SUPPLY-001D9: upgrade Firebase CLI and Java emulator boundary

[daliu]

Outcome

Removes the two critical advisory groups carried by the repository Firebase CLI and moves every hosted emulator gate to the Java 21 boundary required by Firebase CLI 15, without changing application, Functions, Rules, provider, or production behavior.

Fixes #455

Officer impact: None — this changes developer and hosted CI tooling only; no officer task or live surface changes.

Officer documentation: docs/officers/PUBLISH_AND_CHECK.md — records the internal CLI/Java boundary and confirms officers never install or run either tool.

Deployment evidence: Exact-head GitHub CI run 29926297611 passed all five jobs. Netlify generated PR deploy preview 6a60cc5937205f0008a3ec5d; its redirect/preview checks passed and its header/page-change checks skipped because those files did not change. The preview was not used for private, Firebase, or provider behavior and is not production. No production website publication, Firebase deployment, provider configuration, production data access, or live behavior was performed or verified.

Invariant and changes

• Pin root development tooling exactly to firebase-tools@15.24.0 from the public npm registry.
• Provision Java 21 explicitly in the Rules and commerce-emulator jobs while retaining Node 20, committed installs, Firestore-only scopes, and explicit demo-* projects.
• Make both emulator jobs exact, read-only, credential-free parsed contracts: checkout credentials are not persisted, lifecycle scripts are disabled, and tests reject skips, ignored failures, extra commands, unexpected env/permissions/defaults, hosted projects, broader emulator scope, floating/global tooling, and npm lifecycle-hook bypasses.
• Record the Java 21 compatibility boundary in current engineering, security, operations, supply-chain, and officer evidence without presenting source or tests as production deployment.

RED and regression evidence

On exact base 8a5b0cc513bf72ff87d88d7956714184319a1be6, the new focused tests failed because CI still selected Java 17 and the manifest still specified ^13.7.0. After the change, the focused dependency/workflow set passes 23/23 and the complete static workflow/release/dependency/artifact set passes 58/58.

The first independent review found that required substrings could be retained as decoys around fail-open or extra commands. The repair now binds the complete parsed jobs and package-script lifecycle; all reported bypass mutations fail, and three independent re-reviews approve 23c27f55d8d1e202261b6070b837a245e51fea44 with no remaining findings.

Local verification

• Clean Node 20/npm 10 root install with lifecycle scripts disabled: 2,230 installed dependencies.
• Root full audit: 64 findings (2 critical, 32 high, 17 moderate, 13 low) to 58 (0 critical, 24 high, 21 moderate, 13 low).
• Root production audit: unchanged at 3 findings (0 critical, 2 high, 0 moderate, 1 low); no new production critical/high finding.
• Lock review: one CLI at 15.24.0; sole protobufjs 7.6.5 and tar 7.5.21; 194 records added, 116 removed, 62 retained records changed; every resolved record uses the public registry with SHA-512 integrity.
• Deliberate Java 17 probe: rejected before emulator startup with the CLI 15 pre-Java-21 compatibility error.
• Java 21 Rules emulator: 378/378 passed under demo-rules-test.
• Java 21 commerce concurrency emulator: 63/63 passed under demo-pay002b2-test.
• Credential-inaccessible Java 21 Auth/Firestore/Functions readiness smoke: all three loopback ports became ready under demo-mprc-local; no Function or provider was invoked.
• Functions lockfiles: byte-identical to base. Lint passed; Jest passed 65 suites plus 2 skipped, 6,231 tests plus 64 skipped. Full/production audits remain the pre-existing 12/10 findings.
• Frontend exact-record lint gate: 111 files with the reviewed 113-error/6-warning debt baseline; no drift.
• Frontend Jest: 14/14 suites and 727/727 tests passed. SPA suite: 11/11 passed.
• Diagnostic production build passed. Clean baseline and upgraded builds contain the same 59 files and 19,520,717 bytes, byte-for-byte; 49 non-map files also match.
• YAML safe parse, dependency tree, release validation, artifact safety, diff check, and clean-worktree checks passed.

Hosted verification

• PR CI run 29926297611 belongs to exact head 23c27f55d8d1e202261b6070b837a245e51fea44.
• Frontend, Functions, commerce emulator, Rules emulator, and artifact scrubber jobs all passed every declared step; none was skipped or ignored.
• Netlify redirect and deploy-preview checks passed. Header/page-change checks were skipped because this PR does not change those files. A preview status is not production publication or live-behavior proof.

Compatibility, residual risk, and rollback

Node remains 20. Repository-owned emulator work now requires Java 21; Java 17 is intentionally unsupported. No schema, migration, public bundle, Function, Rule, Firebase configuration, or provider behavior changes.

The remaining root and Functions audit findings stay open for separate atomic supply-chain slices. A green PR or main CI run proves source/test behavior only. Roll back by reverting this PR, but doing so restores both critical CLI advisory groups and the obsolete Java 17 emulator boundary.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	23c27f5
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a60cc5937205f0008a3ec5d
😎 Deploy Preview	https://deploy-preview-456--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.