Reverse spec drafted

User Profile

A person-owned, cross-Workspace account profile for personal identity, accessibility, calendar defaults, notification preferences and security entry points. Uses a dedicated settings-style design rather than the shared Entity record-tab profile.

Observed route/account/profileFuture Spec 04 →

Current maturityWorking cross-Workspace personal settings profile with incomplete security and preference depth

Evidence confidenceVerified

Last reviewedAugust 4, 2026

Visual evidenceDeferred during UI updates

Current-state summary

The live User Profile at /account/profile is a person-owned settings experience, not an Entity record profile. It uses a dedicated full-page editor with five section buttons—Personal, Accessibility, Calendar, Notifications and Security—and one Save changes action. The page explicitly separates global personal identity from Workspace-specific job titles, Role Labels and Team memberships. This information architecture is intentionally different from the Overview/Activity/Notes/Files/Tasks tab design used by Designer Studio, Provider, Client and Project records.

Interface inventory

Anatomy and verified behavior

Verification states separate observed behavior from requirements or assumptions.

Element	Current behavior	Verification
Profile frame	Account · Personal identity eyebrow, My profile heading, explanatory separation copy, section navigation and Save changes action in a dedicated settings-style page.	Verified live
Personal	Profile image, first name, last name, display name, disabled authentication email, phone, timezone, locale, date format and time format.	Verified live
Accessibility	Reduce motion, Higher contrast and Larger interface text preferences that follow the User across Workspaces.	Verified live
Calendar	Default Calendar view, week start, typical working hours, working days and availability notes. Workspace schedules and assignments remain canonical elsewhere.	Verified live
Notifications	Per-channel checkboxes are generated from the current notification-event catalogue. Required invitation, approval, decline, provisioning-failure and activation messages cannot be disabled; the current catalogue is heavily Application/provisioning focused.	Verified live
Security	Supabase Auth ownership is explained. Password reset links to /forgot-password and sign-in email changes route to support email; MFA, active sessions, devices and recent security events are not visible.	Verified live
Profile family	Uses form sections and settings navigation rather than Entity summary cards, operational tabs or record-level Activity.	Verified design distinction

User journeys

Current flows

Update personal profile

Open account menu
Choose My profile
Select Personal
Update allowed person-owned fields
Review formatting and validation
Save changes
Propagate the canonical User identity to authorized Workspace views

Set personal preferences

Choose Accessibility, Calendar or Notifications
Change personal defaults
Preserve required operational/security messages
Save
Apply preferences across Workspaces without changing Workspace business records

Manage authentication

Open Security
Choose password reset or sign-in-email support path
Complete the Supabase Auth-owned flow
Return with updated verified identity

State model

Current and expected states

Personal section

Default editable profile surface.

Accessibility section

Three global presentation toggles currently Off.

Calendar section

Personal defaults and free-text availability inputs.

Notification preference

Optional event/channel choices can be on or off; required choices are checked and disabled.

Security

External authentication-management entry points only.

Dirty, saving, saved or conflict

Save action exists; detailed states were not exercised.

Product rules

Non-negotiable boundaries

User Profile belongs to one global User identity and follows that person across Workspaces.
Job title, Role Label, Team, Access Role, Membership state and Workspace-specific notification routing do not belong in the global User Profile.
A Workspace Owner may edit permitted Membership details but cannot rewrite another person’s global profile, authentication email, accessibility choices or personal notification preferences.
Authentication email is controlled by Supabase Auth and verified security workflows, not ordinary profile save.
Required operational and security notifications cannot be disabled, but the reason and channel remain visible.
Accessibility preferences must apply before or during initial render to avoid motion, contrast or text-scale flashes.
Calendar preferences do not overwrite canonical Project, Task, Work Order or Provider schedules.
User Profile intentionally uses the settings-profile design family rather than the shared Entity record-tab family.

Dependencies

Spec 04 Authenticated Workspace Dashboard and ProfilesSupabase AuthGlobal User ProfileWorkspace MembershipsSpec 16 reusable fieldsNotifications BuilderCalendar and availability servicesProfile image storageAudit and security events

Known current limitations · 5 mapped

What is missing, broken or unverified

Future Spec 04 owns closure →

Phone is currently a general textbox without the standardized international Phone Number component, E.164 contract, extension or channel-consent context.
Typical working hours and working days appear as text inputs rather than structured reusable schedule controls.
Notification preferences expose the incomplete current event catalogue and therefore over-represent Applications/provisioning while other product domains are absent.
Security lacks MFA, active sessions, device/session revocation, recent security events and direct verified email-change workflow.
Autosave, unsaved-change protection, server validation, save confirmation and concurrent-update behavior were not verified.

Future alignment

Required evolution

01Preserve this separate settings-style profile family in Spec 04.
02Adopt the Spec 16 Phone Number, timezone, locale, date/time and structured availability components.
03Expand Notification preferences automatically as the cross-product Domain Event catalogue grows.
04Add security-session management, MFA and verified email-change controls without storing credentials in the profile.
05Expose safe User Profile identity consistently through Avatars and Identity Chips while Membership context remains Workspace-specific.

Current baseline

Acceptance record

The User Profile card is listed under Entities and profiles but clearly identified as a person-owned settings profile.
All five live sections and their ownership boundaries are documented.
No Workspace action can change another person’s global preferences or authentication credentials.
Required notifications remain enforced and explainable.
No profile values were changed during review.

Reverse-spec completeness

Documentation coverage

The interface is still changing, so visual evidence and repository tracing remain intentionally incomplete.

Purpose and user outcome

Documented

Roles and access

Documented

Routes and entry points

Documented

Page and component anatomy

Documented

Fields and displayed data

Documented

Primary actions

Documented

Forms and validation

Documented

States and transitions

Documented

Empty, loading and error states

Documented

Responsive behavior

Partial

Accessibility behavior

Partial

Activity and audit events

Partial

Data sources and persistence

Documented

Notifications and automation

Partial

Known defects and limitations

Documented

Reusable component dependencies

Documented

Future-spec conflicts

Partial

Visual and repository evidence

Deferred

Acceptance of current baseline

Documented