Constructive Auth

Configure identity, authentication, and session behavior. This skill owns auth semantics and settings; constructive-blocks owns the Authentication feature-pack UI, its standalone host contract, and the Console module's endpoint, session, discovery, and adapter boundaries.

When to Apply

Use this skill when:

• Configuring sign-up, sign-in, recovery, magic link, OAuth, passkey, or phone behavior.
• Configuring MFA, backup codes, trusted devices, or device approval.
• Configuring cookie auth, anonymous sessions, CAPTCHA, cross-origin behavior, or rate limits.
• Linking identities or resolving account collisions.
• Understanding auth operation results, session claims, and service settings.

For product UI, activate constructive-blocks and install the Authentication pack or its Console module. Sign-up, sign-in, recovery, and account management are acceptance scenarios within that pack, not separate install units.

Runtime Boundary

For the Console auth module or custom auth client, the host must supply the tenant's explicit semantic auth endpoint. A standalone Authentication pack receives already-loaded resources and semantic actions through its host contract, so it does not resolve that endpoint itself. In Blocks/frontend/application code, never construct an auth-<database> hostname, derive a sibling route from the data endpoint, or send a bearer token to an inferred origin — endpoint discovery is the provisioning/harness layer's job (that layer derives and pins the per-DB endpoints and hands them to the app via env/host contract).