Every feature awaiting UX approval. Each entry is a navigable HTML frame set built in
the fuse-seam design system — the visual contract that implementation and Playwright verification
are measured against. This directory is generated from the folders present in
design/frames/; it is never hand-maintained.
Contract-freeze UX artifacts for the account-security hub: the navigational spine linking password, two-factor, devices & sessions, API tokens, and connected accounts. Approving these frames approves the AccountSecurityHub visual + interaction model and its component/package plan before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for the vendor-neutral machine-to-machine service-token surface (create-scoped → reveal-once secret → list → revoke) backed by FuzeFront's Security API. Approving a flow approves its visual + interaction model AND the component/package build inventory before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. The reveal-once screen (03) is the most important in the flow.
Contract-freeze UX artifacts for docs/planning/app-builder-and-ownership.md (rollout item F-2). Four flows: (1) a 'Build your application' card beside the dashed 'Add application' card on /applications; (2) the build session — form (where/name/brief), progress (launching → building → deploying → deployed), FuzeAgent deep link, cancel, and every terminal/refusal state; (3) the org-held, user-originated ownership block in app detail (org as owner, creator name+contact while a member, 'former member' after); (4) the marketplace publish request and the platform-admin review queue. Each flow ships dark behind its own default-OFF release flag. Approving a flow approves its visual + interaction model AND its component/package/contract build inventory. Flows bind to the REAL @fuzefront/app-registry-client (app-registry 1.2.0, #1261); two additive contract amendments are commissioned by approval (see commissionedByApproval).
Contract-freeze UX artifacts for the App Management Console (FF-EPIC-20) — the management surface FuzeFront has never had. Three flows: (1) list every registered app (searchable/filterable/paginated) with lifecycle state, visibility and owning org; (2) open one app to view/edit its settings & attributes and run its lifecycle (activate/suspend), built-ins non-deletable; (3) manage where an app is installed and at what scope (org/portal/user). Distinct from federated-apps (the register→activate add-app flow). Approving a flow approves its visual + interaction model AND its component/package/contract build inventory before any UI is written. Flows 1 & 2 bind to the REAL @fuzefront/app-registry-client; flow 3 (installations/scopes) is anticipated and commissioned by these frames. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for four shell changes and one new backing service: per-app install scope levels (personal / organization / both) with an install-for-me vs install-for-everyone choice; the organization switcher and language switcher moving out of the top bar into the avatar menu; a multi-account switcher bounded at MAX_PARALLEL_ACCOUNTS=5 with a per-account storage-namespace isolation contract; and the notification bell backed by a real notification-service inbox. Approving these frames approves the interaction model AND the build inventory (flows / components / services) before implementation.
Freezes the host shell behaviour where the active app injects its own nested navigation into the left side panel (Atlassian/Sentry convention), replacing top navigation tabs, and the Add/Edit/View/Delete chapter lifecycle plus org-context app gating (disabled state) rendered inside it. Approving these frames approves that shell-injection model.
Contract-freeze UX artifacts for FuzeFront's complete, professional sign-up & sign-in: a single OPTIONAL i18n-safe full-name field (replacing first/last), inline email-availability, a password strength meter + live requirements checklist and confirm-match against the authoritative policy, Cloudflare Turnstile, the email-verification state machine, and the honest no-enumeration password reset. Approving these frames approves the flows, components, packages and contract deltas in `build`. frontend-test-engineer drives Playwright against the data-frame / data-* hooks. Per-flow approval — one approved flow unblocks that flow's implementation. 2026-10-21: the signup flow was redesigned (full-name field + password-policy checklist + weak-password/service-unavailable states), so its prior approval is withdrawn and it awaits re-approval; signin, verify-email and password-reset are unchanged and keep their approvals.
Contract-freeze UX artifacts for the vendor-neutral tenant/org access-administration surface (members, roles, invite/add, change-role, remove) backed by FuzeFront's Security API. Approving a flow approves its visual + interaction model AND the component/package build inventory before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. RECONCILED to the personal-identity/root-membership model: this per-org list shows DIRECT active memberships only — access from above (parent/root/reseller ReBAC) has no membership row and is hidden here by omission; the root/portal org (members=everyone) uses the paginated member-directory feature instead; and the per-org GUEST/non-member state no longer applies to the root org, which now resolves to user_role='member' (MEMBER badge, #529 GUEST retired).
Contract-freeze UX artifacts for the vendor-neutral, DB-backed invoice history capability. Approving these frames approves the InvoiceHistoryPanel visual + interaction model before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* attributes.
Freezes the UX for the configuration console FF-EPIC-17/18 has no UI for: a settings editor that states where every value came from, a key catalog that states what every key is, and the secret + audit surfaces that make changes safe and attributable. Approving these frames approves the visual model AND the build inventory (flows / components / packages), so implementation cannot quietly invent a different architecture. The load-bearing states are contract, not decoration: locked-by-ancestor naming the ancestor from lockedBy, system-hidden keys ABSENT rather than filtered, unset vs pin-the-parent's-value as two distinct operations, VERSION_CONFLICT driving re-read-and-merge instead of blind retry, stale-value-vs-updated-definition, and secret reveal-once.
Contract-freeze UX artifacts for the connected-accounts surface reached from the security hub's 'Connected accounts' card (/account/security/connections): connect a social sign-in provider (Google), list linked providers + password, and disconnect one while always keeping at least one way to sign in. Approving this flow approves the ConnectedAccountsPanel visual + interaction model and its component/package plan before UI implementation. Closes the connect half that securityClient does not yet implement (only unlinkProvider exists today). frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. Jira: FFRNT-296.
Contract-freeze UX artifacts for active-session/device management: list every signed-in device (browser, OS, location, last-seen, this-device flagged), sign out a single session (including the caller's own current session), and sign out everywhere else. Revocation is enforced server-side. Approving a flow approves its component/package plan before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. No provider name appears in any consumer surface.
Design-first UX contract for the standalone Fuze developer portal: home (signed-out + personalized signed-in), the aggregated OpenAPI catalog, the spec viewer with its embedded OpenAPI render, the sandboxed 'Try it' playground, and My access. States are contract here, not decoration — the catalog's nothing-harvested-yet and harvest-failed cases, the viewer's invalid-spec fail-closed case, and the playground's 429 quota-exceeded, sandbox-target-unavailable (with an explicit no-production-fallback statement) and 403 cases each have a frame. Approving a flow approves its slice of the build inventory, so implementation cannot invent a different component/package layout. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for the Employee (platform staff) cross-org console. An Employee is the existing Permit ReBAC org-admin-on-root capability (derives down the parent tree) formalized as a named, scoped role. An Employee operates across customer orgs from the root/portal-management console WITHOUT a membership row in any customer org — so a customer's own member list never shows them. This console is the only place that inherited/derived staff access is surfaced, as a clearly separated, labelled panel. Approving the flow approves its visual + interaction model AND commissions the 'Employee' role in the role catalog. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for the federated-app platform. Approving these frames approves the App Manifest model before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* attributes.
Redesign of FuzeAgent UX/UI in accordance with FuzeFront Design System tokens, inherited components, live streaming chat, modal dialog layout stability, high-contrast blueprint catalogs, multi-tier Brain RAG & S3 ingestion, and contextual portal dark/light theme switching. Managed and planned via FuzeX SaaS product workflow.
Contract-freeze UX artifacts for the reconciled identity/tenancy model: the user identity is the base principal, signup makes a user a member of the root FuzeFront org (the platform tenant), and orgs are opt-in tenants. Operating 'as yourself' is a first-class Personal (non-org) context; the root org shows a MEMBER badge, never GUEST; type='personal' orgs are dropped. Unifies the local <select> in OrganizationPage.tsx and the persisted setActiveOrganization in UserMenu.tsx into one ContextSwitcher. Approving a flow approves its visual + interaction model AND the component/package build inventory before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for locked app mode (white-label own-domain web + per-product native app). Approving these frames approves the mode:locked + branding + native manifest model before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* attributes (frontend/tests/locked-app-mode-frames.spec.ts).
Contract-freeze UX artifacts for the root/portal member directory. With literal root membership, 'members of root = everyone', so the platform (or a portal's) member view is a paginated, searchable USER DIRECTORY — distinct from the per-org Members & roles surface (authz-admin) which lists a single org's direct members. Subject to gate-pagination: page-based paging and server-side search are contract. Approving the flow approves its visual + interaction model AND commissions a new directory endpoint. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for two-factor authentication management: enrol an authenticator (TOTP) or phone (text message), one-time recovery codes, remove a method, and the step-up challenge shown mid sign-in. Approving a flow approves its component/package plan before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. No provider name appears in any consumer surface.
Mobile (375px, Android TWA viewport) treatment of the provider-neutral Security API step-up and contact-verification UX requested in issue #251: choose-a-factor, OTP code entry, phone contact verification, and a combined mobile security-status screen. Built for Issue #251's design-review request. Reconciled against already-in-repo flows (see `reconciliation` below) rather than shipping a disconnected fourth pattern for the same data: extends the unapproved `mfa-management` step-up flow with an explicit mobile/375px treatment and the missing loading/empty/generic-error states; adds a genuinely new phone-OTP verification screen while leaving the already-approved email link-click pattern (`auth-experience` `verify-email`) untouched; and adds an additive mobile security-status screen rather than a duplicate of the approved `account-security` hub. No vendor name appears anywhere in the UI. Approving a flow approves its component/package plan before UI implementation; frontend-test-engineer drives Playwright against the data-frame/data-* hooks.
375px (phone / Android TWA viewport) frames for the host shell's primary mobile navigation, closing the gap recorded in docs/design-system/portal-ux.md §5: the design system's mobile guideline specifies a BottomNav below md (≤768px) and the BottomNav primitive exists in @fuzefront/design-system, but it is NOT wired into the host shell — the shell is drawer-only today, so a phone user has no persistent, thumb-reach navigation. These frames freeze how the bottom nav mounts in the shell (3 primary destinations + More), how it coexists with the existing slide-in drawer (one overlay, two triggers — reusing SidePanel/isSidebarOpen, not a second primitive), and the loading/empty/error/safe-area/touch-target states, before any shell code is written. Shell chrome owned by mobile-frontend-engineer; no new npm package. Approving the flow approves the component plan; frontend-test-engineer drives Playwright against the data-frame/data-* hooks.
Contract-freeze UX artifacts for FuzeFront's organization invitations v2 (Jira FFRNT-306, epic FFRNT-304). Covers three flows: (1) the Members-tab invite modal choosing invitee kind {existing|external}, channel {email|WhatsApp e164}, role {admin|member|viewer} and member type {employee|customer} plus the pending-invitations list (resend/revoke); (2) accept -> sign up (incl. Google/Facebook) -> auto-bind for a brand-new external invitee, showing org + role + member type; (3) the root-org owner inviting an external person (Gmail/WhatsApp) as a customer. States are contract: loading/empty/error and the fail-closed cases (410 expired/revoked, 403 identity mismatch, 409 already-accepted, 409 last-owner, 403 forbidden). Approving a flow approves its visual + interaction model AND its slice of the component/package/contract build inventory before UI implementation. Invitations have NO OpenAPI contract today (v1 is un-contracted Express) so the endpoints here are commissioned for contract-designer to freeze. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for three password flows: unauthenticated self-service reset, signed-in change-password, and set-first-password for a social-only account. The 'check your email' screen renders the deliberate no-enumeration 202 honestly. Approving each flow approves its slice of the component/package plan. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks.
Contract-freeze UX artifacts for the two multi-tenant admin surfaces: a master-admin (portal-management) console to run the portal fleet (list/create/suspend/resume + domain status) and a portal-admin console for a tenant to run its own users, app catalog, and billing (Stripe Connect). Approving a flow approves its visual + interaction model AND its component/package/contract build inventory before UI implementation. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. UI-only (FF-EPIC-14) consuming FF-EPIC-09/11/12/15. RECONCILED to the unified org-tree model (see modelReconciliation): a portal is an ORG that is a direct child of the platform root (organizations + parent_id), NOT a separate portal-service entity — the anticipated @fuzefront/portal-client / portal-service surface is SUPERSEDED by org-tree CRUD carrying tenant attributes. The same org/membership/role machinery applies recursively ('root' is relative to the portal). Portal-scoped members reuse the per-org access-admin surface; the portal member VIEW (members=everyone in the portal) uses the member-directory feature; cross-org platform staff are the Employee console.
Contract-freeze UX artifacts for the Portals Directory: a left-menu directory in the FuzeFront shell where a master-admin sees the portals they can manage and OPENS a chosen portal in a NEW browser tab at that portal's own host URL (launchUrl). Management continues on that host under the existing per-host tenant routing — there is deliberately NO in-app portal switcher and no context switch. Each portal carries an identity tier badge: soft (shares the root Authentik) or hard (its own Authentik instance, e.g. Mendys Robotics). Approving the flow approves its visual + interaction model AND its component/contract build inventory before any UI is written. frontend-test-engineer drives Playwright against these via the data-frame / data-* hooks. PortalsDirectory is a shell page in frontend/src — NOT a new npm package. States are contract: loading, empty, error+retry, suspended (no launch), and the fail-closed permission-denied / read-only case (no manage authority => zero launch affordances).
Contract-freeze UX artifacts for FF-EPIC-17 (FFRNT-188). Approving these frames freezes the visual + interaction model AND the build inventory (4 flows, 8 components, 2 packages) for the org-admin management UI, the runtime-i18n translation workbench, per-list ReBAC access control, and the embeddable <SelectionListPicker>, before any feature UI exists. Approval is PER FLOW. Merging an approved flow dispatches UX QA to write ALL-RED Playwright specs against the data-* hooks below, then frontend-engineers implement components -> flow orchestrators -> the @fuzeone/selection-lists-ui package. S9, S10, S11 and S13 are blocked on approval here; gate-frames-first fails any frontend/src/** or packages/*-ui/** PR not covered by an approved flow in this manifest.
Contract-freeze UX artifacts for design-record task 13 of docs/planning/selection-lists-shared-and-fork.md (contract 4.1.0). Approving these frames freezes the visual + interaction model AND the build inventory (5 flows, new components under packages/selection-lists-ui/src/shared-lists/**, no new package, no new host route) for: the common-list badge and read-only detail, the 'Fork to edit' path from 409 fork_required (and its 403 variant), the fork confirmation and every fork result, fork provenance + the informational 'behind source' indicator, the owner's visibility control (platform promotion for platform operators only; demotion locked), the list index with include_shared (grouping, shadowing, visibility filter) and the picker resolving the EFFECTIVE list by key. Loading / empty / error / fail-closed and flag-OFF states, RTL (he/ar) and 375 px are contract. Approval is PER FLOW. Merging an approved flow dispatches UX QA to write ALL-RED Playwright specs against the data-* hooks below; then frontend-engineer implements (design-record task 14). gate-frames-first BLOCKS any change under a flow's implementation.paths until that flow is approved.
FFRNT-361: SMS phone verification as a step of account registration. Freezes where the step sits in signup (immediately after POST /signup issues a session, before the approved check-inbox screen, in parallel with email verification), the single exit rule that skips check-inbox when no email is pending, the flagged sign-in re-prompt for policy=required, the enter-phone → sending → enter-code → verified path, and every state the UI must render: wrong / expired / too-many-attempts (429) codes, send failure, send rate-limit, SMS channel unavailable (honest degrade, never a dead end), number can't be used (409 only after a correct code — no enumeration), server-rejected number, both skip-policy outcomes, loading, already-verified, resume-after-reload, session expired and generic error — at desktop and 375px. Approving the flow approves the build inventory below and the listed contract deltas. frontend-test-engineer drives Playwright against the data-frame / data-* hooks.
Contract-freeze UX artifacts for the FuzeFront white-label tenant portal: one shell (topbar + side panel + app grid) and one login, reskinned to the active portal's name/logo/accent from GET /api/v1/portal/context, applied entirely through design-system token overrides (no raw hex). Covers loading (no-flash), error, and the fail-closed cases (suspended portal, unknown-host root fallback, cross-portal login rejection) plus light/dark theming. Approving these frames approves the flows, components, DS primitive, and package in `build`. frontend-test-engineer drives Playwright against the data-frame / data-* hooks. Per-flow approval — approving portal-shell unblocks that flow independently of portal-login.