[JacobStephens2]

Summary

Start work, Run now, User config and Update can target a Fleet machine from one Console. The owner checks the signed-in person's effective scopes, executes the request and records its attribution. CLI start, config and update accept --machine and act as the token holder.

Console person ── selected machine /api/v1 ── owning Command / config / update
CLI --machine ── saved scoped token ──────── owning machine

Closes #1769

Test seams: CLI; authenticated Console/API; merged Inbox and Activity log; browser forms and confirmation at 1440×900 and 390×844.

Evidence

Execution evidence

• Before: PLAYWRIGHT_BROWSERS_PATH=/tmp/thirdshift-1769-browsers node --test console/tests/fleet-control.test.cjs failed with Update errors fit the viewport: false !== true.
  After: the same command passed both Fleet tests (2 passed), including the hostname-collision Console/CLI regression.
• cargo clippy --all-targets -- -D warnings: passed.
• Retained help regressions caught a 70-line reference and a missing standalone thirdshift help entry. After 40c9fbd2, PATH=/tmp/thirdshift-1769-tools:$PATH cargo test --test command_surface passed: 20 passed, one ignored fixture entry point. The reference keeps its existing 68-line budget and all command forms.
• The hostname-collision test first failed with owner config 3 !== 5; after the fix, both Console and CLI writes change only the owning machine.
• Final validation at 9fc3c23e: PATH=/tmp/thirdshift-1769-tools:$PATH PLAYWRIGHT_BROWSERS_PATH=/tmp/thirdshift-1769-browsers NEXTEST_TEST_THREADS=8 RUST_TEST_THREADS=3 scripts/affected-tests origin/main passed: Rust 3,924 passed, 91 skipped; site 67 passed; Console 160 passed. The Rust command took 1,083.12 seconds with a warm build cache, including compilation (0.29 seconds); its test runner reported 1,081.918 seconds. The selector's separate locked build also passed.
• Validation uses Python 3.11 and Nextest 0.9.151 in an isolated tool path. Temporary test homes get an empty default crontab; explicit test-owned cron fixtures override it. The unchanged idle-I/O test failed identically on the base binary with this host's real crontab; all four idle tests pass with isolated scheduler input.
• The scope regression verifies that authenticated tokens may inspect their own identity while status and OpenAPI still require read.
• Two-Console tests cover the owner's fake Harness, merged Inbox, person/caller Activity log, owner-only config changes, refused access settings, hidden controls and forced 403s. The update test checks the remote version, replaces only the owner's private installed binary and observes its Console restart.

Visual evidence

Paired captures use the same two-Console fixture, viewport and flow. Before uses the unpatched base binary; After includes the reviewed controls and alert wrapping. Test data only; captures are hosted in a secret Gist.

Desktop and mobile Before / After pairs

Start work — 1440×900

Start work — 390×844

Run now — 1440×900

Run now — 390×844

User config — 1440×900

User config — 390×844

Update — 1440×900

Update — 390×844

Review

Main is pinned at ed302922 (origin/main; the local main worktree is behind). Both independent axes inspected all 39 then-changed paths through d0382523, including generated manual hunks. No generated output was excluded. Later validated changes were made after the skill's single follow-up; their final deltas remain unread by the independent reviewers: console/tests/fleet-control.test.cjs, docs/guide.md, site/docs/index.html, src/console/assets/console.css, src/console/fleet_control.rs, src/console/start_controls.rs, src/main.rs, tests/console/tokens.rs.

Standards raised one P3 duplication finding, addressed by typed Remote::identity(); Spec raised zero findings. Post-review lint-only cleanup in src/console/fleet_control.rs passed Clippy; the existing compact-help test also led to a two-line reduction in src/main.rs help text, keeping its 68-line budget. The final hostname-collision regression also verifies that Console and CLI config writes stay on the owner when its Fleet name matches the caller's hostname. Reports and {"standards":1,"spec":0} are saved in the requested .thirdshift-review-ZBhvj9/ directory.

Unaddressed findings

Standards

None. The scope-decoding duplication finding was addressed in d0382523.

Spec

None.

Security

None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

No data migration; reverting restores local controls.

Blast Radius: Fleet

A run or admin token can start work or administer its issuing machine. Owner-side token/person scope checks remain authoritative; the API cannot borrow the caller's Fleet credentials. Access settings remain shell-only.

Built with codex codex-cli 0.166.0 · gpt-6.1-sol · xhigh