ansible-workspace-dnd/docs/roadmap/remediation.md

Feature 0003 Remediation Review

Status: open

Reviewed implementation commits:

• 287fc4a Install and configure Notarius
• 733a194 Add focused Notarius integration coverage

The role's complete integration suite passes. The production architecture is substantially complete and follows the selected nine-operation flow, but the following issues should be corrected before Feature 0003 is marked done.

Finding 1: Correct the Galaxy License Metadata

Severity: medium

ansible-role-notarius/meta/main.yml declares license: BSD-3-Clause, while the repository's retained LICENSE file is CC0 1.0 Universal. Package metadata must not misstate the terms under which the repository is distributed.

Required Remediation

• Change the Galaxy license identifier to CC0-1.0, consistent with the repository license and the other standalone roles that use the same license.
• Run metadata lint as part of the complete integration suite.

Finding 2: Remove the Redundant Build Change Override

Severity: low

The Build Notarius task sets changed_when: true. The ansible.builtin.command module already reports a successful executed command as changed, and the task's when expression already determines exactly when a build occurs. The override adds no behavior and conflicts with the convention to trust module behavior and require a reason for every additional directive.

Required Remediation

• Remove changed_when: true from the production build task.
• Retain the existing rebuild expression unchanged: notarius_checkout.changed or not notarius_binary.stat.exists.
• Run the complete integration suite to confirm that build runs still report changed and immediate repeats remain clean.

Finding 3: Make the Dependency-Opt-Out Test Prove the Selected Go Binary

Severity: low

The integration suite sets notarius_go_binary to a symlink whose target is /snap/bin/go. The test succeeds with the current implementation, but it would also succeed if the build task ignored notarius_go_binary and hard-coded /snap/bin/go. It therefore does not establish the acceptance criterion that a caller-supplied Go executable is actually used.

Required Remediation

• Replace the symlink with a small executable wrapper in the suite's private temporary directory.
• Have the wrapper record its invocation and then delegate to /snap/bin/go.
• Assert that the invocation record was written during the dependency-opt-out build, while retaining the existing clean-repeat assertion.
• Keep the wrapper and its record in the existing private temporary directory; do not add production behavior.

Review Evidence

The review ran from ansible-role-notarius:

tests/integration
git diff --check

The complete suite passed with Ansible Core 2.21.3 and ansible-lint 26.8.0. It covered default convergence, the selected source commit, executable version, native configuration validation, clean repeats, missing-binary and checkout rebuilds, metadata repair without rebuilding, nullable field rendering, PromptKit source alternatives, intentional falsey values, caller-side pipeline-map composition, dependency opt-out, and platform rejection. The suite restored Notarius v0.6.0 and the minimal version: 4 configuration.

No additional production tasks, configuration probes, runtime validation, private state, or unrequested hardening were found.