# Feature 0003 Remediation Review

Status: resolved

Reviewed implementation commits:

- `287fc4a Install and configure Notarius`
- `733a194 Add focused Notarius integration coverage`

Remediation commit:

- `eb4f511 Correct Notarius metadata and dependency coverage`

## Finding 1: Correct the Galaxy License Metadata

Severity: medium

`ansible-role-notarius/meta/main.yml` declared `license: BSD-3-Clause`, while
the retained repository license is CC0 1.0 Universal.

### Resolution

The Galaxy license identifier is now `CC0-1.0`, consistent with the repository
license.

## Finding 2: Remove the Redundant Build Change Override

Status: withdrawn

The initial review treated `changed_when: true` on the conditionally executed
build command as redundant. Validation after removing it failed ansible-lint's
`no-changed-when` production rule.

### Resolution

The directive remains in place. Unlike a desired-state module, the imperative
build command must explicitly declare its change semantics for lint. The
existing `when` expression still determines whether the command runs, and
`changed_when: true` accurately reports that every executed build changes the
binary. The distinction is now documented in `docs/ansible.md`.

## Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary

Severity: low

The original integration test pointed `notarius_go_binary` at a symlink to
`/snap/bin/go`, so it did not prove that the configured path was actually
invoked.

### Resolution

The test now supplies a wrapper in its private temporary directory. The
wrapper records its invocation before delegating to `/snap/bin/go`, and the
suite asserts that the record exists after the dependency-opt-out build.

## Final Validation

The complete `tests/integration` suite passed after remediation with Ansible
Core 2.21.3 and ansible-lint 26.8.0. Production-profile lint passed, every
selected build and configuration behavior remained valid, all required repeat
runs were clean, and the suite restored Notarius `v0.6.0` with the minimal
`version: 4` configuration.

`git diff --check` also passed. No unresolved Feature 0003 findings remain.