[JacobStephens2]

Summary

Each Console now serves /api/v1 for the views and actions it already offers. The page remains server-rendered; CLI, page and API use shared handlers and CLI JSON values.

CLI --json ───────────────┐
Console page + session ───┼─ shared handlers + route table
/api/v1 + session/token ──┘       └─ OpenAPI + CLI parity checks

• Covers Inbox, History, Command details, Waterfall, logs, metrics, Scores, Bug origins, Experiments, cron jobs, Resources and look settings. Adds scoped Stop, Dismissal/Undo, eval judgments and Theme/section actions.
• Adds CLI-issued, hash-only tokens with default read, expiry, last use and immediate revocation. Bearer transport requires HTTPS or a direct connection to 127.0.0.1; failed tokens/passwords share per-address limiting.
• Enforces address scopes and the intersection with a token naming a person. security protects Security run details; Other-account Commands remain read-only. run and admin are reserved for Spec C; token management and address permissions remain CLI-only.
• Records API mutations and outcomes in the Console log, and identifies token/person callers in Stop/Dismissal Activity log entries. Publishes CLI/HTTP whoami and generated OpenAPI; documents the API in the guide and site.

This whole-Spec review fixed missing Theme import/look reads, read-token access to retained logs without Command records, duplicated scope parsing and the manual's unrestricted-session claim.

Evidence

Execution evidence

Test seams: the binary's CLI and Console HTTP interface over fixture Command records; the route table's CLI/OpenAPI parity checks; browser sign-in and scoped page controls.

• cargo test --test console api::theme_import_is_available_through_the_versioned_api -- --exact
  Before: failed with left: 404, right: 200. After: 1 passed; 0 failed.
• cargo test --test console api::existing_look_read_has_its_declared_api_route -- --exact
  Before: failed with left: 404, right: 200. After: 1 passed; 0 failed.
• cargo test --test console api::read_token_can_read_an_ordinary_log_without_a_command_record -- --exact
  Before: failed with left: 422, right: 200. After: 1 passed; 0 failed.
• cargo test --test console api::read_token_can_list_available_themes_without_changing_the_console -- --exact
  Before: failed with left: 405, right: 200. After: 1 passed; 0 failed.

The import regression also checks custom Theme persistence, missing act, invalid Theme documents and Console-log attribution. The route-parity guard now accounts for shared GET/POST API paths, retaining its negative checks for extra or undocumented routes.

• NEXTEST_TEST_THREADS=3 CARGO_BUILD_JOBS=2 scripts/affected-tests main: site 62/62 and Console browser 127/127 passed. Rust stopped after 1,031 passes on an unchanged Pickup fixture test; its exact isolated rerun passed.
• Resumed from Pickup onward without fail-fast: 2,893 passed, 3 failed across 2,896 tests. Each failure was systemd refusing an already-loaded transient scope; all three exact isolated reruns passed without code changes. Combined with the completed earlier binaries, all 3,788 scheduled Rust tests were exercised. There was no single clean full-suite run on this host.
• cargo test --bin thirdshift console::tests -- --test-threads=3: 10 passed, including the negative route/OpenAPI parity checks.
• cargo fmt --check and cargo clippy --all-targets -- -D warnings: passed.

Exact resumed command and isolated reruns

cargo nextest run --no-fail-fast --test-threads 4 --filter-expr 'not binary(/^(acquisition_advice|activity_log|agy_sessions|architect_run|background_work|base_fix|bug_origins|bug_run|ci|codex_sessions|command_logs|command_surface|console|console_install|continuation|dismiss|email_test|eval_arms|evals|experiments|export_trace|failed_run|fakes|fresh_run|grok_sessions|harness|harness_choice|issue_1711_retained_home|issue_981_spec_review|issue_number|launch_pull|merge_run|mergeable|metrics|muse_sessions|numbered_branches|opencode_sessions|otlp_endpoint|packaging|pickup_model)$/)'
cargo test --test pickup_run when_a_later_issue_is_ready_the_earlier_ones_lines_are_printed_and_it_is_taken -- --exact --nocapture
cargo test --test process implement::each_implement_step_retains_its_own_session_trace -- --exact --nocapture
cargo test --test process security_review::security_review_flags_override_the_config_and_skip_without_a_session -- --exact --nocapture
cargo test --bin thirdshift session::execution_tests::missing_review_reports_get_a_progress_line_and_the_run_carries_on -- --exact --nocapture

The last four commands each returned 1 passed; 0 failed. The affected tests and scope implementation are unchanged by this Spec; full logs are retained in .affected-tests/.

Visual evidence

Captured and inspected the same fixture Inbox at 1440×900 and 390×844, before on main and after with a read-only session. Restricted sessions hide Security navigation, Dismiss, Themes and section controls. PNG pairs are retained beside this Session's review reports. They are not published because this Session forbids pushing, including the skill's git-pushed Gist workflow.

Review coverage

Standards: 2 findings, both fixed. Spec: 2 findings, both fixed. Each reviewer read all 78 changed files, including generated site/docs/index.html, and reviewed the nine-file fix delta. No changed file was left unread; no generated-output exclusions. Reports and summary.json are retained with the Session trace.

Merge Danger

Door: two-way

The binary and scoped configuration can be rolled back; no destructive data migration.

Blast Radius: Console

Console readers, authenticated actions, token/account authorization and audit records.

Unaddressed findings

Standards

None. Both findings were addressed.

Spec

None. Both findings were reproduced and addressed.

Security

None. The introduced finding was reproduced with a failing proof-of-concept and fixed: a read token received a Security session prompt from the span and waterfall routes of an ordinary Command. The test failed before the change and passes after it.

Closes #1753

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh

Security review outcome

No unaddressed introduced findings.

Tickets

• Console API: /api/v1 read endpoints from the route table, under sign-in #1754 landed with Console API: serve read views as CLI JSON under /api/v1 #1776
• Console API: tokens, bearer authentication with read, and whoami #1755 landed with Console API: tokens, bearer authentication and whoami #1778
• Console API: the security and act scopes, with actions over the API and auditing #1756 landed with Console API: scoped actions and mutation auditing #1789
• Console API: address scopes and naming a person #1757 landed with Enforce Console account scopes and named-person token requests #1803
• Console API: per-address rate limit for failed tokens and passwords #1758 landed with Limit failed Console tokens and passwords per client address #1790
• Console API: OpenAPI description from the route table #1759 landed with Publish the Console API's generated OpenAPI description #1779