ansible-workspace-dnd/docs/roadmap/remediation.md

# Feature 0022 Remediation Review

Status: resolved

Reviewed on 2026-09-29:
- Pipeline `8ea8621` and `ea8b09e`.
- Collection subtree import through `a78c309` and assembly `3d77eb3`.
- Consumer `f694dad`.

The production wiring implements the approved coordinated versions, Audita
backend/profile assets, credential lists, overlay paths, and nullable retry
controls. The collection's imported pipeline tree exactly matches the source
role. The following test-policy and operator-documentation issues were found
and have now been addressed as recorded below.
Git history preserves the previously resolved Feature 0013 remediation record.

## Finding 1: New assertions freeze unconfigured suite defaults

Priority: P2
Owners: pipeline role and collection tests.

Locations:
- `ansible-role-dnd-pipeline/tests/integration:172`–173.
- `ansible-collection-dnd/tests/integration:104`–105 and 108–109.

The new baseline assertions require specific Audita profile IDs and Narratio
credential lists, but the cases do not explicitly supply the corresponding
selection/list variables. Supplying synthetic values in `dnd_pipeline_secrets`
does not select the credential lists. These assertions therefore fail when
legitimate defaults change, even if installation and caller overrides work.

Required correction: remove redundant default-identity assertions from the
baseline smoke case, or explicitly supply the relevant public inputs and
assert those values. The pipeline already has a useful custom-credential
override case; prefer reusing its coverage. Keep native validation and clean
repeats. Do not replace literals by reading role defaults into expectations;
that would still test implementation identity rather than caller behavior.

This strengthens acceptance beyond the user's state-based testing policy.
The approved plan explicitly asked for supplied-value tests, not default
snapshots.

## Finding 2: Upgrade guidance confuses configuration with session migration

Priority: P2
Owners: pipeline README and consumer deployment guidance.

Locations:
- `ansible-role-dnd-pipeline/README.md:166`–168 and 337–338.
- `rakestraw-ansible/docs/pipeline-dnd.md:86`–104.

The pipeline links “Audita's v2 manifest migration” to Audita's configuration
migration guide, but does not identify Narratio's actual session-manifest
migration. The consumer likewise refers to “Audita manifests” and only
generically warns about Narratio manifests. The roadmap specifically requires
guidance on backing up and migrating local provenance while preserving
progress and immutable snapshots. Existing Narratio manifests containing
`effective_config.selected_profile` are rejected by v3.

Required correction:
- Describe Audita's change as a configuration/backend/profile migration.
- Link Narratio v3's exact operations section
  `#migrating-manifest-overlay-provenance`; briefly explain backup and
  `effective_config.selected_profile` → `selected_overlay` (or removal as
  upstream permits), preserving stage/checkpoint state and leaving immutable
  remote snapshots unchanged. Do not add automatic migration or forced reruns.
- Correct or remove the stale claim that Notarius v0.8.1 selects PromptKit
  v0.10.0. Its tagged release specifies v0.11.2; prefer linking upstream release
  notes over duplicating dependency/catalog versions.

This is a missing operator handoff, not a request for additional runtime code.

## Finding 3: Documentation makes managed secret files mandatory

Priority: P2
Owners: pipeline README and consumer deployment guidance.

Locations:
- `ansible-role-dnd-pipeline/README.md:160`–163.
- `rakestraw-ansible/docs/pipeline-dnd.md:69`–71.

The new text requires each credential to be supplied through
`dnd_pipeline_secrets`. Runtime behavior does not require that: Narratio can
resolve listed names from its process environment or existing secret files.
The README's existing managed-credentials section already describes environment
precedence and an empty default secrets map.

Required correction: require the credential names in the forwarding lists,
but describe managed secret files as the suite-supported provisioning option,
not the only permitted source. Preserve the consumer's chosen Vault workflow
without imposing it on every standalone suite user. No code or new tests are
needed for this wording correction.

This is an unintended documentation-level strengthening of the requirements.

## Review Validation

Shell syntax, changed-commit whitespace checks, pipeline syntax checking with
locally available collections, production-profile lint, and collection build
passed. Source and imported pipeline Git tree hashes match exactly. Reviewed
the recorded successful role/collection integration and consumer syntax runs;
did not rerun host-mutating convergence. A fresh dependency installation stalled
and was stopped, so this review does not independently establish a complete
fresh public dependency installation. No operational host was contacted.

## Remediation Boundaries

Fix authoritative pipeline files first, then publish and re-import the corrected
pipeline revision through the existing public Gitea subtree workflow. Do not
edit its collection copy directly. Update collection-owned tests and consumer
pins/links to the corrected public snapshot as needed. Preserve all agreed
application versions, configuration defaults, and runtime behavior. Validate
affected tests in proportion to the changes; no operational deployment,
credentials, live inference, or session migration is required.

## Resolution Evidence

All three findings were addressed on 2026-09-29:

- Finding 1: pipeline `37b1cf6` removes redundant baseline credential-list
  assertions while preserving custom-input coverage; collection `d9abb62`
  removes default profile-ID and credential-list assertions. Native profile
  inspection, configuration validation, and immediate clean-repeat checks remain.
- Findings 2 and 3: pipeline `37b1cf6` and consumer `15f0f4e` distinguish
  Audita configuration migration from Narratio session migration, link the
  exact provenance procedure, preserve progress and immutable snapshots,
  and allow environment or file-based credential provisioning. The stale
  Notarius dependency/catalog claim is replaced by tagged release guidance.
- The public pipeline revision is
  `37b1cf6fab71c6a1212e49357c2e825cb0237a00`; collection subtree import and
  public revision `b3bc0457efb7ea14ed11789978edd440537860fc` contain its exact
  Git tree. Both remote branch heads were independently checked with
  `git ls-remote`. Consumer `15f0f4e` selects that collection and links the
  corrected source README; the consumer commit remains local.
- Shell syntax and whitespace checks passed. Pipeline and installed-collection
  syntax checks and production-profile lint passed. Collection build and
  disposable artifact installation passed. Consumer real-inventory host
  listing selected only `pipeline-dnd`, and syntax checking passed without
  deployment or Vault decryption.
- Validation used the previously downloaded public role dependencies and
  available local collections. Full host-mutating integration was not rerun:
  production code/defaults are unchanged, test changes remove assertions and
  unused parsing, and prior full-run evidence remains applicable to unchanged
  behavior. No operational system or session state was modified.