One mount-prefix knob for the data plane: BASE_API_PREFIX (default
/v1). Multi-app deployments set /v1/<app> so a gateway can route by
path. Hanzo IAM is always a fixed sibling at /v1/iam — apps do not
mount their own IAM at /v1/<app>/iam.
Ripped:
- BASE_AUTH_MODE env knob — was a no-op after the IAM-native rip
(the "builtin" branch had no routes left to bind).
- apis/superuser_auth_oidc.go (~460 lines) — stale parallel OIDC
superuser path at /_/auth/oidc/*. The canonical path is
/v1/iam/oauth/* via the platform plugin (proxy or embedded).
- apis/base.go EXTERNAL_AUTH_ONLY env-var fallback — the platform
plugin is mandatory and sets the store keys directly. One way only.
installer.go: skip the first-superuser installer when the platform
plugin has flagged external-only mode (IAM owns first login).
LLM.md updated to reflect the new contract.
zeekay
7e92f2d9e5