`6adfbf7`

Update sprint 08 interactive parity evidence

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 6adfbf7bc29d4c185885ad09e645132004711be4
Parents: b5da957
Tree: a3def66

2 changed files

Status	File	+	-
M	`examples/sprint-08-parity-matrix.md`	8	7
M	`examples/sprint-08-validation-report-2026-02-26.md`	18	8

examples/sprint-08-parity-matrix.mdmodified

  ## Matrix
  | Scenario | Procedure | Expected Result | Status | Evidence |
  | --- | --- | --- | --- | --- |
 -| Success path | Trigger `pkcheck --allow-user-interaction --process $$ --action-id com.mesonbuild.install.run` and enter correct password | Prompt completes, auth is authorized, no failure flash | Pending | daemon log + `garcardctl auth-summary` |
 +| Success path | Trigger `pkcheck --allow-user-interaction --process $$ --action-id com.mesonbuild.install.run` and enter correct password | Prompt completes, auth is authorized, no failure flash | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 1/2`, `last_outcome: success`) |
  | Failure path | Trigger same `pkcheck` and enter wrong password | Prompt flashes error, reprompts in place, `auth-summary.last_outcome=failure` before retry | Pending | daemon log + `garcardctl auth-summary` |
 -| Cancel path | Trigger `pkcheck`, cancel prompt | Request exits cleanly, `auth-summary.last_outcome=canceled` | Pending | daemon log + `garcardctl auth-summary` |
 +| Cancel path | Trigger `pkcheck`, cancel prompt | Request exits cleanly, `auth-summary.last_outcome=canceled` | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`cycle 3`, `last_outcome: canceled`) |
  | Timeout path | Set short timeout (`GARCARD_PROMPT_TIMEOUT_SECS=2`), trigger auth, do not respond | Request times out, `auth-summary.last_outcome=timeout` | Pending | daemon log + `garcardctl auth-summary` |
  | Multi-identity flow | Trigger policy requiring identity choice | Identity list rendered, selected identity is honored | Pending | prompt capture + daemon log |
  | Retention choice flow | Trigger policy exposing retention options | Retention choice accepted and recorded in `auth-summary` | Pending | `garcardctl auth-summary` |
 -| Temp auth introspection | Run `garcardctl temp-list` after successful retained auth | Active temporary authorization entries are listed | PASS (baseline) | `target/sprint-08-parity-evidence.md` (`authorizations: []` in non-interactive baseline) |
 +| Temp auth introspection | Run `garcardctl temp-list` after successful retained auth | Active temporary authorization entries are listed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`tmpauthz0/tmpauthz1` listed) |
  | Temp auth revoke single | Run `garcardctl temp-revoke <id>` | Target authorization removed | Pending interactive retained auth | `temp-list` before/after |
 -| Temp auth revoke all | Run `garcardctl temp-revoke-all` | All temporary authorizations removed | PASS (baseline) | `target/sprint-08-parity-evidence.md` (`revoked_count: 0` baseline) |
 +| Temp auth revoke all | Run `garcardctl temp-revoke-all` | All temporary authorizations removed | PASS (interactive) | `target/sprint-08-parity-evidence.md` (`revoked_count: 1` after cycle 1/2) |
  | Daemon restart during lifecycle | Restart daemon and rerun status/diag/temp commands | Control plane recovers without stale socket state | PASS (baseline) | `target/sprint-08-parity-evidence.md` (`validate-sprint-07.sh` section) |
 -| Polkit restart recovery | Restart polkit and relaunch daemon | Diagnostics recover, control commands remain responsive | Pending | script output + daemon log |
 +| Polkit restart recovery | Restart polkit and relaunch daemon | Diagnostics recover, control commands remain responsive | PASS (manual) | 2026-02-26 manual `sudo systemctl restart polkit` + post-check `validate-sprint-07.sh` (`polkit` backend healthy) |
  ## Signoff
 . Date: 2026-02-26 (baseline run)
 . Operator: mfwolffe/codex
 . Result (`PASS`/`FAIL`): IN PROGRESS
 . Blocking gaps:
 -   - interactive `pkcheck` matrix rows (success/failure/cancel/timeout)
 +   - failure-path parity (`last_outcome: failure`) on explicit wrong-password flow
 +   - timeout-path parity (`last_outcome: timeout`) under interactive challenge
     - multi-identity and retention-choice scenarios on policies that expose those options
 -   - polkit restart recovery check with privileged restart command
 +   - temp-revoke single-id scenario

examples/sprint-08-validation-report-2026-02-26.mdmodified

     - previous `InvalidArgs` (`(sa{sv})` vs `((sa{sv}))`) no longer appears
     - `temp-list` and `temp-revoke-all` return clean baseline results
 . Workspace tests pass after lifecycle-call marshaling fix.
 +5. Interactive parity loop executed via `GARCARD_SPRINT08_RUN_INTERACTIVE=1 ./examples/validate-sprint-08-parity.sh`:
 +   - successful auth path observed (`last_outcome: success`)
 +   - canceled auth path observed (`last_outcome: canceled`)
 +   - temporary authorizations created and revoked in-loop (`revoked_count: 1`)
 +6. Privileged polkit-restart recovery executed manually on 2026-02-26:
 +   - operator ran `sudo systemctl restart polkit`
 +   - post-restart lifecycle verification on `polkit` backend passed (`validate-sprint-07.sh`)
  ## Matrix Status
 . Baseline non-interactive rows updated in `examples/sprint-08-parity-matrix.md`.
 -2. Remaining rows are interactive/policy-dependent and still pending:
 -   - success/failure/cancel/timeout prompt-path parity via `pkcheck`
 +2. Interactive/passive coverage now includes:
 +   - success and canceled prompt paths
 +   - temp-list and temp-revoke-all with concrete temporary authorization ids
 +   - manual privileged polkit-restart recovery
 +3. Remaining rows are policy/path specific and still pending:
 +   - explicit wrong-password failure path (`last_outcome: failure`)
 +   - timeout path under live challenge (`last_outcome: timeout`)
     - multi-identity and retention-choice scenarios
 -   - privileged polkit restart recovery path
 +   - temp-revoke single-id scenario
  ## Next Actions
 -1. Run interactive parity pass:
 -   - `GARCARD_SPRINT08_RUN_INTERACTIVE=1 ./examples/validate-sprint-08-parity.sh`
 -2. Execute privileged recovery check:
 -   - `GARCARD_SPRINT07_POLKIT_RESTART_CMD='sudo systemctl restart polkit' ./examples/validate-sprint-07.sh`
 -3. Mark remaining matrix rows PASS/FAIL with log pointers.
 +1. Run one focused wrong-password parity capture (`failure` outcome) with debug logs.
 +2. Run one focused timeout capture using short prompt timeout on `polkit` backend.
 +3. Add one targeted single-id revoke capture (`temp-revoke <authorization-id>`) and finalize matrix signoff.