Complete the Scriptorium feature

docs/roadmap/remediation.md

@@ -1,64 +1,63 @@
-# Feature 0003 Remediation Review
+# Feature 0004 Remediation Review
 
 Status: resolved
 
 Reviewed implementation commits:
 
-- `287fc4a Install and configure Notarius`
-- `733a194 Add focused Notarius integration coverage`
+- `90d7f45 Install and configure Scriptorium`
+- `5944eac Add focused Scriptorium integration coverage`
 
 Remediation commit:
 
-- `eb4f511 Correct Notarius metadata and dependency coverage`
+- `8f47aa8 Clean up Scriptorium review findings`
 
-## Finding 1: Correct the Galaxy License Metadata
+The production role implements the targeted architecture. The complete
+integration suite, independent syntax and lint checks, Bash syntax validation,
+native default-configuration inspection, and clean-repeat scenarios pass. No
+production behavior or architectural gap requires remediation.
 
-Severity: medium
-
-`ansible-role-notarius/meta/main.yml` declared `license: BSD-3-Clause`, while
-the retained repository license is CC0 1.0 Universal.
-
-### Resolution
-
-The Galaxy license identifier is now `CC0-1.0`, consistent with the repository
-license.
-
-## Finding 2: Remove the Redundant Build Change Override
-
-Status: withdrawn
-
-The initial review treated `changed_when: true` on the conditionally executed
-build command as redundant. Validation after removing it failed ansible-lint's
-`no-changed-when` production rule.
-
-### Resolution
-
-The directive remains in place. Unlike a desired-state module, the imperative
-build command must explicitly declare its change semantics for lint. The
-existing `when` expression still determines whether the command runs, and
-`changed_when: true` accurately reports that every executed build changes the
-binary. The distinction is now documented in `docs/ansible.md`.
-
-## Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary
+## Finding 1: Remove the Retained Placeholder README Sentence
 
 Severity: low
 
-The original integration test pointed `notarius_go_binary` at a symlink to
-`/snap/bin/go`, so it did not prove that the configured path was actually
-invoked.
+`ansible-role-scriptorium/README.md` ends with the original placeholder text,
+“Ansible role to install the Scriptorium application.” The rewritten README
+already provides a complete description, so this trailing sentence is an
+accidental duplicate left by the initial replacement.
 
 ### Resolution
 
-The test now supplies a wrapper in its private temporary directory. The
-wrapper records its invocation before delegating to `/snap/bin/go`, and the
-suite asserts that the record exists after the dependency-opt-out build.
+The trailing placeholder sentence was deleted without changing the completed
+role or validation documentation.
+
+## Finding 2: Simplify Representative Test Data Flow
+
+Severity: low
+
+`ansible-role-scriptorium/tests/integration` repeats the same long
+representative extra-vars document for the initial convergence and its clean
+repeat. This makes the requirement that both runs use identical inputs harder
+to see and creates two values that can drift independently.
+
+`ansible-role-scriptorium/tests/verify-config.yml` also persists the parsed
+configuration with a separate `ansible.builtin.set_fact` task even though the
+value is needed only by the following assertion. This adds a task and mutable
+test state without adding behavior.
+
+### Resolution
+
+The shell driver now defines the representative extra-variable arguments once
+and passes the same array to both convergence calls. The verifier parses the
+slurped configuration through a variable local to its assertion task, and the
+standalone `set_fact` task was removed. Existing assertions, native inspection,
+and clean-repeat coverage remain unchanged.
 
 ## Final Validation
 
-The complete `tests/integration` suite passed after remediation with Ansible
-Core 2.21.3 and ansible-lint 26.8.0. Production-profile lint passed, every
-selected build and configuration behavior remained valid, all required repeat
-runs were clean, and the suite restored Notarius `v0.6.0` with the minimal
-`version: 4` configuration.
-
-`git diff --check` also passed. No unresolved Feature 0003 findings remain.
+`bash -n tests/integration`, the complete `tests/integration` suite, and
+`git diff --check` passed after remediation. Production-profile lint and
+Ansible syntax checks passed within the integration entry point. Default,
+missing-binary recovery, and representative-configuration scenarios all
+passed their native inspections and immediate clean repeats, and cleanup
+restored the usable `{}` default configuration. No unresolved Feature 0004
+findings remain.