ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0006 Remediation Review

Status: resolved

Reviewed implementation commits:

• b515968 Compose the D&D pipeline roles
• 61869d1 Add focused pipeline composition coverage

Remediation commit:

• 4ea4358 Clean up pipeline composition review findings

The production architecture matches Feature 0006: the role contains only its public defaults and argument specification, five pinned role dependencies, the approved variable forwarding, and fixed Narratio path wiring. Its task file is empty, and it does not duplicate downstream tasks, templates, state inspection, or validation. The complete integration entry point passes.

The review identified two repository-quality findings.

Finding 1: Remove the Misleading Placeholder README Sentence

Severity: low

ansible-role-dnd-pipeline/README.md still ends with the original placeholder sentence claiming that the role installs the full production pipeline “plus supporting assets.” Feature 0006 expressly defers campaign and prompt assets, operator policy, secrets, and the opinionated D&D configuration layer. The sentence is both redundant with the rewritten introduction and inaccurate for the implemented foundation.

The supported-platform summary also names Ubuntu 26.04 without recording the roadmap's amd64 and arm64 boundary.

Required Remediation

• Remove the retained placeholder sentence.
• State the supported amd64 and arm64 architectures in the rewritten platform summary.
• Make no broader README expansion; the existing dependency, interface, deferral, and validation documentation is otherwise aligned.

Resolution

The retained sentence was removed, and the introduction now records the supported amd64 and arm64 architectures without expanding the role's claimed scope.

Finding 2: Give the Isolated Dependency Path Resolution Priority

Severity: low

ansible-role-dnd-pipeline/tests/integration installs the five pinned Git roles into $test_tmp/roles, but sets ANSIBLE_ROLES_PATH with the workspace parent before that isolated directory:

export ANSIBLE_ROLES_PATH="$(dirname "$repository_root"):$test_tmp/roles"

No conflicting canonical role directories currently exist in the workspace, so the reviewed run used the installed dependencies and passed. Nevertheless, the ordering does not preserve the test's stated invariant if a rakestraw.<application> directory is later present in the parent path: Ansible would resolve that checkout before the exact version installed from requirements.yml. Feature 0006 requires the integration suite to exercise the same pinned dependency combination delivered to consumers.

Required Remediation

Put the fresh dependency path first while retaining the workspace parent only as the fallback that resolves the pipeline role under test:

export ANSIBLE_ROLES_PATH="$test_tmp/roles:$(dirname "$repository_root")"

Do not add dependency-content comparisons, source-revision assertions, or other verification machinery. Ordinary Ansible role lookup with the correct path precedence is sufficient.

Resolution

The integration driver now places its private dependency directory first and uses the workspace parent only as the fallback for the pipeline role under test. No additional dependency verification was added.

Final Validation

From ansible-role-dnd-pipeline, run:

tests/integration
git diff --check
git status --short --branch

Expected result: dependency bootstrap, syntax checking, production lint, baseline native checks, Narratio configuration validation, both immediate clean repeats, the explicit Seriatim v1.4.0 outcome, and baseline cleanup all pass. The role repository contains only the intended remediation changes.

Review Validation Evidence

During review, tests/integration completed successfully. It installed community.general 13.3.0 and all five exact Git role revisions into private temporary paths, passed syntax checking and production-profile ansible-lint, validated the assembled applications through their native interfaces, and reported changed=0 and failed=0 on both required immediate repeats. The cleanup trap restored the baseline Seriatim v1.5.0 deployment. git diff --check also passed before this review record was written.

After remediation, bash -n tests/integration, git diff --check, and the complete tests/integration entry point passed again. The rerun installed the exact pinned dependencies into fresh private paths, passed syntax and production-profile lint, completed all native checks, reported changed=0 and failed=0 on both required repeats, and restored the baseline suite. No Feature 0006 findings remain.