The standalone Packbase admin UI is no longer used by current team decision. Its apps/admin code remains buildable, but that is historical capability, not a destination for new interface work. The old apps/web frontend in the Packbase server repository is also under a hard code freeze: only deletion is accepted there.

New interface work for Packbase’s is_staff product role, admin actions, and moderation belongs in wildbasehq/packbase-react-ui. The product role does not mean a person is a Wild HQ employee. The Packbase server still owns the protected operation and may continue to expose /admin routes while those capabilities are integrated.

What is already in the current web client

  • Staff and content moderators can create, edit, and delete curated tag registry metadata from the tag page.
  • Deleting registry metadata leaves existing howl tag values intact.
  • The web currently renders howl deletion controls for authors, staff or content moderators, and pack members with DeleteHowls; that authority is not yet aligned end to end and is a known integration and security gap described below.
  • The current route graph has no general /admin console, moderator roster, ticket dashboard, or role-management screen.

Do not describe an unimplemented admin screen in copy or documentation. Implement the smallest coherent product-native surface for the task.

Existing tag-page moderation stories are presentation fixtures. They do not prove the API request, server permission, or audit behaviour works end to end.

Add a protected action

  1. Name the actor, target, allowed reason, and server-owned permission.
  2. Confirm or add server enforcement before relying on a client check.
  3. Define the API and SDK contract, including a useful forbidden response.
  4. Add a typed web hook and explicit query invalidation or optimistic rollback.
  5. Keep the control close to the object it acts on unless a real cross-object workflow needs a dedicated surface.
  6. Require confirmation for destructive work and identify the authority being exercised when more than one applies.
  7. Record enough audit context to understand the action without copying unnecessary private content.
  8. Test allowed, forbidden, stale, missing, repeated, and failed cases.

Hiding a button is not authorisation. Possessing a staff flag is not permission to inspect unrelated private data. An audit log should explain who acted, on what, when, under which authority, and with what outcome; it should not become a second archive of the content being moderated.

Keep two kinds of conduct separate

Packbase content moderation concerns product content and accounts. Volunteer conduct concerns participation in Wild HQ. The server’s admin tickets, moderator roles, and tutorial material do not create an independent or confidential volunteer conduct-report process.

Some server files still contain old Inchat terminology and an embedded moderator tutorial that warns it may be inaccurate. Treat those as legacy code or content to evaluate, not current Wild HQ communication policy. Team coordination uses Discord.

Migration rule

When replacing an old admin workflow, first identify the server endpoint, permission check, audit behaviour, and data it actually uses. Build the replacement in Packbase web, verify it, then remove the retired client path in a separate clear change. Do not keep two live interfaces indefinitely merely because deleting the old one feels risky.