[JacobStephens2]

Summary

console scopes → CLI-only address permissions (default: all five)
session → address permissions
token + X-Thirdshift-Person → local sign-in list → intersect permissions
Stop / Dismissal → person and token holder in the Activity log

Closes #1757

Setup preserves the scopes table and writes its default. Restricted sessions hide action controls and retain their own browser sign-out. The guide and public Console descriptions document the CLI and header.
The Resources indicator also follows read, including on an Account page opened with no scopes.

Test seams: the thirdshift binary (Console scopes and Setup), authenticated HTTP (authorization, page controls, Activity log, protected settings), and the rendered Console in Chromium.

Evidence

Execution evidence

• Before: cargo test --test console cli_sets_and_shows_address_scopes_without_changing_other_settings failed because console scopes returned the usage error; 1 failed.
  After: the same command passed: 1 passed; 0 failed. The final cargo test --test console accounts::address_scopes run passed all seven tests, including named-person Stop/Dismissal, scope intersection, protected config, Security log access, and restricted sign-out.
• Before: python3 .thirdshift-review-xFNQof/repro-signout.py failed with read-only session POST /sign-out: 403 {"error":"Missing scope: act"}.
  After: the exact reproducer exited 0 with read-only session POST /sign-out: 303. The regression is also kept in the Rust integration suite.
• Before: cargo test --test console accounts::address_scopes::act_without_security_cannot_read_a_security_run_from_the_stop_page -- --test-threads=1 failed (exit 101). A signed-in session with scopes read and act received HTTP 200 for GET /stop?command=secure-fixture, and the page included the Security run's finding titles.
  After: the same command passed. That session receives 403 Missing scope: security and neither title. An ordinary Stop page stays available, and adding the security scope shows the finding again.
• node --test console/tests/accounts.test.cjs: both tests passed, including 1440×900 and 390×844 with JavaScript enabled and disabled.
• cargo fmt --check, npm run docs:check --prefix site, and cargo clippy --all-targets -- -D warnings passed. All ten Console unit tests and the complete binary unit suite passed (1,646 passed, three ignored). Existing allowlist diagnostics and every page's CLI-pair assertions are preserved.
• Final local validation: CARGO_BUILD_JOBS=3 NEXTEST_TEST_THREADS=8 NEXTEST_RETRIES=1 RUST_TEST_THREADS=3 scripts/affected-tests origin/issue-1753 passed: 62 site tests, 127 Console tests, and 3,783 Rust tests; 82 skipped. The Rust run took 2,074.694 seconds after compilation. One Architect test (labelling_an_idea_adds_needs_triage_with_its_description_to_a_repository_that_lacks_it) hit a transient systemd scope-name collision and passed its retry; no retry policy or scope-management code was changed.
• CI on 8284a57f is green: all 3,783 Rust tests passed, with 82 skipped and no retries. Console and site checks passed. The site job was retried after Chromium installation consumed nearly all of its ten-minute limit and the first attempt was cancelled during tests.

Visual evidence

Desktop, 1440×900: signed-in Inbox with the live Command's details open; all scopes before, read after.

Phone, 390×844: the same Inbox and Command details flow.

Account with zero scopes: Resources is hidden while the browser's own sign-out stays available.

1440×900:

390×844:

Unaddressed findings

Standards

None. STD-1 was addressed with a shared action Actor that owns attribution and preserves the stored Stop-request format.

Spec

None. SPEC-1 was reproduced with the reviewer's exact command, fixed, and retained as a regression test. No findings were deferred to the Spec or Day shift.

Security

None. An Act session without the security scope could open a Security run's Stop page and read its finding records. cargo test --test console accounts::address_scopes::act_without_security_cannot_read_a_security_run_from_the_stop_page -- --test-threads=1 failed before the guard (the page returned 200 and included the finding titles) and passed after it. The confirmation page now uses Peek's missing-scope refusal. Stopping the run still requires only Act.

Review fixed point: remote issue-1753 at 3480c496429376f641b5a7e8a72b3fd3c8e16436. Each reviewer read 43 of the 44 changed files, including the generated manual. Final changes after both permitted follow-ups were not reread: src/console/header-status.html (Resources scope guard), src/console/auth.rs (Clippy error boxing), src/config/console.rs (restored CLI diagnostic prefix), src/console.rs (API-only metadata assertion), and the final zero-scope assertion in tests/console/address_scopes.rs. The latter four files' earlier hunks were read. These changes passed their targeted Rust tests, browser account tests where affected, and Clippy. No other coverage gaps remain, and no generated output was excluded. Reports and summary.json are retained in .thirdshift-review-xFNQof/ with counts {"standards":1,"spec":1}.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Older binaries cannot enforce address scopes. Before rollback, review the sign-in list and remove the new console.address_scopes key. Stored Stop requests retain their existing field layout.

Blast Radius: Console

Scope assignments can deny page or API access; the machine's shell remains the recovery path. Existing addresses retain all five scopes until narrowed.

Built with codex codex-cli 0.164.0 · gpt-6.1-sol · xhigh