ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0013 Remediation Review

Status: resolved

Reviewed implementation and release state:

• Application-role v0.1.0 tags at the five roadmap-fixed commits
• Pipeline release commit and tag 7c2bad827702fdcf78f8f77ece7d6270756bc3c5
• Collection subtree import da348eb8bd9878a58404a37dbcf22ad6562ac5c9
• Collection release commit and tag 63e8f3fb090a583226c7435bd900e10d41a30b89
• Public rakestraw.dnd 0.1.0 Gitea release and rakestraw-dnd-0.1.0.tar.gz attachment
• Workspace implementation record through 06e1b35f25589a3a6ff3fd2884208c86c4fee9c4

Review Summary

Feature 0013 implements the release architecture and public consumer path. The five application-role tags identify the exact reviewed commits selected by the roadmap. The standalone pipeline and collection manifests use those immutable tags, and the native collection dependencies remain pinned to ansible.posix 2.2.0 and community.general 13.3.0. The collection subtree's Git tree exactly matches public pipeline tag v0.1.0.

All seven repositories and tags are public and synchronized with their local counterparts. The collection's non-draft, non-prerelease Gitea release carries one correctly named archive. Its manifest declares rakestraw.dnd 0.1.0, the expected Ansible baseline and collection dependencies, and its file payload matches a fresh build from the tagged collection tree.

One low-severity documentation issue remains. The pipeline README now implies that collection snapshots may be imported only from role releases. That strengthens the settled maintenance contract beyond the requested release feature and contradicts the documented development workflow, which also permits a reviewed, pushed commit.

Finding 1: Pipeline Documentation Narrows Subtree Imports to Releases

Severity: low

ansible-role-dnd-pipeline/README.md:51-53 says that collection maintainers “import a reviewed release as a snapshot.” The same sentence is present in the faithfully imported collection copy at ansible-collection-dnd/roles/pipeline/README.md:51-53.

That wording accurately describes the particular snapshot used for collection release 0.1.0, but it reads as the general maintenance rule. The durable architecture deliberately permits the collection to import any reviewed pipeline commit that has been pushed to Gitea during development. An immutable pipeline tag is required only when preparing a released compatibility set. The collection's own maintenance section correctly accepts a pushed commit or immutable tag.

This is an inadvertent requirement strengthening: it could force an otherwise unnecessary pipeline-role release merely to assemble and test a development collection snapshot. It does not affect runtime behavior, the released dependency pins, subtree fidelity, or consumer installation.

Required Remediation

• In the authoritative pipeline README, replace the release-only wording with concise language saying that collection maintainers import a reviewed, pushed commit or immutable tag as a snapshot.
• Make no role, manifest, default, task, template, handler, or test change.
• Commit and push the pipeline documentation correction before importing it into the collection.
• Refresh roles/pipeline through the documented squashed subtree command using the pushed pipeline documentation commit as the remote revision. Do not edit the collection's subtree copy directly.
• Confirm that the resulting collection subtree Git tree exactly matches the selected pushed pipeline commit outside Git metadata.
• Do not move or replace any v0.1.0 tag, modify the published Gitea release, or replace its attachment. Those immutable artifacts correctly describe the historical 0.1.0 source state.
• Do not create a new role or collection release solely for this maintainer-facing wording correction.

Required Validation

Run:

cd ansible-role-dnd-pipeline
git diff --check

cd ../ansible-collection-dnd
../.venv/bin/ansible-galaxy collection build --output-path "$(mktemp -d)"
git diff --check

Also compare the imported roles/pipeline tree with a disposable clone of the selected pushed pipeline commit. The full application, pipeline, and collection integration suites do not need to be rerun because the remediation changes documentation only and preserves all Ansible and dependency content.

Resolution

Resolved in pipeline commit 78afffe and collection subtree import 5e695f3.

The authoritative pipeline README now states that collection maintainers may import either a reviewed, pushed commit or an immutable tag. The pipeline commit was pushed before the collection imported that exact Gitea revision through the documented squashed subtree workflow. The imported subtree and pipeline source have the same Git tree ID, 37f619ac24d2303847c4b9ea60db1f9fc1bf9d0e.

A fresh collection build succeeded, and git diff --check passed in both repositories. No Ansible content or dependency selection changed, so the integration suites were not rerun. The seven v0.1.0 tags, published collection release, and release attachment remain unchanged.

Review Validation Evidence

• Every local and remote v0.1.0 tag resolves to the commit recorded in the Feature 0013 roadmap and implementation notes.
• All seven Gitea repositories report public visibility and main as their default branch.
• The pipeline v0.1.0 tree ID and the collection tag's roles/pipeline tree ID are both 44a9d2b010012d8a63720b3a4ed07e9f255a5dae.
• The tagged raw collection manifest matches the repository manifest, and its role and collection selections match the released pipeline manifests.
• The public release API reports tag v0.1.0, title rakestraw.dnd 0.1.0, draft: false, prerelease: false, and one rakestraw-dnd-0.1.0.tar.gz attachment.
• The published archive has the same file list, MANIFEST.json, FILES.json, and file payload hashes as a fresh collection build from the tagged tree. It contains the pipeline entry point and omits the selected development-only subtree files.
• A fresh unauthenticated clone and release-attachment download installed the five public role tags and the collection into isolated Ansible paths. The installed rakestraw.dnd.pipeline role converged successfully and its immediate repeat reported changed=0 and failed=0.
• The complete repository-local collection integration suite independently passed isolated bootstrap, collection build and installation, syntax check, production-profile lint, native application validation, and immediate clean convergence.
• git diff --check passes for the pipeline, collection, and workspace implementation ranges. All workspace repositories are clean and synchronized with their upstream branches before this review finding is recorded.

No runtime code-quality issue, release-architecture gap, test-policy violation, or other inadvertent requirement strengthening was found.