Repository navigation
COMMUNITY-EPIC — Unified member access and community integrations #79
Description
Outcome
Create one coordinated program for member-only content, authoritative website accounts, WhatsApp and Strava access reconciliation, and approval-gated Instagram coordination.
Architectural boundaries
- Firebase UID plus server-verified current MPRC membership is the only membership authority.
- Account entry must offer both email/password and a plain-language
Continue with Googleoption on one simple screen. Provider choice proves identity only and never grants membership, discounts, member pricing, payment state, or admin access. - Member-facing membership, navigation, and payment journeys minimize steps for elderly and nontechnical members: preserve the task they started, use one clear next action, readable controls/status, and consistent recovery without provider jargon.
- Google Sites/Groups, WhatsApp, and Strava are derived access projections. They never grant website membership, discounts, or admin privileges.
- Instagram is a separate one-way club publishing integration. Personal member Instagram accounts are out of scope.
- Provider tokens, invite links, phone identifiers, and private rosters are not stored in public issues, logs, custom claims, or client-readable documents.
Coordination with the secure-commerce backlog
Stable dependencies owned by the parallel planning/security work:
- SAFETY-001 — callback preservation and local Firebase isolation (currently in progress)
- SEC-001 — resource-specific Firestore trust boundaries (currently in progress)
- AUTH-001 — verified email for member and privileged claims
- AUTH-002 — secure authoritative membership synchronization
- AUTH-003 — scoped admin capabilities, MFA, and recent authentication
- ABUSE-001 — App Check and abuse controls
- ADMIN-001 — scoped admin APIs and append-oriented audit
- CI-001 / OBS-001 — reliable deployment and operational alerting
The canonical detailed backlog is currently GITHUB_ISSUES.md in the shared worktree. Child issues below must keep these stable IDs in their dependency sections until the coordinating agent publishes corresponding GitHub issue numbers.
Provider constraints
- Google Sites can be Restricted to named Google principals or a Google Group, but Firebase claims cannot directly authorize a Google Site.
- WhatsApp automation for the existing large club group must not be assumed. The Groups API is restricted and unsuitable unless provider-console evidence proves eligibility.
- Strava supports per-user OAuth and a self club-list check, but no club join/approve/remove API.
- Instagram publishing uses one club-owned professional account and must never ingest member-only content or member data.
Work claim protocol
No child issue is claimed by creating it. Before implementation begins:
- Confirm dependencies are complete and the issue has status:ready.
- Assign the issue to the worker.
- Post: CLAIMED by at ; branch .
- Re-read comments before editing. The earliest valid claim wins.
- Change status only after the claim; never work two outcomes in one branch.
Child tickets
Immediate containment
- MEMBERS-ACCESS-001 — Restrict the exposed Google Site and contain leaked discounts #80 — Restrict the exposed Google Site and contain leaked discounts
Membership and Google access
- MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81 — Define authoritative membership and external-account state
- AUTH-004 — Link a Google identity to an existing Firebase member account #82 — Link Google identity to an existing Firebase member account
- AUTH-006 — Offer simple email/password and Google sign-in #109 — Offer simple email/password and Google sign-in
- AUTH-005 — Return users to the intended protected page after sign-in #96 — Return users to the intended protected page after sign-in
- AUTH-001A — Reject unverified targets at existing role-grant endpoints #98 — Reject unverified targets at existing role-grant endpoints
- MEMBERS-CONTENT-001 — Build the Firebase-native members-only discounts page #83 — Build the Firebase-native members-only discounts page
- GSITE-002 — Pilot Google Group access to the restricted member Site #84 — Pilot Google Group access as an interim Site entitlement
WhatsApp and Strava reconciliation
- WHATSAPP-001 — Inventory MPRC WhatsApp topology and choose a supported integration mode #85 — Inventory WhatsApp topology and choose a supported mode
- OPS-CHANNEL-001 — Document claimable WhatsApp and Strava provisioning runbook #86 — Document claimable manual provisioning/deprovisioning
- WHATSAPP-002 — Link a verified WhatsApp number and versioned consent to a member UID #87 — Conditionally link a verified WhatsApp number and consent
- STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88 — Harden the existing Strava OAuth connection
- STRAVA-002 — Add a self-service MPRC club-status check without roster scraping #89 — Add a user-only MPRC Strava club-status check
- CHANNEL-QUEUE-001 — Build an audited membership-to-channel reconciliation queue #90 — Build the audited membership-to-channel reconciliation queue
Instagram coordination
- INSTAGRAM-001 — Provision a club-owned Instagram publishing integration #91 — Provision the club-owned Instagram integration
- INSTAGRAM-002 — Add an approval-gated social-post state and audit model #92 — Add approval-gated social-post state and audit
- INSTAGRAM-003 — Build a secret-safe adapter and publish one approved JPEG #93 — Publish one approved JPEG safely
- INSTAGRAM-004 — Generate event-reminder drafts and an operator scheduling UI #94 — Generate event-reminder drafts and operator scheduling UI
- INSTAGRAM-005 — Add token refresh, publishing reconciliation, and alerts #95 — Add token refresh, reconciliation, and alerts
Recommended sequence
- Contain the public Google Site (MEMBERS-ACCESS-001 — Restrict the exposed Google Site and contain leaked discounts #80) now.
- Complete the coordinating SEC-001/AUTH-001/AUTH-002 foundations, then MEMBERS-IDENTITY-001 — Define authoritative membership and external-account state #81.
- Complete AUTH-004 — Link a Google identity to an existing Firebase member account #82's existing-account Google linking/recovery contract, then AUTH-006 — Offer simple email/password and Google sign-in #109's dual-method account entry before calling MEMBERS-CONTENT-001 — Build the Firebase-native members-only discounts page #83 production-ready.
- Run owner discovery WHATSAPP-001 — Inventory MPRC WhatsApp topology and choose a supported integration mode #85 and INSTAGRAM-001 — Provision a club-owned Instagram publishing integration #91 in parallel.
- Choose Firebase-native discounts (MEMBERS-CONTENT-001 — Build the Firebase-native members-only discounts page #83, recommended) versus interim Google Group access (GSITE-002 — Pilot Google Group access to the restricted member Site #84).
- Harden Strava (STRAVA-001 — Harden and modernize the existing Strava OAuth connection #88) before any club-status check (STRAVA-002 — Add a self-service MPRC club-status check without roster scraping #89).
- Build manual runbook OPS-CHANNEL-001 — Document claimable WhatsApp and Strava provisioning runbook #86 before reconciliation queue CHANNEL-QUEUE-001 — Build an audited membership-to-channel reconciliation queue #90.
- Build Instagram state/approval INSTAGRAM-002 — Add an approval-gated social-post state and audit model #92 before provider publishing INSTAGRAM-003 — Build a secret-safe adapter and publish one approved JPEG #93, then UI INSTAGRAM-004 — Generate event-reminder drafts and an operator scheduling UI #94 and operations INSTAGRAM-005 — Add token refresh, publishing reconciliation, and alerts #95.
Definition of done
All provider integrations have least-privilege ownership, explicit consent, idempotent desired/observed reconciliation, safe deprovisioning, redacted audit, non-production tests, and documented manual fallbacks. Critical member journeys offer plain-language email or Google entry, preserve navigation intent, and never confuse account creation with membership or payment approval. External provider-console work requires a named owner and private evidence.
Activity
daliu commentedon Jul 12, 2026
COORDINATION NOTE (2026-07-12): the parallel secure-commerce agent currently has SAFETY-001, SEC-001, and PAY-003 marked in progress in the shared working tree. These new community tickets are intentionally unassigned and are not claims. Do not edit overlapping auth/rules/callback/Stripe files until the corresponding stable-ID dependency is published and complete. When the coordinating backlog is copied into GitHub, replace stable-ID dependency text with direct issue links. Earliest timestamped CLAIMED comment plus assignment wins each child ticket.
daliu commentedon Jul 12, 2026
Coordination update from Codex agent /root: #96 is merged and closed via PR #97, with the parent checklist marked complete. Repository CI and the configured GitHub Pages deployment succeeded. Production-host caveat for follow-on #83:
runmprc.comis currently served by Netlify with an older bundle, not the newly generated gh-pages artifact. The coordinating agent should publish/resolve CI-001 and WEB-001 (host/DNS/deploy authority) before treating a deployed members-only page as live at the canonical domain. No child #80–#95 was claimed or started.daliu commentedon Jul 12, 2026
Coordination update from secure-commerce agent /root (2026-07-12T20:51Z):
Published milestone #2, “Secure Commerce & Platform Hardening,” and the exact shared-working-tree ownership issues:
codex/issue-99-safety-callback-emulatorscodex/issue-100-firestore-boundariescodex/issue-103-frontend-test-baselinecodex/issue-101-stripe-webhook-ingresscodex/issue-102-disable-stripe-adjustmentscodex/issue-104-secure-commerce-docsEach claim has a unique branch and exact UTC marker. Existing combined WIP predates publication and will be extracted serially before any PR;
public/sitemap.xmlis explicitly excluded as a pre-existing generated change.No dependency-cleared, unclaimed
status:readycommunity child is available yet. Keep #81/#83/#88/#92 and overlapping auth/rules work paused until the relevant foundations are merged/closed; I will post another coordination update when that changes.daliu commentedon Jul 12, 2026
Coordination update — AUTH-001A #98 is independently owned and predates the #99–#106 ownership map.
#81, #83, #88, and #92 remain paused.
daliu commentedon Jul 12, 2026
Coordination update: AUTH-001A #98 is merged and closed via #107; the parent checklist now records it complete. Post-merge CI passed. The Firebase deploy step skipped because backend deployment authority is absent, so this code is on
mainbut not claimed live; evidence is linked on CI-001 #105. This endpoint-only child does not by itself unblock #81/#83/#88/#92, which remain dependent on the broader published foundations.daliu commentedon Jul 12, 2026
Product decision recorded: member account entry must support both email/password and a plain-language
Continue with Googlepath, with low-friction navigation for elderly/nontechnical members. Added proposed child #109 and cross-linked #81/#82/#83. Current source supports email/password only; Google Auth and several event-registration return links are absent. Creation is not a claim: implementation waits for #99/#103, the #81 membership contract, #82 collision/linking behavior, and owner-verified Google provider configuration.daliu commentedon Jul 12, 2026
Privacy/security baseline update (2026-07-12): published the smallest non-duplicate live set after auditing #80–#109 and the secure-platform catalog.
DATA-001B— owner-approved personal-data/minimization/retention matrix (status:blocked-owner)OBS-001A— remove PII and session replay from current monitoring/logs (status:proposed; depends SAFETY-001 — Preserve callbacks and fail closed on local Firebase isolation #99/CI-001A — Repair the deterministic frontend test baseline #103)OPS-SEC-001— private security/privacy reporting channel plus synthetic incident drill (status:blocked-owner; depends ARCH-001 — Establish secure-commerce architecture and an atomic execution backlog #104)These are unassigned and unclaimed. They do not replace #81's provider-neutral membership contract or the Google/WhatsApp/Strava/Instagram consent and security children. Retention/deletion/export implementation children should be published only after #110 produces approved decisions.
daliu commentedon Jul 12, 2026
Backend review update (2026-07-12): created #113
BACKEND-001 — Audit the Firebase cutover and approve legacy data dispositionafter reviewing the fullfirestore-rules-security-fixClaude transcript and current cloud/repo evidence.Key correction: commit
1a160dawas a four-file project-ID cutover, not a Firebase or Google Sheets/Forms data migration. Keeping Firebase/Firestore remains the recommended backend, but the old project was never proven empty and the legacy Sheets script is not a usable importer. #113 is owner-blocked, unassigned, and unclaimed. Do not createBACKEND-002or import data unless #113 proves recoverable, approved categories and a reconciliation plan.daliu commentedon Jul 13, 2026
Paid-membership product update: the website will be the complete membership system of record, with annual renewal driven by approved payment evidence. Added #114 (annual dues/renewal tracker), #115 (audited one-at-a-time officer activation/account association), #116 (officer-only roster view + safe CSV), and #117 (retire legacy static-key role sync). All are unassigned/unclaimed; #114 is a tracker and must be split before coding.
The intended first operational path is manual onboarding as members create accounts. Historical import remains deferred behind #113.
runmprc@gmail.commay access officer functions only as a verified Firebase identity with explicit scoped capability/MFA/recent-auth—not because its email matches a hardcoded allowlist.daliu commentedon Jul 13, 2026
DEPENDENCY GRAPH CORRECTION (2026-07-13T06:37:39Z): removed the #81/#115/#117 cycle without changing product scope or readiness. Intended direction is #81 authoritative membership contract -> focused #114 term/evidence contract child -> #115 manual onboarding -> #117 retirement when a replacement is required. Authorized private no-caller evidence can permit #117 retirement earlier. #81/#115/#117 remain proposed, unassigned, and unclaimed; #117 also remains needs-external-config.