113 lines
4.8 KiB
Markdown
113 lines
4.8 KiB
Markdown
# Feature 0010 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
Reviewed implementation commits:
|
|
|
|
- `14a38e0 Upgrade the Notarius role to version 0.7.0`
|
|
- `90893ae Integrate Notarius extraction into the D&D pipeline`
|
|
- `7fd7b24 Document and test the D&D Notarius integration`
|
|
|
|
## Review Summary
|
|
|
|
Feature 0010 implements the intended production architecture. The standalone
|
|
Notarius role supports ConfigKit imports without owning imported fragments. The
|
|
pipeline role owns the complete D&D extraction topology, renders it as a
|
|
ConfigKit fragment, selects it from the root Notarius configuration, connects
|
|
Narratio to that pipeline and its artifact paths, and manages a shared FHS
|
|
cache with the pipeline's group-access policy. The complete standalone and
|
|
pipeline integration suites pass, including native application validation and
|
|
immediate clean repeats.
|
|
|
|
No production behavior gap was found. Two low-severity issues should be
|
|
addressed: the configurable pipeline-ID boundary is not observed through
|
|
Narratio in the integration suite, and the ACL task names no longer describe
|
|
all of the roots they manage.
|
|
|
|
## Finding 1: Alternate Pipeline Selection Is Not Observed Through Narratio
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/tests/integration:172-187` composes two alternate
|
|
Notarius pipeline maps and selects `archive-session` through
|
|
`dnd_pipeline_narratio_notarius_pipeline_id`. The test then validates only the
|
|
Notarius configuration and cache-mode override. It does not inspect Narratio's
|
|
effective configuration after the alternate convergence.
|
|
|
|
The production wiring in `ansible-role-dnd-pipeline/meta/main.yml:45-50` is
|
|
correct, but a future regression that stops forwarding the selected pipeline
|
|
ID to Narratio could pass the current test. This is a focused behavioral
|
|
coverage gap at a feature-owned integration boundary, not a request for a
|
|
snapshot or implementation-detail assertion.
|
|
|
|
### Required Remediation
|
|
|
|
- After the alternate convergence, use Narratio's native configuration command
|
|
with a deployed campaign and inspect the effective selected pipeline ID.
|
|
- Assert that Narratio observes `archive-session`.
|
|
- Retain the existing native Notarius checks, cache-mode check, and immediate
|
|
clean repeat.
|
|
- Do not run model-backed extraction or snapshot the complete generated
|
|
configuration.
|
|
|
|
## Finding 2: ACL Task Names Exclude the Notarius Cache They Manage
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/tasks/main.yml:19` and
|
|
`ansible-role-dnd-pipeline/tasks/main.yml:39` describe their ACL loops as
|
|
managing "Narratio writable roots." Both loops now also manage the Notarius
|
|
cache root. The task behavior is correct, but the execution log is misleading
|
|
about its scope.
|
|
|
|
### Required Remediation
|
|
|
|
- Rename both ACL tasks to describe the shared pipeline writable roots.
|
|
- Do not otherwise change the direct desired-state ACL implementation or its
|
|
task flow.
|
|
|
|
## Resolution
|
|
|
|
Resolved in pipeline-role commit `bbf01e1`. The alternate-map integration case
|
|
now uses Narratio's native `config show` command to observe the selected
|
|
`archive-session` pipeline ID before its immediate clean repeat. The two ACL
|
|
task names now describe shared pipeline writable roots without changing their
|
|
module arguments, loops, or task flow.
|
|
|
|
## Required Validation
|
|
|
|
After remediation, run:
|
|
|
|
```text
|
|
cd ansible-role-dnd-pipeline && tests/integration
|
|
git diff --check
|
|
```
|
|
|
|
The expected result is successful native configuration validation for the
|
|
base, testing, and alternate profiles; observation of `archive-session` through
|
|
Narratio; successful shared-cache access; and immediate repeats with
|
|
`changed=0` and `failed=0`.
|
|
|
|
## Review Validation Evidence
|
|
|
|
The independent review inspected the full implementation diffs and confirmed
|
|
that the dependency pins resolve to the intended role commits. A semantic
|
|
comparison found that the managed D&D pipeline topology matches the Notarius
|
|
v0.7.0 example after removing only the external reference paths that belong to
|
|
Narratio. The Narratio output map matches its upstream annotated example, and
|
|
the intentional omission of the optional spell catalog agrees with the feature
|
|
roadmap.
|
|
|
|
Both `ansible-role-notarius/tests/integration` and
|
|
`ansible-role-dnd-pipeline/tests/integration` passed. Post-suite checks also
|
|
confirmed the expected Seriatim and Notarius versions, native Notarius pipeline
|
|
validation, native Narratio validation for the base and testing profiles, and
|
|
a clean repeat. `git diff --check` passed, and all repositories were clean
|
|
before this review document was replaced.
|
|
|
|
After remediation, the complete pipeline integration entry point passed again.
|
|
It observed `archive-session` through Narratio, validated the alternate
|
|
Notarius pipeline, and reported `changed=0` and `failed=0` on the identical
|
|
repeat. Cleanup restored Seriatim v1.5.0 and the default `dnd-session`
|
|
configuration. `git diff --check` also passed.
|