Support Scriptorium credentials in Narratio

README.md

@@ -8,7 +8,7 @@ application state.
 ## Variables
 
 ```yaml
-narratio_version: v3.0.0
+narratio_version: v3.1.0
 narratio_repository_url: https://gitea.maximumdirect.net/eric/narratio.git
 narratio_source_dir: /usr/local/src/narratio
 narratio_binary_path: /usr/local/bin/narratio
@@ -92,6 +92,7 @@ narratio_render_include_timestamps: null
 narratio_render_include_segment_ids: null
 narratio_render_include_metadata: null
 narratio_scriptorium_binary: null
+narratio_scriptorium_credentials: null
 narratio_scriptorium_config_path: null
 narratio_scriptorium_timeout: null
 narratio_scriptorium_render_debug: null
@@ -167,6 +168,15 @@ list or selector, `[]` emits an explicit empty list, and `""` emits an explicit
 empty selector. A Narratio overlay replaces a credential list rather than
 appending to it.
 
+`narratio_scriptorium_credentials` is likewise an optional list of exact
+environment-variable or secret-reference names, not credential values. Null
+omits the field; `[]` writes an explicit empty list and forwards nothing.
+When nonempty, Narratio resolves every selected name to a nonempty value at
+pipeline load time, even for inspection commands that do not run Scriptorium.
+Provision those values through Narratio's existing process environment or
+secrets-directory mechanism. Provider/profile selection remains Scriptorium's
+responsibility, and this standalone role does not choose provider names.
+
 Audita v2 owns its configuration, backend/model definitions, PromptKit profiles,
 reporting, and debug policy. Configure it independently before using polish;
 the role does not generate downstream files or guess replacements for the

defaults/main.yml

@@ -1,5 +1,5 @@
 ---
-narratio_version: v3.0.0
+narratio_version: v3.1.0
 narratio_repository_url: https://gitea.maximumdirect.net/eric/narratio.git
 narratio_source_dir: /usr/local/src/narratio
 narratio_binary_path: /usr/local/bin/narratio
@@ -77,6 +77,7 @@ narratio_render_include_timestamps: null
 narratio_render_include_segment_ids: null
 narratio_render_include_metadata: null
 narratio_scriptorium_binary: null
+narratio_scriptorium_credentials: null
 narratio_scriptorium_config_path: null
 narratio_scriptorium_timeout: null
 narratio_scriptorium_render_debug: null

meta/argument_specs.yml

@@ -82,6 +82,7 @@ argument_specs:
       narratio_render_include_segment_ids: {type: bool, required: false}
       narratio_render_include_metadata: {type: bool, required: false}
       narratio_scriptorium_binary: {type: str, required: false}
+      narratio_scriptorium_credentials: {type: list, elements: str, required: false}
       narratio_scriptorium_config_path: {type: str, required: false}
       narratio_scriptorium_timeout: {type: str, required: false}
       narratio_scriptorium_render_debug: {type: bool, required: false}

templates/pipeline.yml.j2

@@ -217,11 +217,14 @@ render:
   include_metadata: {{ narratio_render_include_metadata | to_json }}
 {% endif %}
 {% endif %}
-{% if narratio_scriptorium_binary is not none or narratio_scriptorium_config_path is not none or narratio_scriptorium_timeout is not none or narratio_scriptorium_render_debug is not none or narratio_scriptorium_artifacts is not none or narratio_scriptorium_artifact_families is not none %}
+{% if narratio_scriptorium_binary is not none or narratio_scriptorium_credentials is not none or narratio_scriptorium_config_path is not none or narratio_scriptorium_timeout is not none or narratio_scriptorium_render_debug is not none or narratio_scriptorium_artifacts is not none or narratio_scriptorium_artifact_families is not none %}
 scriptorium:
 {% if narratio_scriptorium_binary is not none %}
   binary: {{ narratio_scriptorium_binary | to_json }}
 {% endif %}
+{% if narratio_scriptorium_credentials is not none %}
+  credentials: {{ narratio_scriptorium_credentials | to_json }}
+{% endif %}
 {% if narratio_scriptorium_config_path is not none %}
   config_path: {{ narratio_scriptorium_config_path | to_json }}
 {% endif %}

tests/integration

@@ -20,7 +20,7 @@ verify_config="$repository_root/tests/verify-config.yml"
 ansible_playbook="$workspace_venv/bin/ansible-playbook"
 baseline_args=(
   -e 'narratio_whisperx_transcribe_url=http://127.0.0.1:8000/transcribe'
-  -e '{"narratio_audita_credentials":null,"narratio_audita_overlay":null,"narratio_audita_proposal_profile":null,"narratio_audita_validation_profile":null,"narratio_notarius_credentials":null,"narratio_notarius_config_overlay":null}'
+  -e '{"narratio_audita_credentials":null,"narratio_audita_overlay":null,"narratio_audita_proposal_profile":null,"narratio_audita_validation_profile":null,"narratio_notarius_credentials":null,"narratio_notarius_config_overlay":null,"narratio_scriptorium_credentials":null}'
 )
 
 cleanup() {
@@ -88,6 +88,7 @@ require_clean_recap "$recovery_repeat_log"
 
 representative_log="$test_tmp/representative.log"
 "$ansible_playbook" -i "$inventory" "$representative" | tee "$representative_log"
+/usr/local/bin/narratio version | grep -Fx 'narratio v3.1.0'
 synthetic_notarius_api_key=notarius-representative-synthetic-value
 synthetic_audita_api_key=audita-representative-synthetic-value
 representative_validation_log="$test_tmp/representative-validation.log"
@@ -101,8 +102,8 @@ representative_repeat_log="$test_tmp/representative-repeat.log"
 require_clean_recap "$representative_repeat_log"
 
 empty_overlay_log="$test_tmp/empty-overlay.log"
-empty_inputs='{"narratio_audita_credentials":[],"narratio_notarius_credentials":[],"narratio_audita_overlay":"","narratio_audita_proposal_profile":"","narratio_audita_validation_profile":"","narratio_notarius_config_overlay":""}'
-empty_expectations='{"narratio_test_audita_credentials":[],"narratio_test_notarius_credentials":[],"narratio_test_audita_overlay":"","narratio_test_audita_proposal_profile":"","narratio_test_audita_validation_profile":"","narratio_test_notarius_config_overlay":""}'
+empty_inputs='{"narratio_audita_credentials":[],"narratio_notarius_credentials":[],"narratio_audita_overlay":"","narratio_audita_proposal_profile":"","narratio_audita_validation_profile":"","narratio_notarius_config_overlay":"","narratio_scriptorium_credentials":[],"narratio_scriptorium_artifacts":null}'
+empty_expectations='{"narratio_test_audita_credentials":[],"narratio_test_notarius_credentials":[],"narratio_test_audita_overlay":"","narratio_test_audita_proposal_profile":"","narratio_test_audita_validation_profile":"","narratio_test_notarius_config_overlay":"","narratio_test_scriptorium_credentials":[],"narratio_test_scriptorium_credentials_only":true}'
 "$ansible_playbook" -i "$inventory" \
   -e "$empty_inputs" \
   "$representative" | tee "$empty_overlay_log"

tests/representative.yml

@@ -3,6 +3,7 @@
   hosts: localhost
   gather_facts: true
   vars:
+    narratio_version: v3.1.0
     narratio_whisperx_transcribe_url: http://127.0.0.1:8000/transcribe
     narratio_scriptorium_base_artifacts:
       disabled_fixture:
@@ -35,6 +36,9 @@
     narratio_notarius_config_overlay: representative-overlay
     narratio_notarius_resume: false
     narratio_notarius_chunk_cache: auto
+    narratio_scriptorium_credentials:
+      - NARRATIO_TEST_AUDITA_API_KEY
+      - NARRATIO_TEST_NOTARIUS_API_KEY
     narratio_normalize_output_path: null
     narratio_trim_enabled: false
     narratio_trim_bounds_render_debug: false

tests/verify-baseline.yml

@@ -14,6 +14,7 @@
         that:
           - "'audita' not in narratio_pipeline"
           - "'notarius' not in narratio_pipeline"
+          - "'scriptorium' not in narratio_pipeline"
       vars:
         narratio_pipeline: "{{ narratio_baseline_pipeline.content | b64decode | from_yaml }}"
 

tests/verify-config.yml

@@ -32,12 +32,11 @@
           - narratio_pipeline.notarius.config_overlay == narratio_expected_notarius_config_overlay
           - narratio_pipeline.notarius.resume == false
           - narratio_pipeline.notarius.chunk_cache == 'auto'
+          - narratio_pipeline.scriptorium.credentials == narratio_expected_scriptorium_credentials
           - narratio_pipeline.trim.enabled == false
           - narratio_pipeline.trim.bounds.render_debug == false
           - narratio_pipeline.render.enabled == false
           - narratio_pipeline.render.include_metadata == false
-          - narratio_pipeline.scriptorium.artifacts.disabled_fixture.enabled == false
-          - narratio_pipeline.scriptorium.artifacts.additional_disabled_fixture.enabled == false
           - "'configkit' not in narratio_pipeline"
           - "'storage' not in narratio_pipeline"
           - "'normalize' not in narratio_pipeline"
@@ -51,6 +50,26 @@
         narratio_expected_audita_validation_profile: "{{ narratio_test_audita_validation_profile | default('representative-validation') }}"
         narratio_expected_notarius_credentials: "{{ narratio_test_notarius_credentials | default(['NARRATIO_TEST_NOTARIUS_API_KEY']) }}"
         narratio_expected_notarius_config_overlay: "{{ narratio_test_notarius_config_overlay | default('representative-overlay') }}"
+        narratio_expected_scriptorium_credentials: >-
+          {{ narratio_test_scriptorium_credentials |
+             default(['NARRATIO_TEST_AUDITA_API_KEY', 'NARRATIO_TEST_NOTARIUS_API_KEY']) }}
+
+    - name: Verify composed Scriptorium artifacts
+      ansible.builtin.assert:
+        that:
+          - narratio_pipeline.scriptorium.artifacts.disabled_fixture.enabled == false
+          - narratio_pipeline.scriptorium.artifacts.additional_disabled_fixture.enabled == false
+      vars:
+        narratio_pipeline: "{{ narratio_managed_pipeline.content | b64decode | from_yaml }}"
+      when: not (narratio_test_scriptorium_credentials_only | default(false))
+
+    - name: Verify the credential-only Scriptorium section
+      ansible.builtin.assert:
+        that:
+          - "narratio_pipeline.scriptorium == {'credentials': []}"
+      vars:
+        narratio_pipeline: "{{ narratio_managed_pipeline.content | b64decode | from_yaml }}"
+      when: narratio_test_scriptorium_credentials_only | default(false)
 
     - name: Validate the representative pipeline as the Narratio account
       become: true