From b7efac7e21822e0531d2a624bb9ca4287bc14803 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Tue, 29 Sep 2026 15:08:19 +0000
Subject: [PATCH] Squashed 'roles/pipeline/' changes from ea8b09e..37b1cf6

37b1cf6 Correct migration guidance and remove default assertions

git-subtree-dir: roles/pipeline
git-subtree-split: 37b1cf6fab71c6a1212e49357c2e825cb0237a00
---
 README.md         | 27 +++++++++++++++++++--------
 tests/integration |  2 --
 2 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 4914fd7..e1c3413 100644
--- a/README.md
+++ b/README.md
@@ -157,15 +157,26 @@ attempt settings according to the desired native behavior. Optional retry
 pass-throughs for Notarius PromptKit and Scriptorium likewise default to
 `null`; an explicit `0` is forwarded, not treated as omission.
 
-Inventory must supply each named backend credential through
-`dnd_pipeline_secrets` and include its name in
-`dnd_pipeline_narratio_audita_credentials`. Narratio forwards only names in
+Include each backend credential name in
+`dnd_pipeline_narratio_audita_credentials` and make its value available to
+Narratio through its process environment or supported secret files.
+`dnd_pipeline_secrets` is the suite's optional file-provisioning interface,
+not a requirement to store credentials on disk. Narratio forwards only names in
 that list and does not discover them from Audita's configuration. The
 Notarius list is independent. For profile overrides, use filename-safe map
 keys equal to each profile's native `id`; the suite writes each map value
-unchanged and does not merge individual fields. See [Audita's v2 manifest
-migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
-for application-owned manifests; this role does not convert them.
+unchanged and does not merge individual fields. See [Audita's v2 configuration
+migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.1/docs/migrations/v2.md)
+for backend and profile migration; this role does not convert caller-owned
+configuration.
+
+Existing Narratio session manifests need a separate migration before opening
+affected sessions with v3. Stop activity for the session and back up its local
+manifest. Follow [Narratio's manifest overlay-provenance migration](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/docs/operations.md#migrating-manifest-overlay-provenance)
+to rename `effective_config.selected_profile` to `selected_overlay`, or remove
+the retired informational member as upstream permits. Preserve stage records,
+checkpoints, and other progress; do not edit immutable remote snapshots or
+force all stages to rerun. The role performs no session migration.
 
 | Variable | Default |
 | --- | --- |
@@ -334,8 +345,8 @@ Notarius profile and ordinary extraction requests checkpoint reuse with
 `resume: true`. Chunk plans use Notarius's root-owned `auto` policy; the
 pipeline deliberately leaves Narratio's optional `chunk_cache` override unset.
 The `chunk-plans` and `checkpoints` paths derive from the cache root and are
-created by Notarius during use. Notarius v0.8.1 selects PromptKit v0.10.0 and
-OpenRouter catalog v2.20260922.1, which supplies both suite-selected IDs.
+created by Notarius during use. See the [Notarius v0.8.1 release notes](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/releases/v0.8.1.md)
+for its PromptKit dependency and profile-source identity changes.
 Existing checkpoints with the previous profile-source identity are not reused;
 source-keyed chunk plans and output artifacts remain compatible. No cache
 deletion or forced extraction is performed by this role. A real testing run may
diff --git a/tests/integration b/tests/integration
index 467dd00..e0bad3f 100755
--- a/tests/integration
+++ b/tests/integration
@@ -169,8 +169,6 @@ assert config["storage"] == {
     },
 }
 assert config["cache"]["s3_audio"] is False
-assert config["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
-assert config["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 assert config["publish"] == {
     "enabled": True,
     "upload_run": True,