# Feature 0013 Remediation Review Status: resolved Reviewed implementation and release state: - Application-role `v0.1.0` tags at the five roadmap-fixed commits - Pipeline release commit and tag `7c2bad827702fdcf78f8f77ece7d6270756bc3c5` - Collection subtree import `da348eb8bd9878a58404a37dbcf22ad6562ac5c9` - Collection release commit and tag `63e8f3fb090a583226c7435bd900e10d41a30b89` - Public `rakestraw.dnd 0.1.0` Gitea release and `rakestraw-dnd-0.1.0.tar.gz` attachment - Workspace implementation record through `06e1b35f25589a3a6ff3fd2884208c86c4fee9c4` ## Review Summary Feature 0013 implements the release architecture and public consumer path. The five application-role tags identify the exact reviewed commits selected by the roadmap. The standalone pipeline and collection manifests use those immutable tags, and the native collection dependencies remain pinned to `ansible.posix` 2.2.0 and `community.general` 13.3.0. The collection subtree's Git tree exactly matches public pipeline tag `v0.1.0`. All seven repositories and tags are public and synchronized with their local counterparts. The collection's non-draft, non-prerelease Gitea release carries one correctly named archive. Its manifest declares `rakestraw.dnd` 0.1.0, the expected Ansible baseline and collection dependencies, and its file payload matches a fresh build from the tagged collection tree. One low-severity documentation issue remains. The pipeline README now implies that collection snapshots may be imported only from role releases. That strengthens the settled maintenance contract beyond the requested release feature and contradicts the documented development workflow, which also permits a reviewed, pushed commit. ## Finding 1: Pipeline Documentation Narrows Subtree Imports to Releases Severity: low `ansible-role-dnd-pipeline/README.md:51-53` says that collection maintainers “import a reviewed release as a snapshot.” The same sentence is present in the faithfully imported collection copy at `ansible-collection-dnd/roles/pipeline/README.md:51-53`. That wording accurately describes the particular snapshot used for collection release 0.1.0, but it reads as the general maintenance rule. The durable architecture deliberately permits the collection to import any reviewed pipeline commit that has been pushed to Gitea during development. An immutable pipeline tag is required only when preparing a released compatibility set. The collection's own maintenance section correctly accepts a pushed commit or immutable tag. This is an inadvertent requirement strengthening: it could force an otherwise unnecessary pipeline-role release merely to assemble and test a development collection snapshot. It does not affect runtime behavior, the released dependency pins, subtree fidelity, or consumer installation. ### Required Remediation - In the authoritative pipeline README, replace the release-only wording with concise language saying that collection maintainers import a reviewed, pushed commit or immutable tag as a snapshot. - Make no role, manifest, default, task, template, handler, or test change. - Commit and push the pipeline documentation correction before importing it into the collection. - Refresh `roles/pipeline` through the documented squashed subtree command using the pushed pipeline documentation commit as the remote revision. Do not edit the collection's subtree copy directly. - Confirm that the resulting collection subtree Git tree exactly matches the selected pushed pipeline commit outside Git metadata. - Do not move or replace any `v0.1.0` tag, modify the published Gitea release, or replace its attachment. Those immutable artifacts correctly describe the historical 0.1.0 source state. - Do not create a new role or collection release solely for this maintainer-facing wording correction. ### Required Validation Run: ```text cd ansible-role-dnd-pipeline git diff --check cd ../ansible-collection-dnd ../.venv/bin/ansible-galaxy collection build --output-path "$(mktemp -d)" git diff --check ``` Also compare the imported `roles/pipeline` tree with a disposable clone of the selected pushed pipeline commit. The full application, pipeline, and collection integration suites do not need to be rerun because the remediation changes documentation only and preserves all Ansible and dependency content. ## Resolution Resolved in pipeline commit `78afffe` and collection subtree import `5e695f3`. The authoritative pipeline README now states that collection maintainers may import either a reviewed, pushed commit or an immutable tag. The pipeline commit was pushed before the collection imported that exact Gitea revision through the documented squashed subtree workflow. The imported subtree and pipeline source have the same Git tree ID, `37f619ac24d2303847c4b9ea60db1f9fc1bf9d0e`. A fresh collection build succeeded, and `git diff --check` passed in both repositories. No Ansible content or dependency selection changed, so the integration suites were not rerun. The seven `v0.1.0` tags, published collection release, and release attachment remain unchanged. ## Review Validation Evidence - Every local and remote `v0.1.0` tag resolves to the commit recorded in the Feature 0013 roadmap and implementation notes. - All seven Gitea repositories report public visibility and `main` as their default branch. - The pipeline `v0.1.0` tree ID and the collection tag's `roles/pipeline` tree ID are both `44a9d2b010012d8a63720b3a4ed07e9f255a5dae`. - The tagged raw collection manifest matches the repository manifest, and its role and collection selections match the released pipeline manifests. - The public release API reports tag `v0.1.0`, title `rakestraw.dnd 0.1.0`, `draft: false`, `prerelease: false`, and one `rakestraw-dnd-0.1.0.tar.gz` attachment. - The published archive has the same file list, `MANIFEST.json`, `FILES.json`, and file payload hashes as a fresh collection build from the tagged tree. It contains the pipeline entry point and omits the selected development-only subtree files. - A fresh unauthenticated clone and release-attachment download installed the five public role tags and the collection into isolated Ansible paths. The installed `rakestraw.dnd.pipeline` role converged successfully and its immediate repeat reported `changed=0` and `failed=0`. - The complete repository-local collection integration suite independently passed isolated bootstrap, collection build and installation, syntax check, production-profile lint, native application validation, and immediate clean convergence. - `git diff --check` passes for the pipeline, collection, and workspace implementation ranges. All workspace repositories are clean and synchronized with their upstream branches before this review finding is recorded. No runtime code-quality issue, release-architecture gap, test-policy violation, or other inadvertent requirement strengthening was found.