Add archive promotion locks

docs/cli.md

@@ -6,7 +6,7 @@
 narratio run --session-id 2026-04-04
 ```
 
-This command uses default discovery for `pipeline.yml` and `session.yml`; both files must be discoverable unless you pass explicit `--config` and `--session` paths.
+This command uses default discovery for `pipeline.yml`, `campaign.yml`, and local `session.yml`. If local session discovery misses and S3 storage is configured, `--session-id` can load remote `session.yml` from the canonical session prefix.
 
 ## Command Overview
 
@@ -28,6 +28,7 @@ For config semantics, see [docs/config.md](./config.md). For operator lifecycle
 ### `run`
 
 - `--config <path>`: optional explicit `pipeline.yml` path.
+- `--campaign <path>`: optional explicit `campaign.yml` path.
 - `--session <path>`: optional explicit `session.yml` path.
 - `--session-id <value>`: session template variable value.
 - `--previous-session-id <value>`: previous-session template variable value.
@@ -37,6 +38,7 @@ For config semantics, see [docs/config.md](./config.md). For operator lifecycle
 ### `plan`
 
 - `--config <path>`
+- `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
@@ -45,6 +47,7 @@ For config semantics, see [docs/config.md](./config.md). For operator lifecycle
 ### `resume`
 
 - `--config <path>`
+- `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
@@ -54,6 +57,7 @@ For config semantics, see [docs/config.md](./config.md). For operator lifecycle
 ### `run-stage`
 
 - `--config <path>`
+- `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
@@ -76,6 +80,7 @@ Valid stage names:
 ### `restore`
 
 - `--config <path>`
+- `--campaign <path>`
 - `--session <path>`
 - `--session-id <value>`
 - `--previous-session-id <value>`
@@ -97,14 +102,15 @@ Purpose:
 Syntax:
 
 ```bash
-narratio run [--config <pipeline.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
+narratio run [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
 ```
 
 Success output:
 - `narratio run: session <session_id>; executed=<n> skipped=<n>; manifest=<path>`
 
 Common failure cases:
-- missing default config/session paths when flags omitted.
+- missing default config/campaign/session paths when flags omitted.
+- missing local session plus missing/unavailable remote `session.yml`.
 - invalid template/rendered session mismatch.
 - unknown/invalid `--artifacts` value.
 - `--artifacts` with unknown configured artifact key.
@@ -117,7 +123,7 @@ Purpose:
 Syntax:
 
 ```bash
-narratio plan [--config <pipeline.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force]
+narratio plan [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force]
 ```
 
 Success output includes:
@@ -126,7 +132,8 @@ Success output includes:
 - `totals: run=<n> skip=<n>`
 
 Common failure cases:
-- same config/session discovery and validation failures as `run`.
+- same config/campaign/session discovery and validation failures as `run`.
+- remote session fallback failures when local session discovery misses.
 - secrets directory read failures when `pipeline.secrets.env_dir` is configured.
 
 ### `resume`
@@ -137,7 +144,7 @@ Purpose:
 Syntax:
 
 ```bash
-narratio resume [--config <pipeline.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
+narratio resume [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>]
 ```
 
 Success output:
@@ -177,7 +184,7 @@ Purpose:
 Syntax:
 
 ```bash
-narratio run-stage [--config <pipeline.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>] <stage>
+narratio run-stage [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--force] [--artifacts <name[,name...]>] <stage>
 ```
 
 Success output:
@@ -201,7 +208,7 @@ Purpose:
 Syntax:
 
 ```bash
-narratio restore [--config <pipeline.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--dry-run] [--force] [--include-audio]
+narratio restore [--config <pipeline.yml>] [--campaign <campaign.yml>] [--session <session.yml>] [--session-id <id>] [--previous-session-id <id>] [--dry-run] [--force] [--include-audio]
 ```
 
 Success output (dry-run):

docs/config.md

@@ -2,12 +2,13 @@
 
 ## 1. Overview
 
-Narratio loads two YAML files:
+Narratio loads three YAML files:
 
 - `pipeline.yml`: pipeline-level runtime configuration.
-- `session.yml`: per-session metadata and input selection.
+- `campaign.yml`: stable campaign identity and campaign-level input defaults.
+- `session.yml`: per-session metadata and input selection, loaded locally or from the configured S3 backend.
 
-These commands load and validate both files before running:
+These commands load and validate all three files before running:
 
 - `narratio run`
 - `narratio plan`
@@ -19,7 +20,10 @@ Behavior:
 
 - strict YAML decode is enabled (`KnownFields(true)`): unknown fields fail.
 - session templates render before session YAML decode.
+- remote `session.yml` uses the same strict decode and template behavior as local `session.yml`.
 - defaults are applied for optional pipeline fields.
+- campaign-level stable input paths fill missing session input paths.
+- session-level stable input paths override campaign-level input paths.
 - validation enforces required fields, value formats, and cross-field constraints.
 
 ## 2. Config file discovery
@@ -32,16 +36,28 @@ Pipeline config lookup for `run`, `plan`, `resume`, `run-stage`, and `restore`:
   2. `/etc/narratio/pipeline.yml`
 - first existing file wins.
 
+Campaign config lookup for `run`, `plan`, `resume`, `run-stage`, and `restore`:
+
+- if `--campaign <path>` is provided, that path is used.
+- if omitted, Narratio searches in order:
+  1. `./campaign.yml`
+  2. `/usr/local/etc/narratio/campaign.yml`
+  3. `/etc/narratio/campaign.yml`
+- first existing file wins.
+
 ## 3. Session file discovery and templating
 
 Session config lookup for `run`, `plan`, `resume`, `run-stage`, and `restore`:
 
 - if `--session <path>` is provided, that path is used.
-- if omitted, Narratio searches in order:
+- if `--session` is omitted, Narratio searches locally in order:
   1. `./session.yml`
   2. `/usr/local/etc/narratio/session.yml`
   3. `/etc/narratio/session.yml`
-- first existing file wins.
+- first existing local file wins.
+- if no local session file is found, `--session-id <value>` is present, storage is configured, and campaign identity is resolved, Narratio loads remote `session.yml` from:
+  - `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`
+- local discovery always runs before remote fallback.
 
 Template behavior:
 
@@ -71,20 +87,28 @@ Why this is sufficient:
 
 ## 5. Minimal session template
 
+`campaign.yml`:
+
 ```yaml
-session_id: "{{ session_id }}"
 campaign: sample-campaign
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+```
+
+`session.yml`:
+
+```yaml
+session_id: "{{ session_id }}"
 inputs:
   audio_dir: ./audio
-  speakers_file: ./examples/speakers.yml
-  autocorrect_file: ./examples/autocorrect.yml
-  glossary_file: ./examples/glossary.yml
 ```
 
 Usage:
 
 ```bash
-narratio run --config /path/to/pipeline.yml --session ./session.yml --session-id 2026-05-03
+narratio run --config /path/to/pipeline.yml --campaign ./campaign.yml --session ./session.yml --session-id 2026-05-03
 ```
 
 Previous-session-enabled variant:
@@ -92,16 +116,12 @@ Previous-session-enabled variant:
 ```yaml
 session_id: "{{ session_id }}"
 previous_session_id: "{{ previous_session_id }}"
-campaign: sample-campaign
 inputs:
   audio_dir: ./audio
-  speakers_file: ./examples/speakers.yml
-  autocorrect_file: ./examples/autocorrect.yml
-  glossary_file: ./examples/glossary.yml
 ```
 
 ```bash
-narratio run --config /path/to/pipeline.yml --session ./session.yml --session-id 2026-05-03 --previous-session-id 2026-04-26
+narratio run --config /path/to/pipeline.yml --campaign ./campaign.yml --session ./session.yml --session-id 2026-05-03 --previous-session-id 2026-04-26
 ```
 
 ## 6. Production-oriented config
@@ -134,6 +154,9 @@ archive:
     - source: narratio.artifact.session_recap
       dest: artifacts/session_recap.md
       required: true
+  locks:
+    - source: narratio.artifact.session_recap
+      reason: Final recap was manually edited.
 
 whisperx:
   transcribe_url: "https://transcription.example.com/transcribe"
@@ -157,8 +180,9 @@ Operational notes:
 
 - archive promotion is explicit and source-based via `archive.promote_artifacts`.
 - `source` is required; `dest` is optional and derived when omitted.
+- `archive.locks` skips top-level promotion overwrites for locked sources while preserving run-local uploads.
 - Narratio does not auto-promote all generated analyze artifacts.
-- `restore` reads the same config/session inputs and restore scope is bounded by committed archive current state.
+- `restore` reads the same config/campaign/session inputs and restore scope is bounded by committed archive current state.
 
 ## 7. Full pipeline reference
 
@@ -185,6 +209,9 @@ Operational notes:
 | `pipeline.archive.promote_artifacts[].source` | string | Yes (per rule) | none |
 | `pipeline.archive.promote_artifacts[].dest` | string | No | derived from source |
 | `pipeline.archive.promote_artifacts[].required` | bool | No | `true` |
+| `pipeline.archive.locks[]` | list | No | empty |
+| `pipeline.archive.locks[].source` | string | Yes (per lock) | none |
+| `pipeline.archive.locks[].reason` | string | No | empty |
 | `pipeline.whisperx.transcribe_url` | string | Yes | none |
 | `pipeline.whisperx.language` | string | No | `en` |
 | `pipeline.whisperx.timeout` | duration string | No | `30m` |
@@ -285,6 +312,8 @@ Allowed `pipeline.scriptorium.artifacts.<name>.inputs.<key>.source` values:
 - `narratio.bounds.session`
 - `narratio.artifact.<configured_artifact_key>`
 
+`pipeline.archive.locks[].source` accepts the same source values as `pipeline.archive.promote_artifacts[].source`.
+
 Archive promotion destination rules:
 
 - `dest` must be a clean relative path (not absolute, no traversal).
@@ -294,26 +323,47 @@ Archive promotion destination rules:
   - configured sources derive from `pipeline.scriptorium.artifacts.<name>.output_path`;
   - derivation failure is a config validation error.
 
+Archive lock rules:
+
+- locks are source-based and do not accept `dest`.
+- duplicate lock sources are rejected.
+- locked promotions are recorded as intentional skips in archive metadata.
+- locked required promotions do not fail archive by default.
+- ordinary `--force` reruns do not override locks.
+
 Restore-related implications:
 
 - restore remote identity requires archive S3 identity to resolve (`pipeline.storage.s3.bucket` and session prefix derivation inputs).
 - restore scope considers committed current state and durable paths (`manifest.json`, `transcripts/**`, `artifacts/**`, `previous/**`, optional `audio/**`).
 
-## 8. Full session reference
+## 8. Full campaign reference
+
+| Path | Type | Required | Default |
+| --- | --- | --- | --- |
+| `campaign.campaign` | string | Yes | none |
+| `campaign.inputs.speakers_file` | string | Yes | none |
+| `campaign.inputs.autocorrect_file` | string | Yes | none |
+| `campaign.inputs.glossary_file` | string | Yes | none |
+
+Campaign input paths may be absolute or relative. Relative paths resolve from the directory containing `campaign.yml`.
+
+## 9. Full session reference
 
 | Path | Type | Required | Default |
 | --- | --- | --- | --- |
 | `session.session_id` | string | Yes | none |
 | `session.previous_session_id` | string | No | empty |
-| `session.campaign` | string | Yes | none |
+| `session.campaign` | string | No | `campaign.campaign` |
 | `session.date` | string | No | empty |
 | `session.title` | string | No | empty |
 | `session.inputs.audio_dir` | string | Conditional | empty |
 | `session.inputs.audio_files[]` | list[string] | Conditional | empty |
 | `session.inputs.audio_s3.prefix` | string | Conditional | none |
-| `session.inputs.speakers_file` | string | Yes | none |
+| `session.inputs.speakers_file` | string | No | `campaign.inputs.speakers_file` |
-| `session.inputs.autocorrect_file` | string | Yes | none |
+| `session.inputs.autocorrect_file` | string | No | `campaign.inputs.autocorrect_file` |
-| `session.inputs.glossary_file` | string | Yes | none |
+| `session.inputs.glossary_file` | string | No | `campaign.inputs.glossary_file` |
+
+Session input paths may be absolute or relative. Relative audio paths and session-level stable input overrides resolve from the directory containing `session.yml`. If both `campaign.yml` and `session.yml` specify campaign identity, the values must match.
 
 Audio-source rule:
 
@@ -328,7 +378,7 @@ Previous-session rule:
 - if `session.previous_session_id` is set, it must not equal `session.session_id`.
 - canonical previous-session sources (`narratio.previous_session.artifact.<name>`) are hydrated during `prepare` from archive current state when required by enabled configured artifacts.
 
-## 9. Secrets
+## 10. Secrets
 
 Narratio supports filesystem-based secret injection via `pipeline.secrets.env_dir`.
 
@@ -347,13 +397,14 @@ Guidance:
 - do not put secret values directly in YAML.
 - configure env var names in config and provide values via env/secrets files.
 
-## 10. Examples
+## 11. Examples
 
 Maintained examples:
 
 - `examples/pipeline.minimal.yml`
 - `examples/pipeline.production.yml`
 - `examples/pipeline.full.annotated.yml`
+- `examples/campaign.yml`
 - `examples/session.template.yml`
 - `examples/session.local-audio.yml`
 - `examples/session.s3-audio.yml`

docs/internal/artifacts.md

@@ -16,6 +16,7 @@ Outputs:
 - resolved artifact path + provenance (`ResolvedSessionArtifact`);
 - runtime catalog entries for built-ins and configured artifacts;
 - requirement sets for canonical previous-session inputs.
+- canonical S3 session, run, current, session config, audio, and promoted artifact keys.
 
 ## Boundaries
 Owns:
@@ -43,6 +44,14 @@ Does not own:
 - configured artifact: `narratio.artifact.<artifact_key>`
 - canonical previous-session artifact: `narratio.previous_session.artifact.<artifact_key>`
 
+## S3 key helpers
+- session prefix: `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/`
+- session config: `{session_prefix}/session.yml`
+- run prefix: `{session_prefix}/runs/{run_id}/`
+- audio prefix: `{session_prefix}/{session.inputs.audio_s3.prefix}`
+- current manifest: `{session_prefix}/current/manifest.json`
+- current run pointer: `{session_prefix}/current/run_id.txt`
+
 ## Runtime catalog model
 Catalog entries track:
 - `planned`: source is registered for this run;

docs/internal/stage-archive.md

@@ -8,6 +8,7 @@ Inputs:
 - session manifest and prerequisite stage records
 - run root contents under `runs/{run_id}/`
 - promotion rules with artifact `source` IDs and archive `dest` paths (`archive.promote_artifacts`)
+- source-based promotion locks (`archive.locks`)
 - session-level `previous/**` cache files when present
 
 Outputs:
@@ -23,6 +24,7 @@ Owns:
 - Prerequisite stage success enforcement
 - Run file collection and upload (excluding `audio/`)
 - Promotion rule resolution and upload
+- Promotion lock enforcement
 - Session previous-cache file collection/upload
 - Commit pointer publish order
 
@@ -34,6 +36,7 @@ Does not own:
 - `pipeline.archive.enabled`
 - `pipeline.archive.upload_run`
 - `pipeline.archive.promote_artifacts`
+- `pipeline.archive.locks`
 - `pipeline.storage.s3.bucket`
 - `pipeline.storage.s3.root_prefix`
 - `pipeline.workspace.root`
@@ -47,9 +50,11 @@ Does not own:
 - Requires `prepare`, `transcribe`, `merge`, `polish`, `normalize`, `trim`, and `analyze` status `succeeded`.
 - Resolves bucket/prefix from manifest identity first, then config fallback.
 - Uploads session `previous/**` files as durable session state when the local `previous/` directory exists.
+- Skips top-level promotion uploads for sources listed in `pipeline.archive.locks`; run-local uploads still publish.
 - Writes metadata including:
   - upload counts/paths
   - `previous_files_uploaded` and `previous_uploaded_paths`
+  - `locked_promotion_count` and `locked_promotions`
   - `current_manifest_key`
   - `current_run_id_key`
   - `current_pointer_written`
@@ -60,7 +65,8 @@ Does not own:
 - Runner-level skip also applies for previously succeeded stage unless forced.
 
 ## Failure Behavior
-- Fails on missing prerequisite success, missing object store when required, missing run root, missing required promotion source, upload failures, or pointer write failures.
+- Fails on missing prerequisite success, missing object store when required, missing run root, missing unlocked required promotion source, upload failures, or pointer write failures.
+- Locked required promotions are intentional skips and do not fail archive.
 - Pointer semantics are fail-safe: `current/run_id.txt` is not written if prior required uploads fail.
 
 ## Tests to Inspect Before Changing
@@ -70,5 +76,6 @@ Does not own:
 ## Architectural Invariants
 - Run upload excludes `audio/` subtree.
 - Session `previous/**` is archiveable durable input/provenance state, not run-local output.
+- Ordinary `--force` does not override archive locks.
 - `current/manifest.json` uploads before `current/run_id.txt`.
 - `current/run_id.txt` is the remote publish commit marker.

docs/internal/stage-prepare.md

@@ -10,8 +10,9 @@ Prepare owns:
 
 ## Inputs and outputs
 Inputs:
-- resolved config/session (`pipeline.yml`, `session.yml`);
+- resolved config/campaign/session (`pipeline.yml`, `campaign.yml`, `session.yml`);
-- session-local input files (`speakers`, `autocorrect`, `glossary`);
+- remote session provenance when `session.yml` was loaded from S3;
+- campaign or session input files (`speakers`, `autocorrect`, `glossary`);
 - audio source:
   - local: `session.inputs.audio_dir` or `session.inputs.audio_files`;
   - S3: `session.inputs.audio_s3.prefix`;
@@ -19,6 +20,7 @@ Inputs:
 - remote previous-session current archive state when previous hydration is required.
 
 Outputs:
+- `inputs/campaign.yml`;
 - `inputs/session.yml`;
 - `inputs/pipeline.resolved.yml`;
 - `inputs/speakers.yml`;
@@ -58,6 +60,10 @@ Does not own:
 - `pipeline.scriptorium.artifacts.<name>.enabled`
 - `pipeline.scriptorium.artifacts.<name>.inputs.<key>.source`
 - `pipeline.scriptorium.artifacts.<name>.inputs.<key>.required`
+- `campaign.campaign`
+- `campaign.inputs.speakers_file`
+- `campaign.inputs.autocorrect_file`
+- `campaign.inputs.glossary_file`
 
 ## External adapters used
 - `storage.ObjectStore` for:
@@ -67,6 +73,9 @@ Does not own:
 ## State and manifest behavior
 - Ensures workspace layout exists.
 - Materializes canonical input files and audio files.
+- Records `inputs/session.yml` provenance as local `session_config` or remote `session_config.s3`.
+- Resolves campaign-provided stable input paths relative to `campaign.yml`.
+- Resolves session-provided stable input overrides relative to `session.yml`.
 - Scans enabled configured artifact inputs for canonical sources:
   - `narratio.previous_session.artifact.<artifact_key>`
 - If one or more canonical previous-session requirements exist:

docs/internal/storage.md

@@ -6,7 +6,7 @@ Document Narratio's remote storage backend contracts and implementations under `
 ## Inputs and outputs
 Inputs:
 - Resolved storage config (`pipeline.storage.*`).
-- Bucket-relative object keys and local file paths from stage/app orchestration.
+- Bucket-relative object keys and local file paths from app/stage orchestration.
 
 Outputs:
 - Listed/downloaded/uploaded object metadata (`ObjectInfo`).
@@ -57,6 +57,7 @@ Implementations:
 - `S3Backend` constructor fails when required bucket is missing or AWS client setup fails.
 - CRUD operations return contextual errors (including not-found behavior via `Exists`).
 - Key normalization is applied before operations (`\\` to `/`, leading slash trimmed).
+- Remote session loading uses `List` to find the exact `session.yml` key and `Download` to materialize it to a local temp file.
 
 ## Tests to inspect before changing
 - `internal/adapters/storage/factory_test.go`

docs/operations.md

@@ -6,19 +6,21 @@ For field-level configuration, see [docs/config.md](./config.md). For full comma
 
 ## Normal workflow (S3-first path)
 
-1. Upload session `.flac` files to object storage under the configured session audio prefix.
+1. Upload `session.yml` to the configured session prefix, or keep a local `session.yml` available.
-2. Run Narratio:
+2. Upload session `.flac` files to object storage under the configured session audio prefix.
+3. Run Narratio:
 
 ```bash
 narratio run --session-id 2026-04-04
 ```
 
-3. Read success output:
+4. Read success output:
 - `narratio run: session <session_id>; executed=<n> skipped=<n>; manifest=<path>`
 - use `manifest=<path>` with `status` for inspection.
 
 Notes:
-- default config/session discovery applies unless `--config` and `--session` are passed.
+- default config/campaign/session discovery applies unless `--config`, `--campaign`, and `--session` are passed.
+- when local `session.yml` discovery misses, `--session-id` loads remote `session.yml` from `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`.
 - S3 audio mode requires `session.inputs.audio_s3.prefix` and valid object-store access.
 
 ## Restore workflow
@@ -61,6 +63,7 @@ Primary state:
 - `manifest.json`: session-level stage state.
 - `runs/{run_id}/manifest.json`: invocation-level state.
 - `.lock`: session lock while a modifying command is active.
+- `inputs/campaign.yml`, `inputs/session.yml`, and `inputs/pipeline.resolved.yml`: materialized config inputs for the run.
 
 Canonical session directories:
 - `inputs/`
@@ -129,6 +132,8 @@ Archive promotion is explicit and source-based:
 - missing required promotion sources fail archive stage.
 - missing optional promotion sources are skipped.
 - invalid resolved artifacts fail archive stage.
+- `archive.locks` skips top-level promotion overwrites for locked sources while run-local uploads still publish.
+- locked required promotions are treated as intentional successful skips and are recorded in archive metadata.
 
 ## Resume, retry, restore, and safe rerun behavior
 
@@ -146,6 +151,7 @@ Restore conflict policy:
 
 Forced reruns:
 - force-rerunning an upstream succeeded stage marks downstream succeeded stages as `stale`.
+- ordinary `--force` does not override archive locks.
 
 Safe rerun pattern:
 1. rerun the changed stage with `--force`.

docs/roadmap/remote.md

@@ -2,13 +2,13 @@
 
 ## Purpose
 
-This roadmap describes planned, unimplemented work for three related feature areas:
+This roadmap tracks implementation work for three related feature areas:
 
 1. `campaign.yml` configuration for stable campaign-level inputs.
 2. Remote `session.yml` loading from the existing S3 object-store backend.
 3. Logical archive locks that prevent selected top-level transcript/artifact promotions from overwriting curated archive state while still preserving run-local outputs.
 
-Treat this document as an implementation plan, not as current behavior. Keep planned behavior under `docs/roadmap/` until each phase is implemented and canonical docs are updated.
+Treat future sections of this document as an implementation plan, not as current behavior. Keep planned behavior under `docs/roadmap/` until each item is implemented and canonical docs are updated.
 
 ## Current Code Facts
 
@@ -43,7 +43,7 @@ Implementation must preserve these constraints:
 - Keep raw secrets out of configs, manifests, logs, generated configs, archive metadata, and roadmap examples.
 - Update canonical user-facing docs only after behavior is implemented.
 
-## Phase 1: Add `campaign.yml`
+## Phase 1: Add `campaign.yml` (implemented)
 
 Add campaign-level configuration for stable campaign identity and stable input files. Do not add remote campaign loading in this phase.
 
@@ -116,7 +116,7 @@ Update `prepare` to materialize the resolved campaign/session inputs into canoni
 
 Continue recording deterministic `manifest.Inputs` records with checksums. If a prepared input came from `campaign.yml`, record source/provenance using the existing manifest input fields where practical; add narrow metadata only if the existing fields cannot describe it.
 
-## Phase 2: Load Remote `session.yml`
+## Phase 2: Load Remote `session.yml` (implemented)
 
 Support running with no local session file when a remote session file exists under the canonical session prefix.
 
@@ -169,13 +169,13 @@ When `prepare` materializes a remote session into `inputs/session.yml`, record t
 - local checksum;
 - downloaded temp/materialized path.
 
-## Phase 3: Add Logical Archive Locks
+## Phase 3: Add Logical Archive Locks (implemented)
 
-Add source-based archive locks under `pipeline.archive.locks`. The current promotion system is already source-based, so the first implementation must not support destination-based locks.
+Narratio supports source-based archive locks under `pipeline.archive.locks`. The promotion system is source-based; destination-based locks are not supported.
 
 ### Config Shape
 
-Add lock entries:
+Lock entries:
 
       archive:
         locks:
@@ -194,7 +194,7 @@ Validation rules:
 
 ### Archive Behavior
 
-Archive must continue uploading complete run-local outputs under `runs/{run_id}/`.
+Archive continues uploading complete run-local outputs under `runs/{run_id}/`.
 
 Promotion behavior:
 
@@ -205,11 +205,11 @@ Promotion behavior:
 5. Continue archive commit when all run-local uploads and all non-locked required promotions succeed.
 6. Upload `current/manifest.json` and `current/run_id.txt` in the existing order, with `current/run_id.txt` last.
 
-Ordinary `--force` must not override locks. Do not implement a lock-break override in this phase.
+Ordinary `--force` does not override locks. A lock-break override remains out of scope.
 
 ### Metadata
 
-Record locked promotion skips in archive metadata/reporting so operators can distinguish missing optional promotions from lock-protected promotions.
+Archive records locked promotion skips in archive metadata/reporting so operators can distinguish missing optional promotions from lock-protected promotions.
 
 Include:
 

examples/campaign.yml

@@ -0,0 +1,5 @@
+campaign: sample-campaign
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml

examples/session.local-audio.yml

@@ -1,9 +1,5 @@
 session_id: 2026-05-03
-campaign: sample-campaign
 date: 2026-05-03
 title: Sample Session
 inputs:
   audio_dir: ./audio
-  speakers_file: ./examples/speakers.yml
-  autocorrect_file: ./examples/autocorrect.yml
-  glossary_file: ./examples/glossary.yml

examples/session.s3-audio.yml

@@ -1,10 +1,6 @@
 session_id: 2026-05-03
-campaign: sample-campaign
 date: 2026-05-03
 title: Sample Session
 inputs:
   audio_s3:
     prefix: audio/
-  speakers_file: ./examples/speakers.yml
-  autocorrect_file: ./examples/autocorrect.yml
-  glossary_file: ./examples/glossary.yml

examples/session.template.yml

@@ -1,7 +1,3 @@
 session_id: "{{ session_id }}"
-campaign: sample-campaign
 inputs:
   audio_dir: ./audio
-  speakers_file: ./examples/speakers.yml
-  autocorrect_file: ./examples/autocorrect.yml
-  glossary_file: ./examples/glossary.yml

internal/adapters/storage/fake_test.go

@@ -56,7 +56,7 @@ func TestFakeBackendDownload(t *testing.T) {
 	fake.SeedObject(FakeObject{Key: "audio/a.flac", Data: []byte("audio-a")})
 
 	dst := filepath.Join(t.TempDir(), "nested", "a.flac")
-	if err := fake.Download(context.Background(), "audio/a.flac", dst); err != nil {
+	if err := fake.Download(context.Background(), `audio\a.flac`, dst); err != nil {
 		t.Fatalf("Download() error = %v", err)
 	}
 	data, err := os.ReadFile(dst)

internal/app/analyze_artifacts_commands_test.go

@@ -14,12 +14,12 @@ import (
 
 func TestExecuteRunStageArtifactsNonAnalyzeFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "--artifacts", "session_recap", "polish"},
+		[]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap", "polish"},
 		&stdout,
 		&stderr,
 	)
@@ -33,12 +33,12 @@ func TestExecuteRunStageArtifactsNonAnalyzeFails(t *testing.T) {
 
 func TestExecuteUnknownArtifactsFailValidation(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	code := Execute(
-		[]string{"run", "--config", pipelinePath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
+		[]string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "unknown_artifact"},
 		&stdout,
 		&stderr,
 	)
@@ -52,7 +52,7 @@ func TestExecuteUnknownArtifactsFailValidation(t *testing.T) {
 
 func TestRunStageArtifactsDoesNotImplyForce(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -65,7 +65,7 @@ func TestRunStageArtifactsDoesNotImplyForce(t *testing.T) {
 	var out bytes.Buffer
 	err := RunStage(
 		context.Background(),
-		[]string{"--config", pipelinePath, "--session", sessionPath, "--artifacts", "session_recap,session_recap", "analyze"},
+		[]string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap,session_recap", "analyze"},
 		&out,
 	)
 	if err != nil {
@@ -78,7 +78,7 @@ func TestRunStageArtifactsDoesNotImplyForce(t *testing.T) {
 
 func TestResumeArtifactsWithSucceededAnalyzeSkipsUnlessForced(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -93,7 +93,7 @@ func TestResumeArtifactsWithSucceededAnalyzeSkipsUnlessForced(t *testing.T) {
 	var out bytes.Buffer
 	err := Resume(
 		context.Background(),
-		[]string{"--config", pipelinePath, "--session", sessionPath, "--artifacts", "session_recap"},
+		[]string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--artifacts", "session_recap"},
 		&out,
 	)
 	if err != nil {
@@ -104,10 +104,10 @@ func TestResumeArtifactsWithSucceededAnalyzeSkipsUnlessForced(t *testing.T) {
 	}
 }
 
-func writeValidConfigFilesWithScriptoriumArtifacts(t *testing.T, workspaceRoot string) (string, string) {
+func writeValidConfigFilesWithScriptoriumArtifacts(t *testing.T, workspaceRoot string) (string, string, string) {
 	t.Helper()
 
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	f, err := os.OpenFile(pipelinePath, os.O_APPEND|os.O_WRONLY, 0)
 	if err != nil {
 		t.Fatalf("open pipeline config for append: %v", err)
@@ -136,5 +136,5 @@ scriptorium:
 	if _, err := f.WriteString(extra); err != nil {
 		t.Fatalf("append scriptorium config: %v", err)
 	}
-	return pipelinePath, sessionPath
+	return pipelinePath, campaignPath, sessionPath
 }

internal/app/campaign_config_path.go

@@ -0,0 +1,49 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/config"
+)
+
+func resolveCampaignConfigPath(flagValue string) (string, error) {
+	return resolveCampaignConfigPathWithCandidates(flagValue, config.DefaultCampaignConfigSearchPaths)
+}
+
+func resolveCampaignConfigPathWithCandidates(flagValue string, candidates []string) (string, error) {
+	if explicit := strings.TrimSpace(flagValue); explicit != "" {
+		return explicit, nil
+	}
+
+	ordered := make([]string, 0, len(candidates))
+	for _, raw := range candidates {
+		path := strings.TrimSpace(raw)
+		if path == "" {
+			continue
+		}
+		ordered = append(ordered, path)
+		info, err := os.Stat(path)
+		if err == nil {
+			if info.IsDir() {
+				continue
+			}
+			return filepath.Clean(path), nil
+		}
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		return "", fmt.Errorf("check default campaign config %q: %w", path, err)
+	}
+
+	if len(ordered) == 0 {
+		return "", fmt.Errorf("no campaign config path provided and no default locations configured")
+	}
+	return "", fmt.Errorf(
+		"no campaign config path provided and no default campaign config found; searched: %s; pass --campaign to use an explicit path",
+		strings.Join(ordered, ", "),
+	)
+}

internal/app/campaign_config_path_test.go

@@ -0,0 +1,49 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestResolveCampaignConfigPathExplicitWins(t *testing.T) {
+	explicit := filepath.Join(t.TempDir(), "custom-campaign.yml")
+	got, err := resolveCampaignConfigPathWithCandidates(explicit, []string{filepath.Join(t.TempDir(), "campaign.yml")})
+	if err != nil {
+		t.Fatalf("resolveCampaignConfigPathWithCandidates() error = %v", err)
+	}
+	if got != explicit {
+		t.Fatalf("path = %q, want explicit path %q", got, explicit)
+	}
+}
+
+func TestResolveCampaignConfigPathUsesFirstExistingDefault(t *testing.T) {
+	dir := t.TempDir()
+	missing := filepath.Join(dir, "missing.yml")
+	found := filepath.Join(dir, "campaign.yml")
+	if err := os.WriteFile(found, []byte("campaign: sample-campaign\n"), 0o644); err != nil {
+		t.Fatalf("write campaign.yml: %v", err)
+	}
+
+	got, err := resolveCampaignConfigPathWithCandidates("", []string{missing, found})
+	if err != nil {
+		t.Fatalf("resolveCampaignConfigPathWithCandidates() error = %v", err)
+	}
+	if got != filepath.Clean(found) {
+		t.Fatalf("path = %q, want %q", got, filepath.Clean(found))
+	}
+}
+
+func TestResolveCampaignConfigPathErrorIncludesSearchedPaths(t *testing.T) {
+	_, err := resolveCampaignConfigPathWithCandidates("", []string{"./campaign.yml", "/usr/local/etc/narratio/campaign.yml", "/etc/narratio/campaign.yml"})
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "searched") {
+		t.Fatalf("error = %q, want searched paths", err.Error())
+	}
+	if !strings.Contains(err.Error(), "pass --campaign") {
+		t.Fatalf("error = %q, want explicit-campaign guidance", err.Error())
+	}
+}

internal/app/commands_test.go

@@ -24,7 +24,7 @@ func TestExecuteValidCommands(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 	manifestPath := writeManifestPathForExecute(t)
 
 	cases := []struct {
@@ -32,11 +32,11 @@ func TestExecuteValidCommands(t *testing.T) {
 		args    []string
 		wantOut string
 	}{
-		{name: "run", args: []string{"run", "--config", pipelinePath, "--session", sessionPath}, wantOut: "narratio run: session 2026-05-03; executed=9 skipped=0; manifest="},
+		{name: "run", args: []string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "narratio run: session 2026-05-03; executed=9 skipped=0; manifest="},
-		{name: "plan", args: []string{"plan", "--config", pipelinePath, "--session", sessionPath}, wantOut: "prepare: skip\ntranscribe: skip\nmerge: skip\npolish: skip\nnormalize: skip\ntrim: skip\nanalyze: skip\narchive: skip\nnotify: skip"},
+		{name: "plan", args: []string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "prepare: skip\ntranscribe: skip\nmerge: skip\npolish: skip\nnormalize: skip\ntrim: skip\nanalyze: skip\narchive: skip\nnotify: skip"},
 		{name: "status", args: []string{"status", "--manifest", manifestPath}, wantOut: "session_id: 2026-05-03"},
-		{name: "resume", args: []string{"resume", "--config", pipelinePath, "--session", sessionPath}, wantOut: "narratio resume: session 2026-05-03 has no remaining stages"},
+		{name: "resume", args: []string{"resume", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, wantOut: "narratio resume: session 2026-05-03 has no remaining stages"},
-		{name: "run-stage", args: []string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "polish"}, wantOut: "narratio run-stage: stage=polish executed=0 skipped=1 force=false; manifest="},
+		{name: "run-stage", args: []string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, wantOut: "narratio run-stage: stage=polish executed=0 skipped=1 force=false; manifest="},
 	}
 
 	for _, tc := range cases {
@@ -94,12 +94,12 @@ func TestExecuteMissingRequiredFlags(t *testing.T) {
 
 func TestExecuteRunStageUnknownFails(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "unknown"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "unknown"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -110,14 +110,14 @@ func TestExecuteRunStageUnknownFails(t *testing.T) {
 
 func TestExecuteRunStageNormalizeIsAccepted(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, "https://example.com/transcribe")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "processed.json"), `{"segments":[{"id":1}]}`)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "normalize"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "normalize"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -136,19 +136,19 @@ func TestExecuteRunStageTranscribeUsesConfiguredWhisperXServer(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "prepare"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "prepare"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("prepare exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
 	stdout.Reset()
 	stderr.Reset()
 
-	code = Execute([]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "--force", "transcribe"}, &stdout, &stderr)
+	code = Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "transcribe"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("transcribe exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -188,6 +188,7 @@ func TestExecuteRunStagePolishLoadsCredentialFromSecretsDir(t *testing.T) {
 	t.Setenv("GO_WANT_APP_AUDITA_HELPER", "1")
 
 	pipelinePath := filepath.Join(configDir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, configDir)
 	sessionPath := filepath.Join(configDir, "session.yml")
 	pipelineYAML := `workspace:
   root: ` + workspaceRoot + `
@@ -239,7 +240,7 @@ inputs:
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run-stage", "--config", pipelinePath, "--session", sessionPath, "--force", "polish"}, &stdout, &stderr)
+	code := Execute([]string{"run-stage", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -252,6 +253,7 @@ func TestExecuteRunFailsWhenConfiguredSecretsDirMissing(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	configDir := t.TempDir()
 	pipelinePath := filepath.Join(configDir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, configDir)
 	sessionPath := filepath.Join(configDir, "session.yml")
 
 	pipelineYAML := `workspace:
@@ -288,7 +290,7 @@ inputs:
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"run", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"run", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -305,11 +307,14 @@ func TestExecuteUsesDefaultPipelineConfigPathWhenConfigFlagOmitted(t *testing.T)
 	}))
 	defer srv.Close()
 
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 	originalDefaults := append([]string(nil), config.DefaultPipelineConfigSearchPaths...)
+	originalCampaignDefaults := append([]string(nil), config.DefaultCampaignConfigSearchPaths...)
 	config.DefaultPipelineConfigSearchPaths = []string{pipelinePath}
+	config.DefaultCampaignConfigSearchPaths = []string{campaignPath}
 	defer func() {
 		config.DefaultPipelineConfigSearchPaths = originalDefaults
+		config.DefaultCampaignConfigSearchPaths = originalCampaignDefaults
 	}()
 
 	var stdout bytes.Buffer
@@ -323,6 +328,33 @@ func TestExecuteUsesDefaultPipelineConfigPathWhenConfigFlagOmitted(t *testing.T)
 	}
 }
 
+func TestExecuteMissingCampaignConfigReportsSearchedPaths(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, _, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	missingCampaignPath := filepath.Join(t.TempDir(), "campaign.yml")
+	originalCampaignDefaults := append([]string(nil), config.DefaultCampaignConfigSearchPaths...)
+	config.DefaultCampaignConfigSearchPaths = []string{missingCampaignPath}
+	defer func() {
+		config.DefaultCampaignConfigSearchPaths = originalCampaignDefaults
+	}()
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"run", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("exit code = 0, want non-zero")
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "no campaign config path provided and no default campaign config found; searched:") {
+		t.Fatalf("stderr = %q, want campaign discovery failure", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "pass --campaign") {
+		t.Fatalf("stderr = %q, want explicit campaign guidance", stderr.String())
+	}
+}
+
 func TestExecuteInvalidCommand(t *testing.T) {
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -359,11 +391,12 @@ func TestExecuteMissingCommand(t *testing.T) {
 	}
 }
 
-func writeValidConfigFiles(t *testing.T, workspaceRoot string, transcribeURL ...string) (string, string) {
+func writeValidConfigFiles(t *testing.T, workspaceRoot string, transcribeURL ...string) (string, string, string) {
 	t.Helper()
 
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := filepath.Join(dir, "campaign.yml")
 	sessionPath := filepath.Join(dir, "session.yml")
 	url := "https://example.com/transcribe"
 	if len(transcribeURL) > 0 && strings.TrimSpace(transcribeURL[0]) != "" {
@@ -407,9 +440,11 @@ notification:
 `
 
 	sessionYAML := `session_id: 2026-05-03
-campaign: sample-campaign
 inputs:
   audio_dir: ./audio
+`
+	campaignYAML := `campaign: sample-campaign
+inputs:
   speakers_file: ./speakers.yml
   autocorrect_file: ./autocorrect.yml
   glossary_file: ./glossary.yml
@@ -418,6 +453,9 @@ inputs:
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatalf("write pipeline config: %v", err)
 	}
+	if err := os.WriteFile(campaignPath, []byte(campaignYAML), 0o644); err != nil {
+		t.Fatalf("write campaign config: %v", err)
+	}
 	if err := os.WriteFile(sessionPath, []byte(sessionYAML), 0o644); err != nil {
 		t.Fatalf("write session config: %v", err)
 	}
@@ -427,7 +465,22 @@ inputs:
 	mustWriteTestFile(t, filepath.Join(dir, "glossary.yml"), "[]\n")
 	mustWriteTestFile(t, filepath.Join(dir, "audio", "alice.flac"), "audio-bytes")
 
-	return pipelinePath, sessionPath
+	return pipelinePath, campaignPath, sessionPath
+}
+
+func writeAppTestCampaignConfig(t *testing.T, dir string) string {
+	t.Helper()
+	campaignPath := filepath.Join(dir, "campaign.yml")
+	campaignYAML := `campaign: sample-campaign
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+`
+	if err := os.WriteFile(campaignPath, []byte(campaignYAML), 0o644); err != nil {
+		t.Fatalf("write campaign.yml: %v", err)
+	}
+	return campaignPath
 }
 
 func writeManifestPathForExecute(t *testing.T) string {

internal/app/config_loader.go

@@ -0,0 +1,133 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
+	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
+	"gitea.maximumdirect.net/eric/narratio/internal/config"
+)
+
+func loadCommandConfig(ctx context.Context, pipelineFlag, campaignFlag, sessionFlag string, sessionOpts config.SessionLoadOptions) (*config.Config, error) {
+	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelineFlag)
+	if err != nil {
+		return nil, err
+	}
+	resolvedCampaignPath, err := resolveCampaignConfigPath(campaignFlag)
+	if err != nil {
+		return nil, err
+	}
+
+	if explicitSession := strings.TrimSpace(sessionFlag); explicitSession != "" {
+		return config.LoadWithSessionOptions(resolvedPipelinePath, resolvedCampaignPath, explicitSession, sessionOpts)
+	}
+
+	discoveredSession, err := discoverSessionConfigPathWithCandidates(config.DefaultSessionConfigSearchPaths)
+	if err != nil {
+		return nil, err
+	}
+	if discoveredSession.Path != "" {
+		return config.LoadWithSessionOptions(resolvedPipelinePath, resolvedCampaignPath, discoveredSession.Path, sessionOpts)
+	}
+
+	pipelineCfg, err := config.LoadPipeline(resolvedPipelinePath)
+	if err != nil {
+		return nil, err
+	}
+	campaignCfg, err := config.LoadCampaign(resolvedCampaignPath)
+	if err != nil {
+		return nil, err
+	}
+
+	sessionID := strings.TrimSpace(sessionOpts.SessionID)
+	if sessionID == "" {
+		return nil, missingSessionConfigError(discoveredSession.Searched, "remote session loading requires --session-id")
+	}
+
+	sessionPrefix := artifacts.S3SessionPrefix(pipelineCfg.Storage.S3.RootPrefix, campaignCfg.Campaign, sessionID)
+	remoteKey := artifacts.S3SessionConfigKey(sessionPrefix)
+	partialCfg := &config.Config{
+		Pipeline:     pipelineCfg,
+		Campaign:     campaignCfg,
+		PipelinePath: resolvedPipelinePath,
+		CampaignPath: resolvedCampaignPath,
+	}
+	store, err := newObjectStoreFromConfigFn(ctx, partialCfg)
+	if err != nil {
+		return nil, missingSessionConfigError(discoveredSession.Searched, fmt.Sprintf("remote session %q unavailable: %v", remoteKey, err))
+	}
+
+	sessionInfo, err := findRemoteSessionConfig(ctx, store, sessionPrefix, remoteKey)
+	if err != nil {
+		return nil, missingSessionConfigError(discoveredSession.Searched, err.Error())
+	}
+	sessionTempPath, err := downloadRemoteSessionConfig(ctx, store, remoteKey)
+	if err != nil {
+		return nil, missingSessionConfigError(discoveredSession.Searched, fmt.Sprintf("remote session %q download failed: %v", remoteKey, err))
+	}
+	sessionBytes, err := os.ReadFile(sessionTempPath)
+	if err != nil {
+		return nil, fmt.Errorf("read downloaded remote session %q: %w", sessionTempPath, err)
+	}
+	sessionCfg, err := config.LoadSessionBytesWithOptions("s3://"+s3BucketName(pipelineCfg)+"/"+remoteKey, sessionBytes, sessionOpts)
+	if err != nil {
+		return nil, err
+	}
+
+	return config.Resolve(
+		resolvedPipelinePath,
+		pipelineCfg,
+		resolvedCampaignPath,
+		campaignCfg,
+		sessionTempPath,
+		sessionCfg,
+		config.SessionSource{
+			Source:    "session_config.s3",
+			LocalPath: sessionTempPath,
+			S3Bucket:  s3BucketName(pipelineCfg),
+			S3Key:     remoteKey,
+			S3Size:    sessionInfo.Size,
+			S3ETag:    sessionInfo.ETag,
+			SpoolPath: sessionTempPath,
+		},
+	)
+}
+
+func findRemoteSessionConfig(ctx context.Context, store storage.ObjectStore, sessionPrefix, remoteKey string) (storage.ObjectInfo, error) {
+	objects, err := store.List(ctx, sessionPrefix)
+	if err != nil {
+		return storage.ObjectInfo{}, fmt.Errorf("remote session %q list failed: %w", remoteKey, err)
+	}
+	for _, obj := range objects {
+		if obj.Key == remoteKey {
+			return obj, nil
+		}
+	}
+	return storage.ObjectInfo{}, fmt.Errorf("remote session %q not found", remoteKey)
+}
+
+func downloadRemoteSessionConfig(ctx context.Context, store storage.ObjectStore, remoteKey string) (string, error) {
+	f, err := os.CreateTemp("", "narratio-session-*.yml")
+	if err != nil {
+		return "", fmt.Errorf("create temp file: %w", err)
+	}
+	path := f.Name()
+	if err := f.Close(); err != nil {
+		return "", fmt.Errorf("close temp file %q: %w", path, err)
+	}
+	if err := store.Download(ctx, remoteKey, path); err != nil {
+		return "", err
+	}
+	return filepath.Clean(path), nil
+}
+
+func s3BucketName(cfg *config.PipelineConfig) string {
+	if cfg == nil || cfg.Storage.S3 == nil {
+		return ""
+	}
+	return strings.TrimSpace(cfg.Storage.S3.Bucket)
+}

internal/app/plan.go

@@ -20,11 +20,13 @@ func Plan(ctx context.Context, args []string, out io.Writer) error {
 	fs.SetOutput(io.Discard)
 
 	var pipelinePath string
+	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
@@ -36,16 +38,7 @@ func Plan(ctx context.Context, args []string, out io.Writer) error {
 	if fs.NArg() != 0 {
 		return fmt.Errorf("plan: unexpected positional arguments")
 	}
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelinePath)
+	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
-	if err != nil {
-		return fmt.Errorf("plan: %w", err)
-	}
-	resolvedSessionPath, err := resolveSessionConfigPath(sessionPath)
-	if err != nil {
-		return fmt.Errorf("plan: %w", err)
-	}
-
-	cfg, err := config.LoadWithSessionOptions(resolvedPipelinePath, resolvedSessionPath, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})

internal/app/plan_test.go

@@ -15,10 +15,10 @@ import (
 
 func TestPlanCreatesAndReusesWorkdir(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var out bytes.Buffer
-	args := []string{"--config", pipelinePath, "--session", sessionPath}
+	args := []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}
 
 	if err := Plan(context.Background(), args, &out); err != nil {
 		t.Fatalf("first Plan() error = %v", err)
@@ -62,7 +62,7 @@ func TestPlanCreatesAndReusesWorkdir(t *testing.T) {
 
 func TestPlanShowsRunAndSkipFromManifest(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -74,7 +74,7 @@ func TestPlanShowsRunAndSkipFromManifest(t *testing.T) {
 	}
 
 	var out bytes.Buffer
-	if err := Plan(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath}, &out); err != nil {
+	if err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out); err != nil {
 		t.Fatalf("Plan() error = %v", err)
 	}
 	got := out.String()
@@ -93,6 +93,7 @@ func TestPlanFailsWhenConfiguredSecretsDirMissing(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	configDir := t.TempDir()
 	pipelinePath := filepath.Join(configDir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, configDir)
 	sessionPath := filepath.Join(configDir, "session.yml")
 
 	pipelineYAML := `workspace:
@@ -128,7 +129,7 @@ inputs:
 	}
 
 	var out bytes.Buffer
-	err := Plan(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath}, &out)
+	err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}

internal/app/remote_session_test.go

@@ -0,0 +1,204 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/adapters/storage"
+	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
+	"gitea.maximumdirect.net/eric/narratio/internal/config"
+)
+
+func TestExecuteRemoteSessionFallbackLoadsFromObjectStore(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
+	fake := &storage.FakeBackend{}
+	remoteKey := seedRemoteSessionConfig(t, fake, "2026-05-03", `session_id: "{{ session_id }}"
+inputs:
+  audio_s3:
+    prefix: audio/
+`)
+	var storeInitCalls int
+	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if storeInitCalls != 1 {
+		t.Fatalf("object store init calls = %d, want 1", storeInitCalls)
+	}
+	if !strings.Contains(stdout.String(), "narratio plan: workdir prepared") {
+		t.Fatalf("stdout = %q, want plan output", stdout.String())
+	}
+	if _, ok := fake.Objects[remoteKey]; !ok {
+		t.Fatalf("remote session key %q was not seeded", remoteKey)
+	}
+}
+
+func TestExecuteExplicitLocalSessionPrecedenceSkipsRemote(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	fake := &storage.FakeBackend{}
+	var storeInitCalls int
+	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if storeInitCalls != 0 {
+		t.Fatalf("object store init calls = %d, want 0", storeInitCalls)
+	}
+}
+
+func TestExecuteLocalSessionDiscoveryPrecedenceSkipsRemote(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	fake := &storage.FakeBackend{}
+	var storeInitCalls int
+	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, config.DefaultSessionConfigSearchPaths)
+
+	originalWD, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("Getwd(): %v", err)
+	}
+	if err := os.Chdir(filepath.Dir(sessionPath)); err != nil {
+		t.Fatalf("Chdir(%q): %v", filepath.Dir(sessionPath), err)
+	}
+	t.Cleanup(func() { _ = os.Chdir(originalWD) })
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
+	}
+	if storeInitCalls != 0 {
+		t.Fatalf("object store init calls = %d, want 0", storeInitCalls)
+	}
+}
+
+func TestExecuteRemoteSessionMissingObjectFailsClearly(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
+	fake := &storage.FakeBackend{}
+	var storeInitCalls int
+	missingSessionPath := filepath.Join(t.TempDir(), "session.yml")
+	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{missingSessionPath})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("exit code = 0, want non-zero")
+	}
+	if !strings.Contains(stderr.String(), "remote session") || !strings.Contains(stderr.String(), "session.yml") || !strings.Contains(stderr.String(), "not found") {
+		t.Fatalf("stderr = %q, want remote session not found context", stderr.String())
+	}
+	if !strings.Contains(stderr.String(), missingSessionPath) {
+		t.Fatalf("stderr = %q, want local searched path", stderr.String())
+	}
+}
+
+func TestExecuteRemoteSessionRequiresSessionID(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
+	var storeInitCalls int
+	restoreAppConfigTestGlobals(t, &storage.FakeBackend{}, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath}, &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("exit code = 0, want non-zero")
+	}
+	if !strings.Contains(stderr.String(), "remote session loading requires --session-id") {
+		t.Fatalf("stderr = %q, want session-id guidance", stderr.String())
+	}
+	if storeInitCalls != 0 {
+		t.Fatalf("object store init calls = %d, want 0", storeInitCalls)
+	}
+}
+
+func TestExecuteRemoteSessionStorageInitErrorFailsClearly(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
+	origStoreFn := newObjectStoreFromConfigFn
+	origSessionDefaults := append([]string(nil), config.DefaultSessionConfigSearchPaths...)
+	config.DefaultSessionConfigSearchPaths = []string{filepath.Join(t.TempDir(), "session.yml")}
+	newObjectStoreFromConfigFn = func(context.Context, *config.Config) (storage.ObjectStore, error) {
+		return nil, errors.New("storage unavailable")
+	}
+	t.Cleanup(func() {
+		newObjectStoreFromConfigFn = origStoreFn
+		config.DefaultSessionConfigSearchPaths = origSessionDefaults
+	})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("exit code = 0, want non-zero")
+	}
+	if !strings.Contains(stderr.String(), "storage unavailable") || !strings.Contains(stderr.String(), "remote session") {
+		t.Fatalf("stderr = %q, want remote storage context", stderr.String())
+	}
+}
+
+func TestExecuteRemoteSessionMalformedYAMLFailsStrictDecode(t *testing.T) {
+	workspaceRoot := t.TempDir()
+	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
+	fake := &storage.FakeBackend{}
+	seedRemoteSessionConfig(t, fake, "2026-05-03", "session_id: 2026-05-03\nunknown: true\n")
+	var storeInitCalls int
+	restoreAppConfigTestGlobals(t, fake, &storeInitCalls, []string{filepath.Join(t.TempDir(), "session.yml")})
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := Execute([]string{"plan", "--config", pipelinePath, "--campaign", campaignPath, "--session-id", "2026-05-03"}, &stdout, &stderr)
+	if code == 0 {
+		t.Fatal("exit code = 0, want non-zero")
+	}
+	if !strings.Contains(stderr.String(), "strict decode failed") {
+		t.Fatalf("stderr = %q, want strict decode context", stderr.String())
+	}
+}
+
+func restoreAppConfigTestGlobals(t *testing.T, fake *storage.FakeBackend, storeInitCalls *int, sessionDefaults []string) {
+	t.Helper()
+	origStoreFn := newObjectStoreFromConfigFn
+	origSessionDefaults := append([]string(nil), config.DefaultSessionConfigSearchPaths...)
+	config.DefaultSessionConfigSearchPaths = append([]string(nil), sessionDefaults...)
+	newObjectStoreFromConfigFn = func(context.Context, *config.Config) (storage.ObjectStore, error) {
+		if storeInitCalls != nil {
+			(*storeInitCalls)++
+		}
+		return fake, nil
+	}
+	t.Cleanup(func() {
+		newObjectStoreFromConfigFn = origStoreFn
+		config.DefaultSessionConfigSearchPaths = origSessionDefaults
+	})
+}
+
+func seedRemoteSessionConfig(t *testing.T, fake *storage.FakeBackend, sessionID, content string) string {
+	t.Helper()
+	sessionPrefix := artifacts.S3SessionPrefix("dnd", "sample-campaign", sessionID)
+	remoteKey := artifacts.S3SessionConfigKey(sessionPrefix)
+	fake.SeedObject(storage.FakeObject{
+		Key:  remoteKey,
+		Data: []byte(content),
+		ETag: "remote-session-etag",
+	})
+	return remoteKey
+}

internal/app/restore.go

@@ -26,6 +26,7 @@ func Restore(ctx context.Context, args []string, out io.Writer) error {
 	fs.SetOutput(out)
 
 	var pipelinePath string
+	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
@@ -33,6 +34,7 @@ func Restore(ctx context.Context, args []string, out io.Writer) error {
 	var force bool
 	var includeAudio bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
@@ -40,7 +42,7 @@ func Restore(ctx context.Context, args []string, out io.Writer) error {
 	fs.BoolVar(&force, "force", false, "overwrite local conflicts with remote state")
 	fs.BoolVar(&includeAudio, "include-audio", false, "include archived session-level audio objects")
 	fs.Usage = func() {
-		_, _ = fmt.Fprintln(out, "Usage: narratio restore [--config <path>] [--session <path>] [--session-id <value>] [--previous-session-id <value>] [--dry-run] [--force] [--include-audio]")
+		_, _ = fmt.Fprintln(out, "Usage: narratio restore [--config <path>] [--campaign <path>] [--session <path>] [--session-id <value>] [--previous-session-id <value>] [--dry-run] [--force] [--include-audio]")
 		_, _ = fmt.Fprintln(out)
 		_, _ = fmt.Fprintln(out, "Flags:")
 		fs.PrintDefaults()
@@ -55,16 +57,7 @@ func Restore(ctx context.Context, args []string, out io.Writer) error {
 	if fs.NArg() != 0 {
 		return fmt.Errorf("restore: unexpected positional arguments")
 	}
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelinePath)
+	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
-	if err != nil {
-		return fmt.Errorf("restore: %w", err)
-	}
-	resolvedSessionPath, err := resolveSessionConfigPath(sessionPath)
-	if err != nil {
-		return fmt.Errorf("restore: %w", err)
-	}
-
-	cfg, err := config.LoadWithSessionOptions(resolvedPipelinePath, resolvedSessionPath, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})

internal/app/restore_execution_test.go

@@ -18,10 +18,10 @@ import (
 
 func TestExecuteRestoreNonDryRunRestoresDurableFiles(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"transcripts/full.json", []byte(`{"segments":[1,2,3]}`))
 	seedRestoreObject(fake, sessionPrefix+"artifacts/session_recap.md", []byte("# recap\n"))
 	seedRestoreObject(fake, sessionPrefix+"audio/alice.flac", []byte("remote-audio"))
@@ -32,7 +32,7 @@ func TestExecuteRestoreNonDryRunRestoresDurableFiles(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -64,17 +64,17 @@ func TestExecuteRestoreNonDryRunRestoresDurableFiles(t *testing.T) {
 
 func TestExecuteRestoreIncludeAudioRestoresAudio(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"audio/alice.flac", []byte("remote-audio"))
 
 	restoreWithStoreAndRealPhases(t, fake)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--include-audio"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -89,10 +89,10 @@ func TestExecuteRestoreIncludeAudioRestoresAudio(t *testing.T) {
 
 func TestExecuteRestoreRestoresPreviousCacheWhenPresent(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"previous/manifest.json", []byte(`{"session_id":"2026-04-26"}`))
 	seedRestoreObject(fake, sessionPrefix+"previous/artifacts/session_recap.md", []byte("# previous recap\n"))
 
@@ -100,7 +100,7 @@ func TestExecuteRestoreRestoresPreviousCacheWhenPresent(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -116,10 +116,10 @@ func TestExecuteRestoreRestoresPreviousCacheWhenPresent(t *testing.T) {
 
 func TestExecuteRestoreConflictWithoutForceDoesNotOverwrite(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"transcripts/full.json", []byte("remote-transcript"))
 
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
@@ -129,7 +129,7 @@ func TestExecuteRestoreConflictWithoutForceDoesNotOverwrite(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -148,10 +148,10 @@ func TestExecuteRestoreConflictWithoutForceDoesNotOverwrite(t *testing.T) {
 
 func TestExecuteRestoreForceOverwritesDifferingFile(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"transcripts/full.json", []byte("remote-transcript"))
 
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
@@ -161,7 +161,7 @@ func TestExecuteRestoreForceOverwritesDifferingFile(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -174,10 +174,10 @@ func TestExecuteRestoreForceOverwritesDifferingFile(t *testing.T) {
 
 func TestExecuteRestoreForceOverwritesDifferingPreviousCacheFile(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"previous/artifacts/session_recap.md", []byte("# remote previous recap\n"))
 
 	sessionRoot := artifacts.SessionWorkDirForCampaign(workspaceRoot, cfg.Session.Campaign, cfg.Session.SessionID)
@@ -187,7 +187,7 @@ func TestExecuteRestoreForceOverwritesDifferingPreviousCacheFile(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -196,10 +196,10 @@ func TestExecuteRestoreForceOverwritesDifferingPreviousCacheFile(t *testing.T) {
 
 func TestExecuteRestoreLockConflictFailsAndWritesNothing(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, _, _ := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, sessionPrefix+"transcripts/full.json", []byte("remote-transcript"))
 
 	store := artifacts.NewLocalStore(workspaceRoot)
@@ -213,7 +213,7 @@ func TestExecuteRestoreLockConflictFailsAndWritesNothing(t *testing.T) {
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -229,10 +229,10 @@ func TestExecuteRestoreLockConflictFailsAndWritesNothing(t *testing.T) {
 
 func TestExecuteRestoreInvalidManifestDoesNotCorruptExistingManifest(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	base := &storage.FakeBackend{}
-	cfg, sessionPrefix, manifestKey, _ := seedRestoreCommittedState(t, base, pipelinePath, sessionPath)
+	cfg, sessionPrefix, manifestKey, _ := seedRestoreCommittedState(t, base, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(base, sessionPrefix+"transcripts/full.json", []byte("remote-transcript"))
 
 	toggled := &stagedManifestDownloadStore{
@@ -260,7 +260,7 @@ func TestExecuteRestoreInvalidManifestDoesNotCorruptExistingManifest(t *testing.
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -344,9 +344,9 @@ func restoreWithStoreAndRealPhases(t *testing.T, objectStore storage.ObjectStore
 	executeRestorePlanFn = executeRestorePlan
 }
 
-func seedRestoreCommittedState(t *testing.T, fake *storage.FakeBackend, pipelinePath, sessionPath string) (*config.Config, string, string, string) {
+func seedRestoreCommittedState(t *testing.T, fake *storage.FakeBackend, pipelinePath, campaignPath, sessionPath string) (*config.Config, string, string, string) {
 	t.Helper()
-	cfg, err := config.LoadWithSessionOptions(pipelinePath, sessionPath, config.SessionLoadOptions{})
+	cfg, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{})
 	if err != nil {
 		t.Fatalf("LoadWithSessionOptions() error = %v", err)
 	}

internal/app/restore_test.go

@@ -32,6 +32,9 @@ func TestExecuteRestoreHelp(t *testing.T) {
 	if !strings.Contains(out, "--include-audio") {
 		t.Fatalf("stdout = %q, want --include-audio flag", out)
 	}
+	if !strings.Contains(out, "--campaign") {
+		t.Fatalf("stdout = %q, want --campaign flag", out)
+	}
 }
 
 func TestExecuteRestoreRecognizedAndReturnsNYI(t *testing.T) {
@@ -70,7 +73,7 @@ func TestExecuteRestoreRecognizedAndReturnsNYI(t *testing.T) {
 	}
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
@@ -78,6 +81,7 @@ func TestExecuteRestoreRecognizedAndReturnsNYI(t *testing.T) {
 		[]string{
 			"restore",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", "2026-05-03",
 			"--dry-run",
@@ -116,11 +120,11 @@ func TestExecuteRestoreRecognizedAndReturnsNYI(t *testing.T) {
 
 func TestExecuteRestoreRejectsUnexpectedPositionalArguments(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "extra"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "extra"}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -138,11 +142,11 @@ func TestExecuteRestoreFailsWhenStorageBackendNotConfigured(t *testing.T) {
 	})
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeRestoreConfigWithoutStorage(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeRestoreConfigWithoutStorage(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -166,11 +170,11 @@ func TestExecuteRestoreDiscoveryErrorSurfaced(t *testing.T) {
 	}
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -208,7 +212,7 @@ func TestExecuteRestoreLoadsSecretsBeforeObjectStoreInit(t *testing.T) {
 	restoreEnv(secretKeyEnv)
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	secretsDir := filepath.Join(t.TempDir(), "secrets")
 	mustWriteTestFile(t, filepath.Join(secretsDir, accessKeyEnv), "test-access-key-id\n")
 	mustWriteTestFile(t, filepath.Join(secretsDir, secretKeyEnv), "test-secret-key\n")
@@ -261,6 +265,7 @@ func TestExecuteRestoreLoadsSecretsBeforeObjectStoreInit(t *testing.T) {
 		[]string{
 			"restore",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", "2026-05-03",
 			"--dry-run",
@@ -307,10 +312,10 @@ func TestExecuteRestoreNonDryRunConflictFailsBeforeNYI(t *testing.T) {
 	}
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &stdout, &stderr)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
@@ -359,10 +364,10 @@ func TestExecuteRestoreNonDryRunForceExecutesPlan(t *testing.T) {
 	}
 
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"restore", "--config", pipelinePath, "--session", sessionPath, "--force"}, &stdout, &stderr)
+	code := Execute([]string{"restore", "--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &stdout, &stderr)
 	if code != 0 {
 		t.Fatalf("exit code = %d, want 0; stderr=%q", code, stderr.String())
 	}
@@ -374,11 +379,12 @@ func TestExecuteRestoreNonDryRunForceExecutesPlan(t *testing.T) {
 	}
 }
 
-func writeRestoreConfigWithoutStorage(t *testing.T, workspaceRoot string) (string, string) {
+func writeRestoreConfigWithoutStorage(t *testing.T, workspaceRoot string) (string, string, string) {
 	t.Helper()
 
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, dir)
 	sessionPath := filepath.Join(dir, "session.yml")
 
 	pipelineYAML := `workspace:
@@ -405,5 +411,5 @@ inputs:
 	mustWriteTestFile(t, filepath.Join(dir, "glossary.yml"), "[]\n")
 	mustWriteTestFile(t, filepath.Join(dir, "audio", "alice.flac"), "audio-bytes")
 
-	return pipelinePath, sessionPath
+	return pipelinePath, campaignPath, sessionPath
 }

internal/app/restore_workflow_test.go

@@ -19,10 +19,10 @@ import (
 
 func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
 
 	fake := &storage.FakeBackend{}
-	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fake, pipelinePath, sessionPath)
+	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fake, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fake, runIDKey, []byte("20260519T010203Z-a1b2c3d4\n"))
 	seedRestoreObject(fake, manifestKey, restoreWorkflowManifestJSON(t, cfg.Session.SessionID, cfg.Session.Campaign))
 	seedRestoreObject(fake, sessionPrefix+"transcripts/full.json", []byte(`{"segments":[1,2,3]}`+"\n"))
@@ -48,6 +48,7 @@ func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 		[]string{
 			"restore",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 		},
@@ -86,6 +87,7 @@ func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 		[]string{
 			"run-stage",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 			"--force",
@@ -157,7 +159,7 @@ func TestRestoreThenRunStageForceAnalyzeUsesRestoredDurableState(t *testing.T) {
 
 func TestRestoreThenAnalyzeUsesRestoredPreviousCacheWithoutObjectStore(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	appendRestoreWorkflowScriptoriumConfig(t, pipelinePath, `
 scriptorium:
   binary: scriptorium
@@ -176,7 +178,7 @@ scriptorium:
 `)
 
 	fakeStore := &storage.FakeBackend{}
-	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fakeStore, pipelinePath, sessionPath)
+	cfg, sessionPrefix, manifestKey, runIDKey := seedRestoreCommittedState(t, fakeStore, pipelinePath, campaignPath, sessionPath)
 	seedRestoreObject(fakeStore, runIDKey, []byte("20260519T010203Z-a1b2c3d4\n"))
 	seedRestoreObject(fakeStore, manifestKey, restoreWorkflowManifestJSON(t, cfg.Session.SessionID, cfg.Session.Campaign))
 	seedRestoreObject(fakeStore, sessionPrefix+"transcripts/trimmed.json", []byte(`{"segments":[]}`+"\n"))
@@ -191,6 +193,7 @@ scriptorium:
 		[]string{
 			"restore",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 		},
@@ -235,6 +238,7 @@ scriptorium:
 		[]string{
 			"run-stage",
 			"--config", pipelinePath,
+			"--campaign", campaignPath,
 			"--session", sessionPath,
 			"--session-id", cfg.Session.SessionID,
 			"--force",

internal/app/resume.go

@@ -17,12 +17,14 @@ func Resume(ctx context.Context, args []string, out io.Writer) error {
 	fs.SetOutput(io.Discard)
 
 	var pipelinePath string
+	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
@@ -35,16 +37,7 @@ func Resume(ctx context.Context, args []string, out io.Writer) error {
 	if fs.NArg() != 0 {
 		return fmt.Errorf("resume: unexpected positional arguments")
 	}
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelinePath)
+	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
-	if err != nil {
-		return fmt.Errorf("resume: %w", err)
-	}
-	resolvedSessionPath, err := resolveSessionConfigPath(sessionPath)
-	if err != nil {
-		return fmt.Errorf("resume: %w", err)
-	}
-
-	cfg, err := config.LoadWithSessionOptions(resolvedPipelinePath, resolvedSessionPath, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})

internal/app/resume_run_stage_test.go

@@ -15,7 +15,7 @@ import (
 
 func TestResumeStartsAfterCompletedStages(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -32,7 +32,7 @@ func TestResumeStartsAfterCompletedStages(t *testing.T) {
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath}, &out)
+	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -51,7 +51,7 @@ func TestResumeStartsAfterCompletedStages(t *testing.T) {
 
 func TestResumeNoRemainingStages(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -64,7 +64,7 @@ func TestResumeNoRemainingStages(t *testing.T) {
 	}
 
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath}, &out)
+	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -80,7 +80,7 @@ func TestResumeForceRerunsSucceeded(t *testing.T) {
 		_, _ = w.Write([]byte(`{"source":"resume-force-test","segments":[{"speaker":"alice"}]}`))
 	}))
 	defer srv.Close()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot, srv.URL)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 
 	store := &manifest.LocalStore{}
@@ -93,7 +93,7 @@ func TestResumeForceRerunsSucceeded(t *testing.T) {
 	}
 
 	var out bytes.Buffer
-	err := Resume(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "--force"}, &out)
+	err := Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force"}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -104,14 +104,14 @@ func TestResumeForceRerunsSucceeded(t *testing.T) {
 
 func TestRunStageExecutesOnlySelectedStage(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
 	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "terms: []\n")
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "polish"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}
@@ -134,7 +134,7 @@ func TestRunStageExecutesOnlySelectedStage(t *testing.T) {
 
 func TestRunStageSkipAndForce(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
@@ -148,7 +148,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 	}
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "polish"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "polish"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}
@@ -157,7 +157,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 	}
 
 	out.Reset()
-	err = RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "--force", "polish"}, &out)
+	err = RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(force) error = %v", err)
 	}
@@ -168,7 +168,7 @@ func TestRunStageSkipAndForce(t *testing.T) {
 
 func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "merged.json"), `{"segments":[]}`)
@@ -184,7 +184,7 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 	}
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "--force", "polish"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--force", "polish"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(force) error = %v", err)
 	}
@@ -203,7 +203,7 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 	}
 
 	out.Reset()
-	err = Resume(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath}, &out)
+	err = Resume(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath}, &out)
 	if err != nil {
 		t.Fatalf("Resume() error = %v", err)
 	}
@@ -214,13 +214,13 @@ func TestRunStageForceMarksDownstreamStaleAndResumeContinuesFromStale(t *testing
 
 func TestRunStageTrimExecutes(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "normalized.json"), `{"segments":[{"id":1},{"id":2}]}`)
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "trim"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "trim"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(trim) error = %v", err)
 	}
@@ -243,13 +243,13 @@ func TestRunStageTrimExecutes(t *testing.T) {
 
 func TestRunStageNormalizeExecutes(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 	manifestPath := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03", "manifest.json")
 	workRoot := filepath.Join(workspaceRoot, "work", "sample-campaign", "2026-05-03")
 	mustWriteTestFile(t, filepath.Join(workRoot, "transcripts", "processed.json"), `{"segments":[{"id":1},{"id":2}]}`)
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "normalize"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "normalize"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage(normalize) error = %v", err)
 	}

internal/app/run.go

@@ -15,12 +15,14 @@ func Run(ctx context.Context, args []string, out io.Writer) error {
 	fs.SetOutput(io.Discard)
 
 	var pipelinePath string
+	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
@@ -33,16 +35,7 @@ func Run(ctx context.Context, args []string, out io.Writer) error {
 	if fs.NArg() != 0 {
 		return fmt.Errorf("run: unexpected positional arguments")
 	}
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelinePath)
+	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
-	if err != nil {
-		return fmt.Errorf("run: %w", err)
-	}
-	resolvedSessionPath, err := resolveSessionConfigPath(sessionPath)
-	if err != nil {
-		return fmt.Errorf("run: %w", err)
-	}
-
-	cfg, err := config.LoadWithSessionOptions(resolvedPipelinePath, resolvedSessionPath, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})

internal/app/run_stage.go

@@ -15,12 +15,14 @@ func RunStage(ctx context.Context, args []string, out io.Writer) error {
 	fs.SetOutput(io.Discard)
 
 	var pipelinePath string
+	var campaignPath string
 	var sessionPath string
 	var sessionID string
 	var previousSessionID string
 	var force bool
 	var selectedArtifacts artifactSelectionFlag
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
+	fs.StringVar(&campaignPath, "campaign", "", "path to campaign.yml (optional; defaults searched)")
 	fs.StringVar(&sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&sessionID, "session-id", "", "session identifier for session.yml templates")
 	fs.StringVar(&previousSessionID, "previous-session-id", "", "previous session identifier for session.yml templates")
@@ -46,16 +48,7 @@ func RunStage(ctx context.Context, args []string, out io.Writer) error {
 		return fmt.Errorf("run-stage: %w", err)
 	}
 
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelinePath)
+	cfg, err := loadCommandConfig(ctx, pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{
-	if err != nil {
-		return fmt.Errorf("run-stage: %w", err)
-	}
-	resolvedSessionPath, err := resolveSessionConfigPath(sessionPath)
-	if err != nil {
-		return fmt.Errorf("run-stage: %w", err)
-	}
-
-	cfg, err := config.LoadWithSessionOptions(resolvedPipelinePath, resolvedSessionPath, config.SessionLoadOptions{
 		SessionID:         sessionID,
 		PreviousSessionID: previousSessionID,
 	})

internal/app/runner_test.go

@@ -994,10 +994,12 @@ func testConfig(t *testing.T) *config.Config {
 	workspace := t.TempDir()
 	cfgDir := t.TempDir()
 	sessionPath := filepath.Join(cfgDir, "session.yml")
+	campaignPath := filepath.Join(cfgDir, "campaign.yml")
 	pipelinePath := filepath.Join(cfgDir, "pipeline.yml")
 
 	mustWriteFile(t, pipelinePath, "workspace:\n  root: "+workspace+"\n")
-	mustWriteFile(t, sessionPath, "session_id: 2026-05-03\ncampaign: sample-campaign\n")
+	mustWriteFile(t, campaignPath, "campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n")
+	mustWriteFile(t, sessionPath, "session_id: 2026-05-03\ncampaign: sample-campaign\ninputs:\n  audio_dir: ./audio\n")
 	mustWriteFile(t, filepath.Join(cfgDir, "speakers.yml"), "alice: alice.flac\n")
 	mustWriteFile(t, filepath.Join(cfgDir, "autocorrect.yml"), "[]\n")
 	mustWriteFile(t, filepath.Join(cfgDir, "glossary.yml"), "[]\n")
@@ -1005,8 +1007,27 @@ func testConfig(t *testing.T) *config.Config {
 
 	return &config.Config{
 		Pipeline:     &config.PipelineConfig{Workspace: config.WorkspaceConfig{Root: workspace}},
+		Campaign:     &config.CampaignConfig{Campaign: "sample-campaign"},
 		PipelinePath: pipelinePath,
+		CampaignPath: campaignPath,
 		SessionPath:  sessionPath,
+		StableInputs: config.ResolvedStableInputs{
+			SpeakersFile: config.ResolvedInputFile{
+				Path:       "./speakers.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
+			},
+			AutocorrectFile: config.ResolvedInputFile{
+				Path:       "./autocorrect.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
+			},
+			GlossaryFile: config.ResolvedInputFile{
+				Path:       "./glossary.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
+			},
+		},
 		Session: &config.SessionConfig{
 			SessionID: "2026-05-03",
 			Campaign:  "sample-campaign",
@@ -1023,6 +1044,7 @@ func testConfig(t *testing.T) *config.Config {
 func TestBuildDefaultRunnersWithOmittedToolSections(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := filepath.Join(dir, "campaign.yml")
 	sessionPath := filepath.Join(dir, "session.yml")
 	pipelineYAML := `workspace:
   root: ` + t.TempDir() + `
@@ -1032,6 +1054,12 @@ analyzer:
   timeout: 20m
 notification:
   timeout: 10s
+`
+	campaignYAML := `campaign: sample-campaign
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
 `
 	sessionYAML := `session_id: 2026-05-03
 campaign: sample-campaign
@@ -1042,6 +1070,7 @@ inputs:
   glossary_file: ./glossary.yml
 `
 	mustWriteFile(t, pipelinePath, pipelineYAML)
+	mustWriteFile(t, campaignPath, campaignYAML)
 	mustWriteFile(t, sessionPath, sessionYAML)
 
 	cfg, err := config.Load(pipelinePath, sessionPath)

internal/app/session_cli_test.go

@@ -11,7 +11,7 @@ import (
 
 func TestPlanUsesDiscoveredSessionTemplateWithSessionIDs(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, _, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	sessionTemplate := `session_id: "{{ session_id }}"
 previous_session_id: "{{ previous_session_id }}"
@@ -51,10 +51,10 @@ inputs:
 
 func TestPlanFailsWhenSessionIDMismatchesConcreteSession(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var out bytes.Buffer
-	err := Plan(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "--session-id", "2026-04-04"}, &out)
+	err := Plan(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-04-04"}, &out)
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
@@ -65,7 +65,7 @@ func TestPlanFailsWhenSessionIDMismatchesConcreteSession(t *testing.T) {
 
 func TestPlanFailsWhenPreviousSessionIDMismatchesConcreteSession(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	sessionYAML := `session_id: 2026-05-03
 previous_session_id: 2026-04-26
@@ -83,6 +83,7 @@ inputs:
 	var out bytes.Buffer
 	err := Plan(context.Background(), []string{
 		"--config", pipelinePath,
+		"--campaign", campaignPath,
 		"--session", sessionPath,
 		"--session-id", "2026-05-03",
 		"--previous-session-id", "2026-04-25",
@@ -97,10 +98,10 @@ inputs:
 
 func TestRunStageAcceptsSessionIDFlagAndParsesStageName(t *testing.T) {
 	workspaceRoot := t.TempDir()
-	pipelinePath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
 
 	var out bytes.Buffer
-	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--session", sessionPath, "--session-id", "2026-05-03", "prepare"}, &out)
+	err := RunStage(context.Background(), []string{"--config", pipelinePath, "--campaign", campaignPath, "--session", sessionPath, "--session-id", "2026-05-03", "prepare"}, &out)
 	if err != nil {
 		t.Fatalf("RunStage() error = %v", err)
 	}

internal/app/session_config_path.go

@@ -19,6 +19,22 @@ func resolveSessionConfigPathWithCandidates(flagValue string, candidates []strin
 		return explicit, nil
 	}
 
+	resolved, err := discoverSessionConfigPathWithCandidates(candidates)
+	if err != nil {
+		return "", err
+	}
+	if resolved.Path != "" {
+		return resolved.Path, nil
+	}
+	return "", missingSessionConfigError(resolved.Searched, "")
+}
+
+type sessionConfigDiscovery struct {
+	Path     string
+	Searched []string
+}
+
+func discoverSessionConfigPathWithCandidates(candidates []string) (sessionConfigDiscovery, error) {
 	ordered := make([]string, 0, len(candidates))
 	for _, raw := range candidates {
 		path := strings.TrimSpace(raw)
@@ -31,19 +47,32 @@ func resolveSessionConfigPathWithCandidates(flagValue string, candidates []strin
 			if info.IsDir() {
 				continue
 			}
-			return filepath.Clean(path), nil
+			return sessionConfigDiscovery{Path: filepath.Clean(path), Searched: ordered}, nil
 		}
 		if errors.Is(err, os.ErrNotExist) {
 			continue
 		}
-		return "", fmt.Errorf("check default session config %q: %w", path, err)
+		return sessionConfigDiscovery{}, fmt.Errorf("check default session config %q: %w", path, err)
 	}
 
+	return sessionConfigDiscovery{Searched: ordered}, nil
+}
+
+func missingSessionConfigError(searched []string, remoteDetail string) error {
+	ordered := append([]string(nil), searched...)
 	if len(ordered) == 0 {
-		return "", fmt.Errorf("no session config path provided and no default locations configured")
+		if strings.TrimSpace(remoteDetail) != "" {
+			return fmt.Errorf("no session config path provided and no default locations configured; %s", remoteDetail)
 		}
-	return "", fmt.Errorf(
+		return fmt.Errorf("no session config path provided and no default locations configured")
-		"no session config path provided and no default session config found; searched: %s; pass --session to use an explicit path",
+	}
+	msg := fmt.Sprintf(
+		"no session config path provided and no default session config found; searched: %s",
 		strings.Join(ordered, ", "),
 	)
+	if strings.TrimSpace(remoteDetail) != "" {
+		msg += "; " + strings.TrimSpace(remoteDetail)
+	}
+	msg += "; pass --session to use an explicit path"
+	return fmt.Errorf("%s", msg)
 }

internal/artifacts/s3_keys.go

@@ -34,6 +34,12 @@ func S3AudioPrefix(sessionPrefix, audioPrefix string) string {
 	return ensureS3TrailingSlash(key)
 }
 
+// S3SessionConfigKey returns the session config key.
+// Format: {session_prefix}/session.yml
+func S3SessionConfigKey(sessionPrefix string) string {
+	return path.Join(strings.TrimSuffix(cleanS3Key(sessionPrefix), "/"), "session.yml")
+}
+
 // S3CurrentManifestKey returns the current manifest pointer key.
 // Format: {session_prefix}/current/manifest.json
 func S3CurrentManifestKey(sessionPrefix string) string {

internal/artifacts/s3_keys_test.go

@@ -17,6 +17,11 @@ func TestS3KeyConstruction(t *testing.T) {
 		t.Fatalf("audioPrefix = %q", audioPrefix)
 	}
 
+	sessionConfigKey := S3SessionConfigKey(`dnd\campaigns\forsaken\sessions\2026-04-19\`)
+	if sessionConfigKey != "dnd/campaigns/forsaken/sessions/2026-04-19/session.yml" {
+		t.Fatalf("session config key = %q", sessionConfigKey)
+	}
+
 	runPrefix := S3RunPrefix(sessionPrefix, runID)
 	wantRunPrefix := "dnd/campaigns/forsaken/sessions/2026-04-19/runs/" + runID + "/"
 	if runPrefix != wantRunPrefix {

internal/config/campaign_config_test.go

@@ -0,0 +1,138 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCampaignConfigDefaultSearchOrder(t *testing.T) {
+	want := []string{
+		"./campaign.yml",
+		"/usr/local/etc/narratio/campaign.yml",
+		"/etc/narratio/campaign.yml",
+	}
+	if len(DefaultCampaignConfigSearchPaths) != len(want) {
+		t.Fatalf("DefaultCampaignConfigSearchPaths = %#v, want %#v", DefaultCampaignConfigSearchPaths, want)
+	}
+	for i := range want {
+		if DefaultCampaignConfigSearchPaths[i] != want[i] {
+			t.Fatalf("DefaultCampaignConfigSearchPaths[%d] = %q, want %q", i, DefaultCampaignConfigSearchPaths[i], want[i])
+		}
+	}
+}
+
+func TestCampaignStrictDecodeRejectsUnknownFields(t *testing.T) {
+	pipelinePath, campaignPath, sessionPath := writeCampaignConfigTestFiles(t,
+		"campaign: sample-campaign\nunknown: true\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n",
+		"session_id: 2026-05-03\ninputs:\n  audio_dir: ./audio\n",
+	)
+
+	_, err := LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, SessionLoadOptions{})
+	if err == nil {
+		t.Fatal("expected load error, got nil")
+	}
+	if !strings.Contains(err.Error(), "campaign file") || !strings.Contains(err.Error(), "strict decode failed") {
+		t.Fatalf("error = %q, want campaign strict decode context", err.Error())
+	}
+}
+
+func TestCampaignSessionMergeFillsStableInputs(t *testing.T) {
+	pipelinePath, campaignPath, sessionPath := writeCampaignConfigTestFiles(t,
+		"campaign: sample-campaign\ninputs:\n  speakers_file: ./campaign-speakers.yml\n  autocorrect_file: ./campaign-autocorrect.yml\n  glossary_file: ./campaign-glossary.yml\n",
+		"session_id: 2026-05-03\ninputs:\n  audio_dir: ./audio\n",
+	)
+
+	cfg, err := LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, SessionLoadOptions{})
+	if err != nil {
+		t.Fatalf("LoadWithSessionOptions() error = %v", err)
+	}
+	if err := Validate(cfg); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+	if cfg.Session.Campaign != "sample-campaign" {
+		t.Fatalf("session campaign = %q, want campaign config value", cfg.Session.Campaign)
+	}
+	assertResolvedStableInput(t, cfg.StableInputs.SpeakersFile, "./campaign-speakers.yml", campaignPath, "campaign_config")
+	assertResolvedStableInput(t, cfg.StableInputs.AutocorrectFile, "./campaign-autocorrect.yml", campaignPath, "campaign_config")
+	assertResolvedStableInput(t, cfg.StableInputs.GlossaryFile, "./campaign-glossary.yml", campaignPath, "campaign_config")
+}
+
+func TestCampaignSessionMergeSessionOverridesStableInputs(t *testing.T) {
+	pipelinePath, campaignPath, sessionPath := writeCampaignConfigTestFiles(t,
+		"campaign: sample-campaign\ninputs:\n  speakers_file: ./campaign-speakers.yml\n  autocorrect_file: ./campaign-autocorrect.yml\n  glossary_file: ./campaign-glossary.yml\n",
+		"session_id: 2026-05-03\ncampaign: sample-campaign\ninputs:\n  audio_dir: ./audio\n  speakers_file: ./session-speakers.yml\n",
+	)
+
+	cfg, err := LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, SessionLoadOptions{})
+	if err != nil {
+		t.Fatalf("LoadWithSessionOptions() error = %v", err)
+	}
+	if err := Validate(cfg); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+	assertResolvedStableInput(t, cfg.StableInputs.SpeakersFile, "./session-speakers.yml", sessionPath, "session_config")
+	assertResolvedStableInput(t, cfg.StableInputs.AutocorrectFile, "./campaign-autocorrect.yml", campaignPath, "campaign_config")
+	assertResolvedStableInput(t, cfg.StableInputs.GlossaryFile, "./campaign-glossary.yml", campaignPath, "campaign_config")
+}
+
+func TestCampaignSessionMismatchFails(t *testing.T) {
+	pipelinePath, campaignPath, sessionPath := writeCampaignConfigTestFiles(t,
+		"campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n",
+		"session_id: 2026-05-03\ncampaign: other-campaign\ninputs:\n  audio_dir: ./audio\n",
+	)
+
+	_, err := LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, SessionLoadOptions{})
+	if err == nil {
+		t.Fatal("expected load error, got nil")
+	}
+	if !strings.Contains(err.Error(), "does not match campaign config") {
+		t.Fatalf("error = %q, want campaign mismatch context", err.Error())
+	}
+}
+
+func TestLoadMissingCampaignFileFails(t *testing.T) {
+	pipelinePath, _, sessionPath := writeCampaignConfigTestFiles(t,
+		"campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n",
+		"session_id: 2026-05-03\ninputs:\n  audio_dir: ./audio\n",
+	)
+	missingCampaignPath := filepath.Join(filepath.Dir(sessionPath), "missing-campaign.yml")
+
+	_, err := LoadWithSessionOptions(pipelinePath, missingCampaignPath, sessionPath, SessionLoadOptions{})
+	if err == nil {
+		t.Fatal("expected load error, got nil")
+	}
+	if !strings.Contains(err.Error(), "load campaign config") {
+		t.Fatalf("error = %q, want campaign load context", err.Error())
+	}
+}
+
+func writeCampaignConfigTestFiles(t *testing.T, campaignYAML, sessionYAML string) (string, string, string) {
+	t.Helper()
+
+	dir := t.TempDir()
+	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := filepath.Join(dir, "campaign.yml")
+	sessionPath := filepath.Join(dir, "session.yml")
+
+	pipelineYAML := "workspace:\n  root: " + filepath.ToSlash(filepath.Join(dir, "work")) + "\nwhisperx:\n  transcribe_url: https://example.com/transcribe\nanalyzer:\n  timeout: 20m\nnotification:\n  timeout: 10s\n"
+	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
+		t.Fatalf("write pipeline.yml: %v", err)
+	}
+	if err := os.WriteFile(campaignPath, []byte(campaignYAML), 0o644); err != nil {
+		t.Fatalf("write campaign.yml: %v", err)
+	}
+	if err := os.WriteFile(sessionPath, []byte(sessionYAML), 0o644); err != nil {
+		t.Fatalf("write session.yml: %v", err)
+	}
+
+	return pipelinePath, campaignPath, sessionPath
+}
+
+func assertResolvedStableInput(t *testing.T, got ResolvedInputFile, wantPath, wantConfigPath, wantSource string) {
+	t.Helper()
+	if got.Path != wantPath || got.ConfigPath != wantConfigPath || got.Source != wantSource {
+		t.Fatalf("resolved input = %#v, want path=%q config_path=%q source=%q", got, wantPath, wantConfigPath, wantSource)
+	}
+}

internal/config/config.go

@@ -1,11 +1,17 @@
 package config
 
-// Config is the resolved combined configuration from pipeline.yml and session.yml.
+// Config is the resolved combined configuration from pipeline.yml,
+// campaign.yml, and session.yml.
 type Config struct {
 	Pipeline     *PipelineConfig
+	Campaign     *CampaignConfig
 	Session      *SessionConfig
 	PipelinePath string
+	CampaignPath string
 	SessionPath  string
+
+	StableInputs  ResolvedStableInputs
+	SessionSource SessionSource
 }
 
 // PipelineConfig contains durable pipeline-level settings.
@@ -25,6 +31,19 @@ type PipelineConfig struct {
 	Notification NotificationConfig `yaml:"notification"`
 }
 
+// CampaignConfig contains stable campaign-level identity and input defaults.
+type CampaignConfig struct {
+	Campaign string               `yaml:"campaign"`
+	Inputs   CampaignInputsConfig `yaml:"inputs"`
+}
+
+// CampaignInputsConfig contains stable campaign-level input file references.
+type CampaignInputsConfig struct {
+	SpeakersFile    string `yaml:"speakers_file"`
+	AutocorrectFile string `yaml:"autocorrect_file"`
+	GlossaryFile    string `yaml:"glossary_file"`
+}
+
 // SessionConfig contains per-session inputs and metadata.
 type SessionConfig struct {
 	SessionID         string              `yaml:"session_id"`
@@ -76,6 +95,7 @@ type ArchiveConfig struct {
 	Enabled          *bool                  `yaml:"enabled"`
 	UploadRun        *bool                  `yaml:"upload_run"`
 	PromoteArtifacts []ArchivePromotionRule `yaml:"promote_artifacts"`
+	Locks            []ArchiveLockRule      `yaml:"locks"`
 }
 
 // ArchivePromotionRule configures one artifact promotion mapping.
@@ -85,6 +105,13 @@ type ArchivePromotionRule struct {
 	Required *bool  `yaml:"required"`
 }
 
+// ArchiveLockRule prevents one source-based promotion from overwriting its
+// top-level archive destination.
+type ArchiveLockRule struct {
+	Source string `yaml:"source"`
+	Reason string `yaml:"reason"`
+}
+
 // WhisperXConfig configures WhisperX adapter settings.
 type WhisperXConfig struct {
 	TranscribeURL string `yaml:"transcribe_url"`
@@ -229,3 +256,29 @@ type SessionInputsConfig struct {
 type SessionAudioS3Input struct {
 	Prefix string `yaml:"prefix"`
 }
+
+// ResolvedStableInputs records where stable input file paths came from after
+// campaign/session merge.
+type ResolvedStableInputs struct {
+	SpeakersFile    ResolvedInputFile
+	AutocorrectFile ResolvedInputFile
+	GlossaryFile    ResolvedInputFile
+}
+
+// ResolvedInputFile records one merged config path and its source config file.
+type ResolvedInputFile struct {
+	Path       string
+	ConfigPath string
+	Source     string
+}
+
+// SessionSource records where session.yml came from before materialization.
+type SessionSource struct {
+	Source    string
+	LocalPath string
+	S3Bucket  string
+	S3Key     string
+	S3Size    int64
+	S3ETag    string
+	SpoolPath string
+}

internal/config/defaults.go

@@ -5,6 +5,9 @@ package config
 const (
 	DefaultPipelineConfigPathUsrLocal = "/usr/local/etc/narratio/pipeline.yml"
 	DefaultPipelineConfigPathEtc      = "/etc/narratio/pipeline.yml"
+	DefaultCampaignConfigPathLocal    = "./campaign.yml"
+	DefaultCampaignConfigPathUsrLocal = "/usr/local/etc/narratio/campaign.yml"
+	DefaultCampaignConfigPathEtc      = "/etc/narratio/campaign.yml"
 	DefaultSessionConfigPathLocal     = "./session.yml"
 	DefaultSessionConfigPathUsrLocal  = "/usr/local/etc/narratio/session.yml"
 	DefaultSessionConfigPathEtc       = "/etc/narratio/session.yml"
@@ -88,6 +91,17 @@ var DefaultPipelineConfigSearchPaths = []string{
 	DefaultPipelineConfigPathEtc,
 }
 
+// DefaultCampaignConfigSearchPaths defines the default search order for
+// campaign.yml when callers do not provide an explicit path.
+//
+// Keep this in a variable so future defaults can be extended without changing
+// call sites.
+var DefaultCampaignConfigSearchPaths = []string{
+	DefaultCampaignConfigPathLocal,
+	DefaultCampaignConfigPathUsrLocal,
+	DefaultCampaignConfigPathEtc,
+}
+
 // DefaultSessionConfigSearchPaths defines the default search order for
 // session.yml when callers do not provide an explicit path.
 //

internal/config/load.go

@@ -22,6 +22,15 @@ func LoadPipeline(path string) (*PipelineConfig, error) {
 	return &cfg, nil
 }
 
+// LoadCampaign loads campaign configuration from a YAML file with strict field checking.
+func LoadCampaign(path string) (*CampaignConfig, error) {
+	var cfg CampaignConfig
+	if err := decodeStrictYAML("campaign", path, &cfg); err != nil {
+		return nil, fmt.Errorf("load campaign config: %w", err)
+	}
+	return &cfg, nil
+}
+
 // LoadSession loads session configuration from a YAML file with strict field checking.
 func LoadSession(path string) (*SessionConfig, error) {
 	return LoadSessionWithOptions(path, SessionLoadOptions{})
@@ -40,20 +49,25 @@ func LoadSessionWithOptions(path string, opts SessionLoadOptions) (*SessionConfi
 	if err != nil {
 		return nil, fmt.Errorf("load session config: session file %q: open: %w", path, err)
 	}
+	return LoadSessionBytesWithOptions(path, sessionBytes, opts)
+}
 
-	rendered, err := renderSessionTemplate(string(sessionBytes), opts)
+// LoadSessionBytesWithOptions loads session configuration from YAML bytes with
+// strict field checking after template rendering.
+func LoadSessionBytesWithOptions(label string, data []byte, opts SessionLoadOptions) (*SessionConfig, error) {
+	rendered, err := renderSessionTemplate(string(data), opts)
 	if err != nil {
 		return nil, fmt.Errorf("load session config: %w", err)
 	}
 
 	var cfg SessionConfig
-	if err := decodeStrictYAMLFromReader("session", path, strings.NewReader(rendered), &cfg); err != nil {
+	if err := decodeStrictYAMLFromReader("session", label, strings.NewReader(rendered), &cfg); err != nil {
 		return nil, fmt.Errorf("load session config: %w", err)
 	}
 	if strings.TrimSpace(opts.SessionID) != "" && strings.TrimSpace(cfg.SessionID) != "" && strings.TrimSpace(cfg.SessionID) != strings.TrimSpace(opts.SessionID) {
 		return nil, fmt.Errorf(
 			"load session config: session file %q: session_id mismatch: --session-id %q does not match rendered session_id %q",
-			path,
+			label,
 			strings.TrimSpace(opts.SessionID),
 			strings.TrimSpace(cfg.SessionID),
 		)
@@ -63,7 +77,7 @@ func LoadSessionWithOptions(path string, opts SessionLoadOptions) (*SessionConfi
 		strings.TrimSpace(cfg.PreviousSessionID) != strings.TrimSpace(opts.PreviousSessionID) {
 		return nil, fmt.Errorf(
 			"load session config: session file %q: previous_session_id mismatch: --previous-session-id %q does not match rendered previous_session_id %q",
-			path,
+			label,
 			strings.TrimSpace(opts.PreviousSessionID),
 			strings.TrimSpace(cfg.PreviousSessionID),
 		)
@@ -71,32 +85,144 @@ func LoadSessionWithOptions(path string, opts SessionLoadOptions) (*SessionConfi
 	return &cfg, nil
 }
 
-// Load loads and resolves combined pipeline and session configuration.
+// Load loads and resolves combined pipeline, campaign, and session configuration.
-func Load(pipelinePath, sessionPath string) (*Config, error) {
+// Passing only a session path is supported for package-internal compatibility;
-	return LoadWithSessionOptions(pipelinePath, sessionPath, SessionLoadOptions{})
+// in that form campaign.yml is expected next to the session file.
+func Load(pipelinePath string, paths ...string) (*Config, error) {
+	campaignPath, sessionPath, err := campaignSessionPaths(paths...)
+	if err != nil {
+		return nil, err
+	}
+	return LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, SessionLoadOptions{})
 }
 
-// LoadWithSessionOptions loads and resolves combined pipeline and session
+// LoadWithSessionOptions loads and resolves combined pipeline, campaign, and
-// configuration with session template options.
+// session configuration with session template options.
-func LoadWithSessionOptions(pipelinePath, sessionPath string, sessionOpts SessionLoadOptions) (*Config, error) {
+func LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath string, sessionOpts SessionLoadOptions) (*Config, error) {
 	pipelineCfg, err := LoadPipeline(pipelinePath)
 	if err != nil {
 		return nil, err
 	}
 
+	campaignCfg, err := LoadCampaign(campaignPath)
+	if err != nil {
+		return nil, err
+	}
+
 	sessionCfg, err := LoadSessionWithOptions(sessionPath, sessionOpts)
 	if err != nil {
 		return nil, err
 	}
 
+	return Resolve(pipelinePath, pipelineCfg, campaignPath, campaignCfg, sessionPath, sessionCfg, SessionSource{
+		Source:    "session_config",
+		LocalPath: sessionPath,
+	})
+}
+
+// Resolve builds final stage-facing configuration from already loaded
+// pipeline, campaign, and session documents.
+func Resolve(pipelinePath string, pipelineCfg *PipelineConfig, campaignPath string, campaignCfg *CampaignConfig, sessionPath string, sessionCfg *SessionConfig, sessionSource SessionSource) (*Config, error) {
+	stableInputs, err := mergeCampaignSession(campaignCfg, sessionCfg, campaignPath, sessionPath)
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(sessionSource.Source) == "" {
+		sessionSource.Source = "session_config"
+	}
+	if strings.TrimSpace(sessionSource.LocalPath) == "" {
+		sessionSource.LocalPath = sessionPath
+	}
+
 	return &Config{
 		Pipeline:      pipelineCfg,
+		Campaign:      campaignCfg,
 		Session:       sessionCfg,
 		PipelinePath:  pipelinePath,
+		CampaignPath:  campaignPath,
 		SessionPath:   sessionPath,
+		StableInputs:  stableInputs,
+		SessionSource: sessionSource,
 	}, nil
 }
 
+func campaignSessionPaths(paths ...string) (campaignPath, sessionPath string, err error) {
+	switch len(paths) {
+	case 1:
+		sessionPath = paths[0]
+		campaignPath = filepath.Join(filepath.Dir(sessionPath), "campaign.yml")
+	case 2:
+		campaignPath = paths[0]
+		sessionPath = paths[1]
+	default:
+		return "", "", fmt.Errorf("load config: expected session path or campaign and session paths")
+	}
+	return campaignPath, sessionPath, nil
+}
+
+func mergeCampaignSession(campaignCfg *CampaignConfig, sessionCfg *SessionConfig, campaignPath, sessionPath string) (ResolvedStableInputs, error) {
+	if campaignCfg == nil {
+		return ResolvedStableInputs{}, fmt.Errorf("campaign config is required")
+	}
+	if sessionCfg == nil {
+		return ResolvedStableInputs{}, fmt.Errorf("session config is required")
+	}
+
+	campaignName := strings.TrimSpace(campaignCfg.Campaign)
+	sessionCampaign := strings.TrimSpace(sessionCfg.Campaign)
+	if sessionCampaign != "" && campaignName != "" && sessionCampaign != campaignName {
+		return ResolvedStableInputs{}, fmt.Errorf(
+			"campaign/session config invalid: session campaign %q does not match campaign config %q",
+			sessionCampaign,
+			campaignName,
+		)
+	}
+	if sessionCampaign == "" {
+		sessionCfg.Campaign = campaignName
+	}
+
+	stable := ResolvedStableInputs{
+		SpeakersFile: selectStableInput(
+			campaignCfg.Inputs.SpeakersFile,
+			sessionCfg.Inputs.SpeakersFile,
+			campaignPath,
+			sessionPath,
+		),
+		AutocorrectFile: selectStableInput(
+			campaignCfg.Inputs.AutocorrectFile,
+			sessionCfg.Inputs.AutocorrectFile,
+			campaignPath,
+			sessionPath,
+		),
+		GlossaryFile: selectStableInput(
+			campaignCfg.Inputs.GlossaryFile,
+			sessionCfg.Inputs.GlossaryFile,
+			campaignPath,
+			sessionPath,
+		),
+	}
+
+	sessionCfg.Inputs.SpeakersFile = stable.SpeakersFile.Path
+	sessionCfg.Inputs.AutocorrectFile = stable.AutocorrectFile.Path
+	sessionCfg.Inputs.GlossaryFile = stable.GlossaryFile.Path
+	return stable, nil
+}
+
+func selectStableInput(campaignValue, sessionValue, campaignPath, sessionPath string) ResolvedInputFile {
+	if strings.TrimSpace(sessionValue) != "" {
+		return ResolvedInputFile{
+			Path:       sessionValue,
+			ConfigPath: sessionPath,
+			Source:     "session_config",
+		}
+	}
+	return ResolvedInputFile{
+		Path:       campaignValue,
+		ConfigPath: campaignPath,
+		Source:     "campaign_config",
+	}
+}
+
 func decodeStrictYAML(kind, path string, out any) error {
 	f, err := os.Open(path)
 	if err != nil {

internal/config/load_validate_test.go

@@ -904,6 +904,7 @@ func TestValidateMissingAudioSource(t *testing.T) {
 				Report:                   boolPtr(true),
 			},
 		},
+		Campaign: &CampaignConfig{Campaign: "sample-campaign"},
 		Session: &SessionConfig{
 			SessionID: "2026-05-03",
 			Campaign:  "sample-campaign",
@@ -963,6 +964,7 @@ func TestExamplesLoadAndValidate(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			pipelinePath := filepath.Join(examplesDir, tt.pipelineFile)
+			campaignPath := filepath.Join(examplesDir, "campaign.yml")
 			sessionPath := filepath.Join(examplesDir, tt.sessionFile)
 
 			var (
@@ -972,7 +974,7 @@ func TestExamplesLoadAndValidate(t *testing.T) {
 			if strings.TrimSpace(tt.sessionOpts.SessionID) == "" {
 				cfg, err = Load(pipelinePath, sessionPath)
 			} else {
-				cfg, err = LoadWithSessionOptions(pipelinePath, sessionPath, tt.sessionOpts)
+				cfg, err = LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, tt.sessionOpts)
 			}
 			if err != nil {
 				t.Fatalf("load example config error = %v", err)
@@ -1001,14 +1003,34 @@ func writeConfigFiles(t *testing.T, pipelineYAML, sessionYAML string) (string, s
 
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
+	campaignPath := filepath.Join(dir, "campaign.yml")
 	sessionPath := filepath.Join(dir, "session.yml")
 
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatalf("write pipeline.yml: %v", err)
 	}
+	campaignYAML := `campaign: ` + campaignNameFromSessionYAML(sessionYAML) + `
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+`
+	if err := os.WriteFile(campaignPath, []byte(campaignYAML), 0o644); err != nil {
+		t.Fatalf("write campaign.yml: %v", err)
+	}
 	if err := os.WriteFile(sessionPath, []byte(sessionYAML), 0o644); err != nil {
 		t.Fatalf("write session.yml: %v", err)
 	}
 
 	return pipelinePath, sessionPath
 }
+
+func campaignNameFromSessionYAML(sessionYAML string) string {
+	for _, line := range strings.Split(sessionYAML, "\n") {
+		trimmed := strings.TrimSpace(line)
+		if strings.HasPrefix(trimmed, "campaign:") {
+			return strings.Trim(strings.TrimSpace(strings.TrimPrefix(trimmed, "campaign:")), `"'`)
+		}
+	}
+	return "sample-campaign"
+}

internal/config/session_template_test.go

@@ -241,3 +241,38 @@ inputs:
 		t.Fatalf("SessionID = %q, want 2026-05-03", cfg.SessionID)
 	}
 }
+
+func TestLoadSessionBytesWithOptionsUsesSameTemplateAndStrictDecode(t *testing.T) {
+	sessionYAML := []byte(`session_id: "{{ session_id }}"
+campaign: sample-campaign
+inputs:
+  audio_s3:
+    prefix: audio/
+`)
+
+	cfg, err := LoadSessionBytesWithOptions("s3://bucket/session.yml", sessionYAML, SessionLoadOptions{SessionID: "2026-05-03"})
+	if err != nil {
+		t.Fatalf("LoadSessionBytesWithOptions() error = %v", err)
+	}
+	if cfg.SessionID != "2026-05-03" {
+		t.Fatalf("SessionID = %q, want 2026-05-03", cfg.SessionID)
+	}
+
+	_, err = LoadSessionBytesWithOptions("s3://bucket/session.yml", []byte("session_id: 2026-05-03\nunknown: true\n"), SessionLoadOptions{})
+	if err == nil {
+		t.Fatal("expected strict decode error, got nil")
+	}
+	if !strings.Contains(err.Error(), "strict decode failed") {
+		t.Fatalf("error = %q, want strict decode context", err.Error())
+	}
+}
+
+func TestLoadSessionBytesWithOptionsMismatchFails(t *testing.T) {
+	_, err := LoadSessionBytesWithOptions("s3://bucket/session.yml", []byte("session_id: 2026-05-03\n"), SessionLoadOptions{SessionID: "2026-04-04"})
+	if err == nil {
+		t.Fatal("expected mismatch error, got nil")
+	}
+	if !strings.Contains(err.Error(), "session_id mismatch") {
+		t.Fatalf("error = %q, want mismatch context", err.Error())
+	}
+}

internal/config/storage_archive_test.go

@@ -287,6 +287,100 @@ archive:
 	}
 }
 
+func TestArchiveLockValidation(t *testing.T) {
+	tests := []struct {
+		name        string
+		pipelineYML string
+		wantErr     string
+	}{
+		{
+			name: "valid built in source",
+			pipelineYML: testPipelineBaseYAML + `
+archive:
+  locks:
+    - source: narratio.transcript.trimmed
+      reason: reviewed transcript
+`,
+		},
+		{
+			name: "valid configured source",
+			pipelineYML: testPipelineBaseYAML + `
+scriptorium:
+  artifacts:
+    session_recap:
+      enabled: true
+      prompt_id: dnd.session_recap
+      output_path: artifacts/session_recap.md
+archive:
+  locks:
+    - source: narratio.artifact.session_recap
+`,
+		},
+		{
+			name: "missing source rejected",
+			pipelineYML: testPipelineBaseYAML + `
+archive:
+  locks:
+    - reason: no source
+`,
+			wantErr: "pipeline.archive.locks[0].source is required",
+		},
+		{
+			name: "invalid source rejected",
+			pipelineYML: testPipelineBaseYAML + `
+archive:
+  locks:
+    - source: narratio.unknown
+`,
+			wantErr: "pipeline.archive.locks[0].source \"narratio.unknown\" is unsupported",
+		},
+		{
+			name: "duplicate source rejected",
+			pipelineYML: testPipelineBaseYAML + `
+archive:
+  locks:
+    - source: narratio.transcript.trimmed
+    - source: " narratio.transcript.trimmed "
+`,
+			wantErr: "duplicates another archive lock source",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pipelinePath, sessionPath := writeConfigFiles(t, tt.pipelineYML, testSessionBaseYAML)
+			cfg, err := Load(pipelinePath, sessionPath)
+			if err != nil {
+				t.Fatalf("Load() error = %v", err)
+			}
+			err = Validate(cfg)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("Validate() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Validate() error = %v, want to contain %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestArchiveLockUnknownFieldFailsStrictDecode(t *testing.T) {
+	pipelineYAML := testPipelineBaseYAML + `
+archive:
+  locks:
+    - source: narratio.transcript.trimmed
+      dest: transcripts/trimmed.json
+`
+	pipelinePath, sessionPath := writeConfigFiles(t, pipelineYAML, testSessionBaseYAML)
+	_, err := Load(pipelinePath, sessionPath)
+	if err == nil || !strings.Contains(err.Error(), "strict decode failed") {
+		t.Fatalf("Load() error = %v, want strict decode failed", err)
+	}
+}
+
 func TestArchiveLegacyFromToFailsStrictDecode(t *testing.T) {
 	pipelineYAML := testPipelineBaseYAML + `
 archive:

internal/config/validate.go

@@ -17,6 +17,9 @@ func Validate(cfg *Config) error {
 	if cfg.Pipeline == nil {
 		return fmt.Errorf("pipeline config is required")
 	}
+	if cfg.Campaign == nil {
+		return fmt.Errorf("campaign config is required")
+	}
 	if cfg.Session == nil {
 		return fmt.Errorf("session config is required")
 	}
@@ -24,6 +27,9 @@ func Validate(cfg *Config) error {
 	if err := validatePipeline(cfg.Pipeline); err != nil {
 		return fmt.Errorf("pipeline config %q invalid: %w", shortName(cfg.PipelinePath, "pipeline.yml"), err)
 	}
+	if err := validateCampaign(cfg.Campaign); err != nil {
+		return fmt.Errorf("campaign config %q invalid: %w", shortName(cfg.CampaignPath, "campaign.yml"), err)
+	}
 	if err := validateSession(cfg.Session); err != nil {
 		return fmt.Errorf("session config %q invalid: %w", shortName(cfg.SessionPath, "session.yml"), err)
 	}
@@ -34,6 +40,16 @@ func Validate(cfg *Config) error {
 	return nil
 }
 
+func validateCampaign(cfg *CampaignConfig) error {
+	if cfg == nil {
+		return fmt.Errorf("campaign config is required")
+	}
+	if strings.TrimSpace(cfg.Campaign) == "" {
+		return fmt.Errorf("campaign.campaign is required")
+	}
+	return nil
+}
+
 func validatePipeline(cfg *PipelineConfig) error {
 	if strings.TrimSpace(cfg.Workspace.Root) == "" {
 		return fmt.Errorf("pipeline.workspace.root is required")
@@ -136,6 +152,23 @@ func validateArchive(cfg *ArchiveConfig, scriptorium *ScriptoriumConfig) error {
 		}
 		seenDest[normalizedDest] = struct{}{}
 	}
+	seenLocks := map[string]struct{}{}
+	for i, item := range cfg.Locks {
+		prefix := fmt.Sprintf("pipeline.archive.locks[%d]", i)
+		source := strings.TrimSpace(item.Source)
+		if source == "" {
+			return fmt.Errorf("%s.source is required", prefix)
+		}
+		if _, err := archiveSourceKnown(source, scriptorium); err != nil {
+			return fmt.Errorf("%s.source %q is unsupported: %w", prefix, item.Source, err)
+		}
+		if _, ok := seenLocks[source]; ok {
+			return fmt.Errorf("%s.source %q duplicates another archive lock source", prefix, source)
+		}
+		seenLocks[source] = struct{}{}
+		cfg.Locks[i].Source = source
+		cfg.Locks[i].Reason = strings.TrimSpace(item.Reason)
+	}
 	return nil
 }
 

internal/stage/archive.go

@@ -126,7 +126,14 @@ func (archiveStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 	if err != nil {
 		return nil, fmt.Errorf("archive: build runtime artifact catalog: %w", err)
 	}
-	promotions, skippedOptional, err := resolveArchivePromotions(sessionPaths, m, runtimeCatalog, env.Config.Pipeline.Archive.PromoteArtifacts)
+	promotions, skippedOptional, lockedPromotions, err := resolveArchivePromotions(
+		sessionPaths,
+		m,
+		runtimeCatalog,
+		env.Config.Pipeline.Archive.PromoteArtifacts,
+		env.Config.Pipeline.Archive.Locks,
+		sessionPrefix,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("archive: resolve promotion rules: %w", err)
 	}
@@ -166,6 +173,7 @@ func (archiveStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 		promotedUploaded,
 		previousUploaded,
 		skippedOptional,
+		lockedPromotions,
 		currentManifestKey,
 	))
 	if err != nil {
@@ -204,6 +212,8 @@ func (archiveStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 			"previous_files_uploaded":     len(previousUploaded),
 			"previous_uploaded_paths":     previousUploaded,
 			"skipped_optional_promotions": skippedOptional,
+			"locked_promotion_count":      len(lockedPromotions),
+			"locked_promotions":           lockedPromotionMetadata(lockedPromotions),
 			"current_manifest_key":        currentManifestKey,
 			"current_run_id_key":          currentRunPointerKey,
 			"current_pointer_written":     true,
@@ -220,6 +230,16 @@ type archivePromotion struct {
 	Provenance string
 }
 
+type archiveLockedPromotion struct {
+	Source     string
+	Dest       string
+	RemoteKey  string
+	Reason     string
+	Required   bool
+	LocalPath  string
+	Provenance string
+}
+
 func archiveDisabled(env *Env) bool {
 	cfg := env.Config.Pipeline.Archive
 	if cfg == nil {
@@ -319,26 +339,53 @@ func resolveArchivePromotions(
 	m *manifest.Manifest,
 	catalog *artifacts.ArtifactCatalog,
 	rules []config.ArchivePromotionRule,
-) ([]archivePromotion, []string, error) {
+	locks []config.ArchiveLockRule,
+	sessionPrefix string,
+) ([]archivePromotion, []string, []archiveLockedPromotion, error) {
 	out := make([]archivePromotion, 0, len(rules))
 	skippedOptional := make([]string, 0)
+	lockedPromotions := make([]archiveLockedPromotion, 0)
+	lockSet := archiveLockSet(locks)
 	for _, rule := range rules {
 		source := strings.TrimSpace(rule.Source)
 		required := rule.Required == nil || *rule.Required
 		dest, err := resolveArchivePromotionDest(rule, catalog)
 		if err != nil {
-			return nil, nil, fmt.Errorf("source %q: %w", source, err)
+			return nil, nil, nil, fmt.Errorf("source %q: %w", source, err)
 		}
+		lock, locked := lockSet[source]
 		resolved, err := artifacts.ResolveSessionArtifactWithCatalog(paths, m, source, catalog)
 		if err != nil {
+			if locked {
+				lockedPromotions = append(lockedPromotions, archiveLockedPromotion{
+					Source:    source,
+					Dest:      dest,
+					RemoteKey: artifacts.S3PromotedArtifactKey(sessionPrefix, dest),
+					Reason:    strings.TrimSpace(lock.Reason),
+					Required:  required,
+				})
+				continue
+			}
 			if errors.Is(err, artifacts.ErrSessionArtifactNotFound) && !required {
 				skippedOptional = append(skippedOptional, dest)
 				continue
 			}
 			if errors.Is(err, artifacts.ErrSessionArtifactNotFound) {
-				return nil, nil, fmt.Errorf("required promotion source unavailable: %q", source)
+				return nil, nil, nil, fmt.Errorf("required promotion source unavailable: %q", source)
 			}
-			return nil, nil, fmt.Errorf("resolve source %q: %w", source, err)
+			return nil, nil, nil, fmt.Errorf("resolve source %q: %w", source, err)
+		}
+		if locked {
+			lockedPromotions = append(lockedPromotions, archiveLockedPromotion{
+				Source:     source,
+				Dest:       dest,
+				RemoteKey:  artifacts.S3PromotedArtifactKey(sessionPrefix, dest),
+				Reason:     strings.TrimSpace(lock.Reason),
+				Required:   required,
+				LocalPath:  resolved.Path,
+				Provenance: resolved.Provenance,
+			})
+			continue
 		}
 		out = append(out, archivePromotion{
 			Source:     source,
@@ -348,7 +395,21 @@ func resolveArchivePromotions(
 			Provenance: resolved.Provenance,
 		})
 	}
-	return out, skippedOptional, nil
+	return out, skippedOptional, lockedPromotions, nil
+}
+
+func archiveLockSet(locks []config.ArchiveLockRule) map[string]config.ArchiveLockRule {
+	out := make(map[string]config.ArchiveLockRule, len(locks))
+	for _, lock := range locks {
+		source := strings.TrimSpace(lock.Source)
+		if source == "" {
+			continue
+		}
+		lock.Source = source
+		lock.Reason = strings.TrimSpace(lock.Reason)
+		out[source] = lock
+	}
+	return out
 }
 
 func resolveArchivePromotionDest(rule config.ArchivePromotionRule, catalog *artifacts.ArtifactCatalog) (string, error) {
@@ -663,6 +724,7 @@ func archiveMetadataPreview(
 	promotedUploaded []string,
 	previousUploaded []string,
 	skippedOptional []string,
+	lockedPromotions []archiveLockedPromotion,
 	currentManifestKey string,
 ) map[string]any {
 	return map[string]any{
@@ -677,9 +739,27 @@ func archiveMetadataPreview(
 		"previous_files_uploaded":     len(previousUploaded),
 		"previous_uploaded_paths":     append([]string(nil), previousUploaded...),
 		"skipped_optional_promotions": append([]string(nil), skippedOptional...),
+		"locked_promotion_count":      len(lockedPromotions),
+		"locked_promotions":           lockedPromotionMetadata(lockedPromotions),
 		"current_manifest_key":        currentManifestKey,
 		"current_run_id_key":          artifacts.S3CurrentRunPointerKey(sessionPrefix),
 		"current_pointer_written":     false,
 		"audio_upload_skipped":        true,
 	}
 }
+
+func lockedPromotionMetadata(locked []archiveLockedPromotion) []map[string]any {
+	out := make([]map[string]any, 0, len(locked))
+	for _, item := range locked {
+		out = append(out, map[string]any{
+			"source":     item.Source,
+			"dest":       item.Dest,
+			"remote_key": item.RemoteKey,
+			"reason":     item.Reason,
+			"required":   item.Required,
+			"local_path": item.LocalPath,
+			"provenance": item.Provenance,
+		})
+	}
+	return out
+}

internal/stage/archive_test.go

@@ -2,6 +2,7 @@ package stage
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"os"
 	"path/filepath"
@@ -215,6 +216,128 @@ func TestArchiveSkipsOptionalMissingPromotion(t *testing.T) {
 	}
 }
 
+func TestArchiveSkipsLockedRequiredPromotionAndCommits(t *testing.T) {
+	env, m, _ := archiveFixture(t)
+	env.Config.Pipeline.Archive.Locks = []config.ArchiveLockRule{
+		{Source: "narratio.transcript.trimmed", Reason: "human reviewed"},
+	}
+	fake := env.ObjectStore.(*storage.FakeBackend)
+
+	result, err := archiveStage{}.Run(context.Background(), env, m)
+	if err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+
+	trimmedKey := m.S3SessionPrefix + "transcripts/trimmed.json"
+	if _, ok := fake.Objects[trimmedKey]; ok {
+		t.Fatalf("locked promotion key %q should not be uploaded", trimmedKey)
+	}
+	recapKey := m.S3SessionPrefix + "artifacts/session_recap.md"
+	if _, ok := fake.Objects[recapKey]; !ok {
+		t.Fatalf("unlocked promotion key %q should be uploaded", recapKey)
+	}
+	runTrimmedKey := m.S3RunPrefix + "trim/outputs/transcripts/trimmed.json"
+	if _, ok := fake.Objects[runTrimmedKey]; !ok {
+		t.Fatalf("run-local locked source output %q should still be uploaded", runTrimmedKey)
+	}
+
+	currentRunIDKey := m.S3SessionPrefix + "current/run_id.txt"
+	if len(fake.Uploads) == 0 || fake.Uploads[len(fake.Uploads)-1].Key != currentRunIDKey {
+		t.Fatalf("last upload = %#v, want current run pointer %q", fake.Uploads, currentRunIDKey)
+	}
+
+	if result.Metadata["promoted_files_uploaded"] != 1 {
+		t.Fatalf("metadata promoted_files_uploaded = %#v, want 1", result.Metadata["promoted_files_uploaded"])
+	}
+	if result.Metadata["locked_promotion_count"] != 1 {
+		t.Fatalf("metadata locked_promotion_count = %#v, want 1", result.Metadata["locked_promotion_count"])
+	}
+	locked := result.Metadata["locked_promotions"].([]map[string]any)
+	if len(locked) != 1 {
+		t.Fatalf("locked_promotions = %#v, want one item", locked)
+	}
+	if locked[0]["source"] != "narratio.transcript.trimmed" ||
+		locked[0]["dest"] != "transcripts/trimmed.json" ||
+		locked[0]["remote_key"] != trimmedKey ||
+		locked[0]["reason"] != "human reviewed" ||
+		locked[0]["required"] != true ||
+		locked[0]["local_path"] == "" ||
+		locked[0]["provenance"] == "" {
+		t.Fatalf("locked promotion metadata = %#v", locked[0])
+	}
+
+	currentManifestKey := m.S3SessionPrefix + "current/manifest.json"
+	var current map[string]any
+	if err := json.Unmarshal(fake.Objects[currentManifestKey].Data, &current); err != nil {
+		t.Fatalf("unmarshal current manifest: %v", err)
+	}
+	stages := current["stages"].(map[string]any)
+	archive := stages["archive"].(map[string]any)
+	meta := archive["metadata"].(map[string]any)
+	if meta["locked_promotion_count"] != float64(1) {
+		t.Fatalf("current manifest locked_promotion_count = %#v, want 1", meta["locked_promotion_count"])
+	}
+	items := meta["locked_promotions"].([]any)
+	if len(items) != 1 {
+		t.Fatalf("current manifest locked_promotions = %#v, want one item", items)
+	}
+}
+
+func TestArchiveLockedRequiredMissingPromotionSucceeds(t *testing.T) {
+	env, m, _ := archiveFixture(t)
+	env.Config.Pipeline.Archive.PromoteArtifacts = []config.ArchivePromotionRule{
+		{Source: "narratio.transcript.merged", Dest: "transcripts/merged.json", Required: boolPtr(true)},
+	}
+	env.Config.Pipeline.Archive.Locks = []config.ArchiveLockRule{
+		{Source: "narratio.transcript.merged", Reason: "manual merge is locked"},
+	}
+
+	result, err := archiveStage{}.Run(context.Background(), env, m)
+	if err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+
+	fake := env.ObjectStore.(*storage.FakeBackend)
+	mergedKey := m.S3SessionPrefix + "transcripts/merged.json"
+	if _, ok := fake.Objects[mergedKey]; ok {
+		t.Fatalf("locked missing promotion key %q should not be uploaded", mergedKey)
+	}
+	if _, ok := fake.Objects[m.S3SessionPrefix+"current/run_id.txt"]; !ok {
+		t.Fatalf("current run pointer should be written for locked missing promotion")
+	}
+	locked := result.Metadata["locked_promotions"].([]map[string]any)
+	if len(locked) != 1 {
+		t.Fatalf("locked_promotions = %#v, want one item", locked)
+	}
+	if locked[0]["local_path"] != "" || locked[0]["provenance"] != "" {
+		t.Fatalf("locked missing promotion metadata = %#v, want empty local path/provenance", locked[0])
+	}
+}
+
+func TestArchiveLockDoesNotOverwriteExistingPromotion(t *testing.T) {
+	env, m, _ := archiveFixture(t)
+	env.Config.Pipeline.Archive.Locks = []config.ArchiveLockRule{
+		{Source: "narratio.transcript.trimmed", Reason: "already published"},
+	}
+	fake := env.ObjectStore.(*storage.FakeBackend)
+	trimmedKey := m.S3SessionPrefix + "transcripts/trimmed.json"
+	fake.SeedObject(storage.FakeObject{Key: trimmedKey, Data: []byte("previously published\n")})
+
+	if _, err := (archiveStage{}).Run(context.Background(), env, m); err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+
+	got := string(fake.Objects[trimmedKey].Data)
+	if got != "previously published\n" {
+		t.Fatalf("locked promotion object contents = %q, want existing object preserved", got)
+	}
+	for _, upload := range fake.Uploads {
+		if upload.Key == trimmedKey {
+			t.Fatalf("locked promotion key %q was uploaded", trimmedKey)
+		}
+	}
+}
+
 func TestArchiveFailsWhenRequiredPromotionMissing(t *testing.T) {
 	env, m, _ := archiveFixture(t)
 	env.Config.Pipeline.Archive.PromoteArtifacts = []config.ArchivePromotionRule{

internal/stage/placeholders_test.go

@@ -30,8 +30,10 @@ func TestStagesReturnExpectedMetadata(t *testing.T) {
 	store := artifacts.NewLocalStore(root)
 	cfgDir := t.TempDir()
 	sessionPath := filepath.Join(cfgDir, "session.yml")
+	campaignPath := filepath.Join(cfgDir, "campaign.yml")
 	pipelinePath := filepath.Join(cfgDir, "pipeline.yml")
 	writeStageTestFile(t, sessionPath, "session_id: 2026-05-03\n")
+	writeStageTestFile(t, campaignPath, "campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n")
 	writeStageTestFile(t, pipelinePath, "workspace:\n  root: "+root+"\n")
 	writeStageTestFile(t, filepath.Join(cfgDir, "speakers.yml"), "alice: alice.flac\n")
 	writeStageTestFile(t, filepath.Join(cfgDir, "autocorrect.yml"), "[]\n")
@@ -48,7 +50,9 @@ func TestStagesReturnExpectedMetadata(t *testing.T) {
 	env := &Env{
 		Config: &config.Config{
 			SessionPath:  sessionPath,
+			CampaignPath: campaignPath,
 			PipelinePath: pipelinePath,
+			Campaign:     &config.CampaignConfig{Campaign: "sample-campaign"},
 			Pipeline: &config.PipelineConfig{
 				Workspace: config.WorkspaceConfig{Root: root},
 				Storage: config.StorageConfig{
@@ -62,14 +66,28 @@ func TestStagesReturnExpectedMetadata(t *testing.T) {
 					UploadRun: boolPtr(true),
 				},
 			},
+			StableInputs: config.ResolvedStableInputs{
+				SpeakersFile: config.ResolvedInputFile{
+					Path:       "./speakers.yml",
+					ConfigPath: campaignPath,
+					Source:     "campaign_config",
+				},
+				AutocorrectFile: config.ResolvedInputFile{
+					Path:       "./autocorrect.yml",
+					ConfigPath: campaignPath,
+					Source:     "campaign_config",
+				},
+				GlossaryFile: config.ResolvedInputFile{
+					Path:       "./glossary.yml",
+					ConfigPath: campaignPath,
+					Source:     "campaign_config",
+				},
+			},
 			Session: &config.SessionConfig{
 				SessionID: "2026-05-03",
 				Campaign:  "sample-campaign",
 				Inputs: config.SessionInputsConfig{
 					AudioDir: "./audio",
-					SpeakersFile:    "./speakers.yml",
-					AutocorrectFile: "./autocorrect.yml",
-					GlossaryFile:    "./glossary.yml",
 				},
 			},
 		},

internal/stage/prepare.go

@@ -25,6 +25,7 @@ func (prepareStage) Name() string { return "prepare" }
 func (prepareStage) Declares() IODecl {
 	return IODecl{
 		Inputs: []artifacts.Ref{
+			{Kind: "config", Category: "inputs", RelativePath: "campaign.yml"},
 			{Kind: "config", Category: "inputs", RelativePath: "session.yml"},
 			{Kind: "config", Category: "inputs", RelativePath: "pipeline.resolved.yml"},
 			{Kind: "config", Category: "inputs", RelativePath: "speakers.yml"},
@@ -59,21 +60,30 @@ func (prepareStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 		return nil, fmt.Errorf("prepare: ensure workdir layout: %w", err)
 	}
 
+	campaignSrc := env.Config.CampaignPath
+	if err := requireFile(campaignSrc, "campaign.yml"); err != nil {
+		return nil, fmt.Errorf("prepare: %w", err)
+	}
+
 	sessionSrc := env.Config.SessionPath
 	if err := requireFile(sessionSrc, "session.yml"); err != nil {
 		return nil, fmt.Errorf("prepare: %w", err)
 	}
 	sessionDir := filepath.Dir(sessionSrc)
 
-	speakersSrc, err := resolvePath(sessionDir, env.Config.Session.Inputs.SpeakersFile)
+	speakersInput := stableInputSource(env.Config.StableInputs.SpeakersFile, env.Config.Session.Inputs.SpeakersFile, sessionSrc)
+	autocorrectInput := stableInputSource(env.Config.StableInputs.AutocorrectFile, env.Config.Session.Inputs.AutocorrectFile, sessionSrc)
+	glossaryInput := stableInputSource(env.Config.StableInputs.GlossaryFile, env.Config.Session.Inputs.GlossaryFile, sessionSrc)
+
+	speakersSrc, err := resolveConfigRelativePath(speakersInput)
 	if err != nil {
 		return nil, fmt.Errorf("prepare: speakers path: %w", err)
 	}
-	autocorrectSrc, err := resolvePath(sessionDir, env.Config.Session.Inputs.AutocorrectFile)
+	autocorrectSrc, err := resolveConfigRelativePath(autocorrectInput)
 	if err != nil {
 		return nil, fmt.Errorf("prepare: autocorrect path: %w", err)
 	}
-	glossarySrc, err := resolvePath(sessionDir, env.Config.Session.Inputs.GlossaryFile)
+	glossarySrc, err := resolveConfigRelativePath(glossaryInput)
 	if err != nil {
 		return nil, fmt.Errorf("prepare: glossary path: %w", err)
 	}
@@ -96,17 +106,44 @@ func (prepareStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 		return nil, fmt.Errorf("prepare: resolve audio inputs: %w", err)
 	}
 
-	inputs := make([]manifest.InputRecord, 0, 5+len(resolvedLocalAudio))
+	inputs := make([]manifest.InputRecord, 0, 6+len(resolvedLocalAudio))
 	registerInput := func(kind, path, checksum string) {
 		inputs = append(inputs, manifest.InputRecord{Kind: kind, Path: path, Checksum: checksum})
 	}
+	registerConfigInput := func(kind, path, checksum, source string) {
+		inputs = append(inputs, manifest.InputRecord{Kind: kind, Path: path, Checksum: checksum, Source: source})
+	}
+	registerSessionConfigInput := func(path, checksum string) {
+		source := env.Config.SessionSource
+		if strings.TrimSpace(source.Source) == "" {
+			source.Source = "session_config"
+		}
+		inputs = append(inputs, manifest.InputRecord{
+			Kind:      "session_config",
+			Path:      path,
+			Checksum:  checksum,
+			Source:    source.Source,
+			S3Bucket:  source.S3Bucket,
+			S3Key:     source.S3Key,
+			S3Size:    source.S3Size,
+			S3ETag:    source.S3ETag,
+			SpoolPath: source.SpoolPath,
+		})
+	}
+
+	campaignDst := filepath.Join(paths.InputsDir, "campaign.yml")
+	campaignChecksum, err := copyFileIfChanged(env.ArtifactStore, campaignSrc, campaignDst)
+	if err != nil {
+		return nil, fmt.Errorf("prepare: materialize campaign.yml: %w", err)
+	}
+	registerConfigInput("campaign_config", campaignDst, campaignChecksum, "campaign_config")
 
 	sessionDst := filepath.Join(paths.InputsDir, "session.yml")
 	sessionChecksum, err := copyFileIfChanged(env.ArtifactStore, sessionSrc, sessionDst)
 	if err != nil {
 		return nil, fmt.Errorf("prepare: materialize session.yml: %w", err)
 	}
-	registerInput("session_config", sessionDst, sessionChecksum)
+	registerSessionConfigInput(sessionDst, sessionChecksum)
 
 	pipelineResolvedBytes, err := renderResolvedPipeline(env.Config.Pipeline)
 	if err != nil {
@@ -123,16 +160,17 @@ func (prepareStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*S
 		kind   string
 		src    string
 		dst    string
+		source string
 	}{
-		{kind: "speakers", src: speakersSrc, dst: filepath.Join(paths.InputsDir, "speakers.yml")},
+		{kind: "speakers", src: speakersSrc, dst: filepath.Join(paths.InputsDir, "speakers.yml"), source: speakersInput.Source},
-		{kind: "autocorrect", src: autocorrectSrc, dst: filepath.Join(paths.InputsDir, "autocorrect.yml")},
+		{kind: "autocorrect", src: autocorrectSrc, dst: filepath.Join(paths.InputsDir, "autocorrect.yml"), source: autocorrectInput.Source},
-		{kind: "glossary", src: glossarySrc, dst: filepath.Join(paths.InputsDir, "glossary.yml")},
+		{kind: "glossary", src: glossarySrc, dst: filepath.Join(paths.InputsDir, "glossary.yml"), source: glossaryInput.Source},
 	} {
 		checksum, err := copyFileIfChanged(env.ArtifactStore, cfgFile.src, cfgFile.dst)
 		if err != nil {
 			return nil, fmt.Errorf("prepare: materialize %s: %w", cfgFile.kind, err)
 		}
-		registerInput(cfgFile.kind, cfgFile.dst, checksum)
+		registerConfigInput(cfgFile.kind, cfgFile.dst, checksum, cfgFile.source)
 	}
 
 	if useS3Audio {
@@ -195,6 +233,31 @@ func renderResolvedPipeline(cfg *config.PipelineConfig) ([]byte, error) {
 	return yaml.Marshal(cfg)
 }
 
+func stableInputSource(resolved config.ResolvedInputFile, fallbackPath, fallbackConfigPath string) config.ResolvedInputFile {
+	if strings.TrimSpace(resolved.Path) != "" || strings.TrimSpace(resolved.ConfigPath) != "" || strings.TrimSpace(resolved.Source) != "" {
+		if strings.TrimSpace(resolved.ConfigPath) == "" {
+			resolved.ConfigPath = fallbackConfigPath
+		}
+		if strings.TrimSpace(resolved.Source) == "" {
+			resolved.Source = "session_config"
+		}
+		return resolved
+	}
+	return config.ResolvedInputFile{
+		Path:       fallbackPath,
+		ConfigPath: fallbackConfigPath,
+		Source:     "session_config",
+	}
+}
+
+func resolveConfigRelativePath(input config.ResolvedInputFile) (string, error) {
+	basePath := strings.TrimSpace(input.ConfigPath)
+	if basePath == "" {
+		return "", fmt.Errorf("source config path is required")
+	}
+	return resolvePath(filepath.Dir(basePath), input.Path)
+}
+
 func resolveAudioInputs(sessionDir string, inputs config.SessionInputsConfig) ([]string, bool, error) {
 	hasLocal := strings.TrimSpace(inputs.AudioDir) != "" || len(inputs.AudioFiles) > 0
 	if inputs.AudioS3 != nil {

internal/stage/prepare_test.go

@@ -35,6 +35,7 @@ func TestPrepareStageExplicitAudioFiles(t *testing.T) {
 
 	paths := sessionPathsForEnv(env, m.SessionID)
 	for _, p := range []string{
+		filepath.Join(paths.InputsDir, "campaign.yml"),
 		filepath.Join(paths.InputsDir, "session.yml"),
 		filepath.Join(paths.InputsDir, "pipeline.resolved.yml"),
 		filepath.Join(paths.InputsDir, "speakers.yml"),
@@ -48,8 +49,8 @@ func TestPrepareStageExplicitAudioFiles(t *testing.T) {
 		}
 	}
 
-	if len(m.Inputs) != 7 {
+	if len(m.Inputs) != 8 {
-		t.Fatalf("manifest inputs len = %d, want 7", len(m.Inputs))
+		t.Fatalf("manifest inputs len = %d, want 8", len(m.Inputs))
 	}
 	for _, in := range m.Inputs {
 		if in.Checksum == "" {
@@ -151,6 +152,64 @@ func TestPrepareStageIdempotent(t *testing.T) {
 	}
 }
 
+func TestPrepareStageRecordsLocalSessionProvenance(t *testing.T) {
+	env, m := setupPrepareEnv(t)
+	root := filepath.Dir(env.Config.SessionPath)
+	writeFile(t, filepath.Join(root, "audio", "a.flac"), "a")
+	env.Config.Session.Inputs.AudioFiles = []string{"./audio/a.flac"}
+
+	if _, err := (prepareStage{}).Run(context.Background(), env, m); err != nil {
+		t.Fatalf("prepare.Run() error = %v", err)
+	}
+	sessionInput := findManifestInput(t, m.Inputs, "session_config")
+	if sessionInput.Source != "session_config" {
+		t.Fatalf("session source = %q, want session_config", sessionInput.Source)
+	}
+	if sessionInput.S3Bucket != "" || sessionInput.S3Key != "" || sessionInput.SpoolPath != "" {
+		t.Fatalf("local session input has unexpected remote provenance: %#v", sessionInput)
+	}
+}
+
+func TestPrepareStageRecordsRemoteSessionProvenance(t *testing.T) {
+	env, m := setupPrepareEnv(t)
+	remoteSessionPath := filepath.Join(t.TempDir(), "downloaded-session.yml")
+	writeFile(t, remoteSessionPath, "session_id: 2026-05-03\ninputs:\n  audio_s3:\n    prefix: audio/\n")
+	env.Config.SessionPath = remoteSessionPath
+	env.Config.Session.Inputs.AudioDir = ""
+	env.Config.Session.Inputs.AudioS3 = &config.SessionAudioS3Input{Prefix: "audio/"}
+	env.Config.SessionSource = config.SessionSource{
+		Source:    "session_config.s3",
+		LocalPath: remoteSessionPath,
+		S3Bucket:  "my-dnd-archive",
+		S3Key:     "dnd/campaigns/sample-campaign/sessions/2026-05-03/session.yml",
+		S3Size:    58,
+		S3ETag:    "session-etag",
+		SpoolPath: remoteSessionPath,
+	}
+	env.Config.Pipeline.Spool = config.SpoolConfig{Root: filepath.Join(t.TempDir(), "spool")}
+	env.Config.Pipeline.Storage.S3 = &config.StorageS3Config{Bucket: "my-dnd-archive", RootPrefix: "dnd"}
+	m.RunID = "20260515T031522Z-a1b2c3d4"
+	m.LocalWorkDir = artifacts.SessionRunRootForCampaign(env.Config.Pipeline.Workspace.Root, "sample-campaign", m.SessionID, m.RunID)
+	m.LocalSpoolDir = artifacts.SessionSpoolAudioDir(env.Config.Pipeline.Spool.Root, "sample-campaign", m.SessionID, m.RunID)
+	fake := &storage.FakeBackend{}
+	fake.SeedObject(storage.FakeObject{Key: "dnd/campaigns/sample-campaign/sessions/2026-05-03/audio/alice.flac", Data: []byte("alice")})
+	env.ObjectStore = fake
+
+	if _, err := (prepareStage{}).Run(context.Background(), env, m); err != nil {
+		t.Fatalf("prepare.Run() error = %v", err)
+	}
+	sessionInput := findManifestInput(t, m.Inputs, "session_config")
+	if sessionInput.Source != "session_config.s3" {
+		t.Fatalf("session source = %q, want session_config.s3", sessionInput.Source)
+	}
+	if sessionInput.S3Bucket != "my-dnd-archive" || sessionInput.S3Key != "dnd/campaigns/sample-campaign/sessions/2026-05-03/session.yml" {
+		t.Fatalf("remote session input missing bucket/key: %#v", sessionInput)
+	}
+	if sessionInput.S3Size != 58 || sessionInput.S3ETag != "session-etag" || sessionInput.SpoolPath != remoteSessionPath {
+		t.Fatalf("remote session input missing metadata: %#v", sessionInput)
+	}
+}
+
 func TestPrepareStageS3AudioDownloadAndMaterialization(t *testing.T) {
 	env, m := setupPrepareEnv(t)
 	env.Config.Session.Campaign = "forsaken"
@@ -473,8 +532,15 @@ func setupPrepareEnv(t *testing.T) (*Env, *manifest.Manifest) {
 
 	sessionPath := filepath.Join(cfgDir, "session.yml")
 	pipelinePath := filepath.Join(cfgDir, "pipeline.yml")
+	campaignPath := filepath.Join(cfgDir, "campaign.yml")
 
 	writeFile(t, pipelinePath, "workspace:\n  root: "+workspace+"\n")
+	writeFile(t, campaignPath, `campaign: sample-campaign
+inputs:
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+`)
 	writeFile(t, sessionPath, "session_id: 2026-05-03\n")
 	writeFile(t, filepath.Join(cfgDir, "speakers.yml"), "alice: alice.flac\n")
 	writeFile(t, filepath.Join(cfgDir, "autocorrect.yml"), "[]\n")
@@ -482,16 +548,32 @@ func setupPrepareEnv(t *testing.T) (*Env, *manifest.Manifest) {
 
 	cfg := &config.Config{
 		Pipeline:     &config.PipelineConfig{Workspace: config.WorkspaceConfig{Root: workspace}},
+		Campaign:     &config.CampaignConfig{Campaign: "sample-campaign"},
 		SessionPath:  sessionPath,
+		CampaignPath: campaignPath,
 		PipelinePath: pipelinePath,
 		Session: &config.SessionConfig{
 			SessionID: "2026-05-03",
 			Campaign:  "sample-campaign",
 			Inputs: config.SessionInputsConfig{
 				AudioDir: "./audio",
-				SpeakersFile:    "./speakers.yml",
+			},
-				AutocorrectFile: "./autocorrect.yml",
+		},
-				GlossaryFile:    "./glossary.yml",
+		StableInputs: config.ResolvedStableInputs{
+			SpeakersFile: config.ResolvedInputFile{
+				Path:       "./speakers.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
+			},
+			AutocorrectFile: config.ResolvedInputFile{
+				Path:       "./autocorrect.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
+			},
+			GlossaryFile: config.ResolvedInputFile{
+				Path:       "./glossary.yml",
+				ConfigPath: campaignPath,
+				Source:     "campaign_config",
 			},
 		},
 	}
@@ -519,3 +601,14 @@ func snapshotInputs(inputs []manifest.InputRecord) map[string]string {
 	}
 	return out
 }
+
+func findManifestInput(t *testing.T, inputs []manifest.InputRecord, kind string) manifest.InputRecord {
+	t.Helper()
+	for _, input := range inputs {
+		if input.Kind == kind {
+			return input
+		}
+	}
+	t.Fatalf("manifest input kind %q not found in %#v", kind, inputs)
+	return manifest.InputRecord{}
+}

internal/stage/transcribe_test.go

@@ -233,8 +233,10 @@ func setupTranscribeEnv(t *testing.T, audioFiles []string) (*Env, *manifest.Mani
 
 	sessionPath := filepath.Join(cfgDir, "session.yml")
 	pipelinePath := filepath.Join(cfgDir, "pipeline.yml")
+	campaignPath := filepath.Join(cfgDir, "campaign.yml")
 	writeFile(t, sessionPath, "session_id: 2026-05-03\ncampaign: sample-campaign\n")
 	writeFile(t, pipelinePath, "workspace:\n  root: "+workspace+"\n")
+	writeFile(t, campaignPath, "campaign: sample-campaign\ninputs:\n  speakers_file: ./speakers.yml\n  autocorrect_file: ./autocorrect.yml\n  glossary_file: ./glossary.yml\n")
 	writeFile(t, filepath.Join(cfgDir, "speakers.yml"), "alice: alice.flac\n")
 	writeFile(t, filepath.Join(cfgDir, "autocorrect.yml"), "[]\n")
 	writeFile(t, filepath.Join(cfgDir, "glossary.yml"), "[]\n")
@@ -243,7 +245,9 @@ func setupTranscribeEnv(t *testing.T, audioFiles []string) (*Env, *manifest.Mani
 	concurrency := 2
 	cfg := &config.Config{
 		PipelinePath: pipelinePath,
+		CampaignPath: campaignPath,
 		SessionPath:  sessionPath,
+		Campaign:     &config.CampaignConfig{Campaign: "sample-campaign"},
 		Pipeline: &config.PipelineConfig{
 			Workspace: config.WorkspaceConfig{Root: workspace},
 			WhisperX: config.WhisperXConfig{
@@ -265,6 +269,11 @@ func setupTranscribeEnv(t *testing.T, audioFiles []string) (*Env, *manifest.Mani
 				GlossaryFile:    "./glossary.yml",
 			},
 		},
+		StableInputs: config.ResolvedStableInputs{
+			SpeakersFile:    config.ResolvedInputFile{Path: "./speakers.yml", ConfigPath: campaignPath, Source: "campaign_config"},
+			AutocorrectFile: config.ResolvedInputFile{Path: "./autocorrect.yml", ConfigPath: campaignPath, Source: "campaign_config"},
+			GlossaryFile:    config.ResolvedInputFile{Path: "./glossary.yml", ConfigPath: campaignPath, Source: "campaign_config"},
+		},
 	}
 
 	env := &Env{