Add semantic configuration profile comparison

docs/internal/configuration.md

@@ -53,7 +53,7 @@ a temporary downloaded session file therefore cannot invalidate the resolved
 pipeline or campaign context.
 
 The application also has a separate read-only inspection resolver for `config
-validate` and `config show`. It uses the same production root/profile and
+validate`, `config show`, and `config sources`. It uses the same production root/profile and
 campaign selection functions, but never routes through session discovery,
 remote-session download, secret loading, adapter composition, workspace
 initialization, manifest access, or cleanup. A pipeline with retained artifact
@@ -79,6 +79,17 @@ derived players point to the party source, while legacy players retain a
 dedicated legacy-player role. The application command only joins these sorted
 records with selection metadata and never reparses configuration files.
 
+`config diff` uses a paired profile loader that parses the root, imports, and
+declared overlays once, then clones the additive base before independently
+selecting, decoding, defaulting, and finalizing each profile. When campaign
+resolution is needed, the command loads one selected campaign and party and
+expands both effective pipelines from that same party value. The configuration
+owner projects each normalized effective mapping into sorted logical paths;
+mapping leaves are compared individually while sequence values remain atomic.
+Values are compact deterministic JSON representations for command output, not
+raw YAML fragments, ownership records, or secret material. A differing digest
+with no projected difference is treated as an internal consistency error.
+
 Campaign context construction also reads and classifies the campaign-owned
 party source through `ParseParty`. A canonical party retains its raw bytes and
 normalized roster in runtime-only `ResolvedParty` provenance, while a legacy