Prepare the D&D host deployment sprint

docs/roadmap/features/0016-deploy-dnd-pipeline-to-pipeline-dnd.md

@@ -1,6 +1,6 @@
 # Feature 0016: Deploy the D&D Pipeline to `pipeline-dnd`
 
-Status: proposed
+Status: ready
 
 ## Summary
 
@@ -10,10 +10,10 @@ host through `host_vars`, enroll `eric` as the initial human operator, keep
 credential values in Ansible Vault, and prove the complete pipeline through a
 real repeatable deployment and representative D&D session.
 
-[Feature 0015](0015-dnd-s3-storage-and-publishing.md) must first provide the
-storage and publishing behavior needed for an operational end-to-end pipeline.
-Feature 0016 consumes that reviewed interface; it does not invent a temporary
-storage contract.
+[Feature 0015](0015-dnd-s3-storage-and-publishing.md) has implemented and passed
+independent review of the storage and publishing behavior needed for an
+operational end-to-end pipeline. Feature 0016 consumes that reviewed interface
+and its suite defaults.
 
 ## Problem or Opportunity
 
@@ -43,10 +43,11 @@ synthetic scenario.
 - Map the role's `dnd_pipeline_secrets` interface to host-specific Vault
   variables. Store credential values only in an Ansible Vault-encrypted host
   variables file.
-- Carry the storage and publishing settings selected by Feature 0015 through
-  its final public pipeline interface. Preserve the operational intent of the
-  existing Backblaze B2 endpoint, bucket, prefix, region, and path-style
-  settings where they remain applicable.
+- Inherit Feature 0015's storage and publishing defaults, which already match
+  the intended Backblaze B2 deployment. Host inventory contains only actual
+  host choices and deliberate overrides, without copying suite defaults.
+- Preserve the existing default campaign choice, `dilfs`, through the
+  standalone role's `narratio_campaigns_default_campaign_id` variable.
 - Reconcile existing legacy Narratio host variables so they cannot silently
   override the suite policy selected by the new pipeline role.
 - Update `rakestraw-ansible/requirements.yml` so a clean controller can install
@@ -93,9 +94,9 @@ consumer playbook equivalent to:
 ```
 
 The existing inventory selects the host's connection identity. A dedicated
-host-variable file selects the pipeline's non-secret public inputs, including
-the WhisperX endpoint, the initial operator list, and the storage and
-publishing values exposed by Feature 0015. It maps runtime credential names to
+host-variable file selects the WhisperX endpoint, the initial operator list,
+and the default campaign. Storage, caching, publication, and cleanup inherit
+the reviewed suite defaults. The file maps runtime credential names to
 Vault-backed variables without embedding credential values in the playbook or
 ordinary plaintext inventory, for example:
 
@@ -106,6 +107,8 @@ dnd_pipeline_operator_users:
 dnd_pipeline_whisperx_transcribe_url: >-
   https://transcription.ai.rakestrawhome.com/transcribe
 
+narratio_campaigns_default_campaign_id: dilfs
+
 dnd_pipeline_secrets:
   AUDITA_LLM_API_KEY: "{{ vault_dnd_audita_llm_api_key }}"
   OPENROUTER_API_KEY: "{{ vault_dnd_openrouter_api_key }}"
@@ -117,11 +120,19 @@ The corresponding credential variables reside in a tracked file encrypted in
 full with Ansible Vault. The Vault password or identity mechanism remains
 outside Git and outside this feature's managed content.
 
-The controller dependency manifest selects one reviewed, publicly reachable
-suite snapshot containing Features 0014 and 0015. It also installs that
-snapshot's exact standalone role and native collection dependencies. A clean
-controller therefore does not depend on sibling development checkouts or
-previously installed roles.
+The controller dependency manifest selects public collection commit
+`46913446765e86ecfb29ebad9955d579ef6a4c7e`, containing the reviewed Features
+0014 and 0015 and pipeline commit
+`51566afcf69083cdbb5b5718f2544c86b079001c`. Its compatibility manifest selects
+the five standalone roles at `v0.1.0`, `ansible.posix` at `2.2.0`, and
+`community.general` at `13.3.0`. A clean controller therefore does not depend
+on sibling development checkouts or previously installed roles.
+
+The published collection `v0.1.0` predates these features. The selected
+development snapshot still declares collection version `0.1.0`, so the
+deployment instructions explicitly refresh an already-installed collection
+from the pinned commit instead of allowing an equal-version installation to
+be skipped. Unrelated controller dependencies remain preserved.
 
 On `pipeline-dnd`, the role converges the full application suite and its D&D
 configuration. The `narratio` service identity can run the pipeline, and
@@ -148,9 +159,9 @@ immediate identical Ansible run reports no changes.
 
 ## Constraints and Settled Decisions
 
-- Feature 0015 is a prerequisite and must settle, implement, and review the
-  storage and publishing interface before Feature 0016 becomes ready for an
-  implementation sprint.
+- Feature 0015's implementation and independent review satisfy the storage
+  and publishing prerequisite. Its workspace completion record should be
+  closed out before the Feature 0016 sprint.
 - The target is the inventory alias `pipeline-dnd` as currently defined in
   `rakestraw-ansible`, not a new `pipeline.dnd` alias.
 - The playbook follows the repository's established style: hosts and roles
@@ -161,33 +172,63 @@ immediate identical Ansible run reports no changes.
 - API credentials use the existing typed `dnd_pipeline_secrets` interface and
   Ansible Vault. Plaintext secret values must not enter Git, command lines,
   logs, examples, or ordinary variable files.
-- The public Gitea repositories are the sole dependency sources. The
-  deployment must not reference this workspace's sibling checkout paths.
-- The dependency manifest must select an immutable release when Feature 0015
-  produces one. Otherwise, it must pin the exact reviewed public Git commit;
-  it must not track an unbounded branch for the production deployment.
+- Public Gitea repositories supply the suite's Git dependencies; native
+  collections come from Ansible Galaxy. The deployment must not reference
+  this workspace's sibling checkout paths.
+- The collection is pinned to the reviewed public commit identified above.
+  Feature 0015 did not create a release; this deployment does not track an
+  unbounded branch or require a new coordinated release.
 - The collection artifact does not itself install arbitrary Git-hosted role
   dependencies. The operational manifest must therefore include the five
   standalone roles as well as the collection and its native collection
   dependencies.
-- The legacy host variables must be compared with the final Feature 0015
-  interface. Applicable values move to the new suite configuration, while
-  obsolete or conflicting variables are removed rather than left to win by
-  inventory precedence.
+- Remove the legacy `narratio_s3_*` host variables because their intended
+  values are supplied by the suite defaults. Replace
+  `narratio_default_campaign_id` with
+  `narratio_campaigns_default_campaign_id: dilfs`. The standalone role already
+  exposes this host-specific setting; no new pipeline variable is required.
 - The initial real-host run is an operational acceptance exercise. It should
   test observable pipeline behavior and convergence, not module task traces or
   the current text of defaults.
 
+## Operational Prerequisites
+
+Before implementation, establish the concrete deployment context and record
+the non-secret choices in the implementation plan or deployment runbook:
+
+- Identify the operational Ansible controller and its deployment checkout.
+  The repository configuration currently selects `/etc/ansible/inventory`,
+  `/etc/ansible/roles`, and `/etc/ansible/collections`. Confirm the effective
+  paths so dependency installation and playbook execution use the same
+  inventory and installed content. Distinguish those paths from this
+  development workspace.
+- Confirm that `pipeline-dnd` runs the supported Ubuntu 26.04 environment and
+  that its existing `eric` account provides SSH access and the sudo access
+  required by the roles.
+- Establish the controller's existing Vault password or identity mechanism
+  and operator availability to populate the four credential values in the
+  encrypted host file. Record how Vault is selected, never its password or
+  decrypted contents.
+- Have the operator select the acceptance campaign, session identity, and
+  audio input, with the corresponding session file and accessible input
+  location. This is a real processing and publication exercise using the
+  selected providers; session selection remains an operator decision.
+
+These are deployment inputs and operational checks, not additional production
+tasks or a new automated preflight framework.
+
 ## Simplest Viable Implementation
 
-After Feature 0015 is reviewed, select its exact public collection revision
-and use the associated compatibility manifest to update the controller's
-single root requirements file. Add the minimal playbook and one ordinary
-host-variable file for public inputs. Add one fully encrypted host Vault file
-for the two credential values, populated by the operator without exposing its
-plaintext during implementation or review.
+Use the reviewed collection revision and associated compatibility manifest to
+update the controller's single root requirements file. Add the minimal playbook and one ordinary
+host-variable file for the endpoint, operator, campaign, and credential
+references, inheriting the suite's storage and publication defaults. Add one
+fully encrypted host Vault file for the four credential values, populated by
+the operator without exposing its plaintext during implementation or review.
 
-Install or update dependencies from the root manifest, confirm that Ansible
+Install or update dependencies from the root manifest at the confirmed
+controller paths, explicitly refreshing the collection from its pinned commit
+even when `0.1.0` is already installed. Confirm that Ansible
 resolves `rakestraw.dnd.pipeline`, syntax-check the playbook, and converge only
 `pipeline-dnd`. Start a fresh operator login after enrollment, validate the
 native Narratio configuration under the intended runtime identity, rerun the
@@ -213,11 +254,10 @@ would make a later controller bootstrap select an unreviewed compatibility
 set. An exact public commit retains development flexibility until the next
 release while still making this deployment reproducible.
 
-Running the real-host deployment before Feature 0015 would establish only an
-installation demonstration: the pipeline still could not complete its
-required storage and publishing path. Making Feature 0015 an explicit
-prerequisite avoids temporary inventory variables and gives the acceptance
-run a meaningful end-to-end boundary.
+Feature 0015 now supplies the reviewed storage and publishing path needed for
+meaningful end-to-end acceptance. Inheriting that policy keeps host inventory
+focused on deployment choices and avoids maintaining a second copy of the
+suite defaults.
 
 ## Acceptance Criteria
 
@@ -227,7 +267,8 @@ run a meaningful end-to-end boundary.
   `rakestraw.dnd.pipeline`, and contains no deployment variables or procedural
   setup.
 - Host inventory sets the confirmed WhisperX endpoint, enrolls only `eric`,
-  and supplies the final Feature 0015 storage and publishing inputs.
+  preserves `dilfs` as the default campaign through the existing standalone
+  role variable, and inherits Feature 0015's storage and publishing defaults.
 - `dnd_pipeline_secrets` maps the required typed runtime keys to host Vault
   variables, and the actual values exist only in a valid Ansible
   Vault-encrypted file.
@@ -240,6 +281,9 @@ run a meaningful end-to-end boundary.
   and installs the exact reviewed public collection snapshot, its five
   standalone role dependencies, and its required native collections without
   using local repository paths.
+- The controller uses the selected collection commit even if collection
+  version `0.1.0` was already installed. The documented inventory, role, and
+  collection paths correspond to the operational controller.
 - On a controller bootstrapped from that manifest, `ansible-doc` resolves
   `rakestraw.dnd.pipeline` and each role dependency, and the new playbook
   passes syntax checking.
@@ -263,9 +307,10 @@ run a meaningful end-to-end boundary.
 
 ## Dependencies and Follow-up Work
 
-[Feature 0015](0015-dnd-s3-storage-and-publishing.md) is the immediate next unit
-of work and a hard prerequisite. It selects the pipeline interface,
-credentials, and observable publishing boundary that Feature 0016 will deploy.
+[Feature 0015](0015-dnd-s3-storage-and-publishing.md) supplies the implemented
+and independently reviewed pipeline interface, credentials, and publishing
+boundary consumed here. Its administrative closeout remains before the
+Feature 0016 sprint; its runtime implementation needs no further remediation.
 
 Features 0013 and 0014 provide the public collection installation path and
 existing-operator enrollment required here. Features 0009 and 0011 provide