# Use a Source Overlay For CP9 UI Runtime Configuration

The unmodified `dbaas-ui` production line embeds API, Auth0, and observability settings during compilation, and its local-storage override does not cover every main API consumer. CP9 therefore applies a minimal, versioned source overlay to each pinned upstream commit before building a UI image candidate; the overlay loads a per-session public runtime configuration before the main application and routes all main API consumers through that contract. In v1 the main API origin is always the same cp9 session origin that served the UI and is not an arbitrary configured backend URL. The Auth0 runtime values come from CP9's existing `tidb-dev` account-service configuration, and the current session's `/auth_redirect` flow must support normal interactive login; upstream production defaults and pre-seeded browser tokens are not substitutes. Candidate construction fails closed when the overlay no longer applies. CP9 never patches compressed or content-hashed JavaScript after the build, and an upstream implementation of the same runtime contract may replace the overlay later.