Bootstrap secrets before configuration loading

docs/cli.md

@@ -45,6 +45,7 @@ Most session-aware commands accept:
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
 - `--profile <name>`
+- `--secrets-dir <directory>`
 
 Rules:
 
@@ -57,6 +58,9 @@ Rules:
   may be supplied once; omitted, empty, and the exact name `default` select the
   base configuration, while an unknown named profile fails. The same selection
   applies to all common-flag commands, including `regenerate-artifacts`.
+- `--secrets-dir` selects ConfigKit credential-file bootstrap explicitly. A
+  relative value uses caller CWD. Without the flag, a present `secrets/`
+  directory beside the resolved root pipeline is used; an absent one is skipped.
 - `clean --all` cannot be combined with campaign/session selectors.
 - notification delivery is currently limited to the configured `noop` mode; see
   the [configuration reference](./config.md#notifications).
@@ -81,16 +85,18 @@ Commands with additional positionals keep their command-specific order:
 ### `config validate`, `config show`, `config sources`, and `config diff`
 
 ```bash
-narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
-narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
-narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>]
-narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>]
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
+narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
 ```
 
 These commands resolve the selected profile, defaults, ordinary paths, and—if
 a campaign is selected—the campaign-owned party. They neither discover or load
-a session nor create a workspace, manifest, run, lock, adapter, remote
-connection, or credential environment.
+a session nor create a workspace, manifest, run, lock, adapter, or remote
+connection. Like every pipeline-loading command, they bootstrap the selected or
+conventional secrets directory before resolving configuration; `config show`
+never includes bootstrap reports or secret values in its YAML output.
 
 Campaign selection is optional for a pipeline without party-driven artifact
 families. A pipeline with `scriptorium.artifact_families` needs a selected or
@@ -320,6 +326,7 @@ Options:
 
 - `--config <pipeline.yml>`
 - `--campaign <id>` or `--campaign-file <campaign.yml>`
+- `--secrets-dir <directory>`
 - `--previous-session-id <id>`
 - `--date <YYYY-MM-DD>`
 - `--title <text>`

docs/config.md

@@ -216,14 +216,21 @@ inputs:
 
 - Do not place raw secrets in YAML.
 - Use env var names in config (for example `pipeline.audita.llm_api_key_env`).
-- Optionally load credential files from `pipeline.secrets.env_dir`. Each valid
-  environment-variable filename supplies one value; trailing CR/LF is removed.
+- Every command that loads a pipeline accepts `--secrets-dir <path>`. When the
+  flag is omitted, Narratio uses a present `secrets/` directory beside the
+  resolved root `pipeline.yml`; an absent conventional directory is ignored.
+  Explicit relative paths are resolved from the caller's working directory,
+  and a missing or empty explicit selection is an error.
+- Each immediate regular file whose name is a valid environment-variable name
+  supplies one value. ConfigKit removes trailing CR/LF, permits a symlink as the
+  selected directory, rejects symlink entries, and limits input to 1 MiB per
+  file, 8 MiB total, and 1024 entries.
 - An existing process environment value takes precedence over a credential file.
-- Credential directories and files must not be symlinks and must be regular,
-  bounded files (at most 8 KiB per value). On POSIX, provision the directory
-  with no group/other access (normally `0700`) and files with no group/other
-  access (normally `0600`).
-- Commands that need storage/auth load filesystem secrets before constructing adapters.
+- On POSIX, operators must provision the directory with no group/other access
+  (normally `0700`) and files with no group/other access (normally `0600`);
+  ConfigKit validates type and bounds but does not enforce permission modes.
+- Bootstrap happens once per command, before any configuration load or adapter
+  construction. Safe reports contain filenames, paths, and statuses, never values.
 
 ## Publish Configuration Summary
 
@@ -270,7 +277,6 @@ Rules:
 | `pipeline.workspace.cleanup_after_publish` | bool | No | `false`; selects the published run's workspace target for final cleanup and requires effective `pipeline.publish.enabled=true` and `pipeline.publish.upload_run=true` |
 | `pipeline.campaigns.root` | string | No | `/usr/local/share/narratio/campaigns` |
 | `pipeline.campaigns.default_campaign_id` | string | No | empty |
-| `pipeline.secrets.env_dir` | string | No | empty |
 | `pipeline.storage.backend` | string | No | `local`; supported values are `local` and `s3` (case-insensitive) |
 | `pipeline.storage.s3.bucket` | string | Conditional | required when backend is `s3` and S3 session-audio or publish upload is enabled |
 | `pipeline.storage.s3.root_prefix` | string | No | `dnd` |

docs/operations.md

@@ -554,7 +554,17 @@ API keys are credentials, not ordinary workspace data. Store them outside the
 shared workspace or in a separately restricted credential location; ordinary
 workspace group access must never be treated as authorization to read keys.
 Provision a credential directory as `0700` and credential files as `0600`;
-Narratio rejects group- or other-readable configured credential paths.
+these permission modes are an operator requirement and are not enforced by
+ConfigKit.
+
+Every pipeline-loading command bootstraps credentials once, before the first
+configuration load and before any adapter is constructed. `--secrets-dir`
+selects an explicit directory (relative paths use caller CWD). Otherwise a
+present `secrets/` beside the resolved root pipeline is used, while an absent
+conventional directory is skipped. Explicit missing/empty selections and
+invalid existing directories fail the command. ConfigKit follows a symlink used
+as the selected directory, but immediate entries must be regular non-symlink
+files. Existing environment variables—including empty values—always win.
 
 External adapter results are individually bounded before Narratio validates or
 materializes them. These per-file limits do not reserve disk space: prevent hard
@@ -617,4 +627,5 @@ normal migration path.
 - Publish requires prerequisite stages through `render` and `analyze` to be succeeded.
 - Markdown publish defaults require render outputs (`transcripts/final.md` and `transcripts/final.trimmed.md`).
 - Restore requires configured object storage and committed remote current state.
-- Storage-backed commands load filesystem secrets before object-store initialization.
+- Pipeline-loading commands bootstrap filesystem secrets once before configuration
+  resolution and object-store initialization.

docs/policy/architecture.md

@@ -247,10 +247,13 @@ uses a separate restrictive contract.
 
 Raw secrets must not be stored in pipeline, campaign, or session YAML or written
 to manifests, logs, generated configuration, reports, publish metadata,
-documentation, or examples. Secrets enter through configured environment
-variable names or secret-file references. Diagnostics should avoid transcript
-and prompt content unless a deliberate, bounded inspection mechanism requires
-it.
+documentation, or examples. Pipeline configuration names environment variables;
+command-owned startup may populate previously unset variables from ConfigKit's
+explicit or conventional secrets directory. This bootstrap occurs once per
+invocation before any typed configuration load or adapter construction and is
+not hidden inside library loaders. Safe bootstrap diagnostics may identify
+files and statuses but never values. Diagnostics should avoid transcript and
+prompt content unless a deliberate, bounded inspection mechanism requires it.
 
 Logs, reports, generated invocation files, generated configuration, and render
 debug files are diagnostics, not canonical pipeline products. They should be

docs/roadmap/implementation.md

@@ -282,7 +282,10 @@ prepare/extract, and application loading tests pass.
 
 ## Stage 6 — Move secrets bootstrap before all configuration loads
 
-Status: Pending
+Status: Complete — Added invocation-scoped ConfigKit secrets bootstrap before
+all pipeline loads and adapter construction, exposed consistent explicit and
+conventional directory selection across the CLI, removed the retired pipeline
+schema and custom loader, and verified focused, full, and race test suites.
 
 Read: roadmap “Credential and Secrets Convention”; ConfigKit's bootstrap
 contract; `internal/app/secrets_env*.go`, `config_loader.go`, `config_commands.go`,

docs/troubleshooting.md

@@ -717,7 +717,8 @@ Symptom:
 
 Likely causes:
 
-- invalid `pipeline.secrets.env_dir`;
+- missing, unreadable, or invalid explicit `--secrets-dir`;
+- invalid entries in the conventional `secrets/` directory beside the root pipeline;
 - missing credential environment variables;
 - invalid S3 endpoint/bucket settings.
 
@@ -730,7 +731,7 @@ env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
 
 Safe fix:
 
-- correct secret-file path and permissions;
+- correct `--secrets-dir`, secret-file type/name, and operator-managed permissions;
 - provide required env vars;
 - keep secret values out of YAML.