72 lines
2.7 KiB
Markdown
72 lines
2.7 KiB
Markdown
# Feature 0005 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
Reviewed implementation commits:
|
|
|
|
- `3be78d8 Install and configure Narratio`
|
|
- `0e8ad9f Add focused Narratio integration coverage`
|
|
|
|
Remediation commit:
|
|
|
|
- `7feff47 Clean up Narratio review findings`
|
|
|
|
The production role implements the targeted architecture, and the complete
|
|
integration suite passes. The findings were limited to residual documentation
|
|
and test-quality issues; no production task, template, default, argument
|
|
specification, metadata, or dependency required a change.
|
|
|
|
## Finding 1: Remove the Retained Placeholder README Sentence
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-narratio/README.md` ended with the original placeholder sentence,
|
|
“Ansible role to install the Narratio D&D transcript and session report
|
|
generation suite.” The rewritten README already provided the complete role
|
|
description, so this was accidental residue from the initial repository.
|
|
|
|
### Resolution
|
|
|
|
The retained placeholder sentence was removed without changing the substantive
|
|
role documentation.
|
|
|
|
## Finding 2: Make the Composition Test Non-vacuous
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-narratio/tests/representative.yml` claimed to exercise
|
|
caller-side composition, but both secondary fragments were empty. The verifier
|
|
consequently proved only that one original entry survived serialization.
|
|
|
|
### Resolution
|
|
|
|
The Scriptorium artifact map now combines two nonempty caller-defined
|
|
fragments, and the verifier checks one entry from each. Publish outputs use one
|
|
direct value so the suite retains only one representative composition case.
|
|
Native validation and the immediate clean repeat remain in place.
|
|
|
|
## Finding 3: Use Ansible Privilege Escalation Directly in Verifiers
|
|
|
|
Severity: low
|
|
|
|
Both configuration verifiers escalated to root and then executed
|
|
`/usr/bin/sudo -u narratio` inside `ansible.builtin.command`, creating a
|
|
redundant second privilege transition.
|
|
|
|
### Resolution
|
|
|
|
Both verifier tasks now use `become_user: narratio` and invoke Narratio
|
|
directly. The integration driver enables pipelining and uses `/tmp` for
|
|
Ansible's transient module area, avoiding the local controller's otherwise
|
|
unmet temporary-file ACL requirement without adding a nested sudo command.
|
|
|
|
## Final Validation
|
|
|
|
`bash -n tests/integration`, the complete `tests/integration` suite, and
|
|
`git diff --check` passed after remediation. Syntax checking and
|
|
production-profile lint passed within the integration entry point. Baseline,
|
|
missing-binary recovery, and representative-configuration scenarios passed
|
|
their native Narratio checks as the application account, every required
|
|
immediate repeat reported `changed=0` and `failed=0`, and cleanup restored the
|
|
usable baseline deployment. No unresolved Feature 0005 findings remain.
|