Complete the Narratio role feature

docs/roadmap/remediation.md

@@ -1,63 +1,71 @@
-# Feature 0004 Remediation Review
+# Feature 0005 Remediation Review
 
 Status: resolved
 
 Reviewed implementation commits:
 
-- `90d7f45 Install and configure Scriptorium`
-- `5944eac Add focused Scriptorium integration coverage`
+- `3be78d8 Install and configure Narratio`
+- `0e8ad9f Add focused Narratio integration coverage`
 
 Remediation commit:
 
-- `8f47aa8 Clean up Scriptorium review findings`
+- `7feff47 Clean up Narratio review findings`
 
-The production role implements the targeted architecture. The complete
-integration suite, independent syntax and lint checks, Bash syntax validation,
-native default-configuration inspection, and clean-repeat scenarios pass. No
-production behavior or architectural gap requires remediation.
+The production role implements the targeted architecture, and the complete
+integration suite passes. The findings were limited to residual documentation
+and test-quality issues; no production task, template, default, argument
+specification, metadata, or dependency required a change.
 
 ## Finding 1: Remove the Retained Placeholder README Sentence
 
 Severity: low
 
-`ansible-role-scriptorium/README.md` ends with the original placeholder text,
-“Ansible role to install the Scriptorium application.” The rewritten README
-already provides a complete description, so this trailing sentence is an
-accidental duplicate left by the initial replacement.
+`ansible-role-narratio/README.md` ended with the original placeholder sentence,
+“Ansible role to install the Narratio D&D transcript and session report
+generation suite.” The rewritten README already provided the complete role
+description, so this was accidental residue from the initial repository.
 
 ### Resolution
 
-The trailing placeholder sentence was deleted without changing the completed
-role or validation documentation.
+The retained placeholder sentence was removed without changing the substantive
+role documentation.
 
-## Finding 2: Simplify Representative Test Data Flow
+## Finding 2: Make the Composition Test Non-vacuous
 
 Severity: low
 
-`ansible-role-scriptorium/tests/integration` repeats the same long
-representative extra-vars document for the initial convergence and its clean
-repeat. This makes the requirement that both runs use identical inputs harder
-to see and creates two values that can drift independently.
-
-`ansible-role-scriptorium/tests/verify-config.yml` also persists the parsed
-configuration with a separate `ansible.builtin.set_fact` task even though the
-value is needed only by the following assertion. This adds a task and mutable
-test state without adding behavior.
+`ansible-role-narratio/tests/representative.yml` claimed to exercise
+caller-side composition, but both secondary fragments were empty. The verifier
+consequently proved only that one original entry survived serialization.
 
 ### Resolution
 
-The shell driver now defines the representative extra-variable arguments once
-and passes the same array to both convergence calls. The verifier parses the
-slurped configuration through a variable local to its assertion task, and the
-standalone `set_fact` task was removed. Existing assertions, native inspection,
-and clean-repeat coverage remain unchanged.
+The Scriptorium artifact map now combines two nonempty caller-defined
+fragments, and the verifier checks one entry from each. Publish outputs use one
+direct value so the suite retains only one representative composition case.
+Native validation and the immediate clean repeat remain in place.
+
+## Finding 3: Use Ansible Privilege Escalation Directly in Verifiers
+
+Severity: low
+
+Both configuration verifiers escalated to root and then executed
+`/usr/bin/sudo -u narratio` inside `ansible.builtin.command`, creating a
+redundant second privilege transition.
+
+### Resolution
+
+Both verifier tasks now use `become_user: narratio` and invoke Narratio
+directly. The integration driver enables pipelining and uses `/tmp` for
+Ansible's transient module area, avoiding the local controller's otherwise
+unmet temporary-file ACL requirement without adding a nested sudo command.
 
 ## Final Validation
 
 `bash -n tests/integration`, the complete `tests/integration` suite, and
-`git diff --check` passed after remediation. Production-profile lint and
-Ansible syntax checks passed within the integration entry point. Default,
-missing-binary recovery, and representative-configuration scenarios all
-passed their native inspections and immediate clean repeats, and cleanup
-restored the usable `{}` default configuration. No unresolved Feature 0004
-findings remain.
+`git diff --check` passed after remediation. Syntax checking and
+production-profile lint passed within the integration entry point. Baseline,
+missing-binary recovery, and representative-configuration scenarios passed
+their native Narratio checks as the application account, every required
+immediate repeat reported `changed=0` and `failed=0`, and cleanup restored the
+usable baseline deployment. No unresolved Feature 0005 findings remain.