Document the shared pipeline execution model

README.md

@@ -60,6 +60,22 @@ The Go channel and executable are likewise passed to all five roles. Advanced
 callers may supply unmapped standalone-role variables directly through normal
 Ansible variable precedence.
 
+The following values are deliberate D&D suite policy passed through the
+standalone roles' generic configuration interfaces; they are not standalone
+defaults. Narratio runs first and establishes the selected runtime user and
+group before the remaining configuration-bearing dependencies run.
+
+| Variable | Default policy |
+| --- | --- |
+| `dnd_pipeline_runtime_user` | `narratio` |
+| `dnd_pipeline_runtime_group` | `narratio` |
+| `dnd_pipeline_config_directory_mode` | `0755` |
+| `dnd_pipeline_config_file_mode` | `0644` |
+
+All application configuration, including pipeline-owned Narratio fragments,
+is therefore `narratio:narratio`, world-readable, and Ansible-managed. It is
+not an operator-editable configuration surface.
+
 Narratio receives the standard Seriatim, Audita, Notarius, and Scriptorium
 binary and configuration paths managed by the composed roles. Notarius is
 installed but remains disabled in Narratio until a later feature supplies a
@@ -185,6 +201,26 @@ managed files.
 API keys, Notarius enablement, storage and publishing, operator access,
 scheduling, and end-to-end external execution remain deferred.
 
+### Shared execution filesystem
+
+`/var/lib/narratio`, `/var/spool/narratio`, and `/var/cache/narratio` are
+`narratio:narratio` mode `2775` **setgid** directories. Their access and
+default ACLs retain owner and group write access plus world read/traverse access
+for newly created content. The pipeline may run as `narratio` or as a human
+account already in the selected runtime group; the production role neither
+selects people nor manages their group membership. For example, a consumer can
+manage its own operator membership separately:
+
+```yaml
+operator_group_members:
+  - "{{ pipeline_operator }}"
+```
+
+Configuration, transcripts, caches, generated artifacts, campaign data,
+prompts, and logs are non-secret D&D content. API keys and other credentials
+remain deferred to a future restricted `secrets/` subtree; this role does not
+create or populate that subtree.
+
 ## Validation
 
 `tests/integration` installs the pinned Git dependencies and collection into
@@ -193,7 +229,11 @@ applies the suite with a local syntactically valid WhisperX URL and explicit
 immutable `file://` asset inputs. It uses native application
 smoke/configuration commands, validates Narratio's assembled configuration and
 campaign discovery as the Narratio account, and inspects deployed Scriptorium
-prompts and a schema path. It requires a clean repeat, then selects Seriatim
-`v1.4.0` through the suite interface and requires a clean repeat of that
-selection. Cleanup reapplies the asset-enabled baseline suite and removes only
-the driver's private temporary directory.
+prompts and a schema path. It also validates the same Narratio configuration as
+a temporary existing-group-member fixture, exercises representative shared-root
+access across the service and fixture identities, and confirms that `nobody`
+can read ordinary configuration. It requires immediate clean repeats, then
+selects Seriatim `v1.4.0` through the suite interface and requires a clean
+repeat of that selection. Cleanup reapplies the asset-enabled baseline suite and
+removes only the fixture account, its named test content, and the driver's
+private temporary directory.