Skip to content
tcpsystems
Version: Current

console: the operator surface

import StatusPill from ‘../../../components/StatusPill.astro’;

The console is the operator surface for tcpsystems. The source tree defines operator routes for overview, seats, offers, usage, operations, DNS, and authentication state (sibling tcpsystems/console, observed at commit 6440621 on 2026-11-04 from /home/kivox/src/tcpsystems/console/src/routes: +page.svelte, seats/, offers/, usage/, ops/, dns/, auth/, login, logout, healthz, readyz). A route existing in the tree does not mean it answers with data: pending contracts are not live behavior.

What it does

Section titled “What it does”
  • Server-owned session. Browser requests use an OIDC code and PKCE flow; the server verifies the ID token and keeps an opaque, signed session cookie (__Host-console_session). The browser never holds acumen virtual keys or upstream service tokens (/home/kivox/src/tcpsystems/console/docs/CONSOLE-BFF-CONTRACT.md:7-14,37-46,145-149; /home/kivox/src/tcpsystems/console/src/lib/server/session.ts:8,79-95,170-186).
  • Operator scope. Signed-in data is private (Cache-Control: private, no-store) and protected by scope checks. Mutations require admin scope, a same-host origin, and an idempotency key before the request is forwarded (CONSOLE-BFF-CONTRACT.md:53-55,81-84,107-111; src/hooks.server.ts:30-74,111-117).
  • Honest module state. The console is designed to show live data when a backend route is available and an explicit unavailable or not-wired state when it is not. It must not present fake data for a missing capability (CONSOLE-MODULE-STATES.md:9-19; CONSOLE-BFF-CONTRACT.md:128-136).

Dated status

Section titled “Dated status”
  • Observed 2026-11-05 from this workspace: curl -sSI https://console.tcp.systems returned 302 with location: /login and cache-control: private, no-store (command run in /home/kivox/wt/docs/DOCS-CONSOLE-GUIDES; exit code 0).
  • Observed 2026-11-05 from this workspace: curl -sSI https://console.tcp.systems/healthz returned 200 with cache-control: public, max-age=5, must-revalidate (exit code 0). The x-request-id header confirms a console response, but this probe does not prove the authenticated application body.
  • Recorded deploy evidence: DEPLOY-MATRIX-2026-11-03 reports console.tcp.systems serving /healthz as {"status":"ok","service":"tcp-console","version":"node-70f5fcc","env":"production"} and authenticated admin BFF behavior on 2026-11-03 UTC (/home/kivox/src/tcpsystems/console/docs/evidence/DEPLOY-MATRIX-2026-11-03.md:76-101). Treat that as a dated snapshot, not a permanent fact.

Data and settings boundaries

Section titled “Data and settings boundaries”

The console follows DB-first operation for runtime state and settings. Its own durable state is PostgreSQL (CONSOLE_DATABASE_URL bootstrap reference in src/lib/server/db.ts:54-59; docs/SUITE-LANDING-TRAIN-1.md:25). The initial migration creates console_event, console_event_rejection, and console_setting; settings rows override registry defaults and are edited in the web (migrations/0001_console_event.sql:1-60).

Environment variables and secret files are bootstrap and credential references only. Runtime settings belong in PostgreSQL with audited edits and versioned migrations; env vars, checked-in files, JSON, YAML and file stores are not a runtime store (owner ruling 2026-11-09: durable state lives only in PostgreSQL).

Guides

Section titled “Guides”

The console’s badges are its own reconcile, not a probe of the estate: whole-estate component health, with its honest unprobed and stale states, lives on the status page.

It is in flight: the route set is ahead of the acumen deployment. The console spec lists which operations answer today and which are pending.