Merge F44 (PR #35 merged) into plan-00086 branch — combine both fixes for live re-proof

Author: LTSCommerce

CLAUDE/Plan/Completed/00085-headless-path-local-bin/JOURNAL/00085-Journal-26-08-24.md

@@ -0,0 +1,78 @@
+# Plan 00085 — Journal 26-08-24
+
+> **Append-only activity log** for plan 00085. One file per day
+> (`00085-Journal-YY-MM-DD.md`). `PLAN.md` tracks the plan (what/why,
+> current state, tasks); this journal tracks what actually *happened* —
+> findings, decisions, dead-ends, hand-off state — the linear lifecycle a plan
+> document structurally cannot carry.
+>
+> **Entry grammar** — append new entries at the BOTTOM; NEVER edit earlier
+> entries (corrections are new entries):
+>
+> ```
+> ## HH:MM · category · REF   — optional short title
+> ```
+>
+> - `HH:MM` local 24h (the date is in the filename); times increase down the file.
+> - `category` ∈ `action` | `finding` | `decision` | `thought` | `blocker` | `handoff`
+> - `REF` = optional task/phase ref (`T1.2`, `P1`) or `—`.
+> - Bodies may embed fenced logs/diffs/snippets — no size limit — with a
+>   one-line takeaway above the fence.
+> - End a working session with a `handoff` entry so the next agent's entry
+>   point is the last entry of the newest day-file.
+
+## 15:33 · action · — — plan scaffolded
+
+Plan 00085 created via `mkplan.bash`; `JOURNAL/` initialised. Next:
+fill in `PLAN.md`, then log progress here as it happens.
+
+## 15:50 · finding · T1.1 — root cause confirmed, both PR #33/#34 mechanisms proved live
+
+A downstream deployment repo's live proof of `RUN_BASH_GITHUB_ACCOUNTS=none` against a real
+guest (via Ansible `become`/`become_user`, not an interactive shell) reached
+`headless_preflight OK — sudo=password (RUN_BASH_SUDO_PASSWORD_FILE)`, the HTTPS self-clone,
+and the correctly-skipped GitHub setup steps — proving PR #33 and PR #34 both work end-to-end
+in composition — then failed at `ansible-galaxy: command not found`, even though the preceding
+pipx step's own output listed `ansible-galaxy` among "these apps are now available".
+
+Confirmed root cause: `pipx install --include-deps ansible` creates its app shims under
+`~/.local/bin`, but this script never adds that directory to its own `PATH`. An interactive
+terminal already has it (Fedora's `.bash_profile` adds it at login), so the desktop-interactive
+path was never affected. `sudo -u <user>` (what both headless mode and any Ansible `become` task
+use) resets `PATH` to sudoers' `secure_path`, which never includes `~/.local/bin` — so the
+bare `ansible-galaxy install -r requirements.yml` call, and `./playbooks/playbook-main.yml`
+right after it (shebang `#!/usr/bin/env ansible-playbook`, same PATH lookup), cannot resolve.
+Confirmed the shebang directly (`head -1 playbooks/playbook-main.yml`) so the fix covers both
+call sites, not just the one that happened to fail first.
+
+Fix: `export PATH="$HOME/.local/bin:$PATH"` (guarded against a caller that already has it)
+right after the pipx install/inject block. `bash -n`/`shellcheck -x` clean. Version bumped to
+1.14.0.
+
+## 16:00 · handoff · — — PR opened
+
+Committed and pushed on `plan-00085-headless-path-local-bin`; PR opened against `F44`.
+
+## 16:12 · action · T1.5 — merged, plan complete
+
+Dispatched an independent review agent (`qa-reviewer` stand-in) over PR #35's full diff;
+verdict MERGE-READY WITH NITS, nits addressed (README index row, Task 1.3/1.4 ticked) in
+commit `300269c`.
+
+Then re-proved the fix live, pinned at the branch tip `8fd8725` (lts-infra Plan 00045's
+`verify-github-accounts-none.yml`, prove-before-merge on an unmerged commit — `get_url`
+resolves any sha regardless of branch state). The run got past `ansible-galaxy` and through
+`playbook-main.yml`'s Preflight Sanity and DNF Upgrade plays cleanly — proving both the PATH
+fix AND the underlying PR #33/#34 composition all work together — before hitting an
+unrelated, pre-existing defect in `play-AB-dnf-upgrade.yml`'s kernel-modules enumeration
+(filed as Plan 00086, PR #36). Success criteria met: the failure that remained was not a
+PATH failure.
+
+Checked PR #35's CI: `gitleaks secret scan` was failing, but confirmed via
+`git diff origin/F44...plan-00085-headless-path-local-bin --stat` that the flagged file
+(`CLAUDE/Plan/Completed/00070-.../research/scan-alt-engines.md`) is untouched by this PR, and
+via `gh run list --branch F44` that F44's own tip already fails the same way — a pre-existing
+false positive unrelated to this change, not a merge blocker.
+
+Merged PR #35 (`gh pr merge 35 --merge --delete-branch`, merge commit `dac4f7c`). Plan
+status flipped to Complete and archived to `Completed/`.

CLAUDE/Plan/Completed/00085-headless-path-local-bin/PLAN.md

@@ -0,0 +1,74 @@
+# Plan 00085: headless path ~/.local/bin PATH gap
+
+**Status**: Complete
+**Created**: 2026-08-24
+**Owner**: joseph
+**Priority**: High
+
+## Overview
+
+A downstream deployment repo's live proof of the headless `RUN_BASH_GITHUB_ACCOUNTS=none`
+path (run via Ansible `become`/`become_user`, not an interactive login shell) found that
+`run.bash` fails partway through provisioning with `ansible-galaxy: command not found`,
+even though the preceding pipx install step reported `ansible-galaxy` as one of the apps
+it made available.
+
+Root cause: `pipx install --include-deps ansible` creates its app shims under
+`~/.local/bin`, but `run.bash` never adds that directory to `PATH` within its own process.
+An interactive terminal session already has `~/.local/bin` on `PATH` (Fedora's default
+`.bash_profile`/`.bashrc` add it at login), so the desktop-interactive path has always
+worked and this was never seen there. A non-interactive invocation via `sudo -u <user>`
+(what both this repo's headless mode and any Ansible `become`-based caller use) resets
+`PATH` to sudoers' `secure_path`, which never includes `~/.local/bin` — so the later bare
+`ansible-galaxy install -r requirements.yml` call, and the `./playbooks/playbook-main.yml`
+invocation right after it (shebang `#!/usr/bin/env ansible-playbook`), cannot resolve.
+
+This is a pre-existing gap, unrelated to the RUN_BASH_GITHUB_ACCOUNTS=none (PR #33) or
+RUN_BASH_SUDO_PASSWORD_FILE (PR #34) mechanisms — the run log confirms both of those
+worked correctly (`sudo=password (RUN_BASH_SUDO_PASSWORD_FILE)` authenticated; the HTTPS
+self-clone succeeded; GitHub setup was correctly skipped) before hitting this third,
+independent blocker at the first bare `ansible-galaxy` call.
+
+## Goals
+
+- Make `run.bash` headless provisioning succeed regardless of the caller's PATH/shell
+  context (login shell, non-login shell, `sudo -u`, SSH `command`), by having the script
+  put `~/.local/bin` on its own `PATH` once pipx-installed tools are available.
+
+## Non-Goals
+
+- Not changing the interactive path's behaviour (already works).
+- Not working around this in the downstream repo's Ansible invocation (e.g. passing
+  `environment: PATH=...`) — the fix belongs in `run.bash` itself so every caller
+  benefits, not just this one call site.
+
+## Tasks
+
+### Phase 1: fix
+
+- [x] ✅ **Task 1.1**: add `export PATH="$HOME/.local/bin:$PATH"` to `run.bash`
+  immediately after the pipx-based ansible install block, before any later bare
+  `ansible-galaxy`/`ansible-playbook`/`ansible` invocation.
+- [x] ✅ **Task 1.2**: `bash -n` + `shellcheck -x` clean; bump `RUN_BASH_VERSION`.
+- [x] ✅ **Task 1.3**: commit, push on a branch, open PR against `F44` (PR #35).
+- [x] ✅ **Task 1.4**: independent review (qa-reviewer stand-in) — verdict MERGE-READY
+  WITH NITS; nits addressed (README index row added, Task 1.3 ticked).
+- [x] ✅ **Task 1.5**: merge (merge commit `dac4f7c`).
+
+## Success Criteria
+
+- [x] A downstream live proof re-run (via `sudo -u`/Ansible `become`, the exact context
+  that found this) got past the `ansible-galaxy install -r requirements.yml` step and
+  the subsequent `playbook-main.yml` invocation without a PATH-related failure — proven
+  live before merge (pinned at the branch tip `8fd8725`): pipx-installed `ansible-galaxy`
+  resolved, `playbook-main.yml`'s Preflight Sanity and DNF Upgrade plays both completed.
+  The run then hit an unrelated, pre-existing defect (Plan 00086) in
+  `play-AB-dnf-upgrade.yml`'s kernel-modules enumeration — not a PATH failure.
+
+## Delivery & Milestones
+
+<!-- Curated milestones + delivery commit hashes only (git is the SSoT for
+     "when" — do not add dates). The blow-by-blow activity log lives in
+     JOURNAL/00085-Journal-YY-MM-DD.md — see CLAUDE/PlanJournalling.md. -->
+
+- Recovery cron: 28837729 (shared session-wide failsafe, already running).

CLAUDE/Plan/README.md

@@ -136,6 +136,8 @@ Use these Unicode icons in plan documents:
 
 ## Completed Plans
 
+- [00085-headless-path-local-bin](Completed/00085-headless-path-local-bin/) - A downstream live proof of the composed PR #33/#34 headless mechanisms found a third, unrelated blocker: `ansible-galaxy: command not found` under a non-interactive `sudo -u` invocation, since pipx's `~/.local/bin` shims are never put on PATH there. Exports PATH right after the pipx install block. Merged (`dac4f7c`).
+
 - [00084-port-sudo-password-file-onto-f44](Completed/00084-port-sudo-password-file-onto-f44/) - Ports Plan 00073's `RUN_BASH_SUDO_PASSWORD_FILE` (stranded on an unmerged, diverged branch) onto `F44` so it composes with Plan 00082's `GITHUB_ACCOUNTS=none` — no single commit previously carried both. Merged (`d48fabd`). Also fixed two real VM hostnames from the downstream consumer estate that had been committed into this public repo's tracked content.
 
 - [00083-plan-index-hygiene-and-comment-handlers](Completed/00083-plan-index-hygiene-and-comment-handlers/) - Enables the three handlers the 3.54.0 daemon upgrade shipped disabled (`comment_changelog`, `comment_size`, `sensitive_content`), each after measuring its existing backlog rather than assuming it, and clears the 39 over-length rows the new `index-row-length` check found in this index.