Phase 7a App Check: infrastructure ready, enforcement deferred

Decision

Keep the App Check wrapper plumbing in place but do not enforce App Check on any web callable — enforcement stays deferred until a non-ReCaptcha web attestation path is available. Mobile App Check via native attestation is unaffected.

Why

Original audit listed App Check as a launch blocker; on review, the only web provider Firebase offers is ReCaptcha — which the project has now ruled out (see 2026-06-10-no-recaptcha-ever). Web App Check enforcement stays deferred until a non-ReCaptcha path exists. The wrapper plumbing is kept so individual callables can opt in once a provider is wired.

Impact

• onZodCall wrapper retains an enforceAppCheck?: boolean option. Default is OFF; no callable currently opts in.
• firestore.rules and storage.rules keep signedIn() as request.auth != null only — no request.app predicate, since clients wouldn't be sending App Check tokens.
• Mobile App Check (V2) still goes through @react-native-firebase/app-check with native attestation — that path doesn't involve ReCaptcha and is unaffected.
• Anti-abuse for the two public callables (fileGrievance, requestWaitlistSignup) falls back to server-side IP rate limiting, which both already implement.
• Related: 2026-06-10-no-recaptcha-ever.

Status

Superseded by 2026-06-28-phase-7a-app-check-enforcement — a Firebase CustomProvider backed by an Admin-SDK mint endpoint closed the gap without reintroducing ReCaptcha.

Sources

• .context/wiki/decisions/* § "2026-06-10 — Phase 7a App Check: infrastructure ready, enforcement deferred"