--- id: CAP-PFM-CSH-009 title: Open console work through a durable address feature: FEAT-PFM-CSH-03 product_area: platform module: console-shell revision: 2 status: draft product_intent: proposed implementation_evidence: observed supersedes: [] source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 intent_sources: - >- react-console:docs/url-architecture.md#1. Rules (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) purpose: Shareable addresses preserve the workspace and destination needed to resume console work. outcomes: - Bookmarks and shared links identify their workspace and page. - Route construction and page placement share a maintained catalogue. concepts: - CON-PFM-CSH-003 actors: - ACT-PFM-001 - ACT-PFM-002 - ACT-PFM-004 - ACT-PFM-005 surfaces: - console preconditions: [] postconditions: [] permissions: - key: console.access where_checked: console scope: tenant - key: platform.security-self.read where_checked: api scope: tenant rules: - id: BR-CAP-PFM-CSH-009-01 proved_by: [ATS-PFM-CSH-009-01, TST-PFM-CSH-027] statement: >- Console work uses HQ or workspace console roots, while route guards separately allow authentication, previews, portals, public payments, print pages and temporary legacy entry points. kind: invariant enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/routes/__tests__/guards.test.ts#places every page.tsx on a route node or an allowed page that is not a tenant's origin: none - id: BR-CAP-PFM-CSH-009-02 proved_by: [ATS-PFM-CSH-009-03, ATS-PFM-CSH-009-09, ATS-PFM-CSH-011-06, TST-PFM-CSH-014, TST-PFM-CSH-029] statement: >- Workspace addresses place the product area before its resource and optional record, nest child records under parents and organize Configuration separately by module. kind: invariant enforced_at: - console must_prove: false provenance: documented source: 'react-console:docs/url-architecture.md#1. Rules' origin: >- react-console:docs/url-architecture.md#1. Rules, rules 2 and 4 (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-03 proved_by: [ATS-PFM-CSH-009-02, TST-PFM-CSH-027] statement: >- Console-defined path words are lowercase or camelCase without hyphens or underscores, while data identifiers may include hyphens. kind: validation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/routes/__tests__/guards.test.ts#names every folder under app/ with a lowercase word or camelCase origin: >- react-console:docs/url-architecture.md#1. Rules, rule 3 (Andrew, 2026-10-14) (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-04 proved_by: [ATS-PFM-CSH-009-01, TST-PFM-CSH-027] statement: >- Shared builders construct console links and source guards check literal paths and page inventory with declared non-console and redirect exceptions. kind: invariant enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/routes/__tests__/guards.test.ts#finds no literal console path outside lib/routes origin: >- react-console:docs/url-architecture.md#1. Rules, rule 6 (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-05 proved_by: [ATS-PFM-CSH-009-07, TST-PFM-CSH-029] statement: A Configuration module key cannot also name a cross-module Configuration area. kind: validation enforced_at: - console must_prove: true provenance: test source: >- react-console:lib/routes/__tests__/routes.test.ts#never shares a word between a configuration module and a cross-module area origin: >- react-console:docs/url-architecture.md#1. Rules, rule 4 (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-06 proved_by: [ATS-PFM-CSH-009-04, TST-PFM-CSH-014] statement: >- Record links survive reload in their workspace, and browser history moves between console pages. kind: invariant enforced_at: - console must_prove: true provenance: test source: 'react-console:e2e/mock/url-architecture.mock.spec.ts#a record deep link survives a reload' origin: >- react-console:docs/url-architecture.md#8. Tests (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-07 proved_by: [ATS-PFM-CSH-009-05, TST-PFM-CSH-009] statement: Sign-in after a signed-out deep link returns to its requested page and query. kind: lifecycle enforced_at: - console must_prove: true provenance: test source: >- react-console:e2e/dev/url-architecture.dev.spec.ts#a signed-out deep link goes through sign-in and comes back to the same page and query origin: >- react-console:docs/url-architecture.md#6. Tenant from the URL (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-08 proved_by: [ATS-PFM-CSH-009-06, ATS-PFM-CSH-009-08] statement: >- A registered planned destination renders a named, permission- and application-guarded placeholder, while an unregistered destination returns not found. kind: policy enforced_at: - console must_prove: true provenance: observed source: 'react-console:app/(console)/console/[tenantId]/[...slug]/page.tsx:ModulePage' origin: >- react-console:docs/url-architecture.md#3. Workspaces (decided by Andrew 2026-10-14; final acceptance 2026-10-15) note: The linked finding records the evidence limitation or implementation gap. - id: BR-CAP-PFM-CSH-009-09 proved_by: [ATS-PFM-CSH-009-03, TST-PFM-CSH-029] statement: >- Builders accept queries and legacy redirects retain them, while switching workspaces intentionally removes the query. kind: invariant enforced_at: - console must_prove: false provenance: observed source: >- react-console:lib/routes/build.ts:queryString; lib/routes/legacy.ts:legacyTenantPath; lib/routes/match.ts:switchTenantPath origin: >- react-console:docs/url-architecture.md#5. lib/routes (decided by Andrew 2026-10-14; final acceptance 2026-10-15) - id: BR-CAP-PFM-CSH-009-10 proved_by: [ATS-PFM-CSH-009-11, TST-PFM-CSH-026] statement: >- Former Eligibility addresses permanently redirect to the corresponding Configuration rule screen within the same workspace. kind: lifecycle enforced_at: - console must_prove: false provenance: test source: 'react-console:lib/routes/__tests__/eligibility-redirect.test.ts#keep the tenant the link named' origin: none scenarios: - id: SC-CAP-PFM-CSH-009-01 given: A permitted user reloads a contact bookmark. when: The page initializes again. then: The same workspace and contact remain selected. provenance: test source: 'react-console:e2e/mock/url-architecture.mock.spec.ts#a record deep link survives a reload' - id: SC-CAP-PFM-CSH-009-02 given: A shared console link is opened without a session. when: The person completes sign-in. then: The requested destination and query are preserved. provenance: test source: >- react-console:e2e/dev/url-architecture.dev.spec.ts#a signed-out deep link goes through sign-in and comes back to the same page and query - id: SC-CAP-PFM-CSH-009-03 given: The typed address is neither a page nor a registered planned destination. when: The console resolves it. then: The destination is not found. provenance: observed source: 'react-console:app/(console)/console/[tenantId]/[...slug]/page.tsx:ModulePage' edge_cases: [] constraints: [] depends_on: - CAP-PFM-CSH-010 related: - CAP-PFM-CSH-012 - CAP-PFM-CSH-006 journeys: - JNY-PFM-CSH-003 open_questions: [] evidence: - >- react-console at baf6dae: docs/url-architecture.md, lib/routes/{definitions,build,match,routes,keys}.ts, lib/routes/__tests__/{routes,guards,eligibility-redirect}.test.ts, app/(console)/console/[tenantId]/[...slug]/page.tsx, next.config.mjs, e2e/mock/url-architecture.mock.spec.ts, e2e/dev/url-architecture.dev.spec.ts, e2e/security/navigation.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMySecurityContext with tenant_id and preferred_tenant_id, getMySecurityContextInTenant; MOD-PFM-SEC). controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-002, TC-LOG-003, TC-LOG-005, TC-PI-001, TC-PI-002, TC-PI-004, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] exercised_by: [FAS-PFM-CSH-03-01, FAS-PFM-CSH-03-02, FAS-PFM-CSH-03-03, FAS-PFM-CSH-03-05] suites: [TST-PFM-CSH-009, TST-PFM-CSH-014, TST-PFM-CSH-026, TST-PFM-CSH-027, TST-PFM-CSH-029] --- # Open console work through a durable address ## Purpose Shareable addresses preserve the workspace and destination needed to resume console work. ## How It Works A person opens an address from a bookmark, message or navigation entry. The console reads the workspace and destination from that address. Authentication can intervene before workspace entry. Route construction supplies the same destination shape for links created elsewhere in the console. Planned destinations have a placeholder rather than a finished working screen. The product should remove internal planning references from the placeholder’s customer-facing explanation. ## Relationships - Workspace entry checks the workspace named by the address. - Record references use the route catalogue to build destinations. - Legacy entry maps older addresses onto the current scheme.