Migrate Notarius to credential lists

2026-09-25 15:33:46 +00:00
parent 49948852d6
commit 7e0151ef93
21 changed files with 161 additions and 112 deletions
--- a/internal/adapters/notarius/fake.go
+++ b/internal/adapters/notarius/fake.go
@@ -1,6 +1,10 @@
 package notarius

-import "context"
+import (
+	"context"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)

 // FakeRunner is a configurable in-memory runner for stage tests.
 type FakeRunner struct {
@@ -15,6 +19,7 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 		return RunResult{}, err
 	}
 	copyRequest := req
+	copyRequest.Credentials = append([]configkit.Secret(nil), req.Credentials...)
 	if req.ConfigProfile != nil {
 		profile := *req.ConfigProfile
 		copyRequest.ConfigProfile = &profile
--- a/internal/adapters/notarius/runner.go
+++ b/internal/adapters/notarius/runner.go
@@ -25,8 +25,8 @@ type ReferenceBinding struct {
 // RunRequest contains the resolved inputs and diagnostic destinations for one invocation.
 type RunRequest struct {
 	Binary string
-	// LLMAPIKey is an optional already-resolved credential reference.
-	LLMAPIKey        *configkit.Secret
+	// Credentials are already-resolved environment references selected for Notarius.
+	Credentials      []configkit.Secret
 	ConfigProfile    *string
 	ConfigPath       string
 	PipelineID       string
--- a/internal/adapters/notarius/subprocess.go
+++ b/internal/adapters/notarius/subprocess.go
@@ -52,19 +52,9 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return RunResult{}, err
 	}
-	var envOverrides map[string]string
-	var sensitiveEnvNames []string
-	if req.LLMAPIKey != nil {
-		if !req.LLMAPIKey.IsResolved() {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		name := req.LLMAPIKey.EnvName()
-		value := req.LLMAPIKey.Value()
-		if value == "" {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		envOverrides = map[string]string{name: value}
-		sensitiveEnvNames = []string{name}
+	envOverrides, sensitiveEnvNames, err := subprocess.CredentialEnvironment(req.Credentials)
+	if err != nil {
+		return RunResult{}, fmt.Errorf("notarius credentials: %w", err)
 	}

 	args := []string{
--- a/internal/adapters/notarius/subprocess_test.go
+++ b/internal/adapters/notarius/subprocess_test.go
@@ -188,12 +188,16 @@ func TestSubprocessRunnerRejectsInvalidChunkCacheBeforeLaunch(t *testing.T) {

 func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_LLM_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_OTHER_KEY"
 	const loadedValue = "loaded-notarius-credential"
+	const otherValue = "loaded-notarius-other-credential"
 	credential := loadTestCredential(t, envName, loadedValue)
+	otherCredential := loadTestCredential(t, otherName, otherValue)
 	t.Setenv(envName, "changed-parent-credential")
+	t.Setenv(otherName, "changed-parent-other-credential")

 	req := validRunRequest(t)
-	req.LLMAPIKey = credential
+	req.Credentials = []configkit.Secret{*credential, *otherCredential}
 	var captured sharedsubprocess.RunRequest
 	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
 		captured = processReq
@@ -203,10 +207,10 @@ func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *
 	if _, err := runner.Run(context.Background(), req); err != nil {
 		t.Fatalf("Run() error = %v", err)
 	}
-	if len(captured.EnvOverrides) != 1 || captured.EnvOverrides[envName] != loadedValue {
-		t.Fatal("subprocess did not receive exactly the loaded credential override")
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[envName] != loadedValue || captured.EnvOverrides[otherName] != otherValue {
+		t.Fatal("subprocess did not receive exactly the loaded credential overrides")
 	}
-	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName}) {
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName, otherName}) {
 		t.Fatalf("sensitive environment names = %#v, want configured reference name", captured.SensitiveEnvNames)
 	}
 	wantArgs := []string{
@@ -228,7 +232,7 @@ func TestSubprocessRunnerRejectsInvalidProgrammaticCredentialBeforeLaunch(t *tes
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			req := validRunRequest(t)
-			req.LLMAPIKey = &test.reference
+			req.Credentials = []configkit.Secret{test.reference}
 			started := false
 			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
 				started = true
@@ -342,10 +346,12 @@ func TestSubprocessRunnerRejectsInvalidReferencesBeforeLaunch(t *testing.T) {

 func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_OTHER_KEY"
 	const canary = "notarius-captured-stream-canary"
+	const otherCanary = "notarius-captured-stream-other-canary"
 	const unrelated = "NARRATIO_NOTARIUS_UNRELATED_PARENT_KEY"
 	req := validRunRequest(t)
-	req.LLMAPIKey = loadTestCredential(t, envName, canary)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	writeValidBundleAndReceipt(t, req, false)
 	receiptFixture := req.ReceiptPath + ".fixture"
 	data, err := os.ReadFile(req.ReceiptPath)
@@ -356,7 +362,7 @@ func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T)
 	if err := json.Unmarshal(data, &receipt); err != nil {
 		t.Fatalf("decode receipt fixture: %v", err)
 	}
-	receipt["credential_echo"] = canary
+	receipt["credential_echo"] = canary + " " + otherCanary
 	writeJSONFile(t, receiptFixture, receipt)
 	if err := os.Remove(req.ReceiptPath); err != nil {
 		t.Fatalf("Remove(receipt) error = %v", err)
@@ -373,11 +379,16 @@ if [ "$`+envName+`" != '`+canary+`' ]; then
  printf 'selected credential mismatch\n' >&2
  exit 8
 fi
+if [ "$`+otherName+`" != '`+otherCanary+`' ]; then
+  printf 'other selected credential mismatch\n' >&2
+  exit 10
+fi
 if [ -n "$`+unrelated+`" ]; then
  printf 'unrelated credential inherited\n' >&2
  exit 9
 fi
 printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 cat "$NOTARIUS_RECEIPT_FIXTURE"
 `)
 	req.Binary = script
@@ -392,32 +403,39 @@ cat "$NOTARIUS_RECEIPT_FIXTURE"
 	assertTextFile(t, filepath.Join(captureDir, "working-directory"), req.WorkingDirectory+"\n")
 	assertTextFile(t, filepath.Join(captureDir, "environment"), "")
 	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 	receiptBytes, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
 	assertRedactedCredentialBytes(t, receiptBytes, canary)
+	assertRedactedCredentialBytes(t, receiptBytes, otherCanary)
 }

 func TestSubprocessRunnerRedactsCredentialOnProcessFailure(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_OTHER_KEY"
 	const canary = "notarius-failure-stream-canary"
+	const otherCanary = "notarius-failure-stream-other-canary"
 	req := validRunRequest(t)
-	req.LLMAPIKey = loadTestCredential(t, envName, canary)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	req.Binary = writeShellScript(t, `#!/bin/sh
 printf '%s\n' "$`+envName+`"
 printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 exit 7
 `)
 	_, err := NewSubprocessRunner().Run(context.Background(), req)
 	if err == nil {
 		t.Fatal("Run() error = nil, want process failure")
 	}
-	if strings.Contains(err.Error(), canary) || !strings.Contains(err.Error(), "<redacted>") {
+	if strings.Contains(err.Error(), canary) || strings.Contains(err.Error(), otherCanary) || !strings.Contains(err.Error(), "<redacted>") {
 		t.Fatal("process failure did not return redacted diagnostics")
 	}
 	assertRedactedCredentialFile(t, req.ReceiptPath, canary)
+	assertRedactedCredentialFile(t, req.ReceiptPath, otherCanary)
 	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 }

 func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T) {
--- a/internal/app/config_commands_test.go
+++ b/internal/app/config_commands_test.go
@@ -389,16 +389,16 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 `, 1)
 	pipelineYAML += `notarius:
  enabled: false
-  llm_api_key: NARRATIO_INSPECT_NOTARIUS_ONE
+  credentials: [NARRATIO_INSPECT_NOTARIUS_ONE]
 `
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	writeInspectionOverlays(t, pipelinePath,
 		"audita:\n  model: production\n  llm_api_key: NARRATIO_INSPECT_LLM_ONE\n",
-		"audita:\n  model: testing\n  llm_api_key: NARRATIO_INSPECT_LLM_TWO\nnotarius:\n  llm_api_key: NARRATIO_INSPECT_NOTARIUS_TWO\n",
+		"audita:\n  model: testing\n  llm_api_key: NARRATIO_INSPECT_LLM_TWO\nnotarius:\n  credentials: [NARRATIO_INSPECT_NOTARIUS_TWO]\n",
 	)
-	mustWriteTestFile(t, filepath.Join(filepath.Dir(pipelinePath), "overlays", "without-notarius-key.yml"), "notarius:\n  llm_api_key: null\n")
+	mustWriteTestFile(t, filepath.Join(filepath.Dir(pipelinePath), "overlays", "without-notarius-key.yml"), "notarius:\n  credentials: []\n")

 	var validate bytes.Buffer
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &validate); err != nil {
@@ -439,11 +439,11 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 		!strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") || !strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_TWO") {
 		t.Fatalf("diff omitted safe credential references: %q", diff.String())
 	}
-	if !strings.Contains(sources.String(), "notarius.llm_api_key") {
+	if !strings.Contains(sources.String(), "notarius.credentials") {
 		t.Fatalf("sources omitted Notarius credential ownership: %q", sources.String())
 	}
-	if strings.Contains(removed.String(), "llm_api_key") || strings.Contains(removed.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") {
-		t.Fatalf("overlay null did not remove Notarius credential: %q", removed.String())
+	if strings.Contains(removed.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") {
+		t.Fatalf("empty overlay did not remove Notarius credential: %q", removed.String())
 	}
 }

@@ -451,7 +451,7 @@ func TestConfigValidateRejectsUnavailableNotariusCredential(t *testing.T) {
 	const envName = "NARRATIO_INSPECT_NOTARIUS_MISSING"
 	restoreEnvAfterTest(t, envName)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	mustWriteTestFile(t, path, "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n")
+	mustWriteTestFile(t, path, "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n")
 	err := ConfigValidate(context.Background(), []string{"--config", path}, io.Discard)
 	if err == nil || !strings.Contains(err.Error(), "secret.unset") {
 		t.Fatalf("ConfigValidate() error = %v, want unavailable credential failure", err)
--- a/internal/app/extract_lifecycle_test.go
+++ b/internal/app/extract_lifecycle_test.go
@@ -665,16 +665,16 @@ func TestExtractLifecycleCredentialChangesRemainResumable(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			cfg, env, runner := extractionLifecycleFixture(t, true)
 			if test.before != nil {
-				cfg.Pipeline.Notarius.LLMAPIKey = test.before(t)
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.before(t)}
 			}
 			analyzeRuns := 0
 			plan := extractionLifecyclePlan(t, &analyzeRuns)
 			if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
 				t.Fatalf("initial executeStages() error = %v", err)
 			}
-			cfg.Pipeline.Notarius.LLMAPIKey = nil
+			cfg.Pipeline.Notarius.Credentials = nil
 			if test.after != nil {
-				cfg.Pipeline.Notarius.LLMAPIKey = test.after(t)
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.after(t)}
 			}
 			resumed, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
 			if err != nil {
@@ -876,7 +876,7 @@ func TestPreparedPipelineAndManifestExcludeNotariusCredentialValue(t *testing.T)
 	const name = "NARRATIO_LIFECYCLE_PERSISTED_KEY"
 	const canary = "notarius-persisted-credential-canary"
 	cfg, env, _ := extractionLifecycleFixture(t, true)
-	cfg.Pipeline.Notarius.LLMAPIKey = loadLifecycleNotariusCredential(t, name, canary)
+	cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*loadLifecycleNotariusCredential(t, name, canary)}
 	if _, err := executeStages(context.Background(), cfg, prepareExtractLifecyclePlan(t), RunOptions{Env: env}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -1181,12 +1181,12 @@ func loadLifecycleNotariusCredential(t *testing.T, name, value string) *configki
 	t.Helper()
 	t.Setenv(name, value)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+name+"\n"), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+name+"]\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	pipeline, err := config.LoadPipeline(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return pipeline.Notarius.LLMAPIKey
+	return &pipeline.Notarius.Credentials[0]
 }
--- a/internal/app/secrets_bootstrap_test.go
+++ b/internal/app/secrets_bootstrap_test.go
@@ -138,7 +138,7 @@ func TestNotariusCredentialLoadsFromCommandSecretBootstrap(t *testing.T) {
 			restoreEnvAfterTest(t, envName)
 			root := t.TempDir()
 			pipelinePath := filepath.Join(root, "pipeline.yml")
-			if err := os.WriteFile(pipelinePath, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n"), 0o644); err != nil {
+			if err := os.WriteFile(pipelinePath, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n"), 0o644); err != nil {
 				t.Fatal(err)
 			}
 			secretsDir := filepath.Join(root, "secrets")
@@ -158,8 +158,8 @@ func TestNotariusCredentialLoadsFromCommandSecretBootstrap(t *testing.T) {
 			if err != nil {
 				t.Fatalf("load pipeline: %v", err)
 			}
-			if pipeline.Notarius == nil || pipeline.Notarius.LLMAPIKey == nil || !pipeline.Notarius.LLMAPIKey.IsResolved() ||
-				pipeline.Notarius.LLMAPIKey.EnvName() != envName || pipeline.Notarius.LLMAPIKey.Value() != test.wantValue {
+			if pipeline.Notarius == nil || len(pipeline.Notarius.Credentials) != 1 || !pipeline.Notarius.Credentials[0].IsResolved() ||
+				pipeline.Notarius.Credentials[0].EnvName() != envName || pipeline.Notarius.Credentials[0].Value() != test.wantValue {
 				t.Fatal("Notarius credential did not resolve from the selected command bootstrap source")
 			}
 		})
@@ -220,7 +220,7 @@ func TestExecuteConfigValidateReportsSkippedEmptyBeforeTypedLoadFailure(t *testi
 	if err != nil {
 		t.Fatal(err)
 	}
-	pipelineYAML = append(pipelineYAML, []byte("notarius:\n  enabled: false\n  llm_api_key: "+name+"\n")...)
+	pipelineYAML = append(pipelineYAML, []byte("notarius:\n  enabled: false\n  credentials: ["+name+"]\n")...)
 	if err := os.WriteFile(pipelinePath, pipelineYAML, 0o644); err != nil {
 		t.Fatal(err)
 	}
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -309,7 +309,7 @@ type ScriptoriumInputConfig struct {
 type NotariusConfig struct {
 	Enabled          bool                            `yaml:"enabled" json:"enabled"`
 	Binary           string                          `yaml:"binary" json:"binary"`
-	LLMAPIKey        *configkit.Secret               `yaml:"llm_api_key,omitempty" json:"llm_api_key,omitempty"`
+	Credentials      []configkit.Secret              `yaml:"credentials,omitempty" json:"credentials,omitempty"`
 	ConfigProfile    *string                         `yaml:"config_profile,omitempty" json:"config_profile,omitempty"`
 	Resume           bool                            `yaml:"resume,omitempty" json:"resume,omitempty"`
 	ChunkCache       string                          `yaml:"chunk_cache,omitempty" json:"chunk_cache,omitempty"`
--- a/internal/config/credential_projection.go
+++ b/internal/config/credential_projection.go
@@ -50,12 +50,12 @@ func (cfg AuditaConfig) MarshalYAML() (any, error) {
 	}, nil
 }

-// MarshalYAML exposes only the public Notarius credential reference name.
+// MarshalYAML exposes only public Notarius credential reference names.
 func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	type safeNotarius struct {
 		Enabled          bool                            `yaml:"enabled"`
 		Binary           string                          `yaml:"binary"`
-		LLMAPIKey        *string                         `yaml:"llm_api_key,omitempty"`
+		Credentials      []string                        `yaml:"credentials,omitempty"`
 		ConfigProfile    *string                         `yaml:"config_profile,omitempty"`
 		Resume           bool                            `yaml:"resume,omitempty"`
 		ChunkCache       string                          `yaml:"chunk_cache,omitempty"`
@@ -67,7 +67,7 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 		Outputs          map[string]NotariusOutputConfig `yaml:"outputs"`
 	}
 	return safeNotarius{
-		Enabled: cfg.Enabled, Binary: cfg.Binary, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
+		Enabled: cfg.Enabled, Binary: cfg.Binary, Credentials: secretReferenceNames(cfg.Credentials),
 		ConfigProfile: cfg.ConfigProfile,
 		Resume:        cfg.Resume, ChunkCache: cfg.ChunkCache,
 		ConfigPath: cfg.ConfigPath, PipelineID: cfg.PipelineID, Timeout: cfg.Timeout,
@@ -75,6 +75,17 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	}, nil
 }

+func secretReferenceNames(secrets []configkit.Secret) []string {
+	if secrets == nil {
+		return nil
+	}
+	names := make([]string, len(secrets))
+	for index, secret := range secrets {
+		names[index] = secret.EnvName()
+	}
+	return names
+}
+
 func secretReferenceName(secret *configkit.Secret) *string {
 	if secret == nil {
 		return nil
--- a/internal/config/load_validate_test.go
+++ b/internal/config/load_validate_test.go
@@ -102,7 +102,7 @@ storage:
    secret_access_key: NARRATIO_TEST_SECRET_KEY
 notarius:
  enabled: false
-  llm_api_key: NARRATIO_TEST_NOTARIUS_KEY
+  credentials: [NARRATIO_TEST_NOTARIUS_KEY]
  config_profile: ""
 `
 	pipelinePath, _ := writeConfigFiles(t, pipelineYAML, testSessionBaseYAML)
@@ -146,8 +146,8 @@ notarius:
 	}
 	var roundTrip struct {
 		Notarius *struct {
-			LLMAPIKey     *string `yaml:"llm_api_key"`
-			ConfigProfile *string `yaml:"config_profile"`
+			Credentials   []string `yaml:"credentials"`
+			ConfigProfile *string  `yaml:"config_profile"`
 		} `yaml:"notarius"`
 	}
 	if err := yaml.Unmarshal(firstYAML, &roundTrip); err != nil {
@@ -156,8 +156,8 @@ notarius:
 	if roundTrip.Notarius == nil || roundTrip.Notarius.ConfigProfile == nil || *roundTrip.Notarius.ConfigProfile != "" {
 		t.Fatalf("round-trip config profile = %#v, want explicit empty", roundTrip.Notarius)
 	}
-	if roundTrip.Notarius.LLMAPIKey == nil || *roundTrip.Notarius.LLMAPIKey != "NARRATIO_TEST_NOTARIUS_KEY" {
-		t.Fatalf("round-trip credential reference = %#v, want safe public name", roundTrip.Notarius.LLMAPIKey)
+	if len(roundTrip.Notarius.Credentials) != 1 || roundTrip.Notarius.Credentials[0] != "NARRATIO_TEST_NOTARIUS_KEY" {
+		t.Fatalf("round-trip credential reference = %#v, want safe public name", roundTrip.Notarius.Credentials)
 	}

 	t.Setenv("NARRATIO_TEST_ACCESS_KEY", secondCanary)
--- a/internal/config/notarius_test.go
+++ b/internal/config/notarius_test.go
@@ -58,8 +58,10 @@ notarius:

 func TestNotariusCredentialReferenceLoading(t *testing.T) {
 	const envName = "NARRATIO_TEST_NOTARIUS_KEY"
+	const secondName = "NARRATIO_TEST_NOTARIUS_SECOND_KEY"
 	const canary = "notarius-credential-canary"
 	t.Setenv(envName, canary)
+	t.Setenv(secondName, "second-canary")

 	tests := []struct {
 		name       string
@@ -67,8 +69,9 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
 		wantNil    bool
 	}{
 		{name: "omitted", wantNil: true},
-		{name: "null", credential: "  llm_api_key: null\n", wantNil: true},
-		{name: "custom reference", credential: "  llm_api_key: " + envName + "\n"},
+		{name: "null", credential: "  credentials: null\n", wantNil: true},
+		{name: "empty", credential: "  credentials: []\n"},
+		{name: "custom references", credential: "  credentials: [" + envName + ", " + secondName + "]\n"},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -81,15 +84,19 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			if test.wantNil {
-				if cfg.Notarius.LLMAPIKey != nil {
-					t.Fatal("credential reference should be nil")
-				}
+			if test.wantNil && cfg.Notarius.Credentials != nil {
+				t.Fatal("credential list should be nil")
+			}
+			if test.name == "empty" && len(cfg.Notarius.Credentials) == 0 {
 				return
 			}
-			if cfg.Notarius.LLMAPIKey == nil || cfg.Notarius.LLMAPIKey.EnvName() != envName ||
-				!cfg.Notarius.LLMAPIKey.IsResolved() || cfg.Notarius.LLMAPIKey.Value() != canary {
-				t.Fatal("credential reference was not loaded and resolved")
+			if test.wantNil {
+				return
+			}
+			if len(cfg.Notarius.Credentials) != 2 ||
+				cfg.Notarius.Credentials[0].EnvName() != envName || cfg.Notarius.Credentials[0].Value() != canary ||
+				cfg.Notarius.Credentials[1].EnvName() != secondName || cfg.Notarius.Credentials[1].Value() != "second-canary" {
+				t.Fatal("credential references were not loaded and resolved")
 			}
 		})
 	}
@@ -110,7 +117,7 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "pipeline.yml")
-			pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  enabled: false\n  llm_api_key: " + test.reference + "\n"
+			pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  enabled: false\n  credentials: [" + test.reference + "]\n"
 			if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
 				t.Fatal(err)
 			}
@@ -122,6 +129,17 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
 	}
 }

+func TestNotariusRejectsRetiredCredentialField(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pipeline.yml")
+	pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  llm_api_key: NARRATIO_TEST_NOTARIUS_KEY\n"
+	if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadPipeline(path); err == nil || !strings.Contains(err.Error(), "decode.unknown_field") {
+		t.Fatalf("LoadPipeline() error = %v, want unknown field", err)
+	}
+}
+
 func TestNotariusEnabledDefaultsAndPathResolution(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "deployment", "pipeline.yml")
--- a/internal/config/pipeline_configkit_test.go
+++ b/internal/config/pipeline_configkit_test.go
@@ -147,7 +147,7 @@ func TestPipelineOverlayDoesNotRequireUnusedBaseCredentials(t *testing.T) {
 	}
 }

-func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
+func TestNotariusCredentialOverlayReplacementAndProvenance(t *testing.T) {
 	const baseKey = "NARRATIO_NOTARIUS_UNUSED_BASE_KEY"
 	const profileKey = "NARRATIO_NOTARIUS_PROFILE_KEY"
 	if err := os.Unsetenv(baseKey); err != nil {
@@ -155,24 +155,24 @@ func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
 	}
 	t.Setenv(profileKey, "synthetic-notarius-profile-key")

-	for _, credential := range []string{profileKey, "null"} {
+	for _, credential := range []string{"[" + profileKey + "]", "null", "[]"} {
 		t.Run(credential, func(t *testing.T) {
 			dir := t.TempDir()
-			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+baseKey+"\n")
-			overlay := writePipelineFixture(t, dir, "overlays/testing.yml", "notarius:\n  llm_api_key: "+credential+"\n")
+			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+baseKey+"]\n")
+			overlay := writePipelineFixture(t, dir, "overlays/testing.yml", "notarius:\n  credentials: "+credential+"\n")
 			profile := "testing"
 			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &profile})
 			if err != nil {
 				t.Fatal(err)
 			}
-			if credential == "null" {
-				if cfg.Notarius.LLMAPIKey != nil {
-					t.Fatal("profile did not remove the base credential")
+			if credential == "null" || credential == "[]" {
+				if len(cfg.Notarius.Credentials) != 0 {
+					t.Fatal("overlay did not clear base credentials")
 				}
 				return
 			}
-			if cfg.Notarius.LLMAPIKey == nil || cfg.Notarius.LLMAPIKey.EnvName() != profileKey || !cfg.Notarius.LLMAPIKey.IsResolved() {
-				t.Fatal("profile credential was not resolved")
+			if len(cfg.Notarius.Credentials) != 1 || cfg.Notarius.Credentials[0].EnvName() != profileKey || !cfg.Notarius.Credentials[0].IsResolved() {
+				t.Fatal("overlay credential was not resolved")
 			}
 			sources, err := EffectivePipelineSources(cfg, ResolvedParty{})
 			if err != nil {
@@ -180,12 +180,12 @@ func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
 			}
 			found := false
 			for _, source := range sources {
-				if source.Path == "notarius.llm_api_key" {
+				if source.Path == "notarius.credentials" {
 					found = source.Source == overlay
 				}
 			}
 			if !found {
-				t.Fatal("Notarius credential provenance did not identify the selected profile")
+				t.Fatal("Notarius credential provenance did not identify the selected overlay")
 			}
 		})
 	}
@@ -234,7 +234,7 @@ func TestNotariusCredentialRootProvenance(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_ROOT_KEY"
 	t.Setenv(envName, "synthetic-notarius-root-key")
 	dir := t.TempDir()
-	root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n")
+	root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n")
 	cfg, err := LoadPipeline(root)
 	if err != nil {
 		t.Fatal(err)
@@ -244,7 +244,7 @@ func TestNotariusCredentialRootProvenance(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, source := range sources {
-		if source.Path == "notarius.llm_api_key" && source.Source == root {
+		if source.Path == "notarius.credentials" && source.Source == root {
 			return
 		}
 	}
--- a/internal/stage/extract.go
+++ b/internal/stage/extract.go
@@ -146,7 +146,7 @@ func (extractStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (re
 		chunkCache = "refresh"
 	}
 	request := notarius.RunRequest{
-		Binary: resolvedBinary, LLMAPIKey: notariusConfig.LLMAPIKey, ConfigProfile: notariusConfig.ConfigProfile,
+		Binary: resolvedBinary, Credentials: notariusConfig.Credentials, ConfigProfile: notariusConfig.ConfigProfile,
 		ConfigPath: configPath, PipelineID: notariusConfig.PipelineID,
 		InputPath: inputPath, OutputRoot: outputRoot, WorkingDirectory: workingDirectory,
 		ReceiptPath: receiptPath, LogPath: logPath, Timeout: timeout, Resume: resume, ChunkCache: chunkCache, References: referenceBindings,
--- a/internal/stage/extract_test.go
+++ b/internal/stage/extract_test.go
@@ -61,7 +61,7 @@ func TestExtractStageResolvesManifestInputAndBuildsExactRequest(t *testing.T) {
  transcribe_url: https://transcription.example.test/transcribe
 notarius:
  enabled: false
-  llm_api_key: NARRATIO_EXTRACT_NOTARIUS_KEY
+  credentials: [NARRATIO_EXTRACT_NOTARIUS_KEY]
 `), 0o644); err != nil {
 		t.Fatal(err)
 	}
@@ -71,7 +71,7 @@ notarius:
 	}

 	env, m, fake := setupExtractEnv(t)
-	env.Config.Pipeline.Notarius.LLMAPIKey = loadedPipeline.Notarius.LLMAPIKey
+	env.Config.Pipeline.Notarius.Credentials = loadedPipeline.Notarius.Credentials
 	configProfile := "inexpensive"
 	env.Config.Pipeline.Notarius.ConfigProfile = &configProfile
 	result, err := (extractStage{}).Run(context.Background(), env, m)
@@ -103,7 +103,7 @@ notarius:
 	if req.Resume || req.ChunkCache != "" {
 		t.Fatalf("default cache controls = resume %v, mode %q", req.Resume, req.ChunkCache)
 	}
-	if req.LLMAPIKey != loadedPipeline.Notarius.LLMAPIKey || req.LLMAPIKey.EnvName() != credentialName || !req.LLMAPIKey.IsResolved() {
+	if len(req.Credentials) != 1 || req.Credentials[0].EnvName() != credentialName || !req.Credentials[0].IsResolved() {
 		t.Fatal("request did not retain the loaded Notarius credential reference")
 	}
 	if req.ConfigProfile == nil || *req.ConfigProfile != configProfile {
--- a/internal/stage/semantic_contracts_delivery_test.go
+++ b/internal/stage/semantic_contracts_delivery_test.go
@@ -194,7 +194,7 @@ func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
 	renamed := loadNotariusCredentialForSemanticTest(t, secondName, "second-value")

 	baseline := downstreamSemanticEnv()
-	baseline.Config.Pipeline.Notarius.LLMAPIKey = first
+	baseline.Config.Pipeline.Notarius.Credentials = []configkit.Secret{*first}
 	want, err := (extractStage{}).SemanticConfigFingerprint(baseline)
 	if err != nil {
 		t.Fatal(err)
@@ -209,7 +209,9 @@ func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			env := downstreamSemanticEnv()
-			env.Config.Pipeline.Notarius.LLMAPIKey = test.credential
+			if test.credential != nil {
+				env.Config.Pipeline.Notarius.Credentials = []configkit.Secret{*test.credential}
+			}
 			got, err := (extractStage{}).SemanticConfigFingerprint(env)
 			if err != nil {
 				t.Fatal(err)
@@ -225,14 +227,14 @@ func loadNotariusCredentialForSemanticTest(t *testing.T, name, value string) *co
 	t.Helper()
 	t.Setenv(name, value)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+name+"\n"), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+name+"]\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	pipeline, err := config.LoadPipeline(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return pipeline.Notarius.LLMAPIKey
+	return &pipeline.Notarius.Credentials[0]
 }

 func TestPublishSemanticConfigSensitivityAndOperationalExclusions(t *testing.T) {