91 lines
3.9 KiB
Markdown
91 lines
3.9 KiB
Markdown
# Feature 0009 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
Reviewed implementation commits:
|
|
|
|
- `66ebea9 Make Audita configuration ownership configurable`
|
|
- `e9ae2dc Make Notarius configuration ownership configurable`
|
|
- `8b4c86e Make Scriptorium configuration ownership configurable`
|
|
- `eeb1105 Make Narratio configuration ownership configurable`
|
|
- `901ae35 Apply shared configuration ownership to the D&D pipeline`
|
|
- `dddc5ee Manage shared pipeline access with ACLs`
|
|
- `f53da82 Test shared pipeline access across users`
|
|
- `608d5be Document the shared pipeline execution model`
|
|
|
|
## Review Summary
|
|
|
|
The production architecture and behavioral coverage implement Feature 0009 as
|
|
planned. The four standalone roles expose generic configuration ownership and
|
|
mode controls, and the pipeline selects its opinionated service-owned,
|
|
world-readable policy through those interfaces. Narratio establishes the
|
|
runtime identity first. The pipeline then installs ACL support and directly
|
|
converges access and default ACLs on the three existing shared roots. Focused
|
|
integration coverage exercises actual cross-identity configuration access and
|
|
bidirectional writes under a restrictive umask while preserving immediate clean
|
|
convergence.
|
|
|
|
No production code or test-suite remediation is required. One small consumer
|
|
documentation inconsistency remains.
|
|
|
|
## Finding 1: Operator Support Is Documented Inconsistently
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/README.md:201-217` first lists "operator access" as
|
|
deferred, then correctly states that invocation by an existing member of the
|
|
selected runtime group is supported. The likely deferred concern is operator
|
|
selection and group-membership management, not operator access itself.
|
|
|
|
The adjacent YAML fragment defines an otherwise unexplained
|
|
`operator_group_members` variable but shows no consumer task or role that uses
|
|
it. As written, copying the example does not manage any membership and may lead
|
|
a reader to believe that the pipeline role consumes that variable.
|
|
|
|
### Required Remediation
|
|
|
|
- Replace "operator access" in the deferred list with the precise deferred
|
|
behavior: operator selection and group-membership management.
|
|
- Replace the inert variable fragment with a concise, complete consumer-side
|
|
example that actually adds a selected account to the runtime group, or omit
|
|
the example and state the prerequisite directly.
|
|
- Keep human account and membership management outside the production pipeline
|
|
role.
|
|
|
|
## Resolution
|
|
|
|
Resolved in pipeline-role commit `b15fe8d`. The deferred-work summary now
|
|
names operator selection and group-membership management rather than operator
|
|
access. The shared-filesystem section retains existing-group-member invocation
|
|
as supported behavior and provides a complete consumer-owned
|
|
`ansible.builtin.user` example that adds a selected account to the runtime
|
|
group. No production role behavior changed.
|
|
|
|
## Required Validation
|
|
|
|
After the documentation correction, run:
|
|
|
|
```text
|
|
cd ansible-role-dnd-pipeline && tests/integration
|
|
git diff --check
|
|
```
|
|
|
|
The expected result remains successful native configuration checks,
|
|
representative cross-identity access, and immediate repeats with `changed=0`
|
|
and `failed=0`.
|
|
|
|
## Review Validation Evidence
|
|
|
|
The independent review inspected the complete diffs for all eight stage
|
|
commits and confirmed that every dependency pin resolves to the intended
|
|
standalone-role commit. `git diff --check` passed across all five changed role
|
|
repositories. The complete pipeline `tests/integration` entry point passed its
|
|
isolated dependency installation, syntax check, production-profile lint,
|
|
native application checks, cross-identity access exercise, configurable
|
|
profile and version cases, and immediate clean repeats. All repositories were
|
|
clean before this review document was revised.
|
|
|
|
After remediation, the complete pipeline integration entry point and
|
|
`git diff --check` passed again. The test fixture was removed and the baseline
|
|
Seriatim version and pipeline configuration were restored during cleanup.
|