eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Document Notarius credential forwarding

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-16 14:36:44 +00:00
parent cc43906ae9
commit 5b92b3e790
12 changed files with 157 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/internal/stage-extract.md
View File

@@ -24,7 +24,8 @@ procedures belong in [Operations](../operations.md).
4. fingerprints the byte- and provenance-bearing Notarius invocation evidence,
including sorted reference identities;
5. creates a run-local staging directory and invokes the injected
`notarius.Runner`;
`notarius.Runner`, carrying the optional already-resolved credential
reference without exposing its value;
6. revalidates the reference snapshots, then validates the v2 successful
receipt, confined index, management documents, configured required lane
descriptors, validation summaries, and regular payload files;
@@ -61,6 +62,10 @@ semantic fingerprint. It covers enablement, Notarius pipeline identity, sorted
reference selector/source mappings, sorted declared output contracts, and each
canonical `narratio.extraction.<key>` output identity. It excludes executable,
timeout, working directory, config path, and private Notarius config contents.
Credential presence, reference name, and resolved value are likewise
operational-only and excluded. Ordinary command loading still resolves a
selected reference before resume evaluation, but a credential-only change does
not rerun a valid completed extraction or stale its dependents.
`internal/stage/extract_resume.go` then permits a skip only when the existing
stage record still matches the current byte- and provenance-bearing invocation