[JacobStephens2]

Summary

Console route table: page + CLI twin + /api/v1 path + scope
  sign-in session / --no-sign-in
    shared read handlers
      ├── HTML + htmx page
      └── CLI --json document → /api/v1 JSON

Serve the Inbox, Command details and logs, History, Lanes, Stages, metrics, Scores, Bug origins, Experiments and cron jobs through the read API. Keep Other-account Commands read-only. Document the paths in the manual and site. Finite log reads gain --json to provide their CLI twins.

Closes #1754

Test seams

• Console HTTP and the binary over fixture Command records: CLI JSON parity, current sign-in, refusal messages, reads and Other-account Commands.
• Console route table: CLI twins, versioned API paths, one scope and unpaired-registration rejection.

Evidence

Execution evidence

• Before: cargo test --test console api::inbox_api_equals_status_json_without_sign_in failed: left: 404, right: 200.
  After: the same command passed: 1 passed; 0 failed.
• The Spec review's exact standalone Python reproduction failed with AssertionError: (400, 'text/plain; charset=utf-8', 'Invalid URL: Invalid UTF-8 in id'). After the fix it exits 0; retained api_path_extractor_refusals_are_json checks five path variants and the existing page response.
• cargo test --test console api::: 4 passed. cargo test --bin thirdshift console::tests: 4 passed, including the missing-path and missing-scope should-panic twins.
• cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings and npm run docs:check --prefix site passed.
• NEXTEST_TEST_THREADS=3 RUST_TEST_THREADS=3 scripts/affected-tests issue-1753: site 62/62 passed (144.58s); Console browser 126/126 passed (129.02s). The Rust step stopped after 341.86s including compilation, with 187 passed and one systemd launch failure: thirdshift-session-3983810-0-harness.scope was already loaded or has a fragment file. cargo test --test ci a_pr_closed_by_the_end_is_a_failed_run then passed alone (1 passed, 0 failed). The unrun full-suite coverage is supplied by CI for the exact final head, recorded below.
• Final head 6c96931b: complete Rust CI passed all 3,748 tests (82 skipped; 1,164.356s execution). Site and Console CI passed too. Reused this exact-head full-suite result instead of repeating the local suite. Both release builds and the release smoke gate are green; the ARM download initially returned HTTP 504 and passed on retry.

Visual evidence

Console Inbox, 1440×900:

Console Inbox, 390×844:

Manual, Console installation, 1440×900:

Manual, Console installation, 390×844:

Review

Reviewed against issue-1753 (7b14004f). Standards: 0 findings. Spec: 1 finding, reproduced and fixed in 6c96931b; no new findings on follow-up. Counts include the fixed finding. Reports and summary.json are retained in the Session's .thirdshift-review-W5OdYL/ directory.

Both reviewers read all 40 changed files, including generated site/docs/index.html and its source/generator. Unread changed files: none. Generated-output exclusions: none.

Unaddressed findings

Standards

None.

Spec

None.

Security

None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

No durable format migration. Existing page actions stay available; token authentication and scope enforcement belong to later Tickets.

Blast Radius: Console

Changes affect read routing, JSON/error responses and the shared CLI/page readers.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh