# ORACLE-OS-CONTROL-PANEL-SETTINGS-GOAL.md  
## Full Settings control panel — every section, every option

| | |
|---|---|
| **Version** | v1 (2026-07-21) |
| **Owner** | Ryan (nastermodx) |
| **Status** | **S0+S1 SHIPPED (v9.10.456)** · S2–S5 open |
| **Surface** | Dashboard **Settings** (`SETTINGS2` in `oracle.html` — Account / Plan / Ecosystem / Agents / Appearance / Privacy / General / Legal). Opened via guest Me → Settings, rail, quick menu, etc. |
| **Code** | `oracle.html` (`SETTINGS2`, `s2Nav`, `s2Save*`, `openGuestSettings2`), `command-center-server.mjs` (`/api/me`, `/api/me/settings`, `/api/me/profile`, storage, credits), `shared/plan-tiers.mjs` |
| **NOT this surface** | Host industrial control (fleet restart, providers) → `ORACLE-OS-SETTINGS-GOAL.md`. In-workspace OS desktop Settings app → `ORACLE-OS-WORKSPACE-SETTINGS-GOAL.md`. Spaces product design → `KAI-SPACES-AND-USER-SETTINGS-GOAL.md`. |

---

## 0. Owner intent (why this goal exists)

**The entire Settings control panel — all sections, all options — must be updated and improved.**

Not a cosmetic pass. Each page must:

1. **Show real data** for the **logged-in user** (name, avatar, plan, usage, storage, sessions).  
2. **Save what it claims to save** (no “Saved ✓” that no-ops or wipes fields).  
3. **Do something useful** when a control is used (or be honestly labeled **Coming soon** and disabled).  
4. **Feel like one product** — consistent layout, copy, density, success/error feedback.  
5. **Respect identity & multi-user**: every preference/file/trace is **per-user** in the user DB / tenant / Drive folder — never a shared “User” placeholder.

---

## 1. Inventory (live tree — `SETTINGS2` in `oracle.html`)

### Account
| Sub | Purpose | Reality today (high level) | Priority |
|-----|---------|----------------------------|----------|
| **Profile** | Display name, bio, work/rel, interests, avatar | Partially fixed (flat `/api/me` fields); still fragile; must be rock-solid | **P0** |
| **Sign-in & Security** | Password, PIN, 2FA, idle lock | PIN/idle partially wired; 2FA UI exists; must verify end-to-end | **P0** |
| **Activity** | Action log | API exists; polish filters/empty states | P1 |
| **Sessions & Devices** | Active sessions + sign-in history | Exists; must revoke correctly | **P0** |
| **Linked Accounts** | Google / Discord / YouTube | Partial; some cells “Loading…” forever | P1 |
| **About this account** | Id, role, plan, member since | Must show **real** account, not “User” | **P0** |
| **Danger Zone** | Export / deactivate / delete | Exists; confirm flows + copy | P1 |

### Subscription & Usage
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Current Plan** | Plan card + upgrade path | Cards exist; actions must match `plan-tiers` | **P0** |
| **Usage & Analytics** | Credits / tool usage | Guest credits path; needs clear meters | P1 |
| **Extra Credits** | Balance + auto-topup | Partial | P1 |
| **Billing & Payment** | Payment methods | Often **Soon** — either ship or hide | P2 |
| **Invoices** | History | Stub/soon until payments live | P2 |
| **Storage** | Drive quota + files | API exists; must match workspace Drive | **P0** |
| **Pricing Reference** | Tier matrix | Static/read-only OK if accurate | P2 |

### Internet & Data
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Web Browser** | Default browser behavior | Partial | P1 |
| **Search & Privacy** | Search engine | Host decides provider; UI must not lie | **P0** |
| **Data & Storage** | Cache / downloads | Often soon | P2 |
| **Connections** | Network / external | Partial | P2 |

### Ecosystem
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Feed** | Algorithm / following | Partial | P1 |
| **Notifications** | Push / email / in-app | Partial — must persist | **P0** |
| **Channels & Rooms** | Defaults for Spaces | Product link to Spaces goal | P1 |
| **Content Filters** | Safety / mute words | Partial | P1 |
| **Language & Region** | Locale | Often soon | P2 |

### Agents
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **My Agents** | Roster visibility | Partial | P1 |
| **Behavior & Permissions** | What agents may do | Often soon | P1 |
| **Default Model** | Thinking / model prefs | Partial | P1 |
| **Memory & Knowledge** | Personal memory scope | Partial | P1 |
| **Automations** | Scheduled agent jobs | Soon | P2 |

### Appearance
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Theme** | Light/dark/system | Must apply + persist | **P0** |
| **Density & Text** | UI density | Must apply + persist | **P0** |
| **Motion** | Reduce motion | Must apply + persist | **P0** |
| **Desktop Chat** | Chat chrome | Partial | P1 |
| **Profile Theme** | Cover / profile skin | Partial (profile API) | P1 |

### Privacy
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Visibility** | Who sees profile | Must match server | **P0** |
| **Messaging** | DM policy | Must match server | **P0** |
| **Presence & Status** | Online/idle visibility | Partial | P1 |
| **Read Receipts** | Seen ticks | Partial | P1 |
| **Blocked** | Block list | API path exists | P1 |
| **Data Sharing** | Analytics opt-out | Partial | P1 |

### General
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Language** | UI language | Soon / partial | P2 |
| **Startup** | Default landing view | Should work | P1 |
| **About Oracle OS** | Version / build | Must show real `CC_BUILD_ID` + `KAI_VERSION` | **P0** |

### Legal
| Sub | Purpose | Reality | Priority |
|-----|---------|---------|----------|
| **Privacy Policy** | Link / embed | Content accuracy | P1 |
| **Terms of Service** | Link / embed | Content accuracy | P1 |

---

## 2. Cross-cutting product rules (non-negotiable)

### R1 — Identity
- Every Settings page reads from **live `/api/me`** (or a single in-memory `me` refreshed at open).  
- Never show placeholder **“User”** when a session exists.  
- Avatar, plan, role, userId visible on **About** and **Profile**.

### R2 — One save model
- Prefer **explicit Save** for multi-field forms; **immediate save** for toggles (with toast).  
- Blank field on multi-field forms = **keep existing** (already fixed for profile — apply everywhere).  
- Errors show **server message**, not silent failure.

### R3 — No dead controls
- If backend missing: control is **disabled** + **“Coming soon”** (not fake success).  
- Audit every `_s2soon` and either implement or hide for free tier.

### R4 — Per-user isolation
- Settings store: tenant `userSettings` + user record (already partially true).  
- Storage/Drive: `users/<userId>/…` only.  
- Session restore / workspace prefs keyed by **user id**.

### R5 — Surfaces stay split
| Surface | Audience | Doc |
|---------|----------|-----|
| **This Settings panel** | Every logged-in person | **This file** |
| Host Server Control | Owner/admin operators | `ORACLE-OS-SETTINGS-GOAL.md` |
| Workspace OS Settings app | Builder+ Antigravity desktop | `ORACLE-OS-WORKSPACE-SETTINGS-GOAL.md` |

Do **not** dump fleet restart next to “read receipts.”

### R6 — Visual system
- Shared: section header, row helper, toggle, select, danger button, toast.  
- Mobile: nav as horizontal chips or back-stack (existing `.set2-*` — improve, don’t abandon).  
- Accessibility: reduce-motion honor, contrast, focus rings.

---

## 3. Implementation phases

### Phase S0 — Audit & kill lies  ✅ v9.10.455
- [x] Identity on open: `openSettingsV2` requires real `/api/me`; `s2Data()` merges `me` + `_s2.me` + `window.me`  
- [x] Unwired toggles **disabled** (no fake flips); Soon badge kept  
- [x] About Oracle OS: version + **dashboard build** from `/health` + signed-in user line  
- [x] Storage: live `/api/storage/usage` + **Open workspace files** (Antigravity FM)  
- [x] About this account: prefer `me.avatarUrl`  
- [ ] Full manual walk of every sub (owner eyeball)

### Phase S1 — Account + Security P0  ✅ v9.10.456
- [x] Profile: photo upload + theme/cover buttons in Settings  
- [x] Sign-in: password, PIN, 2FA from `s2Data()`; auto-lock options include **20 min**; applies idle+bg immediately + saves `security.idleLockMin`  
- [x] Login alerts wired to `security.loginAlerts`  
- [x] Sessions revoke toast + reload; sign-in history already hooked  
- [x] Danger zone export/deactivate/delete already real (left as-is)

### Phase S2 — Plan, usage, storage P0
- [ ] Current plan accurate + upgrade CTA.  
- [ ] Storage quota = same as Drive `/api/storage/usage`.  
- [ ] Credits balance + auto-topup honest.  
- [ ] Hide billing/invoices if payment not live (or wire Stripe).

### Phase S3 — Appearance + Privacy + Notifications P0/P1
- [ ] Theme / density / motion write `/api/me/settings` **and** apply CSS immediately.  
- [ ] Visibility / messaging / blocked end-to-end.  
- [ ] Notifications prefs persist.

### Phase S4 — Ecosystem + Agents
- [ ] Feed / filters / channels defaults.  
- [ ] Agent behavior + default model + memory scope.  
- [ ] Automations only if Jobs API can power them.

### Phase S5 — Polish & extract
- [ ] Consistent empty states, skeletons, toasts.  
- [ ] Optional: split `settings2/` modules out of `oracle.html` (surgical, like `oracle-os/`).  
- [ ] Tests: structure gates for each P0 sub id; profile save blank-means-keep unit tests.

---

## 4. Acceptance (control panel “done enough”)

1. Logged-in owner sees **own name + avatar + plan** on Profile and About.  
2. Change display name + bio → refresh → still there.  
3. Theme/density toggle → UI updates **now** and after reload.  
4. Storage page matches Drive quota used in workspace File Manager.  
5. No Settings control shows success without a real side effect (or is labeled Soon).  
6. Member/guest never sees host-only Server Control actions inside this panel.

---

## 5. RESUME HERE (next agent / next session)

1. Read this file. **S0+S1 done** — next is **Phase S2** (Plan, usage, storage polish).  
2. Then S3 Appearance/Privacy if needed.  
3. Keep Codex/Cargo version bumps per ship.  
4. Do **not** mix host Server Control into this panel.

---

## 6. Related docs

- `KAI-SPACES-AND-USER-SETTINGS-GOAL.md` — Spaces + user-settings product doctrine  
- `ORACLE-OS-WORKSPACE-SETTINGS-GOAL.md` — Antigravity desktop Settings app  
- `ORACLE-OS-SETTINGS-GOAL.md` — host industrial control  
- `GOOGLE-DRIVE-STORAGE-SPEC.md` — cloud disk  
- `KAI-ECOSYSTEM-ECONOMY-GOAL.md` — plans/credits  

---

*Locked 2026-07-21. Owner: entire control panel Settings needs update/improvement — this is the map.*