Repository navigation
COMMUNITY-001 — Opt-in runner connections with private, bounded recommendations #689
Description
Outcome
Implement the owner-authorized in-house runner connection experience: separate opt-in card, normalized easy pace, reciprocal run feasibility, deterministic suggestions, optional broadening, withdrawal and block/hide. Preserve existing officer-directory consent and private roster boundaries.
Source development is authorized September 27, 2026. Release remains gated by identity/privacy review and the existing #113/#133/#136 backend prerequisites. This issue does not authorize billing, provider changes, real-member imports, or production testing.
Acceptance
- Separate bounded profile/card and consent contract; no automatic enrollment or use of officer-only consent.
- Integer pace normalization, reciprocal pace/time/location/distance/terrain compatibility, stable bounded ranking and honest sparse results with grounded reasons.
- Trusted member/adult eligibility, no demographic ranking, no contact/private roster values in returned cards.
- Server profile persistence with revision/retry safety, current consent/account/block checks before delivery, request/read limits, strict deny-by-default Rules, and synthetic emulator tests.
- Member profile/recommendation interface with preview, explicit consent, block/hide/withdrawal, unavailable and unknown-save states; disabled until backend-first release is verified.
- Positive/negative unit, frontend, Rules and emulator tests; applicable full checks and independent review.
- Officer procedure, system/data-flow map, privacy/release gates and exact source/test/merge/deployment evidence.
A pure ranker or fixture preview does not complete this issue. Optional field-permissioned demographic matching, minors, introductions/notifications and post-run matching are later scoped work, not silently inferred features.
Officer impact: A proposed member-only way to find compatible runners, without publishing the roster or changing payment handling. NOT AVAILABLE YET.
Officer documentation: Planned docs/officers/RUNNER_CONNECTIONS.md, handbook index and matching system map.
Deployment evidence: None. Website, Firebase and outside providers unchanged at creation.
Activity
daliu commentedon Sep 27, 2026
CLAIMED by Codex at 2026-09-27 08:40:25 UTC; branch codex/runner-connections. Isolated checkout: mprc-runner-connections. Source development only; billing and protected backend release remain blocked. First implementation work is the bounded profile/compatibility domain and negative tests, followed by persistence, current-access rechecks and the member interface. No pure ranker or fixture demonstration will be reported as completed integration.
daliu commentedon Sep 27, 2026
Checkpoint e27c807 is pushed to draft PR #690. Dave explicitly selected member-confirmed18+: exact true is required with versioned consent, no DOB/verified-age claim, and withdrawal clears affirmation. Private storage, revision/idempotency and browser-denial Rules are now implemented in unused source; no callable/UI or production authorization claim.
Local evidence: 35 persistence emulator tests,428 Rules tests,7622 Functions unit tests (99 emulator skips counted separately),1346 frontend tests,134 workflow/release/security tests,lint,synthetic optimized build/artifact scanner and whitespace checks pass. Independent review found no actionable storage/Rules/CI defect; the suggested save-versus-withdraw and authorization-loss-on-retry tests pass. CI36308568014 covers this exact head and is queued; initial-core CI36307415833 passed all5 jobs.
Remaining integrated acceptance cases stay open: real current membership/Auth/AppCheck/rate limits, delivery rechecks and exclusions, member form/preview and recommendations, approved retention/consent wording and protected staging/live proof. No deployment, billing, provider, member-data or payment change.
Officer impact: no usable feature yet.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md and docs/RUNNER_CONNECTIONS.md updated with self-attestation and current source/test boundaries.
Deployment evidence: source/tests only; not merged or published; Firebase/providers unchanged; no production behavior verification.
daliu commentedon Sep 27, 2026
Profile-service integration is now in draftPR690 at bf61fa0. Saves use fresh Auth/revocation and a bounded canonical membership query, never role/profile mirrors; own read/withdraw remains possible after membership expires. Native AppCheck, separate rate limits and server-only Rules are wired in disabled/unexported source.
Evidence:69 focused emulator tests,7699 full Functions/AuthFirestore tests (63 separate-commerce skips),438Rules,134 workflow/security checks and lint pass. Independent review found no actionable defect. CI36309661314 is running for this head; predecessor CI36308568014 passed all5jobs.
Still incomplete: approved membership population/UID uniqueness, recommendation access/exclusions/delivery checks, member UI, actual HTTP/hosted proof and protected release. The backend goal is not achieved; billing remains disabled with zero visible billing accounts. A pilot-source question is pending (officer confirmation from existing records vs connected provider); no option is assumed.
Officer impact: no live change.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md and implementation/data-flow/root references updated.
Deployment evidence: source/tests only; not merged, published or deployed; providers and real member data unchanged.
daliu commentedon Sep 27, 2026
Recommendation/privacy checkpoint is source-tested, not live: e57ad41 on draft PR #690 adds bounded daily windows, requester-scoped hide/block/own-choice undo and fresh delivery checks. Explicit unchecked 18+ self-attestation remains separate from canonical membership; no DOB or verified-age claim.
Local Node20/Java21: 35 storage+34 profile-service+38 recommendation emulator cases; full Functions/Auth/Firestore7737 passed/63 separately opted-in commerce skips; Rules468; workflow/release/security134; lint/whitespace passed. Independent read-only review found no actionable defect. Exact-head CI36310998065 passed all five jobs; logs confirm all107 runner-emulator cases, Rules468 and frontend build/artifact verification actually ran.
Source gates remain disabled and deployment index unchanged. Approved membership population, retention/account-deletion procedures, member/controls UI, HTTP Auth/App Check and protected staging/live qualification remain incomplete. Keep issue open and PR draft.
Officer impact: No live change. Daily sampling and privacy-control behavior documented as unavailable.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md; docs/RUNNER_CONNECTIONS.md map; root design/security/operations references.
Deployment evidence: source changed/tests passed; not merged, website not published, runmprc.com not reverified, Firebase not deployed, providers unchanged, production behavior not verified. No billing/payment change or real-member data.
daliu commentedon Sep 27, 2026
Source progress, not release: draft PR #690 now has the disabled member interface at
0d270ee32bcc8753cb402dd6d49fa2d5feeefbb0.Remaining: approved canonical membership population/UID uniqueness and operator procedures; retention/account-deletion/consent approval; persistent privacy-choice recovery; browser-to-real-callable Auth/App Check staging rehearsal; protected release authority and provider verification. No issue closure, merge or enabled capability. The optional pilot membership-source question remains unanswered.
Officer impact: No live change. Runner connections remain NOT AVAILABLE YET.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md; docs/RUNNER_CONNECTIONS.md and its updated data-flow diagram; root design/security/operations/issue references. Backup-officer review needs no terminal, but arranging demos and deployment still requires the specialist.
Deployment evidence: Source committed/pushed and tests passed; NOT merged. No production website publication requested, runmprc.com not reverified for this change, Firebase not deployed, outside-provider configuration unchanged, production behavior not verified. Any automatic PR preview is not integrated/live-feature proof. No real records, new Function exports, dependencies, lockfiles or sitemap changes. Existing two-profile-Function release scope and billing constraints remain unchanged.
daliu commentedon Sep 27, 2026
Local client-to-backend HTTP integration is now verified at
b3decbbc9eb3c3146656aa2abd9cd91f3b562631on draft PR #690; no live feature enabled.The actual client modules and Firebase Web SDK call all six handlers through isolated Auth/Firestore/Functions emulators. Eight HTTP cases cover persistence and lost-response recovery, authentication-context and membership denials, stale/invalid input, private responses, suggestions and privacy changes, current account status, and expired-term withdrawal. Disposable synthetic fixtures are removed; teardown asserts zero Auth users/root collections.
Local: 8 HTTP + 20 harness checks, 7,757 full Functions/emulator tests (63 separately opted-in commerce cases skipped), and 135 safety/workflow checks passed. Independent read-only review found no actionable findings; it did not rerun emulators.
Exact-head CI36314173154 passed all five jobs. Logs/steps confirm 8 HTTP cases (zero skips), 107 runner-emulator, 468 Rules and 1,384 frontend tests, plus successful build/artifact verification.
Important limit: the Functions emulator bypasses token signatures. These tests do not prove hosted cryptographic Auth/App Check, attestation/IAM, browser CORS enforcement or a connected rendered-browser pilot. Membership population/UID uniqueness and officer operations, retention/account-deletion/consent approval, persistent privacy controls, hosted security and protected release remain open. Explicit unchecked 18+ self-attestation stays separate from membership, with no DOB or verified-age claim.
Officer impact: No live change; runner connections remain NOT AVAILABLE YET.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md; docs/RUNNER_CONNECTIONS.md data-flow map; root design/security/operations/issue references.
Deployment evidence: Source committed/pushed and tests passed; NOT merged. No production website publication by this work; automatic PR previews are not live-feature proof. runmprc.com not reverified, Firebase not deployed, outside providers unchanged, production behavior not verified. No billing/payment change, production test or real-member import. Keep issue open and PR draft.
daliu commentedon Sep 27, 2026
Connected local browser/backend behavior is now verified at
df82b2da5f05ccf72a3a2140969f289da1d2b6f1on draft PR #690.The explicit
--browserrehearsal uses actual RunnerWorkspace/createRunnerClient with disposable Auth/Firestore/Functions emulators, in-memory browser sign-in and declared synthetic fixtures. Argument-free CI still runs mandatory HTTP tests; production gates stay off.Actual browser checks: unchecked initial18+/sharing, preview/save, persisted card after full reload/fresh local sign-in, suggestion, phone390×844 block→empty→own undo restoring the same partner, withdrawal/reload clearing card and age, and denied valid-card save from a nonmember. No phone overflow or captured console warnings/errors. Screenshot inspected without retaining an artifact. Final lifecycle version was separately started/read/stopped; normal cleanup verified zero users/root collections and stopped emulators. Tabs closed, viewport reset.
Local36 harness,7,665 ordinary Functions/171 explicit emulator skips,8 HTTP/zero skips,98 safety contracts, TypeScript/lint/syntax/whitespace passed. Independent read-only code/lifecycle/docs review had no actionable findings and ran no tests.
Exact-head CI36315280591 passed all five jobs. Logs prove7,665 ordinary Functions,1,384 frontend,468 Rules,107 runner-emulator and8 HTTP tests plus build/artifact checks actually executed.
Limits remain: test account selector is not normal app login/service-locator integration; emulators bypass token signatures, so no hosted cryptographic Auth/App Check or hosted CORS proof. Forced-interruption cleanup is unproven. Canonical membership population/operations, retention/account deletion, persistent privacy management, dependency maintenance and protected release remain open. No issue closure or merge.
Officer impact: No live change; runner connections remain NOT AVAILABLE YET.
Officer documentation: docs/officers/RUNNER_CONNECTIONS.md; docs/RUNNER_CONNECTIONS.md updated data-flow map; matching root design/security/plan/operations references. Evidence review needs no terminal; specialist still runs demonstrations and releases.
Deployment evidence: Source committed/pushed, local and CI tests passed; NOT merged. Production website not published by this work; automatic PR previews are not live-feature proof. runmprc.com not reverified, Firebase not deployed, outside providers unchanged, production behavior not verified. No billing, payment, real-member or production-data changes.