[JacobStephens2]

Summary

console fleet add → verify whoami → User config entry + Credentials token
console fleet list → saved Fleet metadata (no token)
console fleet remove → remove entry + token

Test seams: the Console binary's CLI with standard input, two real Console HTTP servers, persisted User config/Credentials permissions and the rendered Console header.

Closes #1761

Evidence

Execution evidence

• Before: cargo test --test console fleet::pairs_two_consoles_and_removes_the_entry_and_owner_only_token failed on the unpatched baseline: test fleet::pairs_two_consoles_and_removes_the_entry_and_owner_only_token ... FAILED, with usage: thirdshift console ... because Fleet commands did not exist.
  After: the same command passed: 1 passed; 0 failed. cargo test --test console fleet:: passed all 4 Fleet tests, including refusal/404/unreachable handling, migration/Setup and hidden terminal input.
• cargo test --bin thirdshift config::tests: 42 passed.
• cargo test --test setup: 37 passed, 1 ignored fixture entry.
• cargo clippy --bin thirdshift -- -D warnings: passed after the review refactor.
• CI exposed the compact-help regression. Before: cargo test --test command_surface help_is_a_compact_reference_with_a_link_to_the_details failed with help should fit in a short reference, got 69 lines. After: cargo test --test command_surface passed: 20 passed, 1 ignored fixture entry. Fleet now shares the Console management help line; the 68-line limit and its regression test are retained.
• Final scripts/affected-tests issue-1142 selection: site 62 passed (83.93 s), Console 139 passed (137.80 s). Its local Rust run stopped because this machine's default Python 3.9 lacks tomllib; using a temporary Python 3.11 PATH entry, cargo test --test bug_origins passed 18 tests with 1 ignored fixture entry. No repository files changed for the environment correction.
• Full Rust coverage reused successful CI on final head 1b6103e1: cargo nextest run passed 3,850 tests, 91 skipped; 1,143.761 s execution plus 60 s compilation. CI formatting, cargo clippy --all-targets -- -D warnings, site and Console checks also passed. The equivalent full suite was not restarted after that success.

Visual evidence

Console header, 1440×900 desktop, empty fixture Inbox:

Console header, 390×844 mobile, same state:

Merge Danger

Door: two-way

Legacy links remain readable; a settings write migrates them to console.fleet. Rolling back to a pre-Fleet binary requires restoring other_consoles and removing the new Credentials table. Pairing keeps holder tokens in owner-only Credentials, separate from shareable User config.

Blast Radius: Console

Fleet config, local Credentials and Console header links. Pairing requires HTTPS except for 127.0.0.1 and refuses redirects.

Unaddressed findings

Standards

S2 (P3, naming judgement): keep the existing shared resend_key::Credentials store in this Fleet slice. It already owns Trial credentials; Fleet saves use the same comment-preserving, owner-only writer as other credentials. ADR 0007 explicitly leaves room for other providers. Splitting all existing credential ownership is an independent refactor; this implementation reuses that store as #1761 requires. No behavior failure was alleged.

Spec

None. The Spec review raised no findings.

Security

None identified. The focused Security review found no introduced vulnerabilities against pinned merge base a7d76bbb399b36cd108365b255b7e589492537cd.

Security review outcome

No unaddressed introduced findings.

Review coverage

Independent Standards and Spec reviews used issue-1142 (a7d76bbb) as the fixed point. Standards raised 2 design judgements: S1 is fixed by moving semantic Fleet mutations into config; S2 is declined above. Spec raised 0 findings. Both axes read all 21 changed files, including generated site/docs/index.html, at their reviewed revisions; no generated output was excluded.

Final coverage gap: src/main.rs received the subsequent help-line compaction after both reviewers' final pass. That final hunk was not independently rereviewed; it is covered by the reproduced compact-help regression and the passing command-surface tests above. No other changed file was left unread.

Security coverage: one session in guidance mode reviewed all 21 changed files and supporting token authentication, identity, terminal input, Credentials persistence and config replacement code. The review used the relevant attack-class, HTTP/authentication, client-side, local-file and availability guidance, plus ADRs 0007, 0015, 0016 and 0026 for the repository's trust boundaries.

Security validation: target/debug/deps/console-3f848f9d3ed6bff2 fleet:: --nocapture --test-threads=1 passed all 4 Fleet tests. Additional disposable checks passed for unsafe pairing URLs, all five redirect statuses (301/302/303/307/308), malformed or unsupported whoami responses, token secrecy, owner-only Credentials and hostile printable Fleet names rendered as escaped text. Checks used dummy data and private loopback inside an OS sandbox with read-only source, an empty allowlisted environment, capped scratch storage and CPU/memory/process/file/time limits. No source fixes or regression-test additions were needed.

The scripts/affected-tests a7d76bbb399b36cd108365b255b7e589492537cd selection was evaluated with command execution replaced by reuse of successful exact-head CI, confirming full Rust, site and Console coverage. Those broad suites were not rerun locally; HEAD remains 1b6103e1999a75bf1a9ebe2017baa01876093eb0.

Built with codex codex-cli 0.166.0 · gpt-6.1-sol · xhigh