Expose pipeline profile selection and provenance

docs/cli.md

@@ -43,6 +43,7 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
+- `--profile <name>`
 
 Rules:
 
@@ -51,6 +52,10 @@ Rules:
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
 - `--previous-session-id` is a strict expectation: the selected session file
   must contain the same `previous_session_id`.
+- `--profile` selects a declared pipeline profile. It may be supplied once;
+  an explicit empty or unknown value fails configuration resolution. When it is
+  omitted, a declared `default_profile` is used. The same selection applies to
+  all common-flag commands, including `regenerate-artifacts`.
 - `clean --all` cannot be combined with campaign/session selectors.
 - notification delivery is currently limited to the configured `noop` mode; see
   the [configuration reference](./config.md#notifications).
@@ -102,6 +107,7 @@ Behavior:
   `--name=value` spellings;
 - continues interrupted or partially completed sessions by running non-succeeded stages;
 - writes session and run manifests.
+- reports the resolved profile (or `none`) and effective configuration digest.
 
 When `--artifacts` is present, the selected range must contain `analyze` or
 `publish`. Either consumer is sufficient, including a one-stage range.
@@ -203,6 +209,8 @@ Uses the same inclusive bounds, endpoint validation, force scope, and artifact
 selection contract as `run`. It validates config and prints run/skip decisions
 for selected stages only without creating the local workdir or changing the
 manifest. Resume-capable selected stages are checked against durable evidence.
+The output includes the resolved profile (or `none`) and effective configuration
+digest without writing provenance or any manifest state.
 For `analyze`, the preview also lists explicit targets, prerequisite-only work,
 execution order, and reusable current artifacts with concise reasons. These
 artifact decisions come from the same reconciliation and work planner used by

docs/internal/manifest.md

@@ -113,6 +113,7 @@ does not turn incidental canonical bytes into manifest authority.
 `manifest.RunManifest` is created for each invocation and records:
 
 - invocation identity and `force` flag
+- the selected profile (when any) and secret-free effective configuration digest
 - requested stages
 - per-stage action (`run` or `skip`)
 - per-stage status
@@ -233,6 +234,15 @@ after such a private content change.
 Session manifest is the authoritative stage-progress ledger across invocations.
 Run manifest is invocation-scoped audit state.
 
+Both manifests retain the most recently resolved invocation's bounded
+configuration provenance. It identifies the selected profile name and source
+(`default` or `cli`) plus the effective configuration digest, but never a raw
+secret or profile content. This provenance is informational: it does not
+participate in stage resume or cache decisions. A profile change therefore
+invalidates only stages whose semantic configuration changed. When a private
+external-tool model, module, prompt, or profile changes behind an unchanged
+configured identifier, use `--force` for the affected work.
+
 `session plan` computes the same current fingerprint and applies the same
 comparison and invalidation rules to a cloned manifest. It predicts the runner
 decision without persisting session or invocation state. The shared helper

docs/operations.md

@@ -70,6 +70,11 @@ narratio run 2026-04-04
 narratio session status 2026-04-04
 ```
 
+Run, plan, and status output identify the resolved pipeline profile (or `none`)
+and effective configuration digest. Status distinguishes the current resolved
+value from the last value persisted in the session manifest, which helps
+diagnose profile switches without changing resume authority.
+
 ## Stage Execution and Continuation Behavior
 
 Canonical stage order:

docs/roadmap/implementation.md

@@ -547,7 +547,7 @@ command-specific resolution before CLI profile selection is exposed.
 
 ## Stage 9 — Profile CLI Plumbing, Reporting, And Manifest Provenance
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal