Assemble PromptKit profiles for offline configuration inspection

docs/cli.md

@@ -1,8 +1,9 @@
 # Audita CLI Reference
 
-The shared version-2 configuration parser is implemented for `process`, `config
-validate`, and `config print-effective`. Profile assembly and process execution are
-being reconnected in later work, so the CLI is not yet a usable assembled command.
+The shared version-2 configuration parser and offline profile inspection are
+implemented for `process`, `config validate`, and `config print-effective`.
+Process execution is being reconnected in later work, so the CLI is not yet a
+usable assembled command.
 The [configuration reference](config.md) owns fields, defaults, and validation.
 
 ## Commands and help
@@ -51,10 +52,17 @@ shared LLM section. Legacy configuration environment overrides are ignored.
 
 ## Streams and exit status
 
-`config validate` prints `config is valid` on success. `config print-effective`
-currently writes ConfigKit's redacted effective-settings YAML; selected-profile
-and provenance views are scheduled with profile assembly. The effective YAML is
-for inspection and is not guaranteed to be a reloadable input file.
+`config validate` loads settings and both selected PromptKit profiles offline,
+then prints `config is valid` on success. `config print-effective` accepts
+`--view settings|profiles|explain` and defaults to `settings`. Settings writes
+ConfigKit's redacted effective-settings YAML. Profiles writes an Audita-owned
+YAML summary of selected ID, backend, model, sampling controls, per-attempt
+timeout, service tier, and reasoning effort for each role. It omits credentials,
+endpoints, and arbitrary extra provider parameters. Explain writes a YAML
+sequence of field paths, source origins, and recorded derivations without
+resolved setting values. These views share the same settings and profile
+validation path as `process`. Unknown views are usage errors. The effective
+settings YAML is for inspection and is not guaranteed reloadable.
 
 For `process`, `--output` writes the corrected transcript to a file and leaves
 stdout empty on success. Without it, stdout carries transcript JSON only on
@@ -63,8 +71,9 @@ errors and diagnostic locations. A successful run can contain skipped correction
 or warnings; see the [report contract](integrations/output-files.md).
 
 Exit codes are `0` for success, `1` for runtime or output failure, and `2` for
-usage or configuration input errors. Configuration commands never contact a
-provider merely to parse settings; profile validation is being connected next.
+usage or configuration input errors. Invalid settings and profiles return `2`;
+broken embedded assets and serialization or write failures return `1`.
+Configuration commands inspect profiles without contacting a provider.
 
 See the [input files](integrations/transcript-glossary-files.md),
 [subprocess contract](integrations/subprocess.md), and

docs/config.md

@@ -1,8 +1,8 @@
 # Audita Configuration
 
 This reference describes the version-2 configuration loader in `internal/core/config`.
-CLI command parsing and profile inspection are being connected in later work; the
-current CLI is not yet a usable entry point for this schema. Complete copyable
+CLI command parsing and offline profile inspection are implemented; process
+execution is being reconnected in later work. Complete copyable
 examples will be migrated with that integration.
 
 ## Loading and precedence
@@ -24,6 +24,15 @@ when that setting can be decoded. ConfigKit retains field origins and derivation
 for effective-configuration inspection. Its effective YAML redacts resolved
 credentials.
 
+Profile files are resolved against the selected main file's directory, or may
+use an absolute `profiles_dir`. Both selected profiles must exist and select a
+registered backend. Their effective endpoints must match that backend's endpoint
+after surrounding whitespace and trailing slashes are removed. Profiles cannot
+supply a competing `api_key_env` lookup. The backend credential supplies the
+runtime key when required; inspection makes no provider call. The
+[CLI inspection views](cli.md#streams-and-exit-status) show selected controls and
+field provenance separately from ConfigKit's redacted settings YAML.
+
 ## Settings
 
 | Field | Default | Rule |
@@ -68,5 +77,4 @@ reference resolves only the replacement; null removes the reference. General
 Secret values are available to the runtime through the resolved reference, while
 ConfigKit's effective output and provenance contain no resolved secret values.
 
-The CLI reference will be updated as the shared input parser and profile inspection
-commands are connected. Current invocation syntax belongs in [CLI](cli.md).
+Current invocation syntax belongs in [CLI](cli.md).

docs/roadmap/implementation.md

@@ -226,7 +226,16 @@ are deliberately migrated in Stages 6–7.
 
 ## Stage 4: Assemble Profiles and Finish Offline Inspection
 
-**Status:** Pending. **Depends on:** Stages 1–3.
+**Status:** Complete (2026-09-24). Added one engine and profile inspection path
+for both roles, requiring registered matching backends and backend-owned
+credentials. Config commands and process select that path; settings, safe selected
+profiles, and provenance are exposed as separate YAML views with secret redaction.
+Focused offline checks passed with `go test internal/framework/llm/runtime.go
+internal/framework/llm/safe_view.go internal/framework/llm/runtime_inspection_test.go`
+and `go test internal/cli/config_input.go internal/cli/config_input_test.go`;
+`git diff --check` passed. Assembled command tests remain deferred until the
+old caller packages are reconnected in later stages.
+**Depends on:** Stages 1–3.
 **Owns:** engine/profile assembly in `internal/framework/llm`, CLI config commands,
 and inspection tests.