Task: Build the profile screen

The three Profile journeys run in ores.web as one screen with panels, on the journey runtime the Setup group landed: the member sets their own photo, name, job title and contact details, the tenant administrator corrects a colleague's, each writable panel saves itself with its own reason, and a reporting-line change is drawn as a proposal that states who decides.

• The member writes their own photo, name, job title and contact details against the real server through the self-service subjects, and the tenant administrator writes a colleague's through the administrator subjects.
• Each writable panel carries its own save and its own change reason, so a half-finished edit never rides along with the record that is ready.
• Where the screen sends a pair of writes, a failure names the record that failed, and nothing on the screen claims the pair is atomic.
• A refusal is drawn from the server's code, so the screen branches on field_not_self_writable and says what it means.
• The photo is replaced through the upload path: the picker states the accepted formats and size, previews at the size other screens show the photo, and the server enforces the same rule.
• A reporting-line change is drawn as a proposal naming who must approve it; the value does not change while the proposal waits, and no approval is claimed that nothing performs.
• Every panel the caller may not write says why, and the sign-in and access panel is a read-only summary that points at its owning journeys.
• The two email fields are labelled apart: the sign-in address and the contact address, neither reading as the other.
• A signed-in person reaches the journeys from the shell, and the trigger that opens them shows the person's own name and photo once the account has been read.
• Every gap the three journey documents record is closed or stated on the screen, and the statement is recorded.
• The screen follows the UX language, the UI design principles and the TypeScript Clean Standard, and reuses the journey runtime without adding a journey entity.

The three journeys run as one page with panels. Variant B of the prototype is accepted: each writable panel carries its own save and its own change reason. No route sends a pair of writes, so the partial state the prototype drew cannot arise, and the screen shows each panel's own outcome and its own new version.

The page is a journey that is a page. The rail runtime does not render it, and it adds no journey entity: the route, the panels and the operations are ordinary screen work, in the shape Journey runtime states: one hand-written BFF route per operation, each parsing a generated schema.

Every number this task claims about a tree, with the command that produced it and the commit it was measured at. A number without both is not a measurement, because a clean-up record describes a tree and trunk moves under a branch: a consumer count, a gate's component count and a suite's size all change with no code changing, and the reader of a bare number cannot tell which tree it came from. Where the raw output matters, put it in an evidence/ file beside the task and name that file in the Command column.

The reconnaissance found a read gap: iam.v1.accounts.get needs iam::accounts:read, which the default Viewer role does not hold, so a plain member cannot read their own account. The screen states the refusal, the identity panel offers no save it cannot ground (an empty field would clear the value on the self write), and the shell trigger falls back to the username and the initials. The gap is recorded in the three journey documents beside their gap lists.

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

The local review pass over the diff, per the runbook's step 5a: the compass-code-review-pr checklist against origin/main...HEAD, and the misspell check with it.

Verdict: ready to merge. The four accepted points are fixed in this pass; the two with no action are recorded, and neither is in the diff's own text.

Closed 2026-10-05, with the verification the plan set, in that order.

The suites and the type checker pass: npm --prefix projects/ores.web test runs the three packages (web 27 files and 260 tests, wire-protocol 13 files and 114 tests, BFF 30 files and 192 tests, all passed), npm --prefix projects/ores.web run typecheck exits 0, and npm --prefix projects/ores.web run format:check reports every file in the style.

The deployment carried the branch under a fresh database: the services were rebuilt and restarted, ./compass.sh db recreate -y -k recreated the database, the environment was bootstrapped, and the member and the tenant administrator signed in through the BFF at http://127.0.0.1:20402.

The journeys then ran end to end over that stack: node doc/agile/versions/v0/sprint_26/implement-profile-journeys/evidence/profile_journeys_check.js drove the three journeys as both actors. 67 checks ran and 29 failed; every failure traces to one of the two platform defects the story's Decisions record and the two captures document, and none to this branch's own code. The administrator's write to a colleague's record passes — the picker's read, the account read, the profile write with its unset fields echoed — and so do the picture byte round trip, the member's reads, the read gap's refusal, the grants read, the upload policy and the refusal of the administrator's route. The member's own saves are refused, so the member's picture and contact record never land, and the administrator's checks that read them cannot pass; the one direct administrator failure is the same self-write defect, the administrator writing their own contact record. The raw output is evidence/profile_journeys_run.txt.

The self-write refusal reproduces in SQL alone, as the DDL user from the .env against ores_dev_brave_hopper, in a transaction that rolls back and keeps nothing:

begin;
do $$
declare rec ores_iam_accounts_tbl%rowtype;
begin
  select * into rec from ores_iam_accounts_tbl
    where username = 'ores_web_member'
    and valid_to = ores_utility_infinity_timestamp_fn();
  rec.modified_by := 'ores_web_member';
  insert into ores_iam_accounts_tbl select (rec).*;
end $$;
rollback;

With the self actor it raises Invalid modified_by: ores_web_member. Must be a valid account username or service role. (23503, from ores_iam_validate_account_username_fn line 41, reached through ores_iam_accounts_insert_fn line 85). The same block with rec.modified_by : 'ores_web_probe'= answers DO and exits 0. The ordering in the generated insert — the version replace first, then the modified_by validation — refuses the write, and the actor's permissions do not enter into it.