Add version two LLM reports and safe execution diagnostics

docs/integrations/output-files.md

@@ -39,7 +39,7 @@ from the transcript output envelope:
 | Metadata field | Type / current value |
 | --- | --- |
 | `report_schema_name` | String: `audita-process-report` |
-| `report_schema_version` | String: `v1` |
+| `report_schema_version` | String: `v2` |
 | `output_schema` | String identifying the selected transcript encoder |
 | `config_version` | Optional integer, present when file configuration was loaded |
 
@@ -60,6 +60,7 @@ The remaining top-level fields are:
 | `normalization_skipped` | Object of optional integer counters: `different_speakers`, `gap_too_large`, `duration_exceeded`, `token_limit_exceeded`; can be empty |
 | `chunking` | Optional section summary described below |
 | `diagnostics` | Optional artifact-path metadata described below |
+| `llm_summary` | Optional logical LLM execution summary, present when observations were initialized |
 | `modules_summary` | Optional aggregate module outcome |
 | `module_results` | Optional array of module outcomes |
 
@@ -88,7 +89,7 @@ human-readable, not structured fields to parse for control flow.
 - `directory_path`
 - `source_transcript_path`, `parsed_source_transcript_path`, `normalized_transcript_path`
 - `normalization_summary_path`, `chunking_summary_path`
-- `utilization_summary_path`, `correction_ledger_path`
+- `utilization_summary_path`, `llm_execution_path`, `selected_profiles_path`, `correction_ledger_path`
 - `invocation_metadata_path`, `redacted_effective_config_path`, `error_log_path`
 
 The [operations guide](../operations.md#diagnostics-directory) defines the physical
@@ -163,24 +164,26 @@ or resume protocol.
 
 ## Utilization Diagnostics
 
-This unversioned JSON object describes observations from the runtime, not service
-limits or performance guarantees:
+`llm_summary` contains integer `logical_calls`, `provider_attempts`,
+`transient_retries`, and `structural_repairs`. Its `usage` contains `prompt`,
+`completion`, `total`, `cached`, and `cache_write`, each with integer `value`
+and boolean `known` and `complete`. A call counts once even if preparation fails.
+If no call dispatches, usage is known-zero and complete. Missing `llm_summary`
+means observations were unavailable.
 
-- `effective_concurrency`: integer `total_llm`, `proposal_llm`, `validation_llm`.
-- `run_timing`: millisecond integers `run_wall_time_ms`, `scheduler_queue_wait_ms`,
-  `llm_execution_time_ms`, `deterministic_validation_time_ms`; integer
-  `max_in_flight_llm_calls` and `average_in_flight_llm_calls`.
-- `llm_calls`: integer `total_proposal_calls` and `total_validation_calls`.
-- Optional `modules`: records with `module_key`, `module_instance`, integer
-  `proposal_llm_calls` and `validation_llm_calls`, and millisecond integer
-  `scheduler_queue_wait_ms`, `llm_execution_time_ms`,
-  `deterministic_validation_time_ms`, and `module_wall_time_ms`.
-- Optional `validators`: records with `module_key`, `module_instance`,
-  `validator_key`, boolean `llm_backed`, integer `calls`, and millisecond integer
-  `elapsed_ms`.
+The unversioned utilization JSON contains `backends`, keyed by backend ID. Each
+entry has configured `concurrency` and `queue_capacity`, the same execution
+summary fields, and integer `capacity_wait_ms`, `generation_ms`,
+`retry_delay_ms`, and `logical_wall_ms`. It also has `run_wall_time_ms` and
+optional `modules` and `validators` arrays. Module records contain the module
+identity, logical proposal/validation call counts, and `module_wall_time_ms`.
+Validator records contain module/validator identity, `llm_backed`, `calls`, and
+`elapsed_ms`. Timings can overlap; they do not decompose total wall time.
 
-Aggregated execution/wait durations can overlap in concurrent work; they need
-not sum to wall time. The observed average concurrency is serialized as an integer.
-Other source snapshots, prompt payloads, and diagnostic files are debugging
-material; their placement is documented in operations without defining a separate
-public schema for every file.
+`llm-execution.json` has `calls` and `events` arrays joined by `call_id`. Calls
+include logical attribution, final classification, summary, elapsed milliseconds,
+and available prompt/profile/model metadata. Events contain safe execution
+metadata, including attempt and terminal records, with millisecond durations.
+Preparation failures have a call and no fabricated events. This artifact has no
+provider messages, endpoints, credentials, or transcript content. Other request
+and response artifacts can contain redacted prompt and transcript content.

docs/internal/diagnostics-reporting.md

@@ -40,8 +40,12 @@ ledger entries. It associates validator records by proposal index within each
 module, separates execution classes through validator metadata, and sorts entries
 by module instance, proposal index, and disposition.
 
-Runner instrumentation collects utilization; CLI orchestration writes it when
-run output is available. Report assembly does not independently measure calls.
+Runner instrumentation and PromptKit observations collect utilization; CLI
+orchestration writes the backend summary and safe call/event artifact when run
+output is available. Report assembly maps the same observations to `llm_summary`
+without independently measuring calls. A selected backend remains attributable
+when preparation fails before dispatch. Domain module/validator timing stays
+separate from provider timing, and those durations can overlap.
 For the serialized forms see [ledger](../integrations/output-files.md#correction-ledger)
 and [utilization](../integrations/output-files.md#utilization-diagnostics).
 
@@ -59,8 +63,9 @@ artifacts and process exit status must be assessed together.
 
 ## Redaction
 
-Effective configuration uses config redaction. LLM diagnostic and error paths
-use `llm.ConfiguredSecrets` and the runtime's redaction helpers. Keep these separate
+Effective configuration uses ConfigKit redaction. LLM diagnostic and error paths
+use `llm.ConfiguredSecrets` and the runtime's redaction helpers. The CLI also
+redacts every resolved backend secret from both report copies. Keep these separate
 mechanisms aligned with the [architecture requirement](../policy/architecture.md#errors-and-secret-handling).
 Operational handling of transcript-bearing artifacts belongs to
 [operations](../operations.md#artifact-handling).

docs/operations.md

@@ -51,10 +51,13 @@ resolve them using the invocation's working directory.
 | `normalization-summary.json` | Normalization counters |
 | `chunking-summary.json` | Section/token summary |
 | `invocation.json` | Invocation metadata |
-| `effective-config.json` | Redacted configuration snapshot |
+| `effective-config.redacted.yaml` | Redacted ConfigKit configuration snapshot |
+| `config-origins.yaml` | Safe configuration origin and resolution metadata |
+| `selected-profiles.yaml` | Safe selected role profiles and model controls |
 | `report.json` | Run's [process report](integrations/output-files.md#process-report) |
 | `correction-ledger.json` | [Correction dispositions](integrations/output-files.md#correction-ledger) |
-| `utilization-diagnostics.json` | [Concurrency and timing observations](integrations/output-files.md#utilization-diagnostics) |
+| `utilization-diagnostics.json` | [Backend execution and domain timing observations](integrations/output-files.md#utilization-diagnostics) |
+| `llm-execution.json` | Safe logical-call and execution event records |
 | `error.log` | Failure details when written |
 
 LLM request, response, and error diagnostics are also written within the run

docs/roadmap/implementation.md

@@ -473,7 +473,15 @@ No raw provider messages, URLs, keys, prompts, or payloads enter observation rec
 
 ## Stage 10: Update Reports and Diagnostic Artifacts
 
-**Status:** Pending. **Depends on:** Stage 9.
+**Status:** Complete. Process reports use v2 LLM summaries; retained diagnostics
+include backend utilization, safe call/event records, selected profiles, config
+origins, and the redacted ConfigKit snapshot. Focused reporting, diagnostics,
+runtime, and runner tests and a binary build passed. A controlled provider 500
+response echoing a synthetic secret produced a partial failure report and retained
+artifacts without the secret in stdout, stderr, reports, or artifacts. The assembled
+CLI test suite remains scheduled for Stage 12.
+
+**Depends on:** Stage 9.
 **Owns:** `internal/core/reporting`, `internal/core/diagnostics`,
 `internal/framework/processreport`, runtime diagnostic writers, and CLI artifact wiring.