# Feature 0002 Remediation Review

Status: resolved

The Audita production task flow implements the approved architecture and the
complete integration suite passes. The following residual issues should be
corrected before Feature 0002 is accepted.

## Finding 1: Correct the Declared Role License

Severity: medium

`ansible-role-audita/meta/main.yml` declares `BSD-3-Clause`, but the
repository's `LICENSE` file is CC0 1.0 Universal. Published role metadata must
identify the license actually granted by the repository.

### Required Remediation

- Change `galaxy_info.license` to the Galaxy-compatible SPDX identifier
  `CC0-1.0`.
- Do not replace or otherwise alter the existing license text.

### Validation

- `meta/main.yml` and `LICENSE` identify the same license.
- Production-profile ansible-lint passes.

## Finding 2: Describe All Integration-Test Host Effects

Severity: low

`ansible-role-audita/README.md` says that the integration suite mutates only
the three Audita paths and its private temporary directory. Default
convergence also enables dependency management, so on a fresh supported host
the suite may install Git through APT, refresh the APT cache, and install the
Go Snap. The statement is therefore incomplete.

### Required Remediation

- State that the suite may install or converge Git and the Go Snap in addition
  to managing the listed Audita paths.
- Retain the statement that temporary test-specific files are confined to the
  private temporary directory.

### Validation

- The README accurately describes package/Snap effects and managed filesystem
  paths.
- The description agrees with `tests/integration` and the role defaults.

## Finding 3: Complete Binary-Type Verification

Severity: low

`tests/verify.yml` checks binary ownership, mode, and executability, but does
not assert that `/usr/local/bin/audita` is a regular file. Stage 1 explicitly
requires baseline verification of binary type and metadata. The production
`file` task establishes this invariant, but the focused verification does not
provide the planned evidence for it.

### Required Remediation

- Add an assertion for `audita_binary_metadata.stat.isreg` to the existing
  binary metadata check.
- Do not add another probe or production task.

### Validation

- `tests/verify.yml` confirms regular-file type, ownership, mode, and
  executability from its existing `stat` result.
- The integration suite passes.

## Finding 4: Synchronize Implementation Progress Tracking

Severity: low

Both implementation stages are annotated complete in
`docs/roadmap/implementation.md`, at role commits `47f1852` and `d37f590`, but
the plan remains `ready`, its progress notes still say execution is ready to
begin, and `docs/status.md` still describes execution as the current activity.
The recorded state should show that implementation is complete and remediation
review is in progress.

The two workspace commits that added stage-completion annotations also diverge
from the plan's instruction that the out-of-band executor leave workspace
planning files unchanged. No implementation code was placed in the wrong
repository, so this requires tracking cleanup rather than code movement.

### Required Remediation

- Set the plan to `in_progress` while findings remain open and replace its
  stale progress note with both completed stage commits and the current
  remediation state.
- Update workspace status so Feature 0002 is `in_progress`, with implementation
  complete and remediation pending, and make review/remediation the current
  focus.
- Do not mark Feature 0002 `done` until remediation is implemented and
  reviewed.

### Validation

- The plan's status, stage annotations, and progress notes describe one
  consistent state.
- Workspace status agrees with the implementation and remediation records.
- `git diff --check` passes in the workspace repository.

## Review Validation Evidence

The review ran the complete `ansible-role-audita/tests/integration` suite on
Ubuntu 26.04 with Ansible Core 2.21.3 and ansible-lint 26.8.0. It passed syntax
checking, production-profile lint, baseline and repeated convergence,
missing-binary rebuilding, dependency opt-out with a caller-supplied Go
executable, metadata repair without rebuilding, configuration-only
convergence, alternate-checkout rebuilding, default restoration, native
configuration validation, and all three platform-rejection cases.

The final state was default commit
`a84941d68168a1ed9ea7423b6477ae8218be73f9`, a `root:root` mode `0755` binary,
a `root:root` mode `0644` configuration, and native validation output
`config is valid`. `bash -n tests/integration` and `git diff --check` also
passed. All nested repository working trees remained clean.

## Resolution

All four findings were implemented and validated on 2026-09-08. The role now
declares `CC0-1.0`, its README identifies dependency-management effects, and
its existing binary `stat` result proves regular-file type. Workspace tracking
records the completed and accepted feature. Role remediation was committed as
`3a8c21f`.

Validation passed with the complete `tests/integration` suite,
production-profile ansible-lint, `bash -n tests/integration`, and
`git diff --check` in both changed repositories. The production task flow was
not changed.