OBS-001A2: disable unapproved Firebase Analytics collection

[daliu]

Outcome

Firebase Analytics is disabled in application source pending an approved #110 privacy policy. No runtime source imports the Analytics SDK, FirebaseResources.analytics is permanently null, the existing track(...) API is a provider-free compatibility no-op, and the Waiver page no longer bypasses that boundary. This describes source behavior only; it does not claim the website or provider state changed.

Tracks #139. Parent tracker: #111.

Security invariant and failure behavior

• Production, preview, local, test, and callback builds have no application runtime path to firebase/analytics, isSupported, getAnalytics, or logEvent.
• Arbitrary/high-cardinality parameters—including identifiers and raw errors—can still be evaluated by existing call sites, but the compatibility wrapper neither reads them nor contacts Firebase/a provider.
• Removing telemetry cannot block registration, waiver, account, or navigation behavior.
• The public Firebase measurement ID remains inert configuration; it is not a secret and no Analytics runtime is imported. A future direct runtime import fails the whole-src guard.
• Re-enablement requires a separate DATA-001B — Inventory personal data and approve a minimization/retention matrix #110-approved purpose/consent/schema/retention decision and reviewed source/provider change.

Scope

• src/services/analytics/analytics.ts
• src/services/analytics/analytics.test.ts
• src/services/firebase/FirebaseResources.ts
• src/services/firebase/FirebaseResources.test.ts
• src/pages/joinUs/Waiver.jsx
• SYSTEM_DESIGN.md
• SECURITY.md
• OPERATIONS_RUNBOOK.md

Excluded: Sentry, signup/profile/Auth, Firestore Rules, Stripe/webhook, Strava, sitemap, provider consoles, production data, cookies/storage deletion, and privacy-policy decisions.

Test evidence

Node 20.20.2 on exact head da7da350a1cc0be876e710e3432e3d7966272617, rebased onto non-overlapping #101 merge 87bd1210575882cdd06214bcb98ed38ce00f71c2:

• Deliberate pre-fix focused run: 5 new assertions failed and 17 existing assertions passed across the two suites.
• Focused Analytics/Firebase suites: 32/32 passed after the fix.
• Complete frontend suite: 7 suites / 82 tests passed; only existing React Router future warnings.
• SPA callback plus protected-release Node gates: 23/23 passed.
• Changed-file ESLint with --max-warnings=0: passed.
• Diagnostic production build: compiled successfully.
• Built JavaScript contains no Google Analytics/Tag Manager/Analytics endpoint marker; the inert public Firebase measurement ID appears once in app configuration.
• git diff --check: passed.
• Independent review found two containment gaps before publication: Firebase's compat/collection-enable APIs, then CRA .mjs modules and public HTML/JavaScript entrypoints. Exact head da7da350a1cc0be876e710e3432e3d7966272617 adds negative fixtures plus an enumeration regression covering src .mjs and every executable public surface. Exact-head privacy, regression, and SDK/build reviews all approve the final fingerprint. Hosted CI run 29243696803 passed Cloud Functions, frontend, and Firestore Rules on this exact head. Final diff SHA-256: c29e1525f1c4cc5a317a00ead88a3368434c7879b88e1b453c30e1996a63fc35.

Tests use mocks, source inspection, and synthetic privacy canaries. They make no Firebase Analytics or other provider call.

Compatibility / rollback

No dependency, schema, route, storage, or provider configuration changes. Existing event constants and track(eventName, params) call signatures remain source-compatible. Waiver still records waiverSigned=true and invokes its callback; the label/input association is made explicit. Rollback would restore unapproved collection and requires privacy review.

Officer impact

None — no officer/member procedure, navigation, permission, or collected field changes.

Officer documentation

None — this is an internal telemetry containment boundary. The system diagram and engineering security/operations evidence are updated; no officer task guide changed.

Deployment evidence

• Source: exact head da7da350a1cc0be876e710e3432e3d7966272617 is pushed and independently approved; not merged.
• Website publication: not published. Production Git builds are paused by CI-001B2 — Make releases protected, backend-first, and fail-closed #135.
• runmprc.com verification: not performed; no exact revision is claimed live.
• Firebase deployment: not required and not performed; this slice changes only frontend source/tests/docs.
• Analytics provider configuration: no provider setting was inspected or changed. Collection/cookies, historical data, retention, access, consent, deletion, and vendor terms remain unverified under DATA-001B — Inventory personal data and approve a minimization/retention matrix #110.
• Live network behavior: not tested; production-configured previews must not be used for private/provider flows.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	da7da35
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54c120afae5f0008b8a2dc
😎 Deploy Preview	https://deploy-preview-141--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.