--- title: Console Shell Design Examination examined_at: '2026-10-23' examiner: codex branch: agent/platform-console-shell-desi-exam-1 source_sha: rhythm-v2-docs: 56439a6a04c1d160ae0f6671ce5fed512c1015b2 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 counts: design_artifacts: 46 domain_objects: 4 invariants: 33 state_models: 4 transitions_after_correction: 38 workflows: 8 workflow_hops: 46 service_contracts: 2 operation_rows: 8 unique_consumed_operations: 7 exposed_operations: 0 screen_contracts: 13 decision_records: 15 responsibilities_rows: 1 inference_callers_with_empty_declaration: 23 model_tasks_found_in_owned_scope: 0 new_findings: 6 new_open_questions: 0 original_source_anchor_origin_fields_audited: 240 coverage: shell_entry_points: '7/7' consumed_operations_with_contract: '7/7; administrative read appears in both consumer and provisional provider contracts' owned_tables_with_object: '0/0; four client objects have no service storage' originally_named_dependency_tables: '2/2 declarations and persistence reads examined; Operations owns both' licensing_dependency_tables: '9 assigned to Operations by planning; no shell storage claimed' specified_screen_surfaces_with_contract: '13/13; hosted business screens remain outside ownership' modeled_client_lifecycles_with_workflow: '3/4; startup, entry and application refresh have workflows; sidebar folding is synchronous component state' owned_service_state_machines: '0/0' owned_queues_and_schedules: '0/0' delegated_licensing_async_resources: 'queue, dead-letter queue and nightly schedule remain Operations responsibilities' inference_operations: '0/0; hosted assistant is delegated to the LLM module' planning_inputs: features: 4 concepts: 4 capabilities: 18 journeys: 5 acceptance_sets: 18 approval_state: 'planning artifacts remain draft; registry says awaiting approval' unavailable_brief: briefs/design/platform-console-shell.brief.md unavailable_external_record: 'docs-2 RS-20 finalized planning approval cited by FND-PFM-CSH-035; no docs-2 checkout supplied' protected_field_changes: - artifact: DOM-PFM-CSH-002 field: invariants.INV-DOM-PFM-CSH-002-08.source before: 'docs-2:specs/apps/console/planning/shell/requirements/REQ-CNS-292-accounting-appears-immediately-under-crm-in-tenant-application-navigation.md#6. Required Behavior (RS-20; not built at the pinned commit, FND-PFM-CSH-042)' after: 'rhythm-v2-docs:specs/platform/console-shell/planning/capabilities/CAP-PFM-CSH-006-find-my-way-through-the-applications-menu.md:BR-CAP-PFM-CSH-006-13' - artifact: DOM-PFM-CSH-002 field: invariants.INV-DOM-PFM-CSH-002-08.enforced_at before: [console] after: [] reason: 'The local planning row supports the requirement; pinned code does not enforce it.' - artifact: SCR-PFM-CSH-001 field: actions.permission changes: 'Home, fold, assistant and dismiss have no action-level check; Configuration shortcut does not check configuration.access.' - artifact: SCR-PFM-CSH-003 field: permission changes: 'HQ links selected by shell mode, not filtered by console.system; workspace entries retain item or section filtering.' - artifact: SCR-PFM-CSH-005 field: permission and Rhythm HQ action.permission changes: 'HQ menu entry uses staff identity and workspace mode; responsibilities retain their key.' - artifact: SCR-PFM-CSH-008 field: displays.greeting.source before: DOM-PFM-CSH-001 signed-in person after: 'Browser clock after hydration; demonstration dashboard greetingName when summary data exists' - artifact: SCR-PFM-CSH-012 field: actions.View Applications.permission changes: 'The link is unconditional; destination checks configuration.applications.view.' - artifact: SCR-PFM-CSH-013 field: actions.Open Configuration.permission changes: 'Available application and known configuration destination control the link; no additional configuration.access check.' - artifact: SCR-PFM-CSH-013 field: displays changes: 'Licence dates are part of the translated explanation, not a separate displayed field; its source names listTenantApplicationsForTenant and applicationAvailabilityReason.' retained_values: - All existing identifiers, status, intent, implementation evidence, origins and source commit values remain unchanged. - Existing operation identifiers, access tiers and service permission keys remain unchanged. - Existing hop anchors and statement provenance remain unchanged. - Other row source values remain unchanged; additional retry transitions cite the provider boot implementation. evidence: - 'rhythm-v2-docs:AGENTS.md; specs/CONVENTIONS.md sections 6 and 9; specs/templates/*; specs/platform/console-shell/MODULE.md, planning/**, ID_REGISTRY.md and FINDINGS.md; specs/PRODUCT-AREAS.md:MOD-PFM-CSH' - 'react-console:app/(console)/layout.tsx, page.tsx, [...legacy]/page.tsx; console/[tenantId]/layout.tsx, page.tsx, [...slug]/page.tsx, configuration/page.tsx' - 'react-console:components/console/{app-sidebar,nav-config,collapse-sidebar,application-unavailable,application-route-gate,console-shell,console-provider,site-header,tenant-id-gate,tenant-switcher,use-shell-mode,legacy-redirect,page-layout,feedback-dialog}.*; components/console/home/**; components/configuration/applications/**' - 'react-console:lib/routes/{definitions,build,match,legacy}.ts and cited tests; lib/console/{domains,use-visible-nav,record-types,application-guard}.ts and cited tests; lib/authz/{guard.tsx,evaluate.ts}; lib/security-context/{provider.tsx,boot,tenant-id,left-tenant,context,entitlements,application-refusal}.ts and cited tests; lib/custom-objects/{navigation,use-custom-navigation}.ts; lib/applications/**; lib/api/dashboard.ts' - 'react-console:cited unit and browser test files were read as static evidence, including initialization, URL architecture, application access, staff landing, workspace gate, registry visibility, placement navigation, sidebar layouts and record destinations; product suites were not executed' - 'react-console:docs/url-architecture.md (sections 2.2, 6, 7, 11 item 24, item 25 and acceptance checkpoints); docs/page-layouts.md (rules, collapse policy and final acceptance)' - 'services-platform:modules/security/aws/api/access.routes.ts; modules/security/services/access/security-context.ts; modules/tenants/aws/api/tenant-applications.routes.ts; cited modules/custom-objects/aws/api/{custom-objects,custom-apps}.routes.ts' - 'services-platform:modules/licensing/db/{applications,tenant-applications}.table.ts; modules/licensing/services/persistence/{applications,tenant-applications}.ts; modules/licensing/aws/api/licensing-api-mapper.ts' - 'services-platform:docs/proposals/application-access-and-entitlements.md (decisions and acceptance); docs/security/{application-access,console-authentication}.md; docs/licensing.md; docs/standards/{custom-field-capability,submission-compatible-operations,record-write-contracts}.md' validation: acceptance_install_and_check: 'npm ci && npm run check: passed, zero errors' acceptance_tests: 'npm test: passed, four tests' rewrite_checks: 'Each artifact rewrite committed independently after npm run check passed.' final_text_audit: 'No unchanged sentence-ending authored frontmatter text; body prose contains no prohibited paths, hashes, ids or internal workspace term.' --- # Console Shell Design Examination ## Scope and Limits The examination covers the entire checked-in design and the console-shell responsibilities row. It compares source anchors, route declarations, client state, navigation assembly, screen behavior and cited product decisions with the pinned repositories. Static test evidence supports specific claims; it does not certify a passing product journey. The named design brief is absent. The planning snapshot is still marked draft and awaiting approval, and the external approval record for Accounting ordering is unavailable in this machine’s repository scope. Existing product decisions remain cited, and this examination grants no approval or new product authority. ## Coverage | Surface | Examined | Result | |---|---:|---| | Design artifacts | 46/46 | Every body and authored statement text rewritten | | Client domain objects | 4/4 | Numbers match their concepts; no shell tables or registrations | | Invariant rows | 33/33 | Planned Accounting order distinguished from enforcement | | State models | 4/4 | Retry, departure and refresh timing corrected | | Workflow hops | 46/46 | Anchors, failure handling and partial effects examined | | Consumed operations | 7/7 | Route access and permission keys retained | | Specified screen surfaces | 13/13 | Components, actions, guards and patterns examined | | Decision records | 15/15 | Cited origins retained; alternatives expressed as design tradeoffs | | Responsibilities rows | 1/1 | Ownership agrees with presentation objects and consumed contracts | | Inference declarations | 23/23 | Empty lists agree with no owned model calls | | Owned tables, queues, schedules and service state machines | 0/0 | Delegated implementations are not claimed as shell resources | The four state models describe client behavior, including derived freshness categories and navigation outcomes; they are not durable service state machines. Sidebar folding remains synchronous component behavior rather than a new asynchronous workflow. Operations still needs its own objects and workflows for licensing storage and synchronization. ## Changes by Artifact Every listed artifact receives final prose and structured text. The notes identify factual corrections beyond that rewrite. | Artifact | Examination result and corrections | |---|---| | DOM-PFM-CSH-001 | Narrowed mounting, cleanup and remount claims to actual provider behavior; recognized demonstration context | | DOM-PFM-CSH-002 | Retained planned Accounting order with no claimed enforcement; replaced unavailable external source with local planning row | | DOM-PFM-CSH-003 | Retained strict entry, builders, encoding and compatibility behavior | | DOM-PFM-CSH-004 | Removed dependency tables and client-memory readership claim; corrected freshness timestamp meaning | | STATE-PFM-CSH-001 | Retry retains failure presentation; added its real outcomes; separated HQ departure from busy entry | | STATE-PFM-CSH-002 | Retained strict entry, refusal memory and departure-delay behavior | | STATE-PFM-CSH-003 | Separated failed refresh with aged timestamp from recent state; documented superseded-success timestamp advancement | | STATE-PFM-CSH-004 | Explained arrival-snapshot restoration and separate mobile state | | WF-PFM-CSH-001 | Corrected strict refusal fallback and acknowledged multiple reads and bookkeeping | | WF-PFM-CSH-002 | Removed repeat-read stability claim and clarified retained context on refusal | | WF-PFM-CSH-003 | Kept immediate-toast defect and unused-switch disagreement visible | | WF-PFM-CSH-004 | Recorded cache-clear await before local departure and uncaught rejection boundary | | WF-PFM-CSH-005 | Corrected threshold origin, successful-response timestamp and full-context service computation | | WF-PFM-CSH-006 | Retained client mapping and distinct permanent server redirects | | WF-PFM-CSH-007 | Corrected cached-placement retention and reconnect/remount revalidation limits | | WF-PFM-CSH-008 | Distinguished repeatable local guards from Security effects; explained permission-derived checks outside registry | | SVC-PFM-CSH-console-shell | Kept consumer boundary; removed transaction and pure-read overclaims; recorded documented enforcement and off defaults | | SVC-PFM-CSH-tenant-applications | Recorded independent uncached reads rather than a shared transaction; preserved provisional ownership | | SCR-PFM-CSH-001 | Corrected ungated shortcut and local actions; logo in HQ targets bare root | | SCR-PFM-CSH-002 | Explained retry without a loading-phase reset | | SCR-PFM-CSH-003 | Corrected observed Accounting order and unfiltered HQ-mode links | | SCR-PFM-CSH-004 | Distinguished user-menu filtering from direct settings entry | | SCR-PFM-CSH-005 | Corrected staff-identity gate; retained undelivered feedback and inert Profile findings | | SCR-PFM-CSH-006 | Retained premature success toast and copy acknowledgement without awaited clipboard success | | SCR-PFM-CSH-007 | Retained context-based root redirect without page content | | SCR-PFM-CSH-008 | Corrected greeting source and distinguished live unavailability from component error variants | | SCR-PFM-CSH-009 | Retained classified refusals, return-link selection and denied-staff HQ handling | | SCR-PFM-CSH-010 | Recorded catch-all lookup without a separate build-status check | | SCR-PFM-CSH-011 | Retained compatibility mapping and not-found state | | SCR-PFM-CSH-012 | Corrected unconditional overview link and distinguished page guards from route classification | | SCR-PFM-CSH-013 | Corrected ungated configuration link, embedded dates, Standard layout and cached-data error suppression | | ADR-PFM-CSH-001 | Rewrote presentation ownership and consumption tradeoffs | | ADR-PFM-CSH-002 | Distinguished normal single-read boot from strict-entry fallback | | ADR-PFM-CSH-003 | Retained strict-address choice and alternatives | | ADR-PFM-CSH-004 | Scoped static-builder evidence without universal runtime guarantee | | ADR-PFM-CSH-005 | Kept application-first choice while distinguishing personal access from organization-level copy | | ADR-PFM-CSH-006 | Retained snapshot choice and open refresh scope | | ADR-PFM-CSH-007 | Kept observed menu policy proposed and destination protection independent | | ADR-PFM-CSH-008 | Kept fallback-removal recommendation proposed rather than product approval | | ADR-PFM-CSH-009 | Retained resource-context preservation and open timing defect | | ADR-PFM-CSH-010 | Retained separate modes and remembered-workspace behavior | | ADR-PFM-CSH-011 | Removed unsupported deployment assertions; kept retirement undecided | | ADR-PFM-CSH-012 | Retained page-selected width and actual sidebar restoration | | ADR-PFM-CSH-013 | Removed claim that consumed reads and session actions have no service effects | | ADR-PFM-CSH-014 | Distinguished absent client registration from designated custom-field entities | | ADR-PFM-CSH-015 | Recorded consumed-read exclusion without treating route reachability as intake publication | | RESP-PFM, MOD-PFM-CSH row | Rewrote ownership, guarantees and delegation with no served operations or shell storage | Verification corrections were committed before the independent artifact rewrites. Follow-up inspection completed retry outcomes and refined observers without changing existing origins, status or intent. The frontmatter records every protected-field correction and the retained technical values. ## Open Disagreements | Finding or question | Remaining decision or evidence gap | |---|---| | FND-PFM-CSH-044 | Supply the missing brief and establish planning approval; external ordering approval was not independently inspected | | FND-PFM-CSH-045 | Prove retry presentation and departure sequencing in the browser | | FND-PFM-CSH-046 | Decide or repair freshness timing and cross-workspace request sharing | | FND-PFM-CSH-047 | Keep action visibility and destination authorization distinct in planning and proof | | FND-PFM-CSH-048 | Confirm cleanup failure behavior and avoid claiming atomic snapshots or universal cache erasure | | FND-PFM-CSH-049, FND-PFM-CSH-042 | Build the recorded Accounting order without assigning Operations storage to the shell | | FND-PFM-CSH-036, FND-PFM-CSH-037 | Establish the final contract home for consumed reads and the administrative application operation | | FND-PFM-CSH-039 | Add the no-inference sentence to the charter in an authorized planning revision | | FND-PFM-CSH-040 | Set the response to an unfamiliar context contract version | | FND-PFM-CSH-041, OQ-PFM-CSH-005 | Set returning-tab refresh scope against the accepted access design | | OQ-PFM-CSH-001 through OQ-PFM-CSH-004 | Retire old links, place renewal warnings, settle unfinished-screen visibility and choose home-dashboard ownership | | FND-PFM-CSH-006, FND-PFM-CSH-007, FND-PFM-CSH-026, FND-PFM-CSH-027 | Resolve undelivered feedback, inactive Profile, premature switch acknowledgement and permissive availability parsing | No planning artifact was edited. Existing acceptance gaps remain open, and no product suite execution is claimed. The shell performs no owned inference, so no new inference artifact is allocated. ## Validation Dependency installation and corpus conformance pass with zero errors. All four repository tests pass. Each artifact rewrite has its own checked commit, and the final audit preserves identifiers, product authority and pinned source values apart from the listed factual corrections. ## Verdict for Andrew The examined design is a faithful static account of the pinned shell implementation, with planned Accounting ordering and other disagreements explicitly separated from observed enforcement. Its weakest areas are browser proof for context races and refresh timing, provisional service ownership, and the unavailable planning approval evidence. Before implementation preparation, confirm planning authority, choose refresh and switch timing policies, establish the administrative read’s home, and settle customer visibility, renewal notices, compatibility retirement and dashboard ownership.