Merge commit 'd5563c5736f489b48e91ca338f61c1e993337065'

roles/pipeline/README.md

@@ -62,7 +62,7 @@ The compatible application versions are selected through these variables:
 | Variable | Default |
 | --- | --- |
 | `dnd_pipeline_audita_version` | `v2.0.1` |
-| `dnd_pipeline_narratio_version` | `v3.0.0` |
+| `dnd_pipeline_narratio_version` | `v3.1.0` |
 | `dnd_pipeline_notarius_version` | `v0.8.1` |
 | `dnd_pipeline_seriatim_version` | `v1.5.0` |
 | `dnd_pipeline_scriptorium_version` | `v0.15.0` |
@@ -196,12 +196,26 @@ force all stages to rerun. The role performs no session migration.
 | `dnd_pipeline_scriptorium_transient_retries` | `null`; native default |
 | `dnd_pipeline_narratio_audita_credentials` | `[AUDITA_LLM_API_KEY]` |
 | `dnd_pipeline_narratio_notarius_credentials` | `[OPENROUTER_API_KEY]` |
+| `dnd_pipeline_narratio_scriptorium_credentials` | `[OPENROUTER_API_KEY]` |
 
 `dnd_pipeline_audita_output_schema` is also the Narratio Audita-adapter schema;
 it is the shared cross-application boundary. Other Narratio-local controls,
 including reports, timeouts, debug rendering, presentation, and bounds prompt
 profile selection, remain Narratio defaults.
 
+Narratio v3.1.0 forwards the selected Scriptorium credential names for trim,
+analysis, character families, and render-debug calls. The Scriptorium and
+Notarius lists independently default to the existing `OPENROUTER_API_KEY` name;
+using the same provisioned value does not couple their selections. Inventory
+may replace the Scriptorium list, set `[]` to forward nothing, or set `null` to
+omit the field. Each selected name must resolve to a nonempty value when
+Narratio loads configuration, even for inspection commands. Values may come
+from Narratio's process environment or its existing secrets directory;
+`dnd_pipeline_secrets` is optional file provisioning, not the only source.
+After upgrading and provisioning the selected key, retry a failed trim or
+analysis normally. Do not force already successful work solely because a
+credential was added or rotated.
+
 ### Storage and publication policy
 
 The suite selects Narratio's S3 backend and the established Backblaze-compatible

roles/pipeline/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 dnd_pipeline_audita_version: v2.0.1
-dnd_pipeline_narratio_version: v3.0.0
+dnd_pipeline_narratio_version: v3.1.0
 dnd_pipeline_notarius_version: v0.8.1
 dnd_pipeline_seriatim_version: v1.5.0
 dnd_pipeline_scriptorium_version: v0.15.0
@@ -257,6 +257,8 @@ dnd_pipeline_narratio_audita_credentials:
   - AUDITA_LLM_API_KEY
 dnd_pipeline_narratio_notarius_credentials:
   - OPENROUTER_API_KEY
+dnd_pipeline_narratio_scriptorium_credentials:
+  - OPENROUTER_API_KEY
 dnd_pipeline_narratio_notarius_resume: true
 dnd_pipeline_narratio_notarius_references:
   party: narratio.input.party

roles/pipeline/meta/argument_specs.yml

@@ -303,6 +303,11 @@ argument_specs:
         elements: str
         required: true
         description: Credential names forwarded by Narratio to Notarius.
+      dnd_pipeline_narratio_scriptorium_credentials:
+        type: list
+        elements: str
+        required: false
+        description: Optional credential names forwarded by Narratio to Scriptorium.
       dnd_pipeline_narratio_notarius_resume:
         type: bool
         required: true

roles/pipeline/meta/main.yml

@@ -67,6 +67,7 @@ dependencies:
       narratio_notarius_outputs: "{{ dnd_pipeline_narratio_notarius_outputs }}"
       narratio_scriptorium_binary: /usr/local/bin/scriptorium
       narratio_scriptorium_config_path: /usr/local/etc/scriptorium/config.yml
+      narratio_scriptorium_credentials: "{{ dnd_pipeline_narratio_scriptorium_credentials }}"
   - role: rakestraw.seriatim
     vars:
       seriatim_version: "{{ dnd_pipeline_seriatim_version }}"

roles/pipeline/requirements.yml

@@ -19,4 +19,4 @@ roles:
   - name: rakestraw.narratio
     src: https://gitea.maximumdirect.net/eric/ansible-role-narratio.git
     scm: git
-    version: 3c0700b5323293d44e3b1e67a50074d82d7a3bff
+    version: 758aed7a74c9a64ad02e13ff551b4f7aea16b3af

roles/pipeline/tests/integration

@@ -325,6 +325,7 @@ override_config="{\"dnd_pipeline_audita_backends\":{\"fixture\":{\"endpoint\":\"
 "\"fixture-validation\":{\"id\":\"fixture-validation\",\"backend\":\"fixture\",\"model\":\"fixture/validation\",\"timeout_seconds\":900}},"\
 "\"dnd_pipeline_audita_llm_proposal_profile\":\"fixture-proposal\",\"dnd_pipeline_audita_llm_validation_profile\":\"fixture-validation\","\
 "\"dnd_pipeline_narratio_audita_credentials\":[\"FIXTURE_AUDITA_KEY\"],\"dnd_pipeline_narratio_notarius_credentials\":[\"FIXTURE_NOTARIUS_KEY\"],"\
+"\"dnd_pipeline_narratio_scriptorium_credentials\":[\"FIXTURE_AUDITA_KEY\",\"FIXTURE_NOTARIUS_KEY\"],"\
 "\"dnd_pipeline_audita_llm_transient_retries\":0,\"dnd_pipeline_audita_llm_repair_attempts\":0,\"dnd_pipeline_audita_llm_operation_timeout\":\"20m\","\
 "\"dnd_pipeline_notarius_promptkit_transient_retries\":0,\"dnd_pipeline_scriptorium_transient_retries\":0,"\
 "\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\","\
@@ -345,6 +346,7 @@ FIXTURE_AUDITA_KEY="$synthetic_fixture_audita_key" \
 notarius_override_config="$test_tmp/notarius-override.yml"
 scriptorium_override_config="$test_tmp/scriptorium-override.yml"
 narratio_override_config="$test_tmp/narratio-override.yml"
+narratio_testing_override_config="$test_tmp/narratio-testing-override.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
   > "$notarius_override_config"
 /usr/local/bin/scriptorium config show --config /usr/local/etc/scriptorium/config.yml \
@@ -352,15 +354,18 @@ narratio_override_config="$test_tmp/narratio-override.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs \
   > "$narratio_override_config"
+/usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
+  > "$narratio_testing_override_config"
 "$workspace_venv/bin/python" - \
   "$audita_override_settings" "$audita_override_profiles" \
   "$notarius_override_config" "$scriptorium_override_config" \
-  "$narratio_override_config" <<'PY'
+  "$narratio_override_config" "$narratio_testing_override_config" <<'PY'
 import sys
 
 import yaml
 
-settings, profiles, notarius, scriptorium, narratio = (
+settings, profiles, notarius, scriptorium, narratio, narratio_testing = (
     yaml.safe_load(open(path, encoding="utf-8")) for path in sys.argv[1:]
 )
 assert settings["backends"]["fixture"]["endpoint"] == "https://inference.fixture.invalid/v1"
@@ -376,6 +381,8 @@ assert notarius["promptkit"]["transient_retries"] == 0
 assert scriptorium["transient_retries"] == 0
 assert narratio["audita"]["credentials"] == ["FIXTURE_AUDITA_KEY"]
 assert narratio["notarius"]["credentials"] == ["FIXTURE_NOTARIUS_KEY"]
+assert narratio["scriptorium"]["credentials"] == ["FIXTURE_AUDITA_KEY", "FIXTURE_NOTARIUS_KEY"]
+assert narratio_testing["scriptorium"]["credentials"] == ["FIXTURE_AUDITA_KEY", "FIXTURE_NOTARIUS_KEY"]
 PY
 ! grep -Fq "$synthetic_fixture_audita_key" "$override_log" "$narratio_override_config"
 ! grep -Fq "$synthetic_fixture_notarius_key" "$override_log" "$narratio_override_config"