ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0003 Remediation Review

Status: resolved

Reviewed implementation commits:

• 287fc4a Install and configure Notarius
• 733a194 Add focused Notarius integration coverage

Remediation commit:

• eb4f511 Correct Notarius metadata and dependency coverage

Finding 1: Correct the Galaxy License Metadata

Severity: medium

ansible-role-notarius/meta/main.yml declared license: BSD-3-Clause, while the retained repository license is CC0 1.0 Universal.

Resolution

The Galaxy license identifier is now CC0-1.0, consistent with the repository license.

Finding 2: Remove the Redundant Build Change Override

Status: withdrawn

The initial review treated changed_when: true on the conditionally executed build command as redundant. Validation after removing it failed ansible-lint's no-changed-when production rule.

Resolution

The directive remains in place. Unlike a desired-state module, the imperative build command must explicitly declare its change semantics for lint. The existing when expression still determines whether the command runs, and changed_when: true accurately reports that every executed build changes the binary. The distinction is now documented in docs/ansible.md.

Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary

Severity: low

The original integration test pointed notarius_go_binary at a symlink to /snap/bin/go, so it did not prove that the configured path was actually invoked.

Resolution

The test now supplies a wrapper in its private temporary directory. The wrapper records its invocation before delegating to /snap/bin/go, and the suite asserts that the record exists after the dependency-opt-out build.

Final Validation

The complete tests/integration suite passed after remediation with Ansible Core 2.21.3 and ansible-lint 26.8.0. Production-profile lint passed, every selected build and configuration behavior remained valid, all required repeat runs were clean, and the suite restored Notarius v0.6.0 with the minimal version: 4 configuration.

git diff --check also passed. No unresolved Feature 0003 findings remain.