Account and Pull-Up/Push-Up Workflow Gate Review
Purpose
This review defines the safe implementation path from current protected previews toward real accounts and live pull-up/push-up drafting.
It is a gate review only. Live submissions do not begin until every account, identity, review, retention, audit, visibility, and pilot gate is resolved.
Current State
Product
Renata
The Sixth Sense at 6th StreetMigration line
paused
pausedAccounts
false
not implementedLive drafts
false
not implementedThe role-set migration line is paused; the next product priority is sequencing account boundaries and pull-up/push-up workflow gates before any live implementation.
Why Accounts Come Before Live Pull-Ups/Push-Ups
Live community drafts require a known access boundary, a privacy-safe actor model, role mapping, staff review rules, retention limits, deletion paths, and a visibility policy before anyone can submit or review real content.
Without those gates, the system cannot safely decide who can draft, who can review, what can be retained, what may appear on the Morning Sheet, or what must stay out of storage entirely.
Account Architecture Options
Cloudflare Access claims only
Use Cloudflare Access as the outer gate while the app stores no identity values.
Recommendation: safest near-term path
Risk: lowest
safest-near-term- Cloudflare Access protects the route family
- app does not expose email, name, token, JWT, or identity details
- no local account table
- no user assignment
- no resident or staff profile
Benefits: keeps authentication boundary outside the app; supports protected planning without identity storage; lets staff review claims exposure before account storage exists.
Blockers: does not support app-level role assignment; does not permit live submissions by itself; requires claim boundary review before any pilot.
Pseudonymous local account map
Future option that maps approved protected users to pseudonymous local actor refs.
Recommendation: plan only after Cloudflare Access claim boundary review
Risk: medium
future-option- privacy approval before storage
- identity policy before actor mapping
- retention and deletion policy
- audit logging design
- no real names or emails in app tables
Benefits: could support role mapping without storing direct identity; could separate app actor refs from Cloudflare identity values; could prepare a narrow live-draft pilot later.
Blockers: requires storage planning; requires staff/privacy review; requires rollback and deletion policy before pilot.
Full user profile model
Blocked model that would store direct user profiles and identity-linked records.
Recommendation: blocked before live pilot
Risk: highest
blocked- identity review
- privacy review
- retention review
- audit and export review
- deletion policy
- legal review
Benefits: could eventually support richer user administration; could support account lifecycle management after approvals.
Blockers: direct identity storage is not approved; resident and staff profiles are not approved; export/deletion/legal policy is not complete.
Pull-Up/Push-Up Workflow Gates
| Gate | Status | Risk | Requirement |
|---|---|---|---|
| Access boundary | review-next | medium | Confirm what Cloudflare Access protects and what the app must not expose. |
| Identity policy | blocked-before-storage | high | Decide whether identity values are ever stored and how they are minimized. |
| Pseudonymous actor model | planning-only | medium | Define actor refs without real identity values. |
| Account-role mapping | planning-only | medium | Plan how protected users could map to roles without live assignment. |
| Draft schema | planning-only | high | Plan draft storage boundaries before any pull-up or push-up collection. |
| Staff review policy | blocked-before-live | high | Define review procedure before any staff decision is stored. |
| Retention policy | blocked-before-live | high | Define how long drafts/reviews could exist before any storage. |
| Audit logging | blocked-before-live | high | Define audit metadata without exposing identity or sensitive content. |
| Deletion/rollback policy | blocked-before-live | high | Define deletion, rollback, and mistake-correction paths. |
| Morning Sheet visibility policy | blocked-before-live | high | Define who can approve public placement and what never appears. |
| AI-use policy | blocked-before-live | high | Decide whether AI may ever touch real peer/community submissions. |
| Small pilot approval | blocked-before-live | high | Approve a limited pilot only after all earlier gates are resolved. |
Safe Implementation Sequence
-
Phase 8.1 - Cloudflare Access Claim Boundary Review
recommended-nextInspect what claims are available conceptually without exposing email, name, token, JWT, or identity details.
Boundaries: no identity response payload; no storage; no account creation.
-
Phase 8.2 - Pseudonymous Actor Model Planning
future-planningDefine actor refs without real identity values.
Boundaries: no storage yet; no user assignment; no live submissions.
-
Phase 8.3 - Account Role Mapping Schema Planning
future-planningPlan mapping between actor refs and roles without an active migration.
Boundaries: no active migration; no role assignment; no account table.
-
Phase 8.4 - Pull-Up/Push-Up Draft Schema Planning
future-planningPlan draft storage boundaries and excluded fields.
Boundaries: no draft collection; no sensitive content storage; no write endpoint.
-
Phase 8.5 - Staff Review Procedure Planning
future-planningPlan review rules before any staff decision or queue storage exists.
Boundaries: no approval/rejection workflow; no staff decision storage; no Morning Sheet placement.
-
Phase 8.6 - Live Draft Pilot Readiness Review
future-gateDecide whether any limited live pilot can start.
Boundaries: all gates must be resolved first; no live submissions until approved; rollback plan required.
Live submissions do not begin until all gates are resolved.
Allowed Next-Phase Candidates
These are planning candidates only. They do not create accounts, store identities, assign roles, or collect drafts.
Blocked Capabilities
- app-level login
- account creation
- email capture
- identity capture
- identity storage
- resident profile storage
- staff profile storage
- user admin CRUD
- live role assignment
- workflow activation
- live pull-up collection
- live push-up collection
- submission collection
- live staff decisions
- staff approval/rejection
- live Morning Sheet placement
- exports
- AI for real submissions
- database writes
- write endpoints
- active migrations
- D1 account/user/submission tables
- attendance tracking
- participation tracking
- participation analytics
- scoring, ranking, discipline points, or compliance metrics
- billing, lead capture, CRM, Stripe, or sales forms
- sensitive community content storage
What Must Never Become Tracking/Scoring
Pull-ups and push-ups must not become attendance tracking, participation tracking, participation analytics, resident productivity tracking, scoring, ranking, discipline points, compliance metrics, or resident performance metrics.
The workflow must remain about repair, recognition, staff-reviewed boundaries, and privacy-first operations, not surveillance.
Not Allowed Next
Approval Gates
- Cloudflare Access claim boundary reviewed
- identity policy approved
- pseudonymous actor model approved
- account-role mapping approved
- draft schema boundaries approved
- staff review policy approved
- retention policy approved
- audit logging policy approved
- deletion/rollback policy approved
- Morning Sheet visibility policy approved
- AI-use policy approved or AI remains excluded
- small pilot approval recorded
Recommended Next Phase
Phase 8.1 - Cloudflare Access Claim Boundary Review
Cloudflare Access is already the outer gate; the safest next step is to review claims conceptually without exposing or storing identity.
Boundaries: no account creation; no app-level login; no identity response payload; no email/name/token/JWT return; no storage; no role assignment; no submissions; no staff decisions.
recommended-next