Design settled and VERIFIED IN SOURCE, so it need not be re-derived when ADR-0030 §7 opens (see the G005-BLOCK bead).
LINK, DO NOT LOOP BACK OVER HTTP. Create backend/crates/ssr (package console-ssr) exporting pub fn router(SsrState) -> Router, merged into console-app's build_router exactly as audit_router already is. The pattern is present at backend/app/src/lib.rs:2969-2977:
let audit_router = console_platform_request_context::with_request_context(
Router::new().route(AUDIT_ROUTE_PATH, get(audit_log))...with_state(state.clone()),
state.jwt_verifier.clone(), pool.clone());
let domain_router = audit_router.merge(console_telemetry::router(...));
No new binary, no new port.
WHY NOT AN HTTP LOOPBACK: it loses the tenant task-local. CURRENT_ORG is a tokio task_local! and current_org() fails CLOSED when unset, so a loopback request is a fresh task that must re-verify the JWT and re-resolve branch scope from the database just to re-arm it.
FIRST SCREEN IS /setup (그룹·법인), deliberately: it is the ONE page NOT under tenant middleware - the platform tier is mounted OUTSIDE with_request_context - so it exercises resolve_platform_principal / with_platform_context, which tenant-only pages never touch. 100% server-rendered, correct with JavaScript disabled, form POST plus redirect.
THE ORACLE DECISION, settled: do NOT link oracle.rs. It hardcodes minimum_hourly with no effective period and is silently wrong from 2027, while console-payroll-domain::minimum_wage_rates() (payroll/domain/src/lib.rs:1095) returns the same judgement WITH an EffectivePeriod and a full Instrument, seeded by migration 0210:166. Linking oracle.rs would turn a 2-way drift that is currently SCORED by vectors.json into a 3-way drift that is not, and put the least authoritative copy on the request path. Instead: keep vectors.json and RE-POINT it at the backend crates, keep the 31-code RefusalCode catalogue, make KernelError carry {code, ko, basis} at the REST/SSR boundary, and strip oracle.js to the FORMAT tier only (which is all §4-27 assigns to the client).
ko.ts (217 KB): transform, do not rewrite. ~50-line node script over the TS AST emitting string leaves verbatim and rewriting the 259 one-line arrow functions into positional format strings; one test asserting key-path-set equality and {n}-arity against parameter count.
Design settled and VERIFIED IN SOURCE, so it need not be re-derived when ADR-0030 §7 opens (see the G005-BLOCK bead).
LINK, DO NOT LOOP BACK OVER HTTP. Create backend/crates/ssr (package console-ssr) exporting
pub fn router(SsrState) -> Router, merged into console-app's build_router exactly as audit_router already is. The pattern is present at backend/app/src/lib.rs:2969-2977:let audit_router = console_platform_request_context::with_request_context(
Router::new().route(AUDIT_ROUTE_PATH, get(audit_log))...with_state(state.clone()),
state.jwt_verifier.clone(), pool.clone());
let domain_router = audit_router.merge(console_telemetry::router(...));
No new binary, no new port.
WHY NOT AN HTTP LOOPBACK: it loses the tenant task-local. CURRENT_ORG is a tokio task_local! and current_org() fails CLOSED when unset, so a loopback request is a fresh task that must re-verify the JWT and re-resolve branch scope from the database just to re-arm it.
FIRST SCREEN IS /setup (그룹·법인), deliberately: it is the ONE page NOT under tenant middleware - the platform tier is mounted OUTSIDE with_request_context - so it exercises resolve_platform_principal / with_platform_context, which tenant-only pages never touch. 100% server-rendered, correct with JavaScript disabled, form POST plus redirect.
THE ORACLE DECISION, settled: do NOT link oracle.rs. It hardcodes minimum_hourly with no effective period and is silently wrong from 2027, while console-payroll-domain::minimum_wage_rates() (payroll/domain/src/lib.rs:1095) returns the same judgement WITH an EffectivePeriod and a full Instrument, seeded by migration 0210:166. Linking oracle.rs would turn a 2-way drift that is currently SCORED by vectors.json into a 3-way drift that is not, and put the least authoritative copy on the request path. Instead: keep vectors.json and RE-POINT it at the backend crates, keep the 31-code RefusalCode catalogue, make KernelError carry {code, ko, basis} at the REST/SSR boundary, and strip oracle.js to the FORMAT tier only (which is all §4-27 assigns to the client).
ko.ts (217 KB): transform, do not rewrite. ~50-line node script over the TS AST emitting string leaves verbatim and rewriting the 259 one-line arrow functions into positional format strings; one test asserting key-path-set equality and {n}-arity against parameter count.