ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0009 Remediation Review

Status: open

Reviewed implementation commits:

• 66ebea9 Make Audita configuration ownership configurable
• e9ae2dc Make Notarius configuration ownership configurable
• 8b4c86e Make Scriptorium configuration ownership configurable
• eeb1105 Make Narratio configuration ownership configurable

Review Summary

The four completed standalone-role stages are concise, idiomatic, and aligned with Feature 0009. Each role exposes owner, group, configuration-directory mode, and configuration-file mode variables; applies them directly through the ordinary file and template tasks; preserves its standalone defaults; and documents the interface. No redundant inspection, corrective convergence, private state, or unrelated application behavior was introduced. All four repository-local integration suites passed independently during review.

Feature 0009 as a whole is not implemented. The pipeline repository remains at pre-feature commit 3e253d7; Stages 5 through 8 have not been executed. The publication blocker encountered after Stage 4 has now been cleared: all four standalone commits are available from their canonical origins. The following findings therefore describe the remaining target architecture rather than defects in the completed standalone commits.

Finding 1: The Pipeline Does Not Select the Shared Configuration Policy

Severity: high

ansible-role-dnd-pipeline/defaults/main.yml and meta/argument_specs.yml do not define the four suite-level runtime identity and configuration-mode variables. meta/main.yml:19-98 still runs Narratio last and does not pass the new configuration ownership interfaces to Audita, Notarius, Scriptorium, or Narratio. requirements.yml:7-22 still pins the four pre-feature role commits.

Consequently, applying the current pipeline role retains standalone ownership: Audita, Notarius, and Scriptorium configuration remains root:root, while Narratio configuration remains root:narratio with its standalone restrictive modes. The target narratio:narratio, 0755 directory, and 0644 file suite policy is not selected. Narratio also does not establish the service identity before the other configuration-bearing dependencies run.

Required Remediation

• Use the four published, immutable standalone-role commits recorded above; do not replace their commit pins with branches.
• Execute Stage 5 of docs/roadmap/implementation.md in full.
• Add the four suite defaults and argument-spec entries, run Narratio first, pass the selected identity and modes through every generic role interface, update the four dependency pins, and apply the same values directly to the pipeline-owned Narratio fragments.
• Retain direct module convergence without any post-dependency permission repair.

Finding 2: Shared Writable-Root ACL Convergence Is Absent

Severity: high

ansible-role-dnd-pipeline/collections/requirements.yml:1-4 contains only community.general. tasks/main.yml:1-65 neither installs Ubuntu's acl package nor uses ansible.posix.acl. The three Narratio writable roots still receive mode 2775 from the standalone role, but the suite does not establish the access and default ACLs required to preserve group write and world read/traverse behavior across invocation identities with different umasks.

Required Remediation

• Execute Stage 6 of the implementation plan in full.
• Pin ansible.posix 2.2.0 alongside the existing collection dependency.
• Install acl with one ordinary privileged ansible.builtin.apt task.
• Apply the selected access and default ACL entries to exactly /var/lib/narratio, /var/spool/narratio, and /var/cache/narratio with direct, non-recursive ansible.posix.acl convergence.
• Do not add filesystem probes, getfacl production commands, recursive migration, handler flow, or supplemental permission repair.

Finding 3: The Shared Execution Contract Has No Behavioral Coverage

Severity: medium

ansible-role-dnd-pipeline/tests/integration:64-133 exercises the established pipeline only as root and the narratio service account. It does not use a representative existing member of the shared group, exchange writable-state content between invocation identities, exercise inheritance under a restrictive ordinary umask, or observe the deliberate world-readable boundary.

The missing tests are important because the group-sharing outcome is suite behavior authored by this feature, not a request to re-test an individual Ansible module. The tests should exercise actual access rather than assert mode values or parse ACL metadata.

Required Remediation

• Execute Stage 7 of the implementation plan after Findings 1 and 2 are resolved.
• Use one uniquely named, test-owned operator account as an integration fixture and clean up only that account and its explicitly named content.
• Validate one representative Narratio operation as that group member and one bidirectional content exchange with the service account.
• Observe one representative world-readable configuration or artifact as an account outside the group.
• Preserve immediate clean repeated convergence and avoid an exhaustive identity, path, mode, or ACL matrix.

Finding 4: Pipeline Consumer Documentation Is Stale

Severity: medium

ansible-role-dnd-pipeline/README.md:185 still lists operator access among deferred concerns. It does not document the new suite variables, Narratio-first dependency order, service-owned and world-readable configuration, shared setgid roots, inherited ACL behavior, existing-group-member invocation, or the restricted future secrets/ boundary.

Required Remediation

• Execute Stage 8 of the implementation plan after the production behavior and tests are complete.
• Clearly distinguish generic standalone defaults from the pipeline's opinionated overrides.
• Document setgid terminology, the three shared roots, supported invocation identities, the fact that production does not manage human membership, and the deliberate non-secret boundary.
• Do not promise the deferred secrets implementation, recursive migration, or Feature 0010 Notarius behavior.

Required Validation

After remediation, run the complete integration entry point in each changed role:

cd ansible-role-audita && tests/integration
cd ../ansible-role-notarius && tests/integration
cd ../ansible-role-scriptorium && tests/integration
cd ../ansible-role-narratio && tests/integration
cd ../ansible-role-dnd-pipeline && tests/integration

Then run from the workspace root:

git diff --check
./scripts/status

The expected result is that all five role suites pass syntax and lint checks, native application checks succeed, the shared cross-identity contract is observed, every immediate repeat reports changed=0 and failed=0, all eight implementation-stage commits are identified, and every repository is clean.

Review Validation Evidence

During this review, the complete tests/integration entry points passed in ansible-role-audita, ansible-role-notarius, ansible-role-scriptorium, and ansible-role-narratio. Each suite installed its pinned collection dependencies, passed syntax checking and production-profile lint, exercised its native application behavior, and reported clean immediate repeats. git diff --check passed and all implementation repositories remained clean after testing.

The pipeline suite was not presented as Feature 0009 validation evidence because the pipeline repository contains no Feature 0009 implementation commits. Its current test suite exercises the prior Feature 0008 architecture. After review, each standalone commit was pushed to its canonical origin/main branch and the local and remote-tracking revisions were confirmed identical.