Repository navigation
MEMBERS-DIRECTORY-001D — Add a safe frontend-only directory preview #621
Description
Parent: #504. Reframes #507 as the later backend connection and full protected release.
Officer impact: Adds an honest, disabled preview of the My Account photo/searchability controls and the guarded officer People finder. No officer can search a name, and no person can read, upload, remove, or save a photo or finder choice until the backend is connected in a later protected release.
Officer documentation: OFFICER_START_HERE.md, docs/officers/README.md, and the matching profile-photo/People-finder procedure and Mermaid diagram in docs/officers/EVENTS_SHOP_MEMBERS.md.
Deployment evidence: Closure requires source checks, reviewed merge, and exact frontend publication/readback if publication authority is available. Firebase Rules, indexes, Functions, production data, privacy-provider configuration, and live backend behavior are explicitly excluded and must remain unchanged.
Atomic outcome
Publish a production-safe frontend-only interface preview for the optional profile photo, independent searchability choice, and officer name-search gallery while the backend remains deferred. Preserve the reviewed connected implementation behind one source-controlled capability boundary that defaults off. The later backend release must deliberately flip that reviewed boundary only after #507's privacy, authorization, staging, backend-first deployment, and readback gates are complete.
Safety invariant
With the capability off, opening My Account or /admin/member-directory performs zero member-directory service calls and exposes no saved state or real result. Every related control is natively disabled and the page says that nothing is read, uploaded, searched, or saved. No frontend flag is authorization; the existing server-side controls remain required when the backend is eventually connected.
Allowed transitions
- Current connected-source UI -> disabled frontend preview with the capability off.
- Preview -> connected behavior only through a later reviewed source change after MEMBERS-DIRECTORY-001C — Release and verify the opt-in officer photo directory #507's backend-first prerequisites.
- Account and admin identity changes may remount the preview, but never create a directory request while disconnected.
Failure cases
- Stop if any preview interaction calls Firebase, creates a request ID, reads a saved preference/photo, accepts a name, renders fake people, or implies persistence/search.
- Stop if the route becomes public, bypasses
AdminGuard, reuses the broad Website accounts filter, or introduces photo-as-query, face recognition, image matching, embeddings, similarity scoring, or biometric templates. - Stop if the change deploys Rules, indexes, Functions, provider settings, or touches real accounts, names, photos, or production data.
Exact source scope
- Add one frontend availability module with a source-controlled boolean defaulting to unavailable.
src/pages/account/MemberDirectoryProfile.tsxand focused tests: render the real layout as a disabled, clearly labeled preview; preserve the connected behavior through an explicit test seam; prove zero profile service calls by default.src/pages/account/Account.css: preview/status styling only.src/pages/admin/members/AdminMemberDirectory.tsxand focused tests: keepAdminGuard; render a disabled name-search layout with no results or service setup; preserve the connected path through an explicit test seam; prove zero request-ID/search calls by default.src/pages/admin/AdminHome.tsx,src/pages/admin/members/AdminMembers.tsx, and focusedsrc/App.test.jsxexpectations: label the route as a preview with backend connection pending.- Separately named, current-truth hunks in
SYSTEM_DESIGN.md,SECURITY.md,IMPLEMENTATION_PLAN.md,OPERATIONS_RUNBOOK.md,OFFICER_START_HERE.md,docs/officers/README.md, and the existing People-finder procedure/diagram indocs/officers/EVENTS_SHOP_MEMBERS.md.
Backend Functions, Rules, indexes, callable contracts, storage/schema, repair/backfill, public Privacy policy, provider configuration, deployment workflow, and real/live data are immutable.
Acceptance criteria
- My Account shows the thumbnail placeholder, file control, and separate finder checkbox, all disabled and programmatically described by a visible preview notice.
- The account preview does not mount the connected attempt and calls none of get/upload/remove/visibility/request-ID services.
- The guarded People finder shows its name field and Search button disabled, collects no name, creates no request ID, calls no directory service, and renders no sample/fake/result cards.
- Copy uses future tense for backend-dependent behavior and still says upload never opts in, results are not membership proof, and there is no photo query or facial recognition.
- Existing connected-state behavior remains covered through an explicit component test seam; the production default stays disconnected in reviewed source.
- Narrow/mobile, keyboard, contrast, accessible-name/description, and no-horizontal-overflow checks pass with synthetic/no data only.
- Focused tests, the complete frontend Jest suite, non-mutating lint, diagnostic build, Functions tests/lint, Rules tests, workflow validation, and artifact scrubber pass as applicable.
- Review reports source changed, tests passed, code merged, frontend published/read back (or exact external blocker), Firebase unchanged, provider unchanged, production data untouched, and backend behavior unavailable.
Migration impact
No data or provider migration. Existing source contracts and stored-schema expectations are unchanged. The only later activation path is a reviewed source flip after #507's backend-first release conditions are proven.
Claim protocol
Assign and post a timestamped CLAIMED marker with exact base, branch, paths/hunks, and exclusions before editing. Coordinate with active #616's separately named SECURITY.md row and preserve it byte-for-byte.
Activity
daliu commentedon Aug 13, 2026
CLAIMED by
/rootat2026-08-13T16:19:52Zon branchcodex/issue-621-member-directory-preview, exact released base3cf3e5bfc3ee13b084edb6efb8eff6bb21b907c5.Invariant: the source-controlled capability defaults unavailable. In that state, the account and guarded officer pages render only an honest, inert preview: no member-directory service/context mount, request ID, file read, name input, saved state, result card, Firebase call, or backend/live claim. Connected behavior remains covered behind an explicit component test seam for #507's later protected backend-first release.
Exact ownership:
src/services/account/memberDirectoryAvailability.tsavailability constant only;src/pages/account/MemberDirectoryProfile.tsxplus separately named default-preview/connected tests insrc/pages/account/MemberDirectoryProfile.test.tsx;src/pages/account/Account.css;src/pages/admin/members/AdminMemberDirectory.tsxplus separately named default-preview/connected tests insrc/pages/admin/members/AdminMemberDirectory.test.tsx;src/pages/admin/AdminHome.tsxandsrc/pages/admin/members/AdminMembers.tsx, with matching separately named expectations insrc/App.test.jsx;SYSTEM_DESIGN.md, the existingSECURITY.mdRISK-042 row plus one separately named MEMBERS-DIRECTORY-001D source-ledger row, the current-directory boundary inIMPLEMENTATION_PLAN.md, and the existing directory release section inOPERATIONS_RUNBOOK.md;OFFICER_START_HERE.md,docs/officers/README.md, and the existing profile-photo/People-finder procedure plus its matching Mermaid diagram/text alternative indocs/officers/EVENTS_SHOP_MEMBERS.md.Immutable/excluded: all Functions, Rules, indexes, callable/service contracts other than the new availability constant, storage/schema/repair/backfill, public Privacy policy, deploy/workflow/provider configuration, #507 backend release, production data, real names/photos/accounts, and every #616 Strava file/hunk. In
SECURITY.md, active #616's separately named OAUTH-001A2L row is immutable and exact-hunk disjoint.Officer impact: Officers can review the guarded future People-finder layout, but cannot enter a name or receive a result. People can review the future photo/default-off choice, but cannot select/read/upload/remove/save anything.
Officer documentation:
OFFICER_START_HERE.md,docs/officers/README.md,docs/officers/EVENTS_SHOP_MEMBERS.md.Deployment evidence: none yet. This claim does not change Firebase, Netlify, providers, production data, or live behavior.
daliu commentedon Aug 13, 2026
CLAIM SCOPE REFINEMENT at
2026-08-13T16:23:55Z, before editing the lint-count proof: #621's new finding-free TypeScript availability module increases the exact frontend lint inventory from 119 files / 42 TS to 120 files / 43 TS while configured findings remain 113 errors / 6 warnings.Add exact ownership of:
tests/ci-workflow.test.js: onlyEXPECTED_LINT_FILES119 -> 120;OPERATIONS_RUNBOOK.md: only the existing lint-inventory sentence in the line-270 CI-001B4 paragraph, adding MEMBERS-DIRECTORY-001D — Add a safe frontend-only directory preview #621 and 120 / 43 TS with findings unchanged;SECURITY.md: only the existing RISK-035 inventory sentence and matching source-ledger count sentence, adding MEMBERS-DIRECTORY-001D — Add a safe frontend-only directory preview #621 and 120 files with findings unchanged.The new file has no finding and no baseline record.
.github/lint-baseline.json, workflow files, all existing finding records, active #616's OAUTH-001A2L row, and every other claimed exclusion remain immutable.daliu commentedon Aug 13, 2026
CLAIM SCOPE REFINEMENT at
2026-08-13T16:26:03Z, before changing the lint ledger: add.github/lint-baseline.jsonsolely for the deterministic gate's mechanically regenerated inventory/fingerprint and location records caused by #621's new finding-free TypeScript file and reviewed line shifts in already-owned frontend files.Required invariant: current scan must remain exactly 120 files, 113 configured errors, and 6 configured warnings. No finding may be added, removed, reworded, or severity/rule changed. Only the sorted new file inventory entry, count-by-extension, fingerprint, and mechanically shifted line/column records within #621-owned files are permitted. The gate itself, workflow, and all other baseline records remain semantically unchanged.
This supersedes only the earlier statement that
.github/lint-baseline.jsonwas immutable. Every other ownership/exclusion, especially active #616's hunk, remains unchanged.daliu commentedon Aug 13, 2026
PR #622 is open at exact reviewed head
1c9f463bfe72b189d5f64e38643f45a5d73ab29fon exact base/current main3cf3e5bfc3ee13b084edb6efb8eff6bb21b907c5, treee403c15f6588ea9ed4ecb5cb958b33ce4e6c4768.Exact 18-file binary diff SHA-256:
daba9d6e4e2942617f6d21036ddf3cb23f1cbad2c157b7398551b31a2bfe8c46.Local full gates are green: frontend 1,057; Functions 7,569; Rules 418; repository Node safety/workflow 105; lint baseline 120 files / unchanged 113 errors / 6 warnings; diagnostic build and diff check. Synthetic local browser QA passed at desktop and actual 320-pixel widths with disabled controls, no overflow, no directory callable, and no console warning/error. Three independent frontend, operations, and security/privacy reviews are GO with no remaining findings.
PR: #622
The claim remains active through exact-head hosted CI, merge, exact-main CI/deployment audit, closure, and explicit release. Firebase, providers, workflows, production sign-in/data, connected behavior, and #616 paths/hunks remain untouched.
MEMBERS-DIRECTORY-001D: add inert interface preview (#621)
daliu commentedon Aug 13, 2026
FINAL SOURCE RELEASE — COMPLETE / CLOSED / CLAIM RELEASED at
2026-08-13T17:04Z.PR #622 was administrator-squash-merged from exact independently reviewed head
1c9f463bfe72b189d5f64e38643f45a5d73ab29fas exact main019353361210021483f23003e09ee6924b78e67c. Reviewed and merged trees are identical:e403c15f6588ea9ed4ecb5cb958b33ce4e6c4768. Exact 18-file binary diff SHA-256 remainsdaba9d6e4e2942617f6d21036ddf3cb23f1cbad2c157b7398551b31a2bfe8c46.PR CI
31723120207and exact-main CI31723453862passed all five jobs. Three independent frontend, operations, and security/privacy reviews were GO. Synthetic local browser proof passed at desktop and actual 320-pixel widths with disabled controls, no overflow, no directory callable, and no console warning/error.Delivery states remain separate:
019353361210021483f23003e09ee6924b78e67c;6a7df7f1325134000805ff2a: errored and unpublished;6a6dc9ea588b0c0008036312, control9ad6837756cdd409d296009fde5082eeeae5c059, source39ab8649df411262c8109a3c81a57bc38f1e168b;The exact external publication blocker is independently reviewed: PR preview
6a7df6fdbb12ce00097329c6contains accumulated current-main work rather than a bounded live-based artifact, and its marker path is SPA HTML rather than valid provenance JSON. Direct promotion would repeat the #617 incident pattern. Safe publication therefore requires a fresh bounded web-release claim, a frozen source projected from live39ab8649..., exact live-to-candidate review, pinned source/tree/count/digest, valid marker, rollback to6a6dc9ea..., an exact-parent one-shot release, and repause. The #621 source claim did not own that provider/configuration control.All 18 source claims are RELEASED. #507 remains open for the later backend connection and availability flip; this marker does not authorize Firebase or connected behavior.
Officer impact: Source now contains the honest disabled interface, but production still shows the existing #473 website until the separate bounded web release succeeds.
Officer documentation: merged in PR #622; it already distinguishes synthetic protected-layout proof from signed-out public publication proof.
Deployment evidence: Netlify attempt failed unpublished; current production marker/deploy remained unchanged. No Firebase, provider, sign-in, or production-data action occurred.