feat(console): "we could not ask" is not "they do not have it" — and the auth story, settled - #84
Merged
Merged
Conversation
…the auth story, settled U4 slice 4. The bug this slice starts with: a probe that THREW was filed as `absent`. A service that is down, or one whose CORS refuses this console's origin, therefore appeared as an app that composes no Goldpath module — a confident, wrong sentence, and precisely the one an operator would act on during an outage. Unreachable is now its own answer: named on the service's own screen, named per section, and reported on TODAY as a blind spot (which already outranks the whole list). The auth story, written down in the RFC rather than implied: 1. SAME ORIGIN is the shape we ship — the console is served by the app it drives, behind the same ops floor as the admin surfaces, so an unauthenticated operator is challenged for the console's own document and never reaches a screen. Nothing to configure, and no way to ship an unauthenticated console by accident. 2. CROSS-SERVICE needs each service to share the console's auth boundary or to allow its origin in CORS with credentials. There is no third option that does not involve a token. 3. A token the console HOLDS is deliberately not built: a browser-side OIDC client puts an identity library in the dist and a per-adopter authority in config, which is a different product decision. Recorded as open-threads T10 with the trigger that would change it. Proof: the console mapped on the auth-floored host answers 401 for its own page — the property that matters most here is the one an adopter cannot get wrong. 22/22 green; console unit 139. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"The service did not answer at all" fired when the first unreadable module was unreachable and the rest were merely unreadable — so one dead probe among four honest 401s was reported as a full outage. That is the same false confidence this row exists to prevent, reintroduced one layer up. It now reuses the shell's own predicate rather than re-deriving a weaker one, and a mixed case is covered. 140 console tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Owner
Author
|
R1 accepted — and it is the sharpest kind of finding: the false-confidence bug this PR set out to remove, reintroduced one layer up. (The agent broke its JSON contract twice on this PR before producing the finding — the raw output was still legible and actionable, so the finding stands on its own.) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
U4 slice 4.
The bug this starts with
A probe that threw was filed as
absent. So a service that is down — or one whose CORS refuses this console's origin — appeared as an app that composes no Goldpath module. A confident, wrong sentence, and exactly the one an operator would act on during an outage.unreachableis now its own answer:The auth story, written down rather than implied
Proof
The console mapped on the auth-floored host answers 401 for its own page — of everything in an auth story, that is the property an adopter must not be able to get wrong.
22/22 green; console unit 139 (3 new), kit 64.
🤖 Generated with Claude Code