# Feature 0003 Remediation Review

Status: open

Reviewed implementation commits:

- `287fc4a Install and configure Notarius`
- `733a194 Add focused Notarius integration coverage`

The role's complete integration suite passes. The production architecture is
substantially complete and follows the selected nine-operation flow, but the
following issues should be corrected before Feature 0003 is marked done.

## Finding 1: Correct the Galaxy License Metadata

Severity: medium

`ansible-role-notarius/meta/main.yml` declares `license: BSD-3-Clause`, while
the repository's retained `LICENSE` file is CC0 1.0 Universal. Package metadata
must not misstate the terms under which the repository is distributed.

### Required Remediation

- Change the Galaxy license identifier to `CC0-1.0`, consistent with the
  repository license and the other standalone roles that use the same license.
- Run metadata lint as part of the complete integration suite.

## Finding 2: Remove the Redundant Build Change Override

Severity: low

The `Build Notarius` task sets `changed_when: true`. The
`ansible.builtin.command` module already reports a successful executed command
as changed, and the task's `when` expression already determines exactly when a
build occurs. The override adds no behavior and conflicts with the convention
to trust module behavior and require a reason for every additional directive.

### Required Remediation

- Remove `changed_when: true` from the production build task.
- Retain the existing rebuild expression unchanged:
  `notarius_checkout.changed or not notarius_binary.stat.exists`.
- Run the complete integration suite to confirm that build runs still report
  changed and immediate repeats remain clean.

## Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary

Severity: low

The integration suite sets `notarius_go_binary` to a symlink whose target is
`/snap/bin/go`. The test succeeds with the current implementation, but it would
also succeed if the build task ignored `notarius_go_binary` and hard-coded
`/snap/bin/go`. It therefore does not establish the acceptance criterion that
a caller-supplied Go executable is actually used.

### Required Remediation

- Replace the symlink with a small executable wrapper in the suite's private
  temporary directory.
- Have the wrapper record its invocation and then delegate to `/snap/bin/go`.
- Assert that the invocation record was written during the dependency-opt-out
  build, while retaining the existing clean-repeat assertion.
- Keep the wrapper and its record in the existing private temporary directory;
  do not add production behavior.

## Review Evidence

The review ran from `ansible-role-notarius`:

```sh
tests/integration
git diff --check
```

The complete suite passed with Ansible Core 2.21.3 and ansible-lint 26.8.0. It
covered default convergence, the selected source commit, executable version,
native configuration validation, clean repeats, missing-binary and checkout
rebuilds, metadata repair without rebuilding, nullable field rendering,
PromptKit source alternatives, intentional falsey values, caller-side
pipeline-map composition, dependency opt-out, and platform rejection. The
suite restored Notarius `v0.6.0` and the minimal `version: 4` configuration.

No additional production tasks, configuration probes, runtime validation,
private state, or unrequested hardening were found.