gardesk/garcard / 007ef69

Browse files

Record sprint 08 targeted parity captures

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
007ef6970bdbb6f57ccd0d32ed9ba8f216ca18bf
Parents
6adfbf7
Tree
42c83a3

2 changed files

StatusFile+-
M examples/sprint-08-parity-matrix.md 7 9
M examples/sprint-08-validation-report-2026-02-26.md 26 6
examples/sprint-08-parity-matrix.mdmodified
@@ -10,13 +10,13 @@ Use this matrix to certify behavior against mature desktop PolicyKit agents.
10
 | Scenario | Procedure | Expected Result | Status | Evidence |
10
 | Scenario | Procedure | Expected Result | Status | Evidence |
11
 | --- | --- | --- | --- | --- |
11
 | --- | --- | --- | --- | --- |
12
 | Success path | Trigger `pkcheck --allow-user-interaction --process $$ --action-id com.mesonbuild.install.run` and enter correct password | Prompt completes, auth is authorized, no failure flash | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 1/2`, `last_outcome: success`) |
12
 | Success path | Trigger `pkcheck --allow-user-interaction --process $$ --action-id com.mesonbuild.install.run` and enter correct password | Prompt completes, auth is authorized, no failure flash | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 1/2`, `last_outcome: success`) |
13
-| Failure path | Trigger same `pkcheck` and enter wrong password | Prompt flashes error, reprompts in place, `auth-summary.last_outcome=failure` before retry | Pending | daemon log + `garcardctl auth-summary` |
13
+| Failure path | Trigger same `pkcheck` and enter wrong password | Prompt flashes error, reprompts in place, `auth-summary.last_outcome=failure` before retry | PASS (targeted) | 2026-02-26 deterministic wrong-password capture (`last_outcome: failure`, `pkcheck rc=1`) |
14
 | Cancel path | Trigger `pkcheck`, cancel prompt | Request exits cleanly, `auth-summary.last_outcome=canceled` | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 3`, `last_outcome: canceled`) |
14
 | Cancel path | Trigger `pkcheck`, cancel prompt | Request exits cleanly, `auth-summary.last_outcome=canceled` | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 3`, `last_outcome: canceled`) |
15
-| Timeout path | Set short timeout (`GARCARD_PROMPT_TIMEOUT_SECS=2`), trigger auth, do not respond | Request times out, `auth-summary.last_outcome=timeout` | Pending | daemon log + `garcardctl auth-summary` |
15
+| Timeout path | Set short timeout (`GARCARD_PROMPT_TIMEOUT_SECS=2`), trigger auth, do not respond | Request times out, `auth-summary.last_outcome=timeout` | PASS (targeted) | 2026-02-26 deterministic timeout capture (`last_outcome: timeout`, `pkcheck rc=1`) |
16
-| Multi-identity flow | Trigger policy requiring identity choice | Identity list rendered, selected identity is honored | Pending | prompt capture + daemon log |
16
+| Multi-identity flow | Trigger policy requiring identity choice | Identity list rendered, selected identity is honored | BLOCKED (host policy) | Runtime callbacks report `identity_count=1` for tested action; no alternate admin identity surfaced |
17
-| Retention choice flow | Trigger policy exposing retention options | Retention choice accepted and recorded in `auth-summary` | Pending | `garcardctl auth-summary` |
17
+| Retention choice flow | Trigger policy exposing retention options | Retention choice accepted and recorded in `auth-summary` | BLOCKED (host policy) | Runtime details expose only `Retention options: one-shot` for tested action |
18
 | Temp auth introspection | Run `garcardctl temp-list` after successful retained auth | Active temporary authorization entries are listed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`tmpauthz0/tmpauthz1` listed) |
18
 | Temp auth introspection | Run `garcardctl temp-list` after successful retained auth | Active temporary authorization entries are listed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`tmpauthz0/tmpauthz1` listed) |
19
-| Temp auth revoke single | Run `garcardctl temp-revoke <id>` | Target authorization removed | Pending interactive retained auth | `temp-list` before/after |
19
+| Temp auth revoke single | Run `garcardctl temp-revoke <id>` | Target authorization removed | PASS (targeted) | 2026-02-26 single-id revoke (`tmpauthz0` present before, revoked true, absent after) |
20
 | Temp auth revoke all | Run `garcardctl temp-revoke-all` | All temporary authorizations removed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`revoked_count: 1` after cycle 1/2) |
20
 | Temp auth revoke all | Run `garcardctl temp-revoke-all` | All temporary authorizations removed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`revoked_count: 1` after cycle 1/2) |
21
 | Daemon restart during lifecycle | Restart daemon and rerun status/diag/temp commands | Control plane recovers without stale socket state | PASS (baseline) | `target/sprint-08-parity-evidence.md` (`validate-sprint-07.sh` section) |
21
 | Daemon restart during lifecycle | Restart daemon and rerun status/diag/temp commands | Control plane recovers without stale socket state | PASS (baseline) | `target/sprint-08-parity-evidence.md` (`validate-sprint-07.sh` section) |
22
 | Polkit restart recovery | Restart polkit and relaunch daemon | Diagnostics recover, control commands remain responsive | PASS (manual) | 2026-02-26 manual `sudo systemctl restart polkit` + post-check `validate-sprint-07.sh` (`polkit` backend healthy) |
22
 | Polkit restart recovery | Restart polkit and relaunch daemon | Diagnostics recover, control commands remain responsive | PASS (manual) | 2026-02-26 manual `sudo systemctl restart polkit` + post-check `validate-sprint-07.sh` (`polkit` backend healthy) |
@@ -26,7 +26,5 @@ Use this matrix to certify behavior against mature desktop PolicyKit agents.
26
 2. Operator: mfwolffe/codex
26
 2. Operator: mfwolffe/codex
27
 3. Result (`PASS`/`FAIL`): IN PROGRESS
27
 3. Result (`PASS`/`FAIL`): IN PROGRESS
28
 4. Blocking gaps:
28
 4. Blocking gaps:
29
-   - failure-path parity (`last_outcome: failure`) on explicit wrong-password flow
29
+   - multi-identity scenario requires host with >1 eligible identity for same action
30
-   - timeout-path parity (`last_outcome: timeout`) under interactive challenge
30
+   - retention-choice scenario requires host policy/details exposing session/always options
31
-   - multi-identity and retention-choice scenarios on policies that expose those options
32
-   - temp-revoke single-id scenario
examples/sprint-08-validation-report-2026-02-26.mdmodified
@@ -11,6 +11,12 @@ 
11
 3. `GARCARD_SPRINT07_BACKEND=stub GARCARD_SPRINT07_RUN_PKCHECK=0 ./examples/validate-sprint-07.sh`
11
 3. `GARCARD_SPRINT07_BACKEND=stub GARCARD_SPRINT07_RUN_PKCHECK=0 ./examples/validate-sprint-07.sh`
12
 4. `cargo test -p garcard`
12
 4. `cargo test -p garcard`
13
 5. `cargo test --workspace`
13
 5. `cargo test --workspace`
14
+6. targeted failure capture with deterministic wrong-password prompt command (`GARCARD_PROMPT_COMMAND='printf "wrong-password\n"'`)
15
+7. targeted timeout capture with deterministic timeout prompt command (`GARCARD_PROMPT_COMMAND='exit 124'`)
16
+8. targeted single-id revoke capture (`temp-list` -> `temp-revoke <id>` -> `temp-list`)
17
+9. manual privileged restart + verification:
18
+   - `sudo systemctl restart polkit`
19
+   - `GARCARD_SPRINT07_BACKEND=polkit GARCARD_SPRINT07_RUN_PKCHECK=0 ./examples/validate-sprint-07.sh`
14
 
20
 
15
 ## Results
21
 ## Results
16
 1. Integration certification script now passes with zero warnings:
22
 1. Integration certification script now passes with zero warnings:
@@ -29,6 +35,19 @@ 
29
 6. Privileged polkit-restart recovery executed manually on 2026-02-26:
35
 6. Privileged polkit-restart recovery executed manually on 2026-02-26:
30
    - operator ran `sudo systemctl restart polkit`
36
    - operator ran `sudo systemctl restart polkit`
31
    - post-restart lifecycle verification on `polkit` backend passed (`validate-sprint-07.sh`)
37
    - post-restart lifecycle verification on `polkit` backend passed (`validate-sprint-07.sh`)
38
+7. Targeted failure-path capture passed:
39
+   - `pkcheck rc=1` with `Not authorized`
40
+   - `auth-summary.last_outcome=failure`
41
+8. Targeted timeout-path capture passed:
42
+   - `pkcheck rc=1` with `Not authorized`
43
+   - `auth-summary.last_outcome=timeout`
44
+9. Targeted temp-revoke single-id capture passed:
45
+   - temporary authorization id observed: `tmpauthz0`
46
+   - `temp-revoke tmpauthz0` returned `revoked: true`
47
+   - follow-up `temp-list` returned empty authorizations
48
+10. Runtime capability probe findings:
49
+   - multi-identity not exposed on tested host/action (`identity_count=1`)
50
+   - retention options for tested action resolve to `one-shot` only
32
 
51
 
33
 ## Matrix Status
52
 ## Matrix Status
34
 1. Baseline non-interactive rows updated in `examples/sprint-08-parity-matrix.md`.
53
 1. Baseline non-interactive rows updated in `examples/sprint-08-parity-matrix.md`.
@@ -36,13 +55,14 @@ 
36
    - success and canceled prompt paths
55
    - success and canceled prompt paths
37
    - temp-list and temp-revoke-all with concrete temporary authorization ids
56
    - temp-list and temp-revoke-all with concrete temporary authorization ids
38
    - manual privileged polkit-restart recovery
57
    - manual privileged polkit-restart recovery
39
-3. Remaining rows are policy/path specific and still pending:
58
+3. Targeted deterministic coverage now includes:
40
    - explicit wrong-password failure path (`last_outcome: failure`)
59
    - explicit wrong-password failure path (`last_outcome: failure`)
41
-   - timeout path under live challenge (`last_outcome: timeout`)
60
+   - timeout path (`last_outcome: timeout`)
42
-   - multi-identity and retention-choice scenarios
43
    - temp-revoke single-id scenario
61
    - temp-revoke single-id scenario
62
+4. Remaining blocked rows are host policy dependent:
63
+   - multi-identity scenario (requires >1 eligible identity)
64
+   - retention-choice scenario (requires session/always retention options from policy details)
44
 
65
 
45
 ## Next Actions
66
 ## Next Actions
46
-1. Run one focused wrong-password parity capture (`failure` outcome) with debug logs.
67
+1. If full parity signoff is required on this host, provision a second eligible identity and an action that exposes retention session/always metadata.
47
-2. Run one focused timeout capture using short prompt timeout on `polkit` backend.
68
+2. Otherwise mark remaining blocked rows as environment-limited and proceed with GA checklist gate review.
48
-3. Add one targeted single-id revoke capture (`temp-revoke <authorization-id>`) and finalize matrix signoff.