From e46c8182f136bd102e03e443697e66a0e39a7600 Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Thu, 10 Sep 2026 14:58:31 +0000 Subject: [PATCH] Complete the pipeline composition foundation --- ...06-pipeline-role-composition-foundation.md | 8 +- docs/roadmap/implementation.md | 388 +----------------- docs/roadmap/remediation.md | 138 +++++-- docs/status.md | 6 +- 4 files changed, 113 insertions(+), 427 deletions(-) diff --git a/docs/roadmap/features/0006-pipeline-role-composition-foundation.md b/docs/roadmap/features/0006-pipeline-role-composition-foundation.md index 7f0d63f..4846224 100644 --- a/docs/roadmap/features/0006-pipeline-role-composition-foundation.md +++ b/docs/roadmap/features/0006-pipeline-role-composition-foundation.md @@ -1,6 +1,6 @@ # Feature 0006: Pipeline Role Composition Foundation -Status: ready +Status: done ## Summary @@ -374,6 +374,12 @@ standalone roles' field-specific variables rather than adding pipeline-owned configuration templates or duplicating every downstream setting behind a new alias. +The feature was implemented in `ansible-role-dnd-pipeline` commits `b515968` +and `61869d1`, then finalized by review remediation commit `4ea4358`. The +complete integration suite passes with fresh dependency bootstrap, native +application validation, explicit suite-level version selection, and clean +repeated convergence. + ## Potential Future Hardening - Verify signed role or application releases. diff --git a/docs/roadmap/implementation.md b/docs/roadmap/implementation.md index 64c3e7c..b927a9b 100644 --- a/docs/roadmap/implementation.md +++ b/docs/roadmap/implementation.md @@ -1,382 +1,14 @@ -# Implementation Plan 0006: Establish Pipeline Role Composition +# Implementation Plan -Status: ready +Status: pending -Target executor: GPT-5.6-Terra +No implementation plan is currently active. Feature 0006 was implemented in +`ansible-role-dnd-pipeline` commits `b515968` and `61869d1`, independently +reviewed, and finalized by remediation commit `4ea4358`. -Feature roadmap: -[Feature 0006: Pipeline Role Composition Foundation](features/0006-pipeline-role-composition-foundation.md) +Its durable scope and rationale remain in +[the Feature 0006 roadmap](features/0006-pipeline-role-composition-foundation.md), +and its final review record remains in [the remediation record](remediation.md). -Active plan location: `docs/roadmap/implementation.md` - -## Objective - -Implement the independently developed `rakestraw.dnd_pipeline` role defined by -Feature 0006. Compose the five completed standalone application roles through -ordinary dependency metadata, install them reproducibly from a Git dependency -manifest, expose the approved suite-level variables, and wire Narratio to the -standard downstream application paths. - -The feature roadmap remains authoritative for scope, rationale, target end -state, public variables, dependency revisions, and acceptance criteria. - -## Execution Rules - -- Execute Stage 1 and Stage 2 in numeric order. -- Immediately before each stage, read every document in that stage's Required - Policy Review, then confirm its preconditions and the owning repository's - working-tree state. -- Modify only `ansible-role-dnd-pipeline`. Treat the workspace control - repository, standalone application roles, application sources, asset - repositories, collection, and proof of concept as read-only during - out-of-band implementation. -- Preserve unrelated changes. Stop if the pipeline-role repository is - unexpectedly dirty at a stage boundary. -- Use ordinary role dependency metadata. Do not copy downstream tasks or - templates, add a loader role, or surround role invocation with state probes - or result inspection. -- Define only the nine suite-owned variables fixed by the feature roadmap. Do - not alias the complete standalone interfaces or add raw downstream-variable - maps, path overrides, component switches, content settings, operator - settings, or secret settings. -- Pass the common build-dependency switch, Go channel, and Go executable to - all five dependencies. Pass each selected application version only to its - corresponding dependency. -- Pass the required WhisperX URL and the roadmap's fixed downstream binary and - configuration paths to Narratio. Install Notarius without enabling it in - Narratio. -- Trust each dependency to establish its documented state. Do not test or - reimplement APT, Snap, Git, file, template, account, or build behavior in - production pipeline-role logic. -- Keep behavioral tests at the composition boundary. Prove that the assembled - applications are usable, Narratio accepts the assembled configuration, a - suite version override reaches its application role, and an immediate - repeat is clean. Do not rerun the standalone roles' behavior matrices. -- Do not assert current default versions, exact dependency pins, task order, - task traces, file metadata, package state, checkout state, or other trusted - module postconditions in behavioral tests. -- Use fully qualified collection names. Run each stage's validation before - committing it, and do not begin Stage 2 if Stage 1 fails validation. -- Commit each completed stage with its specified plain-English message. Do not - push during out-of-band implementation. -- Test cleanup may reapply the baseline pipeline role and remove only the - integration driver's private temporary directory. Do not delete campaign, - prompt, runtime, or other caller content. - -## Starting State and Preconditions - -- `ansible-role-dnd-pipeline` is clean on `main` at - `1a66d177cdd5d948c94c291b718c779dbbfd1f91`, tracking `origin/main` without - divergence. -- This plan, the ready Feature 0006 roadmap, and the corresponding workspace - documentation and status updates are committed before out-of-band execution - begins. -- The exact dependency commits fixed by Feature 0006 are reachable from their - declared remote repositories before Stage 1 begins. At plan preparation, - all five commits are local-only and must be pushed: - - | Dependency | Required commit | Current `origin/main` | - | --- | --- | --- | - | Audita role | `d2d0b9d00b3b491ce7613ccfc8f686f3d1fa0896` | `3a8c21f0e61c62dbb603ba0f3fdfab1fd3b1de09` | - | Narratio role | `7feff4728a5968b6b1dd87e83add9fa1a9066b18` | `b97a317f9ec9f15675e81c65af3f4a1ad8176886` | - | Notarius role | `cfecf37261f2595d45113235c591ee102d6f181f` | `f8a3e113ef4975b2c2745cb3f08500b2206c3f21` | - | Seriatim role | `e08c63c0b078658bdfa2d10a2e6e1e4f9372a075` | `fb8dc4100c029e25c4ab507645d75df0d739fe66` | - | Scriptorium role | `8f47aa802a5e0c9dae9c0f43a1c70b3512b2c8b2` | `2cd69a4b2ead23b44f1aab51fd1b1f14ac326af2` | - -- The local controller and managed-host proxy are Ubuntu 26.04 `x86_64`, with - gathered facts and passwordless task-level privilege escalation available. -- Workspace tooling is available in `../.venv/bin` from the pipeline-role - repository: Ansible Core 2.21.3 and ansible-lint 26.8.0. -- `community.general` 13.3.0 and Go Snap channel `1.26/stable` are available. -- The five application binaries and their current managed state may already - exist from standalone-role development. The integration suite must converge - from that state without treating prior installation as test evidence or - deleting unrelated content. -- Seriatim tag `v1.4.0` remains available for the explicit suite-level version - override case and reports `seriatim version v1.4.0` through its native - version command. -- Narratio can validate the baseline assembled pipeline without contacting the - syntactically valid test WhisperX URL. Notarius remains disabled, and no - campaign, prompt library, credentials, or session input is required for - configuration validation. - -## Repository Scope - -Repository that changes: - -- `ansible-role-dnd-pipeline`: public interface, dependency metadata and - manifests, documentation, and focused repository-local integration suite. - -Repositories that may be inspected but must remain unchanged: - -- `ansible-workspace-dnd`: authoritative roadmap, plan, policies, inventory, - and status. -- `ansible-role-{audita,narratio,notarius,seriatim,scriptorium}`: authoritative - dependency interfaces and reviewed implementations. -- `../{audita,narratio,notarius,seriatim,scriptorium}`: authoritative native - application contracts. -- `assets/campaigns` and `assets/narratio-prompts`: future content inputs, - outside this feature. -- `ansible-collection-dnd`: future collection assembly target. -- `rakestraw-ansible`: historical style and deployment reference. -- Every other repository in `workspace.yml`. - -## Stage 1: Compose the Five Application Roles - -### Objective - -Create a complete standalone pipeline role whose metadata installs the five -applications with the approved suite interface, dependency pins, and -cross-application path wiring, then demonstrate baseline native usability and -clean repeated convergence. - -### Required Policy Review - -Before beginning this stage, read: - -- `AGENTS.md` -- `docs/orientation.md` -- `docs/conventions.md` -- `docs/ansible.md` -- `docs/testing.md` - -### Preconditions - -- The starting revision and tool versions above remain valid. -- `ansible-role-dnd-pipeline` has no uncommitted changes. -- The workspace planning commit containing this plan exists. -- Every required dependency commit is fetchable from its roadmap-declared Git - URL. Confirm this through a fresh `ansible-galaxy role install`; do not - substitute local role directories for the remote dependency test. -- Existing managed application and runtime paths contain no test-created - corruption that prevents ordinary role convergence. Preserve any campaign, - prompt, session, or other caller content already present. - -### Owning Repository - -`ansible-role-dnd-pipeline` - -### Required Changes - -1. Retain the existing license and create the conventional role structure: - `defaults/main.yml`, `meta/main.yml`, `meta/argument_specs.yml`, - `tasks/main.yml`, `requirements.yml`, `collections/requirements.yml`, - `ansible.cfg`, and focused files under `tests/`. -2. Declare role name `dnd_pipeline`, namespace `rakestraw`, author Eric - Rakestraw, license `CC0-1.0`, Ubuntu 26.04 support, Ansible Core 2.18 or - newer, the canonical issue tracker, and appropriate pipeline tags. -3. Define exactly the Feature 0006 Fixed Public Interface in defaults and - matching argument specifications: - - default the five `dnd_pipeline_*_version` variables to their roadmap - releases; - - default `dnd_pipeline_manage_build_dependencies` to `true`; - - default `dnd_pipeline_go_snap_channel` to `1.26/stable`; - - default `dnd_pipeline_go_binary` to `/snap/bin/go`; and - - require `dnd_pipeline_whisperx_transcribe_url` as a string without - inventing a default. -4. Add a root `requirements.yml` containing the five Git role dependencies in - the roadmap's canonical names and at the exact reviewed commits. Add - `collections/requirements.yml` pinning `community.general` to `13.3.0`. -5. Declare these dependencies in `meta/main.yml`, in this order: Seriatim, - Audita, Notarius, Scriptorium, Narratio. Map each suite version to the - corresponding application `*_version` variable and map the common - dependency-management, Go channel, and Go executable values to all five - roles. -6. In the Narratio dependency declaration, additionally pass: - - `dnd_pipeline_whisperx_transcribe_url` as - `narratio_whisperx_transcribe_url`; - - `/usr/local/bin/seriatim` as `narratio_seriatim_binary`; - - `/usr/local/bin/audita` and `/usr/local/etc/audita/config.yml` as the - corresponding Narratio Audita values; - - `/usr/local/bin/notarius` and `/usr/local/etc/notarius/config.yml` as the - corresponding Narratio Notarius path values; and - - `/usr/local/bin/scriptorium` and - `/usr/local/etc/scriptorium/config.yml` as the corresponding Narratio - Scriptorium values. - Do not set `narratio_notarius_enabled` or supply D&D processing policy. -7. Keep `tasks/main.yml` empty except for its YAML document marker if Ansible - requires the file. Dependency metadata is the complete production - implementation for this feature; do not add wrapper tasks, assertions, - probes, facts, handlers, or post-dependency validation. -8. Replace the placeholder README with concise documentation covering the - supported platform, dependency bootstrap commands, canonical installed - role names, all nine suite variables, required WhisperX URL, compatible - default application set, common dependency opt-out and Go behavior, - standard cross-application paths, direct use of unmapped standalone role - variables, Notarius's disabled state, later collection name, deferred - content/operators/secrets, and actual integration-test behavior. -9. Add a baseline local integration harness with one executable - `tests/integration` entry point. Use strict shell options, - repository-relative paths, a mode-`0700` private temporary directory, an - isolated roles path, an isolated collections path, syntax checking, - production-profile ansible-lint, and best-effort cleanup that reapplies the - baseline role and removes only the private temporary directory. -10. Install `community.general` from `collections/requirements.yml` and install - all five roles from `requirements.yml` into the fresh isolated roles path. - Resolve the pipeline role itself from the working repository without - replacing any dependency with a workspace sibling checkout. -11. Apply the pipeline role without play-level escalation and supply only a - syntactically valid local test value for - `dnd_pipeline_whisperx_transcribe_url`. Exercise the installed applications - with concise native smoke or configuration commands without asserting - their current default versions. Validate the assembled Narratio pipeline - natively as the `narratio` application account without contacting - WhisperX. -12. Immediately apply the identical baseline invocation again and require the - aggregate recap to report `changed=0` and `failed=0`. -13. Do not assert downstream file existence, ownership, permissions, package - state, Git state, dependency order, exact default versions, complete - configuration content, or individual task results. Successful native use - and clean repeated convergence are the stage's behavioral evidence. - -### Validation - -From `ansible-role-dnd-pipeline`, run: - -```text -tests/integration -git diff --check -git status --short -``` - -Expected result: both manifests install into fresh isolated paths; syntax and -lint pass; the real pipeline role composes all five dependencies; their native -smoke/configuration commands and Narratio's assembled configuration validation -succeed; the immediate repeat reports `changed=0` and `failed=0`; cleanup -leaves the baseline suite usable; and only intended Stage 1 files are modified. - -### Completion Criteria - -- Defaults and argument specifications implement exactly the nine-variable - suite interface, with only the WhisperX URL required. -- Git and collection manifests use the exact approved names, URLs, revisions, - and collection version. -- Dependency metadata contains the five roles in the settled order and passes - only the approved coordinated values and Narratio path wiring. -- The production role contains no duplicated downstream implementation or - additional task machinery. -- README and metadata accurately describe the role, bootstrap procedure, - public interface, composition boundary, and current non-goals. -- Fresh dependency bootstrap, static validation, baseline native behavior, and - immediate clean convergence pass. -- No repository outside `ansible-role-dnd-pipeline` changes. - -### Commit - -Commit intent: `Compose the D&D pipeline roles` - -## Stage 2: Add Focused Composition Coverage - -### Objective - -Prove through one representative override that suite-owned version selection -reaches the appropriate application role, while retaining the lean baseline -composition test and restoring the approved default suite afterward. - -### Required Policy Review - -Before beginning this stage, read: - -- `AGENTS.md` -- `docs/orientation.md` -- `docs/conventions.md` -- `docs/ansible.md` -- `docs/testing.md` - -### Preconditions - -- Stage 1 is committed and `ansible-role-dnd-pipeline` is otherwise clean. -- Stage 1's complete integration entry point passes. -- The isolated dependency bootstrap still resolves all five exact Git commits. -- Applying the baseline pipeline inputs can restore the compatible default - suite after the representative version override. - -### Owning Repository - -`ansible-role-dnd-pipeline` - -### Required Changes - -1. Retain the Stage 1 baseline native smoke/configuration checks and immediate - clean repeat. Extend the existing integration entry point rather than - introducing another framework, scenario tree, or cross-repository helper. -2. Add one representative convergence that explicitly sets - `dnd_pipeline_seriatim_version: v1.4.0` while supplying the same test - WhisperX URL. -3. Execute Seriatim's native version interface and require - `seriatim version v1.4.0`. This proves suite-variable forwarding; do not - inspect role defaults, dependency metadata, the source checkout, or task - results to establish it. -4. Immediately repeat the same explicit-version invocation and require the - aggregate recap to report `changed=0` and `failed=0`. -5. Ensure the cleanup trap reapplies the baseline pipeline role without the - version override so the managed host returns to the approved compatible - default suite on success or failure when possible. -6. Do not add version assertions for the other applications, a common-Go - forwarding probe, missing-binary recovery, configuration branch cases, - platform matrices, dependency-order checks, file or package assertions, or - an end-to-end transcript run. Those behaviors are either already owned by - standalone suites or explicitly deferred by Feature 0006. -7. Update the README validation section only as needed so it accurately - describes the baseline composition, native validation, clean repeats, and - one explicit Seriatim version-selection case. - -### Validation - -From `ansible-role-dnd-pipeline`, run: - -```text -tests/integration -git diff --check -git status --short -``` - -Expected result: fresh dependency bootstrap and all Stage 1 checks still pass; -the suite-level Seriatim override installs `v1.4.0` as observed through native -version output; both required repeat runs report `changed=0` and `failed=0`; -cleanup restores the baseline compatible suite; and only intended Stage 2 test -and documentation changes are present. - -### Completion Criteria - -- One explicit non-default application revision proves the suite's version - forwarding behavior through a native application outcome. -- Baseline composition, assembled Narratio validation, and both clean-repeat - cases remain successful. -- Test cleanup restores the baseline suite without deleting caller content. -- Tests remain focused on composition and do not reproduce standalone-role - coverage or freeze current defaults and implementation details. -- README test documentation remains accurate. -- No repository outside `ansible-role-dnd-pipeline` changes. - -### Commit - -Commit intent: `Add focused pipeline composition coverage` - -## Final Validation and Handoff - -After Stage 2, from `ansible-role-dnd-pipeline`, run: - -```text -tests/integration -git log --oneline -2 -git status --short --branch -cd .. -./scripts/status -``` - -Report both pipeline-role commit hashes, dependency-bootstrap evidence, static -and behavioral validation results, clean-repeat evidence, baseline restoration, -any deviation or remaining concern, and any complexity beyond dependency -metadata with the acceptance criterion that required it. - -Do not edit workspace planning files, mark Feature 0006 `done`, modify asset or -dependency repositories, or push during out-of-band implementation. Completion -requires subsequent independent review. - -## Progress Notes - -- [x] Stage 1 complete — `ansible-role-dnd-pipeline` commit `b515968`; fresh - dependency bootstrap and full `tests/integration` passed. No deviations. -- [x] Stage 2 complete — `ansible-role-dnd-pipeline` commit `61869d1`; fresh - dependency bootstrap and full `tests/integration` passed. No deviations. +Select and approve the next unit of work before replacing this notice with a +new staged implementation plan. diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md index 255bd8c..b14d7f2 100644 --- a/docs/roadmap/remediation.md +++ b/docs/roadmap/remediation.md @@ -1,71 +1,119 @@ -# Feature 0005 Remediation Review +# Feature 0006 Remediation Review Status: resolved Reviewed implementation commits: -- `3be78d8 Install and configure Narratio` -- `0e8ad9f Add focused Narratio integration coverage` +- `b515968 Compose the D&D pipeline roles` +- `61869d1 Add focused pipeline composition coverage` Remediation commit: -- `7feff47 Clean up Narratio review findings` +- `4ea4358 Clean up pipeline composition review findings` -The production role implements the targeted architecture, and the complete -integration suite passes. The findings were limited to residual documentation -and test-quality issues; no production task, template, default, argument -specification, metadata, or dependency required a change. +The production architecture matches Feature 0006: the role contains only its +public defaults and argument specification, five pinned role dependencies, +the approved variable forwarding, and fixed Narratio path wiring. Its task +file is empty, and it does not duplicate downstream tasks, templates, state +inspection, or validation. The complete integration entry point passes. -## Finding 1: Remove the Retained Placeholder README Sentence +The review identified two repository-quality findings. + +## Finding 1: Remove the Misleading Placeholder README Sentence Severity: low -`ansible-role-narratio/README.md` ended with the original placeholder sentence, -“Ansible role to install the Narratio D&D transcript and session report -generation suite.” The rewritten README already provided the complete role -description, so this was accidental residue from the initial repository. +`ansible-role-dnd-pipeline/README.md` still ends with the original placeholder +sentence claiming that the role installs the full production pipeline “plus +supporting assets.” Feature 0006 expressly defers campaign and prompt assets, +operator policy, secrets, and the opinionated D&D configuration layer. The +sentence is both redundant with the rewritten introduction and inaccurate for +the implemented foundation. + +The supported-platform summary also names Ubuntu 26.04 without recording the +roadmap's `amd64` and `arm64` boundary. + +### Required Remediation + +- Remove the retained placeholder sentence. +- State the supported `amd64` and `arm64` architectures in the rewritten + platform summary. +- Make no broader README expansion; the existing dependency, interface, + deferral, and validation documentation is otherwise aligned. ### Resolution -The retained placeholder sentence was removed without changing the substantive -role documentation. +The retained sentence was removed, and the introduction now records the +supported `amd64` and `arm64` architectures without expanding the role's +claimed scope. -## Finding 2: Make the Composition Test Non-vacuous +## Finding 2: Give the Isolated Dependency Path Resolution Priority Severity: low -`ansible-role-narratio/tests/representative.yml` claimed to exercise -caller-side composition, but both secondary fragments were empty. The verifier -consequently proved only that one original entry survived serialization. +`ansible-role-dnd-pipeline/tests/integration` installs the five pinned Git +roles into `$test_tmp/roles`, but sets `ANSIBLE_ROLES_PATH` with the workspace +parent before that isolated directory: + +```sh +export ANSIBLE_ROLES_PATH="$(dirname "$repository_root"):$test_tmp/roles" +``` + +No conflicting canonical role directories currently exist in the workspace, +so the reviewed run used the installed dependencies and passed. Nevertheless, +the ordering does not preserve the test's stated invariant if a +`rakestraw.` directory is later present in the parent path: +Ansible would resolve that checkout before the exact version installed from +`requirements.yml`. Feature 0006 requires the integration suite to exercise +the same pinned dependency combination delivered to consumers. + +### Required Remediation + +Put the fresh dependency path first while retaining the workspace parent only +as the fallback that resolves the pipeline role under test: + +```sh +export ANSIBLE_ROLES_PATH="$test_tmp/roles:$(dirname "$repository_root")" +``` + +Do not add dependency-content comparisons, source-revision assertions, or +other verification machinery. Ordinary Ansible role lookup with the correct +path precedence is sufficient. ### Resolution -The Scriptorium artifact map now combines two nonempty caller-defined -fragments, and the verifier checks one entry from each. Publish outputs use one -direct value so the suite retains only one representative composition case. -Native validation and the immediate clean repeat remain in place. - -## Finding 3: Use Ansible Privilege Escalation Directly in Verifiers - -Severity: low - -Both configuration verifiers escalated to root and then executed -`/usr/bin/sudo -u narratio` inside `ansible.builtin.command`, creating a -redundant second privilege transition. - -### Resolution - -Both verifier tasks now use `become_user: narratio` and invoke Narratio -directly. The integration driver enables pipelining and uses `/tmp` for -Ansible's transient module area, avoiding the local controller's otherwise -unmet temporary-file ACL requirement without adding a nested sudo command. +The integration driver now places its private dependency directory first and +uses the workspace parent only as the fallback for the pipeline role under +test. No additional dependency verification was added. ## Final Validation -`bash -n tests/integration`, the complete `tests/integration` suite, and -`git diff --check` passed after remediation. Syntax checking and -production-profile lint passed within the integration entry point. Baseline, -missing-binary recovery, and representative-configuration scenarios passed -their native Narratio checks as the application account, every required -immediate repeat reported `changed=0` and `failed=0`, and cleanup restored the -usable baseline deployment. No unresolved Feature 0005 findings remain. +From `ansible-role-dnd-pipeline`, run: + +```text +tests/integration +git diff --check +git status --short --branch +``` + +Expected result: dependency bootstrap, syntax checking, production lint, +baseline native checks, Narratio configuration validation, both immediate +clean repeats, the explicit Seriatim `v1.4.0` outcome, and baseline cleanup all +pass. The role repository contains only the intended remediation changes. + +## Review Validation Evidence + +During review, `tests/integration` completed successfully. It installed +`community.general` 13.3.0 and all five exact Git role revisions into private +temporary paths, passed syntax checking and production-profile ansible-lint, +validated the assembled applications through their native interfaces, and +reported `changed=0` and `failed=0` on both required immediate repeats. The +cleanup trap restored the baseline Seriatim `v1.5.0` deployment. `git diff +--check` also passed before this review record was written. + +After remediation, `bash -n tests/integration`, `git diff --check`, and the +complete `tests/integration` entry point passed again. The rerun installed the +exact pinned dependencies into fresh private paths, passed syntax and +production-profile lint, completed all native checks, reported `changed=0` and +`failed=0` on both required repeats, and restored the baseline suite. No +Feature 0006 findings remain. diff --git a/docs/status.md b/docs/status.md index d7aa7e4..859a2c4 100644 --- a/docs/status.md +++ b/docs/status.md @@ -4,7 +4,7 @@ Last updated: 2026-09-10 Current milestone: M1-03 suite-level pipeline role -Current focus: Review the staged Feature 0006 implementation plan. +Current focus: Select the next suite-level pipeline role feature. | ID | Deliverable | Owner | State | Evidence or next step | | --- | --- | --- | --- | --- | @@ -15,14 +15,14 @@ Current focus: Review the staged Feature 0006 implementation plan. | M0-05 | Suite-level role repository | ansible-role-dnd-pipeline | done | Repository created and added to `workspace.yml` | | M1-01 | Remaining MVP design decisions | workspace | done | Feature 0003 roadmap fixes the Notarius configuration interface | | M1-02 | Standalone application roles | role repositories | done | All five standalone roles implemented and independently reviewed | -| M1-03 | Suite-level pipeline role | ansible-role-dnd-pipeline | in_progress | Feature 0006 defines the dependency-composition foundation | +| M1-03 | Suite-level pipeline role | ansible-role-dnd-pipeline | in_progress | Composition foundation complete; select the next suite-policy feature | | M1-04 | Collection assembly | ansible-collection-dnd | proposed | Select and implement the pipeline-role incorporation mechanism | | F0001 | Install Seriatim from pinned source | ansible-role-seriatim | done | Implementation, integration coverage, and final remediation completed through `fb8dc41` | | F0002 | Install and configure Audita | ansible-role-audita | done | Field-specific configuration completed in `e61f02f` and `847c4c3`; full suite passed | | F0003 | Install and configure Notarius | ansible-role-notarius | done | Implemented and validated through remediation commit `eb4f511` | | F0004 | Install and configure Scriptorium | ansible-role-scriptorium | done | Implemented and validated through remediation commit `8f47aa8` | | F0005 | Install and configure Narratio | ansible-role-narratio | done | Implemented and validated through remediation commit `7feff47` | -| F0006 | Establish pipeline-role composition | ansible-role-dnd-pipeline | ready | Execute `docs/roadmap/implementation.md` after its review and dependency publication | +| F0006 | Establish pipeline-role composition | ansible-role-dnd-pipeline | done | Implemented and validated through remediation commit `4ea4358` | | A0001 | Audit completed standalone-role test suites | workspace and standalone roles | done | Findings recorded in `docs/roadmap/test-suite-audit-findings.md` | | R0001 | Simplify completed standalone-role test suites | workspace and standalone roles | done | Role commits `e08c63c`, `d2d0b9d`, and `cfecf37` passed implementation and independent review |