MikeFaith/authforge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(plan): refresh post-Phase-11 — diagram, sequential-tail status, fanout lesson

Browse Source 
ASCII diagram now marks 9/10/11 as ✅ and Phase 13 as next-open.
'What's parallel-safe right now' section replaced with a brief
'all parallelism collected, sequential tail open' note. The deferred-
gates list updated to reflect that Phase 6 + Phase 12-backend pamtester
smoke tests 1-3 ran locally on 2026-04-27 (test 4 still deferred).
Lessons-learned gains a bullet on the prep-lane + 3-worktree fanout.
This commit is contained in:
michael
2026-04-27 13:06:51 -07:00
parent 789ff2b38e
commit 831fd0152c
1 changed files with 9 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs/plans/2026-04-26-authforge-implementation.md
View File

@@ -79,14 +79,13 @@ The phase numbering is a dependency-respecting ordering, **not** a serial schedu
↓ ↓ ↓ ↓
┌──────────────┬────────────┐ ┌──────────────┬────────────┐
│ │ │ │ │ │
Phase 9 + 12-GUI Phase 11 Phase 10 Phase 9 + 12-GUI ✅ Phase 11 ✅ Phase 10 ✅
policy + recovery TOTP first-login (needs 6 ✓ + 8 ✓) policy + recovery TOTP first-login modal
tabs (open) (open) (open)
│ │ │ │ │ │
└──────────────┴────────────┘ └──────────────┴────────────┘
↓ ↓
Phase 13 Phase 13 ← OPEN NEXT
deb finalization (needs every binary) deb finalization (every binary built)
↓ ↓
Phase 14 Phase 14
Launchpad PPA (VM smoke gate for "Code complete" phases) Launchpad PPA (VM smoke gate for "Code complete" phases)
@@ -101,19 +100,13 @@ The phase numbering is a dependency-respecting ordering, **not** a serial schedu
v1.0 release v1.0 release
``` ```
### What's parallel-safe right now (post-Phase 8 + Phase 12 backend) ### What's open right now (post-Phase 11 merge)
Three lanes are open and touch disjoint file trees: All parallelism wins have been collected — Phases 9, 10, 11, and the Phase 12 GUI tab merged on 2026-04-27 via the prep-lane + 3-worktree fanout described at [2026-04-27-parallel-fanout-9-10-11.md](2026-04-27-parallel-fanout-9-10-11.md). What remains is the sequential tail.
| Lane | Phases | Touches | Why parallel-safe | ### Sequential tail
|---|---|---|---|
| **GUI policy + recovery** | 9 + 12 GUI tab | `gui/src/{app_context,policy_form,policy_page,recovery_page}.rs` (new), additive bus.rs methods, ViewStack tabs in `main.rs` | Both views consume the typed D-Bus contract that landed with Phases 8 + 12 backend. AppContext refactor was foreseen by Phase 8's Task 7. Plan: [2026-04-27-phase-9-and-12-gui.md](2026-04-27-phase-9-and-12-gui.md). |
| **TOTP** | 11 | `daemon/src/totp/` (new), `gui/src/totp_page.rs` (new), `debian/control` Recommends | Feature-flagged at build time. Phase 8 ✓ unblocked the GUI tab; daemon-side TOTP module is brand-new. Step-level plan still to be written. |
| **First-login** | 10 | `gui/src/firstrun.rs` (new), `gui/data/authforge-firstrun.desktop`, `--first-run` CLI flag in `gui/src/main.rs` | Both Phase 6 ✓ (PAM pending blocker) and Phase 8 ✓ (GUI shell) are in. Step-level plan still to be written. |
### Sequential tail (no parallelism wins) Phase 13 (deb finalization) is now open — every binary it packages is built. Phase 14 (PPA) chains off 13 and is the **VM smoke gate** for the remaining "Code complete" deferrals: Phase 1 (5-deb output from `debuild`), Phase 3 (real Yubikey enrollment), Phase 4 (`pam-auth-update --package` against a real `/etc/pam.d/`), Phase 8 (GUI walkthrough w/ Yubikey), Phase 10 (Flow C autostart + watchdog), Phase 11 (`pam_google_authenticator` 6-digit verify with a real authenticator app). Phase 6 + Phase 12-backend's `pamtester` recipes (smoke tests 1–3 in `pam/TESTING.md`) were verified locally on 2026-04-27 once `libargon2-dev` + `pamtester` were installed; smoke test 4 (recovery-code path with the daemon running) remains for Phase 14. Phase 17 (integration tests) chains off 14 — also lands the `safe_user` canonicalize-then-verify hardening flagged in `pam/TESTING.md`. Phase 18 (user docs) and R (release) follow.
Phase 13 (deb finalization) needs every binary built — opens once Phases 9, 10, 11 land. Phase 14 (PPA) chains off 13 — and is the **VM smoke gate** for everything currently in "Code complete" status (1, 3, 4, 6, 8, 12 — six phases with deferred real-hardware/root-write/libargon2-dev gates). Phase 17 (integration tests) chains off 14. Phase 18 (user docs) and R (release) follow.
### Lessons learned from this session's parallelism ### Lessons learned from this session's parallelism
@@ -121,6 +114,7 @@ Phase 13 (deb finalization) needs every binary built — opens once Phases 9, 10
- **They don't work** when the harness sandbox blocks `desktop-file-validate` / `dpkg-checkbuilddeps` / `ansible-lint` — the Phase 15+16 agents both reported these as "skipped, hand-checked." Verification slips through to manual review of the diff. Acceptable for data/config phases; risky for code phases without strong test coverage. - **They don't work** when the harness sandbox blocks `desktop-file-validate` / `dpkg-checkbuilddeps` / `ansible-lint` — the Phase 15+16 agents both reported these as "skipped, hand-checked." Verification slips through to manual review of the diff. Acceptable for data/config phases; risky for code phases without strong test coverage.
- **Phase 4+5 had to land together** because both modify the SetPolicy code path; splitting them creates a window where SetPolicy applies without a lockout pre-check. - **Phase 4+5 had to land together** because both modify the SetPolicy code path; splitting them creates a window where SetPolicy applies without a lockout pre-check.
- **Worktrees share `target/` if and only if you don't isolate** via `CARGO_TARGET_DIR`. We didn't need to — each `git worktree add` produces its own working tree, so cargo target dirs are per-worktree by default. Concurrent cargo runs across worktrees would still race on the global `~/.cargo/registry` cargo lock, but in practice that's a brief synchronization, not a hang. - **Worktrees share `target/` if and only if you don't isolate** via `CARGO_TARGET_DIR`. We didn't need to — each `git worktree add` produces its own working tree, so cargo target dirs are per-worktree by default. Concurrent cargo runs across worktrees would still race on the global `~/.cargo/registry` cargo lock, but in practice that's a brief synchronization, not a hang.
- **Three-lane fanout (Phases 9 / 10 / 11) needed a prep lane first.** A naive "branch off main, dispatch three subagents" plan hit a hard wall — every lane wanted to edit `gui/src/main.rs`, two wanted `daemon/src/{dbus,state}.rs`. Splitting out a prep lane (`AppContext` refactor + `--first-run` flag scaffold + daemon `GetPendingStatus` method) and merging it first made the three follow-on lanes file-disjoint. Coordinator doc at [2026-04-27-parallel-fanout-9-10-11.md](2026-04-27-parallel-fanout-9-10-11.md). Wall-clock from prep merge to all three lanes merged: ~90 minutes including a doc-conflict resolution on the Phase 9-vs-Phase 10 closeout and an interrupt-and-resume cycle when one agent stalled mid-Task-7.
--- ---