Forward Scriptorium credentials through the shared adapter path

docs/config.md

@@ -374,6 +374,7 @@ Rules:
 | `pipeline.render.include_segment_ids` | bool | No | `true` |
 | `pipeline.render.include_metadata` | bool | No | `false` |
 | `pipeline.scriptorium.binary` | string | No | `scriptorium` |
+| `pipeline.scriptorium.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Scriptorium |
 | `pipeline.scriptorium.config_path` | string | No | empty |
 | `pipeline.scriptorium.timeout` | duration | No | `10m` |
 | `pipeline.scriptorium.render_debug` | bool | No | `false` |
@@ -544,6 +545,25 @@ contract-incompatible lane fails extraction. See the
 current ten-lane D&D mapping and the [Notarius contract](./integrations/notarius.md)
 for compatibility ownership.
 
+### Scriptorium Credentials
+
+Set `scriptorium.credentials: [OPENROUTER_API_KEY]` in the pipeline file to
+forward that provider key to Scriptorium. List additional provider names only
+when the selected downstream configuration needs them. The same list applies
+to trim bounds generation, analysis (including character families), and their
+render-debug calls. Scriptorium retains provider/profile selection; Narratio
+does not pass a model-request `--api-key-env` override.
+
+As with Audita and Notarius, names are ConfigKit secret references resolved at
+pipeline load time using the existing environment/secrets bootstrap precedence,
+even when no Scriptorium stage executes. Omitted, null, or empty lists forward
+nothing. An overlay replaces the entire list; `[]` clears it. Captured values
+are forwarded under their exact names and registered for diagnostic redaction.
+Inspection and generated metadata contain names only. Credential changes do
+not invalidate completed trim or analysis work; rotating values also leaves
+the effective configuration digest unchanged. Other environment variables
+retain the shared minimal subprocess inheritance rules.
+
 ### Scriptorium Artifact Entries
 
 For each `pipeline.scriptorium.artifacts.<name>`:

docs/integrations/scriptorium.md

@@ -21,7 +21,7 @@ Both request types carry:
 - output path;
 - timeout;
 - generated config + stdout/stderr log paths;
-- optional API-key env var name;
+- optional list of already-resolved credential references;
 - optional working directory.
 
 ## Result Contract
@@ -39,7 +39,16 @@ Request validation fails for:
 - non-positive timeout;
 - empty input/var names;
 - empty input path values;
-- missing required credential env var when `APIKeyEnv` is set.
+- unresolved or empty selected credential references.
+
+Both modes use the shared credential forwarding used by Audita and Notarius:
+selected names and captured values augment the minimal child environment, and
+all selected values are registered for captured-stream redaction. The adapter
+does not reread the parent environment or override Scriptorium's provider
+selection with `--api-key-env`. Generated invocation records and result metadata
+contain `credential_env_names`, never credential values. This does not scan or
+redact files written directly by Scriptorium. Selection semantics belong in
+[Scriptorium credentials](../config.md#scriptorium-credentials).
 
 Run behavior:
 - subprocess errors propagate with context;

docs/internal/adapters.md

@@ -69,13 +69,13 @@ It also serializes an effective resume request as `--resume` and a nonempty
 validated chunk mode as `--chunk_cache <mode>`. The extract stage, not the
 adapter, resolves force precedence before constructing the request.
 Its request may also carry already-resolved ConfigKit secret references.
-Audita's request carries the same kind of list. Both adapters use the shared
+Audita and Scriptorium requests carry the same kind of list. All three adapters use the shared
 subprocess helper to convert their selected references into exact-name child
 environment overrides and sensitive-name registration. That helper rejects
-unresolved or empty programmatic references, but neither adapter rereads the
+unresolved or empty programmatic references, but no adapter rereads the
 parent environment or inspects downstream configuration to discover names.
 Empty lists add no credential overrides. See the public [Audita](../integrations/audita.md)
-and [Notarius](../integrations/notarius.md) contracts for selection and
+[Notarius](../integrations/notarius.md), and [Scriptorium](../integrations/scriptorium.md) contracts for selection and
 downstream-file boundaries.
 
 Application-owned object-store construction loads configured filesystem

docs/roadmap/bug-report-trim.yml

@@ -1,5 +1,11 @@
 title: Scriptorium credentials are not forwarded during trim bounds generation
-status: reported
+status: implemented; release pending
+resolution: >-
+  Scriptorium now accepts credentials using the same resolved-secret forwarding
+  and redaction helper as Audita and Notarius. Both trim and analyze, including
+  render-debug calls, forward the selected names without provider overrides.
+  See docs/config.md for the current configuration contract. Consumer Ansible
+  role exposure and dependency-pin updates remain downstream follow-up work.
 reported_on: "2026-09-29"
 audience: Narratio maintainers
 
@@ -49,7 +55,7 @@ suspected_root_cause:
     overcome the child-environment filter.
 
 proposed_configuration_addition:
-  status: proposed; not currently supported
+  status: implemented; awaiting downstream release adoption
   field: pipeline.scriptorium.credentials
   example: |
     pipeline:

docs/troubleshooting.md

@@ -739,6 +739,20 @@ manifest-owned.
 Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
 and [Manifest Internals](./internal/manifest.md#transcribe-owned-speaker-state).
 
+## Scriptorium returns HTTP 401 during trim or analyze
+
+Check that Narratio's pipeline selects the credential names required by
+Scriptorium, for example `scriptorium.credentials: [OPENROUTER_API_KEY]`.
+Provision the values through the existing environment or secrets directory;
+exporting a key without selecting it does not forward it to the child process.
+See [Scriptorium credentials](config.md#scriptorium-credentials).
+
+Once corrected, retry the failed run normally; forcing previously successful
+transcription or analysis is unnecessary. If authentication still fails, check
+the selected Scriptorium backend, credential validity, and provider access
+without printing keys. A 401 can indicate an invalid key as well as a missing
+one.
+
 ## Scriptorium private input changed without a rerun
 
 Symptom: