Complete the pipeline composition foundation

docs/roadmap/features/0006-pipeline-role-composition-foundation.md

@@ -1,6 +1,6 @@
 # Feature 0006: Pipeline Role Composition Foundation
 
-Status: ready
+Status: done
 
 ## Summary
 
@@ -374,6 +374,12 @@ standalone roles' field-specific variables rather than adding pipeline-owned
 configuration templates or duplicating every downstream setting behind a new
 alias.
 
+The feature was implemented in `ansible-role-dnd-pipeline` commits `b515968`
+and `61869d1`, then finalized by review remediation commit `4ea4358`. The
+complete integration suite passes with fresh dependency bootstrap, native
+application validation, explicit suite-level version selection, and clean
+repeated convergence.
+
 ## Potential Future Hardening
 
 - Verify signed role or application releases.

docs/roadmap/implementation.md

@@ -1,382 +1,14 @@
-# Implementation Plan 0006: Establish Pipeline Role Composition
+# Implementation Plan
 
-Status: ready
+Status: pending
 
-Target executor: GPT-5.6-Terra
+No implementation plan is currently active. Feature 0006 was implemented in
+`ansible-role-dnd-pipeline` commits `b515968` and `61869d1`, independently
+reviewed, and finalized by remediation commit `4ea4358`.
 
-Feature roadmap:
+Its durable scope and rationale remain in
-[Feature 0006: Pipeline Role Composition Foundation](features/0006-pipeline-role-composition-foundation.md)
+[the Feature 0006 roadmap](features/0006-pipeline-role-composition-foundation.md),
+and its final review record remains in [the remediation record](remediation.md).
 
-Active plan location: `docs/roadmap/implementation.md`
+Select and approve the next unit of work before replacing this notice with a
-
+new staged implementation plan.
-## Objective
-
-Implement the independently developed `rakestraw.dnd_pipeline` role defined by
-Feature 0006. Compose the five completed standalone application roles through
-ordinary dependency metadata, install them reproducibly from a Git dependency
-manifest, expose the approved suite-level variables, and wire Narratio to the
-standard downstream application paths.
-
-The feature roadmap remains authoritative for scope, rationale, target end
-state, public variables, dependency revisions, and acceptance criteria.
-
-## Execution Rules
-
-- Execute Stage 1 and Stage 2 in numeric order.
-- Immediately before each stage, read every document in that stage's Required
-  Policy Review, then confirm its preconditions and the owning repository's
-  working-tree state.
-- Modify only `ansible-role-dnd-pipeline`. Treat the workspace control
-  repository, standalone application roles, application sources, asset
-  repositories, collection, and proof of concept as read-only during
-  out-of-band implementation.
-- Preserve unrelated changes. Stop if the pipeline-role repository is
-  unexpectedly dirty at a stage boundary.
-- Use ordinary role dependency metadata. Do not copy downstream tasks or
-  templates, add a loader role, or surround role invocation with state probes
-  or result inspection.
-- Define only the nine suite-owned variables fixed by the feature roadmap. Do
-  not alias the complete standalone interfaces or add raw downstream-variable
-  maps, path overrides, component switches, content settings, operator
-  settings, or secret settings.
-- Pass the common build-dependency switch, Go channel, and Go executable to
-  all five dependencies. Pass each selected application version only to its
-  corresponding dependency.
-- Pass the required WhisperX URL and the roadmap's fixed downstream binary and
-  configuration paths to Narratio. Install Notarius without enabling it in
-  Narratio.
-- Trust each dependency to establish its documented state. Do not test or
-  reimplement APT, Snap, Git, file, template, account, or build behavior in
-  production pipeline-role logic.
-- Keep behavioral tests at the composition boundary. Prove that the assembled
-  applications are usable, Narratio accepts the assembled configuration, a
-  suite version override reaches its application role, and an immediate
-  repeat is clean. Do not rerun the standalone roles' behavior matrices.
-- Do not assert current default versions, exact dependency pins, task order,
-  task traces, file metadata, package state, checkout state, or other trusted
-  module postconditions in behavioral tests.
-- Use fully qualified collection names. Run each stage's validation before
-  committing it, and do not begin Stage 2 if Stage 1 fails validation.
-- Commit each completed stage with its specified plain-English message. Do not
-  push during out-of-band implementation.
-- Test cleanup may reapply the baseline pipeline role and remove only the
-  integration driver's private temporary directory. Do not delete campaign,
-  prompt, runtime, or other caller content.
-
-## Starting State and Preconditions
-
-- `ansible-role-dnd-pipeline` is clean on `main` at
-  `1a66d177cdd5d948c94c291b718c779dbbfd1f91`, tracking `origin/main` without
-  divergence.
-- This plan, the ready Feature 0006 roadmap, and the corresponding workspace
-  documentation and status updates are committed before out-of-band execution
-  begins.
-- The exact dependency commits fixed by Feature 0006 are reachable from their
-  declared remote repositories before Stage 1 begins. At plan preparation,
-  all five commits are local-only and must be pushed:
-
-  | Dependency | Required commit | Current `origin/main` |
-  | --- | --- | --- |
-  | Audita role | `d2d0b9d00b3b491ce7613ccfc8f686f3d1fa0896` | `3a8c21f0e61c62dbb603ba0f3fdfab1fd3b1de09` |
-  | Narratio role | `7feff4728a5968b6b1dd87e83add9fa1a9066b18` | `b97a317f9ec9f15675e81c65af3f4a1ad8176886` |
-  | Notarius role | `cfecf37261f2595d45113235c591ee102d6f181f` | `f8a3e113ef4975b2c2745cb3f08500b2206c3f21` |
-  | Seriatim role | `e08c63c0b078658bdfa2d10a2e6e1e4f9372a075` | `fb8dc4100c029e25c4ab507645d75df0d739fe66` |
-  | Scriptorium role | `8f47aa802a5e0c9dae9c0f43a1c70b3512b2c8b2` | `2cd69a4b2ead23b44f1aab51fd1b1f14ac326af2` |
-
-- The local controller and managed-host proxy are Ubuntu 26.04 `x86_64`, with
-  gathered facts and passwordless task-level privilege escalation available.
-- Workspace tooling is available in `../.venv/bin` from the pipeline-role
-  repository: Ansible Core 2.21.3 and ansible-lint 26.8.0.
-- `community.general` 13.3.0 and Go Snap channel `1.26/stable` are available.
-- The five application binaries and their current managed state may already
-  exist from standalone-role development. The integration suite must converge
-  from that state without treating prior installation as test evidence or
-  deleting unrelated content.
-- Seriatim tag `v1.4.0` remains available for the explicit suite-level version
-  override case and reports `seriatim version v1.4.0` through its native
-  version command.
-- Narratio can validate the baseline assembled pipeline without contacting the
-  syntactically valid test WhisperX URL. Notarius remains disabled, and no
-  campaign, prompt library, credentials, or session input is required for
-  configuration validation.
-
-## Repository Scope
-
-Repository that changes:
-
-- `ansible-role-dnd-pipeline`: public interface, dependency metadata and
-  manifests, documentation, and focused repository-local integration suite.
-
-Repositories that may be inspected but must remain unchanged:
-
-- `ansible-workspace-dnd`: authoritative roadmap, plan, policies, inventory,
-  and status.
-- `ansible-role-{audita,narratio,notarius,seriatim,scriptorium}`: authoritative
-  dependency interfaces and reviewed implementations.
-- `../{audita,narratio,notarius,seriatim,scriptorium}`: authoritative native
-  application contracts.
-- `assets/campaigns` and `assets/narratio-prompts`: future content inputs,
-  outside this feature.
-- `ansible-collection-dnd`: future collection assembly target.
-- `rakestraw-ansible`: historical style and deployment reference.
-- Every other repository in `workspace.yml`.
-
-## Stage 1: Compose the Five Application Roles
-
-### Objective
-
-Create a complete standalone pipeline role whose metadata installs the five
-applications with the approved suite interface, dependency pins, and
-cross-application path wiring, then demonstrate baseline native usability and
-clean repeated convergence.
-
-### Required Policy Review
-
-Before beginning this stage, read:
-
-- `AGENTS.md`
-- `docs/orientation.md`
-- `docs/conventions.md`
-- `docs/ansible.md`
-- `docs/testing.md`
-
-### Preconditions
-
-- The starting revision and tool versions above remain valid.
-- `ansible-role-dnd-pipeline` has no uncommitted changes.
-- The workspace planning commit containing this plan exists.
-- Every required dependency commit is fetchable from its roadmap-declared Git
-  URL. Confirm this through a fresh `ansible-galaxy role install`; do not
-  substitute local role directories for the remote dependency test.
-- Existing managed application and runtime paths contain no test-created
-  corruption that prevents ordinary role convergence. Preserve any campaign,
-  prompt, session, or other caller content already present.
-
-### Owning Repository
-
-`ansible-role-dnd-pipeline`
-
-### Required Changes
-
-1. Retain the existing license and create the conventional role structure:
-   `defaults/main.yml`, `meta/main.yml`, `meta/argument_specs.yml`,
-   `tasks/main.yml`, `requirements.yml`, `collections/requirements.yml`,
-   `ansible.cfg`, and focused files under `tests/`.
-2. Declare role name `dnd_pipeline`, namespace `rakestraw`, author Eric
-   Rakestraw, license `CC0-1.0`, Ubuntu 26.04 support, Ansible Core 2.18 or
-   newer, the canonical issue tracker, and appropriate pipeline tags.
-3. Define exactly the Feature 0006 Fixed Public Interface in defaults and
-   matching argument specifications:
-   - default the five `dnd_pipeline_*_version` variables to their roadmap
-     releases;
-   - default `dnd_pipeline_manage_build_dependencies` to `true`;
-   - default `dnd_pipeline_go_snap_channel` to `1.26/stable`;
-   - default `dnd_pipeline_go_binary` to `/snap/bin/go`; and
-   - require `dnd_pipeline_whisperx_transcribe_url` as a string without
-     inventing a default.
-4. Add a root `requirements.yml` containing the five Git role dependencies in
-   the roadmap's canonical names and at the exact reviewed commits. Add
-   `collections/requirements.yml` pinning `community.general` to `13.3.0`.
-5. Declare these dependencies in `meta/main.yml`, in this order: Seriatim,
-   Audita, Notarius, Scriptorium, Narratio. Map each suite version to the
-   corresponding application `*_version` variable and map the common
-   dependency-management, Go channel, and Go executable values to all five
-   roles.
-6. In the Narratio dependency declaration, additionally pass:
-   - `dnd_pipeline_whisperx_transcribe_url` as
-     `narratio_whisperx_transcribe_url`;
-   - `/usr/local/bin/seriatim` as `narratio_seriatim_binary`;
-   - `/usr/local/bin/audita` and `/usr/local/etc/audita/config.yml` as the
-     corresponding Narratio Audita values;
-   - `/usr/local/bin/notarius` and `/usr/local/etc/notarius/config.yml` as the
-     corresponding Narratio Notarius path values; and
-   - `/usr/local/bin/scriptorium` and
-     `/usr/local/etc/scriptorium/config.yml` as the corresponding Narratio
-     Scriptorium values.
-   Do not set `narratio_notarius_enabled` or supply D&D processing policy.
-7. Keep `tasks/main.yml` empty except for its YAML document marker if Ansible
-   requires the file. Dependency metadata is the complete production
-   implementation for this feature; do not add wrapper tasks, assertions,
-   probes, facts, handlers, or post-dependency validation.
-8. Replace the placeholder README with concise documentation covering the
-   supported platform, dependency bootstrap commands, canonical installed
-   role names, all nine suite variables, required WhisperX URL, compatible
-   default application set, common dependency opt-out and Go behavior,
-   standard cross-application paths, direct use of unmapped standalone role
-   variables, Notarius's disabled state, later collection name, deferred
-   content/operators/secrets, and actual integration-test behavior.
-9. Add a baseline local integration harness with one executable
-   `tests/integration` entry point. Use strict shell options,
-   repository-relative paths, a mode-`0700` private temporary directory, an
-   isolated roles path, an isolated collections path, syntax checking,
-   production-profile ansible-lint, and best-effort cleanup that reapplies the
-   baseline role and removes only the private temporary directory.
-10. Install `community.general` from `collections/requirements.yml` and install
-    all five roles from `requirements.yml` into the fresh isolated roles path.
-    Resolve the pipeline role itself from the working repository without
-    replacing any dependency with a workspace sibling checkout.
-11. Apply the pipeline role without play-level escalation and supply only a
-    syntactically valid local test value for
-    `dnd_pipeline_whisperx_transcribe_url`. Exercise the installed applications
-    with concise native smoke or configuration commands without asserting
-    their current default versions. Validate the assembled Narratio pipeline
-    natively as the `narratio` application account without contacting
-    WhisperX.
-12. Immediately apply the identical baseline invocation again and require the
-    aggregate recap to report `changed=0` and `failed=0`.
-13. Do not assert downstream file existence, ownership, permissions, package
-    state, Git state, dependency order, exact default versions, complete
-    configuration content, or individual task results. Successful native use
-    and clean repeated convergence are the stage's behavioral evidence.
-
-### Validation
-
-From `ansible-role-dnd-pipeline`, run:
-
-```text
-tests/integration
-git diff --check
-git status --short
-```
-
-Expected result: both manifests install into fresh isolated paths; syntax and
-lint pass; the real pipeline role composes all five dependencies; their native
-smoke/configuration commands and Narratio's assembled configuration validation
-succeed; the immediate repeat reports `changed=0` and `failed=0`; cleanup
-leaves the baseline suite usable; and only intended Stage 1 files are modified.
-
-### Completion Criteria
-
-- Defaults and argument specifications implement exactly the nine-variable
-  suite interface, with only the WhisperX URL required.
-- Git and collection manifests use the exact approved names, URLs, revisions,
-  and collection version.
-- Dependency metadata contains the five roles in the settled order and passes
-  only the approved coordinated values and Narratio path wiring.
-- The production role contains no duplicated downstream implementation or
-  additional task machinery.
-- README and metadata accurately describe the role, bootstrap procedure,
-  public interface, composition boundary, and current non-goals.
-- Fresh dependency bootstrap, static validation, baseline native behavior, and
-  immediate clean convergence pass.
-- No repository outside `ansible-role-dnd-pipeline` changes.
-
-### Commit
-
-Commit intent: `Compose the D&D pipeline roles`
-
-## Stage 2: Add Focused Composition Coverage
-
-### Objective
-
-Prove through one representative override that suite-owned version selection
-reaches the appropriate application role, while retaining the lean baseline
-composition test and restoring the approved default suite afterward.
-
-### Required Policy Review
-
-Before beginning this stage, read:
-
-- `AGENTS.md`
-- `docs/orientation.md`
-- `docs/conventions.md`
-- `docs/ansible.md`
-- `docs/testing.md`
-
-### Preconditions
-
-- Stage 1 is committed and `ansible-role-dnd-pipeline` is otherwise clean.
-- Stage 1's complete integration entry point passes.
-- The isolated dependency bootstrap still resolves all five exact Git commits.
-- Applying the baseline pipeline inputs can restore the compatible default
-  suite after the representative version override.
-
-### Owning Repository
-
-`ansible-role-dnd-pipeline`
-
-### Required Changes
-
-1. Retain the Stage 1 baseline native smoke/configuration checks and immediate
-   clean repeat. Extend the existing integration entry point rather than
-   introducing another framework, scenario tree, or cross-repository helper.
-2. Add one representative convergence that explicitly sets
-   `dnd_pipeline_seriatim_version: v1.4.0` while supplying the same test
-   WhisperX URL.
-3. Execute Seriatim's native version interface and require
-   `seriatim version v1.4.0`. This proves suite-variable forwarding; do not
-   inspect role defaults, dependency metadata, the source checkout, or task
-   results to establish it.
-4. Immediately repeat the same explicit-version invocation and require the
-   aggregate recap to report `changed=0` and `failed=0`.
-5. Ensure the cleanup trap reapplies the baseline pipeline role without the
-   version override so the managed host returns to the approved compatible
-   default suite on success or failure when possible.
-6. Do not add version assertions for the other applications, a common-Go
-   forwarding probe, missing-binary recovery, configuration branch cases,
-   platform matrices, dependency-order checks, file or package assertions, or
-   an end-to-end transcript run. Those behaviors are either already owned by
-   standalone suites or explicitly deferred by Feature 0006.
-7. Update the README validation section only as needed so it accurately
-   describes the baseline composition, native validation, clean repeats, and
-   one explicit Seriatim version-selection case.
-
-### Validation
-
-From `ansible-role-dnd-pipeline`, run:
-
-```text
-tests/integration
-git diff --check
-git status --short
-```
-
-Expected result: fresh dependency bootstrap and all Stage 1 checks still pass;
-the suite-level Seriatim override installs `v1.4.0` as observed through native
-version output; both required repeat runs report `changed=0` and `failed=0`;
-cleanup restores the baseline compatible suite; and only intended Stage 2 test
-and documentation changes are present.
-
-### Completion Criteria
-
-- One explicit non-default application revision proves the suite's version
-  forwarding behavior through a native application outcome.
-- Baseline composition, assembled Narratio validation, and both clean-repeat
-  cases remain successful.
-- Test cleanup restores the baseline suite without deleting caller content.
-- Tests remain focused on composition and do not reproduce standalone-role
-  coverage or freeze current defaults and implementation details.
-- README test documentation remains accurate.
-- No repository outside `ansible-role-dnd-pipeline` changes.
-
-### Commit
-
-Commit intent: `Add focused pipeline composition coverage`
-
-## Final Validation and Handoff
-
-After Stage 2, from `ansible-role-dnd-pipeline`, run:
-
-```text
-tests/integration
-git log --oneline -2
-git status --short --branch
-cd ..
-./scripts/status
-```
-
-Report both pipeline-role commit hashes, dependency-bootstrap evidence, static
-and behavioral validation results, clean-repeat evidence, baseline restoration,
-any deviation or remaining concern, and any complexity beyond dependency
-metadata with the acceptance criterion that required it.
-
-Do not edit workspace planning files, mark Feature 0006 `done`, modify asset or
-dependency repositories, or push during out-of-band implementation. Completion
-requires subsequent independent review.
-
-## Progress Notes
-
-- [x] Stage 1 complete — `ansible-role-dnd-pipeline` commit `b515968`; fresh
-  dependency bootstrap and full `tests/integration` passed. No deviations.
-- [x] Stage 2 complete — `ansible-role-dnd-pipeline` commit `61869d1`; fresh
-  dependency bootstrap and full `tests/integration` passed. No deviations.

docs/roadmap/remediation.md

@@ -1,71 +1,119 @@
-# Feature 0005 Remediation Review
+# Feature 0006 Remediation Review
 
 Status: resolved
 
 Reviewed implementation commits:
 
-- `3be78d8 Install and configure Narratio`
+- `b515968 Compose the D&D pipeline roles`
-- `0e8ad9f Add focused Narratio integration coverage`
+- `61869d1 Add focused pipeline composition coverage`
 
 Remediation commit:
 
-- `7feff47 Clean up Narratio review findings`
+- `4ea4358 Clean up pipeline composition review findings`
 
-The production role implements the targeted architecture, and the complete
+The production architecture matches Feature 0006: the role contains only its
-integration suite passes. The findings were limited to residual documentation
+public defaults and argument specification, five pinned role dependencies,
-and test-quality issues; no production task, template, default, argument
+the approved variable forwarding, and fixed Narratio path wiring. Its task
-specification, metadata, or dependency required a change.
+file is empty, and it does not duplicate downstream tasks, templates, state
+inspection, or validation. The complete integration entry point passes.
 
-## Finding 1: Remove the Retained Placeholder README Sentence
+The review identified two repository-quality findings.
+
+## Finding 1: Remove the Misleading Placeholder README Sentence
 
 Severity: low
 
-`ansible-role-narratio/README.md` ended with the original placeholder sentence,
+`ansible-role-dnd-pipeline/README.md` still ends with the original placeholder
-“Ansible role to install the Narratio D&D transcript and session report
+sentence claiming that the role installs the full production pipeline “plus
-generation suite.” The rewritten README already provided the complete role
+supporting assets.” Feature 0006 expressly defers campaign and prompt assets,
-description, so this was accidental residue from the initial repository.
+operator policy, secrets, and the opinionated D&D configuration layer. The
+sentence is both redundant with the rewritten introduction and inaccurate for
+the implemented foundation.
+
+The supported-platform summary also names Ubuntu 26.04 without recording the
+roadmap's `amd64` and `arm64` boundary.
+
+### Required Remediation
+
+- Remove the retained placeholder sentence.
+- State the supported `amd64` and `arm64` architectures in the rewritten
+  platform summary.
+- Make no broader README expansion; the existing dependency, interface,
+  deferral, and validation documentation is otherwise aligned.
 
 ### Resolution
 
-The retained placeholder sentence was removed without changing the substantive
+The retained sentence was removed, and the introduction now records the
-role documentation.
+supported `amd64` and `arm64` architectures without expanding the role's
+claimed scope.
 
-## Finding 2: Make the Composition Test Non-vacuous
+## Finding 2: Give the Isolated Dependency Path Resolution Priority
 
 Severity: low
 
-`ansible-role-narratio/tests/representative.yml` claimed to exercise
+`ansible-role-dnd-pipeline/tests/integration` installs the five pinned Git
-caller-side composition, but both secondary fragments were empty. The verifier
+roles into `$test_tmp/roles`, but sets `ANSIBLE_ROLES_PATH` with the workspace
-consequently proved only that one original entry survived serialization.
+parent before that isolated directory:
+
+```sh
+export ANSIBLE_ROLES_PATH="$(dirname "$repository_root"):$test_tmp/roles"
+```
+
+No conflicting canonical role directories currently exist in the workspace,
+so the reviewed run used the installed dependencies and passed. Nevertheless,
+the ordering does not preserve the test's stated invariant if a
+`rakestraw.<application>` directory is later present in the parent path:
+Ansible would resolve that checkout before the exact version installed from
+`requirements.yml`. Feature 0006 requires the integration suite to exercise
+the same pinned dependency combination delivered to consumers.
+
+### Required Remediation
+
+Put the fresh dependency path first while retaining the workspace parent only
+as the fallback that resolves the pipeline role under test:
+
+```sh
+export ANSIBLE_ROLES_PATH="$test_tmp/roles:$(dirname "$repository_root")"
+```
+
+Do not add dependency-content comparisons, source-revision assertions, or
+other verification machinery. Ordinary Ansible role lookup with the correct
+path precedence is sufficient.
 
 ### Resolution
 
-The Scriptorium artifact map now combines two nonempty caller-defined
+The integration driver now places its private dependency directory first and
-fragments, and the verifier checks one entry from each. Publish outputs use one
+uses the workspace parent only as the fallback for the pipeline role under
-direct value so the suite retains only one representative composition case.
+test. No additional dependency verification was added.
-Native validation and the immediate clean repeat remain in place.
-
-## Finding 3: Use Ansible Privilege Escalation Directly in Verifiers
-
-Severity: low
-
-Both configuration verifiers escalated to root and then executed
-`/usr/bin/sudo -u narratio` inside `ansible.builtin.command`, creating a
-redundant second privilege transition.
-
-### Resolution
-
-Both verifier tasks now use `become_user: narratio` and invoke Narratio
-directly. The integration driver enables pipelining and uses `/tmp` for
-Ansible's transient module area, avoiding the local controller's otherwise
-unmet temporary-file ACL requirement without adding a nested sudo command.
 
 ## Final Validation
 
-`bash -n tests/integration`, the complete `tests/integration` suite, and
+From `ansible-role-dnd-pipeline`, run:
-`git diff --check` passed after remediation. Syntax checking and
+
-production-profile lint passed within the integration entry point. Baseline,
+```text
-missing-binary recovery, and representative-configuration scenarios passed
+tests/integration
-their native Narratio checks as the application account, every required
+git diff --check
-immediate repeat reported `changed=0` and `failed=0`, and cleanup restored the
+git status --short --branch
-usable baseline deployment. No unresolved Feature 0005 findings remain.
+```
+
+Expected result: dependency bootstrap, syntax checking, production lint,
+baseline native checks, Narratio configuration validation, both immediate
+clean repeats, the explicit Seriatim `v1.4.0` outcome, and baseline cleanup all
+pass. The role repository contains only the intended remediation changes.
+
+## Review Validation Evidence
+
+During review, `tests/integration` completed successfully. It installed
+`community.general` 13.3.0 and all five exact Git role revisions into private
+temporary paths, passed syntax checking and production-profile ansible-lint,
+validated the assembled applications through their native interfaces, and
+reported `changed=0` and `failed=0` on both required immediate repeats. The
+cleanup trap restored the baseline Seriatim `v1.5.0` deployment. `git diff
+--check` also passed before this review record was written.
+
+After remediation, `bash -n tests/integration`, `git diff --check`, and the
+complete `tests/integration` entry point passed again. The rerun installed the
+exact pinned dependencies into fresh private paths, passed syntax and
+production-profile lint, completed all native checks, reported `changed=0` and
+`failed=0` on both required repeats, and restored the baseline suite. No
+Feature 0006 findings remain.

docs/status.md

@@ -4,7 +4,7 @@ Last updated: 2026-09-10
 
 Current milestone: M1-03 suite-level pipeline role
 
-Current focus: Review the staged Feature 0006 implementation plan.
+Current focus: Select the next suite-level pipeline role feature.
 
 | ID | Deliverable | Owner | State | Evidence or next step |
 | --- | --- | --- | --- | --- |
@@ -15,14 +15,14 @@ Current focus: Review the staged Feature 0006 implementation plan.
 | M0-05 | Suite-level role repository | ansible-role-dnd-pipeline | done | Repository created and added to `workspace.yml` |
 | M1-01 | Remaining MVP design decisions | workspace | done | Feature 0003 roadmap fixes the Notarius configuration interface |
 | M1-02 | Standalone application roles | role repositories | done | All five standalone roles implemented and independently reviewed |
-| M1-03 | Suite-level pipeline role | ansible-role-dnd-pipeline | in_progress | Feature 0006 defines the dependency-composition foundation |
+| M1-03 | Suite-level pipeline role | ansible-role-dnd-pipeline | in_progress | Composition foundation complete; select the next suite-policy feature |
 | M1-04 | Collection assembly | ansible-collection-dnd | proposed | Select and implement the pipeline-role incorporation mechanism |
 | F0001 | Install Seriatim from pinned source | ansible-role-seriatim | done | Implementation, integration coverage, and final remediation completed through `fb8dc41` |
 | F0002 | Install and configure Audita | ansible-role-audita | done | Field-specific configuration completed in `e61f02f` and `847c4c3`; full suite passed |
 | F0003 | Install and configure Notarius | ansible-role-notarius | done | Implemented and validated through remediation commit `eb4f511` |
 | F0004 | Install and configure Scriptorium | ansible-role-scriptorium | done | Implemented and validated through remediation commit `8f47aa8` |
 | F0005 | Install and configure Narratio | ansible-role-narratio | done | Implemented and validated through remediation commit `7feff47` |
-| F0006 | Establish pipeline-role composition | ansible-role-dnd-pipeline | ready | Execute `docs/roadmap/implementation.md` after its review and dependency publication |
+| F0006 | Establish pipeline-role composition | ansible-role-dnd-pipeline | done | Implemented and validated through remediation commit `4ea4358` |
 | A0001 | Audit completed standalone-role test suites | workspace and standalone roles | done | Findings recorded in `docs/roadmap/test-suite-audit-findings.md` |
 | R0001 | Simplify completed standalone-role test suites | workspace and standalone roles | done | Role commits `e08c63c`, `d2d0b9d`, and `cfecf37` passed implementation and independent review |