135 lines
5.2 KiB
Markdown
135 lines
5.2 KiB
Markdown
# Feature 0002 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
The Audita production task flow implements the approved architecture and the
|
|
complete integration suite passes. The following residual issues should be
|
|
corrected before Feature 0002 is accepted.
|
|
|
|
## Finding 1: Correct the Declared Role License
|
|
|
|
Severity: medium
|
|
|
|
`ansible-role-audita/meta/main.yml` declares `BSD-3-Clause`, but the
|
|
repository's `LICENSE` file is CC0 1.0 Universal. Published role metadata must
|
|
identify the license actually granted by the repository.
|
|
|
|
### Required Remediation
|
|
|
|
- Change `galaxy_info.license` to the Galaxy-compatible SPDX identifier
|
|
`CC0-1.0`.
|
|
- Do not replace or otherwise alter the existing license text.
|
|
|
|
### Validation
|
|
|
|
- `meta/main.yml` and `LICENSE` identify the same license.
|
|
- Production-profile ansible-lint passes.
|
|
|
|
## Finding 2: Describe All Integration-Test Host Effects
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-audita/README.md` says that the integration suite mutates only
|
|
the three Audita paths and its private temporary directory. Default
|
|
convergence also enables dependency management, so on a fresh supported host
|
|
the suite may install Git through APT, refresh the APT cache, and install the
|
|
Go Snap. The statement is therefore incomplete.
|
|
|
|
### Required Remediation
|
|
|
|
- State that the suite may install or converge Git and the Go Snap in addition
|
|
to managing the listed Audita paths.
|
|
- Retain the statement that temporary test-specific files are confined to the
|
|
private temporary directory.
|
|
|
|
### Validation
|
|
|
|
- The README accurately describes package/Snap effects and managed filesystem
|
|
paths.
|
|
- The description agrees with `tests/integration` and the role defaults.
|
|
|
|
## Finding 3: Complete Binary-Type Verification
|
|
|
|
Severity: low
|
|
|
|
`tests/verify.yml` checks binary ownership, mode, and executability, but does
|
|
not assert that `/usr/local/bin/audita` is a regular file. Stage 1 explicitly
|
|
requires baseline verification of binary type and metadata. The production
|
|
`file` task establishes this invariant, but the focused verification does not
|
|
provide the planned evidence for it.
|
|
|
|
### Required Remediation
|
|
|
|
- Add an assertion for `audita_binary_metadata.stat.isreg` to the existing
|
|
binary metadata check.
|
|
- Do not add another probe or production task.
|
|
|
|
### Validation
|
|
|
|
- `tests/verify.yml` confirms regular-file type, ownership, mode, and
|
|
executability from its existing `stat` result.
|
|
- The integration suite passes.
|
|
|
|
## Finding 4: Synchronize Implementation Progress Tracking
|
|
|
|
Severity: low
|
|
|
|
Both implementation stages are annotated complete in
|
|
`docs/roadmap/implementation.md`, at role commits `47f1852` and `d37f590`, but
|
|
the plan remains `ready`, its progress notes still say execution is ready to
|
|
begin, and `docs/status.md` still describes execution as the current activity.
|
|
The recorded state should show that implementation is complete and remediation
|
|
review is in progress.
|
|
|
|
The two workspace commits that added stage-completion annotations also diverge
|
|
from the plan's instruction that the out-of-band executor leave workspace
|
|
planning files unchanged. No implementation code was placed in the wrong
|
|
repository, so this requires tracking cleanup rather than code movement.
|
|
|
|
### Required Remediation
|
|
|
|
- Set the plan to `in_progress` while findings remain open and replace its
|
|
stale progress note with both completed stage commits and the current
|
|
remediation state.
|
|
- Update workspace status so Feature 0002 is `in_progress`, with implementation
|
|
complete and remediation pending, and make review/remediation the current
|
|
focus.
|
|
- Do not mark Feature 0002 `done` until remediation is implemented and
|
|
reviewed.
|
|
|
|
### Validation
|
|
|
|
- The plan's status, stage annotations, and progress notes describe one
|
|
consistent state.
|
|
- Workspace status agrees with the implementation and remediation records.
|
|
- `git diff --check` passes in the workspace repository.
|
|
|
|
## Review Validation Evidence
|
|
|
|
The review ran the complete `ansible-role-audita/tests/integration` suite on
|
|
Ubuntu 26.04 with Ansible Core 2.21.3 and ansible-lint 26.8.0. It passed syntax
|
|
checking, production-profile lint, baseline and repeated convergence,
|
|
missing-binary rebuilding, dependency opt-out with a caller-supplied Go
|
|
executable, metadata repair without rebuilding, configuration-only
|
|
convergence, alternate-checkout rebuilding, default restoration, native
|
|
configuration validation, and all three platform-rejection cases.
|
|
|
|
The final state was default commit
|
|
`a84941d68168a1ed9ea7423b6477ae8218be73f9`, a `root:root` mode `0755` binary,
|
|
a `root:root` mode `0644` configuration, and native validation output
|
|
`config is valid`. `bash -n tests/integration` and `git diff --check` also
|
|
passed. All nested repository working trees remained clean.
|
|
|
|
## Resolution
|
|
|
|
All four findings were implemented and validated on 2026-09-08. The role now
|
|
declares `CC0-1.0`, its README identifies dependency-management effects, and
|
|
its existing binary `stat` result proves regular-file type. Workspace tracking
|
|
records the completed and accepted feature. Role remediation was committed as
|
|
`3a8c21f`.
|
|
|
|
Validation passed with the complete `tests/integration` suite,
|
|
production-profile ansible-lint, `bash -n tests/integration`, and
|
|
`git diff --check` in both changed repositories. The production task flow was
|
|
not changed.
|