SUPPLY-001D9 — Upgrade Firebase CLI to v15 and migrate emulator gates to Java 21

[daliu]

Outcome

Upgrade the committed root Firebase CLI from 13.7.0 to the reviewed 15.24.0 release and migrate every repository-owned emulator gate from Java 17 to Java 21. Remove the two critical audit groups carried by the current CLI graph while preserving fail-closed demo-project isolation and exact-commit release validation.

Atomic P0 child of #105 and the SUPPLY-001 delivery sequence. Follows #453.

Invariants

• Every local and hosted Auth/Firestore/Functions emulator command remains bound to an explicit demo-* project and may not acquire cloud or provider authority.
• CI and release validation use the Firebase CLI committed in package-lock.json; no global or floating install is allowed.
• Java 21 is explicit in both emulator jobs and current engineering guidance; Java 17 must fail the new compatibility proof.
• No application, Rules, Functions domain behavior, Firebase configuration, provider setting, or production data changes.
• A dependency version bump alone is not completion: the exact lock graph, critical-advisory removal, emulator behavior, and workflow guards must be demonstrated.

Why now

Exact main at 8a5b0cc513bf72ff87d88d7956714184319a1be6 has 64 full-root audit findings, including two critical groups in the direct firebase-tools@13.7.0 development/CI/release chain:

• protobufjs under firebase-tools -> @google-cloud/pubsub -> google-gax;
• tar in the CLI/tooling extraction chain.

The root production-only audit is separately 2 high and 1 low; those lint/compiler findings remain for later atomic slices. Firebase CLI 15 requires Node 20+, already used by the repository, and drops emulator support for Java below 21. See the official Firebase CLI 15.0.0 release notes.

Scope

• Pin firebase-tools exactly to 15.24.0 and regenerate only the necessary root lock graph with Node 20/npm 10 and lifecycle scripts disabled.
• Add a dependency-free RED test for the exact reviewed CLI identity, supported Node engine, patched critical paths, and Java-21-only workflow contract.
• Update the two hosted emulator jobs to Java 21 and strengthen static workflow/release tests so a downgrade or floating CLI fails.
• Update current engineering/operations/version evidence and the supply-chain slice record.
• Run clean-install, dependency-tree, full/production audit, Rules emulator, commerce emulator, frontend, Functions, SPA, workflow, release, artifact-safety, lint, YAML, and diagnostic-build checks.
• Compare clean baseline and upgraded build output; investigate every changed non-map artifact.

Acceptance criteria

• package.json resolves exactly firebase-tools@15.24.0; package-lock.json has one reviewed direct CLI identity from the public npm registry.
• The full root audit contains no critical protobufjs or tar group from firebase-tools; critical count falls from 2 to 0 with no new critical/high production finding.
• Node remains 20 and both hosted emulator jobs explicitly provision Java 21.
• A deliberate Java 17 probe rejects the v15 emulator boundary, while Java 21 passes the complete 378-case Rules suite and 63-case commerce concurrency suite using only demo projects and synthetic data.
• Static CI/release tests reject Java downgrade, floating/global CLI installation, broadened emulator scope, missing demo project, and non-lockfile tooling.
• Full local verification and clean Node 20 install pass; Functions lock/audit and application behavior remain unchanged.
• Clean baseline/upgraded build comparison proves whether any deployable artifact changes; any change is explained and reviewed.
• Documentation distinguishes source changed, tests passed, merged, deployed, and production-verified states.

Out of scope

• Firebase Admin/Functions SDK upgrades, CRA migration, remaining Babel/minimatch/brace-expansion findings, automated audit policy/SBOM, IAM/OIDC, branch protection, staging, deployment, provider configuration, or production testing.
• npm audit fix --force, package overrides without a separately reviewed compatibility reason, real Firebase projects, real member/payment data, or provider credentials.

Dependencies and failure cases

• Depends on the merged CI baseline and SUPPLY-001D8 — Patch the high-severity Babel SystemJS compiler chain #453; both are complete.
• CI-001C — Configure protected short-lived Firebase deployment identity #133 and CI-001D — Prove backend-first staging and deploy the profile repair #136 remain external deployment blockers but do not block this source/tooling slice.
• Stop and split if CLI v15 changes emulator semantics, requires application/Functions behavior changes, or cannot pass under Java 21 with the existing demo-only boundary.

Officer impact: None — this changes developer and hosted CI tooling only; no officer task or live surface changes.

Officer documentation: docs/officers/PUBLISH_AND_CHECK.md — records the internal CLI/Java boundary and confirms officers never install or run either tool.

Deployment evidence: Source and synthetic local/hosted checks only. No website publication, Firebase deployment, provider configuration, production data access, or live behavior is authorized by this issue.

[daliu]

CLAIMED by /root at 2026-07-22T13:23:54Z; branch codex/issue-455-firebase-cli-java21; base 8a5b0cc.

[daliu]

Implementation is ready in PR #456 at head 23c27f55d8d1e202261b6070b837a245e51fea44.

Local evidence:

• RED on base: Java 17 and firebase-tools@^13.7.0 failed the new compatibility/identity contract.
• Exact firebase-tools@15.24.0; Java 21 in both emulator jobs; exact read-only, credential-free workflow contracts with lifecycle hooks and fail-open/extra-command bypasses rejected.
• Root audit: 64 (2 critical/32 high/17 moderate/13 low) to 58 (0 critical/24 high/21 moderate/13 low); production audit unchanged at 2 high/1 low.
• Java 17 rejected before startup; Java 21 Rules 378/378 and commerce 63/63 passed with explicit demo projects; credential-inaccessible three-emulator readiness smoke passed under demo-mprc-local.
• Functions lint and 6,231 tests passed; frontend 727 tests and SPA 11/11 passed; static safety set 58/58 passed.
• Baseline/current diagnostic builds are byte-identical across 59 files and 19,520,717 bytes.
• Three independent adversarial reviewers approved the repaired head with no remaining findings.

Officer impact: None — developer and hosted CI tooling only.

Officer documentation: docs/officers/PUBLISH_AND_CHECK.md.

Deployment evidence: Source and synthetic local checks only so far. No website, Firebase, provider, production-data, or live-behavior change has been performed or verified. Hosted PR checks are running and will be inspected before merge.