MEMBERS-DIRECTORY-001 — Add a private opt-in officer photo directory

[daliu]

Officer impact: Authorized officers will be able to type a person's name and see only the display name and voluntary profile thumbnail of website-account holders who explicitly opted into this optional people finder. This is not an official membership roster and does not prove membership or account authority.

Officer documentation: Update OFFICER_START_HERE.md, docs/officers/README.md, docs/officers/EVENTS_SHOP_MEMBERS.md, docs/officers/ACCESS_CONTINUITY.md, docs/officers/SYSTEM_MAPS.md and its text alternative, and docs/officers/GLOSSARY.md.

Deployment evidence: None at issue creation. Closure requires reviewed source, green focused and full checks, isolated synthetic Firebase proof, exact Firestore/Functions/index deployment and readback, website publication, runmprc.com verification, privacy-notice publication, opt-out/removal proof, and a backup-officer walkthrough. Until every affected surface is proven, this directory is NOT AVAILABLE YET.

Product contract

This issue interprets 'search people's faces / names' as a photo-assisted name search: an authorized officer enters a bounded name query and visually reviews voluntary profile thumbnails. It explicitly excludes uploading a face as a query, facial recognition, face embeddings/templates, similarity scoring, or automated identification. Any biometric feature requires a separate owner/legal/privacy decision and threat assessment.

The optional people finder is separate from the official membership roster, website-role administration, registrations, payments, and membership authority. Turning it off removes a person from this finder; it does not delete or hide records an officer is otherwise authorized to use for an official operational purpose.

Invariants

• Missing preference means hidden. Existing and new accounts are not searchable by default. An opted-in account with no valid current display name is also hidden while retaining an available opt-out control.
• Only the signed-in person may upload, replace, remove, or change visibility for their own thumbnail.
• Consent wording names the officer-only finder, displayed fields, storage purpose, removal behavior, and current privacy contact. Photo upload does not silently enable discoverability.
• The server decodes and re-encodes a bounded static JPG, PNG, or WebP into one thumbnail, strips metadata, rejects malformed/spoofed/animated/oversized input, and never stores the original.
• Directory data lives in a separate server-owned projection. Results contain only an opaque entry reference, current display name, and optional thumbnail bytes/version. They never contain email, phone, role, UID, provider ID, membership/payment state, notes, or source documents.
• Name search is bounded, server-side, prefix-oriented, rate-limited, and capped. The browser never downloads the full members collection for this finder.
• Current verified admin is the compatibility authorization boundary until scoped officer capabilities are available. Browser UI is guidance only; each Function verifies the token independently.
• Photo delivery is authenticated and no-store. No permanent public Firebase download-token URL is created.
• Opt-out hides the projection before success. Photo removal is separate and retry-safe.
• Audits contain actor/capability, fixed action/purpose category, request ID, outcome, and counts only—never raw query text, names, photos, result identities, or request bodies.
• No real member photo/data appears in tests, screenshots, logs, issues, build artifacts, analytics, or AI tools.

Acceptance criteria

• A signed-in account can upload, preview, replace, and remove a synthetic profile thumbnail.
• A separate explicit toggle defaults off and truthfully controls inclusion in the optional officer finder.
• Photo upload alone never enables searchability; opt-out never deletes official account/membership records.
• An authorized officer can submit a bounded name prefix and receive at most the approved result limit with accessible photo/name cards.
• Anonymous, ordinary member, unverified admin-claim, malformed, stale, replayed, and over-limit requests fail generically without enumeration or partial data.
• Results never expose unapproved fields, even when source member documents later gain extra fields.
• Name changes, opt-in/out races, photo replacement/removal, duplicate commands, stale revisions, and partial failures converge safely.
• Image tests cover real synthetic generated pixels plus malformed, spoofed content-type, oversized dimensions/bytes, metadata, animation, and output-size bounds.
• Rules deny every direct browser read/write to projection, photo, audit, and command records.
• Logs, errors, analytics, audits, filenames, URLs, and test artifacts contain no photo/name/query canaries.
• Backend deploys and verifies before the dependent website; a skipped or partial Firebase step publishes nothing.
• The public privacy notice and officer guide describe current verified behavior and deletion/backup limitations without treating promotional-event photo language as directory consent.

Required split

1. Profile thumbnail and opt-in preference: pure validation/state contracts, server endpoints, private persistence, Rules/tests, and My Account UI.
2. Officer name search: minimal server projection, verified-admin compatibility guard, bounded search/audit, separate admin route, and tests.
3. Release: fixed deploy/readback scope, privacy/officer documentation, isolated staging, backend-first publication, opt-out/removal/cache proof, and rollback/safe-roll-forward.

Each child must be independently reviewable and must preserve this complete outcome.

Dependencies and coordination

• DATA-001B — Inventory personal data and approve a minimization/retention matrix #110 owns the broader field-by-field minimization/retention matrix. This issue uses the narrowest behavior—explicit opt-in, no original retained, active thumbnail removed on request, no biometric data—and must add the new categories and any unresolved backup SLA to that decision record before live closure.
• MEMBERS-ROSTER-001 — Add officer-only member roster view and safe CSV export #116 remains the official membership roster/export. Do not merge these concepts or infer current membership from this directory.
• AUTH-003 and ADMIN-001 own future scoped capabilities, MFA/recent-auth policy, and shared privileged audit. Current verified admin may be used only as the documented compatibility boundary; do not invent an MFA duration.
• BACKEND-001 — Audit the Firebase cutover and approve legacy data disposition #113/CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136 and the protected release work own provider inventory, deployment authority, and staged/live evidence.

Explicitly out of scope

• Facial recognition, image-to-person search, biometric templates, or similarity matching.
• Public/member-wide directory access, official membership roster/export, role changes, account linking, payments, registration, or provider migration.
• Real production data inspection, bulk photo import, copying Auth/provider photo URLs, or manual Firebase-console repair.

Claim protocol

This parent coordinates focused children and is not itself a file claim. Each implementation child must be assigned and receive a timestamped CLAIMED comment naming its branch before edits. Earliest valid claim wins.