Add Notarius configuration profile support

internal/adapters/notarius/fake.go

@@ -15,6 +15,10 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 		return RunResult{}, err
 	}
 	copyRequest := req
+	if req.ConfigProfile != nil {
+		profile := *req.ConfigProfile
+		copyRequest.ConfigProfile = &profile
+	}
 	copyRequest.References = append([]ReferenceBinding(nil), req.References...)
 	f.Requests = append(f.Requests, copyRequest)
 	if f.Err != nil {

internal/adapters/notarius/runner.go

@@ -27,6 +27,7 @@ type RunRequest struct {
 	Binary string
 	// LLMAPIKey is an optional already-resolved credential reference.
 	LLMAPIKey        *configkit.Secret
+	ConfigProfile    *string
 	ConfigPath       string
 	PipelineID       string
 	InputPath        string

internal/adapters/notarius/subprocess.go

@@ -82,6 +82,9 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	for _, reference := range references {
 		args = append(args, "--reference", reference.Selector+"="+reference.Path)
 	}
+	if req.ConfigProfile != nil {
+		args = append(args, "--config-profile", *req.ConfigProfile)
+	}
 	args = append(args, "--json")
 	processResult, err := r.run(ctx, subprocess.RunRequest{
 		Executable:        req.Binary,

internal/adapters/notarius/subprocess_test.go

@@ -118,6 +118,53 @@ func TestSubprocessRunnerMapsCacheControlsToArguments(t *testing.T) {
 	}
 }
 
+func TestSubprocessRunnerMapsConfigProfileToArgumentPair(t *testing.T) {
+	tests := []struct {
+		name     string
+		supplied bool
+		value    string
+	}{
+		{name: "omitted"},
+		{name: "empty", supplied: true},
+		{name: "default", supplied: true, value: "default"},
+		{name: "named", supplied: true, value: "inexpensive"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			if test.supplied {
+				req.ConfigProfile = &test.value
+			}
+			var captured sharedsubprocess.RunRequest
+			runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				captured = processReq
+				writeValidBundleAndReceipt(t, req, false)
+				return sharedsubprocess.RunResult{ExitCode: 0}, nil
+			}}
+
+			if _, err := runner.Run(context.Background(), req); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			flagIndex := -1
+			for index, arg := range captured.Args {
+				if arg == "--config-profile" {
+					flagIndex = index
+					break
+				}
+			}
+			if !test.supplied {
+				if flagIndex >= 0 {
+					t.Fatalf("subprocess args unexpectedly contain config profile: %#v", captured.Args)
+				}
+				return
+			}
+			if flagIndex < 0 || flagIndex+2 >= len(captured.Args) || captured.Args[flagIndex+1] != test.value || captured.Args[flagIndex+2] != "--json" {
+				t.Fatalf("config profile argument boundary = %#v, want flag, exact value, then --json", captured.Args)
+			}
+		})
+	}
+}
+
 func TestSubprocessRunnerRejectsInvalidChunkCacheBeforeLaunch(t *testing.T) {
 	for _, mode := range []string{"AUTO", "invalid", " auto "} {
 		t.Run(mode, func(t *testing.T) {
@@ -388,6 +435,10 @@ func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			req := validRunRequest(t)
+			if test.name == "nonzero" {
+				profile := "missing-profile"
+				req.ConfigProfile = &profile
+			}
 			req.Binary = writeShellScript(t, "#!/bin/sh\n"+test.scriptBody)
 			req.Timeout = test.timeout
 			ctx := context.Background()
@@ -684,7 +735,8 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 }
 
 func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
-	req := RunRequest{PipelineID: "pipeline", References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
+	profile := "testing"
+	req := RunRequest{PipelineID: "pipeline", ConfigProfile: &profile, References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
 	want := RunResult{BundleRoot: "/bundle"}
 	fake := &FakeRunner{Result: want}
 	got, err := fake.Run(context.Background(), req)
@@ -695,6 +747,10 @@ func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
 	if fake.Requests[0].References[0].Path != "/references/party.json" {
 		t.Fatalf("fake retained aliased request references: %#v", fake.Requests[0].References)
 	}
+	profile = "changed"
+	if *fake.Requests[0].ConfigProfile != "testing" {
+		t.Fatalf("fake retained aliased config profile: %q", *fake.Requests[0].ConfigProfile)
+	}
 
 	wantErr := errors.New("configured failure")
 	fake.Err = wantErr