Bundles plan tasks 1.8 (read methods), 1.9 (EnrollOwn/RemoveOwn with polkit
gate), 1.10 (EnrollOther, SetPolicy, pending, recovery-code), and 1.11
(main.rs system-bus registration) — they land together because Polkit::System
is only constructed by main.rs, so splitting them mid-implementation would
require dead_code allows that immediately reverse.
Adds:
- daemon/src/dbus.rs — AuthForge struct + #[zbus::interface] impl with all 9
methods. Reads (ListCredentials, GetPolicy) are unauthenticated; writes call
authz() which dispatches to polkit. Includes 9 integration tests via a
tokio::net::UnixStream::pair p2p connection — no system bus needed for tests.
- daemon/src/main.rs — connects to system bus, picks Polkit::system or
Polkit::permissive based on AUTHFORGE_POLKIT_BYPASS env var, registers the
AuthForge interface at /io/dangerousthings/AuthForge, requests well-known
name io.dangerousthings.AuthForge, then parks forever.
- daemon/src/polkit.rs — drop dead_code allows now that System is wired.
- daemon/src/state.rs — gate has_pending() behind cfg(test); production reads
go through the on-disk file in later phases, not this in-memory cache.
- common/src/types.rs (formatting only via rustfmt).
Tests: 14/14 daemon tests pass (4 state, 1 polkit, 9 dbus). 7/7 common tests
pass. cargo clippy --workspace --all-targets -D warnings clean. cargo fmt
clean.
