Simplify pipeline credential management

README.md

@@ -273,12 +273,11 @@ only reference names.
 ### Managed credentials
 
 `dnd_pipeline_secrets` defaults to `{}`. Its keys must be valid environment
-variable names, and each value is either a nonempty string to manage as the
+variable names, and each string value is managed as the exact named credential
-exact named credential file or `null` to remove that exact file. Omitted names
+file. Omitted names are unmanaged: the role neither mirrors nor purges the
-are unmanaged: the role neither mirrors nor purges the directory. Narratio
+directory. Narratio loads this conventional sibling directory before
-loads this conventional sibling directory before configuration resolution; an
+configuration resolution; an already-set process environment value takes
-already-set process environment value takes precedence. The role adds no
+precedence. The role adds no wrapper, service, or parallel credential loader.
-wrapper, service, or parallel credential loader.
 
 Keep values in encrypted inventory, for example with Ansible Vault; Vault is a
 consumer workflow, not role functionality:
@@ -287,9 +286,14 @@ consumer workflow, not role functionality:
 dnd_pipeline_secrets:
   AUDITA_LLM_API_KEY: "{{ vault_dnd_audita_llm_api_key }}"
   OPENROUTER_API_KEY: "{{ vault_dnd_openrouter_api_key }}"
-  RETIRED_PROVIDER_KEY: null
 ```
 
+Scriptorium profiles continue to own their `api_key_env` selection. To supply
+that credential through the suite, add a `dnd_pipeline_secrets` entry whose
+name matches the selected profile's `api_key_env`. Narratio's secrets bootstrap
+loads the value, and its existing Scriptorium adapter forwards only the
+profile-selected credential.
+
 ## Validation
 
 `tests/integration` installs the pinned Git dependencies and collection into

tasks/main.yml

@@ -12,7 +12,7 @@
     that:
       - item.key is string
       - item.key is match('^[A-Za-z_][A-Za-z0-9_]*$')
-      - item.value is none or (item.value is string and item.value | length > 0)
+      - item.value is string
   loop: "{{ dnd_pipeline_secrets | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
@@ -38,18 +38,6 @@
   loop: "{{ dnd_pipeline_secrets | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  when: item.value is not none
-  no_log: true
-
-- name: Remove explicitly unmanaged Narratio credentials
-  become: true
-  ansible.builtin.file:
-    path: "/usr/local/etc/narratio/secrets/{{ item.key }}"
-    state: absent
-  loop: "{{ dnd_pipeline_secrets | dict2items }}"
-  loop_control:
-    label: "{{ item.key }}"
-  when: item.value is none
   no_log: true
 
 - name: Create the Notarius cache root

tests/integration

@@ -164,34 +164,6 @@ if run_converge "$invalid_key_log" "${baseline_args[@]}" \
   -e '{"dnd_pipeline_secrets":{"INVALID-KEY":"invalid-key-synthetic-value"}}'; then
   exit 1
 fi
-invalid_value_log="$test_tmp/invalid-value.log"
-if run_converge "$invalid_value_log" "${baseline_args[@]}" \
-  -e '{"dnd_pipeline_secrets":{"EMPTY_VALUE_KEY":""}}'; then
-  exit 1
-fi
-
-removal_key=NARRATIO_TEST_REMOVAL_KEY
-removal_value=removal-synthetic-value
-removal_present_config="{\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\",\"$removal_key\":\"$removal_value\"},\"dnd_pipeline_narratio_notarius_llm_api_key\":\"$removal_key\"}"
-removal_present_log="$test_tmp/removal-present.log"
-run_converge "$removal_present_log" "${baseline_args[@]}" -e "$removal_present_config"
-removal_present_validation_log="$test_tmp/removal-present-validation.log"
-/usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs | tee "$removal_present_validation_log"
-removal_absent_config="{\"dnd_pipeline_secrets\":{\"AUDITA_LLM_API_KEY\":\"$synthetic_audita_api_key\",\"OPENROUTER_API_KEY\":\"$synthetic_notarius_api_key\",\"$removal_key\":null},\"dnd_pipeline_narratio_notarius_llm_api_key\":\"$removal_key\"}"
-removal_absent_log="$test_tmp/removal-absent.log"
-run_converge "$removal_absent_log" "${baseline_args[@]}" -e "$removal_absent_config"
-removal_absent_validation_log="$test_tmp/removal-absent-validation.log"
-if /usr/bin/sudo -u narratio /usr/local/bin/narratio config validate \
-  --config /usr/local/etc/narratio/pipeline.yml --campaign centaurs | tee "$removal_absent_validation_log"; then
-  exit 1
-fi
-removal_absent_repeat_log="$test_tmp/removal-absent-repeat.log"
-run_converge "$removal_absent_repeat_log" "${baseline_args[@]}" -e "$removal_absent_config"
-require_clean_recap "$removal_absent_repeat_log"
-! grep -Fq "$synthetic_audita_api_key" "$baseline_log" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
-! grep -Fq "$synthetic_notarius_api_key" "$baseline_log" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
-! grep -Fq "$removal_value" "$removal_present_log" "$removal_absent_log" "$removal_present_validation_log" "$removal_absent_validation_log"
 
 testing_profile_log="$test_tmp/testing-profile.log"
 run_converge "$testing_profile_log" "${baseline_args[@]}" \