feat(console): "we could not ask" is not "they do not have it" — and the auth story, settled

[omercelikdev]

U4 slice 4.

The bug this starts with

A probe that threw was filed as absent. So a service that is down — or one whose CORS refuses this console's origin — appeared as an app that composes no Goldpath module. A confident, wrong sentence, and exactly the one an operator would act on during an outage.

unreachable is now its own answer:

• the service's own screen says it did not answer at all, and names CORS as a candidate;
• a single refusing section says it for that section;
• Today reports it as a blind spot, which already outranks the entire list;
• the nav offers no module links for a service that never answered — every link would say the same thing.

The auth story, written down rather than implied

1. Same origin — the shape we ship. The console is served by the app it drives, behind the same ops floor as the admin surfaces. The browser is challenged for the console's own document, so an unauthenticated operator never reaches a screen. Nothing to configure, and no way to ship an unauthenticated console by accident.
2. Cross-service needs each service to share the console's auth boundary, or to allow its origin in CORS with credentials. There is no third option that does not involve a token.
3. A token the console holds is deliberately not built. A browser-side OIDC client puts an identity library in the dist and a per-adopter authority/clientId in config — a different product decision. Recorded as open-threads T10, with the trigger that would change it.

Proof

The console mapped on the auth-floored host answers 401 for its own page — of everything in an auth story, that is the property an adopter must not be able to get wrong.

22/22 green; console unit 139 (3 new), kit 64.

🤖 Generated with Claude Code

[omercelikdev]

R1 accepted — and it is the sharpest kind of finding: the false-confidence bug this PR set out to remove, reintroduced one layer up. did not answer at all fired when the FIRST unreadable module was unreachable and the rest were merely unreadable, so one dead probe among four honest 401s read as a full outage. It now reuses the shell's own isUnreachable predicate instead of re-deriving a weaker one, with a mixed-case test.

(The agent broke its JSON contract twice on this PR before producing the finding — the raw output was still legible and actionable, so the finding stands on its own.)