@@ -2,7 +2,7 @@ |
| 2 | 2 | |
| 3 | 3 | ## Scope |
| 4 | 4 | 1. Static ecosystem wiring checks against parent Gardesk repo. |
| 5 | | -2. Runtime challenge-flow checks remain covered by Sprint 02 live validation. |
| 5 | +2. Runtime challenge-flow probes for logind and NetworkManager policy actions. |
| 6 | 6 | |
| 7 | 7 | ## Command |
| 8 | 8 | 1. `./examples/validate-sprint-03-integration.sh ..` |
@@ -17,10 +17,22 @@ |
| 17 | 17 | 7. `gargears` includes `garcard` discovery socket mapping and panel component. |
| 18 | 18 | 8. Script exited successfully with all checks passing. |
| 19 | 19 | |
| 20 | | -## Remaining Manual Runtime Checks |
| 21 | | -1. Validate `gartray` power operation prompts in a full logged-in session with `garcard` enabled. |
| 22 | | -2. Validate a NetworkManager privileged operation triggers `garcard` prompt and recoverable retry/cancel behavior. |
| 20 | +## Runtime Probe Results |
| 21 | +1. Daemon run mode: |
| 22 | + - `RUST_LOG=garcard=debug GARCARD_AGENT_BACKEND=polkit cargo run -p garcard -- daemon` |
| 23 | +2. logind probe: |
| 24 | + - `pkcheck --allow-user-interaction --process $$ --action-id org.freedesktop.login1.manage` |
| 25 | + - Result: exit `1` (`Not authorized.`) with daemon callback logs: |
| 26 | + - `Started active polkit auth request action_id=org.freedesktop.login1.manage ...` |
| 27 | + - `Processing polkit auth request action_id=org.freedesktop.login1.manage ...` |
| 28 | +3. NetworkManager probes: |
| 29 | + - `pkcheck --allow-user-interaction --process $$ --action-id org.freedesktop.NetworkManager.settings.modify.system` |
| 30 | + - `pkcheck --allow-user-interaction --process $$ --action-id org.freedesktop.NetworkManager.settings.modify.global-dns` |
| 31 | + - Result: authorized (`polkit.result=yes`) in this host policy context; no challenge callback required. |
| 32 | +4. Policy inspection (`pkaction --verbose`) confirms host/session policy variance: |
| 33 | + - multiple NetworkManager actions resolve to active `yes` in this environment even when defaults are `auth_admin_keep`. |
| 23 | 34 | |
| 24 | 35 | ## Conclusion |
| 25 | 36 | 1. Sprint 03 static integration wiring is in place. |
| 26 | | -2. Remaining Sprint 03 runtime checks are clearly isolated for session-level manual execution. |
| 37 | +2. logind-side runtime challenge callback is verified with live daemon. |
| 38 | +3. NetworkManager challenge callback is policy-dependent on this host and should be re-run on a profile that enforces admin challenge for active users. |