Complete the Audita feature

docs/roadmap/remediation.md

@@ -1,137 +1,134 @@
-# Feature 0001 Remediation Review
+# Feature 0002 Remediation Review
 
 Status: resolved
 
-## Finding 1: Synchronize Implementation Progress Tracking
+The Audita production task flow implements the approved architecture and the
+complete integration suite passes. The following residual issues should be
+corrected before Feature 0002 is accepted.
+
+## Finding 1: Correct the Declared Role License
+
+Severity: medium
+
+`ansible-role-audita/meta/main.yml` declares `BSD-3-Clause`, but the
+repository's `LICENSE` file is CC0 1.0 Universal. Published role metadata must
+identify the license actually granted by the repository.
+
+### Required Remediation
+
+- Change `galaxy_info.license` to the Galaxy-compatible SPDX identifier
+  `CC0-1.0`.
+- Do not replace or otherwise alter the existing license text.
+
+### Validation
+
+- `meta/main.yml` and `LICENSE` identify the same license.
+- Production-profile ansible-lint passes.
+
+## Finding 2: Describe All Integration-Test Host Effects
 
 Severity: low
 
-The two implementation stages are marked complete in
-`docs/roadmap/implementation.md`, with commits `325a5c7` and `718030e`, but the
-same document still has status `proposed` and says that no stages have been
-executed. `docs/status.md` likewise still describes plan review as the current
-focus and Feature 0001 as `ready` rather than reflecting the completed
-implementation and pending review outcome.
+`ansible-role-audita/README.md` says that the integration suite mutates only
+the three Audita paths and its private temporary directory. Default
+convergence also enables dependency management, so on a fresh supported host
+the suite may install Git through APT, refresh the APT cache, and install the
+Go Snap. The statement is therefore incomplete.
 
 ### Required Remediation
 
-- Update the implementation plan status and progress notes to agree with its
-  two recorded stage completions.
-- Update workspace status to reflect that implementation is complete and the
-  feature is awaiting review acceptance.
-- Preserve the prior remediation history in Git rather than carrying its
-  superseded contents in the active remediation document.
+- State that the suite may install or converge Git and the Go Snap in addition
+  to managing the listed Audita paths.
+- Retain the statement that temporary test-specific files are confined to the
+  private temporary directory.
 
 ### Validation
 
-- The implementation plan's status, stage completion annotations, and progress
-  notes describe one consistent state.
-- Workspace status names implementation review as the current activity and
-  uses the corresponding feature state.
-- `git diff --check` passes.
+- The README accurately describes package/Snap effects and managed filesystem
+  paths.
+- The description agrees with `tests/integration` and the role defaults.
 
-## Finding 2: Remove Production Version Interrogation
+## Finding 3: Complete Binary-Type Verification
 
-Severity: medium
+Severity: low
 
-`ansible-role-seriatim/tasks/main.yml` runs the installed binary before a build
-to detect unexpected version output and again after a build to validate the
-result. Neither operation is part of the required production convergence
-contract. The first adds unrequested drift detection, while the second turns a
-role task into a test of the role's own build implementation.
+`tests/verify.yml` checks binary ownership, mode, and executability, but does
+not assert that `/usr/local/bin/audita` is a regular file. Stage 1 explicitly
+requires baseline verification of binary type and metadata. The production
+`file` task establishes this invariant, but the focused verification does not
+provide the planned evidence for it.
 
 ### Required Remediation
 
-- Remove the pre-build `--version` command and its registered result.
-- Rebuild only when the Git checkout changed or the binary is absent.
-- Retain the binary `ansible.builtin.stat`, because its result is independently
-  needed to decide whether the imperative build must run.
-- Remove the post-build `--version` command, its registered build result, and
-  the associated lint suppression.
-- Continue verifying the installed version in repository-local integration
-  tests.
+- Add an assertion for `audita_binary_metadata.stat.isreg` to the existing
+  binary metadata check.
+- Do not add another probe or production task.
 
 ### Validation
 
-- The role contains no production invocation of `seriatim --version`.
-- The build task has exactly the two required triggers: changed checkout or
-  absent binary.
-- Missing-binary and changed-checkout integration cases each cause a build and
-  then converge to an unchanged repeat.
-- The integration suite verifies the built binary's exact version output.
+- `tests/verify.yml` confirms regular-file type, ownership, mode, and
+  executability from its existing `stat` result.
+- The integration suite passes.
 
-## Finding 3: Complete the Declarative Dependency and Privilege Contract
+## Finding 4: Synchronize Implementation Progress Tracking
 
-Severity: medium
+Severity: low
 
-The build command hard-codes `/snap/bin/go`, which makes dependency opt-out
-unnecessarily dependent on the Snap installation path. The Git package task
-also refreshes the APT cache without a validity interval, and tasks that modify
-system-owned paths or install system dependencies currently rely on privilege
-escalation supplied by the calling play.
+Both implementation stages are annotated complete in
+`docs/roadmap/implementation.md`, at role commits `47f1852` and `d37f590`, but
+the plan remains `ready`, its progress notes still say execution is ready to
+begin, and `docs/status.md` still describes execution as the current activity.
+The recorded state should show that implementation is complete and remediation
+review is in progress.
+
+The two workspace commits that added stage-completion annotations also diverge
+from the plan's instruction that the out-of-band executor leave workspace
+planning files unchanged. No implementation code was placed in the wrong
+repository, so this requires tracking cleanup rather than code movement.
 
 ### Required Remediation
 
-- Add `seriatim_go_binary`, defaulting to `/snap/bin/go`, to the public defaults
-  and argument specification, and use it as the build command executable.
-- Add `cache_valid_time: 3600` to the Git `ansible.builtin.apt` task.
-- Set `become: true` directly on tasks that install dependencies or modify
-  root-owned application state. Do not add privilege escalation to the
-  platform assertion or binary inspection merely for uniformity.
-- Update the README's variable table, dependency opt-out description, and
-  privilege behavior to match the implemented contract.
+- Set the plan to `in_progress` while findings remain open and replace its
+  stale progress note with both completed stage commits and the current
+  remediation state.
+- Update workspace status so Feature 0002 is `in_progress`, with implementation
+  complete and remediation pending, and make review/remediation the current
+  focus.
+- Do not mark Feature 0002 `done` until remediation is implemented and
+  reviewed.
 
 ### Validation
 
-- Dependency opt-out can use a caller-supplied Go executable.
-- The APT task retains declarative cache management without refreshing a valid
-  cache.
-- A play connecting as an ordinary sudo-capable user can apply the role without
-  play-level `become: true`.
-- Defaults, argument specifications, tasks, and README agree on the seven
-  public variables.
+- The plan's status, stage annotations, and progress notes describe one
+  consistent state.
+- Workspace status agrees with the implementation and remediation records.
+- `git diff --check` passes in the workspace repository.
 
-## Finding 4: Align the Feature Record and Focused Tests
+## Review Validation Evidence
 
-Severity: medium
+The review ran the complete `ansible-role-audita/tests/integration` suite on
+Ubuntu 26.04 with Ansible Core 2.21.3 and ansible-lint 26.8.0. It passed syntax
+checking, production-profile lint, baseline and repeated convergence,
+missing-binary rebuilding, dependency opt-out with a caller-supplied Go
+executable, metadata repair without rebuilding, configuration-only
+convergence, alternate-checkout rebuilding, default restoration, native
+configuration validation, and all three platform-rejection cases.
 
-The active feature roadmap and completed implementation plan still require
-wrong-version drift detection, post-build validation as a production task, a
-hard-coded Go executable, and a six-variable interface. The integration driver
-also contains a wrong-version rebuild case that would preserve the superseded
-contract.
-
-### Required Remediation
-
-- Revise the feature roadmap to record the two rebuild triggers, the
-  seven-variable interface, and the approximately eight-task target flow.
-- Annotate or revise the completed implementation plan so it does not remain an
-  apparently authoritative description of the superseded target.
-- Remove the wrong-version rebuild case from the integration driver.
-- Retain focused coverage of default convergence and idempotence, a missing
-  binary, binary metadata convergence without a build, a changed selected
-  version, platform rejection, and final version output.
-- Update the README to describe only the revised behavior.
-
-### Validation
-
-- Workspace roadmap, implementation record, role implementation, README, and
-  integration suite describe the same final architecture.
-- No active document claims that unexpected version output triggers a rebuild
-  or that the production role validates a newly built executable by running
-  it.
-- `tests/integration`, `bash -n tests/integration`, and `git diff --check` pass.
+The final state was default commit
+`a84941d68168a1ed9ea7423b6477ae8218be73f9`, a `root:root` mode `0755` binary,
+a `root:root` mode `0644` configuration, and native validation output
+`config is valid`. `bash -n tests/integration` and `git diff --check` also
+passed. All nested repository working trees remained clean.
 
 ## Resolution
 
-All four findings were resolved in `ansible-role-seriatim` commit `fb8dc41` on
-2026-09-08. The role now uses an eight-task flow with two rebuild triggers, a
-caller-selectable Go executable, bounded APT cache refreshes, and task-level
-privilege escalation. Production tasks do not execute the installed
-application; repository-local verification retains the version assertion. The
-active roadmap, implementation record, status, README, interface, and focused
-tests describe the same architecture.
+All four findings were implemented and validated on 2026-09-08. The role now
+declares `CC0-1.0`, its README identifies dependency-management effects, and
+its existing binary `stat` result proves regular-file type. Workspace tracking
+records the completed and accepted feature. Role remediation was committed as
+`3a8c21f`.
 
-Validation completed successfully with `tests/integration`,
-`bash -n tests/integration`, and `git diff --check` in both changed
-repositories.
+Validation passed with the complete `tests/integration` suite,
+production-profile ansible-lint, `bash -n tests/integration`, and
+`git diff --check` in both changed repositories. The production task flow was
+not changed.