# Console navigation

Route map
- /console/dashboard: KPIs, feed age, queue depth, alerts (min scope: ui.read).
- /console/findings: policy verdicts, explain drawer, exports (min scope: findings.read).
- /console/sbom: SBOM catalog, component graph, overlays (min scope: sbom.read).
- /console/advisories: advisory aggregation with provenance (min scope: advisory.read).
- /console/vex: VEX consensus and claims (min scope: vex.read).
- /console/runs: scheduler runs, progress, evidence bundles (min scope: runs.read).
- /console/policies: authoring, simulation, approvals (min scope: policy.read).
- /console/downloads: artifacts and offline kit parity (min scope: downloads.read).
- /console/admin: tenants, roles, clients, tokens, audit (min scope: ui.admin plus authority scopes).
- /console/help: guides, tours, release notes (min scope: ui.read).

Secondary navigation
- Left rail: active route, quick metrics, saved views.
- Breadcrumbs: Home / Module / Detail with shareable context.
- Action shelf: context actions (export, verify, retry) gated by scopes.

Command palette
- Open with Cmd/Ctrl+K.
- Jump to routes, saved views, tenants, and recent entities.
- Actions apply stored filters without a full reload.
- Offline mode restricts to cached routes and saved views.

Global filter controls
- Tenant picker (Cmd/Ctrl+T): requests a new Authority token and invalidates caches.
- Filter tray (Shift+F): time window, severity, tags, source, status, policy view.
- Component search: focus with / when tray is closed.
- Time presets: Cmd/Ctrl+Shift+1..4 for 24h, 7d, 30d, custom.
- Context chips: show active filters and allow one-click removal.

Keyboard shortcuts
- Cmd/Ctrl+K: command palette.
- Cmd/Ctrl+T: tenant switcher.
- Shift+F: filter tray.
- Cmd/Ctrl+1..9: saved view presets.
- ?: keyboard overlay with per-module shortcuts.
- Module examples: Cmd/Ctrl+G (SBOM overlays), Cmd/Ctrl+R (runs refresh), Cmd/Ctrl+S (policy save).
- Shortcuts are remappable and follow WCAG 2.2 guidance.

Deep link schema
- /console/<route>[/<id>]?tenant=<slug>&since=<iso>&until=<iso>&severity=<list>&view=<token>&panel=<drawer>&component=<purl>
- tenant is required and matches Authority slugs.
- panel selects drawers or tabs (panel=explain, panel=timeline).
- Offline share links include snapshot=<hash>.
- Share links map to CLI commands for parity and offline replay.

Tenant switching lifecycle
- User selects a tenant from the picker or palette.
- UI requests a new tenant-scoped, DPoP-bound token from Authority.
- Cache stores are invalidated; SSE streams reconnect with new headers.
- Filters reapply where valid; incompatible presets prompt fallback selection.
- Audit event ui.tenant.switch emitted with correlation ID.
- Offline mode hides tenants missing from the snapshot.

Focus and accessibility
- Route changes move focus to the primary heading.
- Drawers and modals trap focus until closed; Esc restores focus.
- Tab lists are keyboard navigable and update the URL tab parameter.
- Automated accessibility checks validate focus order and shortcut collisions.