# Feature 0022 Remediation Review Status: resolved Reviewed on 2026-09-29: - Pipeline `8ea8621` and `ea8b09e`. - Collection subtree import through `a78c309` and assembly `3d77eb3`. - Consumer `f694dad`. The production wiring implements the approved coordinated versions, Audita backend/profile assets, credential lists, overlay paths, and nullable retry controls. The collection's imported pipeline tree exactly matches the source role. The following test-policy and operator-documentation issues were found and have now been addressed as recorded below. Git history preserves the previously resolved Feature 0013 remediation record. ## Finding 1: New assertions freeze unconfigured suite defaults Priority: P2 Owners: pipeline role and collection tests. Locations: - `ansible-role-dnd-pipeline/tests/integration:172`–173. - `ansible-collection-dnd/tests/integration:104`–105 and 108–109. The new baseline assertions require specific Audita profile IDs and Narratio credential lists, but the cases do not explicitly supply the corresponding selection/list variables. Supplying synthetic values in `dnd_pipeline_secrets` does not select the credential lists. These assertions therefore fail when legitimate defaults change, even if installation and caller overrides work. Required correction: remove redundant default-identity assertions from the baseline smoke case, or explicitly supply the relevant public inputs and assert those values. The pipeline already has a useful custom-credential override case; prefer reusing its coverage. Keep native validation and clean repeats. Do not replace literals by reading role defaults into expectations; that would still test implementation identity rather than caller behavior. This strengthens acceptance beyond the user's state-based testing policy. The approved plan explicitly asked for supplied-value tests, not default snapshots. ## Finding 2: Upgrade guidance confuses configuration with session migration Priority: P2 Owners: pipeline README and consumer deployment guidance. Locations: - `ansible-role-dnd-pipeline/README.md:166`–168 and 337–338. - `rakestraw-ansible/docs/pipeline-dnd.md:86`–104. The pipeline links “Audita's v2 manifest migration” to Audita's configuration migration guide, but does not identify Narratio's actual session-manifest migration. The consumer likewise refers to “Audita manifests” and only generically warns about Narratio manifests. The roadmap specifically requires guidance on backing up and migrating local provenance while preserving progress and immutable snapshots. Existing Narratio manifests containing `effective_config.selected_profile` are rejected by v3. Required correction: - Describe Audita's change as a configuration/backend/profile migration. - Link Narratio v3's exact operations section `#migrating-manifest-overlay-provenance`; briefly explain backup and `effective_config.selected_profile` → `selected_overlay` (or removal as upstream permits), preserving stage/checkpoint state and leaving immutable remote snapshots unchanged. Do not add automatic migration or forced reruns. - Correct or remove the stale claim that Notarius v0.8.1 selects PromptKit v0.10.0. Its tagged release specifies v0.11.2; prefer linking upstream release notes over duplicating dependency/catalog versions. This is a missing operator handoff, not a request for additional runtime code. ## Finding 3: Documentation makes managed secret files mandatory Priority: P2 Owners: pipeline README and consumer deployment guidance. Locations: - `ansible-role-dnd-pipeline/README.md:160`–163. - `rakestraw-ansible/docs/pipeline-dnd.md:69`–71. The new text requires each credential to be supplied through `dnd_pipeline_secrets`. Runtime behavior does not require that: Narratio can resolve listed names from its process environment or existing secret files. The README's existing managed-credentials section already describes environment precedence and an empty default secrets map. Required correction: require the credential names in the forwarding lists, but describe managed secret files as the suite-supported provisioning option, not the only permitted source. Preserve the consumer's chosen Vault workflow without imposing it on every standalone suite user. No code or new tests are needed for this wording correction. This is an unintended documentation-level strengthening of the requirements. ## Review Validation Shell syntax, changed-commit whitespace checks, pipeline syntax checking with locally available collections, production-profile lint, and collection build passed. Source and imported pipeline Git tree hashes match exactly. Reviewed the recorded successful role/collection integration and consumer syntax runs; did not rerun host-mutating convergence. A fresh dependency installation stalled and was stopped, so this review does not independently establish a complete fresh public dependency installation. No operational host was contacted. ## Remediation Boundaries Fix authoritative pipeline files first, then publish and re-import the corrected pipeline revision through the existing public Gitea subtree workflow. Do not edit its collection copy directly. Update collection-owned tests and consumer pins/links to the corrected public snapshot as needed. Preserve all agreed application versions, configuration defaults, and runtime behavior. Validate affected tests in proportion to the changes; no operational deployment, credentials, live inference, or session migration is required. ## Resolution Evidence All three findings were addressed on 2026-09-29: - Finding 1: pipeline `37b1cf6` removes redundant baseline credential-list assertions while preserving custom-input coverage; collection `d9abb62` removes default profile-ID and credential-list assertions. Native profile inspection, configuration validation, and immediate clean-repeat checks remain. - Findings 2 and 3: pipeline `37b1cf6` and consumer `15f0f4e` distinguish Audita configuration migration from Narratio session migration, link the exact provenance procedure, preserve progress and immutable snapshots, and allow environment or file-based credential provisioning. The stale Notarius dependency/catalog claim is replaced by tagged release guidance. - The public pipeline revision is `37b1cf6fab71c6a1212e49357c2e825cb0237a00`; collection subtree import and public revision `b3bc0457efb7ea14ed11789978edd440537860fc` contain its exact Git tree. Both remote branch heads were independently checked with `git ls-remote`. Consumer `15f0f4e` selects that collection and links the corrected source README; the consumer commit remains local. - Shell syntax and whitespace checks passed. Pipeline and installed-collection syntax checks and production-profile lint passed. Collection build and disposable artifact installation passed. Consumer real-inventory host listing selected only `pipeline-dnd`, and syntax checking passed without deployment or Vault decryption. - Validation used the previously downloaded public role dependencies and available local collections. Full host-mutating integration was not rerun: production code/defaults are unchanged, test changes remove assertions and unused parsing, and prior full-run evidence remains applicable to unchanged behavior. No operational system or session state was modified.