docs: phase 13 closeout notes

docs/plans/2026-04-26-authforge-implementation.md

@@ -40,7 +40,7 @@
 | 10 | First-login flow: autostart entry + fullscreen modal | 4 days | ✅ **Code complete** (2026-04-27) — VM smoke deferred |
 | 11 | TOTP support (PAM module + GUI tab) — feature flag | 5 days | ✅ **Code complete** (2026-04-27) — `pam_google_authenticator` smoke deferred |
 | 12 | Recovery flow (codes + emergency unlock) | 4 days | ✅ **Code complete** (2026-04-27) — backend + PAM + GUI tab all landed |
-| 13 | Debian packaging finalization (postinst, debconf, purge) | 4 days | **Spec'd** — sequential tail; needs all binaries built |
+| 13 | Debian packaging finalization (postinst, debconf, purge) | 4 days | ✅ **Code complete** (2026-04-27) — `piuparts` smoke deferred to Phase 14 |
 | 14 | Launchpad PPA build setup | 2 days | **Spec'd** — sequential tail after 13; **VM smoke gate for all "Code complete" phases** |
 | 15 | `authforge-gnome-integration` (Users panel shortcut) | 3 days | ✅ **Done** (2026-04-27) — parallel subagent (gnome lane) |
 | 16 | Ansible role `dangerousthings.authforge` | 2 days | ✅ **Done** (2026-04-27) — parallel subagent (ansible lane) |
@@ -335,6 +335,34 @@ Landed via [2026-04-27-phase-11-totp.md](2026-04-27-phase-11-totp.md). Built ato
 - `authforgectl totp enroll alice` → scan QR with Aegis → `sudo whoami` prompts for the 6-digit code → success.
 - Verify the rendered profile loads in `pam-auth-update --package` without rejection on a clean Ubuntu VM.
 
+### Phase 13 closeout notes (2026-04-27)
+
+Landed via [2026-04-27-phase-13-deb-packaging.md](2026-04-27-phase-13-deb-packaging.md). 10 commits on `main` (no worktree — all changes are in `debian/` and don't touch the workspace's Rust crates).
+
+**Done:**
+- `debian/authforge.pam-config` — baseline `pam-auth-update` profile, `Default: no`, pending-flag-only. Daemon's `policy_apply::render_profile` overwrites this file at runtime once a real policy is set.
+- `debian/authforge-pam.{postinst,prerm}` — registers via `pam-auth-update --package` on `configure`; deregisters via `--remove authforge` on `remove`/`deconfigure`. Idempotent. Use `command -v pam-auth-update` (not hard-coded `/usr/sbin/`) to satisfy lintian.
+- `debian/authforge-daemon.postrm` — purges `/etc/authforge/` + `/var/lib/authforge/` on `purge`; preserves them on plain `remove` (Debian Policy §6.6).
+- `debian/authforge.{templates,config}` — debconf prompt: `None` / `Optional everywhere` / `Required for sudo`. Default `None`. `Pre-Depends: debconf (>= 0.5) | debconf-2.0` added to the metapackage.
+- `debian/authforge.postinst` — reads the debconf answer; writes `/etc/authforge/policy.d/00-debconf.conf` exactly once on first install (`[ -z "$2" ]`). Schema cross-checked against `daemon/src/storage/policy.rs` test fixture (`[stacks.<name>]` + `mode` + `methods`).
+- Per-binary `lintian-overrides` (six files) — zero W/E from `lintian` on the built debs. Real fixes folded in: `policykit-1` → `polkitd | policykit-1` (obsolete-package error); dropped manual `/lib/systemd/system/` install line so `dh_installsystemd` owns the unit at `/usr/lib/systemd/system/` (file-in-root-and-usr error). Overrides cover deferred-manpage (Phase 18), cross-package `desktop-command-not-in-package` (gnome-integration → authforge-gui), and `initial-upload-closes-no-bugs` (PPA-only, no ITP).
+- `debian/PIUPARTS.md` — manual smoke recipe for Ubuntu 24.04. Install → reinstall → remove → purge cycle documented; `piuparts` run is the Phase 14 gate.
+- `debian/changelog` — bumped `(0.1.0-1) UNRELEASED; urgency=low` → `(0.1.0-1) noble; urgency=medium` ready for Phase 14 dput.
+- `.gitignore` — added `debian/*.debhelper` so build-time hook snippets don't pollute `git status`.
+
+**Plan deviations:**
+- `dpkg-buildpackage` invoked with `-d` throughout (cargo + rustc are installed via rustup, not apt, so the apt-level Build-Depends check fails even though the build itself works). The Build-Depends in `debian/control` are correct for the Phase 14 PPA / Launchpad sbuild — only the local dev-env check needs the override.
+- Lintian sweep folded three real fixes into the same commit as the overrides rather than splitting per the plan's literal "fix any real warnings" suffix — the fixes are all packaging-control changes (control file, rules file, hook scripts) and live in the same diff window. Single atomic commit reads cleaner than three.
+- Added a `# shellcheck source=/dev/null` directive to `authforge.config` and `authforge.postinst` for the `/usr/share/debconf/confmodule` source line — shellcheck SC1091 is info-level and was returning exit 1 under the local config; the directive is the standard idiom for sourced runtime files.
+
+**Test count delta:** 0. Phase 13 ships no Rust code. `cargo test --workspace` still reports 112 passed (cli 9 + common 8 + daemon 78 + gui 10 + pam 0 + zero failures). `cargo fmt --all -- --check` clean.
+
+**Deferred until Phase 14 PPA + VM smoke:**
+- `piuparts` actually run on a clean Ubuntu 24.04 chroot.
+- `pam-auth-update --package` actually mutating `/etc/pam.d/common-*` on a real system.
+- The "Required for sudo" debconf branch tested end-to-end (sudo prompts for FIDO2 + password).
+- `dpkg-buildpackage -us -uc -b` producing five debs that install on a fresh VM (build verified locally; install path is the Phase 14 gate).
+
 ---
 
 # Phase 0: Repository Scaffolding (FULLY DETAILED)