Console reference

This reference covers the operator console in the sibling tcpsystems/console repository. Facts include a code path, a dated observation, or a recorded deploy note. Items not verified from this docs workspace are marked clearly.

Product boundary

Console is the operator surface. The console split removed product, metrics, pricing, discover, intel, studio, IDE, and related modules from the console worker. The operator routes include overview, seats, offers, usage, ops, DNS, auth, login, logout, callback, health, and ready (/home/kivox/src/tcpsystems/console/docs/CONSOLE-SPLIT.md:4-20, observed 2026-11-04, commit 6440621).

Routes

Route	Purpose	Access	Source
/	Overview	operator session	CONSOLE-SPLIT.md:13; src/routes/+page.svelte
/login	Start OIDC sign-in	public	CONSOLE-SPLIT.md:19; src/lib/server/session.ts:115-126
/auth/callback	OIDC callback	public callback	CONSOLE-BFF-CONTRACT.md:31,48-49; src/lib/server/session.ts:128-168
/auth	Session state	operator session	CONSOLE-SPLIT.md:19; src/routes/auth/+page.server.ts
/logout	End session	signed-in, same-host, idempotency key	src/hooks.server.ts:36-44; src/lib/server/session.ts:184-188
/seats/	Seat view	operator session	CONSOLE-SPLIT.md:14
/offers/	Offers or metrics view	operator session	CONSOLE-SPLIT.md:15
/usage/	Usage summary	operator session	CONSOLE-SPLIT.md:16
/ops/	Operations and health	operator session	CONSOLE-SPLIT.md:17
/dns/	DNS view	operator session; upstream may be unavailable until a credential is bound	CONSOLE-SPLIT.md:18
/healthz	Liveness	public	src/routes/healthz
/readyz	Readiness	public	src/routes/readyz; observed 2026-11-05

Exact response bodies for authenticated pages are not verified from this docs workspace.

Access and session model

• Identity provider: Pocket ID OIDC. The issuer comes from deployment bootstrap (CONSOLE-BFF-CONTRACT.md:57-58; src/lib/server/session.ts:97-101).
• Flow: authorization code with PKCE S256 (src/lib/server/session.ts:115-126).
• Session cookies: signed __Host-console_session and login transaction __Host-console_login (src/lib/server/session.ts:8-9,79-95,124-126,165-166).
• Scopes: callback resolves token scopes and groups. A session with no console scope is denied (src/lib/server/session.ts:154-163; CONSOLE-BFF-CONTRACT.md:88-106,109-111).
• Privacy: signed-in responses are private and are not shared in caches (CONSOLE-BFF-CONTRACT.md:53-55,81-84; src/hooks.server.ts:118-122).

Runtime configuration boundaries

Runtime settings must follow DB-first rules:

• Console durable state lives in PostgreSQL. The connection uses the CONSOLE_DATABASE_URL bootstrap reference (src/lib/server/db.ts:54-59).
• Migration 0001_console_event.sql creates console_event, console_event_rejection, and console_setting (migrations/0001_console_event.sql:1-60).
• console_setting stores row overrides for web-edited settings. Defaults live in the settings registry, not in code (migrations/0001_console_event.sql:49-60).

Bootstrap references allowed in docs and deploy config:

• OIDC_ISSUER, OIDC_CLIENT_ID, AUTH_CLIENT_SECRET, OIDC_REDIRECT_URI, SESSION_KEY (src/lib/server/env.ts:13-20; CONSOLE-BFF-CONTRACT.md:67-75).
• CONSOLE_DATABASE_URL (src/lib/server/env.ts:30; src/lib/server/db.ts:54-59).
• Upstream base URLs and server-side service tokens (src/lib/server/env.ts:21-29; docs/DEPLOY.md:44-52).

Do not document these as normal operations:

• config files for feature flags or operator behavior;
• env vars for routine runtime settings beyond bootstrap and secret refs;
• runtime state in JSON, YAML or files instead of PostgreSQL rows (owner ruling 2026-11-09: durable state lives only in PostgreSQL).

Deployment facts (dated)

• Observed 2026-11-05: https://console.tcp.systems/ returned 302 to /login; /healthz returned 200 (curl -sSI, exit code 0).
• Recorded 2026-11-03: deploy evidence reports a distroless console-node container on scaleblade, listener 127.0.0.1:8791, Caddy routing /console to 127.0.0.1:8791, and /healthz version node-70f5fcc (tcpsystems/console/docs/evidence/DEPLOY-MATRIX-2026-11-03.md:5-29,76-84).
• Recorded 2026-11-01: console split notes a DNS blocker for console.tcp.systems at that time (CONSOLE-SPLIT.md:25-33). The 2026-11-05 probe suggests later progress, but this workspace cannot verify the current certificate chain or host inventory.

Verification limits

• No authenticated operator session was used from this docs workspace.
• No production host access was used from this docs workspace.
• Upstream acumen route availability depends on the deployed version (snapshot 2026-11-05) and credentials. Console passes through honest upstream refusals (CONSOLE-BFF-CONTRACT.md:128-136).