Auth & access surfaces [UI]

The sign-in and credential surfaces — the doorway into an instance and the gateway. One shared two-panel frame (AuthShell) hosts the caller's controls; distinct flows sit behind it for members, Directors, and MCP credentials. Auth is local-first; the control plane is a separate, non-blocking layer.

flowchart TB
    Shell["**AuthShell** — two-panel frame<br/>(welcome panel + caller's controls, cosmos backdrop)"]

    Shell --> SignIn & Portal & Central

    SignIn["**SignInView**<br/>gateway login (Supabase)"]
    SignIn -.->|"reset"| SetPw["SetPasswordCard"]

    Portal["**UserPortal**<br/>signed-in menu: profile · settings · sign-out"]
    Central["**DirectorCentralOnboarding**<br/>Director welcome / seeding"]

    subgraph Creds["credential surfaces (separate from sign-in)"]
        direction TB
        Mcp["**McpConnectModal**<br/>local stdio vs remote HTTP relay"]
        Prof["GatewayProfileModal · CredentialModal"]
    end

    Portal -.-> Creds

• One frame, many callers. AuthShell is the shared violet-welcome + controls layout; SignInView, UserPortal, and DirectorCentralOnboarding all render inside it, so the doorway looks the same everywhere.
• Local-first, gateway-separate. The member / dev sign-in path never calls the gateway; the Supabase session is the platform-account layer. The one exception is the Electron Director sign-in, which is license-gated (fail-closed, cache-honouring). Never put a gateway call in the member sign-in path.
• MCP credentials are their own flow. McpConnectModal sets up a headless connection — local loopback (stdio) vs a remote gateway-relayed HTTP endpoint with a minted Bearer token. Distinct from human sign-in (mcp-runtime).

Where it lives: src/features/access/auth/ — AuthShell.tsx · UserPortal.tsx; src/features/gateway/auth/ — SignInView.tsx · SetPasswordCard.tsx; src/features/access/ — McpConnectModal.tsx; src/features/access/onboarding/DirectorCentralOnboarding.tsx. Routes: src/app/(gateway)/{signin,access}/. The decision ladder: access-gate; the hosted session: hosted-signin.