Document the completed Seriatim remediation

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Implementation Plan 0001: Simplify Seriatim Source Installation
 
-Status: proposed
+Status: done
 
 Target executor: GPT-5.6-Terra
 
@@ -27,8 +27,10 @@ coverage.
   the immediately preceding stage.
 - Follow `docs/conventions.md` and the Feature 0001 task flow. Trust the
   idempotence and change detection of `apt`, Snap, `file`, and `git`.
-- Keep the three rebuild triggers directly on the build task. Do not create an
+- Keep the two rebuild triggers directly on the build task. Do not create an
   intermediate rebuild fact, build handlers, or a handler flush.
+- Do not run the installed executable from production role tasks. Verify its
+  build output in repository-local integration tests.
 - Do not reintroduce fingerprints, checksums, sidecar build state, manual Git
   cleanup, staged replacement, compiler inspection, or malformed-path
   recovery.
@@ -91,10 +93,11 @@ Retain exactly these public defaults:
 | `seriatim_binary_path` | `/usr/local/bin/seriatim` | Installed executable |
 | `seriatim_manage_build_dependencies` | `true` | Whether to install Git and Go |
 | `seriatim_go_snap_channel` | `1.26/stable` | Go Snap channel |
+| `seriatim_go_binary` | `/snap/bin/go` | Go executable used for the build |
 
-The Go executable, package, build flags, linker symbol, and build environment
-are fixed implementation details. The selected version is both the Git ref and
-the value injected into the binary.
+The package, build flags, linker symbol, and build environment are fixed
+implementation details. The selected version is both the Git ref and the value
+injected into the binary.
 
 ## Stage 1: Replace the Role with the Minimal Implementation
 
@@ -118,7 +121,7 @@ validates the default Seriatim release idempotently.
 
 ### Required Changes
 
-1. Reduce `defaults/main.yml` and `meta/argument_specs.yml` to the six variables
+1. Reduce `defaults/main.yml` and `meta/argument_specs.yml` to the seven variables
    in the Fixed Public Interface. Retain useful role and Galaxy metadata in
    `meta/main.yml`.
 2. Replace the imported task structure with one readable `tasks/main.yml` and
@@ -134,29 +137,27 @@ validates the default Seriatim release idempotently.
       `seriatim_repository_url`, `seriatim_source_dir`, and `force: true`, and
       register the module result;
    6. inspect `seriatim_binary_path` with `ansible.builtin.stat`;
-   7. run `seriatim_binary_path --version` only when the binary exists,
-      registering the result without reporting change or failing the play;
-   8. build directly to `seriatim_binary_path` when the Git task changed, the
-      binary is absent, or the version command failed or returned anything
-      other than `seriatim version {{ seriatim_version }}`;
-   9. converge recursive `root:root` source ownership and binary
+   7. build directly to `seriatim_binary_path` when the Git task changed or the
+      binary is absent;
+   8. converge recursive `root:root` source ownership and binary
       `root:root` mode `0755` with one item-driven `ansible.builtin.file` loop;
-   10. validate the binary version after a build without reporting change.
 3. Put the rebuild expression directly on the build command. Register the
-   build result for post-build validation and mark the command changed only
-   when it runs.
-4. Invoke `/snap/bin/go build` with `argv`, the fixed package, flags, linker
+   Git and binary inspection results needed by its two conditions without
+   creating an intermediate rebuild fact.
+4. Invoke `seriatim_go_binary` with `argv`, the fixed package, flags, linker
    value, output path, working directory, and environment from the upstream
-   contract. Do not turn those fixed values into defaults or facts.
+   contract. Do not turn the remaining fixed values into defaults or facts.
+   Apply task-level privilege escalation to dependency installation and tasks
+   that manage root-owned application state.
 5. Remove all code for Git executable discovery, Go executable and compiler
    validation, manual Git status/reset/clean, resolved-commit facts, temporary
    build directories, build inputs, fingerprints, checksums, sidecar state,
    special path-object recovery, and transactional installation.
-6. Do not add `handlers/main.yml`; the build, permission, and validation tasks
-   execute in normal order.
-7. Rewrite the README to document the six-variable interface, privilege and
+6. Do not add `handlers/main.yml`; the build and permission tasks execute in
+   normal order.
+7. Rewrite the README to document the seven-variable interface, privilege and
    fact requirements, dependency opt-out behavior, authoritative Git checkout,
-   direct build contract, three rebuild triggers, installed metadata, and
+   direct build contract, two rebuild triggers, installed metadata, and
    validation commands. Remove every claim or example tied to deleted
    variables, state files, staging, compiler invalidation, or failure
    preservation.
@@ -175,7 +176,7 @@ From `ansible-role-seriatim`, run:
 ```sh
 tests/integration
 ! rg -n \
-  'seriatim_(source_ref|build_version|build_state_dir|go_binary|go_build_flags|go_ldflags|go_package)|fingerprint|checksum' \
+  'seriatim_(source_ref|build_version|build_state_dir|go_build_flags|go_ldflags|go_package)|fingerprint|checksum' \
   defaults meta tasks tests README.md
 git diff --check
 git status --short
@@ -189,7 +190,7 @@ changes remain before commit.
 
 ### Completion Criteria
 
-- The public interface contains exactly six defaults and matching argument
+- The public interface contains exactly seven defaults and matching argument
   specifications.
 - The role's effective task flow matches the roadmap without intermediate
   rebuild state or handlers.
@@ -230,8 +231,8 @@ default state.
 2. Retain the baseline convergence, verification, and clean-repeat cases, then
    add focused cases for:
    - an absent binary causing one rebuild followed by an unchanged run;
-   - an executable that reports the wrong version causing one rebuild followed
-     by an unchanged run;
+   - dependency opt-out with a caller-supplied Go executable causing one build
+     followed by an unchanged run;
    - binary ownership or mode drift being repaired by the ordinary `file` task
      without requiring a rebuild, as shown by the captured Ansible task output;
    - selecting `v1.4.0`, confirming its commit and version output, and reaching
@@ -312,4 +313,8 @@ push during out-of-band execution. Completion requires subsequent review.
 
 ## Progress Notes
 
-No stages have been executed.
+- Stage 1 completed in `ansible-role-seriatim` commit `325a5c7`.
+- Stage 2 completed in `ansible-role-seriatim` commit `718030e`.
+- The final manual-review remediation in `docs/roadmap/remediation.md` was
+  implemented and validated in `ansible-role-seriatim` commit `fb8dc41` on
+  2026-09-08. Feature acceptance remains a separate review step.