Complete the pipeline composition foundation

docs/roadmap/remediation.md

@@ -1,71 +1,119 @@
-# Feature 0005 Remediation Review
+# Feature 0006 Remediation Review
 
 Status: resolved
 
 Reviewed implementation commits:
 
-- `3be78d8 Install and configure Narratio`
-- `0e8ad9f Add focused Narratio integration coverage`
+- `b515968 Compose the D&D pipeline roles`
+- `61869d1 Add focused pipeline composition coverage`
 
 Remediation commit:
 
-- `7feff47 Clean up Narratio review findings`
+- `4ea4358 Clean up pipeline composition review findings`
 
-The production role implements the targeted architecture, and the complete
-integration suite passes. The findings were limited to residual documentation
-and test-quality issues; no production task, template, default, argument
-specification, metadata, or dependency required a change.
+The production architecture matches Feature 0006: the role contains only its
+public defaults and argument specification, five pinned role dependencies,
+the approved variable forwarding, and fixed Narratio path wiring. Its task
+file is empty, and it does not duplicate downstream tasks, templates, state
+inspection, or validation. The complete integration entry point passes.
 
-## Finding 1: Remove the Retained Placeholder README Sentence
+The review identified two repository-quality findings.
+
+## Finding 1: Remove the Misleading Placeholder README Sentence
 
 Severity: low
 
-`ansible-role-narratio/README.md` ended with the original placeholder sentence,
-“Ansible role to install the Narratio D&D transcript and session report
-generation suite.” The rewritten README already provided the complete role
-description, so this was accidental residue from the initial repository.
+`ansible-role-dnd-pipeline/README.md` still ends with the original placeholder
+sentence claiming that the role installs the full production pipeline “plus
+supporting assets.” Feature 0006 expressly defers campaign and prompt assets,
+operator policy, secrets, and the opinionated D&D configuration layer. The
+sentence is both redundant with the rewritten introduction and inaccurate for
+the implemented foundation.
+
+The supported-platform summary also names Ubuntu 26.04 without recording the
+roadmap's `amd64` and `arm64` boundary.
+
+### Required Remediation
+
+- Remove the retained placeholder sentence.
+- State the supported `amd64` and `arm64` architectures in the rewritten
+  platform summary.
+- Make no broader README expansion; the existing dependency, interface,
+  deferral, and validation documentation is otherwise aligned.
 
 ### Resolution
 
-The retained placeholder sentence was removed without changing the substantive
-role documentation.
+The retained sentence was removed, and the introduction now records the
+supported `amd64` and `arm64` architectures without expanding the role's
+claimed scope.
 
-## Finding 2: Make the Composition Test Non-vacuous
+## Finding 2: Give the Isolated Dependency Path Resolution Priority
 
 Severity: low
 
-`ansible-role-narratio/tests/representative.yml` claimed to exercise
-caller-side composition, but both secondary fragments were empty. The verifier
-consequently proved only that one original entry survived serialization.
+`ansible-role-dnd-pipeline/tests/integration` installs the five pinned Git
+roles into `$test_tmp/roles`, but sets `ANSIBLE_ROLES_PATH` with the workspace
+parent before that isolated directory:
+
+```sh
+export ANSIBLE_ROLES_PATH="$(dirname "$repository_root"):$test_tmp/roles"
+```
+
+No conflicting canonical role directories currently exist in the workspace,
+so the reviewed run used the installed dependencies and passed. Nevertheless,
+the ordering does not preserve the test's stated invariant if a
+`rakestraw.<application>` directory is later present in the parent path:
+Ansible would resolve that checkout before the exact version installed from
+`requirements.yml`. Feature 0006 requires the integration suite to exercise
+the same pinned dependency combination delivered to consumers.
+
+### Required Remediation
+
+Put the fresh dependency path first while retaining the workspace parent only
+as the fallback that resolves the pipeline role under test:
+
+```sh
+export ANSIBLE_ROLES_PATH="$test_tmp/roles:$(dirname "$repository_root")"
+```
+
+Do not add dependency-content comparisons, source-revision assertions, or
+other verification machinery. Ordinary Ansible role lookup with the correct
+path precedence is sufficient.
 
 ### Resolution
 
-The Scriptorium artifact map now combines two nonempty caller-defined
-fragments, and the verifier checks one entry from each. Publish outputs use one
-direct value so the suite retains only one representative composition case.
-Native validation and the immediate clean repeat remain in place.
-
-## Finding 3: Use Ansible Privilege Escalation Directly in Verifiers
-
-Severity: low
-
-Both configuration verifiers escalated to root and then executed
-`/usr/bin/sudo -u narratio` inside `ansible.builtin.command`, creating a
-redundant second privilege transition.
-
-### Resolution
-
-Both verifier tasks now use `become_user: narratio` and invoke Narratio
-directly. The integration driver enables pipelining and uses `/tmp` for
-Ansible's transient module area, avoiding the local controller's otherwise
-unmet temporary-file ACL requirement without adding a nested sudo command.
+The integration driver now places its private dependency directory first and
+uses the workspace parent only as the fallback for the pipeline role under
+test. No additional dependency verification was added.
 
 ## Final Validation
 
-`bash -n tests/integration`, the complete `tests/integration` suite, and
-`git diff --check` passed after remediation. Syntax checking and
-production-profile lint passed within the integration entry point. Baseline,
-missing-binary recovery, and representative-configuration scenarios passed
-their native Narratio checks as the application account, every required
-immediate repeat reported `changed=0` and `failed=0`, and cleanup restored the
-usable baseline deployment. No unresolved Feature 0005 findings remain.
+From `ansible-role-dnd-pipeline`, run:
+
+```text
+tests/integration
+git diff --check
+git status --short --branch
+```
+
+Expected result: dependency bootstrap, syntax checking, production lint,
+baseline native checks, Narratio configuration validation, both immediate
+clean repeats, the explicit Seriatim `v1.4.0` outcome, and baseline cleanup all
+pass. The role repository contains only the intended remediation changes.
+
+## Review Validation Evidence
+
+During review, `tests/integration` completed successfully. It installed
+`community.general` 13.3.0 and all five exact Git role revisions into private
+temporary paths, passed syntax checking and production-profile ansible-lint,
+validated the assembled applications through their native interfaces, and
+reported `changed=0` and `failed=0` on both required immediate repeats. The
+cleanup trap restored the baseline Seriatim `v1.5.0` deployment. `git diff
+--check` also passed before this review record was written.
+
+After remediation, `bash -n tests/integration`, `git diff --check`, and the
+complete `tests/integration` entry point passed again. The rerun installed the
+exact pinned dependencies into fresh private paths, passed syntax and
+production-profile lint, completed all native checks, reported `changed=0` and
+`failed=0` on both required repeats, and restored the baseline suite. No
+Feature 0006 findings remain.