--- id: SVC-PFM-CSH-console-shell title: Console Shell product_area: platform module: console-shell repository: react-console source_module: >- react-console shell: components/console (frame, menu, gates), lib/routes, lib/console, lib/security-context (provider, entitlements, refusal signal), lib/applications, lib/custom-objects (menu merge) revision: 1 status: draft design_intent: proposed implementation_evidence: observed source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 owns: - DOM-PFM-CSH-001 - DOM-PFM-CSH-002 - DOM-PFM-CSH-003 - DOM-PFM-CSH-004 does_not_own: - >- Identity, sessions, reachable workspaces and staff clearance remain Security responsibilities. - Operations owns licensing records and application availability. - 'Metadata owns custom record definitions, apps and placements.' - Hosted tools retain the ownership of their respective modules. inference: [] operations: - operation_id: getMySecurityContext intent: >- Consume Security’s context to establish identity and working context at boot or HQ departure; strict-address failure can require preference fallback. access: console permission: platform.security-self.read realises: - CAP-PFM-CSH-001 - CAP-PFM-CSH-004 - CAP-PFM-CSH-010 - CAP-PFM-CSH-012 - CAP-PFM-CSH-013 published_to_submissions: >- not published: a read about the caller, owned by Security; not a business operation - operation_id: getMySecurityContextInTenant intent: >- Consume Security’s current-workspace context for full refresh or the unused programmatic switch. access: console permission: platform.security-self.read realises: - CAP-PFM-CSH-011 - CAP-PFM-CSH-013 published_to_submissions: >- not published: a read about the caller, owned by Security; not a business operation - operation_id: getMyApplications intent: >- Consume the personal application and feature list after application refusal or an aged visible-tab return. access: console permission: platform.security-self.read realises: - CAP-PFM-CSH-014 - CAP-PFM-CSH-016 published_to_submissions: >- not published: a read about the caller, owned by Security; not a business operation - operation_id: getCustomObjectsNavigation intent: >- Consume Metadata’s filtered readable record placements and custom apps for navigation. access: console permission: platform.custom-records.read realises: - CAP-PFM-CSH-008 published_to_submissions: >- not published: a navigation read owned by Metadata; not a business operation - operation_id: listCustomObjects intent: >- Consume the definition list when the preferred navigation read fails, applying local access filtering. access: console permission: platform.custom-objects.read realises: - CAP-PFM-CSH-008 published_to_submissions: >- not published: a definition read owned by Metadata; not a business operation - operation_id: listCustomApps intent: Consume the custom-app list alongside definitions in navigation fallback. access: console permission: platform.custom-objects.read realises: - CAP-PFM-CSH-008 published_to_submissions: >- not published: a definition read owned by Metadata; not a business operation - operation_id: listTenantApplicationsForTenant intent: >- Consume the administrative workspace-availability list for the Configuration overview. access: console permission: platform.tenant-applications.read realises: - CAP-PFM-CSH-017 published_to_submissions: 'not published: an administrative read with no business effect' events: - name: 'application refusal (in-browser signal, not a platform event)' direction: consumed when: >- A console request receives a 403 with a recognized application-access or licensing refusal code. payload_summary: >- The code is delivered to browser listeners so the provider can request its application list. jobs: [] integrations: - system: Browser storage direction: outbound contract: >- Local storage retains workspace preference per person; the sidebar writes a fold cookie without restoring it. Other shell presentation state is in memory. consistency: - rule: >- Boot, entry and full refresh replace context, while narrow refresh replaces applications and features only. kind: eventual compensation: >- No business-save rollback is defined; service refusal remains independent and coded application refusal requests refresh. - rule: >- A context-change answer can install data only while its ticket remains current; application replacement also checks the selected workspace. kind: eventual compensation: none - rule: >- These operations carry no business-save payload, although consumed Security reads can update bookkeeping. kind: transactional compensation: none evidence: - >- react-console at baf6dae: lib/security-context/{provider.tsx,context.ts,tenant-id.ts,boot.ts, application-refusal.ts,entitlements.ts}; lib/custom-objects/{api.ts,use-custom-navigation.ts}; lib/applications/api.ts; lib/auth/session.ts; components/ui/sidebar.tsx. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts; modules/custom-objects/aws/api/{custom-objects,custom-apps}.routes.ts; modules/tenants/aws/api/tenant-applications.routes.ts; docs/standards/submission-compatible-operations.md. - >- services-platform:docs/security/application-access.md#1. The three modes, and the one Platform deploys; docs/licensing.md#9. How a licence reaches the permission check (unset modes default off; recorded deployment uses enforce). controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-AZ-006, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-PRV-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Console Shell ## What This Service Is For The shell turns Platform answers into the shared console experience: start-up states, page space, navigation, context entry and application explanations. It is implemented in the console and serves no API of its own. ## Boundary The four owned objects describe client presentation. Security supplies identity and authority, Metadata supplies record placements, and Operations supplies application availability. Hosted search, attention, alerts, recent records, financial context and assistant behavior stay with their owning modules. ## Operations in Words The operations below describe consumption. Start-up asks for the security context, strictly when an address names a workspace and otherwise with a remembered preference. A strict refusal or failure can require fallback reads. Full refresh uses the current workspace context, while application refresh reads only applications and features into the client snapshot. Navigation reads placed record types, falling back to definition and custom-app lists. The administrator overview reads workspace availability. Each listed read is excluded from configurable intake with an explicit reason. ## Events and Jobs An in-browser application-refusal signal starts a refresh. It is not a published Platform event. The shell schedules no service jobs and performs no model inference. The remembered workspace and sidebar cookie are browser preferences. ## Consistency Guarantees Context-change tickets prevent old answers from replacing a newer workspace. This client ordering is not a database transaction. Application refresh checks both ticket and selected workspace, retaining the previous list on failure. Security reads can stamp authentication and settle expired grants; these effects remain Security responsibilities. The recorded deployment enables licensing and application-access enforcement. The mode readers default to off when configuration is absent or unreadable, so that deployment assumption must be preserved by the owning services. The console still derives domain visibility from the returned application list.