The reference app cannot be viewed: 22 routes declare auth: 'required' and no authenticator is configured

[sebyx07]

Found by driving examples/dummy with a real browser.

$ x dev --port 4477
X_CONFIG_INVALID: 22 route(s) declare auth: 'required' and no authenticator is configured,
  so every request is anonymous and each of them refuses every session
  fix: call configureAuthenticator() at module scope in a file under apps/*/

$ curl -o /dev/null -w '%{http_code}' http://localhost:4477/settings
401

Why this matters more than it looks. examples/dummy is the proving ground — "every primitive, once, idiomatically" — and most of it cannot be looked at. Only /, /pricing, /blog and /offline render. Every app/ surface answers 401, including /settings, which is now the app's only page with a reactive Solid island.

That is a DX problem twice over:

1. A human evaluating the framework opens the reference app, clicks anything past the marketing pages, and gets a 401. The most convincing thing in the repo is unreachable.
2. An agent verifying its own change cannot see the page it just edited. This is precisely the gap x shot / x pr / x ci: the primary developer is an agent, and an agent cannot look at anything #241 describes — and the workaround is to hand-roll browser driving, which is what I did to prove the island works at all.

The warning is emitted at boot, correctly coded, with a runnable fix: — the error contract works fine. The problem is that the reference app ships in that state and nobody notices, because no gate step loads a page and looks at it.

Fix, one of:

• examples/dummy calls configureAuthenticator() with a dev-only viewer, so its own pages render. It already has viewerFor machinery in its test fixtures.
• or x dev mounts a dev-only anonymous actor when no authenticator is configured, loudly (a banner in /_x, a line in the boot log), so the app is browsable while the misconfiguration stays visible.

The first is more honest and demonstrates a primitive the app is otherwise silent about. The second helps every app, not just this one — it is a mechanism, not a convention. They are not exclusive.

Related: /favicon.ico 404s on every page. Cosmetic, but it is the only console error on an otherwise clean load, and a scaffolded app inherits it.

[developerz-ai]

I couldn't reliably classify or scope this report right now, so I haven't guessed or handed it off. A maintainer will review it.

🤖 Posted by developerz.ai — the maintainer agent, not a human.