ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0022 Remediation Review

Status: resolved

Reviewed on 2026-09-29:

• Pipeline 8ea8621 and ea8b09e.
• Collection subtree import through a78c309 and assembly 3d77eb3.
• Consumer f694dad.

The production wiring implements the approved coordinated versions, Audita backend/profile assets, credential lists, overlay paths, and nullable retry controls. The collection's imported pipeline tree exactly matches the source role. The following test-policy and operator-documentation issues were found and have now been addressed as recorded below. Git history preserves the previously resolved Feature 0013 remediation record.

Finding 1: New assertions freeze unconfigured suite defaults

Priority: P2 Owners: pipeline role and collection tests.

Locations:

• ansible-role-dnd-pipeline/tests/integration:172–173.
• ansible-collection-dnd/tests/integration:104–105 and 108–109.

The new baseline assertions require specific Audita profile IDs and Narratio credential lists, but the cases do not explicitly supply the corresponding selection/list variables. Supplying synthetic values in dnd_pipeline_secrets does not select the credential lists. These assertions therefore fail when legitimate defaults change, even if installation and caller overrides work.

Required correction: remove redundant default-identity assertions from the baseline smoke case, or explicitly supply the relevant public inputs and assert those values. The pipeline already has a useful custom-credential override case; prefer reusing its coverage. Keep native validation and clean repeats. Do not replace literals by reading role defaults into expectations; that would still test implementation identity rather than caller behavior.

This strengthens acceptance beyond the user's state-based testing policy. The approved plan explicitly asked for supplied-value tests, not default snapshots.

Finding 2: Upgrade guidance confuses configuration with session migration

Priority: P2 Owners: pipeline README and consumer deployment guidance.

Locations:

• ansible-role-dnd-pipeline/README.md:166–168 and 337–338.
• rakestraw-ansible/docs/pipeline-dnd.md:86–104.

The pipeline links “Audita's v2 manifest migration” to Audita's configuration migration guide, but does not identify Narratio's actual session-manifest migration. The consumer likewise refers to “Audita manifests” and only generically warns about Narratio manifests. The roadmap specifically requires guidance on backing up and migrating local provenance while preserving progress and immutable snapshots. Existing Narratio manifests containing effective_config.selected_profile are rejected by v3.

Required correction:

• Describe Audita's change as a configuration/backend/profile migration.
• Link Narratio v3's exact operations section #migrating-manifest-overlay-provenance; briefly explain backup and effective_config.selected_profile → selected_overlay (or removal as upstream permits), preserving stage/checkpoint state and leaving immutable remote snapshots unchanged. Do not add automatic migration or forced reruns.
• Correct or remove the stale claim that Notarius v0.8.1 selects PromptKit v0.10.0. Its tagged release specifies v0.11.2; prefer linking upstream release notes over duplicating dependency/catalog versions.

This is a missing operator handoff, not a request for additional runtime code.

Finding 3: Documentation makes managed secret files mandatory

Priority: P2 Owners: pipeline README and consumer deployment guidance.

Locations:

• ansible-role-dnd-pipeline/README.md:160–163.
• rakestraw-ansible/docs/pipeline-dnd.md:69–71.

The new text requires each credential to be supplied through dnd_pipeline_secrets. Runtime behavior does not require that: Narratio can resolve listed names from its process environment or existing secret files. The README's existing managed-credentials section already describes environment precedence and an empty default secrets map.

Required correction: require the credential names in the forwarding lists, but describe managed secret files as the suite-supported provisioning option, not the only permitted source. Preserve the consumer's chosen Vault workflow without imposing it on every standalone suite user. No code or new tests are needed for this wording correction.

This is an unintended documentation-level strengthening of the requirements.

Review Validation

Shell syntax, changed-commit whitespace checks, pipeline syntax checking with locally available collections, production-profile lint, and collection build passed. Source and imported pipeline Git tree hashes match exactly. Reviewed the recorded successful role/collection integration and consumer syntax runs; did not rerun host-mutating convergence. A fresh dependency installation stalled and was stopped, so this review does not independently establish a complete fresh public dependency installation. No operational host was contacted.

Remediation Boundaries

Fix authoritative pipeline files first, then publish and re-import the corrected pipeline revision through the existing public Gitea subtree workflow. Do not edit its collection copy directly. Update collection-owned tests and consumer pins/links to the corrected public snapshot as needed. Preserve all agreed application versions, configuration defaults, and runtime behavior. Validate affected tests in proportion to the changes; no operational deployment, credentials, live inference, or session migration is required.

Resolution Evidence

All three findings were addressed on 2026-09-29:

• Finding 1: pipeline 37b1cf6 removes redundant baseline credential-list assertions while preserving custom-input coverage; collection d9abb62 removes default profile-ID and credential-list assertions. Native profile inspection, configuration validation, and immediate clean-repeat checks remain.
• Findings 2 and 3: pipeline 37b1cf6 and consumer 15f0f4e distinguish Audita configuration migration from Narratio session migration, link the exact provenance procedure, preserve progress and immutable snapshots, and allow environment or file-based credential provisioning. The stale Notarius dependency/catalog claim is replaced by tagged release guidance.
• The public pipeline revision is 37b1cf6fab71c6a1212e49357c2e825cb0237a00; collection subtree import and public revision b3bc0457efb7ea14ed11789978edd440537860fc contain its exact Git tree. Both remote branch heads were independently checked with git ls-remote. Consumer 15f0f4e selects that collection and links the corrected source README; the consumer commit remains local.
• Shell syntax and whitespace checks passed. Pipeline and installed-collection syntax checks and production-profile lint passed. Collection build and disposable artifact installation passed. Consumer real-inventory host listing selected only pipeline-dnd, and syntax checking passed without deployment or Vault decryption.
• Validation used the previously downloaded public role dependencies and available local collections. Full host-mutating integration was not rerun: production code/defaults are unchanged, test changes remove assertions and unused parsing, and prior full-run evidence remains applicable to unchanged behavior. No operational system or session state was modified.