and was not used with member data or capability callbacks.

Existing repository lint annotations outside this two-file scope remain warnings only. The PR stays draft pending the explicit shared-document release and a refresh from the resulting main.