max / alloy

Answer polkit in the console, in Akari, without tearing the screen down Tier 3 of wiki alloy-privilege. The console registers an authentication agent for its own process, polkit's question arrives as a modal naming the action, and the command runs on a thread beside the event loop so the TUI stays up. The PAM conversation is not ours and that is the point: it runs in polkit's setuid polkit-agent-helper-1, whose protocol is plain text on stdin and stdout. Alloy supplies the cookie, draws the prompt, and hands back what was typed. It decides nothing about whether an answer was right, so what ships is a drawing rather than an authentication surface. Two things the parsers get right because they were written to be attacked. The subject's start-time is read past the comm field rather than by counting whitespace, since comm is the basename of whatever was executed and can hold spaces and parentheses. And the identity asked for is the user's own before any other administrator: polkit offers every one of them, and asking for the first would teach a laptop owner to type the root password into whatever is on screen. Verified against the live polkit on fw13, not only in unit tests: the agent registers, pkcheck's question reaches it, the helper runs, its PAM prompt arrives as a Prompt, and dismissing it comes back as a refusal. Registration takes the object path as a plain string — polkit rejects the typed form, which nothing catches at compile time.