@@ -41,13 +41,18 @@ Run this gate whenever the officer roster, a form-response snapshot, profile lin
 
 1. Run `npm test` and `npm run validate:officers`.
 2. Confirm `src/data/officersFa26Roster.json` is the only authority for cohort membership, roles, order, stable IDs, and fallback portraits.
-3. Confirm `src/data/officerProfilesFa26.json` contains the real Notion response page ID for provenance and only public profile fields copied from reviewed form responses. Never add email addresses, phone numbers, birthdays, or other private form answers.
-4. Review every unmatched submission, invalid profile link, and officer without a current response reported by the validator. An officer without a response may retain only the roster fallback; do not invent a bio or personal link.
-5. On the rendered page, open at least one complete profile and confirm its full bio and Website, LinkedIn, GitHub, and ORCID destinations are labeled, keyboard accessible, and correct.
-6. Confirm every added or replaced headshot path resolves in a clean build, and complete Gate 1 for its framing.
-7. Confirm the Fall 2025 and Spring 2026 archive tabs load from the tracked files under `public/officers/archive/`; a build must not require Notion, Google Sheets, or a prior production deployment.
-
-This gate passes only when the published roster matches the approved cohort, current public submissions enrich the correct people, invalid or private form values cannot leak through, and all officer tabs work from a clean checkout.
+3. Treat Notion as private intake. Use `officers:notion:dry-run` or `officers:notion:check` before `officers:notion:write`, then inspect the resulting Git diff. Confirm the sync did not commit, push, deploy, or write back to Notion.
+4. Confirm `src/data/officerProfilesFa26.json` contains the real Notion response page ID for provenance and only the allowlisted public fields: source ID, submission time, full and preferred names, headshot path, bio, personal website, LinkedIn, GitHub, and ORCID. Confirm upstream database/data-source IDs and the intake window are absent from this browser-facing snapshot.
+5. Search the diff for email addresses, phone numbers, birthdays, scheduling information, internal notes, and unknown form properties. None may enter Git, logs, or workflow artifacts.
+6. Review every unmatched submission, invalid profile link, and officer without a current response reported by the validator. An officer without a response may retain only the roster fallback; do not invent a bio or personal link.
+7. Confirm write preparation was atomic and idempotent: dirty managed files were not overwritten, managed files were rechecked after network work, validation completed before replacement, and repeating the sync against unchanged source data creates no diff.
+8. Confirm every replaced portrait uses its stable versioned path, matches the recorded response provenance, contains no private metadata, and resolves in a clean build. Confirm changing an attachment on the same response is detected. Complete Gate 1 for its rendered framing.
+9. Confirm `public/fetched` remains untracked, no page imports from `/fetched/`, and a clean release artifact does not contain local legacy cache files.
+10. Confirm the Fall 2025 and Spring 2026 archive tabs load from the intentional tracked snapshots under `public/officers/archive/`; do not confuse immutable archives with duplicate current data.
+11. On the rendered page, open at least one complete profile and confirm its full bio and Website, LinkedIn, GitHub, and ORCID destinations are labeled, keyboard accessible, and correct.
+12. Confirm local, staging, and production builds remain credential-free. If the optional drift workflow changed, verify it has read-only repository permissions, passes secrets only to the check command, fails on a missing or retyped Notion property, publishes no candidate artifact, and cannot commit or deploy.
+
+This gate passes only when the published roster matches the approved cohort, current public submissions enrich the correct people through a reviewed Git snapshot, invalid or private form values cannot leak through, cache and archive boundaries remain clear, and all officer tabs work from a clean credential-free checkout.
 
 ## Release discipline
 
 
@@ -0,0 +1,48 @@
+name: Check officer profile drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 16 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: officer-profile-drift
+  cancel-in-progress: true
+
+jobs:
+  check:
+    environment:
+      name: github-pages
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check reviewed officer snapshot against Notion
+        shell: bash
+        run: |
+          set +e
+          npm run officers:notion:check
+          status=$?
+          set -e
+          if [[ "$status" -eq 2 ]]; then
+            echo "::warning::Reviewed officer profile drift is waiting for maintainer review."
+            exit 0
+          fi
+          exit "$status"
+        env:
+          NOTION_API_KEY: ${{ secrets.NOTION_API_KEY }}
+          NOTION_OFFICERS_DB_ID: ${{ secrets.NOTION_OFFICERS_DB_ID }}
@@ -17,12 +17,24 @@ Run `npm run build` for the same credential-free production build used by GitHub
 Fall 2026 deliberately separates approved roster decisions from submitted public profile content:
 
 - `src/data/officersFa26Roster.json` owns cohort membership, roles, order, stable IDs, and fallback portraits.
-- `src/data/officerProfilesFa26.json` is a reviewed, public-only snapshot of the latest officer form responses.
+- `src/data/officerProfilesFa26.json` is a reviewed, public-only snapshot of in-window officer form responses.
+- `scripts/lib/officer-profile-cohorts.js` owns operational file paths and the explicit intake window; upstream database identifiers stay in protected environment secrets and out of the client bundle.
 - `src/data/compileOfficerDirectory.js` matches responses to the roster, keeps the newest nonblank public fields, normalizes links, and ignores unmatched people.
 - `public/officers/fa26/` stores stable headshot assets.
 - `public/officers/archive/` stores immutable Fall 2025 and Spring 2026 snapshots so historical tabs work in a clean checkout.
 
-Never copy private form fields such as email, phone number, or birthday into the repository. Run:
+Notion is private intake, not a publishing system. Maintainers use the controlled
+`officers:notion:dry-run`, `officers:notion:check`, and
+`officers:notion:write` commands described in `scripts/README.md` to prepare a
+sanitized working-tree change. The `write` command does not commit, push,
+deploy, or write anything back to Notion. A human must review the Git diff and
+the staging site before promotion.
+
+Each profile record in the public snapshot is limited to provenance ID,
+submission time, full and preferred names, headshot path, bio, personal
+website, LinkedIn, GitHub, and ORCID. Never copy email, phone number, birthday,
+scheduling data, another private form field, or an upstream database identifier
+into the snapshot. Run:
 
 ```sh
 npm test
@@ -36,4 +48,8 @@ The validator reports unmatched responses, invalid public links, missing assets,
 - Pushes to `dev` deploy the staging GitHub Pages site from the `Hilo-Hilo` staging repository.
 - Pushes to `main` deploy production from `CompbioAtBerkeley/compbioatberkeley.github.io`.
 
-Neither build reads Notion or Google Sheets credentials. Form intake is reviewed and versioned before publication, so the same commit produces the same site in local, staging, and production environments.
+Neither build reads Notion or Google Sheets credentials. Form intake is
+reviewed and versioned before publication, so the same commit produces the same
+site in local, staging, and production environments. The separate weekly/manual
+drift workflow may read Notion with a read-only integration, but it cannot
+modify repository contents or publish candidate data.
@@ -8,6 +8,9 @@
     "dev": "vite",
     "test": "node --test scripts/lib/*.test.js",
     "validate:officers": "node scripts/validate-officer-data.js",
+    "officers:notion:dry-run": "node scripts/sync-officer-profiles-notion.js --term fa26 --dry-run",
+    "officers:notion:check": "node scripts/sync-officer-profiles-notion.js --term fa26 --check",
+    "officers:notion:write": "node scripts/sync-officer-profiles-notion.js --term fa26 --write",
     "build": "npm run validate:officers && vite build",
     "build:dev": "npm run validate:officers && vite build --mode development",
     "build:preview": "npm run validate:officers && vite build",
 
@@ -1,18 +1,68 @@
 # Officer data workflow
 
-Officer data is reviewed before publication. A normal build never queries Notion or Google Sheets.
+Officer data is reviewed before publication. Notion is private intake; the
+reviewed Git snapshot is the public publication boundary. A normal build never
+queries Notion or Google Sheets.
 
 ## Updating Fall 2026
 
 1. Confirm the person and approved role in `src/data/officersFa26Roster.json`. The roster, not the form, controls membership and role.
-2. Copy only the latest public form fields into `src/data/officerProfilesFa26.json`: the real Notion response page ID as `sourceId`, submission time, full and preferred names, headshot path, bio, personal website, LinkedIn, GitHub, and ORCID.
-3. Save the reviewed headshot under `public/officers/fa26/` and reference that stable path from the profile snapshot.
-4. Do not copy email, phone, birthday, scheduling, or any other private response field.
-5. Run `npm test` and `npm run validate:officers`.
-6. Run the project pre-production checklist, including rendered portrait inspection at desktop and mobile widths.
+2. Preview the sanitized Notion-to-Git proposal with `npm run officers:notion:dry-run`.
+3. Use `npm run officers:notion:check` when a machine-readable drift result is needed. It performs the same read-only comparison and writes no candidate files.
+4. When ready to prepare a reviewable change, run `npm run officers:notion:write`. It may update only the public snapshot and matched portrait files in the working tree.
+5. Review the complete Git diff. The command never commits, pushes, deploys, or writes back to Notion.
+6. Run `npm test` and `npm run validate:officers`.
+7. Run the project pre-production checklist, including rendered portrait inspection at desktop and mobile widths.
 
 Duplicate form responses are supported. `compileOfficerDirectory.js` takes the newest nonblank value per public field, so an optional blank in a newer response does not erase a valid earlier response. Names must match a canonical roster name or a deliberately reviewed alias.
 
+### Command guarantees
+
+- `dry-run` fetches, sanitizes, matches, and compares without changing tracked files.
+- `check` is also read-only: it exits cleanly when Git matches the sanitized intake, reports drift separately, and treats authentication, schema, or matching failures as errors.
+- `write` refuses to overwrite dirty managed files, fingerprints the snapshot and portrait tree before network work, and rechecks that state immediately before committing. It validates a complete candidate in temporary storage before atomically replacing the snapshot or a portrait.
+- Repeating a command against unchanged Notion content is idempotent. Portraits are streamed through a 15 MB bound, decoded, metadata-stripped, and normalized before comparison; expiring attachment query strings do not create a diff, while replacing an attachment on an existing response does.
+- The roster remains authoritative for membership, roles, order, stable IDs, and fallback portraits. Form answers may enrich only matched officers.
+
+The explicit cohort window and managed paths live in
+`scripts/lib/officer-profile-cohorts.js`. The private upstream database ID is
+read only from `NOTION_OFFICERS_DB_ID`; it is not serialized into the public
+snapshot or browser bundle. Before querying responses, the sync retrieves the
+database schema and requires the expected names and Notion property types, so a
+renamed or retyped form field is an operational error rather than publishable
+blank content.
+
+### Public privacy allowlist
+
+Only these fields may enter `src/data/officerProfilesFa26.json`:
+
+- `sourceId` using the real Notion response page ID for provenance
+- `submittedAt`
+- `fullName`
+- `preferredName`
+- `image`
+- `bio`
+- `personal website`
+- `linkedin`
+- `github`
+- `orcid`
+
+Email, phone number, birthday, scheduling information, internal notes, and
+unknown form properties are private and must never be serialized, logged,
+uploaded as workflow artifacts, or copied into Git. Upstream database and data
+source identifiers must likewise remain outside the browser-facing snapshot.
+Automated checks report only the count of unmatched submissions; inspect their
+identities inside the private intake rather than exposing them in public Actions
+logs.
+
+### Portrait and provenance review
+
+- Store the reviewed current-term portrait at a stable, versioned path under `public/officers/fa26/`.
+- Confirm every profile `sourceId` and `submittedAt` traces to the intended form response.
+- Never save temporary Notion URLs. Every submitted portrait is decoded and re-encoded as WebP to strip private metadata; a failed or oversized download aborts before the approved snapshot is changed. Replacing a portrait on the same response is detected by normalized content comparison.
+- Inspect every changed portrait on desktop and mobile; verify centering through the project pre-production skill.
+- Do not publish an ignored importer cache or treat it as an approved snapshot.
+
 ## Historical data
 
 The immutable Fall 2025 and Spring 2026 JSON and portrait assets live in:
@@ -30,3 +80,19 @@ These files are tracked so local, staging, and production builds contain the sam
 `fetch-officers-fa25.js` and `fetch-officers-notion.js` are retained only as migration helpers for creating an ignored local staging copy under `public/fetched/`. They are not package scripts, are not invoked by GitHub Actions, and their output is not publishable until it has been reviewed and moved into the versioned sources above.
 
 The historical Notion importer uses `NOTION_API_KEY` and `NOTION_OFFICERS_DB_ID` when run manually. Those credentials must remain outside the repository. The website build and deploy workflows do not require them.
+
+Before release, confirm `git ls-files public/fetched` is empty and that no
+current or historical page imports from `/fetched/`. Local files there are
+scratch/cache output only; because the directory is under `public/`, remove it
+from any local release artifact and validate from a clean checkout.
+
+## Drift monitoring
+
+`.github/workflows/officer-profile-drift.yml` is separate from deployment. It
+runs manually and weekly with `contents: read`, passes the read-only Notion
+credentials only to `npm run officers:notion:check`, and does not upload
+candidate profiles or portraits. The existing secret names live in the
+organization repository's protected `github-pages` environment; normal build
+and deploy steps do not reference them. Drift is a prompt for a maintainer to
+run the controlled review flow; it is never permission to commit or publish
+automatically.