Support Scriptorium credentials in Narratio

README.md

@@ -8,7 +8,7 @@ application state.
 ## Variables
 
 ```yaml
-narratio_version: v3.0.0
+narratio_version: v3.1.0
 narratio_repository_url: https://gitea.maximumdirect.net/eric/narratio.git
 narratio_source_dir: /usr/local/src/narratio
 narratio_binary_path: /usr/local/bin/narratio
@@ -92,6 +92,7 @@ narratio_render_include_timestamps: null
 narratio_render_include_segment_ids: null
 narratio_render_include_metadata: null
 narratio_scriptorium_binary: null
+narratio_scriptorium_credentials: null
 narratio_scriptorium_config_path: null
 narratio_scriptorium_timeout: null
 narratio_scriptorium_render_debug: null
@@ -167,6 +168,15 @@ list or selector, `[]` emits an explicit empty list, and `""` emits an explicit
 empty selector. A Narratio overlay replaces a credential list rather than
 appending to it.
 
+`narratio_scriptorium_credentials` is likewise an optional list of exact
+environment-variable or secret-reference names, not credential values. Null
+omits the field; `[]` writes an explicit empty list and forwards nothing.
+When nonempty, Narratio resolves every selected name to a nonempty value at
+pipeline load time, even for inspection commands that do not run Scriptorium.
+Provision those values through Narratio's existing process environment or
+secrets-directory mechanism. Provider/profile selection remains Scriptorium's
+responsibility, and this standalone role does not choose provider names.
+
 Audita v2 owns its configuration, backend/model definitions, PromptKit profiles,
 reporting, and debug policy. Configure it independently before using polish;
 the role does not generate downstream files or guess replacements for the