Ship the Narratio credential forwarding update

0f841fd Forward Scriptorium credentials in the D&D suite

git-subtree-dir: roles/pipeline
git-subtree-split: 0f841fd91ffc533aeec0ec688e81c24bd187a845

README.md

@@ -8,11 +8,14 @@ Release `0.1.0` contains the reviewed `rakestraw.dnd_pipeline` `v0.1.0`
 snapshot and pins the Seriatim, Audita, Notarius, Scriptorium, and Narratio
 roles to their respective `v0.1.0` releases.
 
-The current development snapshot integrates Narratio v3.0.0, Notarius v0.8.1,
+The current development snapshot integrates Narratio v3.1.0, Notarius v0.8.1,
 Audita v2.0.1, and Scriptorium v0.15.0 through public standalone role pins.
 It includes the suite's Audita backend/profile configuration and Narratio and
-Notarius testing overlays. This does not replace or modify the published
+Notarius testing overlays. Narratio now selects the existing OpenRouter
-`0.1.0` release artifact. Review the [pipeline role migration notes](roles/pipeline/README.md)
+credential name for Scriptorium as well as Notarius; see the pipeline role's
+credential guidance for provisioning and retries. This does not replace or
+modify the published `0.1.0` release artifact. Review the [pipeline role
+migration notes](roles/pipeline/README.md)
 before upgrading inventory or application-owned manifests; this collection
 does not convert existing manifests. Seriatim remains v1.5.0.
 

requirements.yml

@@ -19,7 +19,7 @@ roles:
   - name: rakestraw.narratio
     src: https://gitea.maximumdirect.net/eric/ansible-role-narratio.git
     scm: git
-    version: 3c0700b5323293d44e3b1e67a50074d82d7a3bff
+    version: 758aed7a74c9a64ad02e13ff551b4f7aea16b3af
 collections:
   - name: ansible.posix
     version: 2.2.0

roles/pipeline/README.md

@@ -62,7 +62,7 @@ The compatible application versions are selected through these variables:
 | Variable | Default |
 | --- | --- |
 | `dnd_pipeline_audita_version` | `v2.0.1` |
-| `dnd_pipeline_narratio_version` | `v3.0.0` |
+| `dnd_pipeline_narratio_version` | `v3.1.0` |
 | `dnd_pipeline_notarius_version` | `v0.8.1` |
 | `dnd_pipeline_seriatim_version` | `v1.5.0` |
 | `dnd_pipeline_scriptorium_version` | `v0.15.0` |
@@ -157,15 +157,26 @@ attempt settings according to the desired native behavior. Optional retry
 pass-throughs for Notarius PromptKit and Scriptorium likewise default to
 `null`; an explicit `0` is forwarded, not treated as omission.
 
-Inventory must supply each named backend credential through
+Include each backend credential name in
-`dnd_pipeline_secrets` and include its name in
+`dnd_pipeline_narratio_audita_credentials` and make its value available to
-`dnd_pipeline_narratio_audita_credentials`. Narratio forwards only names in
+Narratio through its process environment or supported secret files.
+`dnd_pipeline_secrets` is the suite's optional file-provisioning interface,
+not a requirement to store credentials on disk. Narratio forwards only names in
 that list and does not discover them from Audita's configuration. The
 Notarius list is independent. For profile overrides, use filename-safe map
 keys equal to each profile's native `id`; the suite writes each map value
-unchanged and does not merge individual fields. See [Audita's v2 manifest
+unchanged and does not merge individual fields. See [Audita's v2 configuration
-migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+migration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.1/docs/migrations/v2.md)
-for application-owned manifests; this role does not convert them.
+for backend and profile migration; this role does not convert caller-owned
+configuration.
+
+Existing Narratio session manifests need a separate migration before opening
+affected sessions with v3. Stop activity for the session and back up its local
+manifest. Follow [Narratio's manifest overlay-provenance migration](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/docs/operations.md#migrating-manifest-overlay-provenance)
+to rename `effective_config.selected_profile` to `selected_overlay`, or remove
+the retired informational member as upstream permits. Preserve stage records,
+checkpoints, and other progress; do not edit immutable remote snapshots or
+force all stages to rerun. The role performs no session migration.
 
 | Variable | Default |
 | --- | --- |
@@ -185,12 +196,26 @@ for application-owned manifests; this role does not convert them.
 | `dnd_pipeline_scriptorium_transient_retries` | `null`; native default |
 | `dnd_pipeline_narratio_audita_credentials` | `[AUDITA_LLM_API_KEY]` |
 | `dnd_pipeline_narratio_notarius_credentials` | `[OPENROUTER_API_KEY]` |
+| `dnd_pipeline_narratio_scriptorium_credentials` | `[OPENROUTER_API_KEY]` |
 
 `dnd_pipeline_audita_output_schema` is also the Narratio Audita-adapter schema;
 it is the shared cross-application boundary. Other Narratio-local controls,
 including reports, timeouts, debug rendering, presentation, and bounds prompt
 profile selection, remain Narratio defaults.
 
+Narratio v3.1.0 forwards the selected Scriptorium credential names for trim,
+analysis, character families, and render-debug calls. The Scriptorium and
+Notarius lists independently default to the existing `OPENROUTER_API_KEY` name;
+using the same provisioned value does not couple their selections. Inventory
+may replace the Scriptorium list, set `[]` to forward nothing, or set `null` to
+omit the field. Each selected name must resolve to a nonempty value when
+Narratio loads configuration, even for inspection commands. Values may come
+from Narratio's process environment or its existing secrets directory;
+`dnd_pipeline_secrets` is optional file provisioning, not the only source.
+After upgrading and provisioning the selected key, retry a failed trim or
+analysis normally. Do not force already successful work solely because a
+credential was added or rotated.
+
 ### Storage and publication policy
 
 The suite selects Narratio's S3 backend and the established Backblaze-compatible
@@ -334,8 +359,8 @@ Notarius profile and ordinary extraction requests checkpoint reuse with
 `resume: true`. Chunk plans use Notarius's root-owned `auto` policy; the
 pipeline deliberately leaves Narratio's optional `chunk_cache` override unset.
 The `chunk-plans` and `checkpoints` paths derive from the cache root and are
-created by Notarius during use. Notarius v0.8.1 selects PromptKit v0.10.0 and
+created by Notarius during use. See the [Notarius v0.8.1 release notes](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/releases/v0.8.1.md)
-OpenRouter catalog v2.20260922.1, which supplies both suite-selected IDs.
+for its PromptKit dependency and profile-source identity changes.
 Existing checkpoints with the previous profile-source identity are not reused;
 source-keyed chunk plans and output artifacts remain compatible. No cache
 deletion or forced extraction is performed by this role. A real testing run may

roles/pipeline/defaults/main.yml

@@ -1,6 +1,6 @@
 ---
 dnd_pipeline_audita_version: v2.0.1
-dnd_pipeline_narratio_version: v3.0.0
+dnd_pipeline_narratio_version: v3.1.0
 dnd_pipeline_notarius_version: v0.8.1
 dnd_pipeline_seriatim_version: v1.5.0
 dnd_pipeline_scriptorium_version: v0.15.0
@@ -257,6 +257,8 @@ dnd_pipeline_narratio_audita_credentials:
   - AUDITA_LLM_API_KEY
 dnd_pipeline_narratio_notarius_credentials:
   - OPENROUTER_API_KEY
+dnd_pipeline_narratio_scriptorium_credentials:
+  - OPENROUTER_API_KEY
 dnd_pipeline_narratio_notarius_resume: true
 dnd_pipeline_narratio_notarius_references:
   party: narratio.input.party

roles/pipeline/meta/argument_specs.yml

@@ -303,6 +303,11 @@ argument_specs:
         elements: str
         required: true
         description: Credential names forwarded by Narratio to Notarius.
+      dnd_pipeline_narratio_scriptorium_credentials:
+        type: list
+        elements: str
+        required: false
+        description: Optional credential names forwarded by Narratio to Scriptorium.
       dnd_pipeline_narratio_notarius_resume:
         type: bool
         required: true

roles/pipeline/meta/main.yml

@@ -67,6 +67,7 @@ dependencies:
       narratio_notarius_outputs: "{{ dnd_pipeline_narratio_notarius_outputs }}"
       narratio_scriptorium_binary: /usr/local/bin/scriptorium
       narratio_scriptorium_config_path: /usr/local/etc/scriptorium/config.yml
+      narratio_scriptorium_credentials: "{{ dnd_pipeline_narratio_scriptorium_credentials }}"
   - role: rakestraw.seriatim
     vars:
       seriatim_version: "{{ dnd_pipeline_seriatim_version }}"

roles/pipeline/requirements.yml

@@ -19,4 +19,4 @@ roles:
   - name: rakestraw.narratio
     src: https://gitea.maximumdirect.net/eric/ansible-role-narratio.git
     scm: git
-    version: 3c0700b5323293d44e3b1e67a50074d82d7a3bff
+    version: 758aed7a74c9a64ad02e13ff551b4f7aea16b3af

roles/pipeline/tests/integration

@@ -169,8 +169,6 @@ assert config["storage"] == {
     },
 }
 assert config["cache"]["s3_audio"] is False
-assert config["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
-assert config["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 assert config["publish"] == {
     "enabled": True,
     "upload_run": True,
@@ -327,6 +325,7 @@ override_config="{\"dnd_pipeline_audita_backends\":{\"fixture\":{\"endpoint\":\"
 "\"fixture-validation\":{\"id\":\"fixture-validation\",\"backend\":\"fixture\",\"model\":\"fixture/validation\",\"timeout_seconds\":900}},"\
 "\"dnd_pipeline_audita_llm_proposal_profile\":\"fixture-proposal\",\"dnd_pipeline_audita_llm_validation_profile\":\"fixture-validation\","\
 "\"dnd_pipeline_narratio_audita_credentials\":[\"FIXTURE_AUDITA_KEY\"],\"dnd_pipeline_narratio_notarius_credentials\":[\"FIXTURE_NOTARIUS_KEY\"],"\
+"\"dnd_pipeline_narratio_scriptorium_credentials\":[\"FIXTURE_AUDITA_KEY\",\"FIXTURE_NOTARIUS_KEY\"],"\
 "\"dnd_pipeline_audita_llm_transient_retries\":0,\"dnd_pipeline_audita_llm_repair_attempts\":0,\"dnd_pipeline_audita_llm_operation_timeout\":\"20m\","\
 "\"dnd_pipeline_notarius_promptkit_transient_retries\":0,\"dnd_pipeline_scriptorium_transient_retries\":0,"\
 "\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\","\
@@ -347,6 +346,7 @@ FIXTURE_AUDITA_KEY="$synthetic_fixture_audita_key" \
 notarius_override_config="$test_tmp/notarius-override.yml"
 scriptorium_override_config="$test_tmp/scriptorium-override.yml"
 narratio_override_config="$test_tmp/narratio-override.yml"
+narratio_testing_override_config="$test_tmp/narratio-testing-override.yml"
 /usr/local/bin/notarius config effective --config /usr/local/etc/notarius/config.yml \
   > "$notarius_override_config"
 /usr/local/bin/scriptorium config show --config /usr/local/etc/scriptorium/config.yml \
@@ -354,15 +354,18 @@ narratio_override_config="$test_tmp/narratio-override.yml"
 /usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs \
   > "$narratio_override_config"
+/usr/bin/sudo -u narratio /usr/local/bin/narratio config show \
+  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
+  > "$narratio_testing_override_config"
 "$workspace_venv/bin/python" - \
   "$audita_override_settings" "$audita_override_profiles" \
   "$notarius_override_config" "$scriptorium_override_config" \
-  "$narratio_override_config" <<'PY'
+  "$narratio_override_config" "$narratio_testing_override_config" <<'PY'
 import sys
 
 import yaml
 
-settings, profiles, notarius, scriptorium, narratio = (
+settings, profiles, notarius, scriptorium, narratio, narratio_testing = (
     yaml.safe_load(open(path, encoding="utf-8")) for path in sys.argv[1:]
 )
 assert settings["backends"]["fixture"]["endpoint"] == "https://inference.fixture.invalid/v1"
@@ -378,6 +381,8 @@ assert notarius["promptkit"]["transient_retries"] == 0
 assert scriptorium["transient_retries"] == 0
 assert narratio["audita"]["credentials"] == ["FIXTURE_AUDITA_KEY"]
 assert narratio["notarius"]["credentials"] == ["FIXTURE_NOTARIUS_KEY"]
+assert narratio["scriptorium"]["credentials"] == ["FIXTURE_AUDITA_KEY", "FIXTURE_NOTARIUS_KEY"]
+assert narratio_testing["scriptorium"]["credentials"] == ["FIXTURE_AUDITA_KEY", "FIXTURE_NOTARIUS_KEY"]
 PY
 ! grep -Fq "$synthetic_fixture_audita_key" "$override_log" "$narratio_override_config"
 ! grep -Fq "$synthetic_fixture_notarius_key" "$override_log" "$narratio_override_config"

tests/integration

@@ -65,10 +65,9 @@ run_converge "$baseline_log"
 /usr/local/bin/seriatim --version
 AUDITA_LLM_API_KEY='audita-pipeline-synthetic-value' \
   /usr/local/bin/audita config validate --config /usr/local/etc/audita/config.yml
-audita_profiles="$test_tmp/audita-profiles.yml"
 AUDITA_LLM_API_KEY='audita-pipeline-synthetic-value' \
   /usr/local/bin/audita config print-effective --config /usr/local/etc/audita/config.yml \
-  --view profiles > "$audita_profiles"
+  --view profiles >/dev/null
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
   --pipeline dnd-session
 /usr/local/bin/notarius config validate --config /usr/local/etc/notarius/config.yml \
@@ -89,24 +88,18 @@ narratio_testing_config="$test_tmp/narratio-testing.yml"
   --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs --overlay testing \
   > "$narratio_testing_config"
 "$workspace_venv/bin/python" - \
-  "$audita_profiles" "$notarius_testing_config" "$narratio_testing_config" <<'PY'
+  "$notarius_testing_config" "$narratio_testing_config" <<'PY'
 import sys
 
 import yaml
 
 with open(sys.argv[1], encoding="utf-8") as config_file:
-    audita_profiles = yaml.safe_load(config_file)
-with open(sys.argv[2], encoding="utf-8") as config_file:
     notarius = yaml.safe_load(config_file)
-with open(sys.argv[3], encoding="utf-8") as config_file:
+with open(sys.argv[2], encoding="utf-8") as config_file:
     narratio = yaml.safe_load(config_file)
 
-assert audita_profiles["proposal"]["id"] == "dnd-proposal"
-assert audita_profiles["validation"]["id"] == "dnd-validation"
 assert notarius["pipelines"]["dnd-session"]["llm_profile"] == "gpt-terra-latest"
 assert narratio["notarius"]["config_overlay"] == "testing"
-assert narratio["audita"]["credentials"] == ["AUDITA_LLM_API_KEY"]
-assert narratio["notarius"]["credentials"] == ["OPENROUTER_API_KEY"]
 PY
 
 repeat_log="$test_tmp/repeat.log"