Document Audita v2 operator migration and examples

docs/integrations/audita.md

@@ -1,69 +1,54 @@
 # Integration: Audita
 
-## Purpose
-Define the Audita adapter contract used by the `polish` stage.
+Narratio invokes Audita v2's `process INPUT --glossary PATH --output PATH`
+subprocess for `polish`. The configured timeout and parent cancellation bound
+execution. Narratio passes explicit `--config`, `--overlay`,
+`--proposal-profile`, `--validation-profile`, `--transcript-description`,
+`--output-schema`, and `--modules` only when selected. An omitted module list
+leaves Audita's default sequence in place; `modules: []` passes an explicit
+empty argument and runs no correction modules. Order and repetitions are kept.
+Narratio passes no debug, work-directory, or reporting flags, leaving those
+choices to Audita's own configuration.
 
-## External Boundary
+Audita owns its ConfigKit file, backend and profile definitions, native config
+discovery, and their validation. Narratio does not create an Audita
+configuration or infer downstream overlay/profile names from its own selected
+pipeline overlay. An empty Narratio Audita selector adds no CLI override.
+The [configuration reference](../config.md#audita-selection-and-credentials)
+owns Narratio's fields and defaults. Audita's
+[v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+owns its downstream file format.
 
-Narratio invokes `audita process` as a subprocess for each polish operation.
-The configured timeout and parent cancellation bound the invocation. Internal
-runner composition is documented in
-[the adapter implementation guide](../internal/adapters.md).
+Each name in `pipeline.audita.credentials` is a ConfigKit secret reference
+resolved when Narratio loads the pipeline. Narratio forwards only the selected
+names and their captured, nonempty values under those exact names, in the
+minimal child environment; it never maps them to a fixed alias or rereads the
+parent environment. Every name is registered for captured stdout/stderr and
+failure-diagnostic redaction. Audita resolves credentials for all configured
+backends, including unselected ones, so operators must list every backend
+credential that its selected configuration needs. The downstream files and
+provider output remain Audita's responsibility, outside Narratio's
+captured-stream redaction boundary.
 
-## Request Contract
-`PolishRequest` carries:
-- required transcript/glossary/output/work-dir paths;
-- optional report path (required when report mode is enabled);
-- generated config and stdout/stderr log paths;
-- optional per-invocation module override.
+The corrected transcript is the only canonical polish output. A successful
+invocation must produce a valid JSON transcript with a top-level `segments`
+array within Narratio's 64 MiB bound. Exit zero is accepted even if Audita's
+ordinary reports describe recoverable model errors or no corrections. Narratio
+does not parse report status, counts, or Markdown. It discovers only
+`errors.yml`, `recoveries.yml`, and `report.md` next to the requested output,
+each subject to a 16 MiB read bound. Missing reports are allowed, for example
+when Audita reporting is disabled externally. Available reports are diagnostic
+references, not canonical artifact outputs. See Audita's
+[ordinary output contract](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/integrations/output-files.md)
+for their schemas, and [operations](../operations.md) for placement and
+publication.
 
-The constructed runner owns static Audita settings: binary, timeout,
-credentials, default modules, model and endpoint settings, validation and output
-settings, report mode, and concurrency. The `polish` stage supplies only
-invocation-specific paths and may override modules for that invocation.
+On nonzero exit, Narratio preserves the original subprocess error and
+available run-local evidence; it never promotes a transcript merely because
+the file exists. The adapter returns safe paths, exit details, and selection
+metadata on failure. Narratio's `audita.generated.v2` YAML records the
+invocation, including arguments, paths, and credential names but never values;
+it is a diagnostic record, not a generated Audita config file.
 
-## Result Contract
-`PolishResult` returns:
-- processed transcript path;
-- optional report path;
-- work dir and generated-config/log paths;
-- exit code, duration, binary provenance;
-- adapter metadata map.
-
-## Validation and Failure Semantics
-Construction fails for invalid static config values, including:
-- empty binary;
-- non-positive timeout;
-- invalid base URL;
-- invalid output schema;
-- invalid work-dir retention value;
-- invalid concurrency values.
-
-Run fails for:
-- missing required request paths;
-- subprocess execution failure;
-- invalid processed transcript JSON (`segments` array required);
-- invalid report JSON when reporting is enabled.
-
-Processed transcript JSON is limited to 64 MiB and optional report JSON to 16
-MiB. Both must be regular files without symlinked path components.
-
-Failure results still include output/log/config/exit metadata for diagnostics.
-
-## Deterministic Behavior
-- CLI args are built from runner config + request in a fixed order.
-- A configured typed `llm_api_key` reference is resolved during pipeline load;
-  the captured value is supplied only as the child's `AUDITA_LLM_API_KEY`
-  override and is never re-read from the parent environment.
-- Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
-- Manifest writes are stage-owned; adapter itself is stateless.
-
-## Configuration
-
-Operator-selected values are defined under `pipeline.audita.*` in the
-[configuration reference](../config.md#pipeline).
-
-Maintained example with Audita config:
-
-- [Full annotated pipeline](../../examples/pipeline.full.annotated.yml)
-- [Production-shaped pipeline](../../examples/pipeline.production.yml)
+Maintained Narratio examples: [full annotated pipeline](../../examples/pipeline.full.annotated.yml)
+and [production-shaped pipeline](../../examples/pipeline.production.yml).