Merge commit 'b7efac7e21822e0531d2a624bb9ca4287bc14803'

37b1cf6 Correct migration guidance and remove default assertions

git-subtree-dir: roles/pipeline
git-subtree-split: 37b1cf6fab71c6a1212e49357c2e825cb0237a00

roles/pipeline/README.md

@@ -157,15 +157,26 @@ attempt settings according to the desired native behavior. Optional retry
 pass-throughs for Notarius PromptKit and Scriptorium likewise default to
 `null`; an explicit `0` is forwarded, not treated as omission.
 
-Inventory must supply each named backend credential through
-`dnd_pipeline_secrets` and include its name in
-`dnd_pipeline_narratio_audita_credentials`. Narratio forwards only names in
+Include each backend credential name in
+`dnd_pipeline_narratio_audita_credentials` and make its value available to
+Narratio through its process environment or supported secret files.
+`dnd_pipeline_secrets` is the suite's optional file-provisioning interface,
+not a requirement to store credentials on disk. Narratio forwards only names in
 that list and does not discover them from Audita's configuration. The
 Notarius list is independent. For profile overrides, use filename-safe map
 keys equal to each profile's native `id`; the suite writes each map value
-unchanged and does not merge individual fields. See [Audita's v2 manifest
-migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
-for application-owned manifests; this role does not convert them.
+unchanged and does not merge individual fields. See [Audita's v2 configuration
+migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.1/docs/migrations/v2.md)
+for backend and profile migration; this role does not convert caller-owned
+configuration.
+
+Existing Narratio session manifests need a separate migration before opening
+affected sessions with v3. Stop activity for the session and back up its local
+manifest. Follow [Narratio's manifest overlay-provenance migration](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/docs/operations.md#migrating-manifest-overlay-provenance)
+to rename `effective_config.selected_profile` to `selected_overlay`, or remove
+the retired informational member as upstream permits. Preserve stage records,
+checkpoints, and other progress; do not edit immutable remote snapshots or
+force all stages to rerun. The role performs no session migration.
 
 | Variable | Default |
 | --- | --- |
@@ -334,8 +345,8 @@ Notarius profile and ordinary extraction requests checkpoint reuse with
 `resume: true`. Chunk plans use Notarius's root-owned `auto` policy; the
 pipeline deliberately leaves Narratio's optional `chunk_cache` override unset.
 The `chunk-plans` and `checkpoints` paths derive from the cache root and are
-created by Notarius during use. Notarius v0.8.1 selects PromptKit v0.10.0 and
-OpenRouter catalog v2.20260922.1, which supplies both suite-selected IDs.
+created by Notarius during use. See the [Notarius v0.8.1 release notes](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/releases/v0.8.1.md)
+for its PromptKit dependency and profile-source identity changes.
 Existing checkpoints with the previous profile-source identity are not reused;
 source-keyed chunk plans and output artifacts remain compatible. No cache
 deletion or forced extraction is performed by this role. A real testing run may

roles/pipeline/tests/integration

@@ -169,8 +169,6 @@ assert config["storage"] == {
     },
 }
 assert config["cache"]["s3_audio"] is False
-assert config["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
-assert config["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 assert config["publish"] == {
     "enabled": True,
     "upload_run": True,

tests/integration

@@ -65,10 +65,9 @@ run_converge "$baseline_log"
 /usr/local/bin/seriatim --version
 AUDITA_LLM_API_KEY='audita-pipeline-synthetic-value' \
   /usr/local/bin/audita config validate --config /usr/local/etc/audita/config.yml
-audita_profiles="$test_tmp/audita-profiles.yml"
 AUDITA_LLM_API_KEY='audita-pipeline-synthetic-value' \
   /usr/local/bin/audita config print-effective --config /usr/local/etc/audita/config.yml \
-  --view profiles > "$audita_profiles"
+  --view profiles >/dev/null
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
   --pipeline dnd-session
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
@@ -89,24 +88,18 @@ narratio_testing_config="$test_tmp/narratio-testing.yml"
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
   > "$narratio_testing_config"
 "$workspace_venv/bin/python" - \
-  "$audita_profiles" "$notarius_testing_config" "$narratio_testing_config" <<'PY'
+  "$notarius_testing_config" "$narratio_testing_config" <<'PY'
 import sys
 
 import yaml
 
 with open(sys.argv[1], encoding="utf-8") as config_file:
-    audita_profiles = yaml.safe_load(config_file)
-with open(sys.argv[2], encoding="utf-8") as config_file:
     notarius = yaml.safe_load(config_file)
-with open(sys.argv[3], encoding="utf-8") as config_file:
+with open(sys.argv[2], encoding="utf-8") as config_file:
     narratio = yaml.safe_load(config_file)
 
-assert audita_profiles["proposal"]["id"] == "dnd-proposal"
-assert audita_profiles["validation"]["id"] == "dnd-validation"
 assert notarius["pipelines"]["dnd-session"]["llm_profile"] == "gpt-terra-latest"
 assert narratio["notarius"]["config_overlay"] == "testing"
-assert narratio["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
-assert narratio["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 PY
 
 repeat_log="$test_tmp/repeat.log"