Migrate the standalone Audita role to version 2 configuration

README.md

@@ -8,7 +8,7 @@ manage root-owned application state.
 ## Variables
 
 ```yaml
-audita_version: v0.9.1
+audita_version: v2.0.1
 audita_repository_url: https://gitea.maximumdirect.net/eric/audita.git
 audita_source_dir: /usr/local/src/audita
 audita_binary_path: /usr/local/bin/audita
@@ -20,22 +20,16 @@ audita_config_owner: root
 audita_config_group: root
 audita_config_directory_mode: "0755"
 audita_config_file_mode: "0644"
-audita_config_version: 1
+audita_config_version: 2
+audita_profiles_dir: null
+# Required caller inputs: audita_backends, audita_llm_proposal_profile
 audita_pipeline_modules: null
 audita_output_schema: null
-audita_llm_proposal_base_url: null
-audita_llm_proposal_model: null
-audita_llm_proposal_api_key_env: null
-audita_llm_proposal_timeout: null
-audita_llm_proposal_max_retries: null
-audita_llm_validation_base_url: null
-audita_llm_validation_model: null
-audita_llm_validation_api_key_env: null
-audita_llm_validation_timeout: null
-audita_llm_validation_max_retries: null
-audita_concurrency_total_llm: null
-audita_concurrency_proposal_llm: null
-audita_concurrency_validation_llm: null
+audita_llm_validation_profile: null
+audita_llm_transient_retries: null
+audita_llm_repair_attempts: null
+audita_llm_operation_timeout: null
+audita_validation_max_prompt_tokens: null
 audita_chunking_target_sections: null
 audita_chunking_max_section_tokens: null
 audita_chunking_min_section_tokens: null
@@ -48,8 +42,10 @@ audita_thresholds_homophones: null
 audita_thresholds_spoken_word: null
 audita_thresholds_grammar: null
 audita_context_description: null
+audita_reporting_enabled: null
+audita_reporting_stdout_dir: null
+audita_diagnostics_debug: null
 audita_diagnostics_work_dir: null
-audita_diagnostics_retention: null
 ```
 
 When `audita_manage_build_dependencies` is `false`, Git and the executable
@@ -63,22 +59,23 @@ selecting `audita_version`. The role builds Audita directly to
 the checkout changes or the binary is absent. The source tree is recursively
 owned by `root:root`; the binary is `root:root` mode `0755`.
 
-The configuration variables map directly to Audita's versioned YAML fields.
-Every optional variable defaults to `null`; null values and their empty parent
-sections are omitted, allowing Audita to retain ownership of its built-in
+The configuration variables map directly to Audita's version-2 YAML fields.
+`audita_backends` and `audita_llm_proposal_profile` are required caller inputs;
+the role has no defaults for them. Callers own the selected PromptKit profile
+files. Every optional variable defaults to `null`; null values and their empty
+parent sections are omitted, allowing Audita to retain ownership of its built-in
 defaults. `audita_config_version` always renders as `version` and defaults to
-`1`. The role manages `audita_config_path | dirname` and the resulting file
+`2`. The role manages `audita_config_path | dirname` and the resulting file
 with the `audita_config_owner`, `audita_config_group`,
 `audita_config_directory_mode`, and `audita_config_file_mode` inputs. The
 standalone defaults are `root:root`, directory mode `0755`, and file mode
 `0644`. Composing roles may override these generic configuration inputs for
 their own deployment policy.
 
-LLM API-key settings name environment variables through
-`audita_llm_proposal_api_key_env` and `audita_llm_validation_api_key_env`; they
-must never contain secret values. The repository-local integration suite
-validates the rendered file with Audita rather than executing the CLI during
-production convergence.
+Backend credential references name environment variables; they must never
+contain secret values. The repository-local integration suite validates the
+rendered file with Audita rather than executing the CLI during production
+convergence.
 
 ## Example
 
@@ -86,25 +83,27 @@ production convergence.
 - hosts: audita_hosts
   roles:
     - role: ansible-role-audita
+      vars:
+        audita_backends:
+          local:
+            endpoint: http://127.0.0.1:11434/v1
+            credential: null
+        audita_llm_proposal_profile: local-proposal
 ```
 
+The caller supplies `profiles/local-proposal.yaml` beside the managed
+configuration before invoking Audita.
+
 ## Validation
 
 The integration driver installs pinned collection dependencies, runs syntax
-checking and ansible-lint, and validates the default configuration with Audita
-before requiring clean repeated convergence. It also covers one representative
-field-specific configuration with nested values, null omission, and intentional
-falsey values, then validates it natively. A combined recovery scenario proves
-that a missing binary is rebuilt with a caller-supplied Go executable while
-dependency management is disabled. Audita currently has no native
-release-identity command, so the suite intentionally does not use a source
-commit as a version-test proxy.
-On a fresh host, default convergence may also install Git through APT, refresh
-the APT cache, and install the Go Snap. Application state is limited to
-`/usr/local/src/audita`, `/usr/local/bin/audita`, and
-`/usr/local/etc/audita/config.yml`; temporary test-specific files remain inside
-the suite's private temporary directory. The suite restores the default
-deployment during cleanup:
+checking and ansible-lint, validates a caller-supplied local configuration and
+profile offline, and requires clean repeated convergence. It also tests a
+caller-supplied Go executable with dependency management disabled after removing
+the managed binary. On a fresh host, the role may install Git through APT and
+the Go Snap. The test uses a private temporary configuration and profile root;
+the role still manages the local source checkout and binary. Cleanup removes
+only the private fixture root:
 
 ```sh
 tests/integration