docs(server): implementation plan for the scope switch (#580)

[halcwb]

Description

Implementation plan for the scope switch (#580): the production server exposes only the MDR-accredited parts of GenPRES, all other environments the full suite, selected at runtime and enforced by the server. One trunk, no release branches.

Key points:

• GENPRES_SCOPE=accredited|full, parsed into Settings; defaults to accredited when GENPRES_PROD=1, full otherwise; any other value stops the server at startup.
• One shared Feature list compiled into server and client; Feature.ofCommand is total over every command family, with a test per case.
• The gate sits in processCmd ahead of requireLoaded and returns a stable NOT_IN_SCOPE error without touching any port.
• A new getSettings method carries scope and demo flag to the client, which filters the page list and guards UpdatePage and the pg deep link. This also repairs the dead IsDemo plumbing.
• Stated limits: the emergency list and continuous medication pages are client-only (sheets read from Google in the browser), so they are enforced client-side only; the MCP host is not covered; the accredited set is a placeholder to be supplied from the MDR file.

Five PRs, each under 200 lines.

Author checklist

• The described changes have already been described in an issue: feat(server): scope switch to expose only the accredited parts in production #580
• This PR documents the plan in a markdown file in docs/implementation-plans/.
• I have used the implementation plan template.
• The plan has enough detail: any suggestions that a reviewer adds to a PR that implements the plan are likely to be relatively quick to implement.

Reviewer checklist

• The chosen approach is a good choice.
• The sequence of steps is complete and sensible.
• I have documented resources that may help with implementation.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This documentation-only PR provides a phased implementation plan for runtime scope selection between accredited and full GenPRES surfaces.

• Defines shared scope and feature contracts for client and server.
• Places server enforcement before all command-dispatch bypasses.
• Covers client navigation, initial-page normalization, and scope-dependent sheet loading.
• Documents safe configuration defaults, known limits, tests, and deployment verification.

Confidence Score: 5/5

The documentation plan appears safe to merge, with no outstanding actionable findings.

The latest revision closes the prior sheet-loading lifecycle gap by moving permitted loads into the settings-resolution handler and explicitly verifying that full scope fetches both sheets. All earlier findings are resolved in the current plan.

Important Files Changed

Filename	Overview
docs/implementation-plans/580-scope-switch.md	Documents the complete scope-switch architecture and now ensures full-scope sheet loads begin after settings resolve.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    Env["GENPRES_SCOPE / GENPRES_PROD"] --> Settings["Validated server Settings"]
    Settings --> Gate["processCmd scope gate"]
    Command["API Command"] --> Gate
    Gate -->|Permitted| Ports["Server ports and domain logic"]
    Gate -->|Withheld| Error["NOT_IN_SCOPE"]
    Settings --> API["getSettings"]
    API --> Client["Client settings handler"]
    Client --> Pages["Filter and normalize pages"]
    Client --> Sheets["Load permitted client-side sheets"]

Loading

_{Reviews (3): Last reviewed commit: "docs(server): start permitted sheet load..." | Re-trigger Greptile}