Add versioned Audita config support

docs/architecture.md

@@ -140,14 +140,20 @@ internal/framework/llm/
 ```
 
 ## Current CLI behavior
-Primary command:
+Primary commands:
 
 ```sh
 audita process <transcript.json> --glossary <glossary.yaml> [flags]
+audita config validate --config <config.yml>
+audita config print-effective [--config <config.yml>]
 ```
 
 Current runtime flow (`internal/cli/run.go`):
-1. Load config from env.
+1. Build runtime config from:
+   - defaults;
+   - file config source (`--config`, `AUDITA_CONFIG`, or `/etc/audita/config.yml` when present);
+   - environment overrides;
+   - CLI overrides.
 2. Parse flags and apply CLI overrides.
 3. Validate transcript positional argument and required `--glossary`.
 4. Create per-run diagnostics directory.
@@ -168,6 +174,15 @@ Current runtime flow (`internal/cli/run.go`):
 15. Optionally write `--report-json`; always write run-dir `report.json`.
 16. Apply work-dir retention.
 
+Config command behavior (`internal/cli/run.go`):
+- `audita config validate --config <path>`:
+  - loads and validates a versioned YAML config file;
+  - does not require transcript or glossary inputs.
+- `audita config print-effective [--config <path>]`:
+  - builds effective config from defaults + file config + env overrides;
+  - prints redacted JSON to stdout;
+  - does not require transcript or glossary inputs.
+
 Parity fixture status:
 - representative Python-parity fixture coverage exists under `internal/cli/testdata/parity`;
 - parity tests use fake structured LLM responses for deterministic behavior, including default full-pipeline shape assertions;
@@ -212,10 +227,34 @@ Optional:
 - `aliases`, `plural`
 
 ## Implemented config/env/flag behavior
-Precedence:
+Precedence for `audita process`:
 1. defaults (`config.Default()`)
-2. environment (`config.LoadFromEnv()`)
-3. CLI flags (`ApplyCLIOverrides`)
+2. config file (if resolved from `--config`, `AUDITA_CONFIG`, or default path)
+3. environment overrides
+4. CLI flags (`ApplyCLIOverrides`)
+
+File-config source behavior:
+- explicit `--config <path>`:
+  - required to exist, otherwise process fails clearly.
+- `AUDITA_CONFIG` (when `--config` is not provided):
+  - required to exist, otherwise process fails clearly.
+- default path `/etc/audita/config.yml` (when neither explicit source is provided):
+  - used only when present;
+  - silently ignored when missing.
+
+Versioned file-config behavior (`internal/core/config/file_config.go`):
+- supported version: `version: 1`;
+- missing version fails;
+- unsupported version fails;
+- strict unknown-field rejection is enabled.
+
+`api_key_env` behavior:
+- file config can declare API key environment variable names for proposal/validation LLM settings;
+- runtime resolves those names from the process environment during config application;
+- no direct API-key value field is supported in file config.
+
+Redaction behavior:
+- effective config artifacts and `audita config print-effective` both use the same redaction path (`Config.Redacted()`), so API keys are not emitted in plaintext.
 
 Implemented config surfaces include:
 - module list
@@ -229,6 +268,7 @@ Implemented config surfaces include:
 
 Current caveat:
 - LLM/module-related settings are active for default and explicit module-run paths.
+- compatibility environment variables and lower-level CLI tuning flags remain available while the preferred config-driven surface is adopted.
 
 Transcript description behavior:
 - `--transcript-description` is a process-flag input for optional user-supplied background context.