[JacobStephens2]

Summary

/api/v1 request
  authenticate caller
  security → Security run details, traces and Waterfall
  act → shared CLI action → CLI JSON
    Stop / Dismissal → Activity log: by token <holder>
    attempted change → Console log: caller, endpoint, HTTP outcome

Adds Stop, Dismissal and Undo, Scores, Bug-origin settlement, Eval-task approval, Theme and hidden-section POSTs. Other-account Commands keep their CLI refusals. The guide, site pages and OpenAPI describe the calls and scopes.

Closes #1756

Test seams

• The Console binary over authenticated HTTP, compared with CLI JSON, including the human-scoring dialogue.
• The documented Activity log file and Console log CLI reader.
• Other-account Commands through the existing machine fixture, checking retained foreign files remain unchanged.
• The existing route-table/CLI/OpenAPI parity seam.

Evidence

Execution evidence

• Before: cargo test --test console tokens::read_scope_cannot_read_security_findings -- --exact failed: left: 200, right: 403 for Security Command details. An expanded run also failed with left: 200, right: 403 for /api/v1/waterfall?command=secure-fixture.
  After: The same command passed: 1 passed; 0 failed, covering details, Waterfall, spans and exact Session reads.
• Before: cargo test --test console actions::act_scope_dismisses_and_undoes_with_audit_and_token_activity -- --exact failed for /api/v1/stop: left: 405, right: 403.
  After: cargo test --test console act_ -- --test-threads=3 passed: 8 passed; 0 failed, including this test, live Stop with both endings, Dismissal/Undo and auditing, eval judgments and look-setting JSON parity.
• cargo test --test console api_session_actions_require_csrf_and_audit_the_address and cargo test --test console other_account_live_actions_never_signal_or_write_and_details_never_cache_there: each passed, 1 passed; 0 failed.
• cargo test --bin thirdshift console::tests: 10 passed; 0 failed.
• CARGO_BUILD_JOBS=2 cargo clippy --all-targets -- -D warnings: passed after replacing the OpenAPI wildcard with an exhaustive list of non-action views; cargo fmt --check passed.
• Review regression before: python3 .thirdshift-review-KXZS5F/spec-security-dispatch.py failed: all five dispatched-fix detail/log endpoints returned 200 instead of 403. After: the exact same command exited 0, all five endpoints returned 403 naming security. The reproduction is retained with the review reports and committed Rust test tokens::security_scope_covers_dispatched_fix_details_and_sessions covers the same five endpoints, including success with read,security.
• cargo test --test console tokens:: -- --test-threads=3: 8 passed; 0 failed.
• Second Spec regression before: python3 /tmp/thirdshift-1756-fail-closed-spec.py exited 1: corrupt Scoring data caused both finite log endpoints to return 200 and the private fixture marker. After: the identical command exited 0; both returned 403 without the marker. Its full test is retained in the Spec report and .thirdshift-review-KXZS5F/spec-fail-closed.py; the committed HTTP test also confirms security-authorized access with corrupt Scoring data.
• cargo test --test console -- --test-threads=3: 184 passed; 0 failed; 1 ignored after the routed-method CSRF correction.
• Final affected checks: scripts/affected-tests origin/issue-1753 selected site, Console and full Rust checks; incremental runs used 4d8eb8b0 and 32ba4976 after their corresponding fixes. The unchanged site suite passed. On final head 055e62db, cargo build --locked passed and all 126 Console browser tests passed (136.42 s). The local full Rust attempt took 497.32 s including compilation: 262 passed, three account-revocation cases timed out with explicit OS file watch limit reached / 60 s fallback warnings, and 82 were skipped. The three exact failing cases passed serially (cargo test --test console accounts::an_open_ -- --test-threads=1, then cargo test --test console accounts::cli_and_allowlist_changes_revoke_http_sessions_without_deleting_the_account -- --exact). Full Rust CI passed on this exact head: 3,770 passed, 82 skipped, across 86 binaries. Nextest test time was 1171.695 s, with a separate 1 m 34 s compilation: successful CI Rust job. Formatting, Clippy, site and Console CI jobs all passed; ARM CI was skipped under the repository’s PR policy..

Visual evidence

console-log, 1440×900

console-log, 390×844

guide, 1440×900

guide, 390×844

architecture, 1440×900

architecture, 390×844

workflow, 1440×900

workflow, 390×844

Review

Independent Standards and Spec reviews use the published issue-1753 branch at 39ce50f9473ccccc202200a13a2e6c0942030e06 as the fixed point. The local checkout of that branch was stale; this is the freshly fetched origin/issue-1753.

Standards: 1 finding raised, addressed (duplicated Waterfall authorization); final review covered all 31 changed files. Spec: 2 findings raised, addressed by the implementing agent (dispatched Security-fix scope and fail-open classification errors). Both exact Spec reproductions failed before and passed after their corrections; both have retained Rust HTTP coverage. No generated output was excluded. Reports and counts are retained in .thirdshift-review-KXZS5F/standards.md, spec.md and summary.json.

Final Spec review gap: automatic cyber-risk screening blocked the final follow-up, including a source-only attempt. The final correction in src/console.rs, src/console/api.rs, src/console/logs.rs, src/logs/reading/selection.rs, src/logs/stop.rs and tests/console/tokens.rs was not re-read by Spec. These paths were read in earlier review phases (Selection as supporting context); their final changed hunks remain unverified by that axis. Standards read the complete final changes.

Unaddressed findings

Standards

None. S1 was addressed by the shared waterfall::security_refusal operation.

Spec

None. P1 and P2 were both reproduced exactly as written, fixed, and retained as regressions. P1 now follows owning-Command privacy; P2 uses record-only classification and refuses classification errors. The Spec verification gap is disclosed above; no finding was declined or deferred to the Day shift.

Security

None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Reverting removes the new endpoints. Console log events gain optional endpoint/outcome fields; old events remain readable. Mutations have the existing CLI effects, including Stop cleanup and saved judgments.

Blast Radius: Console

Bearer action authorization, Security detail visibility, Activity and Console logging, and shared page handlers.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh