eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Migrate Notarius to credential lists

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-25 15:33:46 +00:00
parent 49948852d6
commit 7e0151ef93
21 changed files with 161 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/integrations/notarius.md
View File

@@ -105,15 +105,16 @@ causes a cold miss. Chunk refresh bypasses lookup and publishes the accepted
replacement for the active source; it does not delete unrelated plans or
checkpoint state.
When `pipeline.notarius.llm_api_key` is absent or null, Narratio adds no
credential to that environment. When configured, the field names an environment
variable whose already-loaded nonempty value is forwarded under that exact
name. Operators must use the same name as the `api_key_env` in the selected
Notarius/PromptKit profile. Narratio does not inspect the Notarius configuration
to infer a provider or destination name, and it does not forward unrelated
credentials from its parent environment or secrets directory.
When `pipeline.notarius.credentials` is absent, null, or empty, Narratio adds no
credentials to that environment. When configured, each list entry names an
environment variable whose already-loaded nonempty value is forwarded under
that exact name. Operators must use the names referenced by the selected
Notarius/PromptKit providers. Narratio does not inspect the Notarius configuration
to infer providers or destination names, and it does not forward unrelated
credentials from its parent environment or secrets directory. A Narratio
overlay replaces the whole credential list; `[]` clears it.
The selected name is registered with Narratio's shared streaming redactor.
Every selected name is registered with Narratio's shared streaming redactor.
Credential bytes written by the child to captured stdout, captured stderr, or
stderr-derived failure diagnostics are replaced with `<redacted>`, including
custom names not known to the built-in sensitive-name list. Narratio does not