Migrate Notarius to credential lists

docs/cli.md

@@ -98,7 +98,7 @@ a session nor create a workspace, manifest, run, lock, adapter, or remote
 connection. Like every pipeline-loading command, they bootstrap the selected or
 conventional secrets directory before resolving configuration; `config show`
 never includes bootstrap reports or secret values in its YAML output.
-Typed credential references, including `notarius.llm_api_key`, must therefore
+Typed credential references, including `notarius.credentials[]`, must therefore
 resolve even though these inspection commands never construct an adapter.
 
 Campaign selection is optional for a pipeline without party-driven artifact
@@ -178,7 +178,7 @@ Behavior:
 - runs `render` before `extract`; an omitted or disabled Notarius
   configuration records an explicit `notarius_disabled` self-skip;
 - resolves every selected typed credential during the initial configuration
-  load, including a Notarius credential when extract is disabled, outside the
+  load, including Notarius credentials when extract is disabled, outside the
   selected range, or later skipped as resumable;
 - skips already-succeeded stages unless `--force` is set or a stage-specific
   resume check finds its durable result obsolete;

docs/config.md

@@ -230,7 +230,7 @@ inputs:
 - Do not place raw secrets in YAML.
 - Credential fields contain environment-variable names, represented internally
   as ConfigKit typed secret references (for example
-  `pipeline.notarius.llm_api_key: NOTARIUS_LLM_API_KEY`). A configured reference
+  `pipeline.notarius.credentials: [NOTARIUS_LLM_API_KEY]`). A configured reference
   must resolve to a nonempty environment value during load.
 - Every surviving reference is resolved during ordinary pipeline loading,
   regardless of whether its integration is disabled, outside the selected
@@ -362,7 +362,7 @@ Rules:
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.notarius.enabled` | bool | No | `false` |
 | `pipeline.notarius.binary` | string | No | `notarius` |
-| `pipeline.notarius.llm_api_key` | secret reference | No | unset; exact environment-variable name forwarded to Notarius |
+| `pipeline.notarius.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Notarius |
 | `pipeline.notarius.config_profile` | string | No | unset; exact Notarius ConfigKit profile selector |
 | `pipeline.notarius.config_path` | string | Conditional | required when enabled; relative paths resolve from the pipeline file directory |
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
@@ -406,35 +406,36 @@ does not restrict profile names, resolve profile files, or rewrite the value.
 This selection is independent of Narratio's own `--overlay` selection. A
 Narratio overlay may explicitly select a differently named Notarius overlay,
 but Narratio never forwards its own overlay name automatically. It is also
-independent of `pipeline.notarius.llm_api_key`: an overlay may change either or
+independent of `pipeline.notarius.credentials`: an overlay may change either or
 both fields according to the deployed Notarius configuration. See the
 [Notarius integration contract](./integrations/notarius.md) for invocation and
 failure behavior.
 
-### Notarius Credential
+### Notarius Credentials
 
-`pipeline.notarius.llm_api_key` optionally names the one environment variable
+`pipeline.notarius.credentials` optionally lists environment-variable names
 to forward to the Notarius child process:
 
 ```yaml
 notarius:
-  llm_api_key: OPENROUTER_API_KEY
+  credentials: [OPENROUTER_API_KEY, ANTHROPIC_API_KEY]
 ```
 
-The field contains the variable name, not a credential value. That name must
-match `api_key_env` in the Notarius/PromptKit profile selected by the deployed
-Notarius pipeline; Narratio does not infer or remap provider names. Omission or
-`null` forwards nothing. A non-null selected reference must resolve at pipeline
+The list contains variable names, not credential values. Those names must
+match the credential references in the selected Notarius/PromptKit configuration;
+Narratio does not infer or remap provider names. Omission, `null`, or `[]`
+forwards nothing. Each selected reference must resolve at pipeline
 load time through the process environment or existing secrets-directory
 bootstrap, even when Notarius is disabled, extract is outside the requested
 range, or a completed extraction can be reused.
 
 The Notarius child receives only Narratio's minimal execution environment plus
-this exact selected name and loaded value. Other credentials are not forwarded.
-Changing the value, name, presence, or absence does not invalidate extract's
-semantic resume evidence. The public name remains part of safe effective
-inspection, so renaming it may appear in `config diff` and change the effective
-configuration digest; rotating only its value does neither.
+these exact selected names and loaded values. Other credentials are not forwarded.
+Changing a value, name, presence, or absence does not invalidate extract's
+semantic resume evidence. The public names remain part of safe effective
+inspection, so renaming them may appear in `config diff` and change the effective
+configuration digest; rotating only their values does neither. An overlay
+replaces the whole list, including with `[]` to clear it.
 
 See the [Notarius integration contract](./integrations/notarius.md) for the
 delivery and redaction boundary.

docs/integrations/notarius.md

@@ -105,15 +105,16 @@ causes a cold miss. Chunk refresh bypasses lookup and publishes the accepted
 replacement for the active source; it does not delete unrelated plans or
 checkpoint state.
 
-When `pipeline.notarius.llm_api_key` is absent or null, Narratio adds no
-credential to that environment. When configured, the field names an environment
-variable whose already-loaded nonempty value is forwarded under that exact
-name. Operators must use the same name as the `api_key_env` in the selected
-Notarius/PromptKit profile. Narratio does not inspect the Notarius configuration
-to infer a provider or destination name, and it does not forward unrelated
-credentials from its parent environment or secrets directory.
+When `pipeline.notarius.credentials` is absent, null, or empty, Narratio adds no
+credentials to that environment. When configured, each list entry names an
+environment variable whose already-loaded nonempty value is forwarded under
+that exact name. Operators must use the names referenced by the selected
+Notarius/PromptKit providers. Narratio does not inspect the Notarius configuration
+to infer providers or destination names, and it does not forward unrelated
+credentials from its parent environment or secrets directory. A Narratio
+overlay replaces the whole credential list; `[]` clears it.
 
-The selected name is registered with Narratio's shared streaming redactor.
+Every selected name is registered with Narratio's shared streaming redactor.
 Credential bytes written by the child to captured stdout, captured stderr, or
 stderr-derived failure diagnostics are replaced with `<redacted>`, including
 custom names not known to the built-in sensitive-name list. Narratio does not

docs/roadmap/implementation.md

@@ -241,7 +241,10 @@ a resolver, provider policy, or ambient-secret inheritance.
 
 ## Stage 3: Migrate Notarius to credential lists
 
-Status: Not started.
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/adapters/notarius ./internal/stage ./internal/app`,
+`go test -race ./internal/adapters/notarius`, and `git diff --check` passed.
 
 Preparation: `internal/config/config.go`, `credential_projection.go`, loading/
 inspection tests; `internal/adapters/notarius/runner.go`, `subprocess.go`;

docs/troubleshooting.md

@@ -312,7 +312,7 @@ and [Transcribe internals](./internal/stage-transcribe.md).
 Symptom:
 
 - configuration loading reports `secret.unset`, `secret.empty`, or an invalid
-  name for `pipeline.notarius.llm_api_key`, including during inspection or a
+  name in `pipeline.notarius.credentials`, including during inspection or a
   run that would not execute extraction.
 
 Likely causes: