V2: verified identity and transactional exercise foundation

[mekado11]

Scope

Stacked review unit: depends on #19 and targets feat/v2-domain-foundation, not main. Keep both PRs unmerged until reviewed. This is the server-security and transactional exercise foundation for the original HubCyS V2 rebuild, not a visual redesign or a completed release.

• Verify Firebase ID tokens, including revocation/disabled-user checks, at the six existing AI/utility API handlers.
• Isolate the V2 organization namespace from browser clients; resolve organization membership, provider grants and exercise assignment from server-managed records.
• Add feature-gated command/query APIs for exercise creation, lifecycle transitions, manual inject release and independent participant responses.
• Persist response, evidence, audit event, outbox event and idempotency receipt atomically.
• Enforce reviewer permission separately from participant workspace access.
• Reuse complete scenario-manifest validation at exercise creation and scoring.
• Add Auth/Firestore emulator testing and CI without production credentials or a staging dependency.
• Pin the server runtime to Node 22 and use the current Firebase Admin SDK.

Preserved

Existing frontend routes, navigation, customer records, incidents, assessments, action items, policies, utilities, billing and legacy data remain in place. No customer migration, destructive operation, merge or production deployment has been performed.

Verification

• npm run typecheck:v2: pass.
• npm run test:v2: 68 tests pass.
• npm run test:security: 26 tests pass.
• npm run test:emulator: 14 integration tests pass against demo-hubcys-v2 only.
• npm run build: pass; existing large-bundle warning remains.
• git diff --check: pass.
• Existing root lint: 23 errors, unchanged baseline.
• Existing root typecheck: 2,991 diagnostics, unchanged baseline.
• Dependency audit is NOT clean: 34 full-tree findings (2 critical, 13 high, 17 moderate, 2 low); production-only audit 19 (2 critical, 9 high, 7 moderate, 1 low). These include legacy findings and development-tool transitive findings. No unsafe automatic major-version downgrade/fix was applied.
• Hosted test/build workflow: passed on the final commit.
• Vercel automatic preview build: passed. This does not verify deployed server credentials or live workflow behavior.
• Hosted Snyk check remains failed; GitHub exposes the failure status but not its detailed finding list. This remains an explicit review/release blocker, not a waived check.

Integration coverage includes synthetic six-person participation, real emulator-issued identity, disabled users, cross-tenant denial, forged fields, direct-client CRUD denial, provider grant intersection/expiry/revocation, privilege non-escalation, hidden artifact/rubric separation, retry idempotency, concurrent inject release and rollback without partial evidence.

Activation requirements and limitations

Do not treat this PR as deploy-ready. The six existing API authentication changes are not feature-gated: server FIREBASE_PROJECT_ID and Google Application Default Credentials must be configured and verified before deploying them, or they will fail closed with 503. Server credential configuration has not been verified on Vercel.

Keep HUBCYS_V2_ENABLED off until the reviewed V2 rules are deployed and authoritative organization/membership/scenario/context provisioning is implemented and verified. Browser-managed legacy authority fields must not be automatically migrated into V2 authority.

No production Firebase rules, Storage policies, customer data or Vercel settings were changed. Emulator evidence does not establish live IAM or deployment correctness.

The UI, observation acceptance, persisted score runs, verification/retesting, reports, file ingestion, outbox workers, scheduled/branching injects, migration tooling and remaining legacy security hardening are subsequent review units. A response evidence record proves a submitted statement, not execution of the technical action it describes.

Visual review: not applicable to this backend-only change; no user-visible rebuild is claimed. The complete end-to-end readiness acceptance story has not yet been implemented.

See docs/v2/server-boundary.md for storage paths, operation boundaries, local commands and deployment prerequisites.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hubcys	Ready	Preview	Sep 23, 2026 9:05am UTC

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a87fad9e6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require provider assignment for exercise reads

When a provider user has an organization-level readiness_lead, organization_admin, or auditor role, this exemption skips the participant-assignment check even though their membership belongs to the provider organization. Consequently, a provider user with a customer grant containing exercise:read can query every exercise in that customer tenant without an active assignment and receive its metadata and released artifacts. Restrict this broad-role exemption to customer-local memberships, or require an assignment whenever provider_grant is present.

Useful? React with 👍 / 👎.