[JacobStephens2]

Summary

The Console serving one OS account now includes opted-in readable Commands from other local accounts, including Needs you and its tab count. status follows the same setting.

[console].other_accounts = "none" | "readable" | ["conductor"]
  → passwd homes + readable logs.dir overrides
  → Console views / status / log readers
      own Commands: existing controls
      other accounts: owner tag, read-only

Setup and thirdshift console other-accounts set/show the choice. Named unavailable accounts are reported once by status; filesystem permissions or ACLs grant access. Stop, Requeue, Dismiss and Undo refuse foreign Commands before writing or signaling.

Closes #1446

Test seams: User config and Setup; local-account source discovery; shared Command observation and Inbox presentation; CLI and Console HTTP reads and Stop/Dismissal requests.

Evidence

• Before: the new CLI/source regressions failed (unknown setting command; only the serving account's Command appeared). Reviewer reproductions also failed for trailing-slash log roots, unreadable foreign logs and Session traces, and Lanes/Stages.
  After: cargo test --test console other_accounts passes all 7 retained regressions, including live-process/no-write assertions, foreign-only status, foreign Process naming, and unreadable Session-trace isolation. Each reviewer's exact behavior reproduction now passes.
• cargo test --bin thirdshift setup::: 61 passed; focused Setup integration passed. Captured-inventory tests: 4 passed. Command-surface tests: 20 passed, 1 fixture entry ignored.
• cargo fmt --check and cargo clippy --all-targets -- -D warnings pass.
• scripts/affected-tests main passes on the reconciled head f23c133f: full Rust suite and 51 public-site browser tests. Measured with /usr/bin/time -p: 1644.21s wall for the required validation, compilation included. The existing Process heading test also passes.
• npm test --prefix console: 106 browser tests passed on the final implementation.
• Independent reviews against main, including a fresh review after merging upstream: Standards 2 findings, Spec 4; all addressed. Both axes cover every changed file. Generated output was inspected directly; no exclusions or unread changed files.

Merge Danger

Door: two-way

Blast Radius: Console

The default remains the serving account only. Other-account sources are read-only and require existing filesystem access; rollback restores the previous views without changing their records.

Unaddressed findings

Standards

None.

Spec

None.

Security

None.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh

Security review outcome

No unaddressed introduced findings.

CI notes

• site-test job 122443333941 was cancelled after 3h24m during the unchanged npx playwright install --with-deps chromium step while APT retried azure.archive.ubuntu.com; npm test never started. The branch changes none of .github/workflows/ci.yml, site/package.json, site/package-lock.json or site/tests/**, and the same installer succeeded in console-test on this head. Locally, npm test --prefix site passed all 51 tests (0 skipped).

• Local scripts/affected-tests main (574.69s, cached compilation) passed all 51 site tests and 141 Console integration tests, then stopped in code_graders::snapshot_preserves_files_directories_and_symlinks_but_skips_special_files: the fixture failed launching a freshly copied binary at tests/experiments.rs:791 with ETXTBSY / "Text file busy", before the snapshot assertion. The test, fixture and Code Grader are unchanged against main; the exact focused rerun passed (1/1), and the Rust CI job for head 7455dd69 succeeded. No unrelated code was changed; the local full suite did not complete.