Add Notarius credential configuration

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Notarius Credential Forwarding Implementation Plan
 
-Status: Not started
+Status: In progress — 2026-09-16
 
 Implement the [feature roadmap](notarius-credential-forwarding.md) in the order
 below. Each stage is a bounded assignment for a gpt-5.6-terra coding agent.
@@ -50,7 +50,21 @@ ConfigKit upgrade plan is preserved in Git history.
 
 ## Stage 1 — Add typed configuration and safe projections
 
-Status: Not started
+Status: Complete — 2026-09-16
+
+Completion: Added the optional typed Notarius credential reference and a safe
+direct-YAML projection. Existing ConfigKit loading, effective projections,
+schema-derived provenance, normalization copies, and effective digests carry
+the field without exposing its resolved value. Coverage now protects omitted
+and null values, custom and invalid references, disabled-section resolution,
+profile replacement/removal, root/profile ownership, safe YAML/JSON output, and
+reference-name versus value-rotation digest behavior.
+
+Checks:
+
+- `GOWORK=off go test ./internal/config` — pass.
+- `GOWORK=off go test ./...` — pass; maintained examples load and validate.
+- `git diff --check` — pass.
 
 Read: `internal/config/config.go`, `credential_projection.go`,
 `effective_projection.go`, `effective_pipeline.go`, `effective_digest.go`,