ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0010 Remediation Review

Status: resolved

Reviewed implementation commits:

• 14a38e0 Upgrade the Notarius role to version 0.7.0
• 90893ae Integrate Notarius extraction into the D&D pipeline
• 7fd7b24 Document and test the D&D Notarius integration

Review Summary

Feature 0010 implements the intended production architecture. The standalone Notarius role supports ConfigKit imports without owning imported fragments. The pipeline role owns the complete D&D extraction topology, renders it as a ConfigKit fragment, selects it from the root Notarius configuration, connects Narratio to that pipeline and its artifact paths, and manages a shared FHS cache with the pipeline's group-access policy. The complete standalone and pipeline integration suites pass, including native application validation and immediate clean repeats.

No production behavior gap was found. Two low-severity issues should be addressed: the configurable pipeline-ID boundary is not observed through Narratio in the integration suite, and the ACL task names no longer describe all of the roots they manage.

Finding 1: Alternate Pipeline Selection Is Not Observed Through Narratio

Severity: low

ansible-role-dnd-pipeline/tests/integration:172-187 composes two alternate Notarius pipeline maps and selects archive-session through dnd_pipeline_narratio_notarius_pipeline_id. The test then validates only the Notarius configuration and cache-mode override. It does not inspect Narratio's effective configuration after the alternate convergence.

The production wiring in ansible-role-dnd-pipeline/meta/main.yml:45-50 is correct, but a future regression that stops forwarding the selected pipeline ID to Narratio could pass the current test. This is a focused behavioral coverage gap at a feature-owned integration boundary, not a request for a snapshot or implementation-detail assertion.

Required Remediation

• After the alternate convergence, use Narratio's native configuration command with a deployed campaign and inspect the effective selected pipeline ID.
• Assert that Narratio observes archive-session.
• Retain the existing native Notarius checks, cache-mode check, and immediate clean repeat.
• Do not run model-backed extraction or snapshot the complete generated configuration.

Finding 2: ACL Task Names Exclude the Notarius Cache They Manage

Severity: low

ansible-role-dnd-pipeline/tasks/main.yml:19 and ansible-role-dnd-pipeline/tasks/main.yml:39 describe their ACL loops as managing "Narratio writable roots." Both loops now also manage the Notarius cache root. The task behavior is correct, but the execution log is misleading about its scope.

Required Remediation

• Rename both ACL tasks to describe the shared pipeline writable roots.
• Do not otherwise change the direct desired-state ACL implementation or its task flow.

Resolution

Resolved in pipeline-role commit bbf01e1. The alternate-map integration case now uses Narratio's native config show command to observe the selected archive-session pipeline ID before its immediate clean repeat. The two ACL task names now describe shared pipeline writable roots without changing their module arguments, loops, or task flow.

Required Validation

After remediation, run:

cd ansible-role-dnd-pipeline && tests/integration
git diff --check

The expected result is successful native configuration validation for the base, testing, and alternate profiles; observation of archive-session through Narratio; successful shared-cache access; and immediate repeats with changed=0 and failed=0.

Review Validation Evidence

The independent review inspected the full implementation diffs and confirmed that the dependency pins resolve to the intended role commits. A semantic comparison found that the managed D&D pipeline topology matches the Notarius v0.7.0 example after removing only the external reference paths that belong to Narratio. The Narratio output map matches its upstream annotated example, and the intentional omission of the optional spell catalog agrees with the feature roadmap.

Both ansible-role-notarius/tests/integration and ansible-role-dnd-pipeline/tests/integration passed. Post-suite checks also confirmed the expected Seriatim and Notarius versions, native Notarius pipeline validation, native Narratio validation for the base and testing profiles, and a clean repeat. git diff --check passed, and all repositories were clean before this review document was replaced.

After remediation, the complete pipeline integration entry point passed again. It observed archive-session through Narratio, validated the alternate Notarius pipeline, and reported changed=0 and failed=0 on the identical repeat. Cleanup restored Seriatim v1.5.0 and the default dnd-session configuration. git diff --check also passed.