Repository navigation
MEMBERS-DIRECTORY-001 — Add a private opt-in officer photo directory #504
Description
Officer impact: Authorized officers will be able to type a person's name and see only the display name and voluntary profile thumbnail of website-account holders who explicitly opted into this optional people finder. This is not an official membership roster and does not prove membership or account authority.
Officer documentation: Update OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/SYSTEM_MAPS.md and its text alternative, and docs/officers/GLOSSARY.md.
Deployment evidence: None at issue creation. Closure requires reviewed source, green focused and full checks, isolated synthetic Firebase proof, exact Firestore/Functions/index deployment and readback, website publication, runmprc.com verification, privacy-notice publication, opt-out/removal proof, and a backup-officer walkthrough. Until every affected surface is proven, this directory is NOT AVAILABLE YET.
Product contract
This issue interprets 'search people's faces / names' as a photo-assisted name search: an authorized officer enters a bounded name query and visually reviews voluntary profile thumbnails. It explicitly excludes uploading a face as a query, facial recognition, face embeddings/templates, similarity scoring, or automated identification. Any biometric feature requires a separate owner/legal/privacy decision and threat assessment.
The optional people finder is separate from the official membership roster, website-role administration, registrations, payments, and membership authority. Turning it off removes a person from this finder; it does not delete or hide records an officer is otherwise authorized to use for an official operational purpose.
Invariants
- Missing preference means hidden. Existing and new accounts are not searchable by default. An opted-in account with no valid current display name is also hidden while retaining an available opt-out control.
- Only the signed-in person may upload, replace, remove, or change visibility for their own thumbnail.
- Consent wording names the officer-only finder, displayed fields, storage purpose, removal behavior, and current privacy contact. Photo upload does not silently enable discoverability.
- The server decodes and re-encodes a bounded static JPG, PNG, or WebP into one thumbnail, strips metadata, rejects malformed/spoofed/animated/oversized input, and never stores the original.
- Directory data lives in a separate server-owned projection. Results contain only an opaque entry reference, current display name, and optional thumbnail bytes/version. They never contain email, phone, role, UID, provider ID, membership/payment state, notes, or source documents.
- Name search is bounded, server-side, prefix-oriented, rate-limited, and capped. The browser never downloads the full members collection for this finder.
- Current verified admin is the compatibility authorization boundary until scoped officer capabilities are available. Browser UI is guidance only; each Function verifies the token independently.
- Photo delivery is authenticated and no-store. No permanent public Firebase download-token URL is created.
- Opt-out hides the projection before success. Photo removal is separate and retry-safe.
- Audits contain actor/capability, fixed action/purpose category, request ID, outcome, and counts only—never raw query text, names, photos, result identities, or request bodies.
- No real member photo/data appears in tests, screenshots, logs, issues, build artifacts, analytics, or AI tools.
Acceptance criteria
- A signed-in account can upload, preview, replace, and remove a synthetic profile thumbnail.
- A separate explicit toggle defaults off and truthfully controls inclusion in the optional officer finder.
- Photo upload alone never enables searchability; opt-out never deletes official account/membership records.
- An authorized officer can submit a bounded name prefix and receive at most the approved result limit with accessible photo/name cards.
- Anonymous, ordinary member, unverified admin-claim, malformed, stale, replayed, and over-limit requests fail generically without enumeration or partial data.
- Results never expose unapproved fields, even when source member documents later gain extra fields.
- Name changes, opt-in/out races, photo replacement/removal, duplicate commands, stale revisions, and partial failures converge safely.
- Image tests cover real synthetic generated pixels plus malformed, spoofed content-type, oversized dimensions/bytes, metadata, animation, and output-size bounds.
- Rules deny every direct browser read/write to projection, photo, audit, and command records.
- Logs, errors, analytics, audits, filenames, URLs, and test artifacts contain no photo/name/query canaries.
- Backend deploys and verifies before the dependent website; a skipped or partial Firebase step publishes nothing.
- The public privacy notice and officer guide describe current verified behavior and deletion/backup limitations without treating promotional-event photo language as directory consent.
Required split
- Profile thumbnail and opt-in preference: pure validation/state contracts, server endpoints, private persistence, Rules/tests, and My Account UI.
- Officer name search: minimal server projection, verified-admin compatibility guard, bounded search/audit, separate admin route, and tests.
- Release: fixed deploy/readback scope, privacy/officer documentation, isolated staging, backend-first publication, opt-out/removal/cache proof, and rollback/safe-roll-forward.
Each child must be independently reviewable and must preserve this complete outcome.
Dependencies and coordination
- DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 owns the broader field-by-field minimization/retention matrix. This issue uses the narrowest behavior—explicit opt-in, no original retained, active thumbnail removed on request, no biometric data—and must add the new categories and any unresolved backup SLA to that decision record before live closure.
- MEMBERS-ROSTER-001 — Add officer-only member roster view and safe CSV export #116 remains the official membership roster/export. Do not merge these concepts or infer current membership from this directory.
- AUTH-003 and ADMIN-001 own future scoped capabilities, MFA/recent-auth policy, and shared privileged audit. Current verified admin may be used only as the documented compatibility boundary; do not invent an MFA duration.
- BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113/CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136 and the protected release work own provider inventory, deployment authority, and staged/live evidence.
Explicitly out of scope
- Facial recognition, image-to-person search, biometric templates, or similarity matching.
- Public/member-wide directory access, official membership roster/export, role changes, account linking, payments, registration, or provider migration.
- Real production data inspection, bulk photo import, copying Auth/provider photo URLs, or manual Firebase-console repair.
Claim protocol
This parent coordinates focused children and is not itself a file claim. Each implementation child must be assigned and receive a timestamped CLAIMED comment naming its branch before edits. Earliest valid claim wins.
Activity
daliu commentedon Aug 1, 2026
CHILD STATUS UPDATE — #506 COMPLETE; #507 REMAINS GATED
#506 / PR #529 is merged at exact main
9e61a023301d10c0580253738e67cbc7867ea38b; exact-main CI30712502828passed all five required jobs. The implementation claim is released: #506 (comment)This does not complete parent #504. The source includes the opt-in/profile-photo surface and bounded administrator name-prefix finder, but production is unchanged: Netlify attempt
6a6e3a33b38152000890171askipped deployment, the public release marker remains the prior containment artifact, and Firebase was not deployed.#507 remains the release owner and is blocked by #110 privacy/retention/backup/removal approval, AUTH-003 finder-specific scoped authorization, #133 protected short-lived release identity and named approvers, isolated synthetic staging, backend-first deployment/readback, and dry-run repair/backfill plus required-index READY evidence.
Officer impact: No live officer workflow changed; reviewed source and guides are ready for the protected release after its gates are met.
Officer documentation:
OFFICER_START_HERE.md,docs/officers/README.md,docs/officers/EVENTS_SHOP_MEMBERS.md,docs/officers/ACCESS_CONTINUITY.md,docs/officers/SYSTEM_MAPS.md, anddocs/officers/GLOSSARY.md.Deployment evidence: preview verified; production website publication skipped;
runmprc.commarker unchanged; Firebase and outside providers unchanged; production behavior not yet verified.daliu commentedon Aug 8, 2026
PRODUCTION AUDIT UPDATE — 2026-08-08T06:52Z
Source remains intact and green on exact current main
b94622bd42775d84704d5fc05ee87da81f5a76e0, but the feature is still not release-complete.An unexpected manual Netlify promotion of PR #615 deploy-preview
6a6f038b9701b00008066000placed the profile-photo/searchability/People-finder frontend onrunmprc.comwithout the release marker or available directory callable endpoints. There is no directory Rules/index/Functions live readback. This is a split frontend/backend incident, not successful #504/#507 deployment.Containment is isolated in #617. The verified target is prior bounded web deploy
6a6dc9ea588b0c0008036312; production mutation is stopped until a named backup officer approves and Netlify exposes an exact supported pointer-restore action. No Firebase, DNS, provider configuration, account/member/payment/event state, or production data was changed.daliu commentedon Aug 13, 2026
Coordination from new unclaimed #623 WEB-002C: this child publishes only #621's inert disabled/no-directory-call interface through a frozen source projected from current live
39ab8649.... It does not connect #505/#506, flip availability, deploy Firebase Rules/indexes/Functions, approve privacy/retention, use real names/photos, or satisfy #507. Production backend and data remain unchanged. #504 remains the feature parent and #507 remains the later connected/backend-first release.daliu commentedon Aug 13, 2026
Coordination from claimed child #627: this child owns only the seven enumerated Account/profile/People-finder frontend paths plus four separately named current-truth documentation hunks. It keeps memberDirectoryAvailability.ts byte-for-byte false and the published preview inert. It adds display-name eligibility truth, accessibility, narrow-screen geometry, and stale file-read tests only. It does not claim #507 privacy approval, scoped authorization, staging, backend deployment/readback, availability flip, publication, or live proof.
18 remaining items
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination from /root after released #643: proposed MEMBERS-DIRECTORY-001N — Preserve deliberate focus during confirmed photo changes, from exact main 6b6a597 / tree a07d391b8e23e28dd39785329be444f452fa2953. Exact proposed scope: MemberDirectoryProfile.tsx and its test; separate 001N hunks in SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, and SECURITY.md; and only the optional-directory one-sentence text alternative plus one no-terminal evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. Confirmed upload/remove will restore only focus displaced from the exact initiating Save/Remove and preserve deliberately selected connected focus. No CSS, Mermaid, Account/Admin/service, Function, Rule, index, provider, data, sign-in, deployment, release, or availability change; availability stays literal false. No issue, branch, claim, or edit exists yet. Send STOP only for exact outcome/path-hunk overlap; claim will remain active until explicit release.
daliu commentedon Aug 14, 2026
#645 COMPLETE / CLAIM RELEASED. PR #646 merged as exact main
0f421e6d1ffc454aa1de09d342d7b70d3fbd2388, tree292cc0cd87e3246d1b2976a15f2d48bc7b3dce93; exact-main CI31761911555passed 5/5. The child changed only its six claimed profile-focus/test/current-source documentation paths. Availability remains hardfalse, live #623 remains inert, and no backend/provider/data/live action occurred. #504 remains the coordinating parent; #645's exact hunks are released.daliu commentedon Aug 14, 2026
PRE-CLAIM coordination proposal from
/rootafter released #645:MEMBERS-DIRECTORY-001O — Preserve visibility-toggle focus after authoritative settlement, from exact released main0f421e6d1ffc454aa1de09d342d7b70d3fbd2388, tree292cc0cd87e3246d1b2976a15f2d48bc7b3dce93. Proposed exact ownership:src/pages/account/MemberDirectoryProfile.tsxonly an exact-operation focused-visibility intent and guarded ready-state handoff;src/pages/account/MemberDirectoryProfile.test.tsxone separately named 001O block; one separate 001O current-source hunk each inSYSTEM_DESIGN.md,IMPLEMENTATION_PLAN.md, andSECURITY.md; and only the optional-directory one-sentence text alternative plus one no-terminal 001O evidence procedure indocs/officers/EVENTS_SHOP_MEMBERS.md. A focused visibility checkbox may regain focus after its exact current confirmed or definitively rejected mutation completes authoritative readback, only when focus was otherwise lost; any other connected focus is preserved. Unknown/readback failure remains #637 Reload recovery. No CSS or Mermaid change. Availability remains byte-for-bytefalse. Exclude Account/profile-name, photo focus, admin finder, services, backend, Functions, Rules, indexes, packages, workflows, #507 gates, provider/data/deploy/account/sign-in/live work, real names/photos, and biometrics. #504 remains only the coordinating parent. No issue, branch, edit, or claim exists yet. Send STOP only for exact path/hunk collision or dependency.daliu commentedon Aug 14, 2026
#647 COMPLETE / CLAIM RELEASED. PR #648 merged as exact main
161ebb80f951651484a7592fd0e504649d3d1035, treef5f598aab4efb8a4ad7d8668be2ad2e4b6a9ad7f; exact-main CI31763730376passed 5/5. The child changed only its six claimed visibility-focus/test/current-source documentation paths. Availability remains hardfalse, live #623 remains inert, and no backend/provider/data/live action occurred. #504 remains the coordinating parent; #647's exact hunks are released.daliu commentedon Aug 14, 2026
PRE-CLAIM coordination proposal from /root after released #647: MEMBERS-DIRECTORY-001P — Announce and focus a successful profile-settings reload, from exact released main 161ebb8. Proposed exact ownership: src/pages/account/MemberDirectoryProfile.tsx only a dedicated top-of-ready-controls Reload result plus exact-lifetime/load focus intents and result ref; src/pages/account/MemberDirectoryProfile.test.tsx one separately named 001P block; src/pages/account/Account.css only the result focus outline; one separately named 001P current-source hunk each in SYSTEM_DESIGN.md, IMPLEMENTATION_PLAN.md, and SECURITY.md; and only the optional-directory one-sentence text alternative plus one no-terminal 001P evidence procedure in docs/officers/EVENTS_SHOP_MEMBERS.md. No Mermaid change because the existing ready-controls/status structure, data movement, permissions, ownership, and topology do not change. Every valid explicit current Reload success shows the fixed polite atomic result “Profile photo and officer finder settings reloaded.” before the recovered controls. Only a Reload button that actually owned focus may arm exact-load success focus; after that exact guarded success, focus moves to the result only from null/body/document root/disconnected focus, while any connected deliberate focus is preserved. Initial loads, failed Reloads, programmatic/unfocused activation, stale app/UID loads, and unmount cannot transfer success focus; #637 replacement-Reload failure focus stays unchanged. Availability remains byte-for-byte false. Exclude Account.tsx/admin/services/backend/Functions/Rules/index/packages/workflows/#507/provider/data/deploy/account-sign-in/live work, real names/photos, and biometrics. No issue, branch, edit, or claim exists yet. #504 is only the coordinating parent; send STOP only for an exact path/hunk collision or dependency.
daliu commentedon Aug 14, 2026
SCOPE WORDING CORRECTION before documentation edits: the exact seven-path ownership is unchanged, but the visible successful-Reload result is a new page-structure node. Repository continuity policy therefore requires the existing optional-directory Mermaid in docs/officers/EVENTS_SHOP_MEMBERS.md to change together with its one-sentence text alternative and the 001P no-terminal procedure. Data movement, permissions, ownership, deployment, backend, provider, and live topology remain unchanged. This correction supersedes only the earlier “no Mermaid change” phrase; every runtime invariant, exclusion, protected #616 boundary, false availability requirement, exact branch/base/tree, and seven-path claim remains unchanged.
daliu commentedon Aug 14, 2026
RELEASE NOTICE — child #649 is complete and released on exact main 4f11ddd after PR #650. Exact-main CI 31766093106 is 5/5 green; Netlify attempt 6a7e879737447b0008b8f0b4 is unpublished; live #623 remains unchanged. The seven #649 paths are released.
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination proposal from /root after released #649: a source-only AUTH-006G child would add fixed confirmed profile-name Save feedback and an exact non-stealing focus handoff in current My Account. It changes no directory component/service/availability, search, photo, preference, backend, data, or #507 gate. Proposed seven paths are Account.tsx/test/Account.css and separate AUTH-006G hunks in SYSTEM_DESIGN, IMPLEMENTATION_PLAN, SECURITY, and the existing My Account profile-name officer diagram/text/procedure only. No issue, branch, edit, or claim exists. Send STOP only for exact overlap/dependency.
daliu commentedon Aug 14, 2026
RELEASE NOTICE from /root: AUTH-006G #651 merged through PR #652 at exact main
cfe03c66b8f443cb4e160a80d335d966ba268e27(treecd8c32d73021b026e145325d968f0a3cedf9bbff) and its exact seven-path claim is released. The slice changed only confirmed My Account name-save feedback/focus plus separately named documentation. It preserved #531 lifecycle fences, directory availability literalfalse, every #507 connection/release gate, and active #616 files/hunk. Exact-main CI31768544349passed 5/5; the automatic Netlify main attempt stopped unpublished, and production remains inert #623. No Firebase, provider, account/sign-in, production-data, or live action occurred.daliu commentedon Aug 14, 2026
PRECLAIM — AUTH-006H current-user profile-save unconfirmed-result focus (source only).
Base: exact current
origin/maincfe03c66b8f443cb4e160a80d335d966ba268e27; treecd8c32d73021b026e145325d968f0a3cedf9bbff.Invariant: when one exact current admitted full-name Save owned focus and its update rejects or its authoritative confirmation reread is missing/rejected, preserve the existing fixed unconfirmed truth and recovery control, but transfer otherwise-lost focus exactly once to that connected alert. The intent contains only profile generation + attempt ID, transfers only in the current catch, is consumed before target checks, restores only null/body/document-root/disconnected focus, and never steals any other connected focus. Unfocused/programmatic Save and initial/background load failure remain focus-inert. Focus targets the result alert, not
Try profile again; next Tab reaches that existing recovery action.Requested exact paths:
src/pages/account/Account.tsx,src/pages/account/Account.test.tsx,src/pages/account/Account.css,SYSTEM_DESIGN.md,IMPLEMENTATION_PLAN.md,SECURITY.md,docs/officers/EVENTS_SHOP_MEMBERS.md. Runtime hunk is limited to the existing #651 focus token/effect, the current catch, and the existing profile alert; CSS only adds bounded alert/focus rules. Documentation gets a separate AUTH-006H boundary/procedure and matching My Account diagram/text alternative.Explicit exclusions: the settlement after clicking
Try profile again; initial-load focus; validation error association/aria-invalid; Edit-to-input focus; Cancel-to-Edit focus; changed success truth or #651 semantics; service contract/payload/call counts; Functions, Rules, schema, index, package, workflow, provider, account/sign-in, production data, deployment/publication/live proof; directory connection/availability and active #616 Strava work.Collision audit at exact base: #651 is CLOSED and its seven-path claim explicitly RELEASED; open PR list is empty; open repository issue search for
profile save focusis empty; #651 names this as a separate follow-up. #504/#507 remain coordination/release gates. Active #616 ownsfunctions/strava.js,functions/strava.test.js, and a separate SECURITY RISK-024 hunk, all disjoint and to be preserved. No source/doc edit, issue, branch, provider, or data action preceded this notice. Send STOP only for exact path/hunk collision or dependency. The eventual claim remains active until reviewed merge/audit/closure and explicit release.daliu commentedon Aug 14, 2026
RELEASE notice from /root: AUTH-006H #653 / PR #654 is merged and released on exact main
75a4f1ee3b20f61d375ed6d786e67e056a2206ef. Its seven-path claim is free. It changed only current My Account unconfirmed-save focus; optional-directory availability remains byte-for-bytefalse, live #623 remains inert, and #504 coordination/source behavior is unchanged.daliu commentedon Aug 14, 2026
PRECLAIM from /root at 2026-08-14T04:49:31Z — proposed AUTH-006I current-user Profile Edit-to-input focus, source only, from exact main
75a4f1ee3b20f61d375ed6d786e67e056a2206ef/ tree6036ac48fd2c28f0cc0c05d5b1be09a7d812783e. Only when the exact connected current Profile Edit button owns focus as the ready profile enters editing, one generation-only intent may restore otherwise-lost null/body/document-root/disconnected focus to the existing Full name input; the intent is consumed before checks, leaves retained input focus alone, preserves every other connected focus, and is inert for programmatic/outside activation, context/resource/UID/generation change, reload, Save, Cancel, stale work, or unmount. No call, payload, state truth, CSS, backend, provider, account, data, deployment, or live behavior changes. Proposed exact paths: Account.tsx/test; separate AUTH-006I hunks in SYSTEM_DESIGN and IMPLEMENTATION_PLAN; one separate AUTH-006I/RISK-039 SECURITY row after released AUTH-006H; and only the existing My Account profile-name Mermaid/text alternative plus one no-terminal AUTH-006I procedure in the officer guide. #651/#653 claims are released; no open PR or Edit-to-input issue/claim exists. No issue, branch, or source edit preceded these coordination notices. Directory availability remains literal false and #504 remains coordination-only; no directory behavior changes. Send STOP only for exact overlap or a dependency.daliu commentedon Aug 14, 2026
RELEASE notice from
/root: AUTH-006I #655 / PR #656 is complete and explicitly released. Exact main is3265a55cb92df1ebb5401f2647ff81e4ca3af0b8, tree322468cc75a57f7ea392eb9f57a201fb11c4b35a; exact-main CI31772914108passed 5/5. The six paths (Account.tsx,Account.test.tsx, SYSTEM_DESIGN, IMPLEMENTATION_PLAN, SECURITY, and EVENTS_SHOP_MEMBERS) are free for later coordinated work.No directory connection, backend, Function, Rule, provider, account/sign-in, production-data, publication, or live action occurred. Directory availability remains blob
295909b0df8dd7c54a0f164f99d4943656aece4band literalfalse; #507 retains every connection/live-proof gate. Active #616 Strava blobs remain2eb48945061ab5ad2a896c6835f308cefd7fe63aandd1792d390bd57608fecab84341a6e5916fcf8196, and its separately named RISK-024 hunk is unchanged. Production remains inert #623.daliu commentedon Aug 14, 2026
PRE-CLAIM disjointness notice for #657, WEB-UX-004 — Move focus to main content after SPA path navigation.
Exact proposed base is main
3265a55cb92df1ebb5401f2647ff81e4ca3af0b8, tree322468cc75a57f7ea392eb9f57a201fb11c4b35a. Proposed ownership is exactly four paths:src/components/ScrollToTop.jsxonly a pathname-bound, cancelable, one-shot main-focus settlement while preserving its scroll effect;src/App.jsxonly the existing main landmark's stable target relationship andtabIndex={-1}; existingsrc/App.test.jsxonly one separately named WEB-UX-004 generated focus/race matrix and real-shell proof; anddocs/officers/PUBLISH_AND_CHECK.mdonly one separately named no-terminal route-focus verification procedure adjacent to the historical #291 keyboard procedure.There is no new test file, lint-baseline change, CSS change, root-document change, Navbar/Footer/route-page change, backend/service/Rules/Functions/index/package/workflow change, provider/account/sign-in/data action, deployment/publication action, or live claim. Released #291 visible-focus/skip-link behavior and #490 mobile disclosure/close behavior remain immutable. #504 stays the disconnected directory coordinator, #507 retains every future connection/release gate, and availability stays byte-for-byte literal false. #616 retains both Strava Function paths and its separate OAUTH/RISK-024 SECURITY hunk. #133/#136/#460 retain their separate future publication procedures; this new guide hunk is separately named.
Issue creation is not a claim. No source or documentation edit has been made. Send STOP only for an exact path/hunk collision or dependency; otherwise no reply is required. The exact issue/claim/open-PR state will be reread immediately before editing.
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination for #659 / WEB-002D. This is a bounded public accessibility release only.
memberDirectoryAvailability.tsremains byte-for-byte literalfalse; #507 retains every privacy, authorization, backend-first, staging, availability-flip, publication, and connected-live gate; #504 remains the directory coordinator. The frozen source includes no Account/profile directory runtime, admin finder, member-directory service, callable, photo/name search, provider, production data, real account, or biometrics. The release preview and public checks remain signed out and use no real data. Send STOP for an exact dependency or release-gate collision.