Contract-freeze · UX approval · design-first

Root / portal member directory · Approval Frames

With literal root membership, "members of root = everyone" — so the platform (or a portal's) member view is not a small team list, it is a paginated, searchable user directory. This is distinct from the per-org Members & roles surface (authz-admin), which lists a single org's direct members. Because the directory can be arbitrarily large it is subject to gate-pagination — page-based paging and server-side search are contract, not enhancements. Approving freezes the visual + interaction model and commissions a new directory endpoint. Built in the fuse-seam design system (tokens only).

Frame (a) · flow: member-directory

📖 Directory

Paginated, searchable directory of all users of a root/portal: person · email · joined · role. Server-side search box, total count, page-based pager.

Frame (b) · states are contract

◔ States

Loading skeleton (aria-busy), no-search-results (distinct from empty), the real empty (fresh install = just you), error+retry, pager boundaries, and 403-in-place for a non-admin.

Build inventory — approving these frames approves this plan

Flows

member-directory → MemberDirectoryFlow @ /organizations/:id/directory · approved:false

Components

MemberDirectory
DirectorySearchBar
DirectoryTable
DirectoryRow
Pagination
DirectoryEmptyState
NoResultsState
DirectoryForbiddenNotice

Packages

@fuzefront/identity-ui

Feature flag

fuzefront.identity.member-directory

Contract mapping — what approval commissions

Commissioned by approval (NEW endpoint): GET /api/organizations/{id}/directory?query=&page=&pageSize= — a paginated, server-side-searchable list of all users of a root/portal org (DirectoryPage { items, page, pageSize, total }). Does not exist in packages/security/openapi.yaml today; contract-designer must freeze it. Distinct from the cursor-paged GET /v1/security/tenants/{tenantId}/members (small-team member list) — the directory is page-based and search-first because "everyone" is unbounded.
Scale (gate-pagination): the flow MUST paginate and MUST push search to the server — it may never fetch all users client-side. The pager and search box are part of the frozen contract.
Authz: directory access is an org-admin/owner (or Employee/ReBAC) capability; a non-privileged caller gets 403 FORBIDDEN rendered in place.
Root vs portal: the same endpoint serves any tenant-root; {id} = the root org id or a portal-root org id. "root" is relative to the portal.

Design system: @fuzefront/design-system (fuse-seam) · Contract: packages/security/openapi.yaml → @fuzefront/security-client (directory endpoint commissioned) · Component: @fuzefront/identity-ui → MemberDirectoryFlow · Flag: fuzefront.identity.member-directory (default OFF).
Approve per flow by setting build.flows[].approved: true (+ approver + date), or reply @claude approve / @claude reject: <reason>.