Complete the D&D Notarius integration feature

docs/roadmap/remediation.md

@@ -1,90 +1,112 @@
-# Feature 0009 Remediation Review
+# Feature 0010 Remediation Review
 
 Status: resolved
 
 Reviewed implementation commits:
 
-- `66ebea9 Make Audita configuration ownership configurable`
-- `e9ae2dc Make Notarius configuration ownership configurable`
-- `8b4c86e Make Scriptorium configuration ownership configurable`
-- `eeb1105 Make Narratio configuration ownership configurable`
-- `901ae35 Apply shared configuration ownership to the D&D pipeline`
-- `dddc5ee Manage shared pipeline access with ACLs`
-- `f53da82 Test shared pipeline access across users`
-- `608d5be Document the shared pipeline execution model`
+- `14a38e0 Upgrade the Notarius role to version 0.7.0`
+- `90893ae Integrate Notarius extraction into the D&D pipeline`
+- `7fd7b24 Document and test the D&D Notarius integration`
 
 ## Review Summary
 
-The production architecture and behavioral coverage implement Feature 0009 as
-planned. The four standalone roles expose generic configuration ownership and
-mode controls, and the pipeline selects its opinionated service-owned,
-world-readable policy through those interfaces. Narratio establishes the
-runtime identity first. The pipeline then installs ACL support and directly
-converges access and default ACLs on the three existing shared roots. Focused
-integration coverage exercises actual cross-identity configuration access and
-bidirectional writes under a restrictive umask while preserving immediate clean
-convergence.
+Feature 0010 implements the intended production architecture. The standalone
+Notarius role supports ConfigKit imports without owning imported fragments. The
+pipeline role owns the complete D&D extraction topology, renders it as a
+ConfigKit fragment, selects it from the root Notarius configuration, connects
+Narratio to that pipeline and its artifact paths, and manages a shared FHS
+cache with the pipeline's group-access policy. The complete standalone and
+pipeline integration suites pass, including native application validation and
+immediate clean repeats.
 
-No production code or test-suite remediation is required. One small consumer
-documentation inconsistency remains.
+No production behavior gap was found. Two low-severity issues should be
+addressed: the configurable pipeline-ID boundary is not observed through
+Narratio in the integration suite, and the ACL task names no longer describe
+all of the roots they manage.
 
-## Finding 1: Operator Support Is Documented Inconsistently
+## Finding 1: Alternate Pipeline Selection Is Not Observed Through Narratio
 
 Severity: low
 
-`ansible-role-dnd-pipeline/README.md:201-217` first lists "operator access" as
-deferred, then correctly states that invocation by an existing member of the
-selected runtime group is supported. The likely deferred concern is operator
-selection and group-membership management, not operator access itself.
+`ansible-role-dnd-pipeline/tests/integration:172-187` composes two alternate
+Notarius pipeline maps and selects `archive-session` through
+`dnd_pipeline_narratio_notarius_pipeline_id`. The test then validates only the
+Notarius configuration and cache-mode override. It does not inspect Narratio's
+effective configuration after the alternate convergence.
 
-The adjacent YAML fragment defines an otherwise unexplained
-`operator_group_members` variable but shows no consumer task or role that uses
-it. As written, copying the example does not manage any membership and may lead
-a reader to believe that the pipeline role consumes that variable.
+The production wiring in `ansible-role-dnd-pipeline/meta/main.yml:45-50` is
+correct, but a future regression that stops forwarding the selected pipeline
+ID to Narratio could pass the current test. This is a focused behavioral
+coverage gap at a feature-owned integration boundary, not a request for a
+snapshot or implementation-detail assertion.
 
 ### Required Remediation
 
-- Replace "operator access" in the deferred list with the precise deferred
-  behavior: operator selection and group-membership management.
-- Replace the inert variable fragment with a concise, complete consumer-side
-  example that actually adds a selected account to the runtime group, or omit
-  the example and state the prerequisite directly.
-- Keep human account and membership management outside the production pipeline
-  role.
+- After the alternate convergence, use Narratio's native configuration command
+  with a deployed campaign and inspect the effective selected pipeline ID.
+- Assert that Narratio observes `archive-session`.
+- Retain the existing native Notarius checks, cache-mode check, and immediate
+  clean repeat.
+- Do not run model-backed extraction or snapshot the complete generated
+  configuration.
+
+## Finding 2: ACL Task Names Exclude the Notarius Cache They Manage
+
+Severity: low
+
+`ansible-role-dnd-pipeline/tasks/main.yml:19` and
+`ansible-role-dnd-pipeline/tasks/main.yml:39` describe their ACL loops as
+managing "Narratio writable roots." Both loops now also manage the Notarius
+cache root. The task behavior is correct, but the execution log is misleading
+about its scope.
+
+### Required Remediation
+
+- Rename both ACL tasks to describe the shared pipeline writable roots.
+- Do not otherwise change the direct desired-state ACL implementation or its
+  task flow.
 
 ## Resolution
 
-Resolved in pipeline-role commit `b15fe8d`. The deferred-work summary now
-names operator selection and group-membership management rather than operator
-access. The shared-filesystem section retains existing-group-member invocation
-as supported behavior and provides a complete consumer-owned
-`ansible.builtin.user` example that adds a selected account to the runtime
-group. No production role behavior changed.
+Resolved in pipeline-role commit `bbf01e1`. The alternate-map integration case
+now uses Narratio's native `config show` command to observe the selected
+`archive-session` pipeline ID before its immediate clean repeat. The two ACL
+task names now describe shared pipeline writable roots without changing their
+module arguments, loops, or task flow.
 
 ## Required Validation
 
-After the documentation correction, run:
+After remediation, run:
 
 ```text
 cd ansible-role-dnd-pipeline && tests/integration
 git diff --check
 ```
 
-The expected result remains successful native configuration checks,
-representative cross-identity access, and immediate repeats with `changed=0`
-and `failed=0`.
+The expected result is successful native configuration validation for the
+base, testing, and alternate profiles; observation of `archive-session` through
+Narratio; successful shared-cache access; and immediate repeats with
+`changed=0` and `failed=0`.
 
 ## Review Validation Evidence
 
-The independent review inspected the complete diffs for all eight stage
-commits and confirmed that every dependency pin resolves to the intended
-standalone-role commit. `git diff --check` passed across all five changed role
-repositories. The complete pipeline `tests/integration` entry point passed its
-isolated dependency installation, syntax check, production-profile lint,
-native application checks, cross-identity access exercise, configurable
-profile and version cases, and immediate clean repeats. All repositories were
-clean before this review document was revised.
+The independent review inspected the full implementation diffs and confirmed
+that the dependency pins resolve to the intended role commits. A semantic
+comparison found that the managed D&D pipeline topology matches the Notarius
+v0.7.0 example after removing only the external reference paths that belong to
+Narratio. The Narratio output map matches its upstream annotated example, and
+the intentional omission of the optional spell catalog agrees with the feature
+roadmap.
 
-After remediation, the complete pipeline integration entry point and
-`git diff --check` passed again. The test fixture was removed and the baseline
-Seriatim version and pipeline configuration were restored during cleanup.
+Both `ansible-role-notarius/tests/integration` and
+`ansible-role-dnd-pipeline/tests/integration` passed. Post-suite checks also
+confirmed the expected Seriatim and Notarius versions, native Notarius pipeline
+validation, native Narratio validation for the base and testing profiles, and
+a clean repeat. `git diff --check` passed, and all repositories were clean
+before this review document was replaced.
+
+After remediation, the complete pipeline integration entry point passed again.
+It observed `archive-session` through Narratio, validated the alternate
+Notarius pipeline, and reported `changed=0` and `failed=0` on the identical
+repeat. Cleanup restored Seriatim v1.5.0 and the default `dnd-session`
+configuration. `git diff --check` also passed.