Harden API key file loading

docs/config.md

@@ -94,7 +94,13 @@ inputs:
 
 - Do not place raw secrets in YAML.
 - Use env var names in config (for example `pipeline.audita.llm_api_key_env`).
-- Optionally load env files from `pipeline.secrets.env_dir`.
+- Optionally load credential files from `pipeline.secrets.env_dir`. Each valid
+  environment-variable filename supplies one value; trailing CR/LF is removed.
+- An existing process environment value takes precedence over a credential file.
+- Credential directories and files must not be symlinks and must be regular,
+  bounded files (at most 8 KiB per value). On POSIX, provision the directory
+  with no group/other access (normally `0700`) and files with no group/other
+  access (normally `0600`).
 - Commands that need storage/auth load filesystem secrets before constructing adapters.
 
 ## Publish Configuration Summary

docs/internal/fileops.md

@@ -31,6 +31,14 @@ tree through those directory handles. It rejects root deletion and any symlink
 encountered in the target path or tree; repeated removal of a missing target is
 successful. Command and post-publish policy remains owned by `internal/app`.
 
+## Confined Reads
+
+`ReadRegularFileUnderRoot` is the no-follow, bounded read primitive for a
+caller-selected root and relative file path. It verifies the root and every
+ancestor through directory handles, admits only a stable regular-file handle,
+and lets the caller enforce its own byte limit and access policy. Credential
+mode policy and environment precedence remain owned by `internal/app`.
+
 ## Replacement Contract
 
 `ReplaceFileAtomic` requires an existing destination directory. It creates a

docs/operations.md

@@ -303,6 +303,9 @@ Windows access control.
 API keys are credentials, not ordinary workspace data. Store them outside the
 shared workspace or in a separately restricted credential location; ordinary
 workspace group access must never be treated as authorization to read keys.
+On POSIX, provision a credential directory as `0700` and credential files as
+`0600`; Narratio rejects group- or other-readable configured credential paths.
+On Windows, restrict the directory and files with ACLs to the credential owner.
 
 ## Cleanup
 

docs/roadmap/implementation.md

@@ -21,7 +21,7 @@ All stages are pending when this plan is created.
 | 3 | Consolidate crash-durable atomic file replacement | RSK-002, DUP-001, DUP-005 | Completed |
 | 4 | Add confined destination and download/install capabilities | COR-003, DUP-003, TST-003 | Completed |
 | 5 | Confine recursive cleanup and replace sentinel locks | RSK-003 | Completed |
-| 6 | Harden API-key file acquisition | RSK-010 | Pending |
+| 6 | Harden API-key file acquisition | RSK-010 | Completed |
 | 7 | Bound and verify external result acquisition | RSK-013, TST-007 | Pending |
 | 8 | Terminate owned subprocess trees | RSK-011 | Pending |
 | 9 | Redact and cap subprocess diagnostics | RSK-012 | Pending |