Store Session logs beside their owning Command log

[JacobStephens2]

Summary

Session logs now sit beside their owning Command log. Dispatched Runs, Tickets and Base fixes inherit that command's folder; existing logs stay in place.

 <logs.dir>/<owner>/<repo>/
-  sessions/<name>-<stamp>-<kind>.jsonl
+  commands/<command>/<name>-<stamp>-<kind>.jsonl
   commands/<command>/<prefix><stamp>.log

Closes #599

Evidence

• Before: cargo test --test command_logs a_pickup_spec_keeps_its_tickets_session_logs_beside_its_command_log -- --exact failed: commands/pickup/ lacked Tickets 21 and 22's transcripts. The plain Run and Pickup Run regression tests also reproduced the old destination.
  After: The same test passes. cargo test --test command_logs passes all 11 tests, including child Ticket inheritance, Architect dispatch, Base fixes and failure paths.
• cargo test --no-fail-fast passes the full suite.
• cargo clippy --all-targets -- -D warnings and cargo fmt --check pass.
• The focused Security audit/reproduction test passes with both Session logs in commands/secure/.
• cargo test --test continuation passes all 8 tests; no-session assertions now check transcript files rather than shared-directory absence.

Test seams

• The thirdshift CLI: observable Session logs, Command logs, failure output and notifications for Runs, Spec runs, Passes and their child Runs.

Review

Standards: one finding, addressed by sharing CommandKind::folder() across Command and Session log paths. Spec: no findings. Both axes reviewed all 33 changed files, including the folder-mapping correction; no changed file was left unread. Reports are saved to .thirdshift-review-JVNwYE/standards.md and .thirdshift-review-JVNwYE/spec.md in the session worktree.

Security: completed a single-session guidance review of 1e73f4fdbd398e7c4b664367b0d07faf208b70cc...HEAD, including supporting code and relevant attack-class guidance. Checked folder allowlisting, child argument propagation, log creation and consumers, and failure paths against the repository's trust and confidentiality ADRs. No introduced Security findings or proof-of-concept candidates were identified. This pass used source inspection; no tests were run and no source changes were made.

Unaddressed findings

• Standards: None.
• Spec: None.
• Security: None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Reverting restores the destination for future Session logs; existing files are not moved.

Blast Radius: logging

Tools that read the old Session log folder need the new command folder. An obstructed command folder now also prevents starting a session, because its Session log cannot be created there.

Built with codex · gpt-6.1-sol · high