[jaspermayone]

Summary

ad/converge.ps1 needs the Windows ActiveDirectory module. Before this change, a person ran it by hand on a DC. This PR adds the opt-in tag converge to ansible/ad.yml, so the control node can run phase Build on loom over WinRM as svc-ansible.

flowchart LR
  cn["control node"] -- "git status -- ad (apply only)" --> cn
  cn -- "WinRM, svc-ansible" --> dir["loom: C:\ProgramData\Patchwork\ad-converge\src<br/>SYSTEM + Administrators only"]
  dir --> run["converge.ps1 -Phase Build -Server loom<br/>-WhatIf unless ad_converge_apply"]
  run --> rep["Report: commit, WOULD / CHANGE / REPORT / ERROR / END, stderr"]
  rep --> chk["fail if exit code is not 0"]

Loading

cd ansible
ansible-playbook ad.yml -t converge                              # -WhatIf
ansible-playbook ad.yml -t converge -e ad_converge_apply=true    # Build

• A run is -WhatIf unless -e ad_converge_apply=true.
• An apply refuses uncommitted changes under ad/.
• The play sets an explicit ACL on the script directory (SYSTEM and Administrators only, no inheritance) and deletes the copies of the last run before it copies the files again.
• The script runs against loom with -Server, so a moved PDC role cannot cause a double-hop failure.
• -DataFile is passed explicitly: under powershell.exe -File on loom, $PSScriptRoot was empty in the parameter default.
• The Report task runs before the play fails, so the ERROR lines are visible.
• Migrate and Prune stay manual. --check is not supported.
• Docs: ansible/README.md, ad/README.md, and a line in ad/TIERING.md (a Build run is now an Ansible run, and it must be tested again after the Kerberos switch).

Checks

• ansible-playbook --syntax-check ad.yml, yamllint ., ansible-lint and python3 -m unittest discover -s tests pass.
• Live on loom, from this branch:
  • -WhatIf showed only the twill and hank groups and memberships from org.json.
  • The apply made 12 changes with 0 errors: twill-admins and hank-admins, mayonej in both, and infra and the two groups in lnx-twill-* and lnx-hank-*.
  • A second -WhatIf had 0 changes.
  • After the review fixes: a -WhatIf run passed, an apply with an uncommitted ad/ file stopped at the first task, and the directory ACL on loom is O:BAG:SYD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA), with the files inheriting only those two ACEs.
• An adversarial review found no high-severity issue. The second commit fixes its findings: the open ACL on the script directory, applies from a dirty tree, the PDC assumption, the Report task not running on failure, --check, the header tag list, and the TIERING note.
• Not fixed here: nix fmt -- --ci wants to reformat tests/ad-org.nix. That drift is already on main, and this PR does not touch the file.