Adopt ConfigKit for pipeline loading

docs/internal/configuration.md

@@ -8,31 +8,21 @@ pipeline-loading boundary implemented by `internal/config`.
 
 `LoadPipeline` assembles and validates a pipeline in this order:
 
-1. Parse the root YAML into a presence-aware composition tree. The tree retains
-   source names, full field paths, node kinds, declaration order, and explicit
-   zero, false, empty-map, and empty-list values.
-2. Decode the root-only `composition` envelope, validate its declaration shapes
-   and cross-field profile semantics, then clone the root without that envelope
-   as the ordinary pipeline body. The parsed source document is not mutated. A
-   load option retains the difference between omitted and explicitly empty
-   profile selection.
-3. Open each import relative to the root pipeline directory through the
-   confined regular-file boundary. Imports must use a `.yml` or `.yaml`
-   extension and cannot traverse, use symlinks, repeat a file, import the root,
-   or contain another composition envelope.
-4. Resolve and structurally parse every declared profile overlay through the
-   same confined regular-file boundary. Missing or malformed unselected
-   overlays fail the load. Overlays cannot contain a composition envelope.
-5. Additively merge the root body and imports. Distinct map leaves compose;
-   repeated scalar or list paths and node-kind disagreements are conflicts.
-6. Select exactly one declared profile from an explicit option or the default,
-   then recursively merge its overlay. Overlay leaves replace base leaves,
-   lists are atomic replacements, and null or kind changes fail.
-7. Emit deterministic canonical YAML and strictly decode it into
-   `PipelineConfig`.
-8. Apply pipeline defaults once, explicitly normalize reusable domain values,
-   resolve ordinary relative pipeline paths from the root pipeline file, and
-   digest the normalized effective mapping.
+1. Give ConfigKit a fresh typed `PipelineConfig` default value, the root file,
+   enabled imports, and the caller's profile selection. Omitted, empty, and
+   exact `default` selections use the base; named profiles use the fixed
+   `profiles/<name>.yml` convention.
+2. ConfigKit parses the root and declared imports, additively merges base
+   sources, applies only the selected overlay, and strictly decodes the result.
+3. The definition resolver applies recorded entry-level and inherited defaults,
+   runs deterministic domain normalization, records derived publish destinations,
+   and resolves ordinary paths relative to the root pipeline file.
+4. The definition validator performs read-only checks that require only the
+   pipeline file. Checks requiring canonical-party family expansion remain at
+   the existing explicit pipeline/campaign resolution boundary.
+5. Narratio inspects public ConfigKit metadata to reject artifact and family keys
+   declared by multiple base files, adapts source ownership records, attaches
+   runtime-only state, and computes the normalized effective digest.
 
 This ordering preserves monolithic configuration behavior. Moving a field to
 an imported fragment changes its source ownership, not its path base, default,
@@ -71,7 +61,7 @@ commands do not marshal runtime objects directly.
 
 `EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
 safe provenance projection for `config sources`. Pipeline ownership begins with
-the complete logical field paths retained during composition and classifies
+the complete logical field paths projected from the schema and classifies
 each contributor as root, import, profile, or centralized default. The
 projection replaces generated concrete member paths with paired family and
 canonical-party records, and does the same for generated publish rules.
@@ -79,9 +69,8 @@ Campaign records identify campaign-owned fields and party inputs; canonical
 derived players point to the party source. The application command only joins these sorted
 records with selection metadata and never reparses configuration files.
 
-`config diff` uses a paired profile loader that parses the root, imports, and
-declared overlays once, then clones the additive base before independently
-selecting, decoding, defaulting, and finalizing each profile. When campaign
+`config diff` uses a thin paired loader that performs two independent ConfigKit
+loads. When campaign
 resolution is needed, the command loads one selected campaign and party and
 expands both effective pipelines from that same party value. The configuration
 owner projects each normalized effective mapping directly from that same typed
@@ -128,21 +117,22 @@ that candidate without changing it. Scriptorium validates artifact declarations
 and outputs, dependencies and inputs, variables, referenced outputs, and the final
 dependency graph in deterministic artifact order.
 
-Diagnostics identify the relevant semantic field. Composition conflicts also
+Diagnostics identify the relevant semantic field. Merge conflicts also
 retain every claiming source needed to correct an additive ownership conflict.
 Complete prose, punctuation, formatting, and private validation choreography are
 not compatibility contracts.
 
 ## Diagnostics And Runtime Metadata
 
-Syntax, duplicate-key, composition, conflict, and schema failures include the
+Syntax, duplicate-key, merge, profile, and schema failures include the
 relevant source name and full field path. Additive conflicts report every
 claiming source so operators can repair the split without repeatedly
 rediscovering additional conflicts.
 
 The loaded pipeline retains private runtime metadata for the absolute root
 path, ordered imports, selected profile name and selection source, selected
-overlay, contributing sources, effective digest, and leaf ownership. Base
+overlay, original ConfigKit metadata and source snapshots, effective digest,
+and leaf ownership. Base
 leaves retain their root/import owners, replaced leaves belong to the selected
 overlay, and centrally supplied values use the synthetic `default` owner. This
 metadata does not participate in YAML decoding or alter the public
@@ -152,7 +142,7 @@ The effective digest is SHA-256 over a versioned deterministic JSON encoding of
 the same typed safe projection used by show and diff. Runtime Notarius paths remain absolute for
 execution, but the digest substitutes their normalized logical values captured
 before root-relative resolution, so relocating an equivalent configuration
-bundle does not change provenance. Because composition and resolution metadata
+bundle does not change provenance. Because ConfigKit and resolution metadata
 are private, the digest excludes source layout, profile name, and ownership.
 Configuration stores environment variable names rather than resolving raw
 credentials, so raw secret values are neither loaded nor hashed.
@@ -161,12 +151,11 @@ for later runtime expansion.
 
 ## Test Surfaces
 
-`composition_test.go` protects the presence and merge algebra independently of
-the public schema. `pipeline_composition_test.go` exercises explicit imports,
-confinement, conflicts, strict decoding, metadata, and root-relative path
-behavior through `LoadPipeline`. `pipeline_profiles_test.go` covers selection,
-all-overlay validation, overlay behavior, provenance, option propagation, and
-effective-digest stability. Application configuration-loader tests protect the
+`pipeline_configkit_test.go` exercises real imports and fixed-path profiles,
+base selection, unselected-overlay isolation, source attribution, and Narratio's
+unique artifact/family base-declaration rule. Existing focused configuration
+tests protect defaults, explicit-value semantics, strict decoding, validation,
+metadata, and root-relative path behavior. Application configuration-loader tests protect the
 single-read boundary by changing the pipeline file after its initial load and
 confirming local session resolution retains the original pipeline. Other
 configuration tests continue to protect defaults and validation after assembly.

docs/internal/overview.md

@@ -37,7 +37,7 @@ failed stage or required manifest save prevents later stages from starting.
 | --- | --- | --- |
 | Executable | `cmd/narratio` | Process entry, standard stream wiring, argument handoff, and exit status. |
 | Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, and user-facing reporting. |
-| Configuration | [`internal/config`](configuration.md) | Presence-aware root/import/profile composition, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
+| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and profiles, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
 | Pipeline stages | `internal/stage` | Canonical stage registry, shared stage contract, execution dependencies, and implemented stage behavior. |
 | External boundaries | `internal/adapters`, `internal/audio` | WhisperX HTTP, downstream subprocesses, notification, object storage, and S3 audio materialization behind Narratio contracts. |
 | Manifests | `internal/manifest` | Durable session progress, stage transitions, validation, and atomic persistence. |
@@ -105,8 +105,8 @@ so any earlier replacement can stale a prior cleanup result.
 
 ## Focused Documentation
 
-- [Configuration Internals](configuration.md): pipeline composition, import
-  confinement, field ownership, decoding, and root-relative path semantics.
+- [Configuration Internals](configuration.md): pipeline imports and profiles,
+  field ownership, decoding, and root-relative path semantics.
 - [Adapter Internals](adapters.md): external adapter boundaries, composition,
   failure behavior, and test surfaces.
 - [Artifact Internals](artifacts.md): source identities, runtime catalog,