Forward Notarius credentials securely

docs/roadmap/implementation.md

@@ -109,7 +109,24 @@ Acceptance:
 
 ## Stage 2 — Deliver the selected credential and register redaction
 
-Status: Not started
+Status: Complete — 2026-09-16
+
+Completion: Extended the typed Notarius request boundary with the resolved
+credential reference, passed it from extraction, and taught the subprocess
+adapter to reject invalid programmatic references before launch. The adapter
+now forwards exactly the configured name and loaded value through the minimal
+child environment and registers the custom name for streaming redaction.
+Focused coverage verifies nil and invalid references, unchanged arguments,
+load-time value capture, exact-name delivery, unrelated-parent exclusion, and
+stdout/stderr redaction for successful receipts and process failures without
+putting credentials in stage metadata.
+
+Checks:
+
+- `GOWORK=off go test ./internal/adapters/notarius ./internal/adapters/subprocess ./internal/stage` — pass.
+- `GOWORK=off go test -race ./internal/adapters/notarius ./internal/stage` — pass.
+- `GOWORK=off go test ./...` — pass.
+- `git diff --check` — pass.
 
 Read: `internal/adapters/notarius/runner.go`, `subprocess.go`, `fake.go`,
 `subprocess_test.go`; `internal/adapters/subprocess/run.go`,