Merge commit '3599f39f4926dc8f86866f138da0d36138b5c511'

roles/pipeline/README.md

@@ -61,11 +61,11 @@ The compatible application versions are selected through these variables:
 
 | Variable | Default |
 | --- | --- |
-| `dnd_pipeline_audita_version` | `v0.9.1` |
+| `dnd_pipeline_audita_version` | `v2.0.1` |
-| `dnd_pipeline_narratio_version` | `v2.2.0` |
+| `dnd_pipeline_narratio_version` | `v3.0.0` |
-| `dnd_pipeline_notarius_version` | `v0.7.1` |
+| `dnd_pipeline_notarius_version` | `v0.8.1` |
 | `dnd_pipeline_seriatim_version` | `v1.5.0` |
-| `dnd_pipeline_scriptorium_version` | `v0.13.0` |
+| `dnd_pipeline_scriptorium_version` | `v0.15.0` |
 | `dnd_pipeline_manage_build_dependencies` | `true` |
 | `dnd_pipeline_go_snap_channel` | `1.26/stable` |
 | `dnd_pipeline_go_binary` | `/snap/bin/go` |
@@ -119,20 +119,53 @@ chosen policy value when their deployment requires it.
 | --- | --- |
 | `dnd_pipeline_audita_pipeline_modules` | `glossary`, `homophones`, `glossary`, `spoken_word`, `grammar` |
 | `dnd_pipeline_audita_output_schema` | `audita-v1` |
-| `dnd_pipeline_audita_llm_proposal_*` | `https://inference.ai.rakestrawhome.com/v1`, `google/gemma-4-31b-it`, `AUDITA_LLM_API_KEY`, `900s`, `3` |
+| `dnd_pipeline_audita_backends` | Native `dnd` backend at `https://inference.ai.rakestrawhome.com/v1`, credential `AUDITA_LLM_API_KEY`, shared concurrency `4` |
-| `dnd_pipeline_audita_llm_validation_*` | `https://inference.ai.rakestrawhome.com/v1`, `google/gemma-4-31b-it`, `AUDITA_LLM_API_KEY`, `900s`, `3` |
+| `dnd_pipeline_audita_profiles` | Complete native `dnd-proposal` and `dnd-validation` mappings using `google/gemma-4-31b-it` and 900-second attempt timeouts |
-| `dnd_pipeline_audita_concurrency_*` | total, proposal, and validation concurrency of `4` |
+| `dnd_pipeline_audita_llm_proposal_profile` | `dnd-proposal` |
+| `dnd_pipeline_audita_llm_validation_profile` | `dnd-validation` |
+| `dnd_pipeline_audita_llm_transient_retries`, `dnd_pipeline_audita_llm_repair_attempts`, `dnd_pipeline_audita_llm_operation_timeout` | `null`; omit overrides and use native defaults |
 | `dnd_pipeline_audita_chunking_*` | `8` target sections, `6144` maximum and `2048` minimum section tokens |
-| `dnd_pipeline_audita_normalization_*` | `3s` maximum and ellipsis gaps, `240s` maximum duration, `2048` maximum tokens |
+| `dnd_pipeline_audita_normalization_*` | `3.0` maximum and ellipsis gaps, `240.0` maximum duration, `2048` maximum tokens |
 | `dnd_pipeline_audita_thresholds_*` | `0.8` for glossary, homophones, spoken word, and grammar |
 | `dnd_pipeline_audita_context_description` | D&D-game transcript context, including possible pre- and post-session banter |
-| `dnd_pipeline_audita_diagnostics_*` | `/tmp/audita`, retained automatically |
+| `dnd_pipeline_audita_diagnostics_work_dir` | `/tmp/audita` |
 
-Audita's proposal and validation settings independently remain overrideable,
+Audita owns its backend and LLM policy. The suite writes each complete profile
-but both default to the one typed `AUDITA_LLM_API_KEY` reference Narratio can
+mapping to `/usr/local/etc/audita/profiles/<key>.yml`; keys must be filename-safe
-forward. Audita owns its endpoint, model, tuning, and diagnostics configuration;
+IDs matching each mapping's `id`. Inventory may replace the mappings and selected
-Narratio receives its managed Audita configuration path and supplies the
+IDs. Narratio forwards the configured credential names, while Audita's native
-run-specific output path.
+configuration resolves them. The role does not remove old profile files.
+
+For inventories upgrading from the prior suite, replace the separate Audita
+proposal/validation endpoint, model, key, timeout, and concurrency variables
+with `dnd_pipeline_audita_backends` and `dnd_pipeline_audita_profiles`, then
+select profile IDs with the two `dnd_pipeline_audita_llm_*_profile` variables.
+Replace `dnd_pipeline_narratio_notarius_llm_api_key` with
+`dnd_pipeline_narratio_notarius_credentials`, and use
+`dnd_pipeline_narratio_audita_credentials` for Audita's backend credential
+names. The old diagnostics retention variable is no longer forwarded.
+
+The old per-purpose Audita endpoint and API-key names now belong to the
+backend map; both default profiles share the `dnd` backend and its one
+concurrency limit. Old proposal and validation models and per-attempt timeouts
+belong in complete profile mappings. The default 900-second value is retained
+per attempt; `dnd_pipeline_audita_llm_operation_timeout` is an independent
+whole-operation deadline and defaults to `null`, leaving Audita's native
+policy in charge. The former `*_max_retries` variables do not have a direct
+one-to-one replacement: use the optional Audita transient retry and repair
+attempt settings according to the desired native behavior. Optional retry
+pass-throughs for Notarius PromptKit and Scriptorium likewise default to
+`null`; an explicit `0` is forwarded, not treated as omission.
+
+Inventory must supply each named backend credential through
+`dnd_pipeline_secrets` and include its name in
+`dnd_pipeline_narratio_audita_credentials`. Narratio forwards only names in
+that list and does not discover them from Audita's configuration. The
+Notarius list is independent. For profile overrides, use filename-safe map
+keys equal to each profile's native `id`; the suite writes each map value
+unchanged and does not merge individual fields. See [Audita's v2 manifest
+migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+for application-owned manifests; this role does not convert them.
 
 | Variable | Default |
 | --- | --- |
@@ -148,6 +181,10 @@ run-specific output path.
 | `dnd_pipeline_narratio_render_format` | `markdown` |
 | `dnd_pipeline_narratio_testing_scriptorium_profile` | `gemini-flash-latest` |
 | `dnd_pipeline_notarius_testing_llm_profile` | `gpt-luna-latest` |
+| `dnd_pipeline_notarius_promptkit_transient_retries` | `null`; native default |
+| `dnd_pipeline_scriptorium_transient_retries` | `null`; native default |
+| `dnd_pipeline_narratio_audita_credentials` | `[AUDITA_LLM_API_KEY]` |
+| `dnd_pipeline_narratio_notarius_credentials` | `[OPENROUTER_API_KEY]` |
 
 `dnd_pipeline_audita_output_schema` is also the Narratio Audita-adapter schema;
 it is the shared cross-application boundary. Other Narratio-local controls,
@@ -221,7 +258,7 @@ suite-owned base fragments in this fixed order:
 ├── artifacts/deranged-rumors.yml
 ├── artifacts/scene-map.yml
 ├── artifact-families/character-meta-analysis.yml
-└── profiles/testing.yml
+└── overlays/testing.yml
 ```
 
 Notarius follows the corresponding base-and-overlay layout:
@@ -230,10 +267,10 @@ Notarius follows the corresponding base-and-overlay layout:
 /usr/local/etc/notarius/
 ├── config.yml
 ├── pipelines/dnd-session.yml
-└── profiles/testing.yml
+└── overlays/testing.yml
 ```
 
-The `testing` profile is an overlay, not a second configuration tree. It sets
+The `testing` overlay is not a second configuration tree. It sets
 the Scriptorium `profile_id` for the four artifact sources and the one family,
 and explicitly selects Notarius's separately managed `testing` overlay. The
 Scriptorium default, `gemini-flash-latest`, is an inexpensive development
@@ -245,12 +282,19 @@ dnd_pipeline_narratio_testing_scriptorium_profile: endpoint-profile
 dnd_pipeline_notarius_testing_llm_profile: alternate-economy-profile
 ```
 
+Narratio selects it with `--overlay testing`, and direct Notarius commands
+use `--config-overlay testing`; the former `--profile` and
+`--config-profile` selectors are retired. Previously deployed
+`profiles/testing.yml` files are ignored, not pruned. Renaming the selected
+overlay normally changes configuration identity, so cached work tied to the
+old named selection may not be reused.
+
 ### Notarius extraction policy
 
 The Notarius root configuration imports the fixed
 `pipelines/dnd-session.yml` fragment. The suite owns that fragment at
 `/usr/local/etc/notarius/pipelines/dnd-session.yml`; callers do not edit it.
-The separate `/usr/local/etc/notarius/profiles/testing.yml` overlay changes only
+The separate `/usr/local/etc/notarius/overlays/testing.yml` overlay changes only
 the selected suite pipeline's LLM profile.
 
 | Variable | Default policy |
@@ -261,7 +305,7 @@ the selected suite pipeline's LLM profile.
 | `dnd_pipeline_notarius_cache_checkpoints_enabled` | `true` |
 | `dnd_pipeline_notarius_testing_llm_profile` | `gpt-luna-latest` |
 | `dnd_pipeline_narratio_notarius_pipeline_id` | `dnd-session` |
-| `dnd_pipeline_narratio_notarius_llm_api_key` | `OPENROUTER_API_KEY` |
+| `dnd_pipeline_narratio_notarius_credentials` | `[OPENROUTER_API_KEY]` |
 | `dnd_pipeline_narratio_notarius_resume` | `true` |
 | `dnd_pipeline_narratio_notarius_references` | `party`, `players`, and `glossary` prepared sources |
 | `dnd_pipeline_narratio_notarius_outputs` | Complete native map of ten accepted D&D lanes |
@@ -290,7 +334,7 @@ Notarius profile and ordinary extraction requests checkpoint reuse with
 `resume: true`. Chunk plans use Notarius's root-owned `auto` policy; the
 pipeline deliberately leaves Narratio's optional `chunk_cache` override unset.
 The `chunk-plans` and `checkpoints` paths derive from the cache root and are
-created by Notarius during use. Notarius v0.7.1 selects PromptKit v0.10.0 and
+created by Notarius during use. Notarius v0.8.1 selects PromptKit v0.10.0 and
 OpenRouter catalog v2.20260922.1, which supplies both suite-selected IDs.
 Existing checkpoints with the previous profile-source identity are not reused;
 source-keyed chunk plans and output artifacts remain compatible. No cache
@@ -308,7 +352,7 @@ the party-driven character family:
 sudo -u narratio narratio config validate \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs
 sudo -u narratio narratio config validate \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --profile testing
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing
 sudo -u narratio narratio config artifacts \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs
 sudo -u narratio narratio config diff default testing \

roles/pipeline/defaults/main.yml

@@ -1,9 +1,9 @@
 ---
-dnd_pipeline_audita_version: v0.9.1
+dnd_pipeline_audita_version: v2.0.1
-dnd_pipeline_narratio_version: v2.2.0
+dnd_pipeline_narratio_version: v3.0.0
-dnd_pipeline_notarius_version: v0.7.1
+dnd_pipeline_notarius_version: v0.8.1
 dnd_pipeline_seriatim_version: v1.5.0
-dnd_pipeline_scriptorium_version: v0.13.0
+dnd_pipeline_scriptorium_version: v0.15.0
 dnd_pipeline_manage_build_dependencies: true
 dnd_pipeline_go_snap_channel: 1.26/stable
 dnd_pipeline_go_binary: /snap/bin/go
@@ -26,25 +26,33 @@ dnd_pipeline_audita_pipeline_modules:
   - spoken_word
   - grammar
 dnd_pipeline_audita_output_schema: audita-v1
-dnd_pipeline_audita_llm_proposal_base_url: https://inference.ai.rakestrawhome.com/v1
+dnd_pipeline_audita_backends:
-dnd_pipeline_audita_llm_proposal_model: google/gemma-4-31b-it
+  dnd:
-dnd_pipeline_audita_llm_proposal_api_key_env: AUDITA_LLM_API_KEY
+    endpoint: https://inference.ai.rakestrawhome.com/v1
-dnd_pipeline_audita_llm_proposal_timeout: 900s
+    credential: AUDITA_LLM_API_KEY
-dnd_pipeline_audita_llm_proposal_max_retries: 3
+    concurrency: 4
-dnd_pipeline_audita_llm_validation_base_url: https://inference.ai.rakestrawhome.com/v1
+dnd_pipeline_audita_profiles:
-dnd_pipeline_audita_llm_validation_model: google/gemma-4-31b-it
+  dnd-proposal:
-dnd_pipeline_audita_llm_validation_api_key_env: AUDITA_LLM_API_KEY
+    id: dnd-proposal
-dnd_pipeline_audita_llm_validation_timeout: 900s
+    backend: dnd
-dnd_pipeline_audita_llm_validation_max_retries: 3
+    model: google/gemma-4-31b-it
-dnd_pipeline_audita_concurrency_total_llm: 4
+    timeout_seconds: 900
-dnd_pipeline_audita_concurrency_proposal_llm: 4
+  dnd-validation:
-dnd_pipeline_audita_concurrency_validation_llm: 4
+    id: dnd-validation
+    backend: dnd
+    model: google/gemma-4-31b-it
+    timeout_seconds: 900
+dnd_pipeline_audita_llm_proposal_profile: dnd-proposal
+dnd_pipeline_audita_llm_validation_profile: dnd-validation
+dnd_pipeline_audita_llm_transient_retries: null
+dnd_pipeline_audita_llm_repair_attempts: null
+dnd_pipeline_audita_llm_operation_timeout: null
 dnd_pipeline_audita_chunking_target_sections: 8
 dnd_pipeline_audita_chunking_max_section_tokens: 6144
 dnd_pipeline_audita_chunking_min_section_tokens: 2048
-dnd_pipeline_audita_normalization_max_segment_gap: 3s
+dnd_pipeline_audita_normalization_max_segment_gap: 3.0
-dnd_pipeline_audita_normalization_ellipsis_gap: 3s
+dnd_pipeline_audita_normalization_ellipsis_gap: 3.0
-dnd_pipeline_audita_normalization_max_segment_duration: 240s
+dnd_pipeline_audita_normalization_max_segment_duration: 240.0
 dnd_pipeline_audita_normalization_max_segment_tokens: 2048
 dnd_pipeline_audita_thresholds_glossary: 0.8
 dnd_pipeline_audita_thresholds_homophones: 0.8
@@ -55,7 +63,6 @@ dnd_pipeline_audita_context_description: >-
   It may contain some unrelated pre-session or post-session banter, in addition
   to actual D&D gameplay.
 dnd_pipeline_audita_diagnostics_work_dir: /tmp/audita
-dnd_pipeline_audita_diagnostics_retention: auto
 dnd_pipeline_notarius_pipelines:
   dnd-session:
     llm_profile: gpt-terra-latest
@@ -208,6 +215,8 @@ dnd_pipeline_notarius_cache_root: /var/cache/notarius
 dnd_pipeline_notarius_cache_chunk_plans_mode: auto
 dnd_pipeline_notarius_cache_checkpoints_enabled: true
 dnd_pipeline_notarius_testing_llm_profile: gpt-luna-latest
+dnd_pipeline_notarius_promptkit_transient_retries: null
+dnd_pipeline_scriptorium_transient_retries: null
 dnd_pipeline_narratio_workspace_cleanup_after_publish: true
 dnd_pipeline_narratio_storage_backend: s3
 dnd_pipeline_narratio_storage_s3_bucket: rakestraw-assets
@@ -244,7 +253,10 @@ dnd_pipeline_narratio_trim_bounds_prompt_id: dnd.session_bounds
 dnd_pipeline_narratio_trim_bounds_transcript_input_name: transcript
 dnd_pipeline_narratio_trim_bounds_output_path: artifacts/session_bounds.json
 dnd_pipeline_narratio_notarius_pipeline_id: dnd-session
-dnd_pipeline_narratio_notarius_llm_api_key: OPENROUTER_API_KEY
+dnd_pipeline_narratio_audita_credentials:
+  - AUDITA_LLM_API_KEY
+dnd_pipeline_narratio_notarius_credentials:
+  - OPENROUTER_API_KEY
 dnd_pipeline_narratio_notarius_resume: true
 dnd_pipeline_narratio_notarius_references:
   party: narratio.input.party

roles/pipeline/meta/argument_specs.yml

@@ -97,58 +97,34 @@ argument_specs:
         type: str
         required: true
         description: Audita output schema shared with Narratio.
-      dnd_pipeline_audita_llm_proposal_base_url:
+      dnd_pipeline_audita_backends:
+        type: dict
+        required: true
+        description: Native Audita backend definitions.
+      dnd_pipeline_audita_profiles:
+        type: dict
+        required: true
+        description: Native Audita profiles keyed by filename-safe IDs matching each mapping's id.
+      dnd_pipeline_audita_llm_proposal_profile:
         type: str
         required: true
-        description: Audita proposal LLM endpoint.
+        description: Audita proposal profile ID.
-      dnd_pipeline_audita_llm_proposal_model:
+      dnd_pipeline_audita_llm_validation_profile:
         type: str
         required: true
-        description: Audita proposal LLM model.
+        description: Audita validation profile ID.
-      dnd_pipeline_audita_llm_proposal_api_key_env:
+      dnd_pipeline_audita_llm_transient_retries:
-        type: str
-        required: true
-        description: Proposal LLM API-key environment variable name.
-      dnd_pipeline_audita_llm_proposal_timeout:
-        type: str
-        required: true
-        description: Proposal LLM timeout.
-      dnd_pipeline_audita_llm_proposal_max_retries:
         type: int
-        required: true
+        required: false
-        description: Proposal LLM retry count.
+        description: Optional Audita transient retry override.
-      dnd_pipeline_audita_llm_validation_base_url:
+      dnd_pipeline_audita_llm_repair_attempts:
-        type: str
-        required: true
-        description: Audita validation LLM endpoint.
-      dnd_pipeline_audita_llm_validation_model:
-        type: str
-        required: true
-        description: Audita validation LLM model.
-      dnd_pipeline_audita_llm_validation_api_key_env:
-        type: str
-        required: true
-        description: Validation LLM API-key environment variable name.
-      dnd_pipeline_audita_llm_validation_timeout:
-        type: str
-        required: true
-        description: Validation LLM timeout.
-      dnd_pipeline_audita_llm_validation_max_retries:
         type: int
-        required: true
+        required: false
-        description: Validation LLM retry count.
+        description: Optional Audita repair attempt override.
-      dnd_pipeline_audita_concurrency_total_llm:
+      dnd_pipeline_audita_llm_operation_timeout:
-        type: int
+        type: str
-        required: true
+        required: false
-        description: Total Audita LLM concurrency.
+        description: Optional Audita whole-operation deadline override.
-      dnd_pipeline_audita_concurrency_proposal_llm:
-        type: int
-        required: true
-        description: Proposal Audita LLM concurrency.
-      dnd_pipeline_audita_concurrency_validation_llm:
-        type: int
-        required: true
-        description: Validation Audita LLM concurrency.
       dnd_pipeline_audita_chunking_target_sections:
         type: int
         required: true
@@ -162,15 +138,15 @@ argument_specs:
         required: true
         description: Audita minimum section tokens.
       dnd_pipeline_audita_normalization_max_segment_gap:
-        type: str
+        type: float
         required: true
         description: Audita maximum segment gap.
       dnd_pipeline_audita_normalization_ellipsis_gap:
-        type: str
+        type: float
         required: true
         description: Audita ellipsis gap.
       dnd_pipeline_audita_normalization_max_segment_duration:
-        type: str
+        type: float
         required: true
         description: Audita maximum segment duration.
       dnd_pipeline_audita_normalization_max_segment_tokens:
@@ -201,10 +177,6 @@ argument_specs:
         type: str
         required: true
         description: Audita diagnostics work directory.
-      dnd_pipeline_audita_diagnostics_retention:
-        type: str
-        required: true
-        description: Audita diagnostics retention policy.
       dnd_pipeline_notarius_pipelines:
         type: dict
         required: true
@@ -225,6 +197,14 @@ argument_specs:
         type: str
         required: true
         description: Notarius LLM profile selected by the testing overlay.
+      dnd_pipeline_notarius_promptkit_transient_retries:
+        type: int
+        required: false
+        description: Optional Notarius PromptKit transient retry override.
+      dnd_pipeline_scriptorium_transient_retries:
+        type: int
+        required: false
+        description: Optional Scriptorium transient retry override.
       dnd_pipeline_narratio_workspace_cleanup_after_publish:
         type: bool
         required: true
@@ -313,10 +293,16 @@ argument_specs:
         type: str
         required: true
         description: Notarius pipeline selected by Narratio.
-      dnd_pipeline_narratio_notarius_llm_api_key:
+      dnd_pipeline_narratio_audita_credentials:
-        type: str
+        type: list
+        elements: str
         required: true
-        description: Environment-variable name forwarded by Narratio to Notarius.
+        description: Credential names forwarded by Narratio to Audita.
+      dnd_pipeline_narratio_notarius_credentials:
+        type: list
+        elements: str
+        required: true
+        description: Credential names forwarded by Narratio to Notarius.
       dnd_pipeline_narratio_notarius_resume:
         type: bool
         required: true

roles/pipeline/meta/main.yml

@@ -55,13 +55,13 @@ dependencies:
       narratio_seriatim_binary: /usr/local/bin/seriatim
       narratio_audita_binary: /usr/local/bin/audita
       narratio_audita_config_path: /usr/local/etc/audita/config.yml
-      narratio_audita_llm_api_key: "{{ dnd_pipeline_audita_llm_proposal_api_key_env }}"
+      narratio_audita_credentials: "{{ dnd_pipeline_narratio_audita_credentials }}"
       narratio_notarius_binary: /usr/local/bin/notarius
       narratio_notarius_config_path: /usr/local/etc/notarius/config.yml
       narratio_notarius_enabled: true
       narratio_notarius_pipeline_id: "{{ dnd_pipeline_narratio_notarius_pipeline_id }}"
       narratio_notarius_working_directory: /usr/local/etc/notarius
-      narratio_notarius_llm_api_key: "{{ dnd_pipeline_narratio_notarius_llm_api_key }}"
+      narratio_notarius_credentials: "{{ dnd_pipeline_narratio_notarius_credentials }}"
       narratio_notarius_resume: "{{ dnd_pipeline_narratio_notarius_resume }}"
       narratio_notarius_references: "{{ dnd_pipeline_narratio_notarius_references }}"
       narratio_notarius_outputs: "{{ dnd_pipeline_narratio_notarius_outputs }}"
@@ -85,19 +85,13 @@ dependencies:
       audita_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
       audita_pipeline_modules: "{{ dnd_pipeline_audita_pipeline_modules }}"
       audita_output_schema: "{{ dnd_pipeline_audita_output_schema }}"
-      audita_llm_proposal_base_url: "{{ dnd_pipeline_audita_llm_proposal_base_url }}"
+      audita_backends: "{{ dnd_pipeline_audita_backends }}"
-      audita_llm_proposal_model: "{{ dnd_pipeline_audita_llm_proposal_model }}"
+      audita_profiles_dir: /usr/local/etc/audita/profiles
-      audita_llm_proposal_api_key_env: "{{ dnd_pipeline_audita_llm_proposal_api_key_env }}"
+      audita_llm_proposal_profile: "{{ dnd_pipeline_audita_llm_proposal_profile }}"
-      audita_llm_proposal_timeout: "{{ dnd_pipeline_audita_llm_proposal_timeout }}"
+      audita_llm_validation_profile: "{{ dnd_pipeline_audita_llm_validation_profile }}"
-      audita_llm_proposal_max_retries: "{{ dnd_pipeline_audita_llm_proposal_max_retries }}"
+      audita_llm_transient_retries: "{{ dnd_pipeline_audita_llm_transient_retries }}"
-      audita_llm_validation_base_url: "{{ dnd_pipeline_audita_llm_validation_base_url }}"
+      audita_llm_repair_attempts: "{{ dnd_pipeline_audita_llm_repair_attempts }}"
-      audita_llm_validation_model: "{{ dnd_pipeline_audita_llm_validation_model }}"
+      audita_llm_operation_timeout: "{{ dnd_pipeline_audita_llm_operation_timeout }}"
-      audita_llm_validation_api_key_env: "{{ dnd_pipeline_audita_llm_validation_api_key_env }}"
-      audita_llm_validation_timeout: "{{ dnd_pipeline_audita_llm_validation_timeout }}"
-      audita_llm_validation_max_retries: "{{ dnd_pipeline_audita_llm_validation_max_retries }}"
-      audita_concurrency_total_llm: "{{ dnd_pipeline_audita_concurrency_total_llm }}"
-      audita_concurrency_proposal_llm: "{{ dnd_pipeline_audita_concurrency_proposal_llm }}"
-      audita_concurrency_validation_llm: "{{ dnd_pipeline_audita_concurrency_validation_llm }}"
       audita_chunking_target_sections: "{{ dnd_pipeline_audita_chunking_target_sections }}"
       audita_chunking_max_section_tokens: "{{ dnd_pipeline_audita_chunking_max_section_tokens }}"
       audita_chunking_min_section_tokens: "{{ dnd_pipeline_audita_chunking_min_section_tokens }}"
@@ -111,7 +105,6 @@ dependencies:
       audita_thresholds_grammar: "{{ dnd_pipeline_audita_thresholds_grammar }}"
       audita_context_description: "{{ dnd_pipeline_audita_context_description }}"
       audita_diagnostics_work_dir: "{{ dnd_pipeline_audita_diagnostics_work_dir }}"
-      audita_diagnostics_retention: "{{ dnd_pipeline_audita_diagnostics_retention }}"
   - role: rakestraw.notarius
     vars:
       notarius_version: "{{ dnd_pipeline_notarius_version }}"
@@ -128,6 +121,7 @@ dependencies:
       notarius_cache_chunk_plans_directory: "{{ dnd_pipeline_notarius_cache_root ~ '/chunk-plans' }}"
       notarius_cache_checkpoints_enabled: "{{ dnd_pipeline_notarius_cache_checkpoints_enabled }}"
       notarius_cache_checkpoints_directory: "{{ dnd_pipeline_notarius_cache_root ~ '/checkpoints' }}"
+      notarius_promptkit_transient_retries: "{{ dnd_pipeline_notarius_promptkit_transient_retries }}"
   - role: rakestraw.scriptorium
     vars:
       scriptorium_version: "{{ dnd_pipeline_scriptorium_version }}"
@@ -140,3 +134,4 @@ dependencies:
       scriptorium_config_file_mode: "{{ dnd_pipeline_config_file_mode }}"
       scriptorium_prompt_dir: "{{ dnd_pipeline_prompt_library_root ~ '/prompts' }}"
       scriptorium_schema_dir: "{{ dnd_pipeline_prompt_library_root ~ '/schemas' }}"
+      scriptorium_transient_retries: "{{ dnd_pipeline_scriptorium_transient_retries }}"

roles/pipeline/requirements.yml

@@ -7,16 +7,16 @@ roles:
   - name: rakestraw.audita
     src: https://gitea.maximumdirect.net/eric/ansible-role-audita.git
     scm: git
-    version: v0.1.0
+    version: c3dd59f5ac9b942306ffe540ae9e71d493998137
   - name: rakestraw.notarius
     src: https://gitea.maximumdirect.net/eric/ansible-role-notarius.git
     scm: git
-    version: a82a83dfc23bb80a59f45f94f78d6754c47285e7
+    version: 6aef48b7e12e3651971444b8c224d96ff1879e6c
   - name: rakestraw.scriptorium
     src: https://gitea.maximumdirect.net/eric/ansible-role-scriptorium.git
     scm: git
-    version: v0.1.0
+    version: b174c8c2990bb79f8149d8f288c5e06ccb42bd73
   - name: rakestraw.narratio
     src: https://gitea.maximumdirect.net/eric/ansible-role-narratio.git
     scm: git
-    version: 330afe7856da94b2402a75447f4b60aba767843f
+    version: 3c0700b5323293d44e3b1e67a50074d82d7a3bff

roles/pipeline/tasks/main.yml

@@ -144,7 +144,7 @@
     - conf.d
     - artifacts
     - artifact-families
-    - profiles
+    - overlays
 
 - name: Create Notarius configuration directories
   become: true
@@ -156,7 +156,26 @@
     mode: "{{ dnd_pipeline_config_directory_mode }}"
   loop:
     - pipelines
-    - profiles
+    - overlays
+
+- name: Create the Audita profile directory
+  become: true
+  ansible.builtin.file:
+    path: /usr/local/etc/audita/profiles
+    state: directory
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_directory_mode }}"
+
+- name: Deploy Audita profiles
+  become: true
+  ansible.builtin.template:
+    src: audita-profile.yml.j2
+    dest: "/usr/local/etc/audita/profiles/{{ item.key }}.yml"
+    owner: "{{ dnd_pipeline_runtime_user }}"
+    group: "{{ dnd_pipeline_runtime_group }}"
+    mode: "{{ dnd_pipeline_config_file_mode }}"
+  loop: "{{ dnd_pipeline_audita_profiles | dict2items }}"
 
 - name: Deploy the Notarius D&D pipeline configuration
   become: true
@@ -171,7 +190,7 @@
   become: true
   ansible.builtin.template:
     src: notarius-testing.yml.j2
-    dest: /usr/local/etc/notarius/profiles/testing.yml
+    dest: /usr/local/etc/notarius/overlays/testing.yml
     owner: "{{ dnd_pipeline_runtime_user }}"
     group: "{{ dnd_pipeline_runtime_group }}"
     mode: "{{ dnd_pipeline_config_file_mode }}"
@@ -198,4 +217,4 @@
     - src: character-meta-analysis.yml.j2
       dest: artifact-families/character-meta-analysis.yml
     - src: testing.yml.j2
-      dest: profiles/testing.yml
+      dest: overlays/testing.yml

roles/pipeline/templates/audita-profile.yml.j2

@@ -0,0 +1 @@
+{{ item.value | to_nice_yaml }}

roles/pipeline/templates/testing.yml.j2

@@ -1,5 +1,5 @@
 notarius:
-  config_profile: testing
+    config_overlay: testing
 scriptorium:
   artifacts:
     session_recap:

roles/pipeline/tests/integration

@@ -46,6 +46,7 @@ baseline_args=(
   -e '{"dnd_pipeline_narratio_publish_outputs":[{"source":"narratio.transcript.final","required":true},{"source":"narratio.artifact.session_recap","required":true}]}'
   -e 'dnd_pipeline_narratio_testing_scriptorium_profile=endpoint-profile'
   -e 'dnd_pipeline_notarius_testing_llm_profile=gpt-terra-latest'
+  -e '{"dnd_pipeline_audita_llm_transient_retries":null,"dnd_pipeline_audita_llm_repair_attempts":null,"dnd_pipeline_audita_llm_operation_timeout":null,"dnd_pipeline_notarius_promptkit_transient_retries":null,"dnd_pipeline_scriptorium_transient_retries":null}'
 )
 
 cleanup() {
@@ -90,19 +91,37 @@ printf '%s\n' \
 baseline_log="$test_tmp/baseline.log"
 run_converge "$baseline_log" "${baseline_args[@]}"
 /usr/local/bin/seriatim --version
-/usr/local/bin/audita config validate --config /usr/local/etc/audita/config.yml
+AUDITA_LLM_API_KEY="$synthetic_audita_api_key" \
+  /usr/local/bin/audita config validate --config /usr/local/etc/audita/config.yml
+"$workspace_venv/bin/python" - <<'PY'
+import yaml
+
+with open("/usr/local/etc/audita/config.yml", encoding="utf-8") as config_file:
+    audita = yaml.safe_load(config_file)
+with open("/usr/local/etc/notarius/config.yml", encoding="utf-8") as config_file:
+    notarius = yaml.safe_load(config_file)
+with open("/usr/local/etc/scriptorium/config.yml", encoding="utf-8") as config_file:
+    scriptorium = yaml.safe_load(config_file)
+
+assert "transient_retries" not in audita["llm"]
+assert "repair_attempts" not in audita["llm"]
+assert "operation_timeout" not in audita["llm"]
+assert "transient_retries" not in notarius.get("promptkit", {})
+assert "transient_retries" not in scriptorium
+PY
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
   --pipeline dnd-session
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
-  --config-profile testing --pipeline dnd-session
+  --config-overlay testing --pipeline dnd-session
 notarius_effective_config="$test_tmp/notarius-effective.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
   > "$notarius_effective_config"
 notarius_testing_effective_config="$test_tmp/notarius-testing-effective.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
-  --config-profile testing > "$notarius_testing_effective_config"
+  --config-overlay testing > "$notarius_testing_effective_config"
 grep -Fq 'mode: auto' "$notarius_effective_config"
 grep -Fq 'step: describe-session' "$notarius_effective_config"
+/usr/local/bin/scriptorium config validate --config /usr/local/etc/scriptorium/config.yml
 /usr/local/bin/scriptorium inspect profile --config /usr/local/etc/scriptorium/config.yml \
   --profile-dir "$profile_dir" --profile endpoint-profile
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
@@ -110,19 +129,17 @@ grep -Fq 'step: describe-session' "$notarius_effective_config"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
   --config /usr/local/etc/narratio/pipeline.yml --campaign dilfs
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --profile testing
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing
 narratio_effective_config="$test_tmp/narratio-effective.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs \
   > "$narratio_effective_config"
 narratio_testing_effective_config="$test_tmp/narratio-testing-effective.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --profile testing \
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
   > "$narratio_testing_effective_config"
 grep -Fq 'enabled: true' "$narratio_effective_config"
-grep -Fq 'llm_api_key: AUDITA_LLM_API_KEY' "$narratio_effective_config"
 grep -Fq 'pipeline_id: dnd-session' "$narratio_effective_config"
-grep -Fq 'llm_api_key: OPENROUTER_API_KEY' "$narratio_effective_config"
 grep -Fq 'resume: true' "$narratio_effective_config"
 ! grep -Fq 'chunk_cache:' "$narratio_effective_config"
 grep -Fq 'party: narratio.input.party' "$narratio_effective_config"
@@ -152,6 +169,8 @@ assert config["storage"] == {
     },
 }
 assert config["cache"]["s3_audio"] is False
+assert config["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
+assert config["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 assert config["publish"] == {
     "enabled": True,
     "upload_run": True,
@@ -168,8 +187,8 @@ assert config["publish"] == {
         },
     ],
 }
-assert "config_profile" not in config["notarius"]
+assert "config_overlay" not in config["notarius"]
-assert testing_config["notarius"]["config_profile"] == "testing"
+assert testing_config["notarius"]["config_overlay"] == "testing"
 assert all(
     artifact["profile_id"] == "endpoint-profile"
     for artifact in testing_config["scriptorium"]["artifacts"].values()
@@ -256,7 +275,7 @@ run_converge "$alternate_log" "${baseline_args[@]}" -e "$alternate_config"
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
   --pipeline archive-session
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
-  --config-profile testing --pipeline archive-session
+  --config-overlay testing --pipeline archive-session
 alternate_narratio_config="$test_tmp/alternate-narratio.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs \
@@ -264,14 +283,14 @@ alternate_narratio_config="$test_tmp/alternate-narratio.yml"
 grep -Fq 'pipeline_id: archive-session' "$alternate_narratio_config"
 alternate_testing_narratio_config="$test_tmp/alternate-testing-narratio.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --profile testing \
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
   > "$alternate_testing_narratio_config"
 alternate_effective_config="$test_tmp/alternate-effective.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
   > "$alternate_effective_config"
 alternate_testing_effective_config="$test_tmp/alternate-testing-effective.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
-  --config-profile testing > "$alternate_testing_effective_config"
+  --config-overlay testing > "$alternate_testing_effective_config"
 "$workspace_venv/bin/python" - \
   "$alternate_narratio_config" "$alternate_testing_narratio_config" \
   "$alternate_effective_config" "$alternate_testing_effective_config" <<'PY'
@@ -289,9 +308,9 @@ with open(sys.argv[4], encoding="utf-8") as config_file:
     notarius_testing = yaml.safe_load(config_file)
 
 assert narratio_base["notarius"]["pipeline_id"] == "archive-session"
-assert "config_profile" not in narratio_base["notarius"]
+assert "config_overlay" not in narratio_base["notarius"]
 assert narratio_testing["notarius"]["pipeline_id"] == "archive-session"
-assert narratio_testing["notarius"]["config_profile"] == "testing"
+assert narratio_testing["notarius"]["config_overlay"] == "testing"
 assert notarius_base["pipelines"]["archive-session"]["llm_profile"] == "gpt-luna-latest"
 assert notarius_testing["pipelines"]["archive-session"]["llm_profile"] == "gpt-terra-latest"
 assert notarius_testing["pipelines"]["research-session"]["llm_profile"] == "gpt-luna-latest"
@@ -300,3 +319,68 @@ PY
 alternate_repeat_log="$test_tmp/alternate-repeat.log"
 run_converge "$alternate_repeat_log" "${baseline_args[@]}" -e "$alternate_config"
 require_clean_recap "$alternate_repeat_log"
+
+synthetic_fixture_audita_key='audita-override-synthetic-value'
+synthetic_fixture_notarius_key='notarius-override-synthetic-value'
+override_config="{\"dnd_pipeline_audita_backends\":{\"fixture\":{\"endpoint\":\"https://inference.fixture.invalid/v1\",\"credential\":\"FIXTURE_AUDITA_KEY\",\"concurrency\":2}},"\
+"\"dnd_pipeline_audita_profiles\":{\"fixture-proposal\":{\"id\":\"fixture-proposal\",\"backend\":\"fixture\",\"model\":\"fixture/proposal\",\"timeout_seconds\":900},"\
+"\"fixture-validation\":{\"id\":\"fixture-validation\",\"backend\":\"fixture\",\"model\":\"fixture/validation\",\"timeout_seconds\":900}},"\
+"\"dnd_pipeline_audita_llm_proposal_profile\":\"fixture-proposal\",\"dnd_pipeline_audita_llm_validation_profile\":\"fixture-validation\","\
+"\"dnd_pipeline_narratio_audita_credentials\":[\"FIXTURE_AUDITA_KEY\"],\"dnd_pipeline_narratio_notarius_credentials\":[\"FIXTURE_NOTARIUS_KEY\"],"\
+"\"dnd_pipeline_audita_llm_transient_retries\":0,\"dnd_pipeline_audita_llm_repair_attempts\":0,\"dnd_pipeline_audita_llm_operation_timeout\":\"20m\","\
+"\"dnd_pipeline_notarius_promptkit_transient_retries\":0,\"dnd_pipeline_scriptorium_transient_retries\":0,"\
+"\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\","\
+"\"FIXTURE_AUDITA_KEY\":\"$synthetic_fixture_audita_key\",\"FIXTURE_NOTARIUS_KEY\":\"$synthetic_fixture_notarius_key\","\
+"\"OBJECT_STORAGE_KEY_ID\":\"$synthetic_object_storage_key_id\",\"OBJECT_STORAGE_KEY\":\"$synthetic_object_storage_key\"}}"
+override_log="$test_tmp/override.log"
+run_converge "$override_log" "${baseline_args[@]}" -e "$override_config"
+FIXTURE_AUDITA_KEY="$synthetic_fixture_audita_key" \
+  /usr/local/bin/audita config validate --config /usr/local/etc/audita/config.yml
+audita_override_settings="$test_tmp/audita-override-settings.yml"
+audita_override_profiles="$test_tmp/audita-override-profiles.yml"
+FIXTURE_AUDITA_KEY="$synthetic_fixture_audita_key" \
+  /usr/local/bin/audita config print-effective --config /usr/local/etc/audita/config.yml \
+  --view settings > "$audita_override_settings"
+FIXTURE_AUDITA_KEY="$synthetic_fixture_audita_key" \
+  /usr/local/bin/audita config print-effective --config /usr/local/etc/audita/config.yml \
+  --view profiles > "$audita_override_profiles"
+notarius_override_config="$test_tmp/notarius-override.yml"
+scriptorium_override_config="$test_tmp/scriptorium-override.yml"
+narratio_override_config="$test_tmp/narratio-override.yml"
+/usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
+  > "$notarius_override_config"
+/usr/local/bin/scriptorium config show --config /usr/local/etc/scriptorium/config.yml \
+  > "$scriptorium_override_config"
+/usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs \
+  > "$narratio_override_config"
+"$workspace_venv/bin/python" - \
+  "$audita_override_settings" "$audita_override_profiles" \
+  "$notarius_override_config" "$scriptorium_override_config" \
+  "$narratio_override_config" <<'PY'
+import sys
+
+import yaml
+
+settings, profiles, notarius, scriptorium, narratio = (
+    yaml.safe_load(open(path, encoding="utf-8")) for path in sys.argv[1:]
+)
+assert settings["backends"]["fixture"]["endpoint"] == "https://inference.fixture.invalid/v1"
+assert settings["backends"]["fixture"]["concurrency"] == 2
+assert settings["llm"]["proposal_profile"] == "fixture-proposal"
+assert settings["llm"]["validation_profile"] == "fixture-validation"
+assert settings["llm"]["transient_retries"] == 0
+assert settings["llm"]["repair_attempts"] == 0
+assert settings["llm"]["operation_timeout"] == "20m0s"
+assert profiles["proposal"]["model"] == "fixture/proposal"
+assert profiles["validation"]["model"] == "fixture/validation"
+assert notarius["promptkit"]["transient_retries"] == 0
+assert scriptorium["transient_retries"] == 0
+assert narratio["audita"]["credentials"] == ["FIXTURE_AUDITA_KEY"]
+assert narratio["notarius"]["credentials"] == ["FIXTURE_NOTARIUS_KEY"]
+PY
+! grep -Fq "$synthetic_fixture_audita_key" "$override_log" "$narratio_override_config"
+! grep -Fq "$synthetic_fixture_notarius_key" "$override_log" "$narratio_override_config"
+override_repeat_log="$test_tmp/override-repeat.log"
+run_converge "$override_repeat_log" "${baseline_args[@]}" -e "$override_config"
+require_clean_recap "$override_repeat_log"