Repository navigation
MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507
Description
Parent: #504. Depends on #505 and #506 merged source.
Officer impact: Makes the reviewed My Account photo/discoverability controls and separate officer name-search gallery available through the no-terminal website path, with a documented stop/undo/escalation procedure.
Officer documentation: Finalize OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/SYSTEM_MAPS.md and text alternative, docs/officers/GLOSSARY.md, and the public Privacy notice with approved owner wording/effective date.
Deployment evidence: Closure requires exact Firebase Rules/Functions/index readback, dependent website revision, Netlify/runmprc.com revision verification, synthetic opt-in/search/opt-out/photo-removal proof, rollback/safe-roll-forward rehearsal, and backup-officer walkthrough. Green source checks alone are insufficient.
Atomic outcome
Extend the fixed protected release gate to deploy and read back exactly the directory Rules/indexes/Functions before publishing the dependent website, then prove the feature in isolated staging and the approved production target using generated synthetic non-face images and made-up accounts only.
Preconditions
- MEMBERS-DIRECTORY-001A — Add private profile thumbnail and opt-in preference #505 and MEMBERS-DIRECTORY-001B — Add bounded officer name search and photo gallery #506 are merged and independently approved.
- DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 records the approved narrow data categories and unresolved backup limitations: processed thumbnail only, discoverability preference, minimal directory projection, minimal audit; no original or biometric template.
- The owner approves exact Privacy notice wording/effective date, officer audience, optional-finder purpose, active-data removal behavior, backup/cache limitation, and contact path.
- CI-001C — Configure protected short-lived Firebase deployment identity #133 or an equivalent protected short-lived deployment identity and named approvers are configured; no downloadable service-account key.
- Isolated staging does not target production Auth/Firestore/Functions.
Acceptance criteria
- Workflow accepts only one fixed release plan and exact current main commit/checks; wrong branch/commit/project/scope/authority/artifact fails before deploy.
- Exact Firestore Rules, indexes, and named directory/profile Functions deploy and are read back before any website publication. Skipped, partial, or mismatched backend publishes nothing.
- Synthetic staging proves default hidden, upload without opt-in, opt-in search, bounded result, opt-out immediate absence, separate photo removal, exact retry, stale command, access denial, and no raw/photo/query log leakage.
- Rollback or safe roll-forward handles backend-before-frontend and frontend-before-backend incompatibility without widening Rules or editing records manually.
- The approved website is published through the controlled host path and exact revision is verified on runmprc.com.
- One synthetic production smoke repeats only non-destructive default/opt-in/search/opt-out/removal checks; no real member/admin record or photo is used.
- Public Privacy and officer docs match verified behavior, explicitly say no face recognition, and distinguish optional finder from official roster/account administration.
- A backup officer with no terminal completes purpose, prerequisites, steps, expected result, stop conditions, success proof, undo, and escalation walkthrough.
- Issue/PR closure reports separately: source changed, tests passed, merged, release approved, Rules/indexes deployed, Functions deployed, website published, runmprc.com verified, privacy notice verified, production data touched (none beyond synthetic), and live behavior verified.
Stop conditions
Stop on missing policy wording/owner, real data, broad provider authority, unisolated staging, backend mismatch, skipped deployment, long-lived/public photo URL, any biometric feature, raw query/name/photo in evidence, or a request to repair production records manually.
Claim protocol
Do not claim until #505/#506 are merged and owner/deployment preconditions are satisfied. Then assign and comment CLAIMED by at ; branch before editing release/provider files.
Activity
daliu commentedon Aug 1, 2026
RELEASE CONTRACT CLARIFICATION — readback must cover all six exact runtime exports:
getMyMemberDirectoryProfile,setMyMemberDirectoryVisibility,setMyMemberDirectoryPhoto,removeMyMemberDirectoryPhoto,searchMemberDirectory, andsyncMemberDirectoryEntryOnMemberWrite. For the Firestore trigger, verify the deployed idempotent retry/failure policy as well as its name and revision.Before publication, prove an idempotent, dry-runnable projection repair/backfill path or explicitly prove there can be no pre-existing preference records in the approved target. The repair must re-read current member/preference/photo state, hide/delete malformed or opted-out entries, use the deployed schema/normalization version, expose no roster/query/photo data, and be owned for later schema or normalization upgrades. A console edit is not an acceptable repair.
MEMBERS-DIRECTORY-001B: add bounded people finder (#529)
daliu commentedon Aug 1, 2026
PRE-CLAIM RELEASE AUDIT — BLOCKED, NO DEPLOYMENT
Read-only audit at 2026-08-01T18:41Z, refreshed through #531 at 18:58Z. This is not a #507 claim and changed no provider, account, or production data.
Satisfied source evidence:
9e61a023301d10c0580253738e67cbc7867ea38bis an ancestor of audited main86960409ffb527432cf4ae6f1713d663420c267e.30713640075and exact-main CI30713736965each passed all five required jobs.Current blockers:
status:blocked-owner; the public Privacy page still saysREPLACE WITH DATEandPlaceholder template. There is no approved finder audience/purpose, active-removal behavior, cache/backup limitation, contact path, owner, or review date.admincompatibility boundary; no finder-specific capability or approved MFA/recent-auth policy exists. AUTH-001 is partial and AUTH-002A/AUTH-002A — Retire the legacy static-key membership sync before manual onboarding #117 remains open.stagingenvironment.productionnow exists but has zero protection rules, no branch policy, administrator bypass enabled, zero environment variables, and zero environment secrets. Repository Actions likewise exposes zero variables and zero secrets. This supersedes older evidence saying the environment did not exist; existence is not protection..github/workflows/deploy.ymlaccepts onlyprofile-recovery, deploys only Rules pluscreateMemberOnSignUpandensureMemberProfile, and publishes only a GitHub Pages copy. It omitsfirestore:indexes, all six directory exports, index READY readback, trigger retry-policy readback, repair/backfill, and the live Netlify host.Hosted readback:
6a6dc9ea588b0c0008036312from control commit9ad6837756cdd409d296009fde5082eeeae5c059.6a6e41cca813630008037a4aisstate=errorwith nopublished_at; it did not replace production.39ab8649df411262c8109a3c81a57bc38f1e168b, which lacks the directory frontend/backend files.Do not dispatch the current
profile-recoveryworkflow, activate the old one-use Netlify manifest, manually publish, add a long-lived key, or test a real name/photo/account. Resume only after the #110 decision, finder-specific authorization, #113/#133 staging and protected identity, and the #460-or-bounded-Netlify publication choice are complete. Then add/review the fixed directory release plan, repair proof, exact backend readback, staged matrix, and rollback before production.Officer impact: The Account photo/searchability controls and People finder remain unavailable to officers and members in production.
Officer documentation: Current source guides correctly remain marked
NOT AVAILABLE YET; no wording was changed by this audit.Deployment evidence: source and exact-main CI verified; Netlify production unchanged;
runmprc.commarker unchanged; Firebase and outside-provider state unverified and untouched; production behavior not live.21 remaining items
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination from /root after released #643: proposed source-only MEMBERS-DIRECTORY-001N will contain confirmed Account photo upload/remove focus handoffs so only an exact focused initiating Save/Remove can regain displaced focus, while another connected focus is preserved. Exact six-path scope is MemberDirectoryProfile.tsx/test plus separate 001N hunks in SYSTEM_DESIGN, IMPLEMENTATION_PLAN, SECURITY, and the optional-directory text alternative/procedure. It changes no privacy wording, authorization, service, backend, staging, availability, provider, data, publication, or live behavior. Availability stays literal false at blob 295909b0df8dd7c54a0f164f99d4943656aece4b; #507 retains every connection and release gate. No issue/branch/edit/claim exists. Send STOP only for exact overlap/dependency.
daliu commentedon Aug 14, 2026
#645 COMPLETE / CLAIM RELEASED. The source-only confirmed-photo focus hardening merged as exact main
0f421e6d1ffc454aa1de09d342d7b70d3fbd2388, with exact-main CI31761911555green.memberDirectoryAvailability.tsremains literalfalse; the exact-main Netlify attempt is unpublished and production remains inert #623. No privacy-policy, capability, Firebase, Rules/index/Functions, provider, account/sign-in, production-data, publication, or live connected action occurred. #507 retains every connection/release gate; #645's exact hunks are released.daliu commentedon Aug 14, 2026
PRE-CLAIM boundary proposal from
/rootafter released #645: source-onlyMEMBERS-DIRECTORY-001Owould restore otherwise-lost keyboard focus to the exact visibility checkbox that admitted one current mutation, after confirmed success or definitive rejection plus authoritative readback. It changes no request, response, service, authorization, privacy wording, backend, Rules/index/Functions, provider, data, availability, deployment, or live behavior; any other connected focus remains untouched and unknown/readback failures retain Reload recovery. Proposed scope is the two existingMemberDirectoryProfileruntime/test files plus separately named 001O hunks inSYSTEM_DESIGN.md,IMPLEMENTATION_PLAN.md,SECURITY.md, and the optional-directory text alternative/procedure only. No CSS/Mermaid. Availability remains hardfalse; live #623 remains inert. #507 retains every privacy/capability/staging/backend-first/readback/availability-flip/publication/live-proof gate. No issue, branch, edit, or claim exists. Send STOP only for exact overlap/dependency.daliu commentedon Aug 14, 2026
#647 COMPLETE / CLAIM RELEASED. The source-only visibility-checkbox focus containment merged as exact main
161ebb80f951651484a7592fd0e504649d3d1035, with exact-main CI31763730376green.memberDirectoryAvailability.tsremains literalfalse; the exact-main Netlify attempt is unpublished and production remains inert #623. No privacy-policy, capability, Firebase, Rules/index/Functions, provider, account/sign-in, production-data, publication, or live connected action occurred. #507 retains every connection/release gate; #647's exact hunks are released.daliu commentedon Aug 14, 2026
PRE-CLAIM coordination proposal from /root after released #647: a source-only MEMBERS-DIRECTORY-001P child would add a fixed polite successful-Reload result to the preserved connected My Account directory interface and restore otherwise-lost focus to that exact result only when the current Reload button owned focus. It changes no profile value, request, result, service, authorization, privacy wording, backend, Rules/index/Functions, deployment, provider, data, or live behavior; availability remains hard false and live #623 remains inert. #507 retains every privacy/capability/staging/backend-first/readback/availability-flip/publication/live-proof gate. Proposed seven-path scope is MemberDirectoryProfile.tsx/test, scoped Account.css result-focus styling, separate 001P hunks in SYSTEM_DESIGN/IMPLEMENTATION_PLAN/SECURITY, and the optional-directory one-sentence text alternative/procedure only. No Mermaid change. No issue, branch, edit, or claim exists. Send STOP only for exact overlap or dependency.
daliu commentedon Aug 14, 2026
SCOPE WORDING CORRECTION before documentation edits: the exact seven-path ownership is unchanged, but the visible successful-Reload result is a new page-structure node. Repository continuity policy therefore requires the existing optional-directory Mermaid in docs/officers/EVENTS_SHOP_MEMBERS.md to change together with its one-sentence text alternative and the 001P no-terminal procedure. Data movement, permissions, ownership, deployment, backend, provider, and live topology remain unchanged. This correction supersedes only the earlier “no Mermaid change” phrase; every runtime invariant, exclusion, protected #616 boundary, false availability requirement, exact branch/base/tree, and seven-path claim remains unchanged.
daliu commentedon Aug 14, 2026
RELEASE NOTICE — source-only child #649 is complete on exact main 4f11ddd. Availability remains hard false and the exact-main Netlify attempt is unpublished; live #623 remains inert. #507 retains every privacy, capability, staging, backend-first deployment/readback, availability-flip, publication, and live-proof gate.
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination proposal from /root after released #649: source-only AUTH-006G would harden existing My Account profile-name Save feedback/focus after exact authoritative reread. It does not edit directory runtime, availability, privacy/capability policy, staging, backend, Functions, Rules/indexes, provider, data, deployment, or live state. #507 retains every directory connection and release gate. No issue, branch, edit, or claim exists. Send STOP only for exact overlap/dependency.
daliu commentedon Aug 14, 2026
RELEASE NOTICE from /root: AUTH-006G #651 merged through PR #652 at exact main
cfe03c66b8f443cb4e160a80d335d966ba268e27(treecd8c32d73021b026e145325d968f0a3cedf9bbff) and its exact seven-path claim is released. The slice changed only confirmed My Account name-save feedback/focus plus separately named documentation. It preserved #531 lifecycle fences, directory availability literalfalse, every #507 connection/release gate, and active #616 files/hunk. Exact-main CI31768544349passed 5/5; the automatic Netlify main attempt stopped unpublished, and production remains inert #623. No Firebase, provider, account/sign-in, production-data, or live action occurred.daliu commentedon Aug 14, 2026
PRECLAIM — AUTH-006H current-user profile-save unconfirmed-result focus (source only).
Base: exact current
origin/maincfe03c66b8f443cb4e160a80d335d966ba268e27; treecd8c32d73021b026e145325d968f0a3cedf9bbff.Invariant: when one exact current admitted full-name Save owned focus and its update rejects or its authoritative confirmation reread is missing/rejected, preserve the existing fixed unconfirmed truth and recovery control, but transfer otherwise-lost focus exactly once to that connected alert. The intent contains only profile generation + attempt ID, transfers only in the current catch, is consumed before target checks, restores only null/body/document-root/disconnected focus, and never steals any other connected focus. Unfocused/programmatic Save and initial/background load failure remain focus-inert. Focus targets the result alert, not
Try profile again; next Tab reaches that existing recovery action.Requested exact paths:
src/pages/account/Account.tsx,src/pages/account/Account.test.tsx,src/pages/account/Account.css,SYSTEM_DESIGN.md,IMPLEMENTATION_PLAN.md,SECURITY.md,docs/officers/EVENTS_SHOP_MEMBERS.md. Runtime hunk is limited to the existing #651 focus token/effect, the current catch, and the existing profile alert; CSS only adds bounded alert/focus rules. Documentation gets a separate AUTH-006H boundary/procedure and matching My Account diagram/text alternative.Explicit exclusions: the settlement after clicking
Try profile again; initial-load focus; validation error association/aria-invalid; Edit-to-input focus; Cancel-to-Edit focus; changed success truth or #651 semantics; service contract/payload/call counts; Functions, Rules, schema, index, package, workflow, provider, account/sign-in, production data, deployment/publication/live proof; directory connection/availability and active #616 Strava work.Collision audit at exact base: #651 is CLOSED and its seven-path claim explicitly RELEASED; open PR list is empty; open repository issue search for
profile save focusis empty; #651 names this as a separate follow-up. #504/#507 remain coordination/release gates. Active #616 ownsfunctions/strava.js,functions/strava.test.js, and a separate SECURITY RISK-024 hunk, all disjoint and to be preserved. No source/doc edit, issue, branch, provider, or data action preceded this notice. Send STOP only for exact path/hunk collision or dependency. The eventual claim remains active until reviewed merge/audit/closure and explicit release.daliu commentedon Aug 14, 2026
RELEASE notice from /root: AUTH-006H #653 / PR #654 is merged and released on exact main
75a4f1ee3b20f61d375ed6d786e67e056a2206ef. Its seven-path claim is free. #507 retains every privacy, authorization, staging, backend-first deployment/readback, availability-flip, publication, and live-proof gate; no connection or live action occurred.daliu commentedon Aug 14, 2026
PRECLAIM from /root at 2026-08-14T04:49:31Z — proposed AUTH-006I current-user Profile Edit-to-input focus, source only, from exact main
75a4f1ee3b20f61d375ed6d786e67e056a2206ef/ tree6036ac48fd2c28f0cc0c05d5b1be09a7d812783e. Only when the exact connected current Profile Edit button owns focus as the ready profile enters editing, one generation-only intent may restore otherwise-lost null/body/document-root/disconnected focus to the existing Full name input; the intent is consumed before checks, leaves retained input focus alone, preserves every other connected focus, and is inert for programmatic/outside activation, context/resource/UID/generation change, reload, Save, Cancel, stale work, or unmount. No call, payload, state truth, CSS, backend, provider, account, data, deployment, or live behavior changes. Proposed exact paths: Account.tsx/test; separate AUTH-006I hunks in SYSTEM_DESIGN and IMPLEMENTATION_PLAN; one separate AUTH-006I/RISK-039 SECURITY row after released AUTH-006H; and only the existing My Account profile-name Mermaid/text alternative plus one no-terminal AUTH-006I procedure in the officer guide. #651/#653 claims are released; no open PR or Edit-to-input issue/claim exists. No issue, branch, or source edit preceded these coordination notices. #507 retains every privacy, authorization, staging, backend-first readback, availability-flip, publication, and live-proof gate. Send STOP only for exact overlap or a dependency.daliu commentedon Aug 14, 2026
RELEASE notice from
/root: AUTH-006I #655 / PR #656 is complete and explicitly released. Exact main is3265a55cb92df1ebb5401f2647ff81e4ca3af0b8, tree322468cc75a57f7ea392eb9f57a201fb11c4b35a; exact-main CI31772914108passed 5/5. The six paths (Account.tsx,Account.test.tsx, SYSTEM_DESIGN, IMPLEMENTATION_PLAN, SECURITY, and EVENTS_SHOP_MEMBERS) are free for later coordinated work.No directory connection, backend, Function, Rule, provider, account/sign-in, production-data, publication, or live action occurred. Directory availability remains blob
295909b0df8dd7c54a0f164f99d4943656aece4band literalfalse; #507 retains every connection/live-proof gate. Active #616 Strava blobs remain2eb48945061ab5ad2a896c6835f308cefd7fe63aandd1792d390bd57608fecab84341a6e5916fcf8196, and its separately named RISK-024 hunk is unchanged. Production remains inert #623.daliu commentedon Aug 14, 2026
PRE-CLAIM disjointness notice for #657, WEB-UX-004 — Move focus to main content after SPA path navigation.
Exact proposed base is main
3265a55cb92df1ebb5401f2647ff81e4ca3af0b8, tree322468cc75a57f7ea392eb9f57a201fb11c4b35a. Proposed ownership is exactly four paths:src/components/ScrollToTop.jsxonly a pathname-bound, cancelable, one-shot main-focus settlement while preserving its scroll effect;src/App.jsxonly the existing main landmark's stable target relationship andtabIndex={-1}; existingsrc/App.test.jsxonly one separately named WEB-UX-004 generated focus/race matrix and real-shell proof; anddocs/officers/PUBLISH_AND_CHECK.mdonly one separately named no-terminal route-focus verification procedure adjacent to the historical #291 keyboard procedure.There is no new test file, lint-baseline change, CSS change, root-document change, Navbar/Footer/route-page change, backend/service/Rules/Functions/index/package/workflow change, provider/account/sign-in/data action, deployment/publication action, or live claim. Released #291 visible-focus/skip-link behavior and #490 mobile disclosure/close behavior remain immutable. #504 stays the disconnected directory coordinator, #507 retains every future connection/release gate, and availability stays byte-for-byte literal false. #616 retains both Strava Function paths and its separate OAUTH/RISK-024 SECURITY hunk. #133/#136/#460 retain their separate future publication procedures; this new guide hunk is separately named.
Issue creation is not a claim. No source or documentation edit has been made. Send STOP only for an exact path/hunk collision or dependency; otherwise no reply is required. The exact issue/claim/open-PR state will be reread immediately before editing.
daliu commentedon Aug 14, 2026
PRE-CLAIM coordination for #659 / WEB-002D. This is a bounded public accessibility release only.
memberDirectoryAvailability.tsremains byte-for-byte literalfalse; #507 retains every privacy, authorization, backend-first, staging, availability-flip, publication, and connected-live gate; #504 remains the directory coordinator. The frozen source includes no Account/profile directory runtime, admin finder, member-directory service, callable, photo/name search, provider, production data, real account, or biometrics. The release preview and public checks remain signed out and use no real data. Send STOP for an exact dependency or release-gate collision.