145 lines
7.2 KiB
Markdown
145 lines
7.2 KiB
Markdown
# Feature 0022 Remediation Review
|
||
|
||
Status: resolved
|
||
|
||
Reviewed on 2026-09-29:
|
||
- Pipeline `8ea8621` and `ea8b09e`.
|
||
- Collection subtree import through `a78c309` and assembly `3d77eb3`.
|
||
- Consumer `f694dad`.
|
||
|
||
The production wiring implements the approved coordinated versions, Audita
|
||
backend/profile assets, credential lists, overlay paths, and nullable retry
|
||
controls. The collection's imported pipeline tree exactly matches the source
|
||
role. The following test-policy and operator-documentation issues were found
|
||
and have now been addressed as recorded below.
|
||
Git history preserves the previously resolved Feature 0013 remediation record.
|
||
|
||
## Finding 1: New assertions freeze unconfigured suite defaults
|
||
|
||
Priority: P2
|
||
Owners: pipeline role and collection tests.
|
||
|
||
Locations:
|
||
- `ansible-role-dnd-pipeline/tests/integration:172`–173.
|
||
- `ansible-collection-dnd/tests/integration:104`–105 and 108–109.
|
||
|
||
The new baseline assertions require specific Audita profile IDs and Narratio
|
||
credential lists, but the cases do not explicitly supply the corresponding
|
||
selection/list variables. Supplying synthetic values in `dnd_pipeline_secrets`
|
||
does not select the credential lists. These assertions therefore fail when
|
||
legitimate defaults change, even if installation and caller overrides work.
|
||
|
||
Required correction: remove redundant default-identity assertions from the
|
||
baseline smoke case, or explicitly supply the relevant public inputs and
|
||
assert those values. The pipeline already has a useful custom-credential
|
||
override case; prefer reusing its coverage. Keep native validation and clean
|
||
repeats. Do not replace literals by reading role defaults into expectations;
|
||
that would still test implementation identity rather than caller behavior.
|
||
|
||
This strengthens acceptance beyond the user's state-based testing policy.
|
||
The approved plan explicitly asked for supplied-value tests, not default
|
||
snapshots.
|
||
|
||
## Finding 2: Upgrade guidance confuses configuration with session migration
|
||
|
||
Priority: P2
|
||
Owners: pipeline README and consumer deployment guidance.
|
||
|
||
Locations:
|
||
- `ansible-role-dnd-pipeline/README.md:166`–168 and 337–338.
|
||
- `rakestraw-ansible/docs/pipeline-dnd.md:86`–104.
|
||
|
||
The pipeline links “Audita's v2 manifest migration” to Audita's configuration
|
||
migration guide, but does not identify Narratio's actual session-manifest
|
||
migration. The consumer likewise refers to “Audita manifests” and only
|
||
generically warns about Narratio manifests. The roadmap specifically requires
|
||
guidance on backing up and migrating local provenance while preserving
|
||
progress and immutable snapshots. Existing Narratio manifests containing
|
||
`effective_config.selected_profile` are rejected by v3.
|
||
|
||
Required correction:
|
||
- Describe Audita's change as a configuration/backend/profile migration.
|
||
- Link Narratio v3's exact operations section
|
||
`#migrating-manifest-overlay-provenance`; briefly explain backup and
|
||
`effective_config.selected_profile` → `selected_overlay` (or removal as
|
||
upstream permits), preserving stage/checkpoint state and leaving immutable
|
||
remote snapshots unchanged. Do not add automatic migration or forced reruns.
|
||
- Correct or remove the stale claim that Notarius v0.8.1 selects PromptKit
|
||
v0.10.0. Its tagged release specifies v0.11.2; prefer linking upstream release
|
||
notes over duplicating dependency/catalog versions.
|
||
|
||
This is a missing operator handoff, not a request for additional runtime code.
|
||
|
||
## Finding 3: Documentation makes managed secret files mandatory
|
||
|
||
Priority: P2
|
||
Owners: pipeline README and consumer deployment guidance.
|
||
|
||
Locations:
|
||
- `ansible-role-dnd-pipeline/README.md:160`–163.
|
||
- `rakestraw-ansible/docs/pipeline-dnd.md:69`–71.
|
||
|
||
The new text requires each credential to be supplied through
|
||
`dnd_pipeline_secrets`. Runtime behavior does not require that: Narratio can
|
||
resolve listed names from its process environment or existing secret files.
|
||
The README's existing managed-credentials section already describes environment
|
||
precedence and an empty default secrets map.
|
||
|
||
Required correction: require the credential names in the forwarding lists,
|
||
but describe managed secret files as the suite-supported provisioning option,
|
||
not the only permitted source. Preserve the consumer's chosen Vault workflow
|
||
without imposing it on every standalone suite user. No code or new tests are
|
||
needed for this wording correction.
|
||
|
||
This is an unintended documentation-level strengthening of the requirements.
|
||
|
||
## Review Validation
|
||
|
||
Shell syntax, changed-commit whitespace checks, pipeline syntax checking with
|
||
locally available collections, production-profile lint, and collection build
|
||
passed. Source and imported pipeline Git tree hashes match exactly. Reviewed
|
||
the recorded successful role/collection integration and consumer syntax runs;
|
||
did not rerun host-mutating convergence. A fresh dependency installation stalled
|
||
and was stopped, so this review does not independently establish a complete
|
||
fresh public dependency installation. No operational host was contacted.
|
||
|
||
## Remediation Boundaries
|
||
|
||
Fix authoritative pipeline files first, then publish and re-import the corrected
|
||
pipeline revision through the existing public Gitea subtree workflow. Do not
|
||
edit its collection copy directly. Update collection-owned tests and consumer
|
||
pins/links to the corrected public snapshot as needed. Preserve all agreed
|
||
application versions, configuration defaults, and runtime behavior. Validate
|
||
affected tests in proportion to the changes; no operational deployment,
|
||
credentials, live inference, or session migration is required.
|
||
|
||
## Resolution Evidence
|
||
|
||
All three findings were addressed on 2026-09-29:
|
||
|
||
- Finding 1: pipeline `37b1cf6` removes redundant baseline credential-list
|
||
assertions while preserving custom-input coverage; collection `d9abb62`
|
||
removes default profile-ID and credential-list assertions. Native profile
|
||
inspection, configuration validation, and immediate clean-repeat checks remain.
|
||
- Findings 2 and 3: pipeline `37b1cf6` and consumer `15f0f4e` distinguish
|
||
Audita configuration migration from Narratio session migration, link the
|
||
exact provenance procedure, preserve progress and immutable snapshots,
|
||
and allow environment or file-based credential provisioning. The stale
|
||
Notarius dependency/catalog claim is replaced by tagged release guidance.
|
||
- The public pipeline revision is
|
||
`37b1cf6fab71c6a1212e49357c2e825cb0237a00`; collection subtree import and
|
||
public revision `b3bc0457efb7ea14ed11789978edd440537860fc` contain its exact
|
||
Git tree. Both remote branch heads were independently checked with
|
||
`git ls-remote`. Consumer `15f0f4e` selects that collection and links the
|
||
corrected source README; the consumer commit remains local.
|
||
- Shell syntax and whitespace checks passed. Pipeline and installed-collection
|
||
syntax checks and production-profile lint passed. Collection build and
|
||
disposable artifact installation passed. Consumer real-inventory host
|
||
listing selected only `pipeline-dnd`, and syntax checking passed without
|
||
deployment or Vault decryption.
|
||
- Validation used the previously downloaded public role dependencies and
|
||
available local collections. Full host-mutating integration was not rerun:
|
||
production code/defaults are unchanged, test changes remove assertions and
|
||
unused parsing, and prior full-run evidence remains applicable to unchanged
|
||
behavior. No operational system or session state was modified.
|