standup
Standup — 2026-07-01
**[#252](https://github.com/caseproof/memberintel/pull/252) shipped the citation full-text modal.** URL-less playbook citations now carry a ↗ button that lazily
Daily standup for 2026-07-01. What shipped:
#252 shipped the citation full-text modal. URL-less playbook citations now carry a ↗ button that lazily fetches the full body via a new GET /api/v1/brain/sources/{id} — entitlement-guarded to global-or-own-tenant with a uniform 404 (no id-enumeration oracle). The modal header renders instantly from metadata already in hand; the body is cached per session. 1,126 backend tests pass, including 7 new endpoint tests covering each entitlement arm.
Two citation housekeeping fixes landed alongside it: #249 fixed inline summary contrast (--ink-muted → --ink-3 on the near-white Sources panel), and #246 scrubbed an internal analysis name that had leaked into 21 playbook author: fields — reaching the chat API payload and staging brain metadata via format_citations forwarding the raw metadata dict verbatim. The staging brain was remediated; the source files now match.
ADR-0029 (#257) records the citation content-access decision: metadata-only in the chat payload, body fetched lazily by id. Status is Accepted — condition open: the ai-engineer review caught that “metadata only” wasn’t true by construction — format_citations forwards the full metadata blob, the exact path that caused the author leak. The fix (an explicit allowlist in format_citations) is filed as #256; ADR-0029 closes when that merges.
Playbook content work: Omar added published_date/last_reviewed date fields to frontmatter and backfilled 28 entries (#236), and hand-authored summaries for 4 playbooks whose auto-derives read thin in citation context (#244).
The KB gained a /roadmap page (#24) — a two-axis explainer (product Versions vs calendar Phases) seeded from a triangulated audit of 183 PRs, 46 standups, and 28 ADRs. The verdict: deep in an expanded V1, V1.5 write-actions unstarted. ADR-backed status cells auto-refresh daily via a new sync-roadmap-status.mjs step wired into the existing standup pipeline.
Notable. The author field leak is a recurring de-identification bug class — scrubbing at ingest is fragile. Blair’s condition on ADR-0029 is that the allowlist fix lands with a regression test asserting a planted non-allowlisted field never reaches the payload. That’s the right fix; #256 is the one to watch.
Window: 2026-06-30T13:00
→ 2026-07-01T11:47.495Z · Sources: memberintel @ df7da19, memberpress-intel @ 6c06852