Update COPYRIGHT and LICENSE contents to align with the house standard

.gitignore

@@ -1,6 +1,5 @@
 # ---> Codex
 .codex
-AGENTS.md
 
 .DS_Store
 
@@ -52,4 +51,3 @@ pipeline.yml
 
 # Built Visual Studio Code Extensions
 *.vsix
-

.woodpecker/release.yml

@@ -2,39 +2,26 @@ when:
   - event: tag
 
 steps:
-  - name: build-release-assets
-    image: golang:1.25
+  validate-release:
+    image: golang:1.26.7
+    commands:
+      - ./scripts/check-release-candidate.sh "$CI_COMMIT_TAG"
+
+  build-release-assets:
+    image: golang:1.26.7
+    depends_on:
+      - validate-release
     commands:
       - |
         set -eu
+        case "$PWD" in
+          /*) ;;
+          *) echo "release workspace must have an absolute path" >&2; exit 1 ;;
+        esac
+        ./scripts/build-release-assets.sh "$CI_COMMIT_TAG" "$PWD/dist"
 
-        version="$CI_COMMIT_TAG"
-        dist="dist"
-        pkg="gitea.maximumdirect.net/eric/narratio/cmd/narratio"
-
-        rm -rf "$dist"
-        mkdir -p "$dist"
-
-        build_binary() {
-          goos="$1"
-          goarch="$2"
-          suffix="$3"
-          output="$dist/narratio-$version-$goos-$goarch$suffix"
-
-          CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" \
-            go build -trimpath -ldflags "-s -w -X gitea.maximumdirect.net/eric/narratio/internal/buildinfo.Version=$version" \
-            -o "$output" "$pkg"
-        }
-
-        build_binary linux amd64 ""
-        build_binary linux arm64 ""
-        build_binary darwin amd64 ""
-        build_binary darwin arm64 ""
-        build_binary windows amd64 ".exe"
-        build_binary windows arm64 ".exe"
-
-  - name: publish-release
-    image: woodpeckerci/plugin-release
+  publish-release:
+    image: woodpeckerci/plugin-release:0.3.1
     depends_on:
       - build-release-assets
     settings:
@@ -42,6 +29,8 @@ steps:
         from_secret: GITEA_RELEASE_TOKEN
       files:
         - dist/narratio-*
+      title: Narratio ${CI_COMMIT_TAG}
+      note: docs/releases/${CI_COMMIT_TAG}.md
       checksum: sha256
       checksum-file: SHA256SUMS
       checksum-flatten: true

.woodpecker/shuffle.yml

@@ -0,0 +1,8 @@
+when:
+  - event: cron
+
+steps:
+  shuffled-race-tests:
+    image: golang:1.26
+    commands:
+      - go test -race -shuffle=on -count=3 ./...

.woodpecker/verify.yml

@@ -0,0 +1,47 @@
+when:
+  - event: [push, pull_request]
+
+steps:
+  tests:
+    image: golang:1.26
+    commands:
+      - go test ./...
+
+  race-tests:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go test -race ./...
+
+  static-analysis:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go vet ./...
+
+  build:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go build ./...
+
+  documentation-and-examples:
+    image: golang:1.26
+    depends_on: tests
+    commands:
+      - go test ./internal/doccheck
+      - go test ./internal/config -run '^TestExamplesLoadAndValidate$'
+
+  cross-build:
+    image: golang:1.26
+    depends_on: [race-tests, static-analysis, build, documentation-and-examples]
+    commands:
+      - |
+        set -eu
+        output_dir="$(mktemp -d)"
+        trap 'rm -rf "$output_dir"' EXIT
+        for target in linux/amd64 linux/arm64 darwin/arm64; do
+          goos="${target%/*}"
+          goarch="${target#*/}"
+          CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" go build -o "$output_dir/narratio-$goos-$goarch" ./cmd/narratio
+        done

AGENTS.md

@@ -0,0 +1,5 @@
+Please review `docs/development.md` for initial orientation in this repository
+and follow its task-specific reading guide.
+
+Review and follow `docs/policy/agents.md` before recommending, planning, or
+implementing any changes to this repository.

COPYRIGHT

@@ -0,0 +1,19 @@
+Narratio
+
+Copyright (C) 2026 Eric Rakestraw
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+Narratio is free software: you can redistribute it and/or modify it
+under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+The GNU General Public License version 3 is provided in LICENSE.
+
+Narratio is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Lesser General Public License for more details.
+
+Third-party code and assets are subject to their respective license terms.

LICENSE

@@ -1,232 +1,674 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
-
-Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-Preamble
-
-The GNU General Public License is a free, copyleft license for software and other kinds of works.
-
-The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
-
-Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-TERMS AND CONDITIONS
-
-0. Definitions.
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on the Program.
-
-To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
-
-1. Source Code.
-The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
-A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-2. Basic Permissions.
-All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
-Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
-
-4. Conveying Verbatim Copies.
-You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
-
-5. Conveying Modified Source Versions.
-You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
-
-6. Conveying Non-Source Forms.
-You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
-A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
-
-7. Additional Terms.
-“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
-
-8. Termination.
-You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
-
-9. Acceptance Not Required for Having Copies.
-You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
-
-10. Automatic Licensing of Downstream Recipients.
-Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
-An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
-
-11. Patents.
-A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
-In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
-A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
-
-12. No Surrender of Others' Freedom.
-If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
-
-13. Use with the GNU Affero General Public License.
-Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
-
-14. Revised Versions of this License.
-The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
-
-15. Disclaimer of Warranty.
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. Limitation of Liability.
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-17. Interpretation of Sections 15 and 16.
-If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
-     narratio
-     Copyright (C) 2026  eric
-
-     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-
-     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
-If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
 
-     narratio  Copyright (C) 2026  eric
-     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
 
-The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
 
-You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
 
-The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -27,7 +27,7 @@ This requires resolvable `pipeline.yml`, `campaign.yml`, and concrete
 - [Integration contracts](docs/integrations/) — external tools, formats, and
   compatibility expectations.
 - [Maintained examples](examples/README.md) — complete copyable configuration
-  and input files.
+  and input files, including the production/testing split bundle.
 
 ## Maintainer Documentation
 

docs/cli.md

@@ -12,12 +12,15 @@ This runs the canonical full pipeline for session `2026-04-04`.
 
 Top-level commands:
 
-- `run <session_id>`: run full stage order.
+- `version`: print the Narratio build version.
+- `run <session_id>`: run all or one contiguous range of the canonical stage order.
+- `regenerate-artifacts <session_id>`: force-run extraction through analysis.
 - `run-stage <stage> <session_id>`: run one stage.
 - `analyze <session_id>`: force-run analyze.
 - `publish <session_id>`: force-run publish.
 - `clean <session_id>` or `clean --all`: remove local work/spool state.
 - `session <subcommand>`: session helper commands.
+- `config <subcommand>`: validate, display, source-trace, catalog, or compare resolved pipeline configuration.
 
 Session subcommands:
 
@@ -41,13 +44,26 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
+- `--overlay <name>`
+- `--secrets-dir <directory>`
 
 Rules:
 
 - `--campaign` and `--campaign-file` are mutually exclusive.
 - `--session` is not used by `session init`.
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
+- `--previous-session-id` is a strict expectation: the selected session file
+  must contain the same `previous_session_id`.
+- `--overlay` selects `overlays/<name>.yml` relative to the pipeline root. It
+  may be supplied once; omitted, empty, and the exact name `default` select the
+  base configuration, while an unknown named overlay fails. The same selection
+  applies to all common-flag commands, including `regenerate-artifacts`.
+- `--secrets-dir` selects ConfigKit credential-file bootstrap explicitly. A
+  relative value uses caller CWD. Without the flag, a present `secrets/`
+  directory beside the resolved root pipeline is used; an absent one is skipped.
 - `clean --all` cannot be combined with campaign/session selectors.
+- notification delivery is currently limited to the configured `noop` mode; see
+  the [configuration reference](./config.md#notifications).
 
 ## Session ID Input Rules
 
@@ -66,21 +82,144 @@ Commands with additional positionals keep their command-specific order:
 
 ## Command Reference
 
+### `config validate`, `config show`, `config sources`, `config artifacts`, and `config diff`
+
+```bash
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
+```
+
+These commands resolve the selected overlay, defaults, ordinary paths, and—if
+a campaign is selected—the campaign-owned party. They neither discover or load
+a session nor create a workspace, manifest, run, lock, adapter, or remote
+connection. Like every pipeline-loading command, they bootstrap the selected or
+conventional secrets directory before resolving configuration; `config show`
+never includes bootstrap reports or secret values in its YAML output.
+Typed credential references, including `notarius.credentials[]`, must therefore
+resolve even though these inspection commands never construct an adapter.
+
+Campaign selection is optional for a pipeline without party-driven artifact
+families. A pipeline with `scriptorium.artifact_families` needs a selected or
+configured default campaign so Narratio can expand its concrete artifacts and
+publish rules. `--campaign` and `--campaign-file` remain mutually exclusive.
+Session, range, force, and artifact-execution flags are not accepted.
+
+`config validate` writes a concise root-path, selected-overlay (or `none`), and
+effective-digest summary after successful complete validation. `config show`
+writes one deterministic, secret-free YAML document containing defaulted and
+expanded concrete configuration. It omits ConfigKit directives, artifact
+family declarations, and runtime provenance.
+
+`config sources` reports the same fully validated resolution without printing
+effective values. Its header identifies the root, ordered imports, selected
+overlay and its file, selected campaign, party source, and digest. The
+remaining tab-separated records are sorted as `path`, `role`, and `source`.
+Roles distinguish root, import, overlay, centralized default, campaign, party,
+and generated family ownership. A generated party member has
+one family record and one party record at the same logical path. The output
+never reads or prints secret values.
+
+`config artifacts` prints the concrete catalog used by analysis, ordered by
+artifact key. Its tab-separated header is `key`, `source`, `definitions`,
+`enabled`, `output`, `dependencies`, `family`, `character`, `family_source`, and
+`party_source`. Definitions and effective dependencies are sorted comma-separated
+lists, and control characters in fields are escaped. Family-member rows identify
+their family, character, defining family file, and party file. An empty catalog
+prints only the header. Ordinary artifacts can be inspected without a campaign;
+party-driven families retain the campaign requirement. See
+[Scriptorium Artifact Entries](./config.md#scriptorium-artifact-entries) for the
+configuration layout.
+
+`config diff` resolves both supplied overlay names independently and compares
+their fully resolved, secret-free effective mappings. It does
+not accept `--overlay`; the two positional names must be distinct, valid
+overlays. When party-driven families are present, both overlays must resolve to
+the same selected campaign and party. Use `--campaign-file` if overlay-specific
+campaign configuration would otherwise select different files.
+
+Equal overlays print `no differences`. Otherwise, sorted tab-separated records
+use one of these forms, with compact JSON values:
+
+```text
+added    <path>    <right-value>
+removed  <path>    <left-value>
+changed  <path>    <left-value>    <right-value>
+```
+
+Mappings are flattened to their logical field paths; lists remain one atomic
+value. The command compares defaulted concrete artifacts and publish rules, not
+overlay names, source-file layout, or formatting. It succeeds when differences
+are found, making it suitable for review and migration checks.
+
+### `version`
+
+```bash
+narratio version
+```
+
+Official release binaries report their exact Git tag. Binaries built directly
+from source without release linker metadata report `dev`.
+
 ### `run`
 
 ```bash
-narratio run <session_id> [--force] [--artifacts <name[,name...]>] [...common config flags]
+narratio run <session_id> [--from <stage>] [--through <stage>] [--force] [--artifacts <name[,name...]>] [...common config flags]
 ```
 
 Behavior:
 
-- evaluates full stage order;
-- runs `extract` between `trim` and `render`; an omitted or disabled Notarius
+- evaluates one inclusive contiguous range of the canonical stage order;
+- defaults an omitted `--from` to `prepare` and an omitted `--through` to
+  `cleanup`, so omitting both retains full-pipeline behavior;
+- rejects unknown endpoints and a `--from` endpoint after `--through`;
+- runs `render` before `extract`; an omitted or disabled Notarius
   configuration records an explicit `notarius_disabled` self-skip;
+- resolves every selected typed credential during the initial configuration
+  load, including Notarius credentials when extract is disabled, outside the
+  selected range, or later skipped as resumable;
 - skips already-succeeded stages unless `--force` is set or a stage-specific
   resume check finds its durable result obsolete;
+- applies `--force` only to stages in the selected range;
+- rejects repeated `--from`, `--through`, or `--force` options, including
+  `--name=value` spellings;
 - continues interrupted or partially completed sessions by running non-succeeded stages;
-- writes session and run manifests.
+- writes the session manifest as the sole durable progress ledger. Each
+  invocation also creates its run-local directory and returns an immediate
+  command summary; neither creates another durable progress record.
+- reports the resolved overlay (or `none`) and effective configuration digest.
+
+When `--artifacts` is present, the selected range must contain `analyze` or
+`publish`. Either consumer is sufficient, including a one-stage range.
+
+### `regenerate-artifacts`
+
+```bash
+narratio regenerate-artifacts <session_id> [--artifacts <name[,name...]>] [...common config flags]
+```
+
+Exactly equivalent to:
+
+```bash
+narratio run <session_id> --force --from extract --through analyze [caller options]
+```
+
+The command always reruns extraction. Analysis rebuilds the selected configured
+artifacts and any prerequisites required by those targets; without
+`--artifacts`, it uses the normal default analysis selection. Publish and notify
+never run. Common session/configuration options and repeatable artifact values
+pass through unchanged.
+
+The forced extraction rebuilds the complete configured Notarius bundle,
+disables Notarius checkpoint loading, and requests chunk-plan refresh.
+`--artifacts` narrows only the analysis work; it never selects Notarius lanes.
+
+Because the expansion owns `--force`, `--from`, and `--through`, callers cannot
+supply those options. The shared `run` parser reports them as duplicate
+singleton flags. The alias has no private execution options or behavior, and
+runtime diagnostics may identify the operation as `run`.
 
 ### `run-stage`
 
@@ -96,11 +235,12 @@ Valid stage names:
 - `polish`
 - `normalize`
 - `trim`
-- `extract`
 - `render`
+- `extract`
 - `analyze`
 - `publish`
 - `notify`
+- `cleanup`
 
 Rules:
 
@@ -118,6 +258,10 @@ Equivalent to:
 narratio run-stage analyze <session_id> --force [...common config flags]
 ```
 
+This selects only `analyze`: it does not invoke Notarius, replace extraction,
+or remove existing extract outputs. `--artifacts` narrows the forced analysis
+targets and their required analysis prerequisites.
+
 ### `publish`
 
 ```bash
@@ -130,6 +274,10 @@ Equivalent to:
 narratio run-stage publish <session_id> --force [...common config flags]
 ```
 
+This command selects only `publish`; it does not invoke cleanup. Use a normal
+full run to include configured cleanup, or `run-stage cleanup` to retry cleanup
+from valid publication evidence.
+
 ### `clean`
 
 ```bash
@@ -143,16 +291,25 @@ Behavior:
 - `--all` removes all local session work and spool state;
 - cache remains unless `--clear-cache` is provided.
 
-See [Operations: Cleanup](./operations.md#cleanup) for deletion scope and
-post-publish cleanup behavior.
+See [Operations: Cleanup](./operations.md#cleanup) for manual and pipeline-stage
+deletion scope.
 
 ### `session plan`
 
 ```bash
-narratio session plan <session_id> [--force] [...common config flags]
+narratio session plan <session_id> [--from <stage>] [--through <stage>] [--force] [--artifacts <name[,name...]>] [...common config flags]
 ```
 
-Validates config, prepares local workdir layout, and prints run/skip decisions for each stage.
+Uses the same inclusive bounds, endpoint validation, force scope, and artifact
+selection contract as `run`. It validates config and prints run/skip decisions
+for selected stages only without creating the local workdir or changing the
+manifest. Resume-capable selected stages are checked against durable evidence.
+The output includes the resolved overlay (or `none`) and effective configuration
+digest without writing provenance or any manifest state.
+For `analyze`, the preview also lists explicit targets, prerequisite-only work,
+execution order, and reusable current artifacts with concise reasons. These
+artifact decisions come from the same reconciliation and work planner used by
+execution; the preview does not predict output identities.
 
 ### `session validate`
 
@@ -160,7 +317,8 @@ Validates config, prepares local workdir layout, and prints run/skip decisions f
 narratio session validate <session_id> [...common config flags]
 ```
 
-Read-only preflight checks for config validity, required inputs, audio mode, previous-session requirements, publish outputs, and effective locks.
+Read-only preflight checks for config validity, required inputs, audio mode,
+previous-session requirements, publish outputs, and independent remote locks.
 
 ### `session status`
 
@@ -168,7 +326,13 @@ Read-only preflight checks for config validity, required inputs, audio mode, pre
 narratio session status <session_id> [...common config flags]
 ```
 
-Prints local manifest state and, when storage is available, remote current-state and published-output status.
+Prints local manifest state and, when storage is available, status for the
+pointer-selected remote commit and its declared published outputs. Current
+publish metadata reports `published`, `carried_locked`, `locked_unpublished`,
+`optional_missing`, and `unselected`; carried output lines include the run
+derived from their exact declared key, the key itself, and its declared
+destination. A separately displayed `dest` is the destination requested by the
+current configuration and may differ while an older declaration is locked.
 
 ### `session init`
 
@@ -187,6 +351,7 @@ Options:
 
 - `--config <pipeline.yml>`
 - `--campaign <id>` or `--campaign-file <campaign.yml>`
+- `--secrets-dir <directory>`
 - `--previous-session-id <id>`
 - `--date <YYYY-MM-DD>`
 - `--title <text>`
@@ -211,7 +376,8 @@ Behavior:
 - discovers committed remote current state;
 - plans local restores;
 - writes an execution report;
-- blocks conflicting overwrites unless `--force` is set.
+- blocks unresolved conflicts. `--force` permits replacement only of eligible
+  regular files.
 
 See [Operations: Restore Workflow](./operations.md#restore-workflow) for the
 default restore scope, report location, and conflict-handling workflow.
@@ -225,7 +391,8 @@ narratio session artifacts <session_id> [--remote] [...common config flags]
 Lists effective built-in, configured Scriptorium, and configured extraction
 sources; reports planned, available, unavailable, and published state without
 reading payload bodies; and includes publish rules, lock state, and optional
-remote published-state availability.
+remote published-state availability. Remote inspection uses exact commit
+declarations and displays the five current publish outcomes when recorded.
 
 ### `session locks`
 
@@ -237,23 +404,34 @@ narratio session locks remove <session_id> <source> [...common config flags]
 
 Behavior:
 
-- list mode reports the effective merge of static and remote locks;
-- add/remove mutate only remote locks;
-- static locks from pipeline config cannot be removed by CLI commands.
+- list mode validates and reports independent remote locks sorted by source;
+- add creates one lock and reports an existing lock unless `--force` is used;
+- `--force` performs one generation-matched replacement and reports a
+  concurrent change for operator retry; and
+- remove is idempotent and reports when the source was not locked.
 
 See [Operations: Publish Locks](./operations.md#publish-locks) for lock storage
-and precedence.
+and publication behavior.
 
 ## `--artifacts` Selection Rules
 
-- accepted on `run`, `run-stage`, `analyze`, and `publish`;
+An artifact-family key selects all of its concrete character members. A
+concrete generated key selects only that member; mixed family and concrete
+selection is deduplicated and executed as concrete keys. The resulting plan
+and command output identify both the concrete key and, where applicable, its
+family and character ID.
+
+- accepted on `run`, `session plan`, `run-stage`, `analyze`, and `publish`;
+- repeatable and comma-separated values are combined, surrounding whitespace
+  is removed, and duplicate names are collapsed;
 - names must exist in `pipeline.scriptorium.artifacts`;
 - empty entries are invalid;
-- repeated names are deduplicated.
+- on `run-stage`, only `analyze` and `publish` accept the option.
 
 Effects:
 
-- filters analyze execution to selected configured artifacts;
+- selects explicit analyze targets; required configured prerequisites may be
+  reused or rebuilt before them;
 - filters publish rules that source `narratio.artifact.<name>`;
 - does not filter built-in transcript/bounds or explicitly configured
   `narratio.extraction.<name>` publish sources; and
@@ -285,6 +463,12 @@ Force publish only:
 narratio publish 2026-04-04
 ```
 
+Regenerate post-transcript artifacts without publishing:
+
+```bash
+narratio regenerate-artifacts 2026-04-04 --artifacts session_recap,player_handout
+```
+
 ## Output And Exit Behavior
 
 - Successful commands write their result or summary to standard output and

docs/config.md

@@ -38,17 +38,162 @@ If local session discovery fails and a `session_id` is known, Narratio attempts
 
 using configured object storage.
 
+The downloaded remote session file is command-scoped: Narratio removes it after
+the command finishes and records only the remote object provenance alongside
+the durable copied session input.
+
+### Read-only effective pipeline inspection
+
+`narratio config validate`, `narratio config show`, `narratio config sources`,
+and `narratio config artifacts` use the same `--config`, `--campaign`,
+`--campaign-file`, and
+`--overlay` selection rules as pipeline commands, but do not select, discover,
+or load a session. They resolve configured typed credential references as part
+of the ordinary ConfigKit load but expose only their environment-variable names;
+they do not create runtime state.
+`narratio config diff <left-overlay> <right-overlay>` uses the same pipeline and
+campaign selectors, resolves each named overlay with an independent ConfigKit
+load, and does not accept a separate `--overlay` flag.
+
+Campaign selection is optional only when the resolved pipeline has no
+`scriptorium.artifact_families`. When families are declared, Narratio selects a
+campaign through an explicit flag or `pipeline.campaigns.default_campaign_id`,
+then parses the campaign-owned party and expands concrete artifacts and any
+family publish rules before validation. `config validate` prints the resulting
+root, overlay, and effective digest. `config show` emits the normalized
+effective pipeline YAML, with defaults and concrete expansion included but
+ConfigKit directives and family declarations omitted. This review projection is
+not promised to be a reloadable authoring document. `config sources` prints a stable
+source projection instead of effective values: root/import/overlay/default
+ownership plus campaign/party and generated-family records. Canonical derived
+players trace to the party. `config artifacts` lists the concrete artifact map,
+effective dependencies, and defining sources. The [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
+owns command syntax and output conventions.
+
+`config diff` compares normalized field values rather than YAML text or source
+ownership. It emits sorted `added`, `removed`, and `changed` records, uses
+compact deterministic JSON values, treats lists atomically, and reports `no
+differences` when the complete effective configurations are equal. Concrete
+family members and generated publish rules participate after expansion; moving
+an equal value between eligible root/import sources does not create a
+difference.
+
+### Migrating to the maintained bundle
+
+Use the [production/testing bundle](../examples/production-testing/pipeline.yml)
+as the complete copyable migration reference. Keep production settings in the
+base, split them into explicit additive imports, and place testing differences
+in the fixed `overlays/testing.yml` overlay. Put ordinary artifacts and families
+in the recommended one-definition files shown by that bundle. Convert campaign
+rosters to [canonical party input](integrations/party.md), then express character
+work as families. Inspect the result with `config validate`, `config show`,
+`config sources`, and `config artifacts`; use `config diff default testing` to
+review the overlay before running a session. Unversioned party documents are
+rejected.
+
+### Identity segments
+
+Campaign IDs (`campaign_id` and `default_campaign_id`), session IDs, previous
+session IDs, and Narratio run IDs are opaque portable segments. They must use
+only ASCII letters, digits, `.`, `_`, and `-`; empty values, `.`/`..`, path
+separators, drive forms, whitespace, control characters, and non-ASCII text are
+rejected. Narratio does not trim or rewrite these values. Existing manifests or
+remote state with an unsafe legacy identity must be migrated before use.
+
 ## Validation and Merge Rules
 
-- YAML decode is strict (`KnownFields(true)`): unknown fields fail load.
+- ConfigKit performs strict typed YAML decoding and accepts exactly one document;
+  unknown fields, duplicate keys, and trailing documents fail load.
+- A pipeline file may explicitly import additive YAML fragments through the
+  root-only `configkit.imports` list. Imported files contribute fields to one
+  logical pipeline document; they do not override fields supplied by the root
+  or another import.
+- An omitted overlay, an empty overlay option, and the exact name `default`
+  select the base configuration. Any other name selects
+  `overlays/<name>.yml` relative to the pipeline root. Move previously selected
+  `profiles/<name>.yml` files there; the old directory is not searched, and
+  `--profile` is no longer accepted for Narratio pipeline selection. Explicit
+  imports from a directory named `profiles` remain valid.
+- Campaign, session, and canonical-party documents are strict single-source
+  ConfigKit schemas. They do not enable imports, overlays, or `configkit`
+  directives.
+- Configured timeout and retry-delay durations must be positive. An omitted
+  artifact timeout continues to inherit its configured Scriptorium timeout.
 - Session files must be concrete; unresolved `{{ ... }}` placeholders fail load.
+- Session and party inputs inspected before typed loading are limited to 8 MiB.
 - Pipeline defaults are applied before validation.
+- Defaults apply only to absent fields. Explicit empty strings, zero values,
+  `false`, and `null` retain ConfigKit's typed meaning and are then checked by
+  Narratio domain validation; they are not silently replaced by defaults.
+  Explicit null optional stage sections stay absent, while required sections
+  fail validation.
 - Campaign and session identities must agree.
-- Stable files (`speakers_file`, `autocorrect_file`, `glossary_file`, `players_file`, `party_file`) resolve from session overrides when provided, otherwise from campaign defaults.
+- Required stable files (`speakers_file`, `autocorrect_file`, `glossary_file`,
+  `party_file`) are campaign-owned; the first three may be overridden by the
+  session. The optional `spell_catalog_file` also inherits a campaign value
+  when omitted by the session.
+- `party_file` is parsed when pipeline and campaign configuration are combined.
+  It must be a versioned [canonical party](integrations/party.md), is
+  campaign-owned and derives the players input internally. `players_file` and
+  session `party_file` are unsupported configuration keys.
 - Exactly one audio mode must be configured in session input:
   - local (`audio_dir` or `audio_files`), or
   - S3 (`audio_s3.prefix`).
 
+### Pipeline imports and overlays
+
+Large pipeline configurations may be split into explicitly named fragments and
+may use fixed-path selected overlays:
+
+```yaml
+configkit:
+  imports:
+    - path: config/storage.yml
+    - path: config/integrations.yaml
+
+campaigns:
+  root: /usr/local/share/narratio/campaigns
+```
+
+The maintained [production/testing bundle](../examples/production-testing/pipeline.yml)
+is a complete copyable example of this structure, including canonical-party
+artifact families.
+
+Imports are resolved relative to the directory containing the root pipeline
+file and are loaded in declaration order. Narratio does not scan directories or
+infer fragments. Each import must be a confined regular `.yml` or `.yaml` file:
+absolute paths, traversal, symlinks, directories, duplicate files, and an
+import of the root pipeline itself are rejected. Imported files cannot declare
+another `configkit` control section.
+
+Base merging is additive. A map may be extended by multiple files when every
+leaf is distinct, but a scalar, list, or map/list/scalar kind cannot be claimed
+more than once, even when the repeated values are identical. Conflict errors
+name the full field path and every source that claimed it. Narratio additionally
+rejects an artifact or artifact-family key declared by more than one base file,
+even when those files contribute disjoint children.
+
+Overlay names are case-sensitive and use ConfigKit's safe fixed-path naming
+rules. Only the selected overlay is opened; a malformed unselected overlay does
+not affect a base or different-overlay load. Maps merge recursively, overlay
+scalars replace base scalars, and overlay lists replace base lists completely.
+Explicit `false`, zero, empty strings, empty containers, and null values remain
+explicit inputs and are not refilled by defaults. Overlays cannot inherit,
+stack, import files, or declare another ConfigKit control section.
+
+During ConfigKit loading, Narratio applies fresh typed defaults, recorded
+entry-level defaults and normalization, read-only file-local validation, and
+ordinary path resolution before computing a deterministic effective
+configuration digest. The digest represents the normalized, secret-free
+runtime pipeline mapping; it excludes ConfigKit directives, source
+provenance, overlay identity, and raw environment secret values. Equivalent
+effective mappings therefore have the same digest regardless of how fields are
+split among the root and imports.
+
+An imported field has the same meaning it would have in a monolithic root
+pipeline. In particular, ordinary relative pipeline paths continue to resolve
+from the root pipeline directory, not from the importing fragment's directory.
+
 ## Minimal Working Configuration
 
 `pipeline.yml`
@@ -69,7 +214,6 @@ inputs:
   speakers_file: ./speakers.yml
   autocorrect_file: ./autocorrect.yml
   glossary_file: ./glossary.yml
-  players_file: ./players.yml
   party_file: ./party.yml
 ```
 
@@ -84,9 +228,31 @@ inputs:
 ## Secrets Handling
 
 - Do not place raw secrets in YAML.
-- Use env var names in config (for example `pipeline.audita.llm_api_key_env`).
-- Optionally load env files from `pipeline.secrets.env_dir`.
-- Commands that need storage/auth load filesystem secrets before constructing adapters.
+- Credential fields contain environment-variable names, represented internally
+  as ConfigKit typed secret references (for example
+  `pipeline.notarius.credentials: [NOTARIUS_LLM_API_KEY]`). A configured reference
+  must resolve to a nonempty environment value during load.
+- Every surviving reference is resolved during ordinary pipeline loading,
+  regardless of whether its integration is disabled, outside the selected
+  stage range, or eligible for resume. Omit the field or set it to `null` when
+  that deployment should not require the credential.
+- Every command that loads a pipeline accepts `--secrets-dir <path>`. When the
+  flag is omitted, Narratio uses a present `secrets/` directory beside the
+  resolved root `pipeline.yml`; an absent conventional directory is ignored.
+  Explicit relative paths are resolved from the caller's working directory,
+  and a missing or empty explicit selection is an error.
+- Each immediate regular file whose name is a valid environment-variable name
+  supplies one value. ConfigKit removes trailing CR/LF, permits a symlink as the
+  selected directory, rejects non-hidden symlink entries, and limits input to
+  1 MiB per file, 8 MiB total, and 1024 entries. Dot-prefixed entries (including
+  files, directories, and symlinks) are ignored and omitted from bootstrap
+  reports, but still count toward the directory entry limit.
+- An existing process environment value takes precedence over a credential file.
+- On POSIX, operators must provision the directory with no group/other access
+  (normally `0700`) and files with no group/other access (normally `0600`);
+  ConfigKit validates type and bounds but does not enforce permission modes.
+- Bootstrap happens once per command, before any configuration load or adapter
+  construction. Safe reports contain filenames, paths, and statuses, never values.
 
 ## Publish Configuration Summary
 
@@ -109,9 +275,6 @@ publish:
     - source: narratio.artifact.session_recap
       dest: artifacts/session_recap.md
       required: true
-  locks:
-    - source: narratio.artifact.session_recap
-      reason: manual post-publish edits
 ```
 
 Rules:
@@ -122,7 +285,8 @@ Rules:
   a rule names that source; the Notarius index and complete bundle are not
   publish sources.
 - `outputs[].required` defaults to `true`.
-- static locks (`pipeline.publish.locks`) merge with remote locks (`{session_prefix}/locks.yml`), with static locks taking precedence on duplicates.
+- publish locks are independent remote session objects managed with
+  `narratio session locks`; they are not pipeline configuration fields.
 
 ## Full Schema
 
@@ -130,21 +294,21 @@ Rules:
 
 | Field | Type | Required | Default / Rule |
 | --- | --- | --- | --- |
+| `configkit.imports[].path` | string | No | explicit additive pipeline fragment relative to the root pipeline directory; `.yml` or `.yaml` regular files only |
 | `pipeline.workspace.root` | string | No | `/var/lib/narratio` |
-| `pipeline.workspace.cleanup_after_publish` | bool | No | `false` |
+| `pipeline.workspace.cleanup_after_publish` | bool | No | `false`; selects the published run's workspace target for final cleanup and requires effective `pipeline.publish.enabled=true` and `pipeline.publish.upload_run=true` |
 | `pipeline.campaigns.root` | string | No | `/usr/local/share/narratio/campaigns` |
 | `pipeline.campaigns.default_campaign_id` | string | No | empty |
-| `pipeline.secrets.env_dir` | string | No | empty |
-| `pipeline.storage.backend` | string | No | empty |
-| `pipeline.storage.s3.bucket` | string | Conditional | required for S3 session-audio and for publish upload when backend is `s3` |
+| `pipeline.storage.backend` | string | No | `local`; supported values are `local` and `s3` (case-insensitive) |
+| `pipeline.storage.s3.bucket` | string | Conditional | required when backend is `s3` and S3 session-audio or publish upload is enabled |
 | `pipeline.storage.s3.root_prefix` | string | No | `dnd` |
 | `pipeline.storage.s3.region` | string | No | empty |
 | `pipeline.storage.s3.endpoint` | string | No | empty |
 | `pipeline.storage.s3.force_path_style` | bool | No | `false` |
-| `pipeline.storage.s3.access_key_id_env` | string | No | `OBJECT_STORAGE_KEY_ID` |
-| `pipeline.storage.s3.secret_access_key_env` | string | No | `OBJECT_STORAGE_KEY` |
+| `pipeline.storage.s3.access_key_id` | secret reference | Conditional | unset; must be paired with `secret_access_key` |
+| `pipeline.storage.s3.secret_access_key` | secret reference | Conditional | unset; must be paired with `access_key_id` |
 | `pipeline.spool.root` | string | No | `/var/spool/narratio` |
-| `pipeline.spool.delete_audio_after_publish` | bool | No | `false` |
+| `pipeline.spool.delete_audio_after_publish` | bool | No | `false`; selects the published run's spool-audio target for final cleanup and requires effective `pipeline.publish.enabled=true` and `pipeline.publish.upload_run=true` |
 | `pipeline.cache.root` | string | No | `/var/cache/narratio` |
 | `pipeline.cache.s3_audio` | bool | No | `true` |
 | `pipeline.publish.enabled` | bool | No | `true` |
@@ -153,10 +317,7 @@ Rules:
 | `pipeline.publish.outputs[].source` | string | Yes (per rule) | must reference built-in or configured artifact source |
 | `pipeline.publish.outputs[].dest` | string | Conditional | derived if omitted and source supports derivation |
 | `pipeline.publish.outputs[].required` | bool | No | `true` |
-| `pipeline.publish.locks[]` | list | No | empty |
-| `pipeline.publish.locks[].source` | string | Yes (per lock) | must reference supported publish source |
-| `pipeline.publish.locks[].reason` | string | No | empty |
-| `pipeline.whisperx.transcribe_url` | string | Yes | valid URL |
+| `pipeline.whisperx.transcribe_url` | string | Yes | absolute `http` or `https` URL |
 | `pipeline.whisperx.language` | string | No | `en` |
 | `pipeline.whisperx.timeout` | duration | No | `30m` |
 | `pipeline.whisperx.retries` | int | No | `3` |
@@ -173,19 +334,14 @@ Rules:
 | `pipeline.seriatim.env.filler_max_duration` | float | No | unset |
 | `pipeline.audita.binary` | string | No | `audita` |
 | `pipeline.audita.timeout` | duration | No | `3h` |
-| `pipeline.audita.llm_api_key_env` | string | No | empty |
-| `pipeline.audita.modules[]` | list[string] | No | empty |
-| `pipeline.audita.base_url` | string | No | empty |
-| `pipeline.audita.model` | string | No | empty |
-| `pipeline.audita.total_llm_concurrency` | int | No | unset |
-| `pipeline.audita.proposal_llm_concurrency` | int | No | unset |
-| `pipeline.audita.validation_model` | string | No | empty |
-| `pipeline.audita.validation_llm_concurrency` | int | No | unset |
+| `pipeline.audita.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Audita |
+| `pipeline.audita.modules[]` | list[string] | No | unset; omit to use Audita defaults, set `[]` for no modules |
+| `pipeline.audita.overlay` | string | No | empty; no downstream overlay override |
+| `pipeline.audita.proposal_profile` | string | No | empty; no downstream proposal-profile override |
+| `pipeline.audita.validation_profile` | string | No | empty; no downstream validation-profile override |
 | `pipeline.audita.transcript_description` | string | No | empty |
 | `pipeline.audita.config_path` | string | No | empty |
 | `pipeline.audita.output_schema` | string | No | empty |
-| `pipeline.audita.work_dir_retention` | string | No | empty |
-| `pipeline.audita.report` | bool | No | `true` |
 | `pipeline.normalize.output_path` | string | No | `transcripts/final.json` |
 | `pipeline.normalize.output_schema` | string | No | `seriatim-intermediate` |
 | `pipeline.normalize.report` | bool | No | `true` |
@@ -201,10 +357,15 @@ Rules:
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.notarius.enabled` | bool | No | `false` |
 | `pipeline.notarius.binary` | string | No | `notarius` |
+| `pipeline.notarius.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Notarius |
+| `pipeline.notarius.config_profile` | string | No | unset; exact Notarius ConfigKit profile selector |
 | `pipeline.notarius.config_path` | string | Conditional | required when enabled; relative paths resolve from the pipeline file directory |
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
 | `pipeline.notarius.timeout` | duration | No | `3h`; must be positive |
 | `pipeline.notarius.working_directory` | string | No | directory containing resolved `config_path`; relative paths resolve from the pipeline file directory |
+| `pipeline.notarius.resume` | bool | No | `false`; request compatible Notarius checkpoint reuse during ordinary executed extraction |
+| `pipeline.notarius.chunk_cache` | string | No | empty; when set, exactly `auto`, `bypass`, or `refresh` |
+| `pipeline.notarius.references` | map[string]string | No | empty; maps normalized Notarius selectors to supported prepared Narratio source IDs; maximum 256 entries |
 | `pipeline.notarius.outputs` | map | Conditional | at least one entry when enabled |
 | `pipeline.render.enabled` | bool | No | `true` |
 | `pipeline.render.format` | string | No | `markdown` (only supported value) |
@@ -217,9 +378,140 @@ Rules:
 | `pipeline.scriptorium.timeout` | duration | No | `10m` |
 | `pipeline.scriptorium.render_debug` | bool | No | `false` |
 | `pipeline.scriptorium.artifacts` | map | No | empty |
-| `pipeline.notification.backend` | string | No | empty |
-| `pipeline.notification.recipient` | string | No | empty |
-| `pipeline.notification.timeout` | duration | No | empty |
+| `pipeline.scriptorium.artifact_families` | map | No | empty; expands one ordinary artifact per canonical party character |
+| `pipeline.notification.mode` | string | No | `noop`; the only supported notification mode until a provider is implemented |
+
+### Audita Selection and Credentials
+
+`pipeline.audita.config_path` optionally passes an Audita v2 configuration file;
+when empty, Audita uses its own native config discovery. `overlay`,
+`proposal_profile`, and `validation_profile` are independent, optional Audita
+selectors. Empty or omitted strings add no command-line override. Narratio's
+selected pipeline overlay is never inferred as an Audita overlay, and Narratio
+does not create or validate Audita's backend or PromptKit profile files. Prepare
+them with [Audita's v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+
+Omit `modules` or set it to `null` to use Audita's configured default sequence.
+Set `modules: []` to run no correction modules. A nonempty list is passed in
+order, including repetitions. Narratio does not add a reporting or debug flag;
+Audita's external configuration controls those settings.
+
+`pipeline.audita.credentials` lists secret-reference names, not values. Narratio
+resolves every listed name during pipeline loading and forwards the captured
+nonempty value under that exact name to Audita. It does not inspect Audita's
+configuration to discover names or map them to aliases. Audita v2 resolves
+credentials for **all configured backends**, even ones not selected by the
+current profiles: list every named backend credential in the selected Audita
+configuration. An unauthenticated backend needs no reference. Omission, `null`,
+or `[]` forwards nothing. A Narratio overlay replaces the entire list, and
+`[]` clears it. See the [Audita integration contract](./integrations/audita.md)
+for the subprocess and redaction boundary.
+
+### Notarius Configuration Profile
+
+`pipeline.notarius.config_profile` optionally selects a Notarius ConfigKit
+configuration profile when extraction executes:
+
+```yaml
+notarius:
+  config_profile: downstream-economy
+```
+
+When the field is omitted or `null`, Narratio supplies no downstream profile
+selector and preserves Notarius's existing configuration-selection behavior.
+When present, Narratio forwards the exact string to Notarius, including an
+empty string or `default`, which explicitly select Notarius's composed base
+configuration. Notarius owns selector interpretation and validation; Narratio
+does not restrict profile names, resolve profile files, or rewrite the value.
+
+This selection is independent of Narratio's own `--overlay` selection. A
+Narratio overlay may explicitly select a differently named Notarius overlay,
+but Narratio never forwards its own overlay name automatically. It is also
+independent of `pipeline.notarius.credentials`: an overlay may change either or
+both fields according to the deployed Notarius configuration. See the
+[Notarius integration contract](./integrations/notarius.md) for invocation and
+failure behavior.
+
+### Notarius Credentials
+
+`pipeline.notarius.credentials` optionally lists environment-variable names
+to forward to the Notarius child process:
+
+```yaml
+notarius:
+  credentials: [OPENROUTER_API_KEY, ANTHROPIC_API_KEY]
+```
+
+The list contains variable names, not credential values. Those names must
+match the references used by the Notarius/PromptKit profiles that Notarius
+loads. Notarius owns profile lookup; Narratio neither infers those names nor
+remaps them. Omission, `null`, or `[]` forwards nothing. Each selected reference
+must resolve at pipeline load time through the process environment or existing
+secrets-directory bootstrap, even when Notarius is disabled, extract is outside
+the requested range, or a completed extraction can be reused.
+
+The Notarius child receives only Narratio's minimal execution environment plus
+these exact selected names and loaded values. Other credentials are not forwarded.
+Changing a value, name, presence, or absence does not invalidate extract's
+semantic resume evidence. The public names remain part of safe effective
+inspection, so renaming them may appear in `config diff` and change the effective
+configuration digest; rotating only their values does neither. An overlay
+replaces the whole list, including with `[]` to clear it.
+
+See the [Notarius integration contract](./integrations/notarius.md) for the
+delivery and redaction boundary.
+
+### Notarius Cache Controls
+
+`pipeline.notarius.resume` defaults to `false`. When true, an executed ordinary
+extraction passes `--resume`; the deployed Notarius configuration must already
+enable checkpoint recording and should select an explicit persistent checkpoint
+root. Narratio does not inspect or generate that configuration.
+
+`pipeline.notarius.chunk_cache` is empty by default, leaving Notarius's
+configured mode in control. A nonempty value must be `auto`, `bypass`, or
+`refresh` and is passed as `--chunk_cache`. Forced extraction takes precedence
+over both fields: it omits `--resume` and passes `--chunk_cache refresh`.
+Neither field changes Narratio's semantic extraction fingerprint, so changing
+them alone does not rerun an otherwise complete durable extraction.
+
+### Notarius Reference Bindings
+
+`pipeline.notarius.references` maps a Notarius CLI selector to a prepared
+Narratio source, not to a filesystem path:
+
+```yaml
+notarius:
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
+```
+
+Supported sources are `narratio.input.party`, `narratio.input.players`,
+`narratio.input.glossary`, and `narratio.input.spell_catalog`. Each map entry is
+required by its presence: omit a binding when the selected Notarius pipeline
+does not need it. A spell-catalog binding additionally requires an effective
+campaign or session `spell_catalog_file`.
+
+Selectors accept Notarius's `slot`, `chunk.slot`, `lane.slot`,
+`lane.extract.slot`, `lane.merge.slot`, and `lane.normalize.slot` forms.
+Narratio trims whitespace around
+selectors and their dot-separated components, rejects empty components and
+`=`, rejects duplicate normalized selectors, and limits the map to 256 entries.
+It validates only selector structure and the prepared source vocabulary;
+Notarius owns target-slot declarations and media compatibility.
+
+Before extraction, Narratio resolves every binding from the current prepared
+session manifest and streams it into a verified, content-addressed session
+snapshot whose absolute path is passed to Notarius. Missing, unsafe, empty,
+changed-during-copy, or checksum-inconsistent prepared evidence fails with
+guidance to force `prepare`. Bindings are sorted by normalized selector and are
+part of extraction fingerprint and resume identity. See the
+[Notarius integration contract](./integrations/notarius.md) for the subprocess
+boundary and the [complete example](../examples/pipeline.full.annotated.yml)
+for a copyable configuration.
 
 ### Notarius Output Entries
 
@@ -248,7 +540,7 @@ For each `pipeline.scriptorium.artifacts.<name>`:
 | Field | Type | Required | Rule |
 | --- | --- | --- | --- |
 | `enabled` | bool | No | `false` if omitted |
-| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; enabled graph must be acyclic |
+| `depends_on[]` | list[string] | No | explicit ordering-only edges; must reference configured artifact keys, may not self-reference, and join inferred input edges in one acyclic graph |
 | `render_debug` | bool | No | per-artifact override |
 | `prompt_id` | string | Conditional | required when artifact is enabled |
 | `profile_id` | string | No | empty |
@@ -259,41 +551,107 @@ For each `pipeline.scriptorium.artifacts.<name>`:
 
 Narratio adds `session_id=narratio-session-<session_id>` to every Scriptorium request for sticky upstream LLM routing. If an artifact config sets `vars.session_id`, Narratio replaces that value before invoking Scriptorium. Use a different variable name if a prompt needs the raw Narratio session ID as content.
 
+Without `--artifacts`, analyze executes enabled configured artifacts. With an
+explicit `--artifacts` list, the exact named configured artifacts are the
+one-invocation targets even if their `enabled` values are false. Analyze closes
+those targets over the effective dependency graph: a current prerequisite is reused, while a
+stale, missing, or failed prerequisite is rebuilt before its dependent.
+Unrelated artifacts are not executed. Named targets and any prerequisite that
+may require rebuilding must therefore have valid executable fields. This
+override affects analyze planning only; publish uses the list only to filter
+configured `narratio.artifact.<name>` output rules.
+
 For each artifact input `pipeline.scriptorium.artifacts.<name>.inputs.<input_name>`:
 
 | Field | Type | Required | Rule |
 | --- | --- | --- | --- |
 | `source` | string | Yes | built-in runtime source, prepared input source, `narratio.extraction.<name>`, `narratio.artifact.<name>`, or `narratio.previous_session.artifact.<name>` |
-| `artifact` | string | No | optional passthrough adapter field |
-| `path` | string | No | optional passthrough adapter field |
 | `required` | bool | No | optional input requirement |
 
+`artifact` and `path` are obsolete and rejected by strict configuration
+loading. Use the canonical `source` identifier to select the input; Narratio
+does not provide adapter-specific input passthrough fields.
+
+Each `narratio.artifact.<name>` input source automatically contributes an
+effective dependency on that configured artifact. Narratio unions these inferred
+edges with explicit `depends_on` entries, then trims, deduplicates, and sorts the
+result during final configuration resolution. Authors use `depends_on` only for
+ordering constraints that are not already expressed by an artifact input.
+Use [`narratio config artifacts`](./cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
+to inspect keys, definition sources, outputs, and effective dependencies without
+loading a session or creating runtime state.
+
+### Scriptorium Artifact Families
+
+`pipeline.scriptorium.artifact_families` declares a shared artifact template
+for every canonical campaign character. Configuration resolution expands each
+family into ordinary `pipeline.scriptorium.artifacts` entries before analyze
+planning or Scriptorium invocation. Party parsing rejects unsupported document
+schemas before family expansion.
+
+For each `pipeline.scriptorium.artifact_families.<name>`:
+
+| Field | Type | Required | Rule |
+| --- | --- | --- | --- |
+| `enabled`, `prompt_id`, `profile_id`, `timeout`, `render_debug`, `depends_on`, `inputs`, `vars` | ordinary artifact fields | No | copied to each generated artifact under the corresponding ordinary rules |
+| `for_each` | string | Yes | exactly `party.characters` |
+| `output_path_pattern` | string | Yes | safe path beneath `artifacts/` with exactly one `{character_id}` token and no other brace syntax |
+| `member_vars` | map | No | maps an ordinary Scriptorium variable name to a supported canonical character selector |
+| `member_dependencies` | list | No | unique family keys; each generated member depends on the corresponding generated member of each listed family |
+| `publish` | map | No | typed family publish policy (`enabled`, `required`, `dest_pattern`) expanded into concrete publish outputs when enabled |
+
+Generated keys are `<family>_<character_id>` and generated output paths must
+not collide with explicit artifacts or another generated artifact. Families
+expand even when disabled; normal analyze selection still omits disabled
+artifacts unless they are explicitly selected by their concrete key.
+
+Supported `member_vars` selectors are `character_id`, `player.name`,
+`character.name`, `character.class_summary`, and `character.alias_summary`.
+Their resolved values are strings. A member variable may not reuse a static
+`vars` name; `session_id` remains owned and overwritten by Narratio as for any
+other Scriptorium artifact.
+
+Within a family only, an input source may use
+`narratio.member_artifact.<family>`. Resolution rewrites the source to the
+corresponding ordinary `narratio.artifact.<family>_<character_id>` source and
+infers the concrete member dependency. Use `member_dependencies` only for
+additional same-character ordering constraints that are not already inputs.
+This syntax is rejected in explicit artifacts and never reaches runtime stages
+or Scriptorium.
+
+### Notifications
+
+Narratio currently supports only `notification.mode: noop`, which is also the
+default when the section is omitted. The notify stage performs no delivery in
+this mode. Backend, recipient, timeout, and other provider settings are
+rejected by strict configuration loading until Narratio has a provider
+integration.
+
 ### Campaign
 
 | Field | Type | Required | Notes |
 | --- | --- | --- | --- |
-| `campaign_id` | string | Yes | canonical campaign identity |
+| `campaign_id` | string | Yes | canonical opaque campaign identity |
 | `session_template_file` | string | No | used by `session init` when set |
 | `inputs.speakers_file` | string | Yes | stable input default |
 | `inputs.autocorrect_file` | string | Yes | stable input default |
 | `inputs.glossary_file` | string | Yes | stable input default |
-| `inputs.players_file` | string | Yes | stable input default |
-| `inputs.party_file` | string | Yes | stable input default |
+| `inputs.party_file` | string | Yes | stable campaign party source; relative paths resolve from `campaign.yml` |
+| `inputs.spell_catalog_file` | string | No | optional spell-catalog overlay default; required when a Notarius reference selects `narratio.input.spell_catalog` |
 
 ### Session
 
 | Field | Type | Required in session file | Notes |
 | --- | --- | --- | --- |
-| `session_id` | string | Yes | must match CLI session target when provided |
-| `previous_session_id` | string | No | must not equal `session_id` |
-| `campaign` | string | No | filled from `campaign_id` during resolve if omitted |
+| `session_id` | string | Yes | opaque identity; must match CLI session target when provided |
+| `previous_session_id` | string | No | opaque identity; must not equal `session_id` |
+| `campaign` | string | No | opaque identity; filled from `campaign_id` during resolve if omitted |
 | `date` | string | No | metadata |
 | `title` | string | No | metadata |
 | `inputs.speakers_file` | string | No | overrides campaign stable input |
 | `inputs.autocorrect_file` | string | No | overrides campaign stable input |
 | `inputs.glossary_file` | string | No | overrides campaign stable input |
-| `inputs.players_file` | string | No | overrides campaign stable input |
-| `inputs.party_file` | string | No | overrides campaign stable input |
+| `inputs.spell_catalog_file` | string | No | overrides the optional campaign spell catalog; empty or omitted inherits the campaign value |
 | `inputs.audio_dir` | string | Conditional | local audio mode |
 | `inputs.audio_files[]` | list[string] | Conditional | local audio mode |
 | `inputs.audio_s3.prefix` | string | Conditional | S3 audio mode |
@@ -301,6 +659,20 @@ For each artifact input `pipeline.scriptorium.artifacts.<name>.inputs.<input_nam
 Audio rules:
 
 - configure local mode (`audio_dir` or `audio_files`) or S3 mode (`audio_s3.prefix`), not both.
+- `audio_s3` requires `pipeline.storage.backend: s3` and a configured S3 bucket.
+
+### Storage backend selection
+
+`local` is the default and disables remote object-store operations. Configure
+`s3` explicitly before supplying `storage.s3`; a populated S3 block does not
+select a backend on its own. Unknown backend names and an S3 block paired with
+`local` are rejected during configuration validation.
+
+### Previous-session expectation
+
+`previous_session_id` is optional in a session file. When a command supplies
+`--previous-session-id`, however, the session file must contain the same value;
+an omitted or different value is rejected before the command performs work.
 
 ## Maintained Examples
 

docs/development.md

@@ -10,6 +10,15 @@ polished transcripts and generated artifacts. Start with the
 [Architecture](policy/architecture.md) for normative system boundaries, and the
 [Internal Overview](internal/overview.md) for implemented component ownership.
 
+Agents must read [Agent Policy](policy/agents.md) before recommending, planning,
+or implementing changes. It owns implementation discipline and the default
+commit-after-completed-work rule; it does not authorize pushing or releasing.
+
+## Go Prerequisite
+
+Maintained development and verification require Go 1.26. Use the official Go
+1.26 toolchain before running repository commands.
+
 ## What To Read
 
 | When working on | Read | Why |
@@ -25,19 +34,35 @@ polished transcripts and generated artifacts. Start with the
 | Adapters or external tool contracts | [Adapter Internals](internal/adapters.md) and [Integration Contracts](integrations/README.md) | The internal guide owns adapter composition and mechanics; integration documents own external formats and protocols. |
 | Manifests, artifacts, workspace paths, or publish behavior | [Manifest Internals](internal/manifest.md), [Artifact Internals](internal/artifacts.md), [Workspace Internals](internal/workspace.md), [Publish Internals](internal/stage-publish.md), and [Operations](operations.md) | These separate implementation state and resolution from operator-visible layout and lifecycle. |
 | Maintained configuration or input examples | [Configuration](config.md) and [Examples](../examples/README.md) | The reference owns field meanings; the examples directory owns complete copyable files. |
-| Proposed or unimplemented behavior | [Roadmap](roadmap/) | Future work belongs only in roadmap documentation until implemented. |
+| Preparing, validating, or publishing a release | [Release Policy](policy/release.md) and [Release Procedure](release.md) | Policy owns requirements and exceptions; the procedure owns concrete validation, guarded publication, and optional later inspection. |
+| Proposed or unimplemented behavior | `docs/roadmap/` | Future work belongs only in roadmap documentation until implemented. |
 
 For an existing subsystem, also inspect its focused tests and package-level
 contracts before changing behavior.
 
 ## Validation
 
-Use focused package tests while iterating. Run the repository-wide checks when a
-change affects shared contracts, application behavior, or maintained
-documentation examples:
+Use focused package tests while iterating. Every pull request and push runs the
+following repository-wide checks before it can be accepted:
 
 ```sh
 go test ./...
+go test -race ./...
 go vet ./...
-go build ./cmd/narratio
+go build ./...
+go test ./internal/doccheck
+go test ./internal/config -run '^TestExamplesLoadAndValidate$'
 ```
+
+The documentation check verifies local Markdown links and the dependency graph
+of the Woodpecker workflows. The configuration check loads every maintained
+pipeline and session example. Tag CI reuses this validation path before its
+asynchronous asset publication; the maintainer release boundary is documented
+in the [Release Procedure](release.md).
+
+Woodpecker also runs `go test -race -shuffle=on -count=3 ./...` on its scheduled
+job to expose ordering and repeatability defects. Current runners cross-compile
+the supported Linux amd64 and arm64 targets and the best-effort macOS arm64
+target. The macOS cross-build establishes compilation only, not native runtime
+evidence. Add a native check only when an official runner label and successful
+native-run evidence are available.

docs/integrations/README.md

@@ -21,6 +21,7 @@ focused stage documents.
 - [Audita](./audita.md): transcript polishing (`audita process`).
 - [Notarius](./notarius.md): complete pipeline execution and safe JSON bundle
   discovery (`notarius run`).
+- [Party](./party.md): canonical campaign roster input.
 - [Seriatim](./seriatim.md): merge, normalize, trim, and render operations.
 - [Scriptorium](./scriptorium.md): artifact generation and debug rendering
   (`scriptorium run|render`).

docs/integrations/audita.md

@@ -1,59 +1,54 @@
 # Integration: Audita
 
-## Purpose
-Define the Audita adapter contract used by the `polish` stage.
+Narratio invokes Audita v2's `process INPUT --glossary PATH --output PATH`
+subprocess for `polish`. The configured timeout and parent cancellation bound
+execution. Narratio passes explicit `--config`, `--overlay`,
+`--proposal-profile`, `--validation-profile`, `--transcript-description`,
+`--output-schema`, and `--modules` only when selected. An omitted module list
+leaves Audita's default sequence in place; `modules: []` passes an explicit
+empty argument and runs no correction modules. Order and repetitions are kept.
+Narratio passes no debug, work-directory, or reporting flags, leaving those
+choices to Audita's own configuration.
 
-## External Boundary
+Audita owns its ConfigKit file, backend and profile definitions, native config
+discovery, and their validation. Narratio does not create an Audita
+configuration or infer downstream overlay/profile names from its own selected
+pipeline overlay. An empty Narratio Audita selector adds no CLI override.
+The [configuration reference](../config.md#audita-selection-and-credentials)
+owns Narratio's fields and defaults. Audita's
+[v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+owns its downstream file format.
 
-Narratio invokes `audita process` as a subprocess for each polish operation.
-The configured timeout and parent cancellation bound the invocation. Internal
-runner composition is documented in
-[the adapter implementation guide](../internal/adapters.md).
+Each name in `pipeline.audita.credentials` is a ConfigKit secret reference
+resolved when Narratio loads the pipeline. Narratio forwards only the selected
+names and their captured, nonempty values under those exact names, in the
+minimal child environment; it never maps them to a fixed alias or rereads the
+parent environment. Every name is registered for captured stdout/stderr and
+failure-diagnostic redaction. Audita resolves credentials for all configured
+backends, including unselected ones, so operators must list every backend
+credential that its selected configuration needs. The downstream files and
+provider output remain Audita's responsibility, outside Narratio's
+captured-stream redaction boundary.
 
-## Request Contract
-`PolishRequest` carries:
-- required transcript/glossary/output/work-dir paths;
-- optional report path (required when report mode is enabled);
-- generated config and stdout/stderr log paths;
-- optional module/model/base-url/config/output-schema/concurrency settings.
+The corrected transcript is the only canonical polish output. A successful
+invocation must produce a valid JSON transcript with a top-level `segments`
+array within Narratio's 64 MiB bound. Exit zero is accepted even if Audita's
+ordinary reports describe recoverable model errors or no corrections. Narratio
+does not parse report status, counts, or Markdown. It discovers only
+`errors.yml`, `recoveries.yml`, and `report.md` next to the requested output,
+each subject to a 16 MiB read bound. Missing reports are allowed, for example
+when Audita reporting is disabled externally. Available reports are diagnostic
+references, not canonical artifact outputs. See Audita's
+[ordinary output contract](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/integrations/output-files.md)
+for their schemas, and [operations](../operations.md) for placement and
+publication.
 
-## Result Contract
-`PolishResult` returns:
-- processed transcript path;
-- optional report path;
-- work dir and generated-config/log paths;
-- exit code, duration, binary provenance;
-- adapter metadata map.
+On nonzero exit, Narratio preserves the original subprocess error and
+available run-local evidence; it never promotes a transcript merely because
+the file exists. The adapter returns safe paths, exit details, and selection
+metadata on failure. Narratio's `audita.generated.v2` YAML records the
+invocation, including arguments, paths, and credential names but never values;
+it is a diagnostic record, not a generated Audita config file.
 
-## Validation and Failure Semantics
-Construction fails for invalid static config values, including:
-- empty binary;
-- non-positive timeout;
-- invalid base URL;
-- invalid output schema;
-- invalid work-dir retention value;
-- invalid concurrency values.
-
-Run fails for:
-- missing required request paths;
-- missing required credential env var when configured (`llm_api_key_env`);
-- subprocess execution failure;
-- invalid processed transcript JSON (`segments` array required);
-- invalid report JSON when reporting is enabled.
-
-Failure results still include output/log/config/exit metadata for diagnostics.
-
-## Deterministic Behavior
-- CLI args are built from runner config + request in a fixed order.
-- Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
-- Manifest writes are stage-owned; adapter itself is stateless.
-
-## Configuration
-
-Operator-selected values are defined under `pipeline.audita.*` in the
-[configuration reference](../config.md#pipeline).
-
-Maintained example with Audita config:
-
-- [Full annotated pipeline](../../examples/pipeline.full.annotated.yml)
-- [Production-shaped pipeline](../../examples/pipeline.production.yml)
+Maintained Narratio examples: [full annotated pipeline](../../examples/pipeline.full.annotated.yml)
+and [production-shaped pipeline](../../examples/pipeline.production.yml).

docs/integrations/notarius.md

@@ -7,12 +7,14 @@ lanes from the final trimmed Seriatim transcript. Narratio owns invocation,
 safe bundle discovery, lane selection, and its own artifact metadata. Notarius
 owns pipeline definitions, lane schemas, the receipt, and bundle formats.
 
-Canonical Notarius references:
+Canonical Notarius v0.7.0 references:
 
-- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/consumers/subprocess.md)
-- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/consumers/dnd-pipeline.md)
-- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/integrations/run-result.md)
-- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/branch/main/docs/integrations/json-output.md)
+- [CLI reference](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/cli.md)
+- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/consumers/subprocess.md)
+- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/consumers/dnd-pipeline.md)
+- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/integrations/run-result.md)
+- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/integrations/json-output.md)
+- [D&D spell-catalog overlay](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/integrations/dnd-spell-catalog-overlays.md)
 
 The [complete Narratio example](../../examples/pipeline.full.annotated.yml)
 records the exact current constraints for all ten D&D lanes. Treat the linked
@@ -23,39 +25,137 @@ duplicate the complete schemas.
 
 When `pipeline.notarius.enabled` is true, Narratio resolves the executable,
 configuration path, input path, output directory, and working directory to
-absolute paths and invokes:
+absolute paths. Configured references require support for the `--reference`
+contract introduced in Notarius v0.6.0. Cache controls require support for the
+selected `--resume` and `--chunk_cache` flags. Notarius v0.7.0 is the tested
+cache integration baseline, not an unconditional minimum version; Narratio
+does not impose a runtime version gate. Each reference binding is a separate
+argument before `--json`. When `pipeline.notarius.config_profile` is present,
+its exact value is another argument pair before `--json`:
 
 ```text
-notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> --json
+notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--resume] [--chunk_cache <mode>] [--reference <selector>=<verified_snapshot_path>]... [--config-profile <name>] --json
 ```
 
+Notarius v0.7.0 is a known supporting version for `--config-profile`; using the
+option requires a compatible Notarius executable, but deployments that omit the
+field acquire no additional version requirement. Omitted or null configuration
+adds no flag. Supplied empty, `default`, and named selectors are forwarded
+without normalization so Notarius can apply its own ConfigKit semantics. This
+option selects a Notarius configuration overlay, not a PromptKit profile through
+`--llm-profile`, and Narratio never substitutes its own selected overlay name.
+A missing or invalid downstream overlay is an ordinary Notarius subprocess
+failure: Narratio does not retry without the selector or fall back to another
+profile.
+
+Reference paths are absolute stable snapshots streamed from manifest-verified
+canonical files prepared inside the current Narratio session workspace. They
+live at `cache/notarius/references/<sha256>/<prepared-basename>` and retain the
+full lowercase content digest. Narratio verifies snapshot checksum and size
+before and after the subprocess, reconstructs missing or corrupt regular files
+from a still-valid prepared source, and passes only configured bindings,
+ordered lexically by normalized selector, as direct argument-vector entries
+without shell interpretation. Symlinks, directories, other non-regular
+conflicts, and prepared-source mismatches fail rather than being deleted. A CLI
+binding takes precedence over a matching external path in Notarius
+configuration. Narratio never emits `--without-reference`.
+
+For canonical party configuration, the `party` binding is the unchanged,
+validated authored roster and the `players` binding is its generated
+projection. Both retain their established `narratio.input.party` and
+`narratio.input.players` source IDs, and both are resolved from the prepared
+manifest rather than from campaign configuration at extraction time.
+
+The maintained D&D boundary binds only the four campaign-owned external slots:
+
+```text
+notarius run dnd-session \
+  --config <absolute config path> \
+  --input <absolute trimmed transcript path> \
+  --output-dir <absolute staging directory> \
+  --reference glossary=<absolute verified glossary snapshot> \
+  --reference party=<absolute verified party snapshot> \
+  --reference players=<absolute verified players snapshot> \
+  --reference spell_catalog=<absolute verified spell catalog snapshot> \
+  --json
+```
+
+The spell-catalog binding is omitted when the campaign does not maintain that
+optional overlay. Registry, scene-description, combat-turn, and occurrence
+handoffs generated during the same Notarius run remain in Notarius pipeline
+composition and must not be emitted as CLI references. The linked CLI and D&D
+consumer documents own selector targeting, declared slots, media compatibility,
+and generated-handoff collision rules.
+
 Standard output is reserved for the JSON receipt. Standard error is captured
 separately as diagnostic output. Narratio applies the configured timeout and
 does not interpret stdout as a receipt unless the subprocess exits successfully.
 It does not pass a Narratio session ID or run `notarius config validate`
-automatically; the configured working directory and inherited environment
-apply to the subprocess.
+automatically; the configured working directory and Narratio's minimal child
+environment apply to the subprocess.
+
+Ordinary extraction maps `pipeline.notarius.resume: true` to `--resume` and a
+nonempty `pipeline.notarius.chunk_cache` to `--chunk_cache <mode>`. Forced
+extraction always omits `--resume` and supplies `--chunk_cache refresh`.
+Notarius owns checkpoint enablement, recording, identity, and both cache roots;
+Narratio neither reads nor synthesizes its configuration. Use explicit
+persistent roots in Notarius when reuse must span subprocess invocations.
+Changing a reference path/digest or other upstream identity input correctly
+causes a cold miss. Chunk refresh bypasses lookup and publishes the accepted
+replacement for the active source; it does not delete unrelated plans or
+checkpoint state.
+
+When `pipeline.notarius.credentials` is absent, null, or empty, Narratio adds no
+credentials to that environment. When configured, each list entry names an
+environment variable whose already-loaded nonempty value is forwarded under
+that exact name. Operators must use the names referenced by the selected
+Notarius/PromptKit providers. Narratio does not inspect the Notarius configuration
+to infer providers or destination names, and it does not forward unrelated
+credentials from its parent environment or secrets directory. A Narratio
+overlay replaces the whole credential list; `[]` clears it.
+
+Every selected name is registered with Narratio's shared streaming redactor.
+Credential bytes written by the child to captured stdout, captured stderr, or
+stderr-derived failure diagnostics are replaced with `<redacted>`, including
+custom names not known to the built-in sensitive-name list. Narratio does not
+serialize the credential into arguments, stage metadata, manifests, or
+generated configuration.
+
+This captured-stream protection is not a filesystem sandbox. Notarius remains
+responsible for keeping credentials out of files it writes directly, including
+bundle artifacts and its own diagnostics. Narratio does not scan or rewrite
+arbitrary downstream files and cannot promise redaction of transformed or
+encoded credentials.
 
 ## Accepted Result
 
-Narratio currently accepts receipt schema `notarius.run-result.v1`. The receipt
+Narratio's tested invocation baseline is Notarius v0.7.0. The accepted
+receipt remains `notarius.run-result.v2`; reference flags do not change the
+receipt or ten-lane output contract. The receipt
 must identify the configured pipeline, and its `index_file` must be exactly
 `index.json` beneath the reported bundle root. The production index must name
-the management files exactly as `manifest.json`, `rejected.json`, and
-`warnings.json`. All receipt, index, and lane paths must stay inside that
-bundle; symlinks and non-regular lane payloads are rejected.
+the management files exactly as `manifest.json`, `rejected.json`,
+`warnings.json`, and `diagnostics.json`. All receipt, index, and lane paths must
+stay inside that bundle; symlinks and non-regular lane payloads are rejected.
 
 Supported receipt and index shapes tolerate unknown fields for forward
 compatibility, while required identity, validation, count, manifest,
-rejection, warning, and lane-list fields remain mandatory. Narratio applies
-bounded reads to the receipt, index, rejection, and warning documents. Optional
-chunk-map and evidence-context descriptors must carry their complete generic
-contract metadata when present.
+rejection, warning, diagnostic, and lane-list fields remain mandatory.
+Narratio applies bounded reads to the receipt, index, rejection, warning, and
+diagnostic documents. Warning and diagnostic envelopes, group counts,
+occurrence counts, truncation state, framework-owned origins, and
+receipt-to-bundle counts must be internally consistent. Optional chunk-map and
+evidence-context descriptors must carry their complete generic contract
+metadata when present.
 
 For every entry in `pipeline.notarius.outputs`, Narratio requires exactly one
 index descriptor with the configured lane ID, media type, schema ID, schema
 version, and, when configured, module key. Missing, duplicate, rejected, or
-incompatible required lanes fail extraction even if Notarius exited zero.
+incompatible required lanes fail extraction even if Notarius exited zero. A
+configured lane whose v2 validation summary is `rejected` or `incomplete` also
+fails extraction.
+An accepted reused producer may report `producer_attempt_count: 0`; Narratio
+preserves that valid summary rather than treating it as a missing field.
 Unconfigured lanes may remain in the preserved bundle but do not become
 selectable Narratio sources.
 
@@ -72,12 +172,30 @@ only explicitly named lane sources; `--artifacts` never selects Notarius lanes.
   staged bundle is promoted to durable storage.
 - Contract and external provenance metadata are preserved on lane artifact
   records and through explicit publication.
+- Undeclared selectors, incompatible reference files, and external/generated
+  reference collisions are Notarius errors and fail extraction normally.
 
-Rejection and warning summaries retain structured stage, scope, lane, and
-reason-code fields for diagnostics without exposing free-form external messages
-or reading lane payload bodies.
+Rejection, validation, warning, and diagnostic summaries retain bounded stable
+identity, category, origin, reason-code, status, and occurrence fields without
+copying free-form external messages into Narratio manifest metadata or reading
+lane payload bodies.
 
 Configuration fields and defaults are in [Configuration](../config.md).
 Operator paths, rerun procedures, and bundle retention are in
 [Operations](../operations.md). See [Troubleshooting](../troubleshooting.md)
 for failure recovery.
+
+## Opt-in Integration Test
+
+The production-boundary cache test requires an absolute path to a locally
+built Notarius v0.7.0-compatible executable. It uses only a local
+OpenAI-compatible `httptest` provider and temporary cache/config/output roots:
+
+```sh
+NARRATIO_TEST_NOTARIUS_BINARY=/absolute/path/to/notarius \
+  GOWORK=off go test ./internal/stage \
+  -run '^TestNotariusCacheReuseIntegration$' -count=1 -v
+```
+
+When the variable is unset, the normal test suite skips this test and never
+searches `PATH`, a sibling checkout, the network, or a real provider.

docs/integrations/party.md

@@ -0,0 +1,71 @@
+# Canonical Party Input
+
+`party.yml` is a campaign-owned roster input. It must be a single, versioned
+`narratio.party.v1` document when Narratio resolves a pipeline, campaign, and
+session together.
+
+```yaml
+schema_version: narratio.party.v1
+
+characters:
+  arannis:
+    player:
+      name: Eric
+    character:
+      name: Arannis
+      alias:
+        - Ari
+        - The Grey Owl
+      classes:
+        - name: wizard
+          level: 8
+```
+
+`characters` is a non-empty mapping. Each key is a stable character ID using
+the configured-artifact key grammar: a lowercase ASCII letter followed by zero
+or more lowercase ASCII letters, digits, or underscores. Character order is
+preserved where roster order matters.
+
+Every entry has `player.name`, `character.name`, and a non-empty
+`character.classes` list. Class entries require a non-empty `name` and may
+include a positive integer `level`. The optional, intentionally singular
+`character.alias` field is a list. Names, aliases, and class names must be
+non-empty, trimmed display strings without control characters. Character names
+and aliases must be unique across the full roster under Unicode-aware
+case-insensitive comparison; player names may repeat.
+
+The document has exactly one YAML document and accepts no unknown fields.
+`schema_version` is required: a missing, wrong, or malformed value is an error.
+
+## Migration
+
+Unversioned party inputs are rejected. Replace each legacy party document with
+the versioned structure above, move each roster entry under `characters`, and
+remove separate player and session-party settings: those keys are unsupported.
+
+The configuration rules and source-relative path behavior are defined in the
+[Configuration Reference](../config.md).
+
+## Derived players document
+
+During `prepare`, Narratio copies the canonical party source bytes unchanged
+to `inputs/party.yml` and writes this deterministic players-only projection to
+`inputs/players.yml`:
+
+```yaml
+schema_version: narratio.players.v1
+players:
+    - name: Eric
+      character:
+        id: arannis
+        name: Arannis
+        alias:
+            - Ari
+            - The Grey Owl
+```
+
+There is one entry per character, sorted by stable character ID. Repeated
+player names remain separate entries. The optional `alias` list retains its
+declared order and is omitted when empty. The projection carries no class
+data. Its prepared manifest record is marked `derived_from_party`; it is not a
+separate user-provided `players_file`.

docs/integrations/scriptorium.md

@@ -46,6 +46,9 @@ Run behavior:
 - `run` exit code `2` is mapped to `ValidationFailed=true`;
 - successful subprocess still fails if output file is missing or empty.
 
+Each artifact result is limited to 64 MiB and must be a regular file without
+symlinked path components.
+
 Render behavior:
 - subprocess errors propagate;
 - output file must exist and be non-empty.

docs/integrations/seriatim.md

@@ -41,6 +41,8 @@ Invocation fails on:
 - empty render output files.
 
 When report paths are provided/enabled, report files must parse as JSON.
+Each Seriatim JSON or rendered-text result is limited to 64 MiB and must be a
+regular file without symlinked path components.
 
 ## Deterministic Behavior
 - argument ordering is deterministic per command construction.

docs/integrations/whisperx.md

@@ -17,6 +17,20 @@ Narratio sends an HTTP `POST` to the configured transcription URL using
 The server must return a `2xx` response whose body is valid JSON. Narratio does
 not currently require a more specific response schema at this boundary.
 
+The transcription URL must be an absolute `http` or `https` URL. Each
+application attempt creates one bounded multipart framing and streams the audio
+from an open file between that framing; it does not buffer the complete audio
+or spool a multipart copy. The file field precedes the language field.
+WhisperX response acquisition is capped at 10 MiB.
+
+The initial request body and any transport-requested replay use the same
+multipart boundary and framing. Every body opens an independent audio handle
+and replay starts at the beginning. Narratio closes all bodies created for the
+attempt on response, failure, timeout, or cancellation, including when a
+transport abandons an earlier body. Genuine source read/close failures remain
+request failures; deliberate early closure of an abandoned original does not
+poison a valid replay.
+
 ## Request And Result Contract
 
 Each adapter request identifies a speaker, a readable audio file, and the
@@ -38,9 +52,14 @@ transcript output.
 - Narratio waits the configured retry delay between attempts and aborts that
   wait when the parent context is canceled.
 
+Transport replay occurs inside one application attempt and does not consume an
+entry from the configured retry budget or increment the reported attempt
+count. The standard HTTP redirect policy remains in effect; body replay can
+also support body-preserving redirects.
+
 ## Validation And Failure Semantics
 
-Client construction rejects a missing or invalid absolute transcription URL,
+Client construction rejects a missing or non-HTTP(S) absolute transcription URL,
 a missing language, a non-positive timeout, negative retries, or a negative
 retry delay. A request fails before transmission when its audio or output path
 is missing.
@@ -50,12 +69,19 @@ failure to install the output causes the transcription to fail. Errors include
 attempt context, and the result retains attempts, final status when available,
 and elapsed duration for diagnostics.
 
+Replay makes a fresh request body available to the HTTP transport; it does not
+provide an exactly-once server guarantee and does not prove recovery from every
+proxy or protocol-level failure. A server may have received work before the
+client learns that a request failed. WhisperX operations should therefore be
+safe to retry for the same input when practical.
+
 ## Determinism And Concurrency
 
 Each audio request has stable multipart field names, and successful bytes are
 installed atomically. The transcribe stage may process speaker files in
-parallel, bounded by the configured concurrency. It records results in stable
-speaker order after all work completes; any speaker failure fails the stage.
+parallel, bounded by the configured concurrency. Each validated speaker is
+checkpointed independently; any speaker failure still fails the aggregate
+stage, while committed earlier speakers remain reusable on an ordinary retry.
 
 ## Related Canonical Docs
 

docs/internal/adapters.md

@@ -35,31 +35,78 @@ Adapters do not own:
 
 ## Default Wiring
 
-`internal/app/runner.go` initializes default adapters when not injected:
+The application composes default adapters per invocation when they were not
+injected through the stage environment, and only when the selected execution
+plan needs them:
 
-- WhisperX HTTP client from pipeline config.
-- Seriatim subprocess runner.
-- Audita subprocess runner.
-- Scriptorium subprocess runner.
-- Notarius subprocess runner when extraction is enabled.
-- Noop notifier (`notify.NoopSender`).
+- WhisperX HTTP client for `transcribe`.
+- Seriatim subprocess runner for `merge`, `normalize`, `trim`, or `render`.
+- Audita subprocess runner for `polish`.
+- Scriptorium subprocess runner for `trim` or `analyze`.
+- Notarius subprocess runner for `extract` when extraction is enabled.
+- Noop notifier (`notify.NoopSender`) for `notify`.
 - Object store only when required by selected stages/config.
 
-Notarius is composed only when extraction is enabled; the extract stage owns
-receipt, bundle, and configured-lane policy rather than the adapter.
+Remote publish locks are loaded only for a selected, enabled publish that
+uploads a run. Shared session lifecycle setup still applies to every selected
+range, but an unselected integration is neither initialized nor validated by
+application-owned composition. Constructor, clock, randomness, remote-lock,
+and post-publish deletion boundaries are scoped to the invocation; stages still
+receive their collaborators through the stage environment. Each selected stage
+retains its own fail-fast configuration and input validation.
 
-Object-store construction goes through `newCommandObjectStore`, which loads
-configured filesystem secrets before adapter initialization.
+`session plan` is outside production adapter composition. It performs
+resume validation and models selected transitions against cloned manifest
+state without constructing or invoking stage-execution adapters. The shared
+command configuration loader may still use object storage to retrieve a missing
+remote session file before planning begins.
+
+Notarius is composed only when extraction is enabled; the extract stage owns
+prepared reference resolution, receipt, bundle, and configured-lane policy.
+The adapter validates the ordered selector/absolute-path pairs and is the sole
+owner of serializing them as repeated `--reference` arguments before `--json`.
+It also serializes an effective resume request as `--resume` and a nonempty
+validated chunk mode as `--chunk_cache <mode>`. The extract stage, not the
+adapter, resolves force precedence before constructing the request.
+Its request may also carry already-resolved ConfigKit secret references.
+Audita's request carries the same kind of list. Both adapters use the shared
+subprocess helper to convert their selected references into exact-name child
+environment overrides and sensitive-name registration. That helper rejects
+unresolved or empty programmatic references, but neither adapter rereads the
+parent environment or inspects downstream configuration to discover names.
+Empty lists add no credential overrides. See the public [Audita](../integrations/audita.md)
+and [Notarius](../integrations/notarius.md) contracts for selection and
+downstream-file boundaries.
+
+Application-owned object-store construction loads configured filesystem
+secrets before invoking the invocation's storage factory. Production commands
+use the concrete storage adapter constructor; focused tests can supply an
+in-memory backend without changing package state.
 
 ## Failure Semantics
 
 - Constructor errors fail stage execution setup early.
 - Runtime adapter errors propagate to stage code and then manifest failure handling.
 - Subprocess adapters persist stage logs/generated configs through stage-managed paths.
+- Shared subprocess execution keeps private lifecycle mechanics separate from
+  Narratio's environment, diagnostics, redaction, and error policy. It starts
+  an owned process group on Linux and macOS. Every terminal path disposes of
+  that owned tree before returning. After a natural leader exit, the runner checks
+  for remaining group members and uses bounded graceful then forceful termination.
+  Cancellation, deadlines, and
+  diagnostic limits use the same terminal disposal path without losing their
+  original result classification. Child environments contain only the execution
+  baseline and adapter-specified values; configured credentials are resolved
+  once by ConfigKit and passed explicitly as sensitive values. Adapters do not
+  re-read their named environment references. Stdout and stderr are redacted while streaming into separate
+  8 MiB diagnostic captures; a bounded wait closes a stream retained by a
+  departed leader's descendant. Unsupported platforms reject owned command
+  execution.
 
 ## Implementation And Tests
 
-- Composition: `internal/app/runner.go`, `internal/app/object_store.go`
+- Composition: `internal/app/runner_composition.go`,
+  `internal/app/runner_dependencies.go`, `internal/app/object_store.go`
 - Shared subprocess mechanics: `internal/adapters/subprocess`
 - Focused adapters: `internal/adapters/{whisperx,seriatim,audita,scriptorium,notarius,storage,notify}`
 - `internal/adapters/whisperx/http_test.go`

docs/internal/artifacts.md

@@ -20,8 +20,8 @@ The internal registry recognizes these stable built-in source IDs:
 - `narratio.transcript.final_trimmed_markdown`
 - `narratio.bounds.session`
 
-Registry entries bind each ID to its producer, output kind, canonical fallback,
-and content validator. The focused stage documents own their input/output flow;
+Registry entries bind each ID to its producer, output kind, and content
+validator. The focused stage documents own their input/output flow;
 [Configuration](../config.md) owns where operators may select these IDs.
 
 ## Configured, Extraction, And Previous-Session Sources
@@ -30,23 +30,63 @@ and content validator. The focused stage documents own their input/output flow;
 - extraction source ID format: `narratio.extraction.<output_key>`
 - previous-session source ID format: `narratio.previous_session.artifact.<artifact_key>`
 
-All formats are validated by strict source-policy rules. Extraction sources are
-registered only from `pipeline.notarius.outputs`; the Notarius index has no
-selectable source ID.
+All formats are validated by strict source-policy rules. Configured artifact and
+extraction keys use `^[a-z][a-z0-9_]*$`; source parsers never normalize an
+unrecognized token into a valid source. Extraction sources are registered only
+from `pipeline.notarius.outputs`; the Notarius index has no selectable source
+ID.
+
+Prepared stable source IDs are `narratio.input.players`,
+`narratio.input.party`, `narratio.input.glossary`, and
+`narratio.input.spell_catalog`. Artifact policy owns their canonical manifest
+kind and prepared filename vocabulary. Canonical party mode preserves the
+party source bytes in the party record and supplies the players record from the
+deterministic `derived_from_party` projection; both remain ordinary prepared
+source IDs for consumers.
 
 ## Runtime Catalog
 
 `ArtifactCatalog` tracks:
 
 - `planned`: source registered for run context;
-- `executable`: selected and enabled for analyze execution;
-- `available`: local file exists and validates;
+- `executable`: included in the effective analyze artifact set;
+- `available`: the source's canonical evidence owner validates its current
+  manifest record and durable bytes;
 - `provenance`: availability source.
 
+Configured definitions are always registered. Without an explicit selection,
+the effective analyze set contains enabled definitions. With `--artifacts`, the
+exact named configured definitions become the effective set for that invocation,
+regardless of their `enabled` value. The effective-set resolver itself does not
+expand dependencies. Configuration has already materialized the sorted union of
+explicit ordering edges and configured-artifact input edges, and the analyze
+work planner closes targets over that one concrete prerequisite graph.
+Availability is separate from executability. Configuration may normalize a
+family selection into its concrete generated members before this resolver runs.
+The effective set retains optional family
+and character origin metadata, but its keys, catalog sources, and runtime
+lookups remain concrete configured-artifact identities.
+Family publish policies are likewise expanded into ordinary configured-source
+publish rules during configuration resolution.
+Configured outputs, including non-executable prerequisites, become available
+only when the versioned analyze state identifies a current result whose source,
+contract, canonical configured path, size, and checksum match a confined
+no-follow regular file. An incidental canonical file is unavailable, and a
+manifest with an unsupported aggregate-only representation is rejected before
+catalog construction.
+Extraction entries are registered from configuration and become available only
+after compatible extraction evidence is hydrated.
+
+During an analyze invocation, a newly validated and atomically materialized
+configured output is marked available with its producer run ID, contract,
+checksum, and size. Later scheduled dependents therefore observe the same
+semantic identity whether their prerequisite was reused from current manifest
+evidence or produced earlier in the invocation.
+
 Current provenance values:
 
 - `generated.current_analyze_run`
-- `filesystem.disabled_artifact_output`
+- `manifest.current_analyze_artifact`
 - `manifest.inputs.previous_cache`
 - `current_session.previous_cache`
 
@@ -54,27 +94,65 @@ Current provenance values:
 
 Built-ins:
 
-1. manifest producer outputs (when present)
-2. canonical session-path fallback
+- resolve only from the current manifest's succeeded registered producer;
+- require exactly one output with the registered source ID and output kind, a
+  safe session-rooted path, producer run ID, canonical checksum, and valid
+  content; and
+- verify the registered checksum against the durable bytes. Incidental files,
+  canonical filenames, duplicate outputs, failed/stale producer records, and
+  malformed evidence are unavailable.
 
 Configured sources (`narratio.artifact.*`):
 
-- resolve only through runtime catalog availability.
+- resolve only through runtime catalog availability;
+- use the shared typed analyze-evidence inspection in
+  `analyze_evidence.go` for prior current-session results;
+- require the supported analyze-state and fingerprint versions, a `current`
+  record for the exact configured key and source ID, a complete contract, the
+  configured canonical relative path, positive stored size, and stored
+  checksum matching bytes read from a confined no-follow regular file; and
+- treat non-current statuses, malformed records, removed keys,
+  unsafe or missing files, and size/checksum mismatches as unavailable without
+  rewriting manifest state. Catalog construction iterates current
+  configuration, so removed or renamed records are not advertised.
+
+`narratio.member_artifact.*` is not a runtime source family. Configuration
+resolution accepts it only in an artifact-family declaration and rewrites it
+to the corresponding configured source before this catalog is built.
+
+Prepared stable sources (`narratio.input.*`):
+
+- resolve only from the current manifest's exact prepared-input record;
+- require the policy-owned canonical path below the session root, a confined
+  non-symlink regular file, a non-empty payload, and a matching SHA-256
+  checksum; and
+- return an immutable source/path/checksum/size identity shared by extract and
+  analyze rather than falling back to campaign/session source paths.
 
 Extraction sources (`narratio.extraction.*`):
 
-- use the shared registration and manifest hydration path in
-  `extraction_catalog.go`;
+- use the shared typed bundle evidence inspection in `extraction_evidence.go`;
 - require a current successful extract record with the exact configured source,
   compatible contract and Notarius provenance, a confined regular durable
-  payload, and matching checksum; and
+  payload, matching checksum, and the current resolved trimmed-transcript
+  identity;
+- remain unavailable unless catalog hydration receives valid evidence. Resume
+  treats absent or obsolete evidence as a rerun decision and unsafe evidence as
+  an error; and
 - are never inferred by scanning the Notarius bundle directory.
 
 Previous-session sources (`narratio.previous_session.artifact.*`):
 
-- resolve only from local `previous/` cache state;
-- prefer manifest-backed previous-input paths;
-- fallback to existing previous-cache filesystem paths.
+- resolve only from one matching `previous_artifact` input record in the
+  current manifest, including its exact source ID and checksum;
+- are hydrated only from the unique `published_output` declaration for their
+  canonical source in the selected remote commit; and
+- never infer a path from a previous manifest, current configuration, basename,
+  or existing cache file.
+
+Source absence is evaluated by the consuming artifact input. An optional input
+is omitted from that invocation; a required input fails resolution. This is
+separate from a stage's lifecycle outcome.
 
 Validation by content type:
 
@@ -87,7 +165,7 @@ Validation by content type:
 
 `CollectPreviousArtifactRequirements`:
 
-- scans enabled configured artifacts only;
+- scans the effective configured artifact set;
 - extracts only canonical previous-session sources;
 - deduplicates by artifact key;
 - merges required and optional references (required wins);
@@ -98,17 +176,44 @@ Validation by content type:
 Artifacts package owns shared remote current-state loading mechanics used by
 restore, status and validation checks, and previous-cache planning.
 
+The selected session manifest is accepted only with
+`schema_version: narratio.session-manifest.v1` and complete stage identity.
+An unsupported local or downloaded manifest must be replaced by regeneration,
+verified restore, or republication; artifact resolution never fills in missing
+authority markers.
+
+For a new-protocol current state, the pointer-selected immutable commit is the
+complete restore authority. Callers receive its declared object identities and
+must not supplement them by listing mutable session prefixes.
+
+A `published_output` declaration must use a canonical publish-compatible source
+ID and an exact `runs/{run_id}/published/{destination}` key in the same session.
+Only this declaration type may refer to an earlier run; other declared objects
+remain confined to the selected commit's run.
+
+The reader opens each small control object directly and enforces owner-specific
+limits before decoding: 64 KiB for the mutable commit pointer, 4 MiB for the
+immutable commit manifest, and 8 MiB for the selected session manifest. These
+are exposed as `MaxCurrentCommitPointerBytes`,
+`MaxRemoteCommitManifestBytes`, and `MaxRemoteSessionManifestBytes`.
+
+Each read uses the generation and size metadata returned with its opened body.
+Actual bytes remain subject to a limit-plus-one read even if size metadata is
+absent or inaccurate. Immutable selections then retain their declared-size,
+checksum, generation, and identity checks. No current-state control object is
+downloaded through a temporary file. Artifact and previous-session downloads
+validate their complete sibling temporary file against available committed
+identity before replacing a canonical local path.
+
 Core helpers:
 
-- `LoadCurrentRunPointer`
-- `LoadCurrentManifest`
 - `LoadCurrentState`
 - `ValidateCurrentStateIdentity`
+- `RemoteCommitManifest` and `CurrentCommitPointer`
 
-Typed missing-state errors:
+Typed missing-state error:
 
-- `CurrentRunPointerMissingError` (`ErrCurrentRunPointerMissing`)
-- `CurrentManifestMissingError` (`ErrCurrentManifestMissing`)
+- `CurrentCommitPointerMissingError` (`ErrCurrentCommitPointerMissing`)
 
 Identity validation supports caller-provided expectations:
 
@@ -122,6 +227,21 @@ Caller policy is intentionally outside artifacts helpers:
 - some callers downgrade missing state to status/findings;
 - some callers skip optional behavior when state is missing.
 
+## Remote Lock Objects
+
+The artifacts package defines the independent remote-lock payload and identity
+contract. Each canonical publish source maps to one object below the validated
+session `locks/` prefix; its filename is the lowercase SHA-256 digest of the
+exact source followed by `.lock`.
+
+Lock payloads are strict versioned JSON containing the canonical source, an
+optional reason, and a UTC creation time. Reads are bounded to
+`MaxRemoteLockObjectBytes` (64 KiB), reject unknown fields and trailing values,
+and verify that the payload source matches the key digest. Exact lookup reports
+presence explicitly, prefix listing validates every object and sorts by source,
+creation uses an absence precondition, forced replacement uses one observed
+generation, and removal is idempotent.
+
 ## Key Path Helpers
 
 `internal/artifacts/paths.go` and S3-key helpers define canonical helpers for:
@@ -131,6 +251,23 @@ Caller policy is intentionally outside artifacts helpers:
 - spool/cache paths;
 - S3 session/run/current-state key layout.
 
+New publication creates run-scoped immutable objects, including
+`runs/{run_id}/commit.json` and `runs/{run_id}/session-manifest.json`. The sole
+mutable selector is `current/commit-pointer.json`; readers verify its selected
+commit and declared object generations/checksums.
+
+A `published_output` declaration may identify its commit's run or an earlier
+immutable run in the same campaign/session namespace. The key parser validates
+that namespace, rejects mutable and malformed keys, and derives the originating
+run from the exact declaration. All other commit artifacts remain confined to
+the commit's own run prefix.
+
+Campaign, session, and Narratio run IDs are validated as portable opaque
+segments at configuration and artifact boundaries before they can be used in a
+workspace or S3 namespace. Previous-artifact destinations remain typed,
+multi-segment relative paths and are confined beneath `previous/artifacts`; they
+are not treated as opaque identifiers.
+
 See [Workspace Internals](workspace.md) for how callers consume local helpers
 and [Operations](../operations.md#local-state-layout) for the authoritative
 physical layout.
@@ -148,8 +285,12 @@ physical layout.
 
 - Registry and resolution: `internal/artifacts/artifact_resolver.go`,
   `internal/artifacts/catalog.go`, `internal/artifacts/transcripts.go`,
-  `internal/artifacts/extraction_catalog.go`
-- Current state: `internal/artifacts/current_state.go`
+  `internal/artifacts/extraction_catalog.go`,
+  `internal/artifacts/extraction_evidence.go`,
+  `internal/artifacts/extraction_input.go`,
+  `internal/artifacts/prepared_input.go`
+- Current state: `internal/artifacts/current_state.go`,
+  `internal/artifacts/current_state_commit.go`,
 - Paths and keys: `internal/artifacts/paths.go`,
   `internal/artifacts/s3_keys.go`
 - Previous requirements: `internal/artifacts/previous_requirements.go`

docs/internal/command-restore.md

@@ -8,8 +8,13 @@ reporting flow in `internal/app`. User invocation belongs in
 physical restore scope belong in
 [Operations](../operations.md#restore-workflow).
 
-Restore is split into explicit phases so remote authority, local conflict
-policy, and filesystem mutation can be tested independently.
+Restore separates remote authority, local conflict policy, and filesystem
+mutation so each remains testable independently.
+
+The public command supplies production defaults to one private,
+invocation-scoped dependency value. Discovery, planning, and execution use that
+same value, so focused sequencing tests can replace one boundary without
+mutable package hooks.
 
 ## Discovery Contract
 
@@ -18,6 +23,7 @@ Discovery delegates current-state pointer and manifest loading to
 
 - campaign must match;
 - session ID must match.
+- run ID must match the pointer-selected committed run.
 
 Restore treats any missing or invalid remote current state as a command error.
 
@@ -31,13 +37,27 @@ Restore planner action kinds:
 
 Planner behavior:
 
-- remote list scope is the resolved session prefix;
+- a new-protocol restore uses only the selected commit's declared artifact set;
+  each action carries that artifact's immutable key, checksum, size, and
+  generation;
 - remote-to-local mapping is traversal-safe;
 - actions are sorted by local relative path and then remote key;
-- force converts differing local targets from conflicts to downloads.
+- planning opens the selected session root and inspects every target by its
+  normalized session-relative path. Missing ancestors produce a missing target;
+  an ancestor or leaf symlink is a non-regular conflict and is never opened for
+  hashing;
+- force converts differing eligible regular files from conflicts to downloads;
+  directories, symlinks, and other non-regular targets remain conflicts.
 
-Previous-cache files are planned separately through `previouscache.BuildPlan`
-when configured previous-session requirements exist.
+For a non-dry-run restore, planning/classification happens only after acquiring
+the session lock. Runner manifest/reuse checks acquire that same lock first.
+
+Previous-cache readiness is resolved through `previouscache.Resolve` for restore,
+prepare, status, and validation. Each requirement selects the unique
+`published_output` for its canonical source in the pointer-selected commit,
+then strips only that run's immutable `published/` prefix for its safe local
+cache path. It never probes candidate objects or derives paths from manifests,
+configuration, or basenames.
 
 ## Execution Contract
 
@@ -45,19 +65,40 @@ Execution order and safety:
 
 - non-manifest downloads happen before manifest install;
 - `manifest.json` installs last;
-- downloads use sibling temp files plus atomic rename;
+- downloads use sibling temp files, validate the complete object, then use an
+  atomic rename;
 - manifest replacement is validated before rename;
+- each committed object is verified against its declared checksum, size, and
+  generation before installation;
+- installation reopens the selected session root, creates only validated
+  missing directory components with workspace modes, and rejects symlinked or
+  non-regular ancestors and leaves before replacement;
+- a committed manifest already verified during discovery is retained for the
+  matching restore action and revalidated before installation, avoiding a
+  second body transfer;
 - failed installs do not roll back files already written in the same execution.
+- a durable `.restore-incomplete.json` marker is written before installation.
+  It blocks runners until a restore retry completes all verified installs and
+  the local manifest replacement, at which point it is removed.
+- restored manifest local references are rebased beneath the selected local
+  session root. Unsafe relative references and producer-machine absolute paths
+  outside the manifest's producer session root are rejected; producer-local
+  spool paths and run-local diagnostic references are not restored as
+  authority. Cleanup remains ordinary restored stage state and is not reset or
+  synthesized by restore.
 
 Audio restore path:
 
 - uses `audio.MaterializeS3Audio`;
 - integrates spool and S3 audio cache paths;
-- supports cache-hit reuse without object redownload.
+- reuses cached audio only when its opened regular file, content digest, and
+  identity sidecar all match the selected remote object version; otherwise it
+  refreshes through the validated download path.
 
 ## Reporting Contract
 
-- dry-run mode prints a summary and performs no local writes;
+- dry-run mode prints a summary, performs no durable session writes, and may
+  read remote current-state or object-identity data to produce that summary;
 - execution mode persists the canonical restore report described in
   [Operations](../operations.md#restore-workflow);
 - report includes plan counts, per-action status, and execution failures.
@@ -65,7 +106,11 @@ Audio restore path:
 ## Invariants
 
 - restore uses committed remote current state as authority;
-- `current/run_id.txt` is the remote publish commit marker;
+- one restore or status inspection observes the single pointer-selected commit
+  loaded at discovery; later pointer changes cannot add objects or substitute a
+  different run into its plan;
+- a verified `current/commit-pointer.json` and its selected immutable commit
+  establish remote commitment; when absent, republish the session;
 - restore does not execute pipeline stages.
 
 ## Implementation And Tests
@@ -78,4 +123,5 @@ Audio restore path:
 - Tests: `internal/app/restore_discovery_test.go`,
   `internal/app/restore_plan_test.go`,
   `internal/app/restore_execution_test.go`,
+  `internal/app/restore_recovery_test.go`,
   `internal/app/restore_workflow_test.go`

docs/internal/configuration.md

@@ -0,0 +1,216 @@
+# Configuration Internals
+
+User-visible fields, defaults, and selection behavior belong in the
+[Configuration Reference](../config.md). This document describes the internal
+pipeline-loading boundary implemented by `internal/config`.
+
+## Pipeline Loading
+
+`LoadPipeline` assembles and validates a pipeline in this order:
+
+1. Give ConfigKit a fresh typed `PipelineConfig` default value, the root file,
+   enabled imports, and the caller's overlay selection. Omitted, empty, and
+   exact `default` selections use the base; named overlays use the fixed
+   `overlays/<name>.yml` convention.
+2. ConfigKit parses the root and declared imports, additively merges base
+   sources, applies only the selected overlay, and strictly decodes the result.
+3. The definition resolver applies recorded entry-level and inherited defaults,
+   runs deterministic domain normalization, records derived publish destinations,
+   and resolves ordinary paths relative to the root pipeline file.
+4. The definition validator performs read-only checks that require only the
+   pipeline file. Checks requiring canonical-party family expansion remain at
+   the existing explicit pipeline/campaign resolution boundary.
+5. Narratio inspects public ConfigKit metadata to reject artifact and family keys
+   declared by multiple base files, adapts source ownership records, attaches
+   runtime-only state, and computes the normalized effective digest.
+
+This ordering preserves monolithic configuration behavior. Moving a field to
+an imported fragment changes its source ownership, not its path base, default,
+or schema semantics.
+
+## Loaded Context Resolution
+
+`LoadedPipelineCampaign` carries one already composed pipeline and its selected
+campaign into session resolution. `LoadSessionWithPipelineCampaignOptions`
+loads a local session against that context, while
+`ResolveLoadedPipelineCampaign` also accepts an already loaded remote session
+or no session while a caller retrieves one. Compatibility loaders route through
+these functions after their initial pipeline and campaign reads.
+
+Application commands own pipeline and campaign discovery, campaign-file versus
+registry selection, and the corresponding mutual-exclusion rules. Once they
+have a `LoadedPipelineCampaign`, local session discovery and remote-session
+download retain that exact pipeline object and its private provenance. Removing
+a temporary downloaded session file therefore cannot invalidate the resolved
+pipeline or campaign context.
+
+Campaign and session files use independent ConfigKit definitions with imports
+and overlays disabled. Campaign files normally load directly from their source;
+session files are first read through the 8 MiB bounded-read boundary because the
+application must reject unresolved template placeholders before passing an exact
+byte snapshot to ConfigKit. Local and remotely downloaded session bytes then use
+the same typed loader and retain the existing post-load identity expectations,
+stable-input precedence, and source-relative path semantics.
+
+The application also has a separate read-only inspection resolver for `config
+validate`, `config show`, `config sources`, and `config artifacts`. It uses the
+same production root, overlay, and campaign selection functions, but never routes
+through session discovery,
+remote-session download, adapter composition, workspace
+initialization, manifest access, or cleanup. A pipeline with retained artifact
+family declarations must resolve its selected campaign before ordinary pipeline
+validation, which expands its canonical-party members and generated publish
+rules. A pipeline without those declarations may be validated by itself.
+Secret-directory bootstrap remains invocation-scoped and happens before the
+ordinary ConfigKit load because explicit typed references must resolve even for
+inspection.
+
+`MarshalEffectivePipeline` is the configuration-owned projection for `config
+show`. It serializes one explicit typed safe projection with the existing YAML
+encoder. The projection has no slots for resolution-only artifact family
+declarations or private provenance. The result has one trailing newline;
+commands do not marshal runtime objects directly.
+
+`EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
+safe provenance projection for `config sources`. Pipeline ownership begins with
+the complete logical field paths projected from the schema and classifies
+each contributor as root, import, overlay, or centralized default. The
+projection replaces generated concrete member paths with paired family and
+canonical-party records, and does the same for generated publish rules.
+Campaign records identify campaign-owned fields and party inputs; canonical
+derived players point to the party source. The application command only joins these sorted
+records with selection metadata and never reparses configuration files.
+
+`EffectiveArtifactCatalog` projects the same finalized concrete artifact map for
+`config artifacts`. It derives source identity from each map key, carries sorted
+effective dependencies, aggregates ConfigKit definition contributors, and adds
+family/character/party provenance for generated members. It does not inspect
+files named after artifacts or infer another runtime graph.
+
+`config diff` uses a thin paired loader that performs two independent ConfigKit
+loads. When campaign
+resolution is needed, the command loads one selected campaign and party and
+expands both effective pipelines from that same party value. The configuration
+owner projects each normalized effective mapping directly from that same typed
+projection into sorted logical paths using JSON number preservation;
+mapping leaves are compared individually while sequence values remain atomic.
+Values are compact deterministic JSON representations for command output, not
+raw YAML fragments, ownership records, or secret material. A differing digest
+with no projected difference is treated as an internal consistency error.
+
+Campaign context construction reads the campaign-owned party source through
+`ParseParty`. The required canonical party retains its raw bytes and normalized
+roster in runtime-only `ResolvedParty` provenance. Canonical resolution creates
+a deterministic `derived_from_party` players projection. The party is the only
+configured roster authority; player and session-party fields are unsupported.
+
+## Canonical Party Domain
+
+`ParseParty` is the package-owned boundary for parsing a party source. Its
+single-source ConfigKit definition disables imports and overlays, requires
+`schema_version` through `VersionRule`, and strictly decodes the
+character-keyed typed schema before applying Narratio's party-domain checks.
+Successful metadata coordinates recover authored character-map order without a
+second YAML parse; class and alias slice order comes directly from typed decode.
+The canonical value retains a separate exact byte copy of its source so
+consumers can materialize the authored party document without reserializing it.
+Its `PlayersYAML` method deterministically derives the ID-sorted, versioned
+players-only projection.
+
+An unversioned source is rejected before resolution, family expansion, or
+prepare-stage materialization.
+
+## Validation Ownership
+
+Configuration validation remains within `internal/config`, with the public
+entry points and pipeline-domain sequencing separated from the private owners
+for core pipeline/session rules, external adapters, publish/storage, Notarius,
+Scriptorium, and shared scalar/path checks. These are package-local ownership
+boundaries rather than extension points or a general validation framework.
+
+Validation is read-only, fails fast, and does not define which of several
+independent invalid fields is reported first. Map-backed declarations are
+nevertheless traversed deterministically. Reusable domain normalization is an
+explicit preceding operation for both loaded and programmatically constructed
+pipelines. Notarius normalization commits canonical scalar, reference, and output
+values only after the complete normalization succeeds; its validator then checks
+that candidate without changing it. Scriptorium validates artifact declarations
+and outputs, dependencies and inputs, variables, referenced outputs, and the final
+dependency graph in deterministic artifact order.
+
+Diagnostics identify the relevant semantic field. Merge conflicts also
+retain every claiming source needed to correct an additive ownership conflict.
+Complete prose, punctuation, formatting, and private validation choreography are
+not compatibility contracts.
+
+## Diagnostics And Runtime Metadata
+
+Syntax, duplicate-key, merge, overlay, and schema failures include the
+relevant source name and full field path. Additive conflicts report every
+claiming source so operators can repair the split without repeatedly
+rediscovering additional conflicts.
+
+The loaded pipeline retains private runtime metadata for the absolute root
+path, ordered imports, selected overlay name, source, and path, original
+ConfigKit metadata and source snapshots, effective digest,
+and leaf ownership. Base
+leaves retain their root/import owners, replaced leaves belong to the selected
+overlay, and centrally supplied values use the synthetic `default` owner. This
+metadata does not participate in YAML decoding or alter the public
+configuration model.
+
+The effective digest is SHA-256 over a versioned deterministic JSON encoding of
+the same typed safe projection used by show and diff. Runtime Notarius paths remain absolute for
+execution, but the digest substitutes their normalized logical values captured
+before root-relative resolution, so relocating an equivalent configuration
+bundle does not change provenance. Because ConfigKit and resolution metadata
+are private, the digest excludes source layout, overlay name, and ownership.
+Configuration stores credentials as ConfigKit typed references. A successful
+load resolves their values inside the opaque typed boundary, while this safe
+projection serializes only `EnvName()` identities. Credential-value changes are
+therefore never hashed; reference-name changes remain ordinary provenance.
+The optional Notarius credential follows the same path even for disabled or
+resumable extraction; normalization copies the opaque reference without reading
+or resolving it again. Direct YAML serialization has a configuration-owned safe
+projection so only the reference name can leave this boundary.
+`recomputePipelineEffectiveDigest` is the single package-owned refresh point
+for later runtime expansion.
+
+## Test Surfaces
+
+`pipeline_configkit_test.go` exercises real imports and fixed-path overlays,
+base selection, unselected-overlay isolation, source attribution, and Narratio's
+unique artifact/family base-declaration rule. Existing focused configuration
+tests protect defaults, explicit-value semantics, strict decoding, validation,
+metadata, and root-relative path behavior. Application configuration-loader tests protect the
+single-read boundary by changing the pipeline file after its initial load and
+confirming local session resolution retains the original pipeline. Other
+configuration tests continue to protect defaults and validation after assembly.
+`party_test.go` protects the versioned typed party schema, domain invariants,
+authored character order, retained bytes, and deterministic players projection
+without involving campaign or runtime wiring.
+`party_resolution_test.go` protects campaign-owned party loading, canonical
+input restrictions, source provenance, and virtual players input selection.
+
+## Artifact Family Resolution
+
+Pipeline loading retains `scriptorium.artifact_families` as a resolution-only
+declaration. Once campaign party resolution establishes a canonical roster,
+configuration expands families in sorted family-key and character-ID order
+into ordinary `ScriptoriumArtifactConfig` values. The expansion owns the narrow
+`{character_id}` output substitution, closed member-variable selectors, key and
+output collision checks, and the runtime-only family-origin catalog. It then
+removes family declarations from `ScriptoriumConfig`, runs ordinary Scriptorium
+validation, and refreshes the effective pipeline digest. Stages and adapters
+therefore receive only concrete artifact maps.
+
+The catalog retains sorted family member keys plus family/character/source
+origins and the typed dependency/publish declarations for their later owners.
+`member_dependencies` add corresponding ordinary concrete dependencies, while
+the family-only `narratio.member_artifact.<family>` input form is rewritten to
+the matching ordinary configured-artifact source. The catalog records those
+resolved dependency and input identities with their declaring family and party
+member. No member-artifact source is registered as a runtime policy source.
+An enabled family publish declaration expands to ordinary configured-artifact
+publish rules before the existing publish and lock validators run. Runtime
+publication consequently receives no family wildcard or special matcher.

docs/internal/fileops.md

@@ -0,0 +1,55 @@
+# Internal: File Operations
+
+`internal/fileops` owns the narrow mechanics for atomically visible replacement of one
+byte file. Callers keep ownership of serialization, validation, cancellation,
+and destination-directory policy.
+
+## Destination Paths
+
+Ordinary workspace replacement uses standard operating-system path semantics.
+Callers with a root-scoped safety contract own that validation at their boundary.
+
+Remote object acquisition is owned by its domain caller. The caller writes a
+sibling temporary file, validates the complete result, and passes that file to
+`InstallSiblingTempFile` only when it is ready to become canonical. Callers own
+remote object selection, validation, conflict handling, and temporary-file
+cleanup.
+
+Directory bundles are not promoted by `internal/fileops`; extraction owns its
+validated Notarius bundle rename.
+
+## Cleanup Contract
+
+`RemoveAllUnderRoot` accepts an explicit root and a proper descendant, opens
+that root with `os.OpenRoot`, and removes the normalized root-relative target
+with `Root.RemoveAll`. It rejects root, traversal, and out-of-root targets; a
+missing target is successful. `RemoveFileUnderRoot` additionally requires an
+existing leaf to be regular. Command and post-publish policy remains owned by
+`internal/app`.
+
+## Bounded Reads
+
+`ReadFileBounded` opens a normal path and reads at most its caller-supplied
+limit. Credential mode policy and environment precedence remain owned by
+`internal/app`.
+
+## Replacement Contract
+
+`ReplaceFileAtomic` requires an existing destination directory. It creates a
+sibling temporary file, writes the complete byte sequence, applies the
+caller-supplied mode, closes the file, runs an optional pre-rename check, and
+replaces the destination with a rename.
+
+The pre-rename check is the last point at which a caller can cancel without
+installing a new destination. A failure before the rename leaves the old
+destination unchanged and removes the temporary file. Successful replacement
+provides atomic visibility; it makes no crash- or power-loss durability claim.
+
+Replacement follows the operating system's same-filesystem rename semantics.
+If a platform cannot replace an existing destination, the operation returns an
+error and never removes the old file as an emulation step.
+
+`WriteFileAtomic` and the copy helpers create the destination parent with the
+repository's workspace permissions. `InstallSiblingTempFile` requires the
+caller to provide an existing temporary file in the existing destination
+directory.

docs/internal/manifest.md

@@ -2,20 +2,45 @@
 
 ## Purpose
 
-Explain the session-progress and invocation-audit models implemented by
-`internal/manifest`. Physical manifest placement belongs in
+Explain the session-progress model implemented by `internal/manifest`. Physical
+manifest placement belongs in
 [Operations](../operations.md#local-state-layout).
 
 ## Session Manifest
 
 `manifest.Manifest` records:
 
+- required `schema_version: narratio.session-manifest.v1`
 - identity (`session_id`, `campaign`, `run_id`)
 - local path metadata (`local_workdir`, `local_spool_dir`)
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
 - `inputs` records
 - durable `artifacts` records
-- per-stage `stages` map
+- per-stage `stages` map, including the ordinary cleanup stage record
+
+Session, campaign, and run identities in local and downloaded manifests must be
+portable opaque segments. Unsafe legacy identities are rejected with migration
+guidance rather than being normalized into a different workspace or remote
+namespace.
+
+Decoding rejects unknown typed fields, including informational fields inside
+`effective_config` and its nested selection. The schema version remains
+`narratio.session-manifest.v1`; there is no compatibility reader that silently
+drops retired fields. See [overlay migration](../operations.md#migrating-manifest-overlay-provenance)
+for deliberate migration of retired selection provenance. Cleanup progress uses
+only the cleanup entry in `stages`.
+
+Every persisted session manifest has a non-nil `stages` map. Each entry is
+non-nil and its embedded `name` exactly matches its map key; loading never
+invents either marker. A missing or unsupported schema version, or incomplete
+stage identity, is unsupported local state: move it aside and regenerate it,
+or restore a verified current committed snapshot when that is authoritative.
+
+Prepare records independent `party` and `players` input checksums. In canonical
+party mode, the party record retains its campaign source identity while the
+players record uses `derived_from_party`; raw roster content is never embedded
+in manifest metadata. Both records remain the durable authority for consumers
+of their prepared input source IDs.
 
 The model admits these stage states:
 
@@ -27,74 +52,325 @@ The model admits these stage states:
 - `stale`
 - `interrupted`
 
-## Run Manifest
+### Transcribe-owned speaker state
 
-`manifest.RunManifest` is created for each invocation and records:
+A `transcribe` stage record may carry `transcribe_state_version: 1` and a
+`transcribe_speakers` map keyed by the existing derived speaker ID. The version
+is the authority marker: a versioned empty map means that no earlier speaker
+completion is reusable. Absence of both fields is accepted as legacy
+aggregate-only state so current Narratio can read older manifests.
 
-- invocation identity and `force` flag
-- requested stages
-- per-stage action (`run` or `skip`)
-- per-stage status
-- overall run status (`running`, `succeeded`, `failed`)
+Each map entry represents one completed speaker only. It binds a versioned
+fingerprint to the session-relative audio path, audio SHA-256 and size, one
+canonical `transcript_raw` output with its path, SHA-256 and size, and the
+producer run ID. Paths must be canonical and session-relative, checksums must
+be lowercase SHA-256 values, and the record and output producer identities
+must agree. Other stages cannot carry this transcribe-owned state.
+Audio size is nonnegative; WhisperX determines whether that audio can be
+transcribed. Output size remains positive and the transcript must be valid JSON.
+
+Transcribe reconciles this collection against the current prepared audio set
+and observable WhisperX semantics. Missing or corrupt regular outputs become
+work; unsafe or non-regular evidence is rejected. It saves the reconciled
+collection before HTTP dispatch and saves a detached candidate after each
+validated completion. Only after a save succeeds is the candidate installed as
+live authority. Canonical bytes produced before an unsuccessful save are not a
+completion record.
+
+Aggregate transcribe status still describes the whole invocation. A failed,
+running, stale, or interrupted aggregate may therefore retain reusable speaker
+records, while aggregate outputs are declared only after the current
+collection is complete. Ordinary retry reconciles and reuses those records.
+Force first checkpoints an empty current collection, preventing later retries
+from reviving pre-force results.
+
+Older aggregate-only transcribe success is conservatively regenerated once
+when transcribe is selected because it does not bind individual outputs to the
+audio bytes used. The session-manifest schema identifier remains
+`narratio.session-manifest.v1`; this additive state is accepted by current
+Narratio, but older strict-decoding binaries may reject manifests after these
+fields have been written.
+
+### Analyze-owned artifact state
+
+Every `analyze` stage record carries `analyze_state_version: 1` and an
+`analyze_artifacts` map keyed by normalized configured artifact key. The
+version is the authority marker: version 1 with no entries is a valid evaluated
+empty set. An absent or unsupported version is unsupported local state and is
+rejected rather than being treated as aggregate-only authority.
+
+Each analyze artifact record has one disposition:
+
+- `current`: the configured artifact is available and carries a versioned
+  fingerprint plus a complete output record and separate output size;
+- `stale`: the recorded semantic identity is no longer current;
+- `missing`: no validated current result exists;
+- `failed`: the attempted work failed and carries a bounded diagnostic; or
+- `unselected`: the artifact was intentionally outside the evaluated set.
+
+Records bind their normalized key and dependencies, fingerprint contract when
+evaluated, canonical session-relative output identity when current, producing
+Narratio run, update time, and bounded non-secret Scriptorium provenance and
+diagnostic paths. A current output includes its configured source ID, contract,
+checksum, and positive byte size. Non-current records cannot carry an output,
+so an older file is not advertised through stale, missing, failed, or
+unselected state.
+
+Family-produced records additionally retain optional `family` and
+`character_id` provenance supplied by configuration resolution. These fields
+do not replace the concrete configured key or infer family membership from a
+name, so older records without them remain valid.
+
+The session-stage collection is the reconciled authority across invocations.
+These records remain analyze-owned data inside the fixed stage; they are not
+dynamic stages or generic subtasks.
+
+Analyze checkpoints one complete validated candidate collection after each
+successful artifact and before exposing that artifact to later work. It saves a
+detached manifest candidate and installs its version, collection, and updated
+timestamp into live state only after the store reports success. Aggregate stage
+outputs are ordinary result outputs rebuilt in configured-key order from current
+session records only.
+
+Successful incremental execution replaces only evaluated artifact records and
+preserves valid unrelated current records. Rebuilt outputs are compared by
+bytes and contract: an unchanged identity permits an unselected dependent with
+the same recomputed fingerprint to remain current, while a changed identity
+removes output authority from every unselected transitive dependent by marking
+it stale. A partial analyze invocation can therefore succeed while unrelated
+configured records remain stale. Existing canonical files never create current
+records without validated execution and a successful checkpoint.
+
+Aggregate analyze status is deliberately coarser than this collection. Resume
+validation may skip a succeeded aggregate record when the selected artifact
+closure is current even if unrelated records are stale. Conversely, a stale
+aggregate record may cross the ordinary runner boundary and perform zero
+Scriptorium calls when reconciliation proves every selected artifact current;
+ordinary successful stage completion then restores the aggregate status.
+
+On an artifact error, analyze installs a complete retry collection on the live
+manifest before returning. The active record is failed without output, current
+transitive dependents are stale, unrelated current records survive, and only
+earlier checkpointed completions remain current. The runner's ordinary failure
+path marks aggregate analyze failed, clears aggregate outputs, invalidates
+delivery dependents, and saves that collection. A terminal session-save failure
+is joined with the original adapter, validation, filesystem, cancellation, or
+checkpoint cause.
+
+If an artifact checkpoint fails, analyze rolls its working collection back to
+the last committed collection before constructing the active failed record.
+Newly materialized canonical bytes therefore remain incidental and cannot
+become current authority. A later ordinary run reconciles the durable records,
+reuses earlier current artifacts, and resumes with the failed or stale work.
+The same recovery applies after process interruption: the aggregate record may
+be non-successful, but every completed artifact checkpoint remains reusable.
+
+## Remote Commit Manifest
+
+`artifacts.RemoteCommitManifest` is a separate, versioned remote snapshot
+contract. It is not a serialized session manifest and contains no local
+post-publication assertion such as `current_pointer_written`. A remote commit
+identifies one campaign, session, and run and declares its immutable artifact
+set. Each artifact has a typed source, immutable destination key, SHA-256
+checksum, size, and storage generation.
+
+`current/commit-pointer.json` is the sole mutable selector for the new
+contract. It identifies exactly one run-scoped `runs/{run_id}/commit.json` and
+binds that object by checksum, size, and generation. Readers strictly reject
+unknown fields, version mismatches, pointer/commit identity mismatches, and
+objects that do not match their declaration.
+
+An absent commit pointer means no remote state is published. Republish to
+establish a current immutable snapshot.
 
 ## Persistence Semantics
 
 `manifest.LocalStore`:
 
-- validates loaded documents;
-- normalizes missing maps/stage records;
-- writes atomically via temp file + rename;
+- accepts only the exact supported session-manifest schema version;
+- rejects unknown fields and multiple JSON values;
+- validates stage-map identity without synthesizing missing maps, records, or
+  names;
+- retains only representation-preserving collection normalization;
+- writes through a sibling temporary file and atomic replacement visibility;
 - updates `updated_at` on save.
 
+### Checkpoint persistence boundary
+
+Analyze and transcribe share one private checkpoint operation in
+`internal/stage`. Their typed callers still decide when to checkpoint, validate
+their collections, populate stage-owned fields, and serialize access. The
+shared operation copies the manifest and its checkpoint-relevant mutable
+collections, applies the typed update to the copied target record, and calls
+the existing `manifest.Store` exactly once. Only after that save succeeds does
+it promote the saved target record and manifest `updated_at` into live state;
+it preserves an existing target record's identity and leaves unrelated live
+stage records in place.
+
+The copy boundary includes stage records, input and artifact slices, aggregate
+output/log/configuration slices, and the typed analyze and transcribe
+collections that callbacks or `LocalStore.Save` may modify. Metadata and other
+pointer fields remain shared read-only because neither checkpoint callback nor
+the store mutates them. This is a bounded execution helper, not a general
+manifest clone or a transaction across transcript/artifact files.
+
+Manifest replacement provides atomic visibility, not a crash- or power-loss
+durability guarantee. Callers reload after a returned save error before retrying.
+A transcribe or analyze checkpoint error leaves the prior manifest collection
+as authority. The runner then attempts to persist the aggregate failure; if
+that terminal save also fails, its error is joined with the originating failure
+and the next invocation must reconcile from the last readable manifest.
+
 ## Execution Semantics
 
-The application runner marks an executing stage running and then succeeded or
-failed in both manifests, persisting each transition. On success it records
-outputs, logs, generated configuration references, and metadata. Artifact
+Planning and execution share one pure pre-execution decision over the recorded
+stage status, force selection, and normalized resume-validation result. That
+decision identifies run versus reuse and any required stale and dependent
+invalidation transition. Planning applies it only to a cloned manifest.
+Execution remains the sole owner of observed stage results and persistence.
+
+For each selected stage, the application runner computes semantic evidence,
+performs any eligible resume validation, applies the pre-execution decision,
+and persists required invalidation before either reusing the existing success
+or beginning an attempt. The same one-stage execution owner marks the attempt
+running before invoking the stage and then records and persists its failed,
+skipped, or successful terminal state before a later stage may start. On
+success it records outputs, logs, generated configuration references, metadata,
+and—when the stage implements the optional contract—a versioned
+semantic-configuration fingerprint. Artifact
 records may include optional contract and external provenance objects; old
 manifests remain compatible when those fields are absent. A successful forced
-rerun marks only succeeded downstream session-stage records stale.
+rerun marks only succeeded transitive dependent session-stage records stale.
+The application owns a fixed dependency relation distinct from execution order;
+dependents are returned in canonical order. Render and extract therefore never
+stale one another, while either can stale analyze, publish, notify, and cleanup.
 
 Starting an execution clears the current session-stage record's prior outputs,
-logs, generated configuration references, and metadata. Failed and skipped
+logs, generated configuration references, metadata, and semantic fingerprint.
+Failed and skipped
 transitions enforce the same clearing rule directly, while success repopulates
 only fields returned by the new result. Marking a record stale does not clear
 those details because resume validation and diagnosis may still require them
-before execution begins. Invocation run manifests remain immutable audit
-records of their own outcomes.
+before execution begins.
+
+Aggregate lifecycle clearing deliberately preserves both the transcribe-owned
+speaker collection and the analyze-owned per-artifact collection. This lets
+later reconciliation replace only non-current entries without erasing durable
+completions. Other stages retain aggregate-only lifecycle behavior and are
+forbidden from carrying either collection.
 
 A stage may explicitly return a skipped disposition and stable reason. The
-runner persists that outcome in both manifests, clears older outputs for the
-session-stage record along with older logs, generated configuration references,
-and metadata, then applies any bounded details from the current skip and
-continues. This self-skip is distinct from deciding not to execute an
+runner persists that outcome in the session manifest, clears older outputs,
+logs, generated configuration references, and metadata, then applies any
+bounded details from the current skip and continues. This self-skip is distinct from deciding not to execute an
 already-succeeded stage and is reconsidered on later runs. Skipped results
-cannot contain outputs.
+cannot contain outputs. An intentional self-skip records the current semantic
+fingerprint because it is a completed, reusable stage result; failed or
+interrupted work never promotes one.
 
-When an already-succeeded stage is skipped, the invocation run manifest records
-the `skip` action and reason. The session manifest deliberately retains its
-existing succeeded record because it remains the cross-invocation progress
-authority. Stages with a resume validator, currently extraction, may reject an
-otherwise eligible skip when the recorded durable result is obsolete; the
-runner marks it stale and executes it.
+When an already-succeeded stage is skipped, the session manifest deliberately
+retains its existing succeeded record because it remains the cross-invocation
+progress authority. If a stage supplies semantic configuration evidence, reuse first
+requires the persisted positive schema version and lowercase SHA-256 digest to
+match the current resolved stage semantics. Missing semantic evidence, malformed
+evidence, or a mismatch makes the stage and its fixed transitive dependents
+stale. The existing stage-specific resume
+validator runs only after this semantic check succeeds; both checks are
+required. Extraction, analyze, and cleanup have resume validators and may
+reject an otherwise eligible skip when their selected durable evidence is
+obsolete; the runner marks the aggregate record stale and executes it.
+Analyze's validator can still accept a partial selection when only unrelated
+artifact records are stale.
 
-Session manifest is the authoritative stage-progress ledger across invocations.
-Run manifest is invocation-scoped audit state.
+Implemented reuse coverage is deliberately split between aggregate semantic
+evidence and focused durable validators:
+
+| Work | Reuse authority | Focused owners |
+| --- | --- | --- |
+| prepare | aggregate semantic fingerprint | [prepare](stage-prepare.md) |
+| transcribe speakers | aggregate semantic fingerprint plus per-speaker input/output reconciliation | [transcribe](stage-transcribe.md), [WhisperX](../integrations/whisperx.md) |
+| merge | aggregate semantic fingerprint | [merge](stage-merge.md), [Seriatim](../integrations/seriatim.md) |
+| polish | aggregate semantic fingerprint | [polish](stage-polish.md), [Audita](../integrations/audita.md) |
+| normalize | aggregate semantic fingerprint | [normalize](stage-normalize.md), [Seriatim](../integrations/seriatim.md) |
+| trim | aggregate semantic fingerprint | [trim](stage-trim.md), [Scriptorium](../integrations/scriptorium.md), [Seriatim](../integrations/seriatim.md) |
+| render | aggregate semantic fingerprint | [render](stage-render.md), [Seriatim](../integrations/seriatim.md) |
+| extract | aggregate semantic fingerprint plus reference/output validator | [extract](stage-extract.md), [Notarius](../integrations/notarius.md) |
+| analyze artifacts | per-artifact fingerprint, reconciliation, and output validator | [analyze](stage-analyze.md), [Scriptorium](../integrations/scriptorium.md) |
+| publish | aggregate semantic fingerprint plus immediate lock/commit checks | [publish](stage-publish.md), [storage adapter](adapters.md) |
+| notify | aggregate delivery-mode fingerprint | [pipeline overview](overview.md), [configuration](../config.md#notifications) |
+| cleanup | aggregate semantic fingerprint plus publish-evidence and target-absence validator | [cleanup](stage-cleanup.md), [workspace](workspace.md) |
+
+These contracts record resolved choices Narratio can observe, not operational
+runner tuning. External model, module, prompt, profile, and configuration-file
+contents that a tool privately loads remain outside the contract when their
+configured identifier is unchanged; operators must force the affected work
+after such a private content change.
+
+The session manifest is the authoritative stage-progress ledger across
+invocations. It retains the most recently resolved invocation's bounded
+configuration provenance. It identifies the selected overlay name and source
+(`explicit` when selected) plus the effective configuration digest, but never a raw
+secret or overlay content. This provenance is informational: it does not
+participate in stage resume or cache decisions. An overlay change therefore
+invalidates only stages whose semantic configuration changed. When a private
+external-tool model, module, prompt, or profile changes behind an unchanged
+configured identifier, use `--force` for the affected work.
+
+`session plan` computes the same current fingerprint and applies the shared
+decision and invalidation rules to a cloned manifest. It predicts the runner
+decision without persisting session state. The semantic fingerprint owner
+hashes deterministic JSON from stage-owned typed structs; stage providers must
+exclude secrets, complete effective-configuration dumps, and operational
+values that cannot affect canonical results. Concrete coverage is owned by the
+focused stage and integration documents linked above.
+
+Before an explicitly bounded execution starts after `prepare`, the application
+reads the session manifest and accepts only `succeeded` or `skipped` for every
+excluded canonical prefix stage. The first other status or absent record fails
+the request before layout mutation, adapter initialization, session-manifest
+writes, or run-directory creation. Excluded prefix records are not passed to
+resume validators. Records after the selected end are not prerequisites and
+may be made stale by selected work without being scheduled.
+
+After a publish commits remotely, any configured local cleanup is first recorded
+as a session-manifest obligation before deletion begins. Each target becomes
+complete only after its confined deletion (or safe absence check) and a
+successful manifest save. An incomplete obligation is retried when publish
+executes again and retains the committed run and remote identity that authorized
+it; an invocation that does not execute publish does not perform cleanup.
+
+Each invocation derives campaign, session, run, local-path, and remote-prefix
+metadata from the validated resolved configuration as one projection. A persisted
+session manifest must agree on campaign and session identity before execution;
+the current projection is refreshed for every invocation while stage progress,
+inputs, and durable artifacts remain session history.
+
+For handled failures after the session identity transition, the runner records
+the failure on the session ledger and atomically attempts its save while
+preserving the originating error. Abrupt process death remains an accepted case
+where the last session transition can require operator interpretation.
 
 ## Invariants
 
 - stage resume/skip decisions are session-manifest driven.
+- semantic fingerprint comparison precedes stage-specific resume validation.
+- only successful and intentional-skipped results promote current semantic
+  evidence.
 - running, failed, and self-skipped stages do not retain result payloads from
   an earlier success.
 - stale stages retain prior details until replacement execution starts.
-- force reruns stale downstream succeeded stages.
-- run manifest does not replace session manifest as progress authority.
+- force reruns stale succeeded stages in the fixed dependency relation.
+- the session manifest is the only durable local progress ledger.
+- remote commitment is established by a verified current pointer and remote
+  commit relationship, never by a mutable session-manifest boolean.
 
 ## Implementation And Tests
 
-- Models and transitions: `internal/manifest/manifest.go`,
-  `internal/manifest/run_manifest.go`
+- Models and transitions: `internal/manifest/manifest.go`
+- Remote commit model and readers: `internal/artifacts/remote_commit.go`,
+  `internal/artifacts/current_state_commit.go`,
 - Persistence and validation: `internal/manifest/store.go`
+- Transcribe speaker state: `internal/manifest/transcribe_state.go`
 - Package tests: `internal/manifest/*_test.go`
 - Assembled execution behavior: `internal/app/runner_test.go`,
   `internal/app/run_stage_test.go`

docs/internal/overview.md

@@ -22,20 +22,29 @@ session safety controls, and runs commands. Pipeline commands execute the
 canonical stage sequence through adapter interfaces, while manifests record
 progress and artifact services resolve durable inputs and outputs.
 
+The pipeline runner follows one explicit invocation lifecycle: inspect bounded
+prerequisites without mutation, prepare the workspace layout, acquire one
+session lock, load or create the authoritative session manifest, compose only
+the collaborators needed by the selected range, execute each selected stage in
+order, and then return the summary. Cleanup, when selected, is the ordinary
+final stage rather than runner finalization work.
+The lock remains held from manifest initialization through finalization, and a
+failed stage or required manifest save prevents later stages from starting.
+
 ## Components
 
 | Area | Implemented owners | Responsibility |
 | --- | --- | --- |
 | Executable | `cmd/narratio` | Process entry, standard stream wiring, argument handoff, and exit status. |
-| Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, cleanup gates, and user-facing reporting. |
-| Configuration | `internal/config` | Strict YAML loading, discovery, defaults, normalization, session templating, and validation. |
+| Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, and user-facing reporting. |
+| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and overlays, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
 | Pipeline stages | `internal/stage` | Canonical stage registry, shared stage contract, execution dependencies, and implemented stage behavior. |
 | External boundaries | `internal/adapters`, `internal/audio` | WhisperX HTTP, downstream subprocesses, notification, object storage, and S3 audio materialization behind Narratio contracts. |
-| Manifests | `internal/manifest` | Durable session progress, invocation audit state, stage transitions, validation, and atomic persistence. |
+| Manifests | `internal/manifest` | Durable session progress, stage transitions, validation, and atomic persistence. |
 | Artifacts and paths | `internal/artifacts`, `internal/pathsafe` | Artifact identities and resolution, local and remote path/key models, current-state discovery, and confined relative destinations. |
 | Previous-session cache | `internal/previouscache` | Deterministic planning and materialization requirements for configured previous-session inputs. |
 | Artifact policy | `internal/artifactpolicy` | Source and destination policy, configured artifact identity validation, and publish destination safety. |
-| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, `internal/fileops` | Transcript and artifact data contracts plus narrow atomic filesystem helpers. |
+| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, [`internal/fileops`](fileops.md) | Transcript and artifact data contracts plus atomic single-file replacement, bounded reads, workspace modes, and root-scoped cleanup helpers. |
 | Logging | `internal/logging` | Application logger construction and shared structured logging behavior. |
 
 The application boundary composes concrete implementations. Stages depend on
@@ -43,6 +52,26 @@ Narratio-level contracts; external transport and SDK details remain in
 adapters. The normative rules for these relationships remain in
 [Architecture](../policy/architecture.md).
 
+Command execution normalizes one private dependency value per invocation.
+Pipeline configuration-path discovery, configuration reads, secret-directory
+reads, remote downloads, object-store construction, and restore phase functions
+use that value throughout the command. Public command entry points supply the
+canonical discovery and production defaults, while focused tests may provide
+invocation-owned discovery candidates or replace only the external or sequencing
+boundary they exercise without mutating package state.
+
+Pipeline execution and `session plan` share the same inclusive contiguous-range
+model and the same pure pre-execution decision over recorded status, force, and
+normalized resume validation. Planning applies that decision and modeled
+selected-stage transitions to cloned session state; it does not persist, create
+invocation state, initialize stage-execution adapters, or claim to observe an
+execution result. Command configuration loading can still retrieve a
+missing session file through configured remote storage. It retains the initially
+composed pipeline and selected campaign while resolving either a local or
+downloaded remote session, so one invocation cannot mix pipeline revisions.
+Analyze planning additionally exposes the artifact closure's targets,
+prerequisite rebuilds, execution order, and current reuse.
+
 ## Pipeline Stage Set
 
 The implemented canonical order is:
@@ -53,26 +82,38 @@ The implemented canonical order is:
 4. [`polish`](stage-polish.md)
 5. [`normalize`](stage-normalize.md)
 6. [`trim`](stage-trim.md)
-7. [`extract`](stage-extract.md)
-8. [`render`](stage-render.md)
+7. [`render`](stage-render.md)
+8. [`extract`](stage-extract.md)
 9. [`analyze`](stage-analyze.md)
 10. [`publish`](stage-publish.md)
-11. `notify` (placeholder)
+11. `notify` (no-op)
+12. [`cleanup`](stage-cleanup.md)
 
-`notify` currently has optional notifier call behavior and no persisted pipeline
-outputs; its default collaborator is a no-op sender. The focused stage
+`notify` currently has no persisted pipeline outputs and uses the explicit
+`noop` notification mode. Its versioned semantic evidence records that delivery
+mode and excludes adapter credentials and response data. The focused stage
 documents own implementation mechanics. The
 [CLI](../cli.md) and [Operations](../operations.md) own user-visible invocation
 and execution semantics.
 
+Execution order and invalidation are separate application contracts. The stage
+registry owns the flat execution sequence. The application orchestration owner
+uses a fixed, validated dependency relation to find transitive dependents in
+canonical order. In particular, `render` and `extract` are sibling consumers of
+trimmed transcript state: neither invalidates the other, while either can stale
+`analyze`, `publish`, `notify`, and `cleanup`. Cleanup is a dependent of notify,
+so any earlier replacement can stale a prior cleanup result.
+
 ## Focused Documentation
 
+- [Configuration Internals](configuration.md): pipeline imports and overlays,
+  field ownership, decoding, and root-relative path semantics.
 - [Adapter Internals](adapters.md): external adapter boundaries, composition,
   failure behavior, and test surfaces.
 - [Artifact Internals](artifacts.md): source identities, runtime catalog,
   resolution, previous requirements, and current-state helpers.
-- [Manifest Internals](manifest.md): session and run records, persistence, and
-  execution transitions.
+- [Manifest Internals](manifest.md): session records, persistence, and execution
+  transitions.
 - [Storage Internals](storage.md): object-store interface and S3 behavior.
 - [Workspace Internals](workspace.md): local layout, locking, and cleanup
   guardrails.
@@ -84,10 +125,11 @@ and execution semantics.
 - [`polish`](stage-polish.md)
 - [`normalize`](stage-normalize.md)
 - [`trim`](stage-trim.md)
-- [`extract`](stage-extract.md)
 - [`render`](stage-render.md)
+- [`extract`](stage-extract.md)
 - [`analyze`](stage-analyze.md)
 - [`publish`](stage-publish.md)
+- [`cleanup`](stage-cleanup.md)
 
 Use this map to find an owner, then read its focused documentation and tests
 before changing behavior.

docs/internal/stage-analyze.md

@@ -2,34 +2,142 @@
 
 ## Purpose
 
-Execute selected configured Scriptorium artifacts in dependency order and materialize outputs.
+Reconcile configured Scriptorium artifacts, execute only required work in
+dependency order, and safely materialize validated outputs.
 
 ## Inputs
 
-- configured artifacts from `pipeline.scriptorium.artifacts`
+- ordinary configured artifacts from `pipeline.scriptorium.artifacts`; canonical
+  party artifact families have already expanded into this map during
+  configuration resolution, including corresponding member dependencies and
+  rewritten member-artifact input sources. Each artifact's dependency list is
+  already the normalized union of explicit ordering edges and configured-artifact
+  input edges.
 - optional selected artifact keys supplied through the stage environment
-- built-in/configured/previous-session source references in artifact inputs
+- built-in, configured, extraction, and previous-session source references in
+  artifact inputs
 
 Supported source families:
 - built-ins: `narratio.transcript.*`, `narratio.bounds.session`
 - prepared stable inputs: `narratio.input.players`, `narratio.input.party`,
-  `narratio.input.glossary`
+  `narratio.input.glossary`, `narratio.input.spell_catalog`
 - configured artifacts: `narratio.artifact.<key>`
+- extraction lanes: `narratio.extraction.<key>`
 - previous-session cache: `narratio.previous_session.artifact.<key>`
 
 ## Outputs
 
-- one materialized output per executed configured artifact (`output_path`)
+- one current per-artifact manifest record per validated materialized output
 - stage metadata describing selected/generated/reused artifacts
 
 ## Key Behavior
 
-- skips with metadata when Scriptorium config is missing or no executable artifacts remain.
-- builds runtime artifact catalog (built-ins + configured artifacts).
-- marks non-executable configured artifacts as reusable when output files already exist.
+- when `pipeline.scriptorium` is absent or no configured artifact is
+  executable, completes successfully and records explanatory metadata. Before
+  returning, it reconciles and checkpoints the complete session collection:
+  records removed from configuration are dropped, while valid records for
+  configured but unselected artifacts remain authoritative. This is not an
+  explicit self-skip: the session manifest records success, satisfies publish's
+  prerequisite, and an ordinary later run reuses the result while the effective
+  set remains empty. Enabling or selecting an artifact later makes missing
+  versioned evidence non-resumable and schedules it without requiring force.
+- builds a runtime artifact catalog containing built-ins, configured artifacts,
+  and configured extraction lanes. Extraction availability is hydrated only
+  from compatible successful extraction evidence.
+- uses enabled configured artifacts by default. An explicit `--artifacts`
+  selection is a one-invocation override that makes exactly the named
+  configured artifacts explicit targets even when disabled. The work planner
+  adds required configured prerequisites, reuses current ones, and schedules
+  stale, missing, or otherwise non-current prerequisites before dependents.
+- makes a non-executable configured artifact reusable only when its current
+  manifest record and durable output pass the configured-artifact evidence
+  contract; an incidental or stale canonical file is unavailable.
 - validates selected artifact dependency order (cycle-safe topo ordering).
-- resolves required/optional inputs per artifact source definition.
-- resolves prepared stable input sources from `inputs/*.yml` materialized by `prepare`.
+- consumes only the concrete dependency graph finalized by configuration;
+  planning, prerequisite closure, execution, reuse, invalidation, and semantic
+  evidence do not infer a second graph from inputs.
+- resolves required/optional inputs per artifact source definition into an
+  ordered semantic identity. Each identity records the configured input name,
+  canonical source ID, required policy, explicit presence, source contract,
+  checksum, size, and a source-based logical identity. Workspace paths and
+  producer run IDs are excluded.
+- orders input identities by configured input name independently of Go map
+  iteration. Runtime adapter paths remain a separate execution-only map.
+- omits an unavailable optional input from the adapter request while retaining
+  explicit absence in its semantic identity; an unavailable required input
+  fails.
+- resolves prepared stable input sources through the shared manifest-authoritative
+  identity resolver; it does not accept incidental files or fall back to
+  campaign/session source paths.
+- reuses checksums and sizes from validated prepared, extraction, and current
+  configured-artifact evidence. Other resolved inputs are hashed as confined
+  regular files with streaming reads and the central resolved-artifact size
+  limit.
+- owns a versioned SHA-256 fingerprint contract with one fixed-field canonical
+  JSON payload and no map serialization. Configured artifacts are fingerprinted
+  in deterministic dependency order.
+- fingerprints the normalized artifact key, prompt and profile identifiers,
+  effective render-debug behavior, session-relative output identity, sorted
+  dependency keys, ordered input declarations and semantic identities,
+  validated current dependency-output identities, and sorted effective
+  Scriptorium variables (including Narratio's sticky session variable).
+- provides read-only reconciliation that classifies each configured record as
+  current, stale, missing, failed, or otherwise non-resumable, and
+  separately identifies manifest records removed from current configuration.
+  A record is current only when its fingerprint version and value match and its
+  configured output still passes manifest-authoritative evidence validation.
+- owns a read-only typed work planner. Its explicit targets are enabled
+  artifacts by default or the exact normalized `--artifacts` selection when
+  supplied. It closes targets over configured prerequisites, orders the closure
+  topologically, reuses current members, and schedules every non-current member
+  before its dependents.
+- force applies only to explicit targets. A current prerequisite is reused
+  unless it is itself an explicit forced target; disabled prerequisites may be
+  rebuilt when required, while unrelated disabled artifacts are excluded.
+- the work plan carries explicit targets, prerequisite-only work, deterministic
+  execution and reuse lists, invalidated and removed records, and a cloned
+  reconciled starting collection. Valid unrelated configured records survive
+  reconciliation, removed records are omitted, and incidental files never
+  become current without manifest-backed regeneration.
+- implements aggregate resume validation by running the same read-only catalog,
+  fingerprint reconciliation, and work planner used by execution. A succeeded
+  aggregate record is reusable exactly when the selected closure schedules no
+  artifact work and no removed configuration records require a checkpoint;
+  stale unrelated records do not block a partial selection.
+- exposes the typed artifact decision to `session plan`. Planning applies it to
+  a cloned manifest after modeling earlier selected stage transitions, so
+  aggregate run/skip and artifact execute/reuse decisions match the ordinary
+  runner without creating durable state or invoking Scriptorium.
+- executes only the work plan's scheduled entries. Manifest-validated current
+  prerequisites remain available through the runtime catalog without invoking
+  Scriptorium; newly produced prerequisites enter that catalog with the same
+  contract, checksum, and size identity used for persisted current evidence.
+- before the first adapter call, checkpoints the reconciled starting collection
+  when it removed configuration records or cleared obsolete authority. After
+  each successful artifact, checkpoints the complete collection before making
+  that artifact available to the next scheduled dependent. Analyze supplies
+  its typed update to the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary)
+  and refreshes its working and committed collections only after the save
+  succeeds.
+- keeps adapter output in the invocation's run-local analyze directory until
+  it is a safe, non-empty, bounded regular file with a calculated checksum and
+  complete output contract. Canonical replacement uses the shared atomic file
+  operation boundary and verifies that the installed checksum matches the
+  validated run-local bytes.
+- records each successful artifact's freshly computed fingerprint, canonical
+  relative output path, contract, checksum, size, producer run ID, bounded
+  Scriptorium provenance, logs, and generated configuration references in the
+  analyze-owned manifest collection.
+- preserves valid unrelated current records during partial execution. If a
+  rebuilt output's bytes and contract are unchanged, unselected dependents may
+  remain current. If that semantic identity changes, unselected transitive
+  dependents become stale without being executed; dependents included in the
+  invocation are evaluated in dependency order instead.
+- returns aggregate outputs from every current session record in normalized-key
+  order after the complete reconciled collection has been checkpointed;
+  unrelated stale records do not make an otherwise successful partial
+  invocation fail.
 - resolves previous-session sources from local `previous/` cache only.
 - runs optional render-debug, then artifact execution.
 - validates non-empty output files and materializes canonical outputs.
@@ -44,17 +152,63 @@ Supported source families:
   guidance.
 - dependency cycles or unavailable required dependencies fail.
 - adapter validation failures fail stage.
+- a scheduled artifact failure installs a retry collection on the live manifest
+  with the active artifact marked `failed`, a bounded error, and no output
+  authority. Current transitive dependents become stale without execution.
+- earlier artifacts remain current only after their run-local output passed
+  validation, canonical materialization, and a successful complete-collection
+  manifest checkpoint; unattempted later artifacts retain their reconciled
+  session state.
+- unrelated current records survive a partial failure. Old canonical bytes for
+  the failed artifact and newly materialized bytes whose checkpoint fails are
+  incidental, not current evidence.
+- a checkpoint failure stops the queue immediately. The in-memory retry
+  collection starts from the last successful checkpoint, marks the active
+  artifact failed without output authority, and stales its current transitive
+  dependents.
+- the runner's ordinary error path marks aggregate analyze failed, clears its
+  aggregate outputs, invalidates publish, notify, and cleanup through the
+  application dependency relation, and persists the live retry collection.
+  Terminal-save errors are joined with the original artifact or checkpoint
+  failure.
 
 ## Invariants
 
 - `analyze` performs no remote storage calls for previous-session source resolution.
+- input-identity resolution is read-only: it does not invoke adapters,
+  materialize outputs, update status, or create run-local files.
+- fingerprints exclude timeouts, retries, timestamps, producer and Narratio run
+  IDs, executable and config paths, workspace roots, diagnostic locations, and
+  executable or private transitive configuration contents. A change that is
+  visible only inside Scriptorium—such as a file privately loaded by its config
+  path—requires an explicit forced regeneration.
 - output provenance and metadata are deterministic per execution.
+- a canonical file without current per-artifact manifest evidence is never
+  promoted to current state.
+- an ordinary retry after interruption or partial failure reuses every valid
+  earlier checkpoint and schedules only failed, stale, missing, or otherwise
+  non-current work in dependency order.
 
 ## Related Contracts And Tests
 
 - [Configuration](../config.md#scriptorium-artifact-entries) owns artifact
-  fields and source-selection rules.
+  fields and source-selection rules, including
+  [artifact families](../config.md#scriptorium-artifact-families).
 - [CLI](../cli.md) owns user-visible artifact selection.
 - [Scriptorium](../integrations/scriptorium.md) owns the subprocess contract.
 - Implementation and tests: `internal/stage/analyze.go`,
-  `internal/stage/analyze_test.go`
+  `internal/stage/analyze_artifact_execution.go`,
+  `internal/stage/analyze_execution_state.go`,
+  `internal/stage/analyze_input_identity.go`,
+  `internal/stage/analyze_fingerprint.go`,
+  `internal/stage/analyze_reconciliation.go`, `internal/stage/analyze_plan.go`,
+  `internal/stage/analyze_resume.go`, `internal/stage/analyze_test.go`,
+  `internal/stage/analyze_checkpoint_test.go`,
+  `internal/stage/analyze_input_identity_test.go`,
+  `internal/stage/analyze_fingerprint_test.go`,
+  `internal/stage/analyze_reconciliation_test.go`,
+  `internal/stage/analyze_plan_test.go`,
+  `internal/stage/analyze_incremental_execution_test.go`,
+  `internal/stage/analyze_failure_test.go`,
+  `internal/stage/analyze_resume_test.go`, and
+  `internal/app/analyze_checkpoint_recovery_test.go`.

docs/internal/stage-cleanup.md

@@ -0,0 +1,54 @@
+# Stage: cleanup
+
+## Purpose
+
+Remove explicitly configured local data for the run selected by a successful
+publish commit. Cleanup is the twelfth and final canonical stage, after
+`notify`.
+
+## Authorization And Targets
+
+Cleanup is disabled unless at least one of these policies is true:
+
+- `pipeline.spool.delete_audio_after_publish`
+- `pipeline.workspace.cleanup_after_publish`
+
+An enabled cleanup requires the manifest's publish stage to be succeeded with
+`uploaded=true`, a canonical `published_run_id`, and the exact remote commit and
+current commit-pointer keys for the manifest campaign/session prefix. The
+configured campaign and session must match the manifest. Cleanup derives its
+only possible targets through the canonical artifact path helpers:
+
+- the published run's session spool-audio directory; and
+- the published run's workspace run directory.
+
+It does not scan parent directories, infer the newest run, or read object
+storage. Every deletion uses the root-confined file operation, which rejects a
+root itself, traversal, symlink escape, and out-of-root targets.
+
+## Execution And Resume
+
+Disabled cleanup records an explicit skipped result. Enabled cleanup removes
+targets in deterministic policy order and treats an already-missing target as
+success. A successful record contains the published run ID and completed policy
+names.
+
+A previous cleanup success is reusable only while its semantic configuration
+matches and every selected target remains absent. A recreated target makes the
+stage non-resumable. A failure is recorded against cleanup; publish remains
+succeeded and remote current state is unchanged. On a later normal full run,
+valid upstream stages are skipped and cleanup is retried without republishing.
+
+`narratio publish` selects publish only and never invokes cleanup. A bounded run
+through `notify` or any earlier endpoint also excludes it. Operators may run
+`narratio run-stage cleanup <session_id>` directly; missing, failed, malformed,
+or identity-mismatched publication evidence fails before deletion.
+
+## Implementation And Tests
+
+- Planning and evidence validation: `internal/stage/cleanup_plan.go`
+- Execution and resume: `internal/stage/cleanup.go`
+- Root-confined deletion: `internal/fileops/cleanup.go`
+- Focused tests: `internal/stage/cleanup_plan_test.go`,
+  `internal/stage/cleanup_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/internal/stage-extract.md

@@ -2,7 +2,7 @@
 
 ## Responsibility
 
-`extract` runs after `trim` and before `render`. It converts the canonical
+`extract` runs after `render` and before `analyze`. It converts the canonical
 `narratio.transcript.final_trimmed` JSON into configured Notarius lane artifacts.
 An omitted or disabled Notarius section makes the stage explicitly self-skip
 with reason `notarius_disabled`, no outputs, and no Notarius runner.
@@ -17,33 +17,87 @@ procedures belong in [Operations](../operations.md).
 `internal/stage/extract.go`:
 
 1. resolves the final trimmed transcript from the shared artifact catalog;
-2. resolves and fingerprints the Notarius invocation contract;
-3. creates a run-local staging directory and invokes the injected
-   `notarius.Runner`;
-4. validates the successful receipt, confined index, configured required lane
-   descriptors, and regular payload files;
-5. atomically promotes the complete bundle to its immutable durable location;
-6. records one non-selectable `notarius_index` output and one selectable
+2. resolves every configured prepared reference through the shared
+   manifest-authoritative identity resolver before creating run-local output;
+3. resolves each reference to a stable content-addressed session snapshot,
+   reusing verified bytes or reconstructing a missing/corrupt regular entry,
+   and rejects any source change observed while copying;
+4. fingerprints the byte- and provenance-bearing Notarius invocation evidence,
+   including sorted reference identities and the explicit downstream
+   configuration-profile selection;
+5. creates a run-local staging directory and invokes the injected
+   `notarius.Runner`, carrying the optional already-resolved credential
+   reference without exposing its value, the optional exact configuration
+   profile, plus effective resume and chunk-cache controls after force
+   precedence;
+6. revalidates the reference snapshots, then validates the v2 successful
+   receipt, confined index, management documents, configured required lane
+   descriptors, validation summaries, and regular payload files;
+7. atomically promotes the complete bundle to its immutable durable location;
+8. records one non-selectable `notarius_index` output and one selectable
    `notarius_lane` output per configured lane; and
-7. registers each lane as `narratio.extraction.<output_key>` for downstream
+9. registers each lane as `narratio.extraction.<output_key>` for downstream
    Scriptorium and publish resolution.
 
 Lane records retain checksum, contract, producer run ID, and Notarius system,
 run, pipeline, and lane provenance. Stage metadata retains the durable bundle
 root, receipt, diagnostic paths, rejection/warning summaries, producing
-Narratio run ID, and invocation fingerprint. Validation completes before
-promotion, so a rejected result cannot expose a partial durable bundle.
+Narratio run ID, the resolved trimmed-input identity, and invocation
+fingerprint. The input identity binds the exact transcript bytes, canonical
+source ID, producer stage/output/run identity, and resolution provenance.
+Reference metadata contains only selector, source ID, canonical session-relative
+path, checksum, and size; adapter requests receive selector and absolute stable
+snapshot path, never payload contents. Snapshot bytes must
+match the prepared identity both before and after Notarius runs, so a concurrent
+prepared-file replacement cannot make recorded provenance describe different
+bytes from those supplied to Notarius.
+Validation completes before the single durable rename, so a rejected result
+cannot expose a partial durable bundle.
+
+Snapshot destinations are owned by `internal/artifacts` under
+`cache/notarius/references/<sha256>/<prepared-basename>`. They contain no run ID
+or timestamp and can be reused across invocations. Identical bytes and basename
+share a verified file; changed bytes select a different digest directory.
+Unsafe path components and non-regular conflicts fail without recursive
+deletion. Snapshot paths are delivery details and never become manifest output
+evidence or prerequisites for reuse of an already complete extract bundle.
 
 Any executed extraction outcome that replaces a different effective outcome
-marks succeeded downstream stages stale. Repeating the same disabled self-skip
-with no outputs is stable and does not repeatedly invalidate downstream stages.
+marks succeeded analysis and delivery dependents stale. Render is an independent
+sibling and remains current. Repeating the same disabled self-skip with no
+outputs is stable and does not repeatedly invalidate dependent stages.
 
 ## Resume Validation
 
-`internal/stage/extract_resume.go` permits a skip only when the existing stage
-record succeeded and still matches the current invocation fingerprint. The
-fingerprint covers the resolved executable and config paths, pipeline ID,
-timeout, working directory, and sorted configured output contracts.
+Before the focused validator runs, the application compares extract's versioned
+semantic fingerprint. It covers enablement, Notarius pipeline identity, sorted
+reference selector/source mappings, sorted declared output contracts, and each
+canonical `narratio.extraction.<key>` output identity. It also covers the
+explicit Notarius configuration-profile selection; omitted, empty, and exact
+`default` selectors share the base-selection identity. It excludes executable,
+timeout, working directory, config path, and private Notarius config contents.
+Credential presence, reference name, and resolved value are likewise
+operational-only and excluded. Ordinary command loading still resolves a
+selected reference before resume evaluation, but a credential-only change does
+not rerun a valid completed extraction or stale its dependents.
+
+`internal/stage/extract_resume.go` then permits a skip only when the existing
+stage record still matches the current byte- and provenance-bearing invocation
+evidence. That evidence covers the current direct trimmed-transcript identity,
+sorted prepared-reference identities, pipeline identity, and configured output
+contracts, plus the same downstream profile-selection identity. The same
+reference helper and transcript identity are resolved again for artifact
+evidence, so changing current transcript bytes, reference bytes, producer
+identity, or a named downstream selection makes the prior extraction obsolete.
+Operational runner settings do not invalidate otherwise current durable
+evidence. This includes `resume` and `chunk_cache`; changing them alone cannot
+make a complete extraction non-resumable. If extraction executes, ordinary
+runs forward the configured values, while force disables resume and selects
+`refresh`.
+
+A valid prepared-reference change makes extraction non-resumable. Missing,
+unsafe, or checksum-inconsistent prepared evidence is a hard validation error
+with prepare-force guidance because an immediate extract rerun cannot succeed.
 
 The validator then checks the producing run identity, canonical immutable
 bundle root, path confinement and absence of symlink components, receipt
@@ -52,33 +106,43 @@ contracts and provenance, regular-file status, and stored checksums. Missing or
 obsolete results are non-resumable and run again; unsafe filesystem conditions
 return an error rather than silently accepting or replacing data.
 
-The fingerprint cannot observe files imported by Notarius configuration,
-profile contents, prompt/module definitions, or other transitive inputs.
-Operators must force extraction after changing any such input.
+This sensitivity is limited to the explicit downstream selector. Narratio's
+own profile label and whole effective-configuration digest are not blanket
+extraction invalidators. Neither contract can observe files imported by
+Notarius configuration, profile contents, prompt/module definitions, or other
+transitive inputs. Operators must force extraction after changing any such
+private input behind a stable identifier.
 
 ## Failure Behavior
 
 Adapter startup, timeout, nonzero exit, receipt decoding, path confinement,
-index compatibility, required-lane rejection, payload inspection, checksum, or
-promotion errors fail the stage through ordinary manifest transition handling.
+index compatibility, inconsistent warning or diagnostic envelopes,
+required-lane rejection or incomplete validation, payload inspection,
+checksum, or installation errors fail the stage through ordinary manifest
+transition handling.
 Stdout receipt and stderr diagnostics remain separate. Downstream stages are
 not given selectable extraction sources unless the complete configured result
-has passed validation and promotion.
+has passed validation and installation.
 
 When a replacement attempt begins, the current session-stage record no longer
 advertises payload from the previous success. A failed replacement therefore
 has no current outputs, logs, generated configuration references, or metadata,
-while the earlier invocation manifest and immutable promoted bundle remain
-available for audit and recovery.
+while the earlier immutable promoted bundle remains available for audit and
+recovery.
 
 ## Implementation And Focused Tests
 
 - Stage execution, selection, and resume validation: `internal/stage/extract.go`,
   `internal/stage/extract_resume.go`,
-  `internal/stage/extract_test.go`
+  `internal/stage/extract_test.go`,
+  `internal/stage/semantic_contracts_delivery.go`
+- Stable snapshot materialization and verification:
+  `internal/stage/extract_references.go`
 - Subprocess boundary: `internal/adapters/notarius/subprocess.go`,
   `internal/adapters/notarius/subprocess_test.go`
 - Catalog hydration: `internal/artifacts/extraction_catalog.go`,
   `internal/artifacts/extraction_catalog_test.go`
 - Composition and downstream behavior: `internal/app/runner_test.go`,
   `internal/stage/analyze_test.go`, `internal/stage/publish_test.go`
+- Opt-in Notarius v0.7.0 production-boundary coverage:
+  `internal/stage/notarius_cache_integration_test.go`

docs/internal/stage-merge.md

@@ -17,7 +17,11 @@ Normalize raw transcript inputs and merge into base transcript via Seriatim.
 
 ## Key Behavior
 
-- discovers and validates raw transcript inputs.
+- discovers and validates raw transcript inputs. For versioned transcribe
+  state, discovery requires aggregate transcribe success and consumes only the
+  aggregate outputs that exactly match the current per-speaker collection.
+  Partial checkpoints and orphaned files are not merge inputs. Legacy/manual
+  workflows without versioned speaker state retain directory discovery.
 - normalizes each raw transcript (`seriatim.Normalize`) into run-local scratch output.
 - merges normalized inputs (`seriatim.Run`) into base transcript.
 - validates merged transcript and optional report JSON.
@@ -26,12 +30,28 @@ Normalize raw transcript inputs and merge into base transcript via Seriatim.
 ## Invariants
 
 - merge always consumes normalized forms of raw inputs.
+- a versioned transcribe collection is usable only through its complete,
+  successful aggregate output declaration.
 - base transcript must validate before stage success.
 - report output is config-gated.
 
+## Resume Evidence
+
+Merge records a versioned semantic-configuration fingerprint for the Seriatim
+merge operation, output schema, coalesce gap, and every configured advanced
+merge transformation. A change reruns merge and stales only its fixed
+descendants; prepare and transcribe remain reusable. Binary path, timeout,
+report emission, logs, and diagnostic retention are operational exclusions.
+
+Configuration or resources loaded privately inside Seriatim are outside
+Narratio's observable contract and require `--force` when changed. An existing
+successful merge record without evidence reruns once when selected.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns subprocess and output semantics.
 - [Configuration](../config.md#pipeline) owns operator-selected Seriatim values.
 - Implementation and tests: `internal/stage/merge.go`,
-  `internal/stage/merge_test.go`
+  `internal/stage/merge_test.go`,
+  `internal/stage/semantic_contracts_initial.go`, and
+  `internal/stage/semantic_contracts_initial_test.go`

docs/internal/stage-normalize.md

@@ -15,7 +15,7 @@ Normalize polished transcript into final transcript using Seriatim.
 
 ## Key Behavior
 
-- resolves polished transcript from manifest outputs/canonical fallback.
+- resolves polished transcript only from verified manifest output evidence.
 - applies `pipeline.normalize` config or default normalize config.
 - runs Seriatim normalize with configured timeout/binary.
 - validates normalized transcript and optional report.
@@ -26,9 +26,17 @@ Normalize polished transcript into final transcript using Seriatim.
 - final transcript must validate as processed transcript JSON (`segments` array).
 - normalize defaults are applied when `pipeline.normalize` is unset.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers the Seriatim normalize operation,
+output schema and canonical output identity, plus the configured transcript
+transformations. Seriatim's executable and timeout and optional report
+generation are operational and do not invalidate the normalized transcript.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns subprocess and output semantics.
 - [Configuration](../config.md#pipeline) owns normalize fields and defaults.
 - Implementation and tests: `internal/stage/normalize.go`,
-  `internal/stage/normalize_test.go`
+  `internal/stage/normalize_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-polish.md

@@ -12,20 +12,41 @@ Run Audita polishing on base transcript and produce polished transcript.
 ## Outputs
 
 - `transcripts/polished.json`
-- optional `artifacts/audita.report.json`
+
+The transcript is the only canonical output. Available `errors.yml`,
+`recoveries.yml`, and `report.md` remain beside the run-local transcript and
+are recorded as diagnostics, not artifact outputs.
 
 ## Key Behavior
 
-- resolves base transcript from merge outputs/canonical fallback.
-- invokes Audita with configured model/module/runtime options.
+- resolves base transcript only from verified merge manifest output evidence.
+- invokes an Audita v2 runner with external configuration selectors and
+  explicitly forwarded provider credentials; the invocation supplies paths.
 - validates processed transcript structure (`segments` array required).
-- validates optional report JSON.
-- materializes canonical outputs; records logs/generated config and adapter metadata.
+- validates reported diagnostic paths against the three fixed adjacent names.
+- materializes only the canonical transcript; records available reports with
+  stdout/stderr logs, generated invocation, and safe adapter metadata.
 
 ## Invariants
 
 - polished transcript schema validation is mandatory.
-- report output is config-gated.
+- reports are optional diagnostics; Audita's external configuration may disable
+  them. A failed invocation never promotes an incidental transcript.
+
+## Resume Semantics
+
+Version 2 semantic evidence covers Audita's config path, downstream overlay,
+proposal and validation profile selectors, ordered module selection (including
+the distinction between omission and an explicit empty list), transcript
+description, output schema, and canonical polished-transcript identity.
+Credentials, executable path, timeout, and diagnostics are operational and do
+not invalidate a successful result. Public credential reference names may
+participate in configuration provenance but never expose resolved values.
+
+Narratio fingerprints selections, not the contents of Audita-owned config or
+profiles. Force `polish` after changing those files behind unchanged selections.
+When polish is selected, older semantic evidence is reconsidered and the stage
+reruns; a downstream-only invocation does not eagerly run polish.
 
 ## Related Contracts And Tests
 
@@ -33,4 +54,5 @@ Run Audita polishing on base transcript and produce polished transcript.
   semantics.
 - [Configuration](../config.md#pipeline) owns operator-selected Audita values.
 - Implementation and tests: `internal/stage/polish.go`,
-  `internal/stage/polish_test.go`
+  `internal/stage/polish_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-prepare.md

@@ -8,6 +8,7 @@ Materialize canonical current-session inputs before processing stages.
 
 - resolved campaign, session, and pipeline configuration
 - stable input files (`speakers`, `autocorrect`, `glossary`, `players`, `party`)
+- optional spell-catalog overlay
 - one resolved local or S3 audio source
 - enabled configured artifact input requirements for previous-session sources
 
@@ -21,6 +22,7 @@ Materialize canonical current-session inputs before processing stages.
 - `inputs/glossary.yml`
 - `inputs/players.yml`
 - `inputs/party.yml`
+- optional `inputs/spell_catalog.json`
 - `audio/*.flac`
 - optional `previous/manifest.json`
 - optional `previous/artifacts/**`
@@ -30,23 +32,55 @@ Materialize canonical current-session inputs before processing stages.
 
 - validates required config/store state.
 - enforces local audio vs S3 audio mutual exclusivity.
+- rejects duplicate explicit local audio sources after resolution.
+- gives distinct local source paths with the same basename deterministic unique
+  prepared filenames so neither source is overwritten.
 - materializes S3 audio through spool/cache-aware logic.
+- materializes a configured spell catalog with checksum and provenance, or
+  safely removes an obsolete canonical spell catalog and its manifest record
+  when the effective input is omitted.
+- copies the validated canonical party bytes unchanged and deterministically
+  generates the prepared players projection.
 - scans enabled configured artifact inputs for `narratio.previous_session.artifact.*` requirements.
-- when previous requirements exist:
-  - clears managed `previous/` state;
-  - builds previous-cache remote plan;
+- clears managed `previous/` state on every invocation, then, when requirements exist:
+  - resolves the pointer-selected previous source through the shared resolver;
   - downloads previous manifest/artifacts;
   - records previous inputs in `manifest.inputs`.
 
-Required previous-session inputs fail when unavailable; optional missing inputs are skipped.
+Required previous-session inputs fail when unavailable; optional missing inputs
+are typed skipped results. Each requirement resolves only from its unique
+`published_output` declaration in the pointer-selected remote commit. Prepare
+strips that selected run's immutable `published/` prefix to derive the local
+cache path, then validates the committed checksum, size, and generation.
 
 ## Invariants
 
 - only `prepare` hydrates canonical `previous/` cache state.
 - managed previous artifacts are stored under `previous/artifacts/**` without
   duplicate `artifacts/artifacts/` nesting.
+- managed `previous/` state represents only the current requirement set.
 - `manifest.inputs` ordering is deterministic (`kind`, `path`).
 
+## Resume Evidence
+
+Prepare records a versioned semantic-configuration fingerprint for the
+resolved campaign/session selection, local-versus-S3 audio mode and canonical
+audio names, stable-input ownership/presence, previous-session identity, and
+the party mode plus canonical players projection version, and the effective
+previous-artifact requirement set. A change reruns prepare and
+stales its fixed descendants. Existing successful records without this
+evidence rerun once when selected.
+
+Workspace, spool, and cache placement and absolute source relocation are not
+semantic when logical selection, canonical names, and bytes are equivalent.
+The fingerprint deliberately does not read or rehash large audio. Prepared
+input checksums remain the content provenance. Before reusing success, prepare
+validates every durable prepared copy and compares current stable-input bytes,
+canonical party and derived-player bytes, local audio membership/checksums, or
+S3 key/size/entity-tag identity with that provenance. Source relocation with
+equivalent names and bytes remains reusable; changed or unavailable evidence
+causes a normal prepare rerun.
+
 ## Related Contracts And Tests
 
 - [Configuration](../config.md) owns audio selection, stable input fields, and
@@ -56,5 +90,10 @@ Required previous-session inputs fail when unavailable; optional missing inputs
 - [Storage Internals](storage.md) and [Artifact Internals](artifacts.md) explain
   the internal collaborators.
 - Implementation and tests: `internal/stage/prepare.go`,
-  `internal/stage/prepare_test.go`, `internal/audio/s3_audio_test.go`,
+  `internal/stage/prepare_test.go`,
+  `internal/stage/prepare_resume.go`,
+  `internal/stage/prepare_resume_test.go`,
+  `internal/stage/semantic_contracts_initial.go`,
+  `internal/stage/semantic_contracts_initial_test.go`,
+  `internal/audio/s3_audio_test.go`,
   `internal/previouscache/*_test.go`

docs/internal/stage-publish.md

@@ -7,36 +7,82 @@ Upload run/session outputs to object storage and atomically advance remote curre
 ## Inputs
 
 - successful preceding stages from the [canonical stage set](overview.md#pipeline-stage-set)
-- invocation-scoped run files
+- declared run-local diagnostic files
 - resolved publish output rules
-- effective publish locks (static + remote merged lock set)
+- independent per-source remote lock objects read at planning start
+- the validated prior current commit when an initially locked source may carry
 - durable previous-session cache files when present
 
 ## Outputs
 
-- uploaded invocation record and selected publish outputs;
+- uploaded session manifest, declared run-local diagnostics, and selected
+  publish outputs;
 - uploaded durable previous-session cache files when present;
-- updated remote current manifest; and
-- remote current-run commit marker, written last.
+- immutable run-scoped commit manifest; and
+- current commit pointer, written last.
 
 Exact remote placement and the operator workflow belong in
 [Operations](../operations.md#publish-workflow).
 
 ## Key Behavior
 
-- stage can self-skip when publish disabled or run upload disabled.
+`publish.go` retains the transaction-owning `Run` path. Source discovery,
+manifest-derived archive metadata, confined opening, and checksum validation
+live in `publish_sources.go`; artifact-catalog matching, selection, required
+and optional rules, destination resolution, and collision inputs live in
+`publish_outputs.go`. Copying, hashing, immutable upload, reuse checks, and
+remote verification live in `publish_transfer.go`; committed-manifest,
+immutable-commit, and current-pointer encoding and writes live in
+`publish_commit.go`. `publish_output_plan.go` owns the deterministic, I/O-free
+five-outcome model and its secret-free metadata projection.
+
+- when publishing or run upload is disabled, completes successfully with no
+  outputs and records explanatory metadata. This is not an explicit self-skip:
+  the session manifest records success. Enablement and upload policy are
+  fingerprinted, so changing either automatically makes the prior result
+  non-resumable.
 - validates prerequisite stage success and object-store availability.
-- collects a deterministic run file list plus run `manifest.json`, excluding
-  `audio/**` and the run-local `extract/notarius-output/**` staging bundle.
-- keeps run-local Notarius receipt and stderr diagnostics eligible for the run
-  archive.
-- resolves publish output sources through runtime artifact catalog and manifest-aware resolution.
+- derives a deterministic run-archive allowlist from the session manifest's
+  declared current-run outputs, logs, and generated configurations. References
+  outside the current run root, including canonical session files and prior-run
+  diagnostics, are not archive candidates. No distinguished diagnostic file is
+  read or uploaded.
+- opens each archive candidate beneath its archive root without following
+  symlinked ancestors or leaf entries, verifies that it is a regular file and
+  checks a declared checksum when present, then streams the opened descriptor.
+- derives the durable previous-cache archive from its validated manifest using
+  the same confinement and regular-file checks.
+- resolves publish output sources through runtime artifact catalog and
+  manifest-aware resolution. Configured Scriptorium outputs are publishable
+  only from validated `current` per-artifact analyze evidence; an incidental
+  canonical file, aggregate output, stale/failed/unselected record, or
+  mismatched path, size, or checksum remains unavailable. Built-in and
+  extraction sources likewise require their own current manifest evidence.
 - publishes extraction lanes only through explicit configured output rules;
   neither run-local nor durable Notarius bundles are scanned or uploaded wholesale.
 - selected artifact filter applies to configured artifact sources only.
-- locked outputs are skipped intentionally (including required ones).
-- optional missing outputs are skipped; required missing unlocked outputs fail.
-- writes remote current manifest before current run pointer.
+- plans every configured output into exactly one source-sorted outcome:
+  `published`, `carried_locked`, `locked_unpublished`, `optional_missing`, or
+  `unselected`.
+- an initially locked selected output carries its exact prior
+  `published_output` declaration when one exists. The declaration may point to
+  an earlier run in the same session and retains its source, key, checksum,
+  size, and generation; the bytes are not copied.
+- verifies a carried object's exact key, size, and generation through object
+  metadata without downloading or opening the local output source.
+- an initially locked source with no prior declaration remains absent even
+  when the output rule is required. Optional missing unlocked outputs remain
+  absent; required missing unlocked outputs fail.
+- creates one complete immutable source-to-destination mapping before upload;
+- uploads and verifies every declared immutable object and the commit manifest;
+- writes the immutable commit from the combined new and exact carried
+  declarations.
+- rereads every initially unlocked participating source after the immutable
+  commit. A newly present lock aborts selection, leaving the uploaded immutable
+  attempt unselected. Removing an initial lock may conservatively produce one
+  carry because the initial snapshot controls the plan.
+- updates `current/commit-pointer.json` exactly once, last, and writes no other
+  mutable publication control record.
 
 ## Metadata Signals
 
@@ -44,31 +90,58 @@ Includes counts/lists for:
 - run uploads
 - published output uploads
 - previous uploads
-- skipped optional outputs
-- skipped unselected outputs
-- locked outputs
-- current-state key paths
-- `current_pointer_written`
+- one `publish_output_outcomes` collection containing all five output states,
+  exact declared keys, and key-derived origin runs where applicable
+- remote commit and current-pointer key paths
+- the run identifier selected by the commit
 
 ## Invariants
 
-- `current/run_id.txt` is the remote commit marker and is written last.
-- run upload excludes `audio/**` and `extract/notarius-output/**`.
-- `extract/notarius.receipt.json` and `extract/notarius.stderr.log` remain
-  eligible run-record diagnostics.
-- publish locks are not overridden by `--force`.
+- `current/commit-pointer.json` is the remote commit marker and is written last.
+- run files, selected outputs, previous-cache files, and the committed session
+  manifest are all declared by an immutable commit under the run prefix.
+- run and previous uploads contain only manifest-declared regular files opened
+  from verified descriptors; symlinks, special files, replacement races, and
+  undeclared entries are rejected or ignored before uploads begin.
+- run-local diagnostics, including Notarius receipt and stderr files, are
+  archived only when recorded by the session manifest. A run with no declared
+  current-run diagnostics legitimately uploads none.
+- independent publish locks are not overridden by `--force`; every initially
+  unlocked relevant source is reread immediately before current-state
+  selection.
+- successful uploaded publication records the exact run ID, remote commit key,
+  and current-pointer key consumed by the later cleanup stage.
 
-The commit boundary and cleanup gate are normative architecture invariants; see
+## Resume Semantics
+
+The versioned semantic fingerprint covers enabled behavior, run-upload policy,
+normalized source/destination/required output rules, and the remote backend,
+bucket, region, endpoint, and root-prefix identity. Rule ordering is
+canonicalized. Credential
+environment names, path-addressing transport mode, local workspace placement,
+and run identifiers are excluded. Independent remote locks remain mutable state
+and are read directly by publish at planning and commit boundaries; semantic
+evidence does not replace those safety checks.
+
+The commit boundary and cleanup authorization are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).
 
+Publish never deletes local state. The standalone `publish` command selects
+only this stage; a full run selects notify and cleanup afterward.
+
 ## Related Contracts And Tests
 
-- [Configuration](../config.md#publish-configuration-summary) owns output and
-  static-lock fields.
+- [Configuration](../config.md#publish-configuration-summary) owns output
+  rules.
 - [Operations](../operations.md#publish-locks) owns remote lock lifecycle and
   physical remote state.
 - [Artifact Internals](artifacts.md) explains source resolution and current-state
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
-  `internal/stage/publish_test.go`, `internal/app/operator_helpers_test.go`,
-  `internal/app/post_publish_cleanup_test.go`
+  `internal/stage/publish_sources.go`, `internal/stage/publish_outputs.go`,
+  `internal/stage/publish_output_plan.go`,
+  `internal/stage/publish_transfer.go`, `internal/stage/publish_commit.go`,
+  `internal/stage/publish_test.go`,
+  `internal/stage/semantic_contracts_delivery.go`,
+  `internal/app/operator_helpers_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/internal/stage-render.md

@@ -3,6 +3,10 @@
 ## Purpose
 
 Render Markdown transcript artifacts from normalized JSON transcripts via Seriatim.
+It runs after `trim` and before `extract` in the canonical sequence. Render and
+extract are independent sibling consumers: replacing render output does not
+invalidate extraction, but it does invalidate succeeded analysis and delivery
+records that may consume rendered transcripts.
 
 ## Inputs
 
@@ -17,10 +21,13 @@ Render Markdown transcript artifacts from normalized JSON transcripts via Seriat
 ## Key Behavior
 
 - uses `pipeline.render` settings (enabled/format/title/booleans).
-- resolves inputs manifest-first, then canonical fallback.
+- resolves inputs only from verified manifest output evidence.
 - writes run-local outputs first, then materializes canonical session outputs.
 - records input provenance, output paths, adapter metadata, logs, and generated config refs.
-- skips with stage metadata when `pipeline.render.enabled=false`.
+- when `pipeline.render.enabled=false`, completes successfully with no outputs
+  and records explanatory metadata. This is not an explicit self-skip: both
+  manifests record success. Because enablement is fingerprinted, enabling
+  render later automatically makes the prior result non-resumable.
 
 ## Failure Semantics
 
@@ -34,9 +41,20 @@ Render Markdown transcript artifacts from normalized JSON transcripts via Seriat
 - only `format: markdown` is supported.
 - render stage owns production of built-in Markdown transcript sources.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers enablement, final format, resolved
+title (including the session-title fallback), timestamp, segment-ID and
+metadata inclusion, both canonical input identities, and both Markdown output
+identities. Seriatim's executable, timeout, and report behavior are operational
+and do not invalidate rendered transcripts. A render-only change leaves the
+independent `extract` sibling reusable while invalidating their shared
+downstream consumers.
+
 ## Related Contracts And Tests
 
 - [Seriatim](../integrations/seriatim.md) owns render subprocess behavior.
 - [Configuration](../config.md#pipeline) owns render fields and defaults.
 - Implementation and tests: `internal/stage/render.go`,
-  `internal/stage/render_test.go`
+  `internal/stage/render_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/stage-transcribe.md

@@ -14,17 +14,70 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 
 ## Key Behavior
 
-- discovers prepared audio from manifest inputs or canonical audio directory.
-- derives speaker ID from `.flac` basename.
-- dispatches WhisperX requests through a bounded worker pool.
-- validates each output as JSON.
-- writes run-local outputs then materializes canonical transcript outputs.
+- discovers prepared audio from manifest inputs or the canonical audio
+  directory and derives each speaker identity from its `.flac` filename.
+- hashes the current audio and reconciles it with the versioned per-speaker
+  completion collection before starting HTTP work.
+- reuses only records whose audio identity, observable WhisperX semantics,
+  canonical output location, JSON, checksum, and size remain current.
+- durably checkpoints the reconciled collection before dispatch, then sends
+  only missing or obsolete speakers through the bounded worker group.
+- validates each successful run-local response, rechecks the audio bytes,
+  materializes the canonical raw transcript, and checkpoints that speaker
+  before accepting another completion.
+- rebuilds aggregate stage outputs in stable speaker order from the complete
+  current collection, including records produced by earlier invocations.
 
 ## Invariants
 
-- speaker basenames must be unique.
+- prepared audio identities must be unique; prepare disambiguates distinct
+  source paths that share a basename.
 - output path returned by adapter must match requested output path.
-- each successful output is validated before stage success.
+- an empty adapter result path means the requested path; adapters cannot select
+  an alternate destination.
+- candidate collection construction, the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary),
+  and installation into live state are serialized by transcribe's mutex.
+  Expensive hashing and HTTP work remain outside that critical section.
+- a canonical file has no completion authority until its manifest checkpoint
+  succeeds. A save failure preserves the last successfully committed
+  collection for ordinary retry.
+- each successful output is validated before its checkpoint, and cancellation,
+  incomplete dispatch, or a failed aggregate save cannot be reported as
+  aggregate stage success.
+- removed audio inputs are omitted from the current collection and aggregate
+  output list; reconciliation does not delete arbitrary transcript files.
+- merge cannot consume a partial versioned collection: it requires transcribe
+  aggregate success and an exact match between current speaker records and
+  declared aggregate outputs.
+
+## Resume Evidence
+
+Each completed speaker record binds the speaker ID, session-relative audio
+path, streamed audio checksum and size, the Narratio-visible WhisperX service
+URL and recognition language, and the canonical transcript path, checksum,
+size, and producer run. Changed audio bytes select that speaker for replacement;
+a changed URL or language selects every speaker. Either case stales fixed
+descendants through the normal runner decision. Retry count/delay, concurrency,
+timeout, credentials, and diagnostic locations are operational and do not
+change this evidence.
+
+An ordinary retry reuses every valid speaker checkpoint even when aggregate
+transcribe status is failed, running, or stale. A succeeded stage is skipped only
+when its stored speaker set and aggregate output evidence also match the current
+collection. Otherwise, execution repairs those records without retranscribing
+reusable speakers and stales dependents through the normal runner path.
+`--force` first durably replaces
+the collection with an empty versioned collection, so a later ordinary retry
+cannot resurrect pre-force results; speakers checkpointed by that forced
+attempt remain reusable.
+
+WhisperX models or private service configuration not exposed by Narratio's
+adapter contract cannot be fingerprinted; use `--force` after changing them.
+An older aggregate-only transcribe record has no trustworthy audio-to-output
+binding. When transcribe is next selected, every current speaker is therefore
+generated once and recorded in the versioned collection; later invocations can
+reuse it normally.
 
 ## Related Contracts And Tests
 
@@ -33,4 +86,9 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 - [Configuration](../config.md#pipeline) owns concurrency and other
   operator-selected values.
 - Implementation and tests: `internal/stage/transcribe.go`,
-  `internal/stage/transcribe_test.go`
+  `internal/stage/transcribe_reconciliation.go`,
+  `internal/stage/transcribe_execution_state.go`,
+  `internal/stage/transcribe_resume.go`,
+  `internal/stage/transcribe_test.go`,
+  `internal/stage/transcribe_reconciliation_test.go`, and
+  `internal/stage/transcribe_checkpoint_test.go`

docs/internal/stage-trim.md

@@ -33,6 +33,19 @@ When `trim.enabled=false`:
 - bounds output exists only in enabled trim path.
 - render-debug output is diagnostic and not a declared stage output.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers enablement, the bounds prompt and
+profile identifiers, the Scriptorium configuration identity, transcript input
+name, sticky session variable, bounds and trimmed output identities, and the
+Seriatim trim operation. Diagnostic bounds rendering, diagnostic output paths,
+timeouts, executable paths, and optional reports are operational and do not
+invalidate the canonical trimmed transcript.
+
+Narratio cannot inspect prompt, profile, or configuration content that
+Scriptorium or Seriatim privately resolves behind a stable identifier. Force
+`trim` after changing such private content without changing its identifier.
+
 ## Related Contracts And Tests
 
 - [Scriptorium](../integrations/scriptorium.md) owns bounds generation and
@@ -40,4 +53,5 @@ When `trim.enabled=false`:
 - [Seriatim](../integrations/seriatim.md) owns transcript trimming behavior.
 - [Configuration](../config.md#pipeline) owns trim fields and defaults.
 - Implementation and tests: `internal/stage/trim.go`,
-  `internal/stage/trim_test.go`
+  `internal/stage/trim_test.go`,
+  `internal/stage/semantic_contracts_refinement.go`

docs/internal/storage.md

@@ -12,14 +12,24 @@ operator-selected storage fields and credential mechanisms belong in
 `storage.ObjectStore` interface:
 
 - `List(ctx, prefix)`
+- `Read(ctx, key)` returns an object body and the generation observed with it
 - `Download(ctx, key, localPath)`
 - `Upload(ctx, localPath, key, opts)`
+- `UploadConditional(ctx, source, key, opts, condition)`
+- `Delete(ctx, key)` removes one object and succeeds when it is already absent
 - `Exists(ctx, key)`
 
 Key invariant:
 - callers pass full bucket-relative keys;
 - storage implementations do not infer campaign/session/run prefixes.
 
+`ReadObjectBounded` is the shared mechanism for small control objects. It opens
+one object version, returns the metadata observed with that body, rejects an
+oversized known size before transfer, and still performs a context-aware
+limit-plus-one read. It closes the body on every exit. Callers own the policy
+limit and add the control-object category to errors; this helper is not used for
+large artifact payloads.
+
 ## Composition
 
 `NewObjectStoreFromConfig` constructs the S3-backed implementation from
@@ -31,14 +41,28 @@ not own discovery, defaults, or configuration validation.
 
 - normalizes object keys.
 - `List` paginates and returns normalized `ObjectInfo`.
+- A truncated S3 listing must supply a new, non-empty continuation token;
+  otherwise listing fails with bucket and prefix context instead of looping.
 - `Download` writes local files with parent directory creation.
 - `Upload` streams local file and returns remote metadata.
+- `Read` binds a returned body to its S3 ETag. `UploadConditional` maps an ETag
+  match or absence precondition directly to the provider request and reports a
+  failed precondition without performing a local check-then-write replacement.
+- `Delete` maps one normalized key to the provider delete-object operation and
+  treats an absent object as success.
 - `Exists` maps not-found responses to `false`.
 
 ## Invariants
 
 - storage layer is stateless regarding manifest/stage progression.
+- bounded reads never retain more than the caller's limit plus one byte and do
+  not replace owner-specific size policy.
 - publish ordering semantics are owned by stage/app code, not storage adapters.
+- A caller that installs remote content into a canonical workspace path first
+  writes a sibling temporary file, validates the complete object against its
+  owner-specific contract, and only then replaces the destination. Temporary
+  files used solely for remote comparisons are removed by their callers and do
+  not represent installed workspace state.
 
 ## Implementation And Tests
 

docs/internal/workspace.md

@@ -13,8 +13,16 @@ previous-cache path construction. `SessionPathsFor` provides the session-scoped
 path model, and layout creation goes through `EnsureLayoutFor`. Callers should
 consume those helpers instead of rebuilding relative paths.
 
-`internal/pathsafe` and application cleanup helpers enforce confinement for
-relative destinations and deletion targets.
+`internal/pathsafe` validates relative destinations. `internal/fileops` opens
+explicit cleanup roots and removes only normalized proper descendants through
+the resulting root handle.
+
+`internal/fileops` owns the ordinary workspace mode contract. On POSIX,
+`WorkspaceDirectoryMode` is setgid `02775` and `WorkspaceFileMode` is `0664`.
+`EnsureWorkspaceDirectory` reapplies the directory mode after creation so a
+restrictive umask cannot remove group access, while retaining existing ownership
+and group. Credential paths are outside this contract; the platform-specific
+operational requirements are in [Operations](../operations.md#workspace-permissions).
 
 ## Run-Local Stage Layout
 
@@ -25,32 +33,46 @@ previous-session cache paths remain session-durable and are never redirected
 into run-local output space.
 
 Extraction uses run-local receipt, stderr, and output-root helpers, then
-promotes the validated external bundle to the unique immutable Notarius bundle
-path supplied by `internal/artifacts`. `internal/fileops.PromoteDirectory`
-copies only regular files and directories to a same-filesystem temporary
-sibling. Source traversal uses confined directory handles and identity checks
-so replacing an inspected root, directory, or file is rejected rather than
-followed. The completed tree is atomically renamed without replacing an
-existing destination. Exact physical paths belong in
+validates and renames the external bundle to the unique immutable Notarius
+bundle path supplied by `internal/artifacts`. Exact physical paths belong in
 [Operations](../operations.md#extraction-workflow).
 
+Prepared references delivered to Notarius use session-durable paths owned by
+`internal/artifacts` beneath
+`cache/notarius/references/<sha256>/<prepared-basename>`. These verified
+content-addressed snapshots are outside run-local layout, survive ordinary
+published-run cleanup, and are excluded from publish and restore enumeration.
+
 ## Locking
 
-`artifacts.LocalStore` enforces the single-writer session lock via `.lock`
-(`ErrLockConflict` on contention).
+`artifacts.LocalStore` enforces the single-writer session lock via an
+operating-system lock held on `.lock` (`ErrLockConflict` on contention). The
+file retains owner metadata after release or process death; its existence is
+not evidence that a lock is active. Command and restore flows wait for this
+lock only while their context remains active, and report a release failure.
+
+The runner assigns every invocation a run-workspace identity but creates the
+physical directory only before an executing stage that requires it. Fully
+reused invocations and cleanup-only invocations therefore do not accumulate
+empty run directories.
 
 ## Cleanup Semantics
 
-Automatic post-publish cleanup:
+The canonical cleanup stage:
 
-- only runs when publish actually executed and succeeded;
-- requires `uploaded=true` and `current_pointer_written=true` metadata;
+- runs after notify only when selected by the invocation range;
+- requires a succeeded publish record with `uploaded=true`, the published run
+  ID, remote commit key, and current commit-pointer key;
 - consumes the resolved cleanup policy described in
   [Configuration](../config.md);
-- refuses unsafe deletes (root delete, out-of-root delete, symlink paths).
+- refuses unsafe deletes (root delete, traversal, and out-of-root targets);
+- treats missing targets as successful, idempotent deletion; and
+- uses its ordinary failed/succeeded manifest stage record for retry. A later
+  full run can skip reusable upstream stages and retry cleanup without
+  republishing.
 
-Manual cleanup uses the same scoped-target checks. Invocation syntax and exact
-deletion scope belong in [CLI](../cli.md#clean) and
+Manual cleanup uses the same root-confined deletion mechanism. Invocation
+syntax and exact deletion scope belong in [CLI](../cli.md#clean) and
 [Operations](../operations.md#cleanup).
 
 ## Invariants
@@ -58,17 +80,24 @@ deletion scope belong in [CLI](../cli.md#clean) and
 - campaign-aware session root is mandatory.
 - manifest-driven stage state is durable across runs.
 - cleanup guardrails prevent destructive root/out-of-scope deletion.
+- restore installation is confined to validated relative paths beneath the
+  selected session root.
+- ordinary workspace paths retain group-writable directory and file modes across
+  nested creation, replacement, and Notarius promotion.
 
 ## Implementation And Tests
 
 - Path model and local store: `internal/artifacts/paths.go`,
   `internal/artifacts/local.go`
 - Run-local materialization: `internal/stage/run_local.go`
-- Immutable bundle promotion: `internal/fileops/directory.go`
-- Cleanup confinement: `internal/app/cleanup_targets.go`,
-  `internal/app/post_publish_cleanup.go`
+- Immutable bundle installation: `internal/stage/extract.go`
+- Workspace modes: `internal/fileops/modes.go`
+- Cleanup confinement: `internal/fileops/cleanup.go`,
+  `internal/stage/cleanup.go`, `internal/stage/cleanup_plan.go`, and
+  `internal/app/cleanup_targets.go`
 - Tests: `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/local_test.go`, `internal/stage/run_local_test.go`,
-  `internal/fileops/directory_test.go`,
-  `internal/app/cleanup_targets_test.go`,
-  `internal/app/post_publish_cleanup_test.go`
+  `internal/fileops/modes_posix_test.go`,
+  `internal/fileops/cleanup_test.go`, `internal/app/cleanup_targets_test.go`,
+  `internal/stage/cleanup_test.go`, and
+  `internal/app/cleanup_orchestration_test.go`

docs/operations.md

@@ -36,7 +36,12 @@ narratio session init 2026-04-04 --remote --force
 
 If `campaign.yml` sets `session_template_file`, `session init` renders it. Template variables must resolve to concrete values.
 
-Campaigns must provide stable input files for speakers, autocorrect, glossary, players, and party. Session files may override those paths for one session. The `prepare` stage materializes them under `inputs/`; configured Scriptorium artifacts can reference prepared `players`, `party`, and `glossary` files with `narratio.input.players`, `narratio.input.party`, and `narratio.input.glossary`.
+Campaigns must provide stable input files for speakers, autocorrect, glossary,
+players, and party, and may provide an optional spell-catalog overlay. Session
+files may override those paths for one session. The `prepare` stage
+materializes them under `inputs/`; configured consumers use the prepared files,
+never the original campaign or session source paths. Field definitions and
+source IDs are in [Configuration](./config.md#notarius-reference-bindings).
 
 ## Standard Session Workflow
 
@@ -65,6 +70,22 @@ narratio run 2026-04-04
 narratio session status 2026-04-04
 ```
 
+Run, plan, and status output identify the resolved pipeline overlay (or `none`)
+and effective configuration digest. Status distinguishes the current resolved
+value from the last value persisted in the session manifest, which helps
+diagnose overlay switches without changing resume authority.
+
+Before switching an operational overlay, compare its effective meaning with the
+production base through `narratio config diff default <overlay>`.
+The command is read-only and succeeds whether it finds differences or not. Its
+sorted records describe defaulted, expanded concrete configuration—not source
+file layout—so it can be used to review model, artifact, and publish changes
+without creating a session or run. Use `narratio config artifacts` to review the
+concrete artifact identities, definitions, outputs, and dependencies. Select the
+same campaign explicitly when overlays could resolve different campaign paths;
+see the [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
+for syntax and record format.
+
 ## Stage Execution and Continuation Behavior
 
 Canonical stage order:
@@ -75,22 +96,54 @@ Canonical stage order:
 4. `polish`
 5. `normalize`
 6. `trim`
-7. `extract`
-8. `render`
+7. `render`
+8. `extract`
 9. `analyze`
 10. `publish`
 11. `notify`
+12. `cleanup`
 
 Execution rules:
 
-- succeeded stages are skipped unless `--force` is set;
+- succeeded stages are skipped unless `--force` is set; stages with semantic
+  configuration contracts additionally require matching versioned evidence;
 - `run` continues interrupted or partially completed sessions by running non-succeeded stages;
-- forcing an upstream stage marks succeeded downstream stages as `stale` before
-  the replacement runs; and
+- forcing a stage marks succeeded transitive dependents as `stale` before the
+  replacement runs; render and extract are independent siblings; and
 - an executed failure, changed self-skip, or success that replaces a different
-  effective upstream outcome also marks succeeded downstream stages stale. A
+  effective outcome uses the same fixed dependency relation. A
   repeated self-skip with the same reason and no outputs is stable and does not
-  perpetually rerun downstream work.
+  perpetually rerun dependent work.
+
+Every aggregate stage except analyze currently provides semantic-configuration
+evidence; transcribe additionally reconciles per-speaker completion evidence,
+while analyze retains its more precise per-artifact fingerprints and validator.
+Prepare additionally validates current stable/local/S3 source identity and the
+checksums of its durable prepared copies before reuse. Changed bytes, audio
+membership, S3 object identity, or missing/tampered copies rerun prepare and
+its fixed descendants without requiring `--force`. Changing prepare selection
+semantics likewise reruns all fixed descendants; changing
+WhisperX language/service identity reuses prepare; changing a Seriatim merge
+transformation reuses prepare and transcribe; and changing a selected Audita
+overlay, profile, or module sequence reuses prepare, transcribe, and merge while
+rebuilding transcript refinement. A trim change invalidates both render and
+extract through the fixed dependency relation, while a render-only change
+preserves the extract sibling.
+
+Operational timeouts, retry/concurrency tuning, executable paths,
+workspace/cache/spool placement, reports, diagnostics, and secret values are
+excluded. Configuration, models, prompts, modules, or resources loaded
+privately inside external tools remain unobservable to Narratio. If their
+contents change behind the same configured identifier, explicitly force the
+affected stage.
+
+An explicit self-skip is a durable `skipped` stage outcome that later runs
+reconsider. It differs from successful no-output execution: disabled `render`
+and `publish`, and absent or no-executable `analyze`, record `succeeded` with
+metadata and no outputs. Ordinary later runs reuse those successful results;
+force the affected stage after enabling or configuring it. Optional artifact
+inputs are omitted only from the consuming artifact invocation and do not make
+the stage self-skip.
 
 Single-stage execution:
 
@@ -98,14 +151,177 @@ Single-stage execution:
 narratio run-stage normalize 2026-04-04 --force
 ```
 
+Contiguous bounded execution uses inclusive canonical endpoints:
+
+```bash
+narratio session plan 2026-04-04 --from extract --through analyze --force
+narratio run 2026-04-04 --from extract --through analyze --force
+```
+
+Omitting `--from` selects from `prepare`; omitting `--through` selects through
+`cleanup`. Force applies only within the selected range. Repeating `--from`,
+`--through`, or `--force` is rejected instead of resolving by argument order.
+The plan command uses the same selection contract and prints only the selected
+range. Planning is read-only: it clones the loaded manifest, models selected
+stage transitions and invalidation in memory, and invokes resume validation
+without writing the manifest, creating run directories, materializing files,
+or invoking pipeline adapters. Analyze detail separates explicit targets,
+prerequisite rebuilds, scheduled execution, and current reuse. This lets a
+coarsely stale aggregate analyze stage show zero artifact executions when its
+selected artifact evidence is still semantically current.
+
+Before a bounded run or plan whose range starts after `prepare`, every excluded
+prefix stage must already have a session-manifest status of `succeeded` or
+`skipped`. Narratio reports the first absent, pending, running, failed, stale,
+or interrupted prerequisite without creating a run-local directory or changing
+session state. Widen `--from` to include that stage, or recover it explicitly
+before retrying. Excluded prefix stages are not resume-validated or repaired as
+part of the bounded invocation; selected stages still reject missing, unsafe,
+or manifest-inconsistent inputs at their owning boundary.
+
+Stages after `--through` are not prerequisites and are never scheduled by the
+bounded invocation. A selected forced stage can mark one of those succeeded
+dependents stale through the fixed invalidation relation, but the dependent
+does not execute until a later invocation selects it. Production composition
+likewise initializes only collaborators needed by the selected range and
+shared session lifecycle. In particular, render does not require Notarius or
+Scriptorium, extract does not require Scriptorium, and analyze does not require
+the transcription, Seriatim, Audita, or Notarius adapters.
+
+### Transcription continuation and replacement
+
+Transcribe checkpoints each validated speaker independently. If a later
+speaker exhausts HTTP retries, the process is canceled, or the aggregate stage
+save fails, the aggregate stage is not successful and downstream merge cannot
+consume the partial set. The last successfully saved speaker records and their
+canonical `transcripts/raw/<speaker>.json` files remain durable, however.
+
+After correcting the underlying problem, retry normally:
+
+```bash
+narratio run-stage transcribe 2026-04-04
+```
+
+Narratio hashes the current prepared audio, validates recorded transcript JSON,
+checksum, size, and location, and calls WhisperX only for missing or obsolete
+speakers. A changed audio file replaces only its speaker; a changed WhisperX
+URL or language makes every current speaker non-reusable. Retry, timeout, and
+concurrency tuning do not invalidate completed speakers.
+
+Use force only when every current transcript must be replaced, including after
+a WhisperX model or private server-side configuration changes behind the same
+URL and language:
+
+```bash
+narratio run-stage transcribe 2026-04-04 --force
+```
+
+Force durably clears the reusable collection before sending requests. If that
+forced attempt fails, a later ordinary retry reuses only replacement speakers
+checkpointed after the reset; it does not revive pre-force results. Do not edit
+speaker checksums or copy older JSON into the canonical directory to influence
+reuse.
+
+The first current Narratio invocation that selects transcribe for an older
+aggregate-only manifest retranscribes every current speaker once because the
+old record cannot prove which audio bytes produced each file. Subsequent runs
+reuse the new versioned evidence normally. The overall session-manifest schema
+identifier is unchanged, but older strict-decoding Narratio binaries may reject
+a manifest after current Narratio writes the additive speaker fields; retain a
+backup or complete the upgrade before relying on downgrade.
+
+Restoring a manifest does not implicitly publish or restore every raw speaker
+file. If a recorded canonical transcript is absent locally, ordinary
+reconciliation schedules that speaker again. Removing run directories does not
+remove canonical checkpointed transcripts and does not by itself invalidate
+them.
+
+## Artifact Development Workflows
+
+Choose the narrowest workflow that matches the intended replacement:
+
+| Intent | Command | Preserved and rebuilt state |
+| --- | --- | --- |
+| Rebuild analysis only | [`narratio analyze 2026-04-04`](./cli.md#analyze) | Preserves transcripts and the current extraction bundle; force-runs selected analysis artifacts and their required analysis prerequisites. |
+| Rebuild extraction and analysis | [`narratio regenerate-artifacts 2026-04-04`](./cli.md#regenerate-artifacts) | Preserves transcripts; force-runs the complete configured extraction bundle, then selected analysis. `--artifacts` narrows analysis only. |
+| Continue bounded work normally | [`narratio run 2026-04-04 --from extract --through analyze`](./cli.md#run) | Uses ordinary resume decisions: current extraction and analysis can be skipped, while incomplete or obsolete work runs. |
+
+All three stop before publication. Inspect the results and run
+[`narratio publish`](./cli.md#publish) separately when delivery is intended.
+
+For the extraction-plus-analysis development loop, use:
+
+```bash
+narratio regenerate-artifacts 2026-04-04
+narratio regenerate-artifacts 2026-04-04 --artifacts session_recap,player_handout
+```
+
+This command is a transparent expansion to a forced bounded `run` from
+`extract` through `analyze`. Extraction always rebuilds its complete configured
+bundle. Analysis rebuilds the selected targets and their required analysis
+prerequisites, or uses the normal default selection when no artifact names are
+given. The command does not run publish, notify, or cleanup; delivery and
+retention remain separate operator actions.
+
+Inspect current artifact evidence, then publish explicitly when the regenerated
+set is ready:
+
+```bash
+narratio session artifacts 2026-04-04
+narratio publish 2026-04-04
+```
+
+If planning or execution reports stale, missing, failed, or tampered
+analysis evidence, regenerate the affected target instead of copying an older
+canonical file into place or editing the manifest. See
+[Troubleshooting: Analysis artifact evidence is not current](./troubleshooting.md#analysis-artifact-evidence-is-not-current).
+
+Analyze checkpoints each completed configured artifact before starting later
+artifact work. After a partial failure or interruption, retry normally: valid
+earlier checkpoints are reused and execution resumes with failed, stale, or
+missing work in dependency order. `--force` is unnecessary unless the operator
+intends to replace otherwise-current artifacts.
+
+### Developing With A Notarius Configuration Profile
+
+A Narratio development overlay can explicitly select a Notarius overlay without
+requiring the names to match. For example, `overlays/testing.yml` may contain:
+
+```yaml
+notarius:
+  config_profile: downstream-economy
+```
+
+Selecting Narratio's `testing` overlay then supplies `downstream-economy` only
+when extraction executes. Switching that explicit selector makes a recorded
+extraction non-current and reruns it when `extract` is in the selected stage
+range; the usual dependent invalidation then applies. Selecting an overlay does
+not create a separate workspace or retain a separate current extraction result.
+
+Narratio cannot observe edits inside Notarius configuration behind an unchanged
+selector. Force extraction after such an edit when a replacement is intended.
+Use `regenerate-artifacts` when both extraction and analysis must be rebuilt;
+use `analyze` when the existing extraction bundle should be preserved. Field
+semantics belong in [Configuration](./config.md#notarius-configuration-profile),
+and the exact downstream invocation belongs in the
+[Notarius integration contract](./integrations/notarius.md#invocation).
+
 ## Artifact Selection
 
-`--artifacts` can be used on `run`, `run-stage`, `analyze`, and `publish`.
+For a configured artifact family, selecting its family key expands to every
+concrete character artifact. Select a concrete generated key to operate on one
+member only. Manifests and plan output retain the concrete key as the durable
+identity and include the family and character ID as optional provenance.
+
+`--artifacts` can be used on `run`, `session plan`, `run-stage`, `analyze`, and
+`publish`. For a bounded run or plan, the selected range must contain `analyze`
+or `publish`.
 
 Selection behavior:
 
 - validates names against `pipeline.scriptorium.artifacts`;
-- filters analyze execution to selected configured artifacts;
+- selects explicit analyze targets and permits their required configured
+  prerequisites to be reused or rebuilt first;
 - filters publish rules for `narratio.artifact.<name>` sources only;
 - does not suppress built-in transcript, bounds, or explicitly configured
   `narratio.extraction.<name>` publish sources; and
@@ -127,29 +343,186 @@ The directory is immutable once promoted. Configured lanes become
 the bundle and `index.json` are retained for audit and resume validation but
 are not selectable or published implicitly.
 
+Configured Notarius references resolve only from the current manifest-backed
+prepared inputs. Their canonical locations are `inputs/party.yml`,
+`inputs/players.yml`, `inputs/glossary.yml`, and, when configured,
+`inputs/spell_catalog.json`. Extraction supplies Notarius with verified,
+content-addressed copies under
+`cache/notarius/references/<sha256>/<prepared-basename>`. The full lowercase
+SHA-256 digest identifies the reference bytes, so retries and later invocations
+reuse the same path while changed bytes select a new path. Older snapshots are
+retained and are not current artifact evidence. A concurrent refresh of
+canonical prepared files therefore cannot change the bytes consumed by an
+in-flight invocation.
+For a canonical party, preparation retains the validated authored party bytes
+at `inputs/party.yml` and generates `inputs/players.yml` from that roster.
+The manifest records their checksums separately, with the players input marked
+as derived from the party; refresh preparation after changing the roster rather
+than editing either prepared file.
+Inspect the effective stable-input inventory and
+prepared-file readiness with:
+
+```bash
+narratio session status 2026-04-04
+narratio session validate 2026-04-04
+```
+
+Reference metadata records selector, source ID, session-relative path,
+checksum, and byte size, but never payload contents. Changing a prepared
+reference changes extraction identity: ordinary continuation rejects the old
+result, reruns Notarius, and marks successful downstream stages stale. If the
+prepared file is missing or inconsistent with its manifest checksum, repair
+the source configuration and refresh prepared state first:
+
+```bash
+narratio run-stage prepare 2026-04-04 --force
+```
+
 Starting a replacement clears the previous extraction payload from the current
 session-stage record. If that replacement fails or self-skips, the current
-record does not fall back to the earlier outputs. The earlier run manifest and
-immutable bundle remain available for inspection, but downstream resolution
-requires a new current successful extraction record.
+record does not fall back to the earlier outputs. The earlier immutable bundle
+remains available for inspection, but downstream resolution requires a new
+current successful extraction record.
 
-Atomic Notarius bundle promotion is supported on Linux, macOS, and Windows.
-On other operating systems, extraction fails before copying the bundle into a
-temporary promotion tree because Narratio has no verified atomic no-replace
-directory primitive there. This is an extraction limitation, not a broader
-platform-support guarantee for every Narratio workflow.
+Notarius extraction validates its run-local bundle and moves it once to the
+unique durable bundle path. A pre-existing durable destination is a collision;
+no duplicate promotion tree is created.
+
+`pipeline.notarius.resume` and `pipeline.notarius.chunk_cache` control work
+inside an executed Notarius invocation. Ordinary extraction forwards their
+configured values. Forced extraction always disables checkpoint loading and
+requests chunk-plan `refresh`, even when the configured mode is `bypass`.
+Refresh regenerates and replaces only the active input's accepted chunk plan;
+it is not cache deletion.
+
+Notarius checkpoint recording must be enabled in the deployed Notarius
+configuration. Narratio neither creates a Notarius pipeline/configuration nor
+reads it to infer checkpoint availability. Configure explicit persistent
+Notarius chunk-plan and checkpoint roots when reuse must survive separate
+Narratio subprocesses. A changed reference, transcript, selected profile,
+profile content, endpoint, or other Notarius checkpoint identity input can
+produce a legitimate cold miss.
+
+There are two independent resume boundaries: Narratio may skip a completed
+`extract` stage without invoking Notarius, while `--resume` allows Notarius to
+reuse compatible accepted work only after Narratio has decided extraction must
+execute. Deleting Narratio's local reference snapshots does not invalidate a
+complete durable extraction; missing snapshots are reconstructed only when a
+later extraction actually runs.
+
+## Migrating Manifest Overlay Provenance
+
+The pipeline-selection rename is a clean cutover. Manifests containing
+`effective_config.selected_profile` are rejected by strict decoding; Narratio
+does not silently discard or translate that retired field.
+
+Before using an affected local session with the new version:
+
+1. Stop Narratio activity for the session and back up its manifest.
+2. Rename only `effective_config.selected_profile` to `selected_overlay`, keeping
+   its `name` and `source`, or remove the retired informational member. If a
+   current `selected_overlay` member already exists, retain it and remove the
+   retired member rather than creating duplicate keys.
+3. Preserve the schema version, digest, stage records, checkpoint evidence,
+   output references, and other session state. Retry the intended command.
+
+This metadata is informational, not resume authority. Do not delete session
+progress or force all stages merely to perform this migration. Other unknown
+fields still require investigation rather than blanket removal.
+
+Do not edit immutable remote committed snapshots. Restoring an older snapshot
+with retired provenance requires a compatible previous Narratio version, followed
+by migration of the restored local manifest before using the new version.
+
+## Migrating Audita and Provider Credentials
+
+This is a breaking clean cutover to Audita v2. Narratio does not translate an
+Audita v1 configuration, retain old field aliases, or generate a downstream
+configuration. Update both the deployed Audita executable/configuration and
+the Narratio pipeline before running polish. Retired Narratio fields are
+rejected by strict configuration loading; account for this break when choosing
+a release version.
+
+| Previous Narratio setting | New ownership and selection |
+| --- | --- |
+| `audita.base_url` | Audita v2 `backends.<id>.endpoint` |
+| `audita.total_llm_concurrency`, `proposal_llm_concurrency`, `validation_llm_concurrency` | Audita v2 `backends.<id>.concurrency` and optional `queue_capacity`; backend capacity is shared across roles |
+| `audita.model`, `validation_model` | Audita PromptKit profile files; optionally select them from Narratio with `audita.proposal_profile` and `validation_profile` |
+| `audita.llm_api_key` | `audita.credentials: [PROVIDER_KEY_NAME]`, matching each Audita backend's `credential` name |
+| `notarius.llm_api_key` | `notarius.credentials: [PROVIDER_KEY_NAME]`, matching references in Notarius-owned profiles |
+| `audita.work_dir_retention`, `report` | Remove; Audita's external configuration owns diagnostics and reporting |
+
+An Audita configuration can also be selected through `audita.config_path`,
+and `audita.overlay` selects an Audita overlay independently of Narratio's
+`--overlay`. Narratio forwards no implicit provider key: a single provider-named
+secret source may be listed for both adapters, and an Audita-only backend key
+may be listed only for Audita. Audita resolves credentials for all configured
+backends, including those not currently selected. Notarius looks up its own
+profiles; Narratio does not discover their credential names. Credential lists
+may be cleared with `[]` in a Narratio overlay.
+
+Prepare the external file from Audita's maintained
+[local example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/minimal-config.yml),
+[service example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/production-config.yml),
+and [v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+Before switching the executable, validate the file offline:
+
+```bash
+audita config validate --config /usr/local/etc/audita/config.yml
+```
+
+Use `audita config print-effective --config /usr/local/etc/audita/config.yml --view profiles`
+to inspect downstream profile selection without contacting a provider. For a
+production Audita configuration, leave ordinary reports enabled
+and debug disabled unless an operator deliberately chooses otherwise; Narratio
+does not override those settings. Audita writes `errors.yml`, `recoveries.yml`,
+and `report.md` beside the polished output when reporting is enabled. An
+exit-zero run with a valid transcript succeeds even if those reports describe
+recoverable errors or no applied corrections. See the [Audita integration
+contract](./integrations/audita.md) for report placement and limits.
+
+Narratio's polish resume evidence tracks selected config path, Audita overlay,
+profiles, ordered modules, description, schema, and output identity. Editing
+Audita-owned files behind unchanged selectors is invisible to Narratio; force
+polish with `narratio run-stage polish <session-id> --force` after such edits.
+
+## External Command Lifecycle
+
+When an external command is cancelled or times out, Narratio terminates its
+owned descendants as well as the command itself. Cancellation first requests
+termination where the platform supports it, then force terminates after a
+bounded wait. A command is not considered finished until its leader has been
+reaped, and descendants that keep standard output or error open cannot keep
+the invocation blocked. Other operating systems fail closed rather than launch
+a command without tree ownership.
+
+Subprocess stdout and stderr diagnostics are separately redacted and capped at
+8 MiB per invocation. Narratio does not retain configured credential values in
+these logs or their error tails; reaching a capture limit terminates the command
+tree and reports which stream exceeded the limit.
 
 Run-local diagnostics are:
 
+- `runs/{run_id}/polish/outputs/transcripts/errors.yml`,
+  `recoveries.yml`, and `report.md` when Audita writes them beside its
+  run-local polished transcript
 - `runs/{run_id}/extract/notarius.receipt.json`
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
 
-The run-record upload excludes the complete
-`extract/notarius-output/**` subtree. The receipt and stderr files remain
-eligible run-record diagnostics. The durable bundle is never scanned for
-implicit publication; only lanes named by explicit `pipeline.publish.outputs`
-rules are uploaded.
+The run upload is an allowlist derived from the session manifest's declared
+current-run outputs, logs, and generated configurations, not a workspace scan.
+References to canonical session files and prior-run paths are excluded. Each
+declared source is opened without following symlinked ancestors or the leaf,
+verified as a regular file, and streamed from that verified descriptor.
+Unlisted files and unsafe entries are never uploaded; a run with no declared
+current-run diagnostics uploads no run-local files. No distinguished diagnostic
+file is uploaded. The durable bundle is never scanned for implicit publication;
+only lanes named by explicit `pipeline.publish.outputs` rules are uploaded.
+To inspect a published polish report remotely, read its declared object under
+the run archive's `polish/outputs/transcripts/` prefix. Session restore does
+not restore run-archive diagnostics as canonical session files; it restores only
+the committed manifest and declared transcript/artifact objects.
 
 To intentionally replace the current extraction result, run:
 
@@ -157,15 +530,27 @@ To intentionally replace the current extraction result, run:
 narratio run-stage extract 2026-04-04 --force
 ```
 
-Narratio automatically reruns extraction when its recorded invocation contract
-or durable output validation changes. It cannot fingerprint configuration
-files, profiles, prompts, modules, or references loaded transitively by
-Notarius. Force extraction after changing any of those inputs, even when the
+Narratio automatically reruns extraction when its recorded invocation contract,
+prepared Narratio reference identities, or durable output validation changes.
+The semantic portion covers Notarius enablement, pipeline identity, declared
+reference mapping, output contracts, and the explicit Notarius configuration
+profile selector. Executable, timeout, working directory, and private
+config-file paths are operational and do not invalidate a current result.
+It cannot fingerprint configuration or profile contents, prompts, modules, or
+other references loaded transitively by Notarius itself. Force extraction after
+changing any of those inputs behind an unchanged selector, even when the
 top-level Narratio and Notarius config paths remain the same. A forced extract
 marks successful downstream stages stale. Ordinary extraction failures or
 outcome changes also stale affected downstream stages, while an identical
 repeated `notarius_disabled` self-skip does not repeatedly invalidate them.
 
+Publish reuse additionally tracks enabled/run-upload behavior, normalized
+output rules, and remote backend/bucket/region/endpoint/root identity.
+Credential environment names, local workspace placement, and run IDs are
+excluded. Regardless of semantic reuse evidence, executing publish reads
+independent remote locks directly and rechecks initially unlocked sources
+before commit selection.
+
 ## Publish Workflow
 
 Run publish only:
@@ -180,31 +565,70 @@ Equivalent:
 narratio run-stage publish 2026-04-04 --force
 ```
 
+This standalone command stops after publish and does not invoke cleanup. A
+default full `run` continues through notify and cleanup.
+
 Publish commit model:
 
 - uploads eligible run files under `{session_prefix}/runs/{run_id}/`, excluding
   audio and the run-local Notarius staging bundle;
-- uploads configured published outputs, including only explicitly configured
-  extraction lanes;
-- uploads `previous/**` cache files when present;
-- writes `current/manifest.json`;
-- writes `current/run_id.txt` last.
+- uploads configured published outputs and `previous/**` cache files into the
+  same immutable run scope, including only explicitly configured extraction
+  lanes;
+- writes `{session_prefix}/runs/{run_id}/commit.json` after all declared
+  immutable objects are uploaded and verified; and
+- writes `{session_prefix}/current/commit-pointer.json` once, last.
 
-`current/run_id.txt` is the remote current-state commit marker.
+`current/commit-pointer.json` is the remote current-state commit marker. It
+selects exactly one immutable commit, which declares the complete object set.
+
+## Remote Commit Migration
+
+The immutable remote commit contract uses
+`runs/{run_id}/commit.json` to declare a run's complete object set and a small
+`current/commit-pointer.json` to select it. The pointer binds the selected
+commit by version, checksum, size, and storage generation; committed artifacts
+are also checksum- and generation-bound. Readers accept this contract now and
+strictly reject mismatched or unknown data.
+
+A selected commit may carry a `published_output` declaration from an earlier
+run in the same campaign/session. Restore, previous-session caching, status,
+and artifact inspection use that declaration's exact immutable key and stable
+source; they do not reconstruct a current-run key or scan the session prefix.
+Other artifact types remain confined to the selected commit's own run.
+
+When the pointer is absent, remote state is not published; republish the
+session to establish a committed snapshot. Remote commit state does not carry
+local `current_pointer_written` metadata.
 
 ## Publish Locks
 
-Lock sources:
+Each mutable lock is an independent strict JSON object at
+`{session_prefix}/locks/{sha256(source)}.lock`. The lowercase digest is computed
+from the exact canonical source. Listing validates every object in that
+reserved prefix and reports locks sorted by source.
 
-- static locks in `pipeline.publish.locks`
-- mutable remote locks in `{session_prefix}/locks.yml`
+Upgrades do not read, migrate, or delete the retired `{session_prefix}/locks.yml`
+object. It has no effect on publication and may be removed manually after
+verifying lock commands and publication behavior with the upgraded Narratio
+version. No migration command is required.
 
-Effective lock rules:
+Operational rules:
 
-- static and remote locks are merged;
-- static locks win on source collisions;
-- locked outputs are intentional skips;
-- lock add/remove commands mutate only remote lock state.
+- add uses conditional creation and reports an existing lock;
+- add with `--force` observes the current generation and attempts one
+  generation-matched replacement. A concurrent change is reported for an
+  explicit operator retry;
+- remove is idempotent and reports whether a lock was present;
+- the initial publish lock snapshot controls output planning. A locked source
+  carries its exact declaration from the prior current commit when available;
+  a never-published locked source remains absent even when required;
+- carried bytes are not copied. Publish verifies the prior object's exact key,
+  size, and generation without downloading it; and
+- after immutable uploads and the immutable commit, publish re-reads every
+  initially unlocked participating source. A newly added lock prevents the
+  current pointer from advancing, although the immutable attempt may remain.
+  A removed initial lock may conservatively cause one carry.
 
 Examples:
 
@@ -230,20 +654,39 @@ Apply:
 narratio session restore 2026-04-04
 ```
 
+`--dry-run` does not write durable session files. It still reads the selected
+remote current state and may read object identity/content needed to classify the
+plan, so it is not a network-free operation.
+
 Default restore scope:
 
-- `manifest.json`
-- `transcripts/**`
-- `artifacts/**`
-- `previous/**` when needed by configured previous-session artifact inputs
+- the committed session manifest and the committed transcript/artifact objects
+  declared by the selected remote commit
+- `previous/**` when needed by configured previous-session artifact inputs;
+  each is selected from its exact committed `published_output` declaration
 
 Optional:
 
 - `--include-audio` to include `audio/**`
-- `--force` to overwrite local conflicts
+- `--force` to overwrite eligible conflicting regular files; it never replaces
+  directories, symlinks, or other non-regular local targets
+
+Restore treats a local leaf symlink or any symlinked ancestor beneath the
+selected session root as a conflict, even when the linked content matches the
+selected remote object. `--force` does not override that conflict.
+
+Before each install, restore validates the destination again beneath the
+selected session root. A target changed into a symlink, directory, or other
+non-regular entry is not overwritten.
 
 Restore writes an execution report at `reports/restore-latest.json`.
 
+If restore fails after beginning installation, it leaves a durable
+`.restore-incomplete.json` marker in the session root. Pipeline runs will stop
+until you rerun the same restore command and it completes. Restore intentionally
+does not try to roll back files already installed; retrying the selected remote
+snapshot is the recovery procedure.
+
 ## Local State Layout
 
 Session root:
@@ -262,10 +705,24 @@ Durable session paths:
 - `logs/**`
 - `config/**`
 - `runs/**`
+- `cache/notarius/references/<sha256>/<prepared-basename>`
+
+`manifest.json` is the versioned session-progress document. Narratio accepts
+only `narratio.session-manifest.v1`. Do not edit unsupported session state to
+add missing markers. Move it aside and regenerate it, restore a verified
+current committed snapshot, or republish healthy regenerated state as the
+relevant workflow requires.
 
 Validated Notarius bundles live below `artifacts/notarius/{run_id}/`; receipt,
 stderr, and pre-promotion output remain in the producing run's `extract`
 directory as described in [Extraction Workflow](#extraction-workflow).
+Stable reference snapshots live in the session cache path above. Ordinary
+published-run cleanup removes its selected run-local target but retains this
+cache, and publish/restore never enumerate it as an artifact. Remove a snapshot
+or digest directory manually only while no command is active for the session;
+regular missing or corrupt content is reconstructed on the next executed
+extraction, while symlinks, directories, and other unsafe conflicts must be
+investigated and removed deliberately.
 
 Run-local layout:
 
@@ -284,6 +741,51 @@ Cache layout (durable S3 audio cache):
 
 - `{cache.root}/s3/{bucket}/...`
 
+Each cached audio file has an adjacent managed identity record. It binds the
+file to its remote object version and verified digest; deleting or altering the
+record simply causes Narratio to download and verify the object again.
+Remote audio and restored files are fully transferred into sibling temporary
+files and validated before they replace their canonical workspace paths.
+
+### Workspace Permissions
+
+Ordinary Narratio workspace content is intentionally shareable with the
+workspace group. On POSIX systems, Narratio-created workspace, spool, and cache
+directories converge on setgid `02775`; ordinary files, including manifests,
+transcripts, generated configuration, logs, reports, and Notarius artifacts,
+converge on `0664`. Narratio explicitly applies these modes so a restrictive
+caller umask does not remove group write or setgid. It does not change file or
+directory ownership: the configured workspace's existing group is inherited.
+
+API keys are credentials, not ordinary workspace data. Store them outside the
+shared workspace or in a separately restricted credential location; ordinary
+workspace group access must never be treated as authorization to read keys.
+Provision a credential directory as `0700` and credential files as `0600`;
+these permission modes are an operator requirement and are not enforced by
+ConfigKit.
+
+Every pipeline-loading command bootstraps credentials once, before the first
+configuration load and before any adapter is constructed. `--secrets-dir`
+selects an explicit directory (relative paths use caller CWD). Otherwise a
+present `secrets/` beside the resolved root pipeline is used, while an absent
+conventional directory is skipped. Explicit missing/empty selections and
+invalid existing directories fail the command. ConfigKit follows a symlink used
+as the selected directory, but immediate entries must be regular non-symlink
+files. Existing environment variables—including empty values—always win.
+
+S3 `access_key_id` and `secret_access_key` are an optional pair of typed
+environment references. When both are absent, the AWS SDK retains its default
+credential provider chain. When both are configured, Narratio supplies their
+load-time resolved values through an explicit static provider. Audita and
+Notarius credential lists likewise resolve at pipeline load. Each adapter
+receives only its listed names and captured values, with no alias mapping or
+ambient environment inheritance. See [configuration](./config.md#audita-selection-and-credentials).
+
+External adapter results are individually bounded before Narratio validates or
+materializes them. These per-file limits do not reserve disk space: prevent hard
+disk exhaustion with filesystem, service, container, or volume quotas sized for
+the session workload.
+
 ## Cleanup
 
 Session-scoped cleanup:
@@ -309,9 +811,30 @@ Rules:
 
 - `clean` deletes work/spool session state;
 - cache is preserved unless `--clear-cache` is set;
-- automatic post-publish cleanup is gated by successful publish commit plus:
+- each deletion is confined beneath its configured workspace, spool, or cache
+  root; root, traversal, and out-of-root targets are refused;
+- the final cleanup stage is gated by successful publish evidence plus:
   - `pipeline.spool.delete_audio_after_publish=true`
   - `pipeline.workspace.cleanup_after_publish=true`
+  - the manifest publish record has `uploaded=true`, the published run ID, the
+    exact remote commit key, and the current commit-pointer key.
+
+Cleanup derives only the configured run-scoped spool and workspace targets,
+uses root-confined deletion, and does not read or mutate object storage. A
+failure leaves publish succeeded and the remote committed snapshot current.
+Retry with a normal full run: valid upstream work, including publish and notify,
+is skipped while the failed cleanup stage runs again. `run-stage cleanup` is
+also available when the manifest has valid publish evidence. A range ending at
+`notify` or earlier and the standalone `publish` command never delete local
+state.
+
+Older local manifests that contain the retired cleanup-obligation field are
+intentionally incompatible with strict manifest decoding. If such an
+obligation is still outstanding, complete it with the pre-upgrade binary.
+Otherwise verify that the remote publication is committed, move aside or
+regenerate the incompatible local manifest (or restore the verified remote
+snapshot), and then use the cleanup stage. Manual JSON editing is not the
+normal migration path.
 
 ## Operational Caveats
 
@@ -319,4 +842,5 @@ Rules:
 - Publish requires prerequisite stages through `render` and `analyze` to be succeeded.
 - Markdown publish defaults require render outputs (`transcripts/final.md` and `transcripts/final.trimmed.md`).
 - Restore requires configured object storage and committed remote current state.
-- Storage-backed commands load filesystem secrets before object-store initialization.
+- Pipeline-loading commands bootstrap filesystem secrets once before configuration
+  resolution and object-store initialization.

docs/policy/agents.md

@@ -0,0 +1,95 @@
+# Agent Policy
+
+**Base Policy Version:** 1.1
+
+**Last Updated**: 2026-09-25
+
+## Purpose
+
+Agents working in this repository must read and adhere to the following house rules.
+
+## Implementation Discipline
+
+**KEY PRINCIPLES:** Write the simplest idiomatic code that satisfies the user's
+request. Do not implicitly strengthen requirements, restrictions, or guarantees
+beyond what the user actually requested.
+
+Simplify the mechanism, not the user's choices.
+
+**Keep implementation machinery proportionate.** Use straightforward,
+idiomatic code and introduce only the machinery needed to support the requested
+behavior and flexibility. Optimize for conceptual simplicity and
+maintainability, not for the fewest lines, fewest options, or narrowest product
+surface.
+
+**Do not invent restrictions.** Do not reject, prohibit, constrain, cap,
+harden, or otherwise narrow behavior unless required by the user, an explicit
+repository contract, or an unavoidable correctness constraint. Preserve
+operator and caller choice where policy has not been established. If an
+additional restriction appears advisable, present it as a decision rather than
+silently implementing it.
+
+A correctness constraint must follow from the requested behavior or an
+established invariant, not from the convenience of the chosen implementation.
+Explain the specific failure it prevents and why a less restrictive
+implementation cannot satisfy the contract.
+
+**Do not invent guarantees.** Do not strengthen public contracts, guarantees,
+or invariants beyond those expressly requested by the user.
+
+**Use the standard library.** For example: in almost every case, the best
+approach to copying files is to use the standard library. Writing custom code to
+implement power-loss protection at the application level, or to guard against
+bad actors with privileged and concurrent access to the host's filesystem,
+is wasteful, unnecessary, and not idiomatic. Stick to the simple, standard, and
+idiomatic approach unless another path is expressly requested by the user.
+
+**An implementation detail is not repository policy.** Tests and documentation
+must not elevate incidental behavior into a durable guarantee or restriction
+unless that behavior was expressly selected as part of the contract. Existing
+explicit contracts remain authoritative; changing or weakening one requires a
+deliberate decision rather than being inferred from this principle.
+
+Agent-authored plans, tests, documentation, and prior implementations are not
+evidence that an additional restriction was deliberately approved. Identify the
+authorizing requirement or decision; when that authority is unclear, surface
+the ambiguity rather than treating repetition as approval.
+
+Standard-library guidance does not authorize weakening Narratio's established
+filesystem, manifest, or publication contracts. Preserve them unless a deliberate
+decision changes them.
+
+## Git Commit Policy
+
+By default, create a commit after completing each coherent unit of work, using a
+concise, plain-English message describing what changed. This policy is standing
+authorization to create those local commits; a separate user request is not
+required. An explicit user instruction to leave work uncommitted takes precedence.
+
+A unit of work is a focused, reviewable outcome, including its relevant tests and
+documentation. Do not commit after every intermediate edit or create empty commits.
+Complete the appropriate validation before committing. If work is incomplete or
+validation is blocked, report that state rather than presenting it as completed.
+
+Before committing:
+
+1. Run `git status --short` and review the relevant diff, including any staged
+   changes. Identify changes that predate the current unit of work.
+2. Exclude secrets, local environment files, generated junk, and unrelated changes.
+3. Stage only the files or hunks belonging to the completed unit. Use `git add .`
+   only when every included change belongs to that unit. Do not disturb unrelated
+   staged or unstaged work.
+4. Review `git diff --staged` and run appropriate checks for the change. Do not
+   repeat checks already passed for unchanged content merely to create a commit.
+5. Review `git log --oneline -n 10` and use
+   `git commit -m "<concise plain-English commit message>"`.
+6. Report the commit identifier and any remaining uncommitted work.
+
+If the unit cannot be safely separated from pre-existing work, leave it uncommitted
+and explain the overlap rather than silently including that work. If a commit
+fails, preserve the changes and report the failure; do not bypass hooks.
+
+Default commit authorization does not authorize pushing, publishing, amending,
+resetting, reverting, or rewriting history. Those actions require a separate user
+instruction. Do not use `git commit -a` or `git commit --no-verify` to bypass the
+staging and validation discipline above.

docs/policy/architecture.md

@@ -1,5 +1,9 @@
 # Architecture
 
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
 This document defines Narratio's intended high-level architecture and the
 invariants that changes must preserve. Implemented component details belong in
 the [Internal Overview](../internal/overview.md) and its linked documents.
@@ -29,6 +33,10 @@ in the [integration documentation](../integrations/).
 The pipeline has one canonical ordered stage set. Configuration may enable,
 disable, or parameterize supported behavior, but it must not turn that sequence
 into an arbitrary DAG or hide orchestration in generic workflow abstractions.
+An invocation selects either the full sequence or one inclusive contiguous
+range of it. Execution remains flat and canonical even though invalidation is
+dependency-aware: the application owns a separate fixed relation used only to
+stale transitive dependents, including dependents outside a selected range.
 The implemented stage inventory belongs in the
 [Internal Overview](../internal/overview.md).
 
@@ -87,8 +95,10 @@ merely on incidental files existing on disk.
 
 A failed or interrupted stage must not be presented as successful. Failure
 should preserve enough local state and diagnostics for inspection, recovery,
-and resume. Forcing an upstream stage invalidates succeeded downstream work
-according to the canonical stage order.
+and resume. Forcing a stage invalidates succeeded transitive dependents
+according to a fixed application-owned relation that is separate from canonical
+execution order. The relation is validated against the stage inventory and is
+not configurable.
 
 A stage may explicitly self-skip with a stable reason and no outputs. That
 outcome is persisted, clears older outputs owned by the stage, and is
@@ -110,8 +120,11 @@ adapter and publish metadata.
 
 Resume and skip decisions are manifest-driven. Filesystem state may be
 inspected and validated, but file presence alone does not replace recorded
-stage state. Invocation-scoped run records provide an audit of one execution;
-they do not replace the session manifest as progress authority.
+stage state. Each invocation retains an in-memory command summary and a
+run-local workspace identity, but neither is a durable progress ledger. The
+physical run directory is created on demand only when an executing stage
+requires it; a fully reused invocation or a cleanup-only invocation does not
+leave an empty run directory.
 
 Restore treats committed remote current state as its authority. It must plan
 deterministically, confine remote-to-local paths, protect local conflicts, and
@@ -119,6 +132,17 @@ install the validated session manifest after other restored durable files. The
 physical workflow and recovery procedures belong in
 [Operations](../operations.md).
 
+Restore and runner transitions for one session use the same local lock. A
+durable incomplete-restore marker blocks runner reuse after a partial restore;
+safe retry, rather than rollback of arbitrary local effects, is the recovery
+mechanism. Restored manifest-local references must be confined to the selected
+local session root, never trusted as producer-machine absolute paths.
+
+For the immutable remote-commit protocol, a restore or status operation binds
+to one pointer-selected commit and only its declared object identities. A force
+flag may replace an eligible regular managed file, but never turns a directory
+or other non-regular conflict into a successful restore.
+
 ## Configuration
 
 Configuration is strict, explicit, centralized, and operator-oriented.
@@ -126,8 +150,16 @@ Configuration is strict, explicit, centralized, and operator-oriented.
 - YAML decoding rejects unknown fields.
 - Defaults are centralized and testable.
 - Empty configured values do not silently replace meaningful defaults.
-- Validation rejects invalid composition before stage execution where
+- Validation rejects invalid configuration before stage execution where
   practical.
+- Root-owned imports and one selected overlay resolve deterministically through
+  the configuration owner; commands do not implement their own merge rules.
+- Canonical party rosters are campaign-owned. Their derived players projection
+  and concrete character-family artifacts are resolved before runtime stages
+  or adapters receive configuration.
+- Resume uses stage- or artifact-owned semantic evidence for observable
+  result-affecting configuration; overlay identity and an effective digest are
+  provenance, never blanket cache keys.
 - Session templating remains narrow and deterministic rather than becoming a
   general configuration language.
 - Secret values are supplied indirectly and are not persisted in ordinary
@@ -146,6 +178,10 @@ Canonical helpers own workspace, spool, cache, session, run, input, transcript,
 artifact, log, report, configuration, and publish-current paths. Callers must
 not reconstruct canonical paths through scattered string concatenation.
 
+Reusable audio cache entries require a typed record that binds a confined,
+no-follow regular file and its digest to the selected remote object identity.
+Size alone and unqualified multipart ETags are not content-integrity evidence.
+
 Artifact resolution is deterministic and manifest-aware. Producers materialize
 canonical outputs before reporting success, and consumers resolve declared
 artifact identities rather than infer files from unrelated directory contents.
@@ -156,8 +192,8 @@ availability.
 Writes, moves, replacements, and deletions must use narrow, explicit,
 root-confined destinations. Symlinks, traversal, broad roots, and ambiguous
 relative destinations must not expand the scope of an operation. Cleanup is
-permitted only through explicit operator action or configured post-publish
-gates, and it must preserve durable cache unless cache removal is explicitly
+permitted only through explicit operator action or the configured final cleanup
+stage, and it must preserve durable cache unless cache removal is explicitly
 requested.
 
 Physical layout, retention, and operational lifecycle belong in
@@ -167,29 +203,61 @@ contracts belong under [Integrations](../integrations/).
 ## Publish Commit Boundary
 
 Publish has one explicit remote commit boundary. A remote run becomes current
-only after Narratio has successfully uploaded the run record, required published
-outputs, `current/manifest.json`, and finally `current/run_id.txt`.
+only after Narratio has successfully uploaded its immutable run-scoped objects,
+the immutable commit manifest, and finally the current commit pointer.
 
-`current/run_id.txt` is the commit marker and must be written last. Failed,
-incomplete, skipped, or uncommitted publish attempts must not be presented as
-current remote state. Publish locks remain authoritative and are not bypassed by
-a forced run.
+`current/commit-pointer.json` is the sole mutable selector and must be written
+exactly once, last. Failed, incomplete, skipped, or uncommitted publish attempts
+must not be presented as current remote state. Publish locks remain authoritative
+and are not bypassed by a forced run. Each mutable remote lock is an independent
+per-source object; lock mutations use provider-enforced generation preconditions.
+Publish revalidates every initially unlocked participating source after writing
+the immutable commit and before pointer selection. A lock observed then leaves
+the prior committed snapshot current. A lock created after that final check may
+race the pointer write; the commit protocol does not claim a stronger distributed
+transaction boundary.
 
 Automatic local cleanup is permitted only after a successful publish commit,
 only when explicitly configured, and only through the path-safety guardrails.
+It is the final ordinary pipeline stage after `notify`. The stage derives its
+exact run-scoped targets from validated publish metadata and the configured
+campaign/session identity; it never infers a target from directory contents or
+rereads remote storage. A cleanup failure makes the invocation incomplete while
+leaving publish succeeded and the committed remote snapshot authoritative. A
+normal later full run reuses valid upstream stages and retries cleanup.
+
+The standalone `publish` command selects only publish and therefore never
+invokes cleanup. Operators may select cleanup directly only when the manifest
+contains valid successful publication evidence.
 
 ## Security, Privacy, And Diagnostics
 
-Narratio handles private campaign material. Transcripts, prompts, generated
-artifacts, reports, logs, manifests, and diagnostic files are potentially
-sensitive.
+Narratio distinguishes ordinary workspace data from credentials. Campaign and
+session material—including manifests, transcripts, prompts, generated
+configuration, logs, reports, diagnostics, and Notarius artifacts—is
+intentionally shareable with the configured workspace group. API-key material
+is sensitive and is not covered by the ordinary workspace-sharing policy.
+
+Narratio supports Linux on amd64 and arm64. macOS arm64 is best effort: it has
+a cross-build gate and release asset, but no native runtime release gate.
+Windows and macOS amd64 are unsupported and have no compatibility promise or
+release asset.
+
+On supported systems, Narratio-created ordinary workspace directories converge on
+setgid `02775` and ordinary workspace files on `0664`, even when the caller's
+umask is restrictive. This preserves the existing workspace group for nested
+creation and atomic replacements without changing ownership. API-key storage
+uses a separate restrictive contract.
 
 Raw secrets must not be stored in pipeline, campaign, or session YAML or written
 to manifests, logs, generated configuration, reports, publish metadata,
-documentation, or examples. Secrets enter through configured environment
-variable names or secret-file references. Diagnostics should avoid transcript
-and prompt content unless a deliberate, bounded inspection mechanism requires
-it.
+documentation, or examples. Pipeline configuration names environment variables;
+command-owned startup may populate previously unset variables from ConfigKit's
+explicit or conventional secrets directory. This bootstrap occurs once per
+invocation before any typed configuration load or adapter construction and is
+not hidden inside library loaders. Safe bootstrap diagnostics may identify
+files and statuses but never values. Diagnostics should avoid transcript and
+prompt content unless a deliberate, bounded inspection mechanism requires it.
 
 Logs, reports, generated invocation files, generated configuration, and render
 debug files are diagnostics, not canonical pipeline products. They should be

docs/policy/documentation.md

@@ -1,5 +1,9 @@
 # Documentation Policy
 
+**Base Policy Version:** 1.1
+
+**Last Updated**: 2026-09-25
+
 ## Purpose
 
 This policy assigns each documentation topic to one canonical owner. Its goal is
@@ -59,6 +63,10 @@ secret values.
 | --- | --- | --- | --- |
 | Product orientation and minimal end-to-end quickstart | `README.md` | What Narratio is, why it is useful, one shortest successful invocation, and links onward. | Complete command reference, configuration reference, operational procedures, implementation detail. |
 | Contributor entry point | `docs/development.md` | Task-oriented reading guide, minimal contributor orientation, baseline validation commands, and links to canonical docs. | Package inventory, architecture rules, subsystem behavior, detailed change recipes. |
+| Agent policy | `docs/policy/agents.md` | Agent implementation discipline, authority boundaries, and local commit policy. | Application contracts, architecture, testing policy, and contributor procedures. |
+| Release policy | `docs/policy/release.md` | Versioning, release integrity, documentation and validation requirements, immutability, publication controls, and explicit exceptions. | Repository-specific commands, installation, historical summaries, and CI implementation detail. |
+| Maintainer release procedure | `docs/release.md` | Prerequisites, concrete candidate validation and publication commands, deliverables, failure recovery, and optional consumer-facing inspection. | General release requirements and exceptions, current application contracts, and historical release summaries. |
+| Historical release summary | `docs/releases/<tag>.md` | Immutable summary, compatibility, upgrade, and changes for one released version. | Current maintainer procedure and current application contract details. |
 | Current application architecture | `docs/policy/architecture.md` | System shape, normative ownership, dependency direction, architectural boundaries, invariants, safety properties, and non-goals. | Concrete package inventory, implementation mechanics, contributor procedures, decision history, future work. |
 | Documentation organization | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
 | Testing policy | `docs/policy/testing.md` | Test philosophy, risk-based sufficiency, test boundaries, doubles, coverage guidance, regression-test policy, and criteria for adding, rewriting, or deleting tests. | Subsystem behavior, application contracts, subsystem-specific test inventories, and implementation plans. |
@@ -98,6 +106,14 @@ configuration, operational, or integration contract. When a workflow crosses
 these topics, choose the document that owns the task and link to the other
 contracts.
 
+### Releases
+
+[Release policy](release.md) owns requirements and explicit exceptions;
+[the release procedure](../release.md) owns the commands used to satisfy them.
+Release notes record history at an immutable tag. Neither the procedure nor a
+release note may silently weaken policy or substitute for updates to current
+canonical documentation.
+
 ### Contracts And Implementation
 
 Integration and API documents define externally observable shapes and

docs/policy/release.md

@@ -0,0 +1,221 @@
+# Release Policy
+
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
+## Purpose
+
+This policy defines the minimum requirements for selecting, validating,
+publishing, verifying, and correcting releases. Its goal is to make every
+release intentional, reproducible from an exact source revision, documented
+for consumers, and safe from retrospective replacement.
+
+The repository-specific commands that implement these requirements belong in
+`docs/release.md`. Historical release summaries belong in `docs/releases/`.
+Neither document may weaken this policy, including its explicit repository
+exceptions.
+
+## Release Model
+
+A release consists of:
+
+- one exact source commit reachable from the repository's primary branch;
+- one immutable version tag identifying that commit;
+- one version-matched, checked-in release note; and
+- every artifact, image, package, registry entry, or other deliverable the
+  repository declares for that release.
+
+The repository's primary branch is `main` unless an adopted policy documents
+an exception. A release candidate must be committed and pushed to that branch
+before its release tag is published.
+
+The source tag is the authoritative release identity. Published deliverables
+must be traceable to the tagged source and must agree with its version. A
+repository may publish source only. When it publishes additional deliverables,
+its release procedure must enumerate them and define how each is built,
+identified, published, and verified.
+
+Release automation may validate or publish a release only when its exact
+responsibility is documented. Automation must not silently change the source
+candidate, move a published tag, replace a published deliverable, or repair a
+release in place.
+
+## Versioning And Compatibility
+
+Stable releases use Semantic Versioning in the form `vMAJOR.MINOR.PATCH`, with
+no leading zeroes. Each version must be unused locally and in every configured
+remote or publication channel before publication begins.
+
+Unless an adopted policy explicitly supports and defines prereleases,
+prerelease versions are not permitted.
+
+For releases at or after `v1.0.0`:
+
+- a major release may make intentional incompatible changes;
+- a minor release may add backward-compatible behavior; and
+- a patch release may make backward-compatible fixes.
+
+Before `v1.0.0`, a minor release may change a documented public, operational,
+configuration, data, integration, or compatibility contract when the release
+note explains the impact and required consumer action. A patch release must
+not intentionally break those contracts within its minor line.
+
+A repository with additional compatibility promises must define them in its
+adopted policy or canonical contract documentation. A release note may explain
+a compatibility change, but it must not redefine the current compatibility
+contract.
+
+## Release Documentation
+
+Every release made under this policy must include
+`docs/releases/<version>.md` in the tagged source tree. The filename must use
+the complete version tag, and the document must begin with a title containing
+the product name and that exact version.
+
+Every new release note must contain these sections:
+
+```markdown
+# <Product> vMAJOR.MINOR.PATCH
+
+This release ...
+
+## Summary
+
+## Compatibility
+
+## Upgrade
+
+## Changes
+```
+
+Use an explicit statement such as "No action required" when a section has no
+substantive content.
+
+Release notes are immutable historical summaries. They should link to current
+canonical documentation for exact behavior. Every affected canonical document
+must be updated in the same candidate; a release note must not substitute for
+current documentation or defer required documentation changes.
+
+## Candidate Preparation And Validation
+
+Each repository must provide one documented release-check command or script
+that exercises the complete set of automated source-candidate gates. The
+repository-specific procedure must state all additional manual gates.
+
+The required gates are:
+
+- dependency or module hygiene appropriate to the language and ecosystem;
+- the complete deterministic, offline default test suite;
+- static analysis and linting used by the repository;
+- formatting and whitespace checks;
+- validation of maintained examples, configuration, schemas, generated
+  sources, and documentation commands where applicable;
+- review of changed local documentation links;
+- removal of obsolete roadmap documents under `docs/roadmap/` that describe
+  completed work included in the release; and
+- review for unintended files, generated output, credentials, private data,
+  and unrelated changes.
+
+## Publication Guards
+
+Immediately before publication, the maintainer or release automation must
+fetch the current primary branch and tags from the authoritative remote and
+verify all of the following:
+
+- the version has the required format and is not already published;
+- the current branch is the primary release branch;
+- the worktree and index are clean;
+- the current commit is the recorded, validated candidate;
+- the authoritative remote branch points to that same commit;
+- the matching release note exists in that commit and has the required title
+  and sections;
+- all required approvals and automated gates succeeded for that commit; and
+- no local or remote tag already uses the selected version.
+
+Create the version tag against the guarded commit and verify its target before
+publishing it. Publish only the exact intended ref and deliverables. Broad
+operations such as `git push --tags` are discouraged because they can publish
+unreviewed refs unrelated to the release.
+
+The repository-specific procedure must make these guards executable or give
+copyable commands for performing them.
+
+## Immutability And Correction
+
+Published version tags and published deliverables are immutable. Do not move,
+overwrite, recreate, or delete a published tag. Do not replace an artifact,
+image, package, checksum, signature, provenance statement, or release note
+under an already published version.
+
+If validation fails before publication, correct the candidate, rerun the
+complete gates, and repeat the publication guards. An unpublished local tag
+may be removed after confirming that it was never published or used by a
+release channel.
+
+If publication or post-publication verification reveals a defect, leave the
+published release intact. Correct the defect on the primary branch, choose a
+new patch version or other semantically appropriate new version, write a new
+matching release note, and perform the complete release procedure again.
+
+A distribution channel's supported yank, deprecation, or advisory mechanism
+may warn consumers away from a defective release, but it must not replace that
+release's contents or reuse its version.
+
+## Repository Release Procedure
+
+Every adopting repository must maintain `docs/release.md` as the canonical
+maintainer runbook for implementing this policy. It must define, in execution
+order:
+
+1. maintainer prerequisites and required access;
+2. version selection and compatibility review;
+3. release-note creation;
+4. candidate preparation and the complete validation command;
+5. candidate commit, push, and exact commit recording;
+6. publication guards;
+7. exact tag and deliverable publication commands;
+8. authoritative remote and consumer-facing verification; and
+9. failure handling and correction.
+
+The procedure should use copyable, fail-fast commands where practical. It must
+name the primary branch, authoritative remote, tag form, published
+deliverables, supported build targets, release automation responsibilities,
+and consumer verification path. It must link to this policy instead of
+restating or redefining its requirements.
+
+## Policy Exceptions
+
+### Tag-push completion and asynchronous deliverables
+
+Narratio's automated release responsibility ends when the exact intended tag is
+successfully pushed to `origin`. It must not wait for, poll, or check CI/Gitea
+results, download assets, or verify their checksums as a completion condition.
+Binary and checksum publication is asynchronous; consumer-facing inspection is
+optional follow-up, not a gate on the source release.
+
+This deliberately qualifies the base policy's complete-deliverable and
+post-publication verification requirements. CI reliability is outside the
+release command's scope; an unavailable publication service must not cause an
+automated releaser to wait indefinitely or claim to repair a published version.
+
+Compensating controls are complete local candidate validation (including supported
+cross-builds and a host version check), exact source/tag guards, immutable source
+tags, asynchronous build validation, and non-overwriting asset publication.
+Successful tag publication is not evidence that binary assets are available.
+Optional inspection and corrective-release procedures belong in
+[the release procedure](../release.md).
+
+### Authoritative publication scope
+
+Narratio's synchronous publication guards inspect the authoritative `origin`
+remote and its `main` branch, not every configured Git remote or a Gitea release
+entry. The command does not add release-service or registry availability checks.
+This qualifies the base policy's all-channel unused-version requirement.
+
+Other remotes are not Narratio release authorities, and Gitea asset publication
+is asynchronous. The compensating controls are local and origin tag uniqueness,
+exact candidate matching, and the publisher's non-overwrite settings. Any known
+already-published version or conflicting deliverable remains ineligible for
+reuse: choose a new version rather than bypassing guards. A future additional
+distribution channel requires deliberate policy/procedure updates.

docs/policy/testing.md

@@ -1,5 +1,9 @@
 # Testing Policy
 
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
 ## Purpose
 
 Our tests exist to make **incorrect changes expensive and correct changes cheap**.

docs/release.md

@@ -0,0 +1,167 @@
+# Releasing Narratio
+
+This is the maintainer runbook for the [Release Policy](policy/release.md).
+Its [explicit exceptions](policy/release.md#policy-exceptions) preserve the
+successful tag push as the automated responsibility boundary. Binary publication
+is asynchronous; later consumer-facing inspection is optional.
+
+## Prerequisites and publication scope
+
+Use a checkout on `main` with Git authentication permitting fetches and pushes
+to `origin`, the authoritative Git remote. Install Git, a POSIX shell, standard
+Unix build tools, and the Go toolchain below. Make required modules available
+before offline validation. No model/provider credentials are needed. Gitea
+publication credentials belong to CI's secret store, not the local command.
+
+Synchronous guards inspect local tags and `origin`, not every configured remote
+or Gitea release entry. Do not select a version known to have been published in
+any channel, even if these guards cannot see it.
+
+## Go prerequisite
+
+Release preparation requires the maintained Go 1.26 baseline. Tag CI currently
+uses the explicitly pinned `golang:1.26.7` image for validation and asset builds.
+That asynchronous work does not change the tag-push completion boundary.
+
+## Choose a version and write its note
+
+Select an unused stable version under the
+[versioning rules](policy/release.md#versioning-and-compatibility). Narratio is
+past v1.0.0; intentional CLI/configuration breaks require a major release.
+
+Create `docs/releases/vMAJOR.MINOR.PATCH.md` using the
+[required note structure](policy/release.md#release-documentation).
+Describe CLI, configuration, artifact, integration, and operating-contract
+changes, and the required operator action. Link to current canonical
+documentation for exact behavior.
+
+## Prepare and record the candidate
+
+Before committing, perform these manual reviews in addition to automated checks:
+
+- Confirm compatibility/version selection and update affected canonical
+  documentation and maintained examples.
+- Remove completed roadmap documents covering work included in this release;
+  retain pending work. Their history remains in Git. Do not delete historical
+  release notes.
+- Review the diff, staged changes, and untracked files for credentials, private
+  data, generated output, unintended files, and unrelated changes.
+- Review changed documentation links and behavior-bearing commands. Automated
+  link checks supplement rather than replace review.
+
+Commit the note and candidate changes, then push that commit to `main` through
+the ordinary development workflow. Record the exact candidate:
+
+```sh
+git rev-parse HEAD
+```
+
+Do not create a tag until `origin/main` points to that same commit. If the
+candidate changes, repeat the reviews and validation.
+
+## Validate the candidate
+
+From the repository root, run:
+
+```sh
+scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH
+```
+
+The script also works when invoked by its absolute path from another directory.
+It validates the version and matching note, module hygiene, formatting,
+whitespace, uncached tests, race tests, static checks, documentation, examples,
+and three cross-build assets. It uses `GOWORK=off`, does not contact application
+services, CI, or Gitea, and does not create tags or modify tracked source.
+Fix failures on `main`, commit, push normally, and rerun validation.
+
+The macOS cross-build proves compilation, not native runtime behavior.
+
+## Declared deliverables and automation
+
+The source release is the exact version tag at the validated commit.
+The tag-triggered `.woodpecker/release.yml` validates the tagged source,
+runs `scripts/build-release-assets.sh`, and publishes these Gitea assets:
+
+- `narratio-vMAJOR.MINOR.PATCH-linux-amd64`
+- `narratio-vMAJOR.MINOR.PATCH-linux-arm64`
+- `narratio-vMAJOR.MINOR.PATCH-darwin-arm64` (best effort)
+- `SHA256SUMS`
+
+The builder embeds the version, disables ambient Go workspaces, and checks a
+host binary's `version` output. The release publisher uses the matching
+checked-in note and generates SHA-256 checksums. Existing files are skipped and
+overwrite is disabled. No image or package-registry deliverable is declared.
+CI does not choose versions, modify source candidates, or move tags.
+
+## Publish the tag
+
+From a clean checkout on `main` whose `HEAD` equals `origin/main`, run:
+
+```sh
+scripts/release.sh vMAJOR.MINOR.PATCH
+```
+
+The command fetches and checks `origin/main`, re-runs candidate validation,
+then fetches and checks again before creating an explicitly unsigned lightweight
+tag for the originally recorded commit. It refuses dirty, divergent, changed,
+or already-tagged candidates. It verifies the local tag target and pushes only:
+
+```text
+refs/tags/vMAJOR.MINOR.PATCH:refs/tags/vMAJOR.MINOR.PATCH
+```
+
+It never commits changes, pushes `main`, force-pushes, moves tags, or pushes all
+tags. Successful publication of that ref completes the command; it prints the
+tag and commit and returns without waiting for CI, querying Gitea, downloading
+assets, or checking checksums.
+
+## Failure handling
+
+Before tag creation, correct the candidate on `main` and repeat validation.
+If a push fails after local tag creation, the local tag is retained for inspection.
+Do not retry blindly or assume the remote received nothing: a connection failure
+can leave publication uncertain. Inspect the exact remote ref before taking any
+local-tag cleanup action. This is recovery from a failed command, not a
+post-success publication gate.
+
+After publication, follow the
+[immutability and correction rules](policy/release.md#immutability-and-correction).
+Correct defects or failed asynchronous publication with a new semantically
+appropriate version, matching note, and the complete procedure. Never replace
+existing tagged assets in place.
+
+## Optional asynchronous inspection
+
+A human may later inspect the tag-triggered Woodpecker job and Gitea release.
+This is optional follow-up, never part of the automated releaser's completion
+criteria. Do not wait for or poll CI/Gitea from the release command.
+
+For optional source verification, substitute the released version below and
+compare the remote target to the recorded candidate hash:
+
+```sh
+git ls-remote --tags origin refs/tags/vMAJOR.MINOR.PATCH
+git rev-parse 'refs/tags/vMAJOR.MINOR.PATCH^{commit}'
+```
+
+Download the three named binaries and `SHA256SUMS` from the matching Gitea release
+into an empty inspection directory. In that directory, verify on Linux:
+
+```sh
+sha256sum --check SHA256SUMS
+```
+
+On macOS, use `shasum -a 256 --check SHA256SUMS`. After successful verification,
+make the matching host binary executable and run its version command, for example
+on Linux amd64 (replace the version in both commands):
+
+```sh
+chmod +x ./narratio-vMAJOR.MINOR.PATCH-linux-amd64
+./narratio-vMAJOR.MINOR.PATCH-linux-amd64 version
+```
+
+Expected output is `narratio vMAJOR.MINOR.PATCH`. Use only the matching architecture
+on other supported hosts. Checksums establish consistency with the downloaded
+checksum file, not a new signature or independent authenticity guarantee.
+Missing assets are an asynchronous publication problem, not grounds to move or
+reuse the successfully published source tag.

docs/releases/README.md

@@ -0,0 +1,28 @@
+# Release Notes
+
+This directory contains immutable historical release notes for Narratio.
+Future notes are created with the matching stable version and use this minimum
+structure:
+
+```markdown
+# Narratio vMAJOR.MINOR.PATCH
+
+This release ...
+
+## Summary
+
+## Compatibility
+
+## Upgrade
+
+## Changes
+```
+
+See the [release procedure](../release.md) for creating a candidate and tag.
+When asynchronous publication succeeds, the corresponding Gitea release is the
+canonical source for downloadable binaries and checksums.
+
+- [v2.0.0](v2.0.0.md)
+- [v1.7.0](v1.7.0.md)
+- [v1.6.0](v1.6.0.md)
+- [v1.5.0](v1.5.0.md)

docs/releases/v1.5.0.md

@@ -0,0 +1,47 @@
+# Narratio v1.5.0
+
+Narratio v1.5.0 makes repeated post-transcript artifact development faster and
+more explicit while retaining the fixed, stage-driven pipeline model.
+
+## Highlights
+
+- The canonical pipeline now completes deterministic rendering before
+  extraction, cleanly separating transcript-generating stages from
+  artifact-generating stages.
+- `narratio run` and `narratio session plan` accept inclusive `--from` and
+  `--through` bounds. Excluded transcript stages are not executed or
+  invalidated by a bounded artifact-regeneration run.
+- `narratio regenerate-artifacts SESSION` is an exact convenience alias for a
+  forced run from `extract` through `analyze`, including focused
+  `--artifacts` selections.
+- Configured Scriptorium artifacts now have independent,
+  manifest-authoritative freshness. Narratio reuses validated current work,
+  rebuilds stale prerequisites in dependency order, and persists successful,
+  failed, and newly stale artifact state when an analysis invocation only
+  partially succeeds.
+- Publish consumes only configured artifacts backed by current manifest
+  evidence; incidental or tampered files are not promoted as current output.
+
+## Reliability And Administration
+
+- Bounded prerequisites are checked again under the session lock before any
+  run mutation, closing a concurrent-run race.
+- Analysis fingerprints are stable across executable and configuration path
+  changes and continue to cover only Narratio-observable semantic inputs.
+- Runner composition now carries one validated execution plan from command
+  parsing through prerequisite validation, adapter composition, manifest
+  recording, and stage execution.
+- `narratio version` reports the exact tag embedded in official release
+  binaries; ordinary source builds report `dev`.
+
+## Upgrade Notes
+
+- Existing unbounded commands and direct `run-stage`, `analyze`, and `publish`
+  workflows retain their meanings.
+- Manifests written before artifact-level analysis state remain readable.
+  Legacy aggregate analysis success is not sufficient freshness evidence, so
+  the first analysis evaluation after upgrading may regenerate configured
+  artifacts once.
+- Narratio cannot observe executable contents or configuration, prompt,
+  profile, module, and other files loaded privately by Scriptorium. Explicitly
+  force affected artifacts after changing those private inputs.

docs/releases/v1.6.0.md

@@ -0,0 +1,74 @@
+# Narratio v1.6.0
+
+Narratio v1.6.0 makes large pipeline configurations easier to organize,
+inspect, and vary while adding character-oriented artifact generation and a
+guarded, reproducible release procedure.
+
+## Summary
+
+Pipeline configuration can now be assembled from explicit additive imports and
+a selected production or testing profile. Campaigns can own a canonical,
+versioned party roster, and Scriptorium artifact families can expand one
+definition into concrete per-character artifacts, dependencies, variables, and
+publish rules.
+
+New read-only configuration commands expose the fully resolved pipeline,
+source provenance, semantic digest, and profile differences before a session is
+run. Stage reuse now records configuration-sensitive semantic evidence so
+profile or configuration changes cannot silently reuse incompatible work.
+
+## Compatibility
+
+This is a backward-compatible feature release. Existing monolithic pipeline
+files, concrete Scriptorium artifacts, publish rules, and configurations
+without profiles remain supported. When profiles are declared and no explicit
+profile is selected, Narratio uses the configured production default.
+
+An unversioned party file plus a separate players file remains available as an
+isolated legacy compatibility path, but it cannot drive artifact families. New
+campaigns and new party-oriented features should use the `narratio.party.v1`
+schema. Existing manifests remain readable; missing legacy semantic evidence
+is treated as stale rather than trusted.
+
+Narratio continues to consume the documented Notarius D&D pipeline contract.
+The release workflow still cross-compiles Linux, macOS, and Windows binaries
+for `amd64` and `arm64`; cross-compilation is not native runtime evidence for
+macOS or Windows.
+
+## Upgrade
+
+No special action is required for existing monolithic configurations that do
+not adopt profiles or artifact families. On the first run after upgrading,
+stages recorded by older manifests may regenerate once because those records do
+not contain the new semantic configuration evidence.
+
+To adopt the new configuration model, use the maintained
+`examples/production-testing` bundle as a migration reference: split stable
+settings into explicit imports, define a production default and optional
+testing profile, convert campaign party data to `narratio.party.v1`, remove the
+separate players file, and then introduce character artifact families. Review
+the result with `narratio config validate`, `config show`, `config sources`, and
+`config diff` before running a session.
+
+Campaign, session, previous-session, and run identifiers must satisfy the
+documented portable identity grammar. Existing manifests or remote state with
+unsafe legacy identifiers must be migrated before use.
+
+## Changes
+
+- Added root-owned, non-recursive additive pipeline imports with strict,
+  source-aware conflict detection.
+- Added named pipeline profiles with an explicit production default and
+  deliberate command-line selection.
+- Added `config validate`, `config show`, `config sources`, and `config diff`
+  for read-only inspection of resolved configuration and provenance.
+- Added the strict `narratio.party.v1` campaign roster, including stable
+  character IDs, player and character names, optional aliases, and classes.
+- Added deterministic players derivation and canonical party delivery to
+  downstream integrations.
+- Added character-oriented artifact families, corresponding member
+  dependencies, family selection, and generated publish policies.
+- Added semantic configuration fingerprints and stage-specific resume checks
+  across transcript and artifact stages.
+- Added shared release candidate, asset build, and guarded tag-publication
+  scripts, with tag-triggered publication remaining asynchronous.

docs/releases/v1.7.0.md

@@ -0,0 +1,100 @@
+# Narratio v1.7.0
+
+Narratio v1.7.0 completes the maintainability refactor begun after v1.6.0. It
+simplifies filesystem and process handling, makes resumable work more precise,
+replaces legacy local and remote state with explicit authorities, and turns
+cleanup into the final ordinary pipeline stage.
+
+## Summary
+
+The session manifest is now the sole durable local progress ledger. Analyze
+checkpoints successful artifacts individually, allowing an interrupted or
+partially failed analysis to resume at the first incomplete artifact without
+rerunning successful siblings unless forced.
+
+Remote publication now commits immutable run state before advancing one
+verified current pointer. Publish locks are independent per-source objects;
+locked outputs retain their previously committed declarations rather than
+being overwritten or silently omitted. Local cleanup runs after notification
+as a separately recorded, safely retryable stage.
+
+The release also adopts Go 1.26, simplifies ordinary file operations around
+Narratio's trusted group-owned workspace model, improves subprocess lifecycle
+handling, decomposes several large orchestration and validation components,
+and removes mutable global test seams.
+
+## Compatibility
+
+This is a minor release with deliberate removal of compatibility paths that
+were deprecated and documented as subject to removal:
+
+- Campaigns must use one versioned `narratio.party.v1` `party.yml`. Separate
+  players files, session-level party overrides, and unversioned party documents
+  are rejected.
+- Session manifests must declare `schema_version:
+  narratio.session-manifest.v1` and satisfy the current strict schema. Older
+  unversioned state and manifests containing the retired
+  `post_publish_cleanup` obligation are rejected rather than migrated.
+- Remote current state must be selected by
+  `current/commit-pointer.json` and its referenced immutable run commit. Legacy
+  current-state layouts are no longer inferred.
+- The retired aggregate `locks.yml` object is ignored. Publish locks now live
+  as independent strict objects under the session lock prefix.
+- Run manifests are no longer produced or consumed. The session manifest owns
+  durable stage progress; invocation summaries and run workspaces remain
+  operational data rather than a second progress authority.
+
+The CLI and current pipeline/configuration formats otherwise remain compatible.
+Building and maintaining Narratio now requires Go 1.26. Cross-built Linux,
+macOS, and Windows assets remain available for `amd64` and `arm64`.
+
+## Upgrade
+
+Before upgrading a campaign that still uses compatibility data:
+
+1. Replace legacy party/player inputs with the documented
+   [`narratio.party.v1`](../integrations/party.md) campaign roster.
+2. If a local manifest contains an outstanding `post_publish_cleanup`
+   obligation, complete it with the pre-upgrade binary. Otherwise verify the
+   remote commit, move aside or regenerate the incompatible manifest, or
+   restore a verified committed snapshot. Do not migrate state by manually
+   editing JSON.
+3. Republish sessions that do not yet have a valid immutable run commit and
+   `current/commit-pointer.json`; legacy remote layouts are not current state in
+   v1.7.0.
+4. Recreate any required publication locks with `narratio session locks add`.
+   After verifying the new locks and publication behavior, the ignored legacy
+   `locks.yml` object may be removed manually.
+
+Existing compatible session manifests and already committed remote snapshots
+need no special action. Consult [Operations](../operations.md) and
+[Troubleshooting](../troubleshooting.md) for recovery procedures.
+
+## Changes
+
+- Upgraded the maintained development and release baseline to Go 1.26.
+- Reworked subprocess execution and Windows process-tree supervision while
+  preserving contextual wait and cleanup failures.
+- Replaced custom confined ordinary I/O and directory-promotion machinery with
+  simpler standard-library operations while retaining bounded reads, atomic
+  single-file visibility, workspace modes, validated downloads, and
+  root-confined destructive operations.
+- Removed legacy party, manifest, artifact-discovery, remote-current, and lock
+  compatibility paths.
+- Consolidated durable progress in the session manifest and removed the run
+  manifest domain model.
+- Unified runner planning and execution decisions, separated invocation
+  lifecycle responsibilities, and avoided creating empty run workspaces for
+  fully reused or cleanup-only invocations.
+- Added per-artifact analyze execution, checkpointing, reconciliation, and
+  recovery.
+- Decomposed configuration validation by domain and made validation diagnostics
+  deterministic without treating incidental ordering or wording as a contract.
+- Introduced immutable remote publish commits, one final current pointer,
+  explicit output planning, safe cross-run carried outputs, and independent
+  per-artifact remote locks.
+- Added `cleanup` as the final canonical stage after `notify`, with validated
+  publish evidence, safe retry, explicit selection, and no separate cleanup
+  obligation.
+- Replaced mutable command test hooks with invocation-scoped dependencies and
+  improved structural test diagnostics.

docs/releases/v2.0.0.md

@@ -0,0 +1,94 @@
+# Narratio v2.0.0
+
+Narratio v2.0.0 replaces its configuration infrastructure with ConfigKit,
+simplifies the supported release platforms, and makes artifact definitions and
+their effective dependency graph directly inspectable.
+
+## Summary
+
+Pipeline roots now use ConfigKit v0.1.2 for strict YAML loading, explicit
+imports, fixed-path named profiles, provenance, defaults, and typed credential
+references. The recommended production layout keeps production values in the
+base, defines each ordinary artifact and artifact family in its own imported
+file, and keeps testing changes in `profiles/testing.yml`.
+
+Configured-artifact inputs now create their dependency edges automatically.
+`narratio config artifacts` reports the finalized concrete catalog, including
+generated party-family members, without loading a session or initializing
+runtime adapters.
+
+## Compatibility
+
+This is a breaking configuration and platform release. There is no runtime
+fallback for the retired Narratio composition/profile catalog, `pipeline.secrets`
+or `secrets.env_dir`, credential `_env` fields, or the previous YAML
+presence/default behavior. Defaults apply only to absent values; explicit empty,
+zero, false, and null values retain their typed meaning and may fail Narratio
+domain validation.
+
+The maintained binaries are Linux amd64, Linux arm64, and macOS arm64. Windows
+and macOS amd64 builds are no longer produced or supported. Existing v1 release
+notes remain historical descriptions of their releases.
+
+Inspection commands still avoid session, manifest, workspace, adapter, and
+remote-service activity, but they are not credential-free loaders: every
+explicit typed credential reference in the selected effective configuration must
+resolve; references replaced or removed by that profile need not resolve.
+Pipelines containing artifact families also require a campaign so the canonical
+party can be expanded.
+`config show` is a secret-safe review projection, not a promised reloadable
+authoring file.
+
+## Upgrade
+
+Migrate each operational bundle before running v2:
+
+1. Replace old composition syntax with root-owned
+   [`configkit.imports`](../config.md#pipeline-imports-and-profiles). Imports are
+   additive base sources; they do not override one another.
+2. Fold the old production overlay into the base pipeline. Move testing changes
+   to `profiles/testing.yml`; compare the two independent resolutions with
+   `narratio config diff default testing`.
+3. Follow the maintained
+   [`examples/production-testing`](../../examples/production-testing/pipeline.yml)
+   layout: one explicit artifact entry per `artifacts/<key>.yml` and one family
+   entry per `artifact-families/<key>.yml`. The map key, not the filename, is the
+   stable artifact identity.
+4. Move credential files to an untracked `secrets/` directory beside
+   `pipeline.yml`, or pass `--secrets-dir`. Rename S3 fields to `access_key_id`
+   and `secret_access_key`, and rename the Audita field to `llm_api_key`.
+5. For static S3 credentials, configure both S3 references (commonly
+   `OBJECT_STORAGE_KEY_ID` and `OBJECT_STORAGE_KEY`) and make them resolvable.
+   To use instance roles, workload identity, shared SDK files, or another AWS SDK
+   discovery provider, omit both references. A partial pair is invalid.
+6. Remove a `depends_on` entry when it only duplicates a
+   `narratio.artifact.<key>` input. Keep explicit entries that express ordering
+   without supplying the upstream output as an input.
+7. Review ConfigKit's stricter explicit-value/null semantics and correct values
+   that previously acquired defaults after being explicitly empty. Do not use
+   `config show` output as a source migration mechanism.
+8. Run `config validate`, `config show`, `config sources`, and `config artifacts`
+   with the same profile, campaign, and secrets selection intended for runtime.
+   Resolve the campaign-owned party whenever families are present.
+9. Update deployment and download automation to one of the three maintained
+   platform assets before removing the v1 binary.
+
+The [configuration reference](../config.md), [CLI reference](../cli.md), and
+[maintained examples](../../examples/README.md) are the canonical detailed
+guides.
+
+## Changes
+
+- Adopted ConfigKit v0.1.2 across pipeline, campaign, session, and party loading
+  while keeping Narratio domain validation and post-campaign expansion explicit.
+- Added ConfigKit imports and fixed `profiles/<name>.yml` pipeline overlays,
+  unified safe effective show/diff/digest projection, and source provenance.
+- Added invocation-scoped ConfigKit secrets-directory bootstrap and typed S3 and
+  Audita credential references without exposing resolved values.
+- Inferred, normalized, and validated configured-artifact input dependencies as
+  part of the one concrete graph consumed by analyze planning and resume logic.
+- Added `config artifacts` with stable concrete identities, definition sources,
+  effective dependencies, and generated family/party provenance.
+- Added the maintained production-base/testing-overlay artifact authoring layout.
+- Reduced release assets and active platform support to Linux amd64/arm64 and
+  macOS arm64.

docs/releases/v2.1.0.md

@@ -0,0 +1,70 @@
+# Narratio v2.1.0
+
+This release adds explicit Notarius credential forwarding and cache reuse,
+with predictable forced regeneration and clearer artifact-development guidance.
+
+## Summary
+
+Narratio can pass one typed API-key reference to Notarius and opt into reuse of
+its accepted execution checkpoints. Stable, verified reference snapshots allow
+unchanged references to retain their cache identity across Narratio invocations.
+Configuration loading now uses ConfigKit v0.3.0.
+
+## Compatibility
+
+The new `notarius.llm_api_key`, `notarius.resume`, and `notarius.chunk_cache`
+fields are optional. Existing v2 configuration needs no schema migration.
+Configured credential references must resolve during configuration loading,
+even when extraction will not execute; omitted references add no requirement.
+
+Forced extraction now omits Notarius checkpoint loading and requests chunk-plan
+refresh. This includes `regenerate-artifacts`, which remains an alias for a
+forced run from extract through analyze. `analyze` continues to force analysis
+only, preserving extraction results and transcripts.
+
+Notarius v0.7.0 is the tested cache integration baseline, not an unconditional
+minimum-version gate. The executable must support the flags selected for the
+invocation, including `--chunk_cache refresh` for forced extraction. Reference
+bindings retain the contract introduced in Notarius v0.6.0. Receipt and artifact
+schemas are unchanged; reused producers may report zero production attempts.
+
+Supported release platforms remain Linux amd64/arm64 and best-effort macOS
+arm64. macOS validation is cross-compilation, not native runtime testing.
+
+## Upgrade
+
+No special migration is required for existing v2 configuration. To use the new
+features:
+
+- Declare `notarius.llm_api_key` with the environment-variable name expected by
+  the deployed Notarius profile, supplying its value through the existing
+  environment or secrets-directory mechanism.
+- Enable checkpoint recording in Notarius configuration before setting
+  Narratio's `notarius.resume: true`. Prefer explicit persistent Notarius cache
+  roots for service deployments. An optional `notarius.chunk_cache` overrides
+  its ordinary chunk-plan policy.
+- Expect an initial checkpoint miss when moving from old run-local reference
+  paths to stable session snapshots. No migration or deletion of old caches is
+  required. Force refreshes the current input's plan, not the whole cache.
+- Use `narratio analyze SESSION` for analysis-only iteration, and
+  `narratio regenerate-artifacts SESSION` when extraction should also be rebuilt.
+
+See [Configuration](../config.md), the
+[Notarius integration contract](../integrations/notarius.md), and
+[Artifact Development Workflows](../operations.md#artifact-development-workflows)
+for current details.
+
+## Changes
+
+- Upgraded ConfigKit from v0.1.2 to v0.3.0 and isolated pipeline-discovery tests
+  from machine configuration.
+- Added optional typed Notarius credentials, exact-name environment delivery,
+  safe configuration projections, and captured-stream redaction for custom names.
+- Added Notarius resume and chunk-cache controls with force taking precedence.
+- Added verified, content-addressed session reference snapshots that survive
+  ordinary run cleanup without becoming published artifacts.
+- Preserved relative-workspace support for snapshot delivery and confinement.
+- Kept credentials and cache-policy controls outside extract's semantic resume
+  identity, so operational changes alone do not invalidate completed results.
+- Added an opt-in real Notarius integration test using a local provider to
+  verify reuse, partial-failure recovery, and forced refresh without paid calls.

docs/releases/v2.1.1.md

@@ -0,0 +1,33 @@
+# Narratio v2.1.1
+
+This release fixes configuration loading for publish rules that explicitly set
+requiredness while relying on a derived destination.
+
+## Summary
+
+Publish rules with a derivable source and omitted `dest` now load correctly
+whether `required` is omitted, explicitly true, or explicitly false. Previously,
+explicit requiredness could trigger ConfigKit's `resolve.unrecorded_change`
+diagnostic instead of accepting valid configuration.
+
+## Compatibility
+
+This is a backward-compatible bookkeeping correction. Publish schemas,
+destination derivation, requiredness defaults, and YAML syntax support are
+unchanged. Explicit destinations and explicit false values remain intact.
+No ConfigKit upgrade or publication/storage behavior change is involved.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required. Operators
+need not add a derivable `dest`, remove explicit `required` values, or change
+flow-style YAML to block-style YAML. See the
+[configuration reference](../config.md#publish-configuration-summary).
+
+## Changes
+
+- Recorded derived publish destinations at ConfigKit's atomic sequence boundary
+  while retaining field-level resolution records.
+- Added real load/validation and safe effective-configuration regression coverage
+  for built-in and configured-artifact sources, explicit requiredness, and an
+  explicit destination that must remain unchanged.

docs/releases/v2.1.2.md

@@ -0,0 +1,26 @@
+# Narratio v2.1.2
+
+This release allows secrets directories to contain hidden metadata without
+preventing credential loading.
+
+## Summary
+
+ConfigKit v0.3.1 ignores dot-prefixed entries such as `.git`, `.gitignore`, and
+`.DS_Store` during secrets bootstrap. These entries no longer block otherwise
+valid credentials from loading and are omitted from bootstrap reports.
+
+## Compatibility
+
+This is a backward-compatible dependency bug fix. Configuration schemas,
+existing-environment precedence, and validation of non-hidden entries are
+unchanged. Hidden entries still count toward the directory entry limit.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required. See the
+[credential configuration reference](../config.md) for secrets-directory usage.
+
+## Changes
+
+- Updated ConfigKit from v0.3.0 to v0.3.1.
+- Clarified hidden-entry handling in the secrets-directory documentation.

docs/releases/v2.2.0.md

@@ -0,0 +1,53 @@
+# Narratio v2.2.0
+
+This release adds resumable per-speaker transcription, replayable WhisperX
+uploads, and explicit Notarius configuration profile selection.
+
+## Summary
+
+Successfully checkpointed speaker transcripts survive later transcription
+failures. Ordinary retry reuses valid completed speakers and processes only the
+remaining work. WhisperX uploads can now be replayed by the HTTP transport
+without buffering whole audio files.
+
+## Compatibility
+
+Existing CLI commands, speaker identities, transcript formats, and pipeline
+ordering are unchanged. Session manifests gain optional per-speaker completion
+evidence. Older manifests remain readable, but older Narratio binaries may
+reject manifests containing the new fields; downgrading after transcription
+is not transparent.
+
+The optional `pipeline.notarius.config_profile` field selects a downstream
+Notarius configuration profile independently of Narratio's own profile. Using
+it requires a Notarius version supporting `--config-profile`; v0.7.0 is a known
+supporting version. Omitting the field retains downstream default selection.
+
+## Upgrade
+
+No configuration migration is required. When transcribe is next selected for
+an older aggregate-only manifest, all current speakers are transcribed once
+to establish reusable evidence. Previously unrecorded results from failed runs
+are not automatically imported.
+
+Use ordinary run/resume to retain valid checkpoints. Forcing transcribe resets
+reuse of prior results; an ordinary retry after a failed forced invocation can
+retain replacements already checkpointed by that attempt. See the
+[operations guide](../operations.md) and
+[Notarius profile configuration](../config.md#notarius-configuration-profile).
+
+## Changes
+
+- Persist validated speaker completions independently of aggregate stage status,
+  with serialized saves for concurrent work and input/output integrity checks.
+- Rebuild aggregate transcript references when speakers are removed or those
+  references need repair, without retranscribing otherwise-current speakers.
+- Keep removed and incomplete speaker results out of versioned merge inputs.
+- Permit checkpoint evidence for zero-byte audio when WhisperX accepts it;
+  service rejection still fails normally.
+- Provide fresh streaming multipart bodies for HTTP transport replay while
+  preserving application retries, cancellation, and resource cleanup. This
+  addresses the missing-body-replay limitation, not persistent upstream
+  protocol failures or exactly-once service execution.
+- Pass explicit Notarius configuration profiles through the CLI and include
+  their selection in extraction reuse decisions.

docs/releases/v2.2.1.md

@@ -0,0 +1,35 @@
+# Narratio v2.2.1
+
+This maintenance release consolidates checkpoint persistence for transcription
+and analysis without changing their operator-facing behavior.
+
+## Summary
+
+Transcribe and analyze now share one internal operation for preparing isolated
+checkpoint candidates, saving them, and promoting successfully saved progress
+into live state. Each stage retains its own progress model and recovery policy.
+
+## Compatibility
+
+CLI commands, configuration, manifest schemas, artifact formats, and external
+integration contracts are unchanged. Speaker concurrency, artifact selection,
+force behavior, and ordinary resume semantics are preserved. No dependency
+upgrade or new external-tool version requirement is introduced.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required when upgrading
+from v2.2.0. See the [v2.2.0 release notes](v2.2.0.md) when upgrading from an
+earlier version for the original speaker-checkpoint upgrade considerations.
+
+## Changes
+
+- Replace duplicate analyze/transcribe save-and-promote sequences with a
+  shared, private checkpoint helper.
+- Isolate checkpoint collections from live state, including analyze records
+  normalized during a transcription checkpoint save.
+- Preserve transcription's caller-owned locking and failure handling, and
+  analysis's working/committed collections and rollback behavior.
+- Add focused checkpoint integrity tests while retaining stage and application
+  recovery coverage.
+- Document the shared [checkpoint persistence boundary](../internal/manifest.md#checkpoint-persistence-boundary).

docs/roadmap/audita.md

@@ -0,0 +1,288 @@
+# Adopt Audita v2 and ConfigKit v0.4.0
+
+Status: implemented (2026-09-25); release pending.
+
+## Goal
+
+Migrate Narratio's `polish` integration from Audita's former command/configuration
+contract to Audita v2.0.0. Keep Narratio responsible for orchestration and Audita
+responsible for correction behavior and LLM execution configuration.
+
+Adopt a consistent provider-named credential list for both Audita and Notarius,
+so operators define each secret once and explicitly share it with the downstream
+applications that need it. This is a clean cutover without backward-compatibility
+shims.
+
+Adopt ConfigKit v0.4.0 and use “overlay” consistently for Narratio's selected
+pipeline configuration, distinct from downstream LLM model profiles.
+
+Production runs use Audita's default reporting configuration: Narratio passes
+neither `--debug` nor `--reporting=false`. Normal reports remain available without
+enabling debug diagnostics. Adding debug reporting through Narratio's testing
+profile is deferred.
+
+This document defines the intended end state, migration scope, and policy.
+The [implementation plan](implementation.md) owns implementation sequencing and
+verification steps.
+
+## Baseline and upstream contract
+
+The baseline is Narratio v2.2.1 and the Audita checkout tagged v2.0.0. Upstream
+references are Audita's `docs/migrations/v2.md`, `docs/cli.md`,
+`docs/integrations/subprocess.md`, and `docs/integrations/output-files.md`,
+available in the sibling `../audita/` checkout. Narratio's current contract is
+documented in [Integration: Audita](../integrations/audita.md).
+
+The current integration is not compatible with Audita v2:
+
+- It requests `--report-json` by default; that flag has been removed.
+- It can pass retired endpoint, model, concurrency, and work-directory-retention
+  flags.
+- It expects one JSON report instead of the normal v2 report bundle.
+- Its single forwarded `AUDITA_LLM_API_KEY` has no implicit meaning in v2;
+  an Audita backend must explicitly reference that environment variable.
+- Its semantic fingerprint sorts modules, although Audita treats module order
+  and repetitions as meaningful.
+
+Audita v2 requires a version-2 configuration file. An explicit `--config` selects
+one; otherwise Audita performs its own documented discovery. Backend definitions
+own endpoints, credentials, and capacity. PromptKit profiles own models and
+per-attempt controls. Audita owns retry/repair policy and operation deadlines.
+Narratio's generated invocation YAML is a diagnostic record, not a substitute
+for that Audita configuration file.
+
+## Target architecture
+
+Retain the existing subprocess boundary and `polish` stage. Do not introduce a
+second correction engine, an in-process Audita dependency, or a generic external
+tool configuration framework.
+
+Narratio owns:
+
+- Selection of the executable and the overall invocation timeout/cancellation.
+- Transcript and glossary inputs, run-local output placement, validation of the
+  corrected transcript, and promotion to the existing polished transcript
+  identity.
+- Explicit configuration/profile selections and supported domain overrides.
+- Deliberate credential forwarding, secret-safe invocation diagnostics, and
+  manifest references to results and reports.
+- Existing stage completion, resume, force, publish, restore, and cleanup
+  behavior.
+
+Audita owns its configuration schema and discovery, backend/model configuration,
+provider execution, correction sequence, recovery behavior, and report contents.
+Narratio does not translate old settings into a generated v2 configuration or
+duplicate Audita's complete validation logic.
+
+## Configuration and invocation migration
+
+### ConfigKit and pipeline overlays
+
+Upgrade Narratio's ConfigKit dependency from v0.3.1 to v0.4.0. ConfigKit's
+selected-configuration terminology changes from profile to overlay: the Go API
+uses `Options.Overlay`, `LayerOverlay`, and `CodeOverlay*`; source layers and
+diagnostic codes use `overlay` and `overlay.*`. Composition, precedence, secret
+resolution, and lifecycle semantics otherwise remain unchanged.
+
+Narratio's pipeline-selection interface becomes `--overlay`, selecting
+`overlays/<name>.yml` beside the root pipeline file. Remove `--profile` and old
+selected-directory discovery without aliases or fallbacks. Preserve existing
+base selection for omission, explicit empty selection, and `default`.
+Configuration inspection, diff descriptions, internal selection names, and
+newly written selection provenance use overlay terminology as well.
+
+Maintain existing value-based digest and stage-reuse semantics; renaming
+informational selection provenance is not a reason to invalidate completed
+work or automatically rewrite historical manifests. Strict manifest decoding
+rejects retired provenance fields; operators must deliberately migrate that
+informational member on a backed-up manifest, preserving execution/checkpoint
+state. Update maintained examples and operator migration guidance for the
+directory, flag, and provenance changes.
+
+This rename does not apply to downstream model profiles, Scriptorium
+`profile_id`, Audita's proposal/validation profiles, or Notarius's
+`config_profile`. Nor does it prohibit ordinary explicit imports from a directory
+named `profiles`. Narratio overlays do not automatically select downstream
+overlays or profiles. These are independently owned choices.
+
+### Audita v2 configuration
+
+Keep binary, timeout, explicit config-path selection, and surviving explicit
+domain overrides such as transcript description, output schema, and modules.
+Allow Audita's native configuration discovery when no config path is selected;
+do not impose an additional requirement to supply an explicit path.
+
+Provide optional Audita overlay, proposal-profile, and validation-profile
+selectors, passed through to their corresponding CLI flags. Omission leaves
+Audita's own defaults and validation-profile inheritance in control. These are
+Audita selectors, not automatic translations of Narratio overlay names.
+
+Retire the Narratio settings that mirror removed Audita endpoint/model/capacity
+flags and work-directory retention. Move their operational meaning into the
+operator-maintained Audita configuration and profiles. Remove stale adapter
+fields, validation, invocation metadata, examples, and tests along with them.
+Remove the old report toggle and both adapters' singular `llm_api_key` fields
+from accepted Narratio configuration. Do not retain deprecated aliases,
+automatic conversion, ignored fields, or a v1 execution path. Existing strict
+configuration decoding rejects removed fields. Provide migration guidance and a
+release compatibility notice rather than runtime compatibility machinery.
+
+Preserve the distinction between omitted modules and an explicitly empty module
+list: omission requests Audita's configured/default sequence; an empty list
+requests no correction modules. Preserve order and repetitions rather than
+sorting or deduplicating. Do not broaden this into a change to unrelated
+adapters' module semantics.
+
+Normal invocations no longer pass `--report-json`, `--work-dir-retention`, or
+debug-work-directory flags as a way to obtain reports. They need no reporting
+override: Audita writes its ordinary report bundle by default. The old
+Narratio `report` toggle must not silently become `--reporting=false`.
+
+The production Audita configuration must also retain reporting enabled and debug
+disabled. Omitting CLI flags does not override an operator's explicit external
+configuration. Document this distinction rather than silently adding forced
+boolean overrides or rejecting otherwise valid Audita configuration.
+
+## Credentials
+
+Define secrets once under provider-oriented environment-variable names, such as
+`OPENROUTER_API_KEY` and `RAKESTRAWHOME_API_KEY`, through the process environment
+or Narratio's existing secrets-directory bootstrap. These names are examples,
+not a fixed provider registry; application-specific names are not required.
+
+Add `pipeline.audita.credentials` and `pipeline.notarius.credentials` as lists
+of Narratio typed secret references. Each entry names the environment variable
+whose captured value is forwarded under that exact name. Omission or an empty
+list forwards no credentials. The same reference may appear in both adapters'
+lists without duplicating its stored secret value. An illustrative configuration
+fragment is:
+
+```yaml
+pipeline:
+  audita:
+    credentials:
+      - OPENROUTER_API_KEY
+      - RAKESTRAWHOME_API_KEY
+  notarius:
+    credentials:
+      - OPENROUTER_API_KEY
+```
+
+Resolve references through the existing configuration/secret-loading mechanism
+before adapter execution, preserving its nonempty-value requirement. Forward
+the captured values rather than rereading the parent environment during a run.
+Retain the minimal child execution environment plus each adapter's explicit
+credential list; do not forward every secret found during bootstrap.
+
+Audita backends select these names through `credential`; the current Notarius
+PromptKit profiles select them through `api_key_env`. Narratio neither inspects
+downstream configuration to infer required credentials nor translates names,
+registers providers, or duplicates backend configuration. Audita resolves
+credentials for every surviving configured backend, even one not selected by
+a profile, so its list must cover all those references.
+
+Generalize Notarius's current single-name forwarding and replace Audita's fixed
+`AUDITA_LLM_API_KEY` destination with this shared convention. Use existing shared
+secret and subprocess facilities, extending narrow helpers where needed rather
+than introducing a new secret-management framework. Register every forwarded
+credential with captured-output redaction, including custom names and multiple
+keys. Values must not enter arguments, generated configuration, manifests,
+logs, or examples. As today, downstream tools remain responsible for files they
+write directly; this does not add arbitrary downstream-file scanning.
+
+## Ordinary reports and result handling
+
+Replace the old `audita.report.json` handling with Audita's normal `errors.yml`,
+`recoveries.yml`, and `report.md` bundle. With a file output, Audita writes these
+beside the corrected transcript; an arbitrary report destination is not supplied
+through the removed report flag.
+
+Discover the reports at their defined run-local locations and retain them as
+diagnostics using Narratio's existing manifest and diagnostic lifecycle. Keep
+them distinguishable from the canonical polished transcript. Adapt report
+references, publication/restore coverage, and operator inspection guidance so
+the bundle is not lost or confused with an older run's JSON report. Do not
+fabricate a legacy JSON report or delete historical diagnostics as part of the
+migration.
+
+Retain existing bounded, confined file handling. Replace JSON-specific report
+handling with only the validation needed for consuming the v2 bundle; do not
+introduce a second comprehensive report-schema validator or make incidental
+Markdown wording a contract. Report locations must be discoverable without
+parsing human-readable stderr. Detailed report-counter ingestion is not required
+for this migration.
+
+Audita's exit status remains authoritative. Exit zero with a valid corrected
+transcript may include recoverable LLM failures, including a normalized result
+with no model corrections. Preserve the reports so operators can assess that
+outcome; do not add an unrequested fail-on-recovery or minimum-correction policy.
+
+Conversely, a nonzero exit must fail polish even if a transcript file exists:
+Audita can fail while writing required reports after writing the transcript.
+Preserve available failure diagnostics without requiring early failures to have
+produced a complete report bundle. Failed output must not become the canonical
+successful result.
+
+## Resume and semantic evidence
+
+Update polish's semantic evidence for the new result-affecting selections and
+remove retired endpoint/model fields. Include explicit config/overlay/profile
+selection and preserve ordered module semantics, including omitted versus empty
+selection. Version the changed evidence so incompatible older evidence is not
+mistaken for a valid match when polish is considered for reuse.
+
+Keep the existing boundary for opaque downstream configuration: Narratio does
+not recursively hash Audita configuration, overlays, and profile contents.
+Operators force polish when changing contents behind unchanged selectors.
+Timeouts, credential values, reporting details, and other execution-only settings
+must not become blanket semantic invalidation keys. Do not rerun unrelated or
+unselected stages merely because the integration was upgraded.
+
+## Migration guidance and verification
+
+Update the canonical [configuration reference](../config.md),
+[Audita integration contract](../integrations/audita.md),
+[Notarius integration contract](../integrations/notarius.md),
+[polish internals](../internal/stage-polish.md), maintained examples, and relevant
+operations/troubleshooting guidance when implementation lands. Cover:
+
+- Moving selected Narratio pipeline files to `overlays/`, replacing `--profile`
+  with `--overlay`, and distinguishing configuration overlays from model profiles.
+- Updating ConfigKit API/source attribution and verifying unchanged effective
+  values retain existing semantic reuse behavior.
+- Preparing and validating an Audita v2 configuration and its profiles before
+  switching the executable; copying an old v1 configuration is insufficient.
+- Moving endpoint, model, capacity, and credential selections to their v2 owners.
+- Replacing both singular `llm_api_key` settings with explicit `credentials`
+  lists, storing each provider key once, and matching downstream credential
+  references to those names. State clearly that old fields are removed.
+- Using normal reports to inspect recoveries and failures without debug mode.
+- Force/resume expectations and the treatment of existing completed sessions.
+- The explicitly deferred nature of Narratio testing-profile debug support.
+
+Verification should exercise the real adapter boundary with offline subprocess
+fixtures and focused stage/configuration tests: accepted v2 arguments, omitted
+defaults, ordered/empty modules, secret-safe forwarding, successful report
+capture, recoverable-error success, nonzero exit with an existing transcript,
+failure diagnostics, and semantic reuse/invalidation. Update existing behavioral
+tests rather than retaining assertions for removed flags or exact stderr prose.
+Where practical, verify invocation against the tagged Audita CLI without live
+provider calls. Follow the repository's testing and documentation policies.
+
+Credential tests must cover both adapters, multiple custom names, reuse of one
+secret by both tools, no forwarding of unselected secrets, captured-value
+semantics, and redaction of every forwarded value. Verify removal of obsolete
+configuration fields without preserving their compatibility behavior.
+
+## Scope boundaries
+
+No changes to pipeline order, transcript identity, downstream artifact
+definitions, or provider algorithms are intended. No automatic v1 configuration
+converter, Audita-internal resume mechanism, runtime binary-version negotiation,
+or live-service release gate is required. Debug-profile integration and ingestion
+of Audita's debug-only execution artifacts are future work.
+
+The Notarius change is limited to credential configuration, forwarding, and
+associated diagnostics/documentation/tests; extraction and cache behavior are
+unchanged. This migration breaks existing pipeline configurations using removed
+fields; account for that explicitly in Narratio release versioning.

docs/roadmap/feature-request-notarius-config-profile.yml

@@ -0,0 +1,102 @@
+---
+title: Select a Notarius configuration profile through Narratio
+status: proposed
+consumer: rakestraw.dnd Ansible collection and its pipeline role
+
+use_case: >-
+  The Ansible pipeline role deploys Narratio and Notarius as independently
+  configured applications. Operators select Narratio's testing profile to
+  develop prompts and other pipeline assets with inexpensive models while
+  retaining production settings in the base configuration. That selection
+  currently cannot select a Notarius configuration profile, leaving extraction
+  on its production settings.
+
+desired_outcome: >-
+  Narratio's testing overlay can explicitly select Notarius's testing overlay.
+  Notarius owns the resulting model choices and any other testing-specific
+  settings. The operator selects testing once when invoking Narratio, without
+  editing production files or separately invoking Notarius.
+
+rationale: >-
+  Both applications already use ConfigKit configuration overlays. Selecting
+  the downstream overlay preserves each application's configuration ownership
+  and supports future Notarius testing adjustments without adding a Narratio
+  configuration field for every downstream setting. This is explicit profile
+  composition, not a requirement for arbitrary recursive orchestration.
+
+requested_interface:
+  field: pipeline.notarius.config_profile
+  value: Optional Notarius ConfigKit configuration profile name
+  supplied: >-
+    Invoke Notarius with --config-profile and the selected name when extraction
+    executes. The setting is available in Narratio's base configuration and
+    its ordinary configuration overlays.
+  omitted_or_null: >-
+    Do not supply a profile-selection flag. Preserve existing Notarius
+    configuration selection behavior.
+  downstream_semantics: >-
+    Retain Notarius's existing selector semantics, including the default
+    selector for its base configuration. Notarius resolves profiles relative
+    to its own configuration root, not Narratio's root.
+  explicit_selection: >-
+    Do not automatically forward Narratio's profile name. The selected
+    Notarius profile may have the same name or a different name.
+  distinction: >-
+    This selects a ConfigKit configuration overlay through --config-profile,
+    not a PromptKit LLM profile through --llm-profile. The Notarius overlay
+    can itself select the desired LLM profiles using native Notarius settings.
+
+illustrative_consumer_configuration:
+  note: >-
+    These are separate files managed by the Ansible suite, not a proposed
+    combined configuration document. The Notarius pipeline and LLM profile
+    names are illustrative; the referenced LLM profile must be available to
+    Notarius.
+  narratio_profiles_testing_yml: |
+    notarius:
+      config_profile: testing
+  notarius_profiles_testing_yml: |
+    pipelines:
+      dnd-session:
+        llm_profile: gemini-flash-latest
+  operator_workflow: >-
+    Select --profile testing on the ordinary Narratio invocation. Narratio
+    selects Notarius's testing configuration overlay when it runs extraction;
+    other Narratio testing overrides continue to apply normally.
+
+observable_behavior:
+  - >-
+    Notarius owns overlay discovery, composition, validation, and the effective
+    downstream settings. A missing or invalid selected overlay must not silently
+    fall back to production or be reported as successful extraction.
+  - >-
+    Changing the selected Notarius configuration profile must not silently
+    reuse Narratio's completed extraction from the previous selection.
+    Existing downstream invalidation behavior applies when extraction changes.
+  - >-
+    Editing Notarius overlay contents behind an unchanged selector retains
+    the existing operator responsibility to force extraction when needed.
+    This request does not require inspecting or tracking private Notarius files.
+  - >-
+    Existing credential forwarding remains independently configurable through
+    notarius.llm_api_key, including in the Narratio testing overlay when the
+    selected Notarius settings require a different credential reference.
+
+consumer_follow_up: >-
+  After Narratio releases this interface, the standalone Narratio Ansible role
+  can expose an optional variable and omit the field when unset. The suite role
+  can deploy Notarius's testing overlay and select it from Narratio's testing
+  overlay, then distribute the changes through the collection. These consumer
+  updates are separate from this upstream feature request.
+
+scope_boundaries:
+  - No Notarius change is currently required; v0.7.0 supports --config-profile.
+  - No separate Narratio-side Notarius LLM-profile selector is requested.
+  - No automatic profile-name propagation or downstream configuration rewriting.
+  - No new credential discovery, copying, or provider-name remapping.
+  - This request specifies consumer behavior, not internal Narratio code changes.
+
+references:
+  narratio_configuration: ../config.md
+  narratio_notarius_integration: ../integrations/notarius.md
+  notarius_cli: https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.7.0/docs/cli.md

docs/roadmap/fix-publish-output-destination-resolution.md

@@ -0,0 +1,171 @@
+# Bugfix Request: Preserve Publish Destination Derivation with Explicit Rules
+
+Status: Implemented; release target v2.1.1
+
+## Summary
+
+Narratio should successfully derive a publish destination when a valid
+`publish.outputs` rule omits `dest`, regardless of whether that rule explicitly
+sets `required`. Narratio v2.1.0 currently rejects this valid configuration in
+some cases with a ConfigKit `resolve.unrecorded_change` diagnostic.
+
+This is a configuration-resolution bookkeeping defect, not a YAML formatting
+restriction. The fix should preserve the existing public configuration
+contract: operators may omit a derivable destination and may independently set
+`required` to either `true` or `false`.
+
+## Observed Behavior
+
+A pipeline containing a rule equivalent to the following fails during native
+configuration loading:
+
+```yaml
+publish:
+  outputs: [{"source": "narratio.transcript.final", "required": true}]
+```
+
+Narratio reports:
+
+```text
+error [resolve.unrecorded_change] /publish/outputs: application resolution changed a value without a covering record
+```
+
+The same failure is possible with ordinary block-style YAML when `required` is
+explicit and `dest` is omitted. Flow-style YAML is valid input and is not the
+cause of the defect.
+
+The existing destination-derivation tests do not expose this case because
+their rules also omit `required`. Narratio then supplies the default value for
+`required` and records a change covering the complete `publish.outputs`
+sequence. That broader record happens to cover the destination mutation as
+well, masking the missing resolution record that occurs when `required` is
+already explicit.
+
+## Expected Contract
+
+The current configuration contract remains unchanged:
+
+- `publish.outputs[].source` is required;
+- `publish.outputs[].dest` may be omitted when Narratio can derive it from the
+  selected built-in or configured artifact source;
+- `publish.outputs[].required` defaults to `true`, but an operator may set it
+  explicitly to either `true` or `false`; and
+- equivalent valid YAML representations have equivalent configuration
+  semantics.
+
+For example, both rules below should load and validate, retain their explicit
+requiredness, and receive the canonical derived destination:
+
+```yaml
+publish:
+  outputs:
+    - source: narratio.transcript.final
+      required: true
+    - source: narratio.transcript.final_markdown
+      required: false
+```
+
+## Root Cause
+
+ConfigKit intentionally treats sequences as atomic when comparing values
+before and after application resolution. Changing a field within one
+`publish.outputs` entry is therefore observed as a change to the
+`/publish/outputs` sequence.
+
+Narratio currently derives each missing destination by recording a
+normalization at the individual `publish.outputs[index].dest` path. That child
+record does not cover the atomic parent-sequence change. A separate
+container-level record is currently created only when Narratio also defaults
+an omitted `required` value, so configurations with explicit `required` values
+lose that incidental coverage.
+
+## Recommended Fix
+
+Make Narratio's publish-output resolution bookkeeping conform to ConfigKit's
+atomic-sequence contract. Whenever resolution derives one or more destinations
+inside `publish.outputs`, the recorded resolution changes must cover the
+`/publish/outputs` container. Destination derivation must not depend on an
+unrelated `required` default being applied in the same list.
+
+The implementation may retain more specific provenance where useful, but it
+must provide valid container-level coverage for the sequence mutation. Do not
+change ConfigKit's sequence comparison semantics merely to accommodate this
+call site.
+
+## Scope
+
+- Correct destination derivation for publish rules that explicitly set
+  `required` and omit a derivable `dest`.
+- Preserve explicit `required: true` and `required: false` values.
+- Preserve canonical destination derivation for built-in transcript sources
+  and configured artifact sources.
+- Add focused regression coverage through Narratio's real configuration load
+  and validation boundary.
+- Prepare a backward-compatible patch release after the fix passes the normal
+  repository validation.
+
+## Non-goals
+
+- Changing the `publish.outputs` schema, defaults, source vocabulary, or
+  destination derivation rules.
+- Requiring operators or configuration generators to supply `dest` when it is
+  derivable.
+- Requiring operators to omit explicit `required: true` values.
+- Treating flow-style YAML or JSON-compatible YAML values as unsupported.
+- Changing ConfigKit's documented atomic treatment of sequences.
+- Adding storage, publication, or network integration behavior.
+
+## Regression Coverage
+
+Add one focused package-level behavioral test that loads and validates a
+pipeline with omitted destinations and explicit requiredness. A representative
+list should include both `required: true` and `required: false`, then assert
+that:
+
+- loading and validation succeed;
+- each destination is derived from its source; and
+- each explicit `required` value is preserved.
+
+Using the compact flow-style representation that exposed the integration
+failure is reasonable, while the existing block-style cases continue to cover
+omitted `required`. The test should exercise the public configuration behavior,
+not ConfigKit call choreography or Narratio's private recording mechanism.
+
+No network service, object store, credential, or test double is required.
+
+## Target End State
+
+All valid publish rules with derivable sources behave consistently across
+these cases:
+
+| `dest` | `required` | Result |
+| --- | --- | --- |
+| omitted | omitted | destination derived; required defaults to `true` |
+| omitted | `true` | destination derived; explicit `true` retained |
+| omitted | `false` | destination derived; explicit `false` retained |
+| explicit | either value | explicit destination and requiredness retained |
+
+`narratio config validate`, `narratio config show`, and ordinary pipeline
+loading accept the corrected cases without an unrecorded-change diagnostic.
+No operator configuration migration or workaround is required.
+
+## Release
+
+This is a backward-compatible correction to documented configuration behavior
+and should be released as Narratio `v2.1.1`. The release note should identify
+the corrected explicit-required/derived-destination interaction and state that
+no special upgrade action is required.
+
+## Acceptance Criteria
+
+- The focused regression test fails against v2.1.0 behavior and passes after
+  the fix.
+- Publish rules with explicit `required: true` or `required: false` and omitted
+  derivable destinations load and validate successfully.
+- Derived destinations and explicit requiredness appear correctly in the safe
+  effective configuration.
+- Existing destination derivation, publish validation, imports, profiles, and
+  configuration inspection tests remain green.
+- The complete repository validation and release-candidate checks pass.
+- The correction is published as the immutable `v2.1.1` tag with the required
+  release note.

docs/roadmap/implementation.md

@@ -0,0 +1,482 @@
+# Implementation Plan: Audita v2 and Shared Provider Credentials
+
+Status: Complete (2026-09-25).
+
+## Scope and working instructions
+
+Implement [the Audita roadmap](audita.md). The baseline is Narratio commit
+`70f1dbf` (v2.2.1), with ConfigKit v0.4.0 and Audita v2.0.0 as the target
+upstream contracts. This replaces the completed checkpoint-refactoring plan,
+which remains in Git history.
+
+Complete Stage 1 through Stage 8 in order, one bounded implementation prompt per
+stage for gpt-5.6-terra. Record completion and actual verification results under
+each stage. These instructions apply to the implementation sprint; the planning
+pass changes documentation only. Intermediate stages are not release candidates.
+Do not add compatibility code to make intermediate states look like a supported
+release.
+
+Before each stage, read `AGENTS.md`, `docs/development.md`, and all policies
+under `docs/policy/`: agents, architecture, documentation, testing, and release.
+Read this plan's selected design and that stage's preparation. Use Go 1.26 and graph-first code
+discovery; inspect current files when graph results are incomplete. Preserve
+unrelated changes. Test at behavioral owners rather than replicating every case
+across configuration, adapter, stage, and command tests.
+
+The user approved a clean cutover: no Audita v1 runner, deprecated aliases,
+compatibility shims, generated configuration conversion, or silently ignored
+old settings. Do not broaden that decision into a purge of unrelated legacy
+code or historical session data.
+
+## Selected design
+
+### ConfigKit and Narratio overlay terminology
+
+Upgrade ConfigKit from v0.3.1 to v0.4.0 before adapter work. Rename its
+`Options.Profile`, `LayerProfile`, and any `CodeProfile*` uses to their overlay
+equivalents. Selected pipeline files move from `profiles/<name>.yml` to
+`overlays/<name>.yml`; no fallback directory or alias is permitted.
+
+Rename Narratio's pipeline-selection flag to `--overlay` everywhere it is
+accepted, including convenience commands and configuration inspection. Rename
+application-owned selection types/helpers, help, errors, and current inspection
+labels consistently. `config diff` still takes two positional selections,
+now described as overlays. Preserve omission, explicit empty, and `default`
+as base selection; do not add a persistent default selector or new precedence.
+
+Rename newly written informational provenance to overlay terminology, including
+`selected_overlay` in manifest configuration provenance. Do not add a dual-field
+reader, automatically rewrite historical manifests, or introduce a manifest-version
+rejection solely for this informational rename. Existing strict typed decoding
+rejects retired provenance fields. Document backed-up operator migration of
+that informational member without changing execution/checkpoint state; it does
+not become resume authority. Preserve
+semantic fingerprints and effective-value digest rules when values are unchanged.
+
+Only Narratio pipeline configuration selection is renamed. Keep model/profile
+fields such as Scriptorium `profile_id`, Audita `proposal_profile` and
+`validation_profile`, and Notarius `config_profile` unchanged. Explicit imports
+from directories named `profiles` remain legal; only selected pipeline overlay
+discovery changes. Do not globally replace the word “profile.”
+
+### Configuration and credentials
+
+- Both `pipeline.audita.credentials` and `pipeline.notarius.credentials` are
+  lists of ConfigKit secret references. Use `[]configkit.Secret`; each element
+  is an actual reference rather than a nullable pointer. Existing ConfigKit
+  validation owns name/value resolution. Omitted, null, or empty lists mean no
+  additional credential forwarding.
+- Define each key once through existing environment/secrets-directory bootstrap.
+  Forward it under its original name to each adapter whose list includes it.
+  No alias mappings, provider registry, downstream config inspection, extra
+  bootstrap, or inheritance of the entire environment.
+- Repeated names need no new rejection rule: forwarding the same captured
+  reference once suffices. Arbitrary valid variable names remain supported;
+  provider names in the roadmap are examples, not an allowlist.
+- Add a narrow shared helper in `internal/adapters/subprocess` converting resolved
+  references to `EnvOverrides` and `SensitiveEnvNames`. It checks the existing
+  resolved/nonempty requirement for direct adapter callers but never resolves
+  secrets or rereads environment values. Errors expose no values. Both adapters
+  use it; the ConfigKit upgrade is owned by Stage 1, not this helper. No new
+  credential service is needed.
+- Configuration projections and diagnostic metadata contain reference names
+  only. Register all forwarded names for existing captured-stream redaction.
+  Downstream tools remain responsible for files they write themselves.
+- Remove both singular `llm_api_key` fields. For Audita also remove `base_url`,
+  `model`, `validation_model`, `total_llm_concurrency`,
+  `proposal_llm_concurrency`, `validation_llm_concurrency`,
+  `work_dir_retention`, and `report`, including defaults and projections.
+- Retain Audita `binary`, `timeout`, `config_path`, `transcript_description`,
+  `output_schema`, and `modules`. Add optional string selectors `overlay`,
+  `proposal_profile`, and `validation_profile`: empty/unset means no CLI
+  override. Audita owns downstream file/profile validation and native config
+  discovery. Narratio overlay names are not implicitly Audita overlay names.
+- Preserve nil versus non-nil empty `modules` through loading, projection,
+  cloning, composition, adapter defaults, and request overrides. Nil omits the
+  flag; empty passes `--modules` with an empty argument; nonempty joins in order
+  with repetitions intact. A nil request override uses the configured selection.
+  Avoid clones that collapse empty slices to nil. YAML null follows unset
+  behavior. Other adapters' module semantics do not change.
+
+### Invocation, reports, and failure
+
+Use `process INPUT --glossary PATH --output PATH` plus selected surviving
+overrides. Production passes no reporting or debug switches, including
+`--debug`, `--reporting=false`, `--report-dir`, or `--work-dir`.
+Remove required `WorkDir` and legacy `ReportPath` request/result plumbing.
+Document production external-config defaults without forcibly overriding or
+rejecting deliberate external reporting/debug choices.
+
+Replace Audita's long positional config-values constructor with typed runner
+configuration. Keep timeout parsing in composition and subprocess cancellation
+through the existing runner. No version probe or automatic config-validation
+subprocess is required.
+
+The corrected transcript remains the only canonical polish output, with existing
+identity, path, validation, and bounded file handling. Discover exactly
+`errors.yml`, `recoveries.yml`, and `report.md` beside the requested output.
+Represent available paths in a small typed report bundle in `PolishResult`.
+Fixed names belong to the adapter; do not parse stderr or recursively scan.
+
+Reports are diagnostics, not a new correctness gate:
+
+- Bound reads of present reports using the existing named 16 MiB report limit;
+  retain confined regular-file handling and errors identifying Audita, the file,
+  and limit. No new smaller limits or report schema/status/count validation is
+  necessary when Narratio only preserves bytes; Markdown needs no parser.
+- Missing files are not independently fatal: external configuration can disable
+  reports and early failures may produce none. Default-reporting success tests
+  must nevertheless demonstrate capture of all three files.
+- On process failure, preserve available diagnostics and the original error;
+  report-inspection errors must not hide it. Never promote an output merely
+  because it exists following a nonzero exit.
+- Exit zero with a valid transcript may include recoverable errors or no model
+  corrections. Accept it without a fail-on-recovery or minimum-correction rule.
+
+Keep reports next to the run-local transcript, not in a second canonical
+destination. Register present report paths in the existing `StageResult.Logs`
+diagnostic collection alongside stdout/stderr, with safe bundle-path metadata.
+Reuse current manifest-driven diagnostic publication rather than adding a
+manifest schema or new publish source IDs. Physical placement does not define
+canonical artifact identity. Existing diagnostic retention/cleanup rules apply.
+
+On failure, retain run-local files and expose the output/report directory in
+contextual errors. Do not add runner-wide failed-result persistence merely to
+register those files. Do not fabricate legacy JSON reports or delete historical
+reports. Normal successful stage-record replacement removes obsolete current
+output references.
+
+Generated invocation YAML becomes `audita.generated.v2`, recording actual
+arguments, selections, paths, and credential names, never values. This remains
+a diagnostic invocation record, not an Audita configuration file.
+
+### Resume boundary
+
+Bump only polish semantic-config version from 1 to 2. Record config path,
+overlay/proposal/validation selectors, ordered modules with presence preserved,
+transcript description, output schema, and existing output identity. Remove old
+endpoint/model fields. Existing runner comparison reconsiders obsolete evidence
+when polish is selected; do not synthesize equivalent fingerprints or expand
+normal dependency/selection invalidation.
+
+Credentials, binary path, timeout, and diagnostics are not semantic keys. Do not
+hash downstream config/profile contents; operators force polish after edits
+behind unchanged selections. Notarius credential migration does not change
+extraction fingerprints, references, force, resume, or chunk-cache behavior.
+
+## Stage 1: Adopt ConfigKit v0.4.0 and pipeline overlays
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/app ./internal/manifest`,
+`go test ./...`, `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check` passed.
+
+Preparation: ConfigKit v0.4.0 release notes and selected-overlay migration guide
+in `../ConfigKit/docs/`; Narratio `internal/config/pipeline_configkit.go`,
+`artifact_catalog.go`, `load.go`, `effective_digest.go`; CLI flag parsing and
+config commands in `internal/app/`; configuration provenance in
+`internal/manifest/manifest.go`; current config/CLI docs and pipeline examples.
+
+1. Update `go.mod`/`go.sum` to ConfigKit v0.4.0 using normal module tooling;
+   do not leave a local replacement or change unrelated dependencies.
+   Replace removed ConfigKit APIs in loading, ownership, and artifact catalog
+   inspection. Account for source layer `overlay` and diagnostic prefix
+   `overlay.*` wherever they are consumed or asserted.
+2. Rename Narratio's pipeline selector to `--overlay` across all commands and
+   aliases, load options, pair loading, inspection, provenance, and tests.
+   Preserve explicit-presence handling through convenience commands and existing
+   base/default selection. Remove `--profile` rather than retaining an alias.
+   Apply the selected design's informational manifest-provenance treatment.
+3. Move maintained selected pipeline files and generated fixture paths to
+   `overlays/`. Update current canonical documentation, policy terminology,
+   examples, and user-visible migration guidance with the directory/flag break.
+   Do not rewrite historical release notes, rename downstream model profiles,
+   or prohibit ordinary explicit imports from a directory named `profiles`.
+4. Adapt existing config/app tests to prove base and named-overlay selection,
+   imported defaults plus overrides, secret replacement/removal, source attribution
+   through character-family expansion, config diff, and convenient-command
+   forwarding. Add focused checks that the retired flag is rejected and the old
+   directory is not a discovery fallback. Do not freeze incidental error wording.
+5. Verify unchanged effective values retain digest and stage-reuse behavior;
+   only diagnostic source labels/paths and selected provenance terminology change.
+   Test current provenance round trips and strict rejection of unknown/retired
+   provenance fields. Document deliberate operator migration; do not add a
+   compatibility decoder, semantic invalidation rule, or schema-version gate.
+6. Run focused and full tests before proceeding so failures from the dependency
+   and terminology change are separated from adapter migrations. No Audita or
+   Notarius credential/CLI behavior changes in this stage.
+
+Verify: `go test ./internal/config ./internal/app ./internal/manifest`,
+`go test ./...`, `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check`.
+
+Done when Narratio uses ConfigKit v0.4.0, exposes pipeline overlays consistently,
+has no old selector/directory fallback, and preserves configuration semantics and
+downstream model-profile concepts.
+
+## Stage 2: Add shared resolved-credential forwarding
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/adapters/subprocess`,
+`go test -race ./internal/adapters/subprocess`, and `git diff --check` passed.
+
+Preparation: `internal/adapters/subprocess/run.go`, its environment/redaction
+helpers and tests; `internal/adapters/notarius/subprocess.go`;
+`internal/config/credential_projection.go`; the pinned ConfigKit secret API.
+
+1. Add the narrow helper described above. Return an independent environment map
+   and selected sensitive names. No logging/serialization of values and no
+   changes to minimal child environment inheritance.
+2. Test multiple custom names, empty lists, repeated names, unresolved references,
+   and captured values after the parent environment changes. Reuse existing
+   split/overlapping-stream redaction coverage rather than repeating its matrix.
+3. Leave production callers unchanged until their migrations.
+
+Verify: `go test ./internal/adapters/subprocess` and
+`go test -race ./internal/adapters/subprocess`.
+
+Done when both adapters can reuse one small conversion mechanism without adding
+a resolver, provider policy, or ambient-secret inheritance.
+
+## Stage 3: Migrate Notarius to credential lists
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/adapters/notarius ./internal/stage ./internal/app`,
+`go test -race ./internal/adapters/notarius`, and `git diff --check` passed.
+
+Preparation: `internal/config/config.go`, `credential_projection.go`, loading/
+inspection tests; `internal/adapters/notarius/runner.go`, `subprocess.go`;
+`internal/stage/extract.go` and its request construction;
+`docs/integrations/notarius.md` and secret handling in `docs/config.md`.
+
+1. Replace the singular field with the typed list across configuration,
+   projection, request types, stage wiring, and adapter execution. Use Stage 2's
+   helper and register all selected names for redaction.
+2. Update name-only metadata and config-show/diff/effective projections. Test
+   real ConfigKit loading, overlay list replacement, and empty-list clearing.
+   Preserve bootstrap precedence and existing load-time reference resolution,
+   including references outside the selected stage range.
+3. Migrate maintained examples, fixtures, and current Notarius configuration/
+   integration documentation for this field. Ordinary strict decoding rejects
+   the old field; do not add a compatibility parser.
+4. Cover multi-key forwarding, unselected-key exclusion, empty selection,
+   captured-value behavior, and custom-name redaction on success/failure.
+   Keep extraction cache/reference/output tests as regression protection,
+   not occasions to redesign extraction.
+
+Verify: `go test ./internal/config ./internal/adapters/notarius ./internal/stage ./internal/app`
+and `go test -race ./internal/adapters/notarius`.
+
+Done when Notarius uses credential lists end to end and no active singular
+credential path remains.
+
+## Stage 4: Cut Audita configuration and adapter over to v2
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/adapters/audita ./internal/stage ./internal/app`,
+`go test -race ./internal/adapters/audita`, `go test ./...`, and
+`git diff --check` passed.
+
+Preparation: Audita v2.0.0 `docs/migrations/v2.md`, `docs/cli.md`,
+`docs/integrations/subprocess.md`, and `docs/integrations/output-files.md` in
+`../audita/`; Narratio `internal/adapters/audita/`,
+`internal/app/runner.go` (`buildDefaultAuditaRunner`), and config types,
+defaults, validation, and credential projection.
+
+1. Replace the Audita configuration surface as selected above, updating defaults,
+   validation, safe projection, examples, and config fixtures. Prove nil/empty
+   modules survive real configuration loading and overlay overrides.
+2. Migrate runner construction, selectors, and credential forwarding. Remove
+   retired flags, fixed credential alias, required work-directory plumbing, and
+   old JSON-report validation. Add the typed report bundle.
+3. Implement adjacent report discovery, bounded reads, failure results, and
+   generated invocation v2. Share metadata construction between success/failure
+   instead of maintaining duplicate field maps.
+4. Rewrite the Audita subprocess fixture to model v2 argument acceptance and
+   output placement. Cover omitted/selected selectors, ordered/repeated/empty
+   modules, no report/debug switches, malformed/missing transcript, ordinary
+   reports, externally disabled reporting, recoverable-error success, and
+   nonzero exit after transcript creation. Cover multiple custom credential names
+   and redaction; preserve timeout/cancellation coverage at its existing owner.
+5. Make mechanical polish and app-fixture adjustments needed to compile: remove
+   obsolete request/metadata fields and old report materialization. Stage 5 owns
+   complete diagnostic integration. Remove retired fingerprint members as needed
+   to compile; Stage 6 completes the replacement semantic contract. These are
+   bounded call-site changes, not permission to introduce transitional shims.
+
+Verify: `go test ./internal/config ./internal/adapters/audita ./internal/stage ./internal/app`
+and `go test -race ./internal/adapters/audita`.
+
+Done when configuration composes a v2-only adapter and subprocess tests prove its
+credential/transcript/report boundary. Stages 5 and 6 complete diagnostic and
+semantic integration; all stages are required before release.
+
+## Stage 5: Integrate polish reports with diagnostic lifecycle
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/stage ./internal/app ./internal/manifest ./internal/artifacts`,
+`go test -race ./internal/stage ./internal/app`, and `git diff --check` passed.
+
+Preparation: `internal/stage/polish.go`, `polish_test.go`, `run_local.go`,
+`stage.go`, `publish_sources.go`; result application in `internal/app/runner.go`;
+publish/restore diagnostic tests; `docs/internal/stage-polish.md`.
+
+1. Finish stage integration: materialize only the canonical polished transcript;
+   register available adjacent reports as diagnostics plus safe metadata and
+   existing logs/generated invocation references. Remove old `audita_report`
+   production and stale stage metadata.
+2. Use existing authoritative-path checks for the requested transcript and fixed
+   adjacent report paths. Do not accept arbitrary fake-returned paths, scan
+   directories, or copy reports to a second destination. Preserve workspace
+   handling/modes.
+3. On execution failure, preserve canonical transcript authority and run-local
+   diagnostics, with actionable directory/log context and original error identity.
+   Test failure after output creation.
+4. Adapt the fake and app helper. With real manifest/store collaborators, prove
+   successful promotion, report references, absence of report canonical outputs,
+   and current-run diagnostic publication. Preserve restore's existing scope of
+   declared committed transcript/artifact objects: run-archive diagnostics do not
+   become automatically restored canonical objects. Test that report references
+   do not create new required canonical restore targets. Document remote diagnostic
+   inspection separately; no new diagnostic-restore feature is authorized.
+5. Leave historical files untouched. Update tests expecting a second canonical
+   polish output without introducing a manifest-format migration.
+
+Verify: `go test ./internal/stage ./internal/app ./internal/manifest ./internal/artifacts`
+and `go test -race ./internal/stage ./internal/app`.
+
+Done when reports use existing diagnostic lifecycle and failed execution cannot
+promote an incidental transcript.
+
+## Stage 6: Complete semantic evidence and resume behavior
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/stage ./internal/app`,
+`go test -race ./internal/stage ./internal/app`, and `git diff --check` passed.
+
+Preparation: `internal/stage/semantic_contracts_refinement.go`, semantic
+fingerprint tests, app runner semantic comparison tests, and extraction semantic
+configuration tests (locate their current owners through graph discovery).
+
+1. Implement polish evidence version 2 and the selected payload. Remove sorting;
+   preserve nil/empty distinction in payload encoding and copies.
+2. Test changes from module order/repetition/presence and external selectors.
+   Credentials and execution-only settings do not change evidence. Avoid
+   assertions on incidental digest literals.
+3. Exercise old-version evidence through runner resume behavior: selected polish
+   is reconsidered and normal dependent invalidation applies. Downstream-only
+   bounded execution does not unexpectedly invoke polish. Unchanged new evidence
+   reuses valid completed output.
+4. Confirm credential-list changes leave extraction semantic/cache behavior
+   unchanged. No downstream file-content scanning or eager fingerprint migration.
+
+Verify: `go test ./internal/stage ./internal/app` and
+`go test -race ./internal/stage ./internal/app`.
+
+Done when selections affect reuse accurately without blanket credential/config
+invalidation or changes to unselected-stage execution.
+
+## Stage 7: Complete operator migration documentation and examples
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check` passed.
+
+Preparation: documentation policy; `docs/config.md`, `docs/operations.md`,
+`docs/troubleshooting.md`, both integration guides,
+`docs/internal/adapters.md`, `docs/internal/stage-polish.md`, and pipeline examples.
+
+1. Complete current-behavior documentation as implementation lands. Configuration
+   owns fields/defaults; integrations own external contracts; operations owns
+   placement and migration; internal docs explain ownership and link onward.
+2. Provide an old-to-new migration table: endpoints/capacity move to Audita
+   backends, models to profiles, role selection to selectors, and credentials to
+   provider-named lists. Remove report/retention settings. Explain Audita's
+   all-configured-backend credential resolution and Notarius's profile lookup.
+3. Describe preparing and validating Audita v2 config offline with its documented
+   command before switching executables. Link upstream examples rather than
+   building a downstream configuration generator. Explain ordinary reports,
+   recoverable-error success, and force after edits behind unchanged selectors.
+4. Production examples omit modules when upstream defaults are intended;
+   `modules: []` deliberately disables correction modules. Production external
+   Audita config keeps reports enabled/debug disabled, without Narratio flag
+   overrides. Testing-profile debug integration remains deferred.
+5. Document the configuration-breaking clean cutover for release-version
+   consideration. Do not edit historical release records, tag a release, or
+   remove unrelated roadmaps.
+
+Verify: `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check`.
+
+Done when operators can migrate using valid examples without obsolete fields,
+implicit credential aliases, or retired CLI/report expectations.
+
+## Stage 8: Verify assembled behavior and audit scope
+
+Status: Complete (2026-09-25).
+
+Verification: the offline app-level shared/Audita-only credential scenario
+passed with config bootstrap, both subprocess fixtures, safe inspection/logging,
+and ordinary polish reports. The tagged Audita v2.0.0 CLI validated its minimal
+configuration and produced a transcript plus all three reports with an empty
+module sequence and no provider request. Active-reference and scope audits found
+no removed production fields or compatibility path; remaining old names occur in
+migration guidance, explicit-rejection checks, or historical fixtures. `go test
+./...`, `go test -race ./...`, `go vet ./...`, `go build ./...`, `go test
+./internal/doccheck`, `go test ./internal/config -run
+'^TestExamplesLoadAndValidate$'`, and `git diff --check` passed.
+
+Preparation: cumulative diff, this plan, feature roadmap, app configuration/
+subprocess integration tests, and all policies.
+
+1. Adapt or add one representative offline app-level scenario showing one
+   provider-named secret source supplying both adapters and another key selected
+   only for Audita. Use real config/bootstrap/composition with subprocess fixtures.
+   Prove safe inspection/logging and successful polish reports. Leave exhaustive
+   flag/redaction cases at lower layers.
+2. Where the tagged Audita checkout is available, smoke-test CLI acceptance and
+   ordinary transcript/reports offline with an explicit minimal v2 config,
+   unauthenticated backend/profile fixtures, and an empty module sequence.
+   No provider requests or production credentials. This is optional local evidence,
+   not a default test dependent on sibling checkouts or installed tools.
+3. Audit active references to removed fields/flags/aliases; historical release
+   notes and completed roadmaps are not compatibility code. Review tests
+   collectively for duplication while retaining consequential failure coverage.
+4. Confirm no provider-name restrictions, duplicate-name rejection, downstream
+   content hashing, fail-on-recovery rule, mandatory explicit config path, debug
+   requirement, live-service gate, pipeline-order change, or Notarius cache change
+   slipped in. Do not require missing reports when disabled externally. Surface
+   additional policy choices rather than encoding them silently in tests.
+5. Run every gate below and record actual results. Mark complete only after all
+   stages and gates pass. No release, tag, push, or unrelated cleanup in this plan.
+
+```sh
+go test ./...
+go test -race ./...
+go vet ./...
+go build ./...
+go test ./internal/doccheck
+go test ./internal/config -run '^TestExamplesLoadAndValidate$'
+git diff --check
+```
+
+Done when the assembled v2 integration and shared credentials meet the roadmap,
+verification passes, and no compatibility machinery remains within scope.
+
+## Open Questions
+
+None requiring a product decision before implementation. The user settled the
+clean cutover and shared provider-named lists. Reports use existing diagnostics
+without new content-based success criteria; debug-profile work remains deferred.
+Release version selection belongs to the later release procedure.

docs/roadmap/notarius-config-profile.md

@@ -0,0 +1,151 @@
+# Notarius Configuration Profile Selection
+
+Status: Implemented.
+
+## Goal and Authority
+
+Implement the consumer behavior in the
+[feature request](feature-request-notarius-config-profile.yml): let a Narratio
+configuration overlay explicitly select a Notarius configuration overlay.
+Operators can select testing once in Narratio while each application retains
+ownership of its own model choices and other settings.
+
+This roadmap describes the target state and required change areas, not an
+implementation sequence; the [implementation plan](implementation.md) owns
+the ordered work and implementation decisions. The feature request is the scope
+authority; the mechanisms suggested below do not establish additional
+user-facing contracts.
+
+## Underlying Issue
+
+Narratio can select its own testing profile, but extraction currently invokes
+Notarius without a configuration-profile selector. Consequently, a Narratio
+testing invocation cannot explicitly select the independently deployed Notarius
+testing overlay through pipeline configuration.
+
+Adding individual downstream model or tuning fields would duplicate Notarius's
+configuration responsibilities. Passing its existing profile selector provides
+the requested flexibility without that duplication.
+
+## Targeted End State
+
+### Explicit Configuration Composition
+
+`pipeline.notarius.config_profile` is an optional Notarius configuration-profile
+name, usable in Narratio's base configuration and ordinary overlays. For
+example, Narratio's `profiles/testing.yml` may contain:
+
+```yaml
+notarius:
+  config_profile: testing
+```
+
+Selecting Narratio's `--profile testing` then selects that explicit downstream
+profile whenever extraction executes. The two profile names need not match.
+Narratio does not automatically forward its own profile name.
+
+When supplied, the selection is passed through Notarius's `--config-profile`
+argument. Omitted or null values add no profile-selection flag and preserve
+existing downstream selection behavior. Notarius's selector semantics remain
+authoritative, including empty and `default` selections for the composed base
+configuration. Narratio does not introduce a stricter profile-name policy.
+
+This field selects a ConfigKit configuration overlay, not a PromptKit profile
+through `--llm-profile`. The Notarius overlay owns any resulting LLM-profile
+selection. Notarius resolves overlays relative to its own configuration root;
+Narratio neither resolves those files against its own root nor rewrites them.
+
+### Execution, Reuse, and Failure
+
+A changed downstream profile selection must not silently reuse Narratio's
+completed extraction from the previous selection. Existing dependent-stage
+invalidation applies when extraction changes; the feature does not change the
+pipeline order or transcript-generation behavior.
+
+Notarius continues to own downstream overlay discovery, composition, validation,
+and cache compatibility. A missing or invalid selected overlay must fail
+extraction through the existing subprocess error path, without silently falling
+back to production or reporting successful extraction.
+
+Existing resume and chunk-cache controls, including force precedence, remain
+in place. Profile selection does not itself mean forced regeneration or cache
+deletion. Narratio's decision to execute extraction and Notarius's decision to
+reuse compatible work remain separate responsibilities.
+
+Changes to private Notarius configuration behind an unchanged selector retain
+the existing operator responsibility to force extraction when needed. There is
+no new downstream file inspection or content-tracking requirement.
+
+Credential forwarding remains independently configured through
+`notarius.llm_api_key`. A Narratio testing overlay may select a different
+credential reference alongside the downstream profile; no new credential
+discovery or provider-name mapping is introduced.
+
+## Required Change Areas
+
+### Configuration and Inspection
+
+Extend the typed Notarius configuration and its existing safe effective-YAML
+projection to carry the optional field. Preserve the ordinary configuration
+composition behavior for base values, overlay overrides, and null values.
+Configuration inspection must reflect the selected field without exposing
+credential values. No replacement configuration loader or downstream preflight
+loader is needed.
+
+### Stage and Adapter Boundary
+
+Carry the selection from resolved configuration through the extraction request
+to the subprocess adapter. Construct the optional CLI flag using the existing
+argument-vector mechanism, alongside the current configuration path, references,
+credential forwarding, and cache controls. Retain normal Notarius error handling.
+
+### Extraction Reuse Evidence
+
+Account for the downstream selection in the existing extraction reuse evidence.
+The current semantic-configuration and invocation fingerprints are the relevant
+change points. Keep their treatment of selection consistent so that a profile
+change cannot bypass the required rerun and downstream invalidation.
+
+This roadmap does not require a new manifest schema, separate profile-indexed
+workspaces, historical per-profile result retention, or an upgrade-wide forced
+rerun.
+
+### Verification and Documentation
+
+Use focused behavioral coverage for configuration composition and inspection,
+explicit argument forwarding and omission, changed-selection reuse decisions,
+and ordinary subprocess failure handling. Reuse existing test coverage where
+it already protects unchanged credentials, force behavior, and invalidation;
+do not duplicate Notarius's complete profile-validation or cache test suites.
+
+When implemented, update the canonical
+[configuration reference](../config.md),
+[Notarius integration contract](../integrations/notarius.md),
+[extract internals](../internal/stage-extract.md), and relevant maintained
+examples. The development workflow in [Operations](../operations.md) should
+explain explicit profile composition and the existing need to force extraction
+after private downstream edits. Clarify that profile selection does not create
+an isolated testing workspace or separate current extraction state.
+
+## Compatibility and Scope Boundaries
+
+Notarius v0.7.0 already documents `--config-profile`; no upstream change is
+required. Document the capability needed when the option is used, without adding
+an unconditional runtime version gate for existing unconfigured deployments.
+
+This feature adds no Narratio CLI selector, automatic profile propagation,
+Notarius LLM-profile selector, downstream configuration rewriting, new
+credential mechanism, or generalized recursive orchestration. Existing output
+and receipt contracts remain unchanged.
+
+The consumer's Ansible role and suite updates are follow-up work outside this
+repository. They can deploy downstream overlays and populate this field after
+the interface is released.
+
+## Scope Review
+
+No stronger requirements or new invariants are proposed beyond the feature
+request and existing repository contracts. In particular, minimizing one-time
+upgrade invalidation and avoiding reruns between equivalent base selectors are
+implementation considerations, not additional acceptance guarantees imposed
+by this roadmap. No user decisions are currently required before planning.

docs/roadmap/remediation.md

@@ -0,0 +1,227 @@
+# Audita v2 and ConfigKit Migration Review Remediation
+
+Status: Complete.
+
+Reviewed `83eaa96` through `fae18bf` against the approved clean-cutover decisions,
+[feature roadmap](audita.md), and [implementation plan](implementation.md).
+Review date: 2026-09-25. No production changes were made. The previous completed
+transcription review is retained below as historical context.
+
+## 1. Preserve omitted modules in direct YAML serialization
+
+Priority: P2. Status: Complete.
+
+The safe YAML projection now omits nil modules while retaining explicit empty
+and ordered/repeated selections. A round-trip regression failed before the fix
+and passes afterward. Config package tests, including credential-safety coverage,
+and its race tests pass.
+
+Location: `internal/config/credential_projection.go:25` (`AuditaConfig.MarshalYAML`),
+especially the plain slice field at line 30 and assignment at line 40.
+
+The direct safe YAML projection passes a nil module slice to yaml.v3, which
+serializes it as `modules: []`. Loading that output produces a non-nil empty
+slice. Under the new Audita contract these are different instructions: nil
+delegates to Audita's configuration/default sequence; empty passes an explicit
+empty module argument and disables correction modules. Serialization therefore
+silently changes behavior for a configuration that is subsequently reloaded.
+
+Evidence: a temporary package test marshaled
+`AuditaConfig{Binary: "audita", Timeout: "3h"}`, unmarshaled it into another
+`AuditaConfig`, and required `Modules == nil`. It failed with output containing
+`modules: []`. The test was removed after reproduction. This concerns direct
+`yaml.Marshal` of the typed configuration; ordinary CLI `config show` uses
+`MarshalEffectivePipeline` through a separate JSON/value-tree projection and
+does not use this faulty path.
+
+Required remediation:
+
+- Make the direct safe YAML projection preserve nil as null or omission and
+  explicit empty as `[]`. Do not simply add `omitempty` to the slice: that would
+  instead erase the explicit empty selection.
+- Keep credential serialization name-only and preserve module order/repetitions.
+- Add a small round-trip regression covering nil, explicit empty, and an ordered
+  repeated selection; retain effective-output inspection coverage without
+  duplicating its whole test matrix.
+
+## 2. Remove the unapproved manifest compatibility decoder
+
+Priority: P2. Status: Complete.
+
+Removed the permissive custom decoder; ordinary strict typed decoding now
+applies to provenance as well. Replaced historical-acceptance coverage with
+retired/unknown-field rejection tests, all of which failed before removal.
+Current provenance round-trip coverage remains intact. Corrected the roadmap,
+plan, internal contract, and operator guidance for narrow backed-up migration
+without discarding execution/checkpoint state or changing resume authority.
+
+Location: `internal/manifest/manifest.go:79-89`,
+`internal/manifest/store_test.go:78`, and `docs/internal/manifest.md`'s decoding
+contract. Also correct the conflicting migration language in the plan/roadmap.
+
+The new `EffectiveConfigProvenance.UnmarshalJSON` bypasses the manifest store's
+`DisallowUnknownFields` by using permissive `json.Unmarshal` for the entire
+provenance object. It accepts retired `selected_profile` data and silently
+discards it. It also silently accepts unknown current provenance fields,
+including unknown nested selection fields, rather than limiting behavior to
+the renamed label.
+
+The user expressly selected a clean cutover without backward-compatibility
+shims. This adds precisely such a shim and a new historical-input acceptance
+guarantee. The regression test explicitly requires the old selection to load,
+and the internal guide now declares permissive informational-field decoding.
+
+The plan contributed to this divergence: it said existing generic decoding
+would handle historical optional provenance and required old manifests to load.
+That assumption was false; the baseline store already strictly decoded these
+fields. Repetition in the plan, tests, and documentation does not authorize
+overriding the user's clean-cutover decision.
+
+Required remediation:
+
+- Remove the custom compatibility unmarshaler and retain ordinary strict typed
+  decoding for the new `selected_overlay` representation. Do not add dual fields,
+  special retired-field handling, automatic manifest rewrites, or a format-version
+  bump just for this rename.
+- Replace the historical-acceptance test with coverage for current provenance
+  round trips and unknown/retired provenance rejection through the real store.
+- Correct the plan and current documentation to acknowledge the upgrade effect:
+  manifests with retired provenance require deliberate operator migration before
+  loading. Document narrow removal/renaming of retired informational provenance
+  on a backed-up manifest, preserving execution/checkpoint state; do not advise
+  deleting all session progress or rerunning everything.
+- Keep provenance informational: this correction does not authorize adding it
+  to semantic resume keys or invalidating work based on overlay identity alone.
+
+If transparent historical-manifest acceptance is desired instead, obtain an
+explicit exception to the clean-cutover decision before retaining a compatibility
+reader. Do not treat that exception as already granted.
+
+## Review verification
+
+The following records the original review, before remediation.
+
+- Existing `go test ./...` passed.
+- Race tests passed for subprocess, Audita, Notarius, config, stage, app, and
+  manifest packages after removing the temporary reproduction.
+- `go vet ./...` passed.
+- The temporary direct-YAML regression failed as described above.
+- Source inspection and the new historical-provenance test establish finding 2;
+  `LocalStore.LoadReader` still uses strict decoding outside the custom hook.
+
+The primary architecture is otherwise in place: ConfigKit v0.4.0 overlays,
+shared named credential forwarding/redaction, a v2-only Audita subprocess
+adapter, ordinary reports as diagnostics, and versioned ordered-module polish
+evidence. No live model/provider runs were performed during this review.
+
+## Migration remediation verification
+
+Completed on 2026-09-25. Both new regressions failed before their respective
+fixes. After remediation, `go test ./...`, `go test -race ./...`,
+`go vet ./...`, `go build ./...`, documentation checks, maintained configuration
+example checks, and `git diff --check` passed. No live provider runs were needed.
+
+## Historical completed transcription review
+
+Status: Complete.
+
+Reviewed commits `7b0bf99` through `96b4e73` against the speaker-checkpoint and
+upload-replay roadmap and the original user request. No production changes were
+made during review. The two failures below were reproduced with temporary tests
+using the existing stage fixtures; those temporary tests were removed afterward.
+
+### 1. Reconcile Aggregate State Even When No Speaker Needs HTTP Work
+
+Priority: P2. Status: Complete.
+
+Implemented read-only aggregate identity/evidence checks before resume skips.
+Regression tests cover removed inputs, missing/duplicate/mismatched outputs,
+repair without HTTP requests, downstream invalidation, and exclusion of removed
+speakers from merge without deleting their files. Equivalent path forms and
+output ordering remain reusable. Focused app/stage tests and documentation
+checks pass.
+
+Location: `internal/stage/transcribe_resume.go:21` and the reconciliation result
+consumed there.
+
+`ValidateResume` returns reusable whenever `reconciliation.work` is empty. That
+only establishes that the remaining speakers need no transcription; it does
+not establish that the stored speaker collection and aggregate outputs match
+the current input set. Removing a speaker while the remaining inputs are
+unchanged produces an empty work list, so a succeeded record can be skipped
+without pruning the removed speaker. Its old aggregate output can then remain
+available to merge. Likewise, missing/inconsistent aggregate output references
+are not repaired when all individual checkpoints remain valid. A prepare rerun
+may already stale transcribe in some workflows, but the resume validator cannot
+rely on that to satisfy its own current-input/output checks.
+
+Reproduction: create complete alice/bob checkpoint records and aggregate
+outputs with the existing fixture, mark the stage succeeded, remove bob from
+the manifest's audio inputs, and call `ValidateResume`. It returns reusable
+despite still retaining bob in the stored collection and aggregate outputs.
+
+Required change:
+
+- Distinguish no HTTP work from no reconciliation work. Validate that the
+  committed speaker set and aggregate transcript references represent the
+  reconciled current set, including relevant identity/evidence, before skipping.
+- When only collection/output repair is needed, return non-resumable and let
+  normal execution checkpoint the pruned collection and rebuild aggregate
+  outputs without retranscribing reusable speakers. Preserve existing dependent
+  invalidation; do not force otherwise-current speaker jobs.
+- Keep resume inspection read-only. Do not fix this by deleting incidental
+  transcript files or changing stage selection rules.
+
+Verification: add removed-only input coverage (not just removal combined with
+an added speaker), plus incomplete/inconsistent aggregate output coverage.
+Exercise the runner skip path and assert zero additional WhisperX requests,
+correct rebuilt outputs, and no removed speaker reaching merge.
+
+### 2. Remove the Unrequested Positive Audio-Size Requirement
+
+Priority: P2. Status: Complete.
+
+Audio evidence now permits zero size while still rejecting negative values.
+Regression tests verify zero-size manifest round trips, successful service
+results being checkpointed and reused, and service rejection being propagated
+without creating a completion record. Nonempty valid-JSON output validation is
+unchanged. Both new success regressions failed before the fix.
+
+Location: `internal/manifest/transcribe_state.go:95`.
+
+The new record validator requires `AudioSize > 0`. Previously Narratio accepted
+a regular `.flac` file and delegated transcription acceptance to WhisperX;
+neither the user request nor the roadmap introduced minimum audio size or a new
+audio-content validation policy. Zero-byte content still has a valid checksum
+and can be represented by the checkpoint mechanism. The current check runs
+after a successful response and output materialization, causing the entire
+stage to fail instead of retaining the completed work.
+
+Reproduction: prepare one speaker, replace its prepared audio with an empty
+regular file, and use the existing successful fake WhisperX client. Stage
+execution fails at checkpoint validation with `audio_size must be positive`.
+This demonstrates the extra Narratio restriction; it does not assert that a
+particular production WhisperX deployment accepts empty audio.
+
+Required change:
+
+- Permit zero audio size and reject negative sizes. Keep byte hashing and
+  size equality checks. Let the downstream service decide whether the input
+  can be transcribed, as before.
+- Do not remove the nonempty valid-JSON output requirement, which has a separate
+  existing justification. Do not add a new early empty-audio rejection instead.
+- Update any new tests/documentation that promote strictly positive input size
+  to a contract.
+
+Verification: cover a zero-size record round-trip and successful adapter result
+being checkpointed/reused for that input; retain negative-size rejection and
+ordinary downstream-failure tests.
+
+### Verification After Remediation
+
+Completed on 2026-09-22 with Go 1.26.8: focused stage/application tests,
+changed-package race tests, `go test ./...`, `go test -race ./...`,
+`go vet ./...`, `go build ./...`, `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check` all passed. Existing replay and cancellation regression
+tests remain intact; the HTTP adapter required no changes.

docs/roadmap/transcribe-checkpoints-and-replay.md

@@ -0,0 +1,183 @@
+# Resumable Speaker Transcription and Replayable Uploads
+
+Status: Implemented.
+
+## Goal and User Intent
+
+Preserve completed speaker transcriptions when another speaker fails, so an
+ordinary run or resume does not repeat expensive successful work. Separately,
+allow Go's HTTP transport to replay WhisperX uploads when it encounters a
+recoverable connection or stream failure.
+
+The motivating incident exhausted four transcription attempts for one speaker
+after three other speakers had completed. The final error reported an HTTP/2
+peer `PROTOCOL_ERROR` and an inability to replay the request body without
+`Request.GetBody`.
+
+These are related reliability improvements, not a promise to eliminate all
+service failures. This document records the target state and scope. The
+completed implementation sequence is retained in Git history; current behavior
+is documented in the canonical guides linked below.
+
+## Pre-implementation Limitations
+
+The [transcribe stage](../internal/stage-transcribe.md) writes successful
+responses into the invocation's run directory. It installs canonical transcripts
+and returns its per-file metadata only after every speaker succeeds. A failure
+therefore leaves no durable per-speaker progress that ordinary resume can use,
+even though some completed JSON files may remain on disk.
+
+The [WhisperX adapter](../integrations/whisperx.md) already retries requests at
+the application level, reopening audio for each attempt. Its multipart request
+body is streamed through a pipe and has no replay callback. Transport-level
+recovery within an attempt cannot reconstruct a consumed body. Providing that
+capability addresses the replay limitation, not the underlying peer protocol
+error; persistent failures can still require service or proxy investigation.
+
+## Targeted End State
+
+### Durable Per-Speaker Completion
+
+Each successfully transcribed speaker file is validated, saved, and recorded
+durably before that work is treated as reusable. The session manifest remains
+the progress authority. Follow the existing analyze-stage checkpoint pattern
+without turning speakers into pipeline stages or introducing a general task
+engine.
+
+Ordinary execution reconciles the current prepared audio set with recorded
+speaker results. It reuses valid completed work and schedules failed,
+unattempted, missing, or obsolete results. A result is not reusable merely
+because a matching filename exists. Evidence binds it to the speaker/audio
+identity, audio content, Narratio-visible recognition settings, and the saved
+transcript's integrity.
+
+The relevant recognition settings remain the WhisperX service URL and language.
+Retry count/delay, concurrency, timeout, credentials, and diagnostic locations
+remain operational settings rather than reasons to discard completed results.
+Changes to private service models or configuration remain an operator reason
+to force transcription; Narratio does not inspect the service's private state.
+
+Changes to individual audio inputs require replacement of affected results,
+not automatic retranscription of unrelated unchanged speakers. New speakers
+need transcription; removed speakers do not remain in the current aggregate
+output set. Records must describe the inputs actually used, not grant reuse to
+old bytes under a changed identity.
+
+### Aggregate Completion, Failure, and Force
+
+The overall stage succeeds only when every currently required speaker has a
+validated, durably recorded result. Incomplete per-speaker progress does not
+make the aggregate stage successful or authorize downstream consumption of an
+incomplete collection. Existing dependent-stage invalidation remains in effect.
+
+Retain bounded concurrency and the current fail-fast behavior: a speaker
+failure cancels outstanding work. Results already checkpointed remain reusable
+after failure, cancellation, or process interruption. A later ordinary run or
+resume retries the remaining work; it does not need a new CLI command.
+
+Checkpoint writes must be serialized so concurrently finishing speakers cannot
+overwrite each other's progress. A failed persistence operation must not
+advertise an unrecorded result as complete. Previously committed progress remains
+the recovery authority, and checkpoint errors must be surfaced rather than
+reported as successful transcription.
+
+`--force` on transcribe regenerates all currently required speakers instead of
+reusing their prior completions. Successful replacements are checkpointed too,
+so an ordinary retry after a failed forced invocation can retain the newly
+completed work. Old results for speakers not successfully regenerated must not
+satisfy that unfinished forced replacement on the next ordinary retry.
+
+This deliberately relaxes the current all-speakers-before-canonical-installation
+implementation: individual durable results may exist while the stage remains
+failed or incomplete. The all-speakers-before-stage-success boundary remains.
+
+### Replayable WhisperX Requests
+
+Provide `Request.GetBody` so the HTTP transport can obtain a fresh body for the
+same request. Replay reopens the audio and reproduces the multipart boundary,
+filename, fields, and framing used by the original request. Independent bodies
+must not share a consumed reader or mutable read position.
+
+Preserve bounded-memory streaming rather than buffering entire audio files in
+memory. Correctly close every original and replay body and its audio resources;
+preserve source-read errors and cancellation, including partial uploads and
+early server responses. Successful response handling must not accidentally wait
+on, or report errors solely from, an abandoned body instead of the replay that
+produced the response.
+
+Keep the existing application-level retry count, delay, classification, and
+per-attempt timeout semantics. Transport replays occur within an application
+attempt and its context; they are not additional Narratio-configured attempts.
+Do not add another custom retry loop, silently increase retries, or disable
+HTTP/2 globally as a substitute for replay support.
+
+The adapter still validates and installs only successful JSON responses.
+Request replay does not provide exactly-once server execution: a lost response
+can cause repeated transcription work, as can existing application retries.
+No new service-side idempotency protocol is required by this feature.
+
+## Required Change Areas
+
+- **Manifest and persistence:** Add transcribe-owned per-speaker progress and
+  evidence, with safe checkpoint updates and preservation through runner failure
+  handling. Review manifest validation, copying, serialization, and existing
+  publish/restore handling wherever the new records pass through those paths.
+- **Stage execution and reuse:** Reconcile speaker records before scheduling,
+  checkpoint validated completions, rebuild aggregate outputs from the current
+  set, and account for partial progress in ordinary and forced execution.
+  Review successful-stage reuse as well as failed-stage retries so stale audio
+  or missing/corrupt transcript evidence is not bypassed by an aggregate skip.
+- **Artifact lifecycle:** Use existing path, installation, integrity, and manifest
+  mechanisms. Ensure checkpointed results do not depend on an ephemeral run
+  directory surviving cleanup. Do not introduce a second authoritative ledger
+  or infer completion by scanning abandoned runs.
+- **HTTP adapter:** Make multipart bodies reproducible and correctly manage
+  every replay's lifetime, without changing the WhisperX HTTP schema or requiring
+  an upstream service change.
+- **Tests:** Cover per-speaker recovery after a later failure, interruption and
+  checkpoint failure; changed/missing inputs or outputs; force followed by an
+  ordinary retry; concurrent successful completions; and aggregate downstream
+  gating. Extend existing fixtures rather than duplicating analyze's complete
+  test suite. Exercise actual body reconstruction after partial consumption,
+  multipart equivalence, cancellation/resource cleanup, and existing bounded
+  streaming and retry behavior—not just the presence of a callback. Default
+  tests remain offline and use local/fake HTTP boundaries, never paid services.
+- **Documentation:** Update the canonical
+  [stage guide](../internal/stage-transcribe.md),
+  [manifest guide](../internal/manifest.md),
+  [WhisperX contract](../integrations/whisperx.md),
+  [operations guide](../operations.md), and
+  [troubleshooting guide](../troubleshooting.md) when implemented. Explain
+  partial completion, ordinary retry versus force, and the distinction between
+  request replay limitations and persistent peer protocol failures.
+
+## Compatibility and Scope Boundaries
+
+Existing speaker identities, raw transcript formats, and the fixed pipeline
+order remain unchanged. Existing manifests remain readable, but must not be
+treated as containing per-speaker evidence they never recorded. Recovery relies
+on verified recorded evidence, not guessed associations between old transcripts
+and current audio. No general legacy-migration framework is part of the feature.
+
+Automatic adoption of unrecorded outputs from previously failed runs is outside
+this feature. Such files may be recoverable after verifying their inputs, but
+their presence alone does not prove completion. No recovery/import command,
+speaker-selection CLI, historical invocation ledger, new service configuration
+discovery, or broader orchestration refactor is included.
+
+The feature does not diagnose the remote service/proxy's underlying HTTP/2
+problem, guarantee recovery from persistent protocol errors, or change the
+policy for continuing unrelated work after failure.
+
+## Completion Criteria
+
+For speakers A, B, C, and D: if A and B are checkpointed, C fails, and D has not
+completed, ordinary resume retains A and B, retries C, and completes D. No
+downstream stage receives an incomplete successful transcription collection.
+Force replaces all four, while an ordinary retry can reuse checkpoints from
+that forced replacement attempt.
+
+The HTTP transport can reconstruct the upload after consuming the original
+body, without whole-file memory buffering, lost source errors, or stranded
+upload resources. A persistent peer error still fails normally after the
+configured application attempts, without discarding checkpointed speakers.

docs/troubleshooting.md

@@ -56,7 +56,8 @@ Symptom:
 
 Likely cause:
 
-- stale field name, typo, invalid enum, or invalid duration/path format.
+- stale field name, typo, invalid enum, invalid duration/path format, or an
+  unsupported local manifest schema/state marker.
 
 Diagnostics:
 
@@ -68,9 +69,69 @@ Safe fix:
 
 - align config with [Configuration](./config.md) and the
   [maintained examples](../examples/README.md).
+- for a manifest schema error, move the unsupported local state aside and
+  regenerate it; restore a verified current committed snapshot or republish
+  healthy regenerated state when appropriate. Do not add version or stage
+  markers by hand.
+- if an older manifest is rejected for its retired cleanup-obligation field,
+  finish outstanding cleanup with the pre-upgrade binary. Otherwise verify the
+  remote commit, move aside or regenerate the incompatible manifest, and use
+  the cleanup stage. Do not treat manual JSON editing as the normal migration
+  path.
 
 Relevant reference: [Configuration](./config.md).
 
+## Party schema version rejected
+
+Symptom:
+
+- configuration loading reports that `party.schema_version` is required or
+  unsupported.
+
+Likely cause:
+
+- the campaign `party.yml` is an unversioned legacy document, or names a
+  schema other than `narratio.party.v1`.
+
+Safe fix:
+
+- replace the file with one exact, single-document
+  [`narratio.party.v1` party](./integrations/party.md); do not add a version
+  marker to an otherwise incompatible legacy structure. The versioned party is
+  the only configured roster authority.
+
+Relevant reference: [Canonical Party Input](./integrations/party.md).
+
+## Unexpected imported or overlay value
+
+Symptom:
+
+- an effective configuration value differs from the root file, or a duplicate
+  ownership/configuration error is hard to locate.
+
+Diagnostics:
+
+```bash
+narratio config sources --config /path/pipeline.yml --overlay testing
+```
+
+Add `--campaign` or `--campaign-file` when the pipeline has party-driven
+artifact families. The output identifies each effective logical field's root,
+import, overlay, default, campaign, party, or family source without printing
+the field value or credential contents.
+
+Safe fix:
+
+- move a duplicated base field so it has one owner;
+- correct the selected overlay; or
+- correct the campaign party/family declaration that owns generated values.
+
+To review what would actually change before switching overlays, run `config
+diff` with the same pipeline and campaign selectors. It compares normalized
+effective values rather than YAML formatting or source-file layout.
+
+Relevant reference: [Configuration inspection](./config.md#read-only-effective-pipeline-inspection).
+
 ## Audio mode conflict
 
 Symptom:
@@ -117,6 +178,205 @@ Safe fix:
 
 Relevant reference: [CLI artifact selection](./cli.md).
 
+## Bounded run prerequisite is unusable
+
+Symptom:
+
+- `run` or `session plan` reports that a prerequisite stage is absent or has a
+  pending, running, failed, stale, or interrupted status before the selected
+  start.
+
+Likely cause:
+
+- `--from` excludes upstream work that has not reached the terminal
+  `succeeded` or `skipped` state in the session manifest.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session plan 2026-04-04 --from render --through analyze
+```
+
+Safe fix:
+
+- widen the bounded range to include the first reported stage, or recover that
+  stage explicitly with `run-stage` before retrying. The failed check does not
+  create a run-local directory or modify the manifest. Narratio does not
+  resume-validate excluded prefix stages, and stages after `--through` are not
+  prerequisites.
+
+If prerequisite statuses are terminal but a selected stage reports a missing,
+unsafe, or checksum-inconsistent artifact, repair the artifact at the stage
+that owns it; do not edit the manifest to bypass the selected stage's concrete
+input validation.
+
+Relevant reference: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior).
+
+## Transcription retries speakers that previously finished
+
+Symptom:
+
+- an ordinary transcribe retry calls WhisperX for a speaker that appeared to
+  finish earlier; or
+- an older successful session retranscribes all speakers once after upgrade.
+
+Likely causes:
+
+- the earlier response or canonical file was not followed by a successful
+  speaker manifest checkpoint;
+- the prepared audio bytes/path, WhisperX URL, or language changed;
+- the canonical transcript is missing, unsafe, non-regular, invalid JSON, or
+  no longer matches its recorded size/checksum;
+- the previous invocation used `--force`, which durably cleared pre-force
+  speaker authority; or
+- the manifest has only legacy aggregate transcribe state and cannot bind old
+  outputs to their source audio.
+
+Safe fix:
+
+- inspect the reported speaker and filesystem error, repair the prepared input
+  or canonical-output path when needed, then retry transcribe normally;
+- allow a legacy aggregate-only record to regenerate once; and
+- do not edit the manifest or copy an old JSON file into place as a substitute
+  for a successful checkpoint.
+
+```bash
+narratio run-stage transcribe 2026-04-04
+```
+
+Valid earlier speaker checkpoints remain reusable even while aggregate
+transcribe status is failed or interrupted. Merge remains gated until
+transcribe reaches aggregate success with the complete current set.
+
+Relevant reference: [Operations: Transcription continuation and replacement](./operations.md#transcription-continuation-and-replacement).
+
+## WhisperX model changed but transcription was reused
+
+Symptom:
+
+- WhisperX model weights, prompts, or private server configuration changed at
+  the same configured URL, but Narratio still considers speaker transcripts
+  current.
+
+Likely cause:
+
+- Narratio can fingerprint its configured URL and language, not private state
+  loaded behind the service boundary.
+
+Safe fix:
+
+- explicitly force transcribe to establish a durable reset, then use ordinary
+  retry if the replacement attempt is interrupted.
+
+```bash
+narratio run-stage transcribe 2026-04-04 --force
+```
+
+Transport replay and application retries do not provide an exactly-once remote
+execution guarantee. Investigate server-side failures or duplicate work using
+WhisperX diagnostics; do not infer completion from a server log without the
+local speaker checkpoint.
+
+Relevant references: [WhisperX integration](./integrations/whisperx.md) and
+[Transcribe internals](./internal/stage-transcribe.md).
+
+## Transcription manifest checkpoint failed
+
+Symptom:
+
+- transcribe reports that a speaker completed but the session manifest could
+  not be saved.
+
+Likely causes:
+
+- the workspace is unwritable or out of space;
+- the manifest path or parent directory is unsafe or the wrong type; or
+- a transient filesystem error interrupted atomic replacement.
+
+Safe fix:
+
+- correct the reported filesystem or permission problem and retry transcribe
+  normally. Narratio reconciles from the last readable collection and reuses
+  only successfully checkpointed speakers.
+
+A canonical raw transcript left by the failed checkpoint is incidental and
+does not become reusable authority. Preserve the manifest and diagnostics if
+the failure repeats; do not advertise the file by editing manifest evidence.
+
+Relevant references: [Manifest persistence](./internal/manifest.md#persistence-semantics)
+and [Transcribe internals](./internal/stage-transcribe.md).
+
+## Notarius credential reference unavailable
+
+Symptom:
+
+- configuration loading reports `secret.unset`, `secret.empty`, or an invalid
+  name in `pipeline.notarius.credentials`, including during inspection or a
+  run that would not execute extraction.
+
+Likely causes:
+
+- the named environment variable is absent or empty;
+- the selected secrets directory lacks a file with that exact name;
+- a process environment variable exists but is empty, so bootstrap correctly
+  leaves it in place; or
+- the Narratio reference name does not match `api_key_env` in the selected
+  Notarius/PromptKit profile.
+
+Safe fix:
+
+- set the exact nonempty environment variable or provide an equivalently named
+  file through the conventional or explicit secrets directory;
+- remove, set to `null`, or set to `[]` when that deployment needs no credential;
+  and
+- use `config show`, `config sources`, and `config diff` to inspect the public
+  reference name and ownership without exposing its value.
+
+Narratio resolves selected credential references during ordinary pipeline
+loading, before stage selection or resume. Credential changes alone do not
+invalidate a completed extraction, but the current reference must still resolve
+for the command to proceed.
+
+Relevant references: [Secrets](./config.md#secrets-handling) and
+[Notarius credentials](./config.md#notarius-credentials).
+
+## Audita v2 configuration or credential failure
+
+Symptom:
+
+- Narratio rejects a retired `pipeline.audita` field during loading, reports
+  `secret.unset` or `secret.empty` for a listed credential, or Audita rejects
+  its external configuration or selected profile when polish runs.
+
+Likely causes:
+
+- the Narratio pipeline still uses v1 endpoint, model, capacity, singular key,
+  report, or retention settings;
+- the named key is missing or empty, including a present but empty process
+  environment variable that takes precedence over a secrets-directory file;
+- Audita's external v2 file references a backend credential name not forwarded
+  by `pipeline.audita.credentials`, including a backend not selected by the
+  current profile; or
+- an Audita overlay or profile selector names a missing downstream definition.
+
+Safe fix:
+
+- follow the [migration table](./operations.md#migrating-audita-and-provider-credentials)
+  and use a supported Audita v2 executable and configuration;
+- provide each needed provider-named variable through the environment or
+  secrets directory, and list that same name in `pipeline.audita.credentials`;
+- validate the external file offline with
+  `audita config validate --config <file>` before switching executables; and
+- inspect Audita's effective profile selection separately from Narratio's
+  `config show`. Narratio does not infer downstream selectors.
+
+An exit-zero polish with a valid transcript succeeds even when Audita reports
+recoverable errors or no corrections. Missing reports are allowed when Audita
+reporting is disabled externally. Edits to Audita-owned files behind unchanged
+selectors require `narratio run-stage polish <session-id> --force` to replace a
+previously successful result. See the [Audita integration contract](./integrations/audita.md).
+
 ## Notarius executable missing
 
 Symptom:
@@ -158,28 +418,118 @@ is expected audit state, not a signal to relink the old bundle manually.
 
 Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
 
-## Atomic Notarius promotion unsupported
+## Prepared Notarius reference missing or inconsistent
 
 Symptom:
 
-- extraction fails with `atomic no-replace directory promotion is unsupported`
-  before a durable bundle or temporary promotion tree is created.
+- extraction or resume validation reports that a configured reference source is
+  unavailable, unsafe, empty, or checksum-inconsistent and recommends
+  `prepare --force`.
 
-Likely cause:
+Likely causes:
 
-- Narratio is running on an operating system other than Linux, macOS, or
-  Windows, where the required atomic no-replace directory primitive has not
-  been implemented and verified.
+- `prepare` has not run since the campaign/session stable input changed;
+- the configured source file is missing;
+- a prepared `inputs/` file or its manifest record was modified independently;
+- a spell-catalog binding exists without an effective `spell_catalog_file`.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session validate 2026-04-04
+```
 
 Safe fix:
 
-- run extraction on Linux, macOS, or Windows. Do not replace the atomic commit
-  with a manual copy or move; the session manifest must never observe a partial
-  or overwritten bundle.
+- correct the campaign/session input path, then refresh canonical prepared
+  evidence before extraction:
 
-This is an extraction-specific platform boundary, not a support statement for
-unrelated Narratio workflows. See
-[Operations: Extraction Workflow](./operations.md#extraction-workflow).
+```bash
+narratio run-stage prepare 2026-04-04 --force
+```
+
+Do not point Notarius directly at the original source path or edit the manifest
+checksum. Relevant references: [Notarius reference configuration](./config.md#notarius-reference-bindings)
+and [Operations: Extraction Workflow](./operations.md#extraction-workflow).
+
+## Notarius reference snapshot cache conflict
+
+Symptom:
+
+- extraction reports that a path beneath
+  `cache/notarius/references/<sha256>/` is a symlink, directory, or another
+  non-regular or unsafe entry.
+
+Safe fix:
+
+- stop commands for the affected session and inspect the exact reported path;
+- investigate unexpected links or special files as possible tampering; and
+- remove only the reported conflicting leaf or digest directory after
+  confirming it belongs to the reconstructible reference cache.
+
+A missing snapshot or corrupt regular snapshot is reconstructed automatically
+from currently verified prepared input. Do not recursively delete the session
+root, edit the manifest checksum, or remove cache entries while extraction is
+active.
+
+Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
+
+## Notarius resume executes work instead of reusing it
+
+Symptom:
+
+- Narratio executes `extract`, and Notarius makes provider calls despite
+  `pipeline.notarius.resume: true`.
+
+Likely causes:
+
+- checkpoint recording is disabled in the Notarius configuration;
+- Notarius is using a nonpersistent or different checkpoint root;
+- transcript/reference bytes, reference paths, pipeline/profile content,
+  local-backend endpoint, selected lanes, or another checkpoint identity input
+  changed; or
+- Narratio extraction was forced, which deliberately omits `--resume`.
+
+Safe fix:
+
+- validate the deployed Notarius configuration and configure explicit
+  persistent chunk-plan and checkpoint roots;
+- inspect Notarius checkpoint decision reason codes for a legitimate cold miss;
+  and
+- retry without force only when reuse is intended.
+
+Remember that Narratio skipping a completed `extract` stage is separate from
+Notarius reusing work inside an extraction that does execute. Narratio does not
+read the Notarius configuration to infer checkpoint enablement.
+
+Relevant references: [Notarius cache controls](./config.md#notarius-cache-controls)
+and [Notarius integration](./integrations/notarius.md).
+
+## Notarius reference selector or generated-handoff collision
+
+Symptom:
+
+- Notarius exits nonzero with an undeclared reference-slot, incompatible media,
+  or external/generated reference collision error.
+
+Likely causes:
+
+- a selector does not identify a slot declared by the selected Notarius target;
+- a prepared file does not satisfy that slot's Notarius media contract; or
+- a CLI binding attempts to replace a same-run generated D&D handoff.
+
+Safe fix:
+
+- compare external bindings with the selected Notarius pipeline's canonical
+  consumer documentation;
+- keep only campaign-owned external slots on the CLI; and
+- leave registry, scene, combat, and occurrence handoffs to Notarius pipeline
+  composition.
+
+Narratio validates selector structure and prepared evidence, while Notarius
+owns slot declarations, media compatibility, and generated-handoff conflicts.
+Relevant reference: [Notarius integration](./integrations/notarius.md).
 
 ## Notarius receipt or index incompatible
 
@@ -198,7 +548,7 @@ Safe fix:
 
 - compare installed Notarius output with the canonical Notarius contracts,
   including receipt `index_file: index.json` and index management names
-  `manifest.json`, `rejected.json`, and `warnings.json`; align
+  `manifest.json`, `rejected.json`, `warnings.json`, and `diagnostics.json`; align
   `pipeline.notarius` constraints and rerun. Do not bypass confinement or schema
   checks.
 
@@ -228,16 +578,23 @@ Symptom:
 
 Likely causes:
 
-- the executable/config path, pipeline ID, timeout, working directory, or
-  configured output contracts changed;
+- the pipeline ID or configured output contracts changed;
+- a configured prepared reference selector, source, path, checksum, or byte
+  size changed;
+- the direct trimmed transcript identity or bytes changed; or
 - the durable bundle, index, lane set, provenance, regular-file status, or
   checksum no longer validates.
 
 Safe fix:
 
 - allow the automatic rerun after verifying the current configuration. Treat
-  an unsafe path or symlink error as filesystem corruption or tampering and
-  investigate it rather than replacing files manually.
+  an unsafe path or bundle symlink error as filesystem corruption or tampering
+  and investigate it rather than replacing files manually.
+
+Executable, config path, timeout, working directory, and Notarius credential
+changes are operational and do not by themselves invalidate reusable extraction
+evidence. A newly selected credential must nevertheless resolve during command
+configuration loading.
 
 ## Notarius transitive configuration changed
 
@@ -252,12 +609,162 @@ Safe fix:
 narratio run-stage extract 2026-04-04 --force
 ```
 
-Narratio fingerprints its invocation contract, not the contents of transitive
-Notarius inputs. Always force extraction after changing them; downstream
+Narratio fingerprints its invocation contract and prepared Narratio reference
+identities, not the contents of other transitive Notarius inputs. Always force
+extraction after changing those external inputs; downstream
 successful stages are then marked stale normally.
 
 Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
 
+## Analysis artifact evidence is not current
+
+Symptom:
+
+- ordinary continuation or `session plan` schedules one or more configured
+  artifacts even though a canonical output file exists; or
+- publish reports a configured artifact source unavailable.
+
+Likely causes:
+
+- the per-artifact record is stale, missing, failed, unselected, or malformed;
+- a configured prompt/profile, dependency, input identity, output path, or
+  effective variable changed; or
+- the recorded output is missing, unsafe, empty, or has a size/checksum that no
+  longer matches its manifest evidence.
+
+Diagnostics:
+
+```bash
+narratio session status 2026-04-04
+narratio session artifacts 2026-04-04
+narratio session plan 2026-04-04 --from analyze --through analyze
+```
+
+Safe fix:
+
+- investigate unexpected path or checksum changes as possible tampering;
+- otherwise let the selected analyze work rerun, or explicitly regenerate only
+  the affected targets; and
+- never edit the fingerprint/checksum in the manifest or copy an old file into
+  the canonical path as a substitute for current evidence.
+
+```bash
+narratio analyze 2026-04-04 --artifacts session_recap
+```
+
+Relevant references: [Operations: Artifact Selection](./operations.md#artifact-selection)
+and [Artifact Internals](./internal/artifacts.md#resolution-rules).
+
+## Analysis manifest checkpoint failed
+
+Symptom:
+
+- analyze reports that it could not save the session manifest after completing
+  an artifact.
+
+Likely causes:
+
+- the workspace is unwritable or out of space;
+- the manifest path or its parent directory has unsafe permissions or type; or
+- a transient local filesystem error interrupted atomic manifest replacement.
+
+Safe fix:
+
+- correct the reported filesystem or permission problem;
+- inspect `session artifacts` to identify the last durable current records; and
+- rerun analyze normally. Narratio reuses earlier successful checkpoints and
+  retries the failed or non-current artifact and its required dependents.
+
+Do not treat a newly created canonical artifact file as current when its
+checkpoint failed, and do not edit the manifest to advertise it. If the error
+recurs, preserve the manifest and run-local diagnostics before repairing the
+workspace.
+
+Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
+and [Manifest Internals](./internal/manifest.md#persistence-semantics).
+
+## Built-in transcript or bounds source is unavailable
+
+Symptom:
+
+- analyze, extract, render, or publish says a built-in source is unavailable
+  even though a file exists at its usual session path.
+
+Likely cause:
+
+- the producing stage has not succeeded, its output lacks the exact registered
+  source, run ID, or checksum, its evidence is duplicated or stale, or the
+  durable bytes no longer match the manifest checksum.
+
+Safe fix:
+
+- do not copy or rename the file to make it discoverable. Rerun the producing
+  stage to regenerate both the bytes and current manifest evidence, then retry
+  the consumer.
+
+## An older manifest schema is rejected
+
+Symptom:
+
+- Narratio rejects a local session manifest because `schema_version` is missing
+  or unsupported; or
+- restore rejects a committed remote session manifest for the same reason.
+
+Likely causes:
+
+- the manifest predates the supported canonical state contract. Narratio
+  rejects it at the schema boundary rather than interpreting aggregate output
+  lists or incidental files as current authority; or
+- an older strict-decoding Narratio binary is reading a current manifest that
+  contains additive transcribe speaker state it does not recognize.
+
+Safe fix:
+
+- for unsupported local state, move the old manifest aside and regenerate, or
+  restore a verified current committed snapshot when one is authoritative;
+- for unsupported committed remote state, regenerate healthy local state as
+  needed and republish the session; and
+- for a downgrade rejection, return to the current binary or restore a verified
+  pre-upgrade backup. Do not delete only the speaker fields by hand.
+
+```bash
+narratio run 2026-04-04
+narratio publish 2026-04-04
+```
+
+After current records exist, inspect them and publish explicitly. Do not copy
+old files into canonical paths merely to influence selection; availability is
+manifest-owned.
+
+Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
+and [Manifest Internals](./internal/manifest.md#transcribe-owned-speaker-state).
+
+## Scriptorium private input changed without a rerun
+
+Symptom:
+
+- a prompt, profile, imported configuration file, executable, or other input
+  loaded privately by Scriptorium changed, but Narratio still considers an
+  artifact current.
+
+Likely cause:
+
+- analysis fingerprints cover Narratio-observable semantic identities, not
+  executable contents or arbitrary files and transitive configuration that
+  Scriptorium loads behind its configured paths and identifiers.
+
+Safe fix:
+
+- explicitly force the affected target after changing an unobserved private
+  input. Force applies to explicit targets; current prerequisites remain
+  reusable unless selected themselves.
+
+```bash
+narratio analyze 2026-04-04 --artifacts session_recap
+```
+
+Relevant reference: [Analyze Internals](./internal/stage-analyze.md#invariants).
+
 ## Previous-session artifact input missing
 
 Symptom:
@@ -267,7 +774,9 @@ Symptom:
 Likely causes:
 
 - missing `session.previous_session_id`;
-- previous artifact not restored/published for source session.
+- the selected previous-session commit does not declare the required canonical
+  source as a `published_output`; or
+- the declared published object is unavailable or fails identity validation.
 
 Diagnostics:
 
@@ -299,7 +808,7 @@ Symptom:
 Likely causes:
 
 - another process is running for the same session;
-- stale lock left by interrupted process.
+- a process still holds the operating-system lock while it is shutting down.
 
 Diagnostics:
 
@@ -311,7 +820,8 @@ ps aux | grep narratio
 Safe fix:
 
 - wait for active process completion;
-- remove stale lock only after confirming no live process owns it.
+- retry after an interrupted holder has exited; the kernel releases its lock
+  even though the `.lock` metadata file remains for inspection.
 
 Relevant reference: [Operations: Local State Layout](./operations.md#local-state-layout).
 
@@ -324,6 +834,8 @@ Symptom:
 Likely cause:
 
 - local durable files differ from remote restore sources.
+- a restore target or one of its ancestors is a symlink or another non-regular
+  filesystem entry.
 
 Diagnostics:
 
@@ -334,7 +846,11 @@ narratio session restore 2026-04-04 --dry-run
 Safe fix:
 
 - review conflicts;
-- rerun with `--force` only when remote state should overwrite local.
+- rerun with `--force` only when remote state should overwrite an eligible
+  regular local file; repair a symlink or other non-regular conflict first.
+
+If the filesystem changed after the plan was printed, rerun restore after
+repairing the destination; installation performs the same safety check again.
 
 Relevant reference: [Operations: Restore Workflow](./operations.md#restore-workflow).
 
@@ -427,7 +943,8 @@ Symptom:
 
 Likely causes:
 
-- invalid `pipeline.secrets.env_dir`;
+- missing, unreadable, or invalid explicit `--secrets-dir`;
+- invalid entries in the conventional `secrets/` directory beside the root pipeline;
 - missing credential environment variables;
 - invalid S3 endpoint/bucket settings.
 
@@ -435,12 +952,12 @@ Diagnostics:
 
 ```bash
 ls -la /path/to/secrets_dir
-env | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
+env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|NOTARIUS|SCRIPTORIUM'
 ```
 
 Safe fix:
 
-- correct secret-file path and permissions;
+- correct `--secrets-dir`, secret-file type/name, and operator-managed permissions;
 - provide required env vars;
 - keep secret values out of YAML.
 

examples/README.md

@@ -11,6 +11,26 @@ in the [configuration reference](../docs/config.md).
   WhisperX URL.
 - [Production-shaped pipeline](pipeline.production.yml): S3 storage, publish,
   external tools, and configured Scriptorium artifacts.
+- [Production-base/testing-overlay bundle](production-testing/pipeline.yml):
+  explicit `conf.d` imports, one ordinary artifact per `artifacts/<key>.yml`,
+  one family per `artifact-families/<key>.yml`, and the fixed
+  `overlays/testing.yml` overlay. Production values live in the base. The
+  bundle demonstrates an input-only artifact dependency, two character families
+  sharing the campaign party, and a testing-only disabled artifact. Inspect it
+  offline with:
+
+  ```sh
+  narratio config validate --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
+  narratio config show --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config sources --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config artifacts --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config diff default testing --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
+  ```
+
+  These inspection commands load configuration and resolve explicit credential
+  references, but do not load a session or create runtime state. This bundle is
+  intentionally local-storage and credential-reference free so the walkthrough
+  needs no tools or cloud services.
 - [Full annotated pipeline](pipeline.full.annotated.yml): every implemented
   pipeline section with explanatory comments.
 - [Extraction subset pipeline](pipeline.extraction-subset.yml): a focused
@@ -37,12 +57,27 @@ with the sample campaign and a compatible local- or S3-audio session.
 - The sample campaign references its local
   [speakers](campaigns/sample-campaign/speakers.yml),
   [autocorrect](campaigns/sample-campaign/autocorrect.yml),
-  [glossary](campaigns/sample-campaign/glossary.yml),
-  [players](campaigns/sample-campaign/players.yml), and
-  [party](campaigns/sample-campaign/party.yml) fixtures.
+  [glossary](campaigns/sample-campaign/glossary.yml), and canonical
+  [party](campaigns/sample-campaign/party.yml) fixture, plus an optional
+  [spell-catalog overlay](campaigns/sample-campaign/spell_catalog.json) that
+  follows the Notarius v0.7 contract. Narratio derives the players projection
+  from this party source.
 - [Sample speaker audio](audio/sample-speaker.flac) is a text placeholder that
   reserves the expected filename and directory shape. Replace it with a real
   FLAC file before running transcription.
 
-The examples contain environment-variable names but no credential values. They
-use fictional campaign content and reserved example domains.
+The examples contain environment-variable names but no credential values. Set
+`OBJECT_STORAGE_KEY_ID`, `OBJECT_STORAGE_KEY`, `AUDITA_LLM_API_KEY`, and
+`NOTARIUS_LLM_API_KEY` to nonempty synthetic or real values before loading the
+examples that reference them. They use fictional campaign content and reserved
+example domains. The Audita and Notarius names are example references, not
+implicit aliases: external backend/profile configurations must use those exact
+names, or the Narratio credential lists must be changed to match. See the
+[Audita v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+for maintained downstream configuration examples.
+
+For a deployed bundle, keep credential files out of source control in a
+`secrets/` directory beside the root `pipeline.yml`, one file per referenced
+environment-variable name, or select another directory with `--secrets-dir`.
+Static S3 credentials are optional: omit both S3 credential references to use
+the AWS SDK discovery chain.

examples/campaigns/sample-campaign/campaign.yml

@@ -4,5 +4,5 @@ inputs:
   speakers_file: ./speakers.yml
   autocorrect_file: ./autocorrect.yml
   glossary_file: ./glossary.yml
-  players_file: ./players.yml
   party_file: ./party.yml
+  spell_catalog_file: ./spell_catalog.json

examples/campaigns/sample-campaign/party.yml

@@ -1,2 +1,26 @@
-- name: Example Hero
-  type: pc
+schema_version: narratio.party.v1
+
+characters:
+  arannis:
+    player:
+      name: Rowan Hale
+    character:
+      name: Arannis
+      alias:
+        - Ari
+        - The Grey Owl
+      classes:
+        - name: wizard
+          level: 8
+  brenna:
+    player:
+      name: Rowan Hale
+    character:
+      name: Brenna
+      alias:
+        - Shield of Dawn
+      classes:
+        - name: paladin
+          level: 6
+        - name: warlock
+          level: 2

examples/campaigns/sample-campaign/players.yml

@@ -1,2 +0,0 @@
-- name: Example Player
-  role: player

examples/campaigns/sample-campaign/spell_catalog.json

@@ -0,0 +1,18 @@
+{
+  "schema_version": "notarius.dnd.spell-catalog-overlay.v1",
+  "catalogs": [
+    {
+      "id": "narratio.sample-campaign",
+      "ruleset": "dnd-5e-2014",
+      "source": {
+        "title": "Narratio sample campaign spell names"
+      },
+      "spells": [
+        {
+          "name": "Aegis of Emberfall",
+          "aliases": ["Emberfall Aegis"]
+        }
+      ]
+    }
+  ]
+}

examples/pipeline.extraction-subset.yml

@@ -14,6 +14,11 @@ notarius:
   config_path: /usr/local/etc/notarius/config.yml
   pipeline_id: dnd-session
   timeout: 3h
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
   outputs:
     npc_registry:
       lane_id: npc-registry
@@ -52,4 +57,3 @@ scriptorium:
         scenes:
           source: narratio.extraction.scene_descriptions
           required: true
-

examples/pipeline.full.annotated.yml

@@ -7,12 +7,11 @@ workspace:
   # Optional: remove run-scoped workdir after successful publish commit.
   cleanup_after_publish: false
 
-# Optional: local secret file loader (directory of ENV_VAR_NAME files).
-# secrets:
-#   env_dir: ./secrets
+# Credential files, when used, belong in a sibling secrets/ directory or in the
+# directory selected with --secrets-dir; they are not pipeline configuration.
 
 storage:
-  # Optional storage backend selector; use "s3" for publish + S3 audio workflows.
+  # Defaults to "local". Use "s3" explicitly for publish + S3 audio workflows.
   backend: s3
   s3:
     # Required when using S3 audio or S3 publish uploads.
@@ -24,8 +23,8 @@ storage:
     endpoint: ""
     force_path_style: false
     # Optional; defaults shown explicitly.
-    access_key_id_env: OBJECT_STORAGE_KEY_ID
-    secret_access_key_env: OBJECT_STORAGE_KEY
+    access_key_id: OBJECT_STORAGE_KEY_ID
+    secret_access_key: OBJECT_STORAGE_KEY
 
 campaigns:
   # Optional; defaults to /usr/local/share/narratio/campaigns.
@@ -91,22 +90,18 @@ seriatim:
     filler_max_duration: 1.25
 
 audita:
-  # Optional overrides; defaults shown explicitly where applicable.
+  # Optional overrides. Audita owns its own configuration and profiles.
   binary: audita
   timeout: 3h
-  llm_api_key_env: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
-  base_url: ""
-  model: ""
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_model: ""
-  validation_llm_concurrency: 1
+  # Names must match credentials on every backend in the Audita v2 config.
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules for Audita's default sequence; modules: [] disables corrections.
+  overlay: ""
+  proposal_profile: ""
+  validation_profile: ""
   transcript_description: ""
   config_path: /usr/local/etc/audita/config.yml
   output_schema: audita-v1
-  work_dir_retention: auto
-  report: true
 
 normalize:
   # Optional; defaults shown explicitly.
@@ -129,13 +124,33 @@ trim:
     report: false
 
 notarius:
-  # Optional structured extraction between trim and render.
+  # Optional structured extraction after render and before analyze.
   enabled: true
   binary: notarius
+  # Optional environment-variable references. Match these names to the
+  # selected Notarius/PromptKit providers; never put credential values here.
+  credentials: [NOTARIUS_LLM_API_KEY]
+  # Optionally select a Notarius ConfigKit overlay when extraction runs. This
+  # is independent of Narratio's selected overlay and may use a different name.
+  # See docs/config.md and docs/integrations/notarius.md for the contracts.
+  # config_profile: downstream-economy
   config_path: /usr/local/etc/notarius/config.yml
   pipeline_id: dnd-session
   timeout: 3h
   working_directory: /usr/local/etc/notarius
+  # Reuse compatible accepted Notarius checkpoints during executed extraction.
+  # The Notarius config must enable recording and provide persistent cache roots.
+  resume: true
+  # auto uses or creates a source-addressed chunk plan. Forced Narratio
+  # extraction overrides this with refresh and disables checkpoint loading.
+  chunk_cache: auto
+  # External campaign references use prepared Narratio source IDs. Omit an
+  # optional binding when the selected Notarius pipeline does not need it.
+  references:
+    glossary: narratio.input.glossary
+    party: narratio.input.party
+    players: narratio.input.players
+    spell_catalog: narratio.input.spell_catalog
   # Each key creates source narratio.extraction.<key>. These constraints match
   # the current Notarius D&D lane contracts; update them with Notarius.
   outputs:
@@ -260,7 +275,5 @@ scriptorium:
         output_kind: player_handout
 
 notification:
-  # Optional notification settings.
-  backend: ""
-  recipient: ""
-  timeout: 30s
+  # No delivery provider is currently implemented.
+  mode: noop

examples/pipeline.production.yml

@@ -8,8 +8,8 @@ storage:
     bucket: my-dnd-archive
     root_prefix: dnd
     region: us-east-1
-    access_key_id_env: OBJECT_STORAGE_KEY_ID
-    secret_access_key_env: OBJECT_STORAGE_KEY
+    access_key_id: OBJECT_STORAGE_KEY_ID
+    secret_access_key: OBJECT_STORAGE_KEY
 
 campaigns:
   root: /usr/local/share/narratio/campaigns
@@ -57,14 +57,9 @@ seriatim:
 audita:
   binary: audita
   timeout: 3h
-  llm_api_key_env: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules to use Audita defaults; modules: [] disables corrections.
   output_schema: audita-v1
-  work_dir_retention: auto
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_llm_concurrency: 1
-  report: true
 
 normalize:
   output_path: transcripts/final.json
@@ -125,4 +120,4 @@ scriptorium:
         output_kind: player_handout
 
 notification:
-  timeout: 30s
+  mode: noop

examples/production-testing/artifact-families/character_items.yml

@@ -0,0 +1,20 @@
+scriptorium:
+  artifact_families:
+    character_items:
+      enabled: true
+      for_each: party.characters
+      prompt_id: dnd.character_items
+      profile_id: production-placeholder
+      output_path_pattern: artifacts/characters/{character_id}/items.md
+      inputs:
+        character_meta:
+          source: narratio.member_artifact.character_meta
+          required: true
+      member_vars:
+        character_id: character_id
+        character_name: character.name
+        aliases: character.alias_summary
+      publish:
+        enabled: true
+        required: false
+        dest_pattern: artifacts/characters/{character_id}/items.md

examples/production-testing/artifact-families/character_meta.yml

@@ -0,0 +1,13 @@
+scriptorium:
+  artifact_families:
+    character_meta:
+      enabled: true
+      for_each: party.characters
+      prompt_id: dnd.character_meta
+      profile_id: production-placeholder
+      output_path_pattern: artifacts/characters/{character_id}/meta.md
+      member_vars:
+        character_id: character_id
+        character_name: character.name
+        player_name: player.name
+        class_summary: character.class_summary

examples/production-testing/artifacts/player_handout.yml

@@ -0,0 +1,11 @@
+scriptorium:
+  artifacts:
+    player_handout:
+      enabled: true
+      prompt_id: dnd.player_handout
+      profile_id: production-placeholder
+      output_path: artifacts/player-handout.md
+      inputs:
+        recap:
+          source: narratio.artifact.session_recap
+          required: true

examples/production-testing/artifacts/session_recap.yml

@@ -0,0 +1,11 @@
+scriptorium:
+  artifacts:
+    session_recap:
+      enabled: true
+      prompt_id: dnd.session_recap
+      profile_id: production-placeholder
+      output_path: artifacts/session-recap.md
+      inputs:
+        transcript:
+          source: narratio.transcript.final_trimmed
+          required: true

examples/production-testing/conf.d/platform.yml

@@ -0,0 +1,12 @@
+workspace:
+  root: ./workspace
+
+campaigns:
+  root: ../../campaigns
+  default_campaign_id: sample-campaign
+
+cache:
+  root: ./cache
+
+spool:
+  root: ./spool

examples/production-testing/conf.d/publish.yml

@@ -0,0 +1,7 @@
+publish:
+  enabled: true
+  upload_run: false
+  outputs:
+    - source: narratio.transcript.final_markdown
+      dest: transcripts/final.md
+      required: true

examples/production-testing/conf.d/storage.yml

@@ -0,0 +1,2 @@
+storage:
+  backend: local

examples/production-testing/conf.d/transcript.yml

@@ -0,0 +1,18 @@
+whisperx:
+  transcribe_url: https://transcription.example.com/transcribe
+  language: en
+
+seriatim:
+  binary: seriatim
+  output_schema: seriatim-intermediate
+
+audita:
+  binary: audita
+  modules: [glossary, grammar]
+  output_schema: audita-v1
+  proposal_profile: narratio-production-model-placeholder
+  validation_profile: narratio-production-validator-placeholder
+
+normalize:
+  output_path: transcripts/final.json
+  output_schema: seriatim-intermediate

examples/production-testing/overlays/testing.yml

@@ -0,0 +1,18 @@
+audita:
+  proposal_profile: narratio-testing-model-placeholder
+  validation_profile: narratio-testing-validator-placeholder
+
+scriptorium:
+  artifacts:
+    session_recap:
+      profile_id: testing-placeholder
+    player_handout:
+      profile_id: testing-placeholder
+    testing_notes:
+      enabled: false
+      output_path: artifacts/testing-notes.md
+  artifact_families:
+    character_meta:
+      profile_id: testing-placeholder
+    character_items:
+      profile_id: testing-placeholder

examples/production-testing/pipeline.yml

@@ -0,0 +1,14 @@
+# Copyable production-base/testing-overlay entry point. ConfigKit expands only
+# these explicit path and glob imports; Narratio never scans directories itself.
+configkit:
+  imports:
+    - path: conf.d/platform.yml
+    - path: conf.d/storage.yml
+    - path: conf.d/transcript.yml
+    - path: conf.d/publish.yml
+    - glob: artifacts/*.yml
+    - glob: artifact-families/*.yml
+
+scriptorium:
+  binary: scriptorium
+  config_path: ./scriptorium/config.yml

go.mod

@@ -1,12 +1,15 @@
 module gitea.maximumdirect.net/eric/narratio
 
-go 1.25.0
+go 1.26.0
 
 require (
+	gitea.maximumdirect.net/eric/ConfigKit v0.4.0
 	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
 	github.com/aws/smithy-go v1.25.1
+	github.com/google/go-cmp v0.7.0
+	golang.org/x/sync v0.22.0
 	golang.org/x/sys v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -26,4 +29,5 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 // indirect
+	go.yaml.in/yaml/v4 v4.0.0-rc.6 // indirect
 )

go.sum

@@ -1,3 +1,5 @@
+gitea.maximumdirect.net/eric/ConfigKit v0.4.0 h1:fo+vKff3zTGeWqJIA38NtT84b6OUP//9ZmBH3lFuKgk=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.0/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
 github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
 github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
@@ -34,6 +36,12 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.42.1 h1:F/M5Y9I3nwr2IEpshZgh1GeHpOIt
 github.com/aws/aws-sdk-go-v2/service/sts v1.42.1/go.mod h1:mTNxImtovCOEEuD65mKW7DCsL+2gjEH+RPEAexAzAio=
 github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
 github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

internal/adapters/audita/fake.go

@@ -4,10 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"path/filepath"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op audita adapter.
@@ -18,13 +17,11 @@ func (n *NoopRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if err := ctx.Err(); err != nil {
 		return PolishResult{}, err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, false); err != nil {
 		return PolishResult{}, err
 	}
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
 		StdoutLogPath:           req.StdoutLogPath,
 		StderrLogPath:           req.StderrLogPath,
 		GeneratedConfigPath:     req.GeneratedConfigPath,
@@ -48,18 +45,20 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if f.Err != nil {
 		return PolishResult{}, f.Err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, true); err != nil {
 		return PolishResult{}, err
 	}
 	res := f.Result
 	if res.ProcessedTranscriptPath == "" {
 		res.ProcessedTranscriptPath = req.OutputProcessedPath
 	}
-	if res.ReportPath == "" {
-		res.ReportPath = req.ReportPath
-	}
-	if res.WorkDir == "" {
-		res.WorkDir = req.WorkDir
+	if res.Reports == (ReportBundle{}) {
+		dir := filepath.Dir(req.OutputProcessedPath)
+		res.Reports = ReportBundle{
+			ErrorsPath:     filepath.Join(dir, "errors.yml"),
+			RecoveriesPath: filepath.Join(dir, "recoveries.yml"),
+			OverviewPath:   filepath.Join(dir, "report.md"),
+		}
 	}
 	if res.StdoutLogPath == "" {
 		res.StdoutLogPath = req.StdoutLogPath
@@ -76,25 +75,25 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	return res, nil
 }
 
-func materializePlaceholders(req PolishRequest) error {
+func materializePlaceholders(req PolishRequest, reports bool) error {
 	if req.GeneratedConfigPath != "" {
 		payload := map[string]any{
-			"schema":                 "audita.generated.v1",
+			"schema":                 "audita.generated.v2",
 			"placeholder":            true,
 			"merged_transcript_path": req.MergedTranscriptPath,
 			"output_path":            req.OutputProcessedPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("audita noop/fake stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("audita noop/fake stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("audita noop/fake stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("audita noop/fake stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -104,11 +103,18 @@ func materializePlaceholders(req PolishRequest) error {
 	}); err != nil {
 		return err
 	}
-	if err := writeJSONIfRequested(req.ReportPath, map[string]any{
-		"schema": "audita.report.v1",
-		"steps":  []any{},
-	}); err != nil {
-		return err
+	if !reports {
+		return nil
+	}
+	for _, report := range []struct{ name, contents string }{
+		{"errors.yml", "schema: audita-errors\nversion: 1\nstatus: completed\nerrors: []\n"},
+		{"recoveries.yml", "schema: audita-recoveries\nversion: 1\nstatus: completed\nrecoveries: []\n"},
+		{"report.md", "# Audita report\n"},
+	} {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), report.name)
+		if err := fileops.WriteFileAtomic(path, []byte(report.contents), fileops.WorkspaceFileMode); err != nil {
+			return fmt.Errorf("write report %q: %w", path, err)
+		}
 	}
 	return nil
 }
@@ -117,14 +123,14 @@ func writeJSONIfRequested(path string, payload any) error {
 	if path == "" {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := fileops.EnsureWorkspaceDirectory(filepath.Dir(path)); err != nil {
 		return fmt.Errorf("create parent directory %q: %w", filepath.Dir(path), err)
 	}
 	data, err := json.Marshal(payload)
 	if err != nil {
 		return fmt.Errorf("marshal placeholder json for %q: %w", path, err)
 	}
-	if err := subprocess.WriteFileAtomic(path, data, 0o644); err != nil {
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
 		return fmt.Errorf("write placeholder json %q: %w", path, err)
 	}
 	return nil

internal/adapters/audita/generated_config.go

@@ -0,0 +1,19 @@
+package audita
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/audita/runner.go

@@ -6,41 +6,34 @@ import (
 	"time"
 )
 
-// TODO: implement a real Audita subprocess/service adapter.
-
 // Runner is the adapter boundary for audita polish invocations.
 type Runner interface {
 	Run(ctx context.Context, req PolishRequest) (PolishResult, error)
 }
 
-// PolishRequest describes an audita invocation.
+// PolishRequest describes an Audita invocation. Nil Modules uses the runner's
+// configured selection; a non-nil empty slice selects no modules.
 type PolishRequest struct {
-	GeneratedConfigPath      string
-	MergedTranscriptPath     string
-	OutputProcessedPath      string
-	GlossaryPath             string
-	ReportPath               string
-	WorkDir                  string
-	Modules                  []string
-	BaseURL                  string
-	Model                    string
-	TranscriptDescription    string
-	ConfigPath               string
-	OutputSchema             string
-	WorkDirRetention         string
-	TotalLLMConcurrency      *int
-	ProposalLLMConcurrency   *int
-	ValidationModel          string
-	ValidationLLMConcurrency *int
-	StdoutLogPath            string
-	StderrLogPath            string
+	GeneratedConfigPath  string
+	MergedTranscriptPath string
+	OutputProcessedPath  string
+	GlossaryPath         string
+	Modules              []string
+	StdoutLogPath        string
+	StderrLogPath        string
 }
 
-// PolishResult describes a polish output.
+// ReportBundle contains optional reports adjacent to the requested output.
+type ReportBundle struct {
+	ErrorsPath     string
+	RecoveriesPath string
+	OverviewPath   string
+}
+
+// PolishResult describes a polish output and available diagnostics.
 type PolishResult struct {
 	ProcessedTranscriptPath string
-	ReportPath              string
-	WorkDir                 string
+	Reports                 ReportBundle
 	StdoutLogPath           string
 	StderrLogPath           string
 	GeneratedConfigPath     string

internal/adapters/audita/subprocess.go

@@ -3,96 +3,42 @@ package audita
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"net/url"
 	"os"
-	"strconv"
+	"path/filepath"
 	"strings"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxProcessedOutputBytes bounds Audita's processed-transcript JSON result.
+const MaxProcessedOutputBytes int64 = 64 * 1024 * 1024
+
+// MaxReportOutputBytes bounds each optional Audita report.
+const MaxReportOutputBytes int64 = 16 * 1024 * 1024
+
 // SubprocessRunnerConfig defines deterministic settings for Audita CLI execution.
 type SubprocessRunnerConfig struct {
-	Binary                   string
-	Timeout                  time.Duration
-	LLMAPIKeyEnv             string
-	Modules                  []string
-	BaseURL                  string
-	Model                    string
-	TranscriptDescription    string
-	ConfigPath               string
-	OutputSchema             string
-	WorkDirRetention         string
-	TotalLLMConcurrency      *int
-	ProposalLLMConcurrency   *int
-	ValidationModel          string
-	ValidationLLMConcurrency *int
-	Report                   bool
+	Binary                string
+	Timeout               time.Duration
+	Credentials           []configkit.Secret
+	Modules               []string
+	Overlay               string
+	ProposalProfile       string
+	ValidationProfile     string
+	TranscriptDescription string
+	ConfigPath            string
+	OutputSchema          string
 }
 
 // SubprocessRunner invokes Audita via subprocess.
 type SubprocessRunner struct {
-	binary                   string
-	timeout                  time.Duration
-	llmAPIKeyEnv             string
-	modules                  []string
-	baseURL                  string
-	model                    string
-	transcriptDescription    string
-	configPath               string
-	outputSchema             string
-	workDirRetention         string
-	totalLLMConcurrency      *int
-	proposalLLMConcurrency   *int
-	validationModel          string
-	validationLLMConcurrency *int
-	report                   bool
-}
-
-// NewSubprocessRunnerFromConfigValues parses config-derived values once.
-func NewSubprocessRunnerFromConfigValues(
-	binary string,
-	timeout string,
-	llmAPIKeyEnv string,
-	modules []string,
-	baseURL string,
-	model string,
-	transcriptDescription string,
-	configPath string,
-	outputSchema string,
-	workDirRetention string,
-	totalLLMConcurrency *int,
-	proposalLLMConcurrency *int,
-	validationModel string,
-	validationLLMConcurrency *int,
-	report bool,
-) (*SubprocessRunner, error) {
-	if strings.TrimSpace(timeout) == "" {
-		return nil, fmt.Errorf("audita timeout is required")
-	}
-	parsedTimeout, err := time.ParseDuration(timeout)
-	if err != nil {
-		return nil, fmt.Errorf("parse audita timeout %q: %w", timeout, err)
-	}
-	return NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   binary,
-		Timeout:                  parsedTimeout,
-		LLMAPIKeyEnv:             llmAPIKeyEnv,
-		Modules:                  modules,
-		BaseURL:                  baseURL,
-		Model:                    model,
-		TranscriptDescription:    transcriptDescription,
-		ConfigPath:               configPath,
-		OutputSchema:             outputSchema,
-		WorkDirRetention:         workDirRetention,
-		TotalLLMConcurrency:      totalLLMConcurrency,
-		ProposalLLMConcurrency:   proposalLLMConcurrency,
-		ValidationModel:          validationModel,
-		ValidationLLMConcurrency: validationLLMConcurrency,
-		Report:                   report,
-	})
+	cfg SubprocessRunnerConfig
+	run func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error)
 }
 
 // NewSubprocessRunner constructs a validated Audita subprocess runner.
@@ -108,277 +54,172 @@ func NewSubprocessRunner(cfg SubprocessRunnerConfig) (*SubprocessRunner, error)
 			return nil, fmt.Errorf("audita module at index %d is empty", i)
 		}
 	}
-	if strings.TrimSpace(cfg.BaseURL) != "" {
-		u, err := url.Parse(cfg.BaseURL)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			if err != nil {
-				return nil, fmt.Errorf("audita base url %q is invalid: %w", cfg.BaseURL, err)
-			}
-			return nil, fmt.Errorf("audita base url %q is invalid", cfg.BaseURL)
-		}
-	}
-	if cfg.TotalLLMConcurrency != nil && *cfg.TotalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita total llm concurrency must be > 0 when provided")
-	}
-	if cfg.ProposalLLMConcurrency != nil && *cfg.ProposalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita proposal llm concurrency must be > 0 when provided")
-	}
-	if cfg.ValidationLLMConcurrency != nil && *cfg.ValidationLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita validation llm concurrency must be > 0 when provided")
-	}
 	switch strings.TrimSpace(cfg.OutputSchema) {
 	case "", "bare-segments", "audita-v1":
 	default:
 		return nil, fmt.Errorf("audita output schema must be one of: bare-segments, audita-v1")
 	}
-	switch strings.TrimSpace(cfg.WorkDirRetention) {
-	case "", "always", "auto", "never":
-	default:
-		return nil, fmt.Errorf("audita work dir retention must be one of: always, auto, never")
+	cfg.Binary = strings.TrimSpace(cfg.Binary)
+	cfg.Credentials = append([]configkit.Secret(nil), cfg.Credentials...)
+	cfg.Modules = cloneModules(cfg.Modules)
+	for i := range cfg.Modules {
+		cfg.Modules[i] = strings.TrimSpace(cfg.Modules[i])
 	}
-
-	modules := make([]string, len(cfg.Modules))
-	for i, m := range cfg.Modules {
-		modules[i] = strings.TrimSpace(m)
-	}
-
-	return &SubprocessRunner{
-		binary:                   strings.TrimSpace(cfg.Binary),
-		timeout:                  cfg.Timeout,
-		llmAPIKeyEnv:             strings.TrimSpace(cfg.LLMAPIKeyEnv),
-		modules:                  modules,
-		baseURL:                  strings.TrimSpace(cfg.BaseURL),
-		model:                    strings.TrimSpace(cfg.Model),
-		transcriptDescription:    strings.TrimSpace(cfg.TranscriptDescription),
-		configPath:               strings.TrimSpace(cfg.ConfigPath),
-		outputSchema:             strings.TrimSpace(cfg.OutputSchema),
-		workDirRetention:         strings.TrimSpace(cfg.WorkDirRetention),
-		totalLLMConcurrency:      cfg.TotalLLMConcurrency,
-		proposalLLMConcurrency:   cfg.ProposalLLMConcurrency,
-		validationModel:          strings.TrimSpace(cfg.ValidationModel),
-		validationLLMConcurrency: cfg.ValidationLLMConcurrency,
-		report:                   cfg.Report,
-	}, nil
+	return &SubprocessRunner{cfg: cfg, run: subprocess.Run}, nil
 }
 
-// Run executes Audita process with deterministic flags and validates output artifacts.
+func cloneModules(modules []string) []string {
+	if modules == nil {
+		return nil
+	}
+	return append([]string{}, modules...)
+}
+
+// Run executes Audita process and validates its corrected transcript.
 func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishResult, error) {
 	if r == nil {
 		return PolishResult{}, fmt.Errorf("audita subprocess runner is nil")
 	}
-	if strings.TrimSpace(req.MergedTranscriptPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita merged transcript path is required")
-	}
-	if strings.TrimSpace(req.GlossaryPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita glossary path is required")
-	}
-	if strings.TrimSpace(req.OutputProcessedPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita output processed path is required")
-	}
-	if strings.TrimSpace(req.WorkDir) == "" {
-		return PolishResult{}, fmt.Errorf("audita work dir is required")
-	}
-	if r.report && strings.TrimSpace(req.ReportPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita report is enabled but report path is missing")
-	}
-
-	reqModules := req.Modules
-	if reqModules == nil {
-		reqModules = append([]string(nil), r.modules...)
-	}
-	args := r.buildArgs(req, reqModules)
-
-	credentialEnvVar := strings.TrimSpace(r.llmAPIKeyEnv)
-	credentialPresent := false
-	env := map[string]string{}
-	if credentialEnvVar != "" {
-		credential, ok := os.LookupEnv(credentialEnvVar)
-		if !ok || strings.TrimSpace(credential) == "" {
-			return PolishResult{}, fmt.Errorf("audita: required credential environment variable %s is not set", credentialEnvVar)
+	for _, field := range []struct{ name, value string }{
+		{"merged transcript path", req.MergedTranscriptPath},
+		{"glossary path", req.GlossaryPath},
+		{"output processed path", req.OutputProcessedPath},
+	} {
+		if strings.TrimSpace(field.value) == "" {
+			return PolishResult{}, fmt.Errorf("audita %s is required", field.name)
 		}
-		env["AUDITA_LLM_API_KEY"] = credential
-		credentialPresent = true
 	}
-
+	modules := req.Modules
+	if modules == nil {
+		modules = r.cfg.Modules
+	}
+	for i, module := range modules {
+		if strings.TrimSpace(module) == "" {
+			return PolishResult{}, fmt.Errorf("audita module at index %d is empty", i)
+		}
+	}
+	modules = cloneModules(modules)
+	for i := range modules {
+		modules[i] = strings.TrimSpace(modules[i])
+	}
+	args := r.buildArgs(req, modules)
+	env, names, err := subprocess.CredentialEnvironment(r.cfg.Credentials)
+	if err != nil {
+		return PolishResult{}, fmt.Errorf("audita credentials: %w", err)
+	}
 	if req.GeneratedConfigPath != "" {
-		if err := r.writeInvocationConfig(req, args, reqModules, credentialPresent); err != nil {
+		if err := r.writeInvocationConfig(req, args, modules, names); err != nil {
 			return PolishResult{}, fmt.Errorf("write audita invocation config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
-
-	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    r.binary,
-		Args:          args,
-		Timeout:       r.timeout,
-		EnvOverrides:  env,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+	run := r.run
+	if run == nil {
+		run = subprocess.Run
+	}
+	runRes, runErr := run(ctx, subprocess.RunRequest{
+		Executable: r.cfg.Binary, Args: args, Timeout: r.cfg.Timeout,
+		EnvOverrides: env, SensitiveEnvNames: names, DiagnosticOwner: "audita",
+		StdoutLogPath: req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
 	})
-	if err != nil {
-		wrappedMessage := fmt.Sprintf(
-			"run audita process (binary=%q, stdout_log=%q, stderr_log=%q)",
-			r.binary,
-			req.StdoutLogPath,
-			req.StderrLogPath,
-		)
-		wrappedMessage = addSubprocessStreamHint(wrappedMessage, err)
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf(
-			"%s: %w",
-			wrappedMessage,
-			err,
-		)
+	result := r.result(req, modules, names, runRes)
+	if runErr != nil {
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("run audita process (binary=%q, output_dir=%q, stdout_log=%q, stderr_log=%q): %w",
+			r.cfg.Binary, filepath.Dir(req.OutputProcessedPath), req.StdoutLogPath, req.StderrLogPath, runErr)
 	}
-
 	if err := validateProcessedOutput(req.OutputProcessedPath); err != nil {
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
 	}
-	if r.report {
-		if err := validateJSONFile(req.ReportPath); err != nil {
-			return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita report output %q: %w", req.ReportPath, err)
-		}
+	reports, err := discoverReports(req.OutputProcessedPath)
+	if err != nil {
+		return result, err
 	}
-
-	return PolishResult{
-		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
-		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    reqModules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyEnv,
-			"credential_present":         credentialPresent,
-		},
-	}, nil
+	result.Reports = reports
+	return result, nil
 }
 
-func (r *SubprocessRunner) failureResult(req PolishRequest, modules []string, runRes subprocess.RunResult, credentialPresent bool) PolishResult {
+func (r *SubprocessRunner) result(req PolishRequest, modules, names []string, runRes subprocess.RunResult) PolishResult {
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
+		StdoutLogPath:           req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
+		GeneratedConfigPath: req.GeneratedConfigPath, ExitCode: runRes.ExitCode,
+		Duration: runRes.Duration, InvokedBinary: r.cfg.Binary,
 		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    modules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyEnv,
-			"credential_present":         credentialPresent,
+			"adapter": "audita_subprocess", "modules": modules,
+			"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+			"validation_profile":     r.cfg.ValidationProfile,
+			"transcript_description": r.cfg.TranscriptDescription,
+			"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+			"credential_names": names,
 		},
 	}
 }
 
 func (r *SubprocessRunner) buildArgs(req PolishRequest, modules []string) []string {
-	args := []string{
-		"process",
-		req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-	}
-	if r.baseURL != "" {
-		args = append(args, "--base-url", r.baseURL)
-	}
-	if r.model != "" {
-		args = append(args, "--model", r.model)
-	}
-	if len(modules) > 0 {
+	args := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath}
+	if modules != nil {
 		args = append(args, "--modules", strings.Join(modules, ","))
 	}
-	if r.report {
-		args = append(args, "--report-json", req.ReportPath)
-	}
-	if r.transcriptDescription != "" {
-		args = append(args, "--transcript-description", r.transcriptDescription)
-	}
-	if r.configPath != "" {
-		args = append(args, "--config", r.configPath)
-	}
-	if r.outputSchema != "" {
-		args = append(args, "--output-schema", r.outputSchema)
-	}
-	if r.workDirRetention != "" {
-		args = append(args, "--work-dir-retention", r.workDirRetention)
-	}
-	if r.totalLLMConcurrency != nil {
-		args = append(args, "--total-llm-concurrency", strconv.Itoa(*r.totalLLMConcurrency))
-	}
-	if r.proposalLLMConcurrency != nil {
-		args = append(args, "--proposal-llm-concurrency", strconv.Itoa(*r.proposalLLMConcurrency))
-	}
-	if r.validationModel != "" {
-		args = append(args, "--validation-model", r.validationModel)
-	}
-	if r.validationLLMConcurrency != nil {
-		args = append(args, "--validation-llm-concurrency", strconv.Itoa(*r.validationLLMConcurrency))
+	for _, setting := range []struct{ flag, value string }{
+		{"--config", r.cfg.ConfigPath}, {"--overlay", r.cfg.Overlay},
+		{"--proposal-profile", r.cfg.ProposalProfile}, {"--validation-profile", r.cfg.ValidationProfile},
+		{"--transcript-description", r.cfg.TranscriptDescription}, {"--output-schema", r.cfg.OutputSchema},
+	} {
+		if setting.value != "" {
+			args = append(args, setting.flag, setting.value)
+		}
 	}
 	return args
 }
 
-func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args []string, modules []string, credentialPresent bool) error {
-	payload := map[string]any{
-		"schema":                     "audita.generated.v1",
-		"binary":                     r.binary,
-		"args":                       args,
-		"timeout":                    r.timeout.String(),
-		"modules":                    modules,
-		"base_url":                   r.baseURL,
-		"model":                      r.model,
-		"transcript_description":     r.transcriptDescription,
-		"config_path":                r.configPath,
-		"output_schema":              r.outputSchema,
-		"work_dir_retention":         r.workDirRetention,
-		"validation_model":           r.validationModel,
-		"total_llm_concurrency":      r.totalLLMConcurrency,
-		"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-		"validation_llm_concurrency": r.validationLLMConcurrency,
-		"report_enabled":             r.report,
-		"merged_transcript_path":     req.MergedTranscriptPath,
-		"glossary_path":              req.GlossaryPath,
-		"output_path":                req.OutputProcessedPath,
-		"report_path":                req.ReportPath,
-		"work_dir":                   req.WorkDir,
-		"credential_env_var":         r.llmAPIKeyEnv,
-		"credential_present":         credentialPresent,
+func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args, modules, names []string) error {
+	return writeGeneratedYAML(req.GeneratedConfigPath, map[string]any{
+		"schema": "audita.generated.v2", "binary": r.cfg.Binary, "args": args,
+		"timeout": r.cfg.Timeout.String(), "modules": modules,
+		"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+		"validation_profile":     r.cfg.ValidationProfile,
+		"transcript_description": r.cfg.TranscriptDescription,
+		"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+		"merged_transcript_path": req.MergedTranscriptPath, "glossary_path": req.GlossaryPath,
+		"output_path": req.OutputProcessedPath, "credential_names": names,
+	})
+}
+
+func discoverReports(outputPath string) (ReportBundle, error) {
+	var reports ReportBundle
+	for _, report := range []struct {
+		name string
+		dest *string
+	}{
+		{"errors.yml", &reports.ErrorsPath},
+		{"recoveries.yml", &reports.RecoveriesPath},
+		{"report.md", &reports.OverviewPath},
+	} {
+		path := filepath.Join(filepath.Dir(outputPath), report.name)
+		info, err := os.Lstat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return reports, fmt.Errorf("inspect audita report %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return reports, fmt.Errorf("audita report %q is not a regular file", path)
+		}
+		if _, err := fileops.ReadFileBounded(path, MaxReportOutputBytes); err != nil {
+			return reports, fmt.Errorf("audita report %q exceeds or cannot be read within %d-byte limit: %w", path, MaxReportOutputBytes, err)
+		}
+		*report.dest = path
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return reports, nil
 }
 
 func validateProcessedOutput(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := fileops.ReadFileBounded(path, MaxProcessedOutputBytes)
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return fmt.Errorf("audita processed transcript result exceeds or cannot be read within %d-byte limit: %w", MaxProcessedOutputBytes, err)
 	}
-
 	var payload map[string]any
 	if err := json.Unmarshal(data, &payload); err != nil {
 		return fmt.Errorf("parse json: %w", err)
@@ -392,26 +233,3 @@ func validateProcessedOutput(path string) error {
 	}
 	return nil
 }
-
-func addSubprocessStreamHint(message string, runErr error) string {
-	if runErr == nil {
-		return message
-	}
-	lower := strings.ToLower(runErr.Error())
-	if strings.Contains(lower, "bad file descriptor") || strings.Contains(lower, "exit code 120") {
-		return message + "; hint=audita child process may have started with invalid stderr/stdout descriptors"
-	}
-	return message
-}
-
-func validateJSONFile(path string) error {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return fmt.Errorf("read file: %w", err)
-	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		return fmt.Errorf("parse json: %w", err)
-	}
-	return nil
-}

internal/adapters/audita/subprocess_test.go

@@ -2,665 +2,262 @@ package audita
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
-	"runtime"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 )
 
-func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	wrapper := writeAuditaHelperWrapper(t)
-	totalLLMConcurrency := 3
-	proposalLLMConcurrency := 2
-	validationLLMConcurrency := 2
-	runner, err := NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   wrapper,
-		Timeout:                  mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv:             "OPENAI_KEY_SOURCE",
-		Modules:                  []string{"glossary", "homophones", "glossary"},
-		BaseURL:                  "https://openrouter.ai/api/v1",
-		Model:                    "openrouter/google/gemma-4-31b-it",
-		TranscriptDescription:    "Campaign Session 42",
-		ConfigPath:               "/etc/audita/config.yml",
-		OutputSchema:             "audita-v1",
-		WorkDirRetention:         "auto",
-		TotalLLMConcurrency:      &totalLLMConcurrency,
-		ProposalLLMConcurrency:   &proposalLLMConcurrency,
-		ValidationModel:          "openrouter/google/gemma-4-31b-it",
-		ValidationLLMConcurrency: &validationLLMConcurrency,
-		Report:                   true,
-	})
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-
+func auditaTestRequest(t *testing.T) PolishRequest {
+	t.Helper()
 	dir := t.TempDir()
-	req := PolishRequest{
-		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: filepath.Join(dir, "base.json"),
+	return PolishRequest{
+		MergedTranscriptPath: filepath.Join(dir, "merged.json"),
 		GlossaryPath:         filepath.Join(dir, "glossary.yml"),
 		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		ReportPath:           filepath.Join(dir, "audita.report.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
-	}
-	writeAuditaTestFile(t, req.MergedTranscriptPath, `{"segments":[]}`)
-	writeAuditaTestFile(t, req.GlossaryPath, "terms: []\n")
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.ProcessedTranscriptPath != req.OutputProcessedPath {
-		t.Fatalf("ProcessedTranscriptPath = %q, want %q", res.ProcessedTranscriptPath, req.OutputProcessedPath)
-	}
-	if res.ReportPath != req.ReportPath {
-		t.Fatalf("ReportPath = %q, want %q", res.ReportPath, req.ReportPath)
-	}
-	if res.WorkDir != req.WorkDir {
-		t.Fatalf("WorkDir = %q, want %q", res.WorkDir, req.WorkDir)
-	}
-	if res.InvokedBinary != wrapper {
-		t.Fatalf("InvokedBinary = %q, want %q", res.InvokedBinary, wrapper)
-	}
-	if res.ExitCode != 0 {
-		t.Fatalf("ExitCode = %d, want 0", res.ExitCode)
-	}
-	if res.Duration <= 0 {
-		t.Fatalf("Duration = %s, want > 0", res.Duration)
-	}
-	assertJSONFileAudita(t, req.OutputProcessedPath)
-	assertJSONFileAudita(t, req.ReportPath)
-	if _, err := os.Stat(req.StdoutLogPath); err != nil {
-		t.Fatalf("stdout log missing: %v", err)
-	}
-	if _, err := os.Stat(req.StderrLogPath); err != nil {
-		t.Fatalf("stderr log missing: %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	wantArgs := []string{
-		"process", req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-		"--base-url", "https://openrouter.ai/api/v1",
-		"--model", "openrouter/google/gemma-4-31b-it",
-		"--modules", "glossary,homophones,glossary",
-		"--report-json", req.ReportPath,
-		"--transcript-description", "Campaign Session 42",
-		"--config", "/etc/audita/config.yml",
-		"--output-schema", "audita-v1",
-		"--work-dir-retention", "auto",
-		"--total-llm-concurrency", "3",
-		"--proposal-llm-concurrency", "2",
-		"--validation-model", "openrouter/google/gemma-4-31b-it",
-		"--validation-llm-concurrency", "2",
-	}
-	if strings.Join(rec.Args, "\n") != strings.Join(wantArgs, "\n") {
-		t.Fatalf("args = %#v, want %#v", rec.Args, wantArgs)
-	}
-	if rec.Env["AUDITA_LLM_API_KEY"] != "super-secret" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want propagated secret", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-	if rec.Env["AUDITA_LLM_CONCURRENCY"] != "" {
-		t.Fatalf("AUDITA_LLM_CONCURRENCY = %q, want empty/omitted", rec.Env["AUDITA_LLM_CONCURRENCY"])
-	}
-
-	cfgData, err := os.ReadFile(req.GeneratedConfigPath)
-	if err != nil {
-		t.Fatalf("read generated config: %v", err)
-	}
-	if strings.Contains(string(cfgData), "super-secret") {
-		t.Fatalf("generated config must not contain credential value")
-	}
-}
-
-func TestSubprocessRunnerMissingConfiguredCredentialFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "MISSING_AUDITA_KEY",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "required credential environment variable MISSING_AUDITA_KEY is not set") {
-		t.Fatalf("error = %q, want missing credential guidance", err.Error())
-	}
-}
-
-func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.Metadata["credential_present"] != false {
-		t.Fatalf("credential_present = %#v, want false", res.Metadata["credential_present"])
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_LLM_API_KEY"] != "" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want omitted/empty", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-}
-
-func TestSubprocessRunnerInheritsParentEnvironment(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("AUDITA_INHERITED_MARKER", "inherited-from-parent")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-		LLMAPIKeyEnv: "",
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_INHERITED_MARKER"] != "inherited-from-parent" {
-		t.Fatalf("AUDITA_INHERITED_MARKER = %q, want inherited-from-parent", rec.Env["AUDITA_INHERITED_MARKER"])
-	}
-}
-
-func TestSubprocessRunnerOmitsModulesFlagWhenNotConfigured(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--modules" {
-			t.Fatalf("args contained --modules unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerOmitsBaseURLAndModelFlagsWhenNotConfigured(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--base-url" {
-			t.Fatalf("args contained --base-url unexpectedly: %#v", rec.Args)
-		}
-		if rec.Args[i] == "--model" {
-			t.Fatalf("args contained --model unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "run audita process") {
-		t.Fatalf("error = %q, want subprocess context", err.Error())
-	}
-	if !strings.Contains(err.Error(), "exit code") {
-		t.Fatalf("error = %q, want exit code context", err.Error())
-	}
-	if !strings.Contains(err.Error(), req.StdoutLogPath) || !strings.Contains(err.Error(), req.StderrLogPath) {
-		t.Fatalf("error = %q, want stdout/stderr log paths", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailureAddsStderrDescriptorHint(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail_bad_fd")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "hint=audita child process may have started with invalid stderr/stdout descriptors") {
-		t.Fatalf("error = %q, want stderr descriptor hint", err.Error())
-	}
-}
-
-func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "missing_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita processed output") {
-		t.Fatalf("error = %q, want output validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "parse json") {
-		t.Fatalf("error = %q, want parse json context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSegmentsMissingFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "segments_missing")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "segments") {
-		t.Fatalf("error = %q, want segments validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_report")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:       writeAuditaHelperWrapper(t),
-		Timeout:      mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyEnv: "OPENAI_KEY_SOURCE",
-		Modules:      []string{"glossary"},
-		BaseURL:      "https://openrouter.ai/api/v1",
-		Model:        "openrouter/google/gemma-4-31b-it",
-		Report:       true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita report output") {
-		t.Fatalf("error = %q, want report validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerConstructorValidation(t *testing.T) {
-	_, err := NewSubprocessRunnerFromConfigValues("", "3h", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected binary validation error")
-	}
-	_, err = NewSubprocessRunnerFromConfigValues("audita", "bad", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected timeout parse error")
-	}
-	_, err = NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:       "audita",
-		Timeout:      mustParseAuditaDuration(t, "1s"),
-		LLMAPIKeyEnv: "AUDITA_LLM_API_KEY",
-		Modules:      []string{"glossary"},
-		BaseURL:      "://",
-		Model:        "openrouter/google/gemma-4-31b-it",
-	})
-	if err == nil {
-		t.Fatal("expected base url validation error")
-	}
-}
-
-type auditaHelperRecord struct {
-	Args []string          `json:"args"`
-	Env  map[string]string `json:"env"`
-}
-
-func TestAuditaSubprocessHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_AUDITA_HELPER") != "1" {
-		return
-	}
-
-	args := os.Args
-	start := -1
-	for i := range args {
-		if args[i] == "--" {
-			start = i + 1
-			break
-		}
-	}
-	if start < 0 || start >= len(args) {
-		_, _ = os.Stderr.WriteString("missing -- args separator\n")
-		os.Exit(2)
-	}
-	procArgs := args[start:]
-	outPath := auditaFlagValue(procArgs, "--output")
-	reportPath := auditaFlagValue(procArgs, "--report-json")
-	recordPath := os.Getenv("AUDITA_HELPER_RECORD_PATH")
-	if strings.TrimSpace(recordPath) != "" {
-		rec := auditaHelperRecord{
-			Args: procArgs,
-			Env: map[string]string{
-				"AUDITA_LLM_API_KEY":      os.Getenv("AUDITA_LLM_API_KEY"),
-				"AUDITA_LLM_CONCURRENCY":  os.Getenv("AUDITA_LLM_CONCURRENCY"),
-				"AUDITA_INHERITED_MARKER": os.Getenv("AUDITA_INHERITED_MARKER"),
-			},
-		}
-		data, _ := json.Marshal(rec)
-		_ = os.MkdirAll(filepath.Dir(recordPath), 0o755)
-		_ = os.WriteFile(recordPath, data, 0o644)
-	}
-
-	mode := os.Getenv("AUDITA_HELPER_MODE")
-	switch mode {
-	case "success":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		_, _ = os.Stdout.WriteString("audita helper success stdout\n")
-		_, _ = os.Stderr.WriteString("audita helper success stderr\n")
-		os.Exit(0)
-	case "fail":
-		_, _ = os.Stderr.WriteString("audita helper failure\n")
-		os.Exit(8)
-	case "fail_bad_fd":
-		_, _ = os.Stderr.WriteString("OSError: [Errno 9] Bad file descriptor\n")
-		os.Exit(120)
-	case "missing_output":
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_output":
-		writeAuditaHelperFile(outPath, `not-json`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "segments_missing":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1"}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_report":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `not-json`)
-		}
-		os.Exit(0)
-	default:
-		_, _ = os.Stderr.WriteString(fmt.Sprintf("unknown helper mode %q\n", mode))
-		os.Exit(2)
-	}
-}
-
-func mustAuditaRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
-	t.Helper()
-	r, err := NewSubprocessRunner(cfg)
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-	return r
-}
-
-func auditaReqForTest(t *testing.T, withReport bool) PolishRequest {
-	t.Helper()
-	dir := t.TempDir()
-	merged := filepath.Join(dir, "base.json")
-	glossary := filepath.Join(dir, "glossary.yml")
-	writeAuditaTestFile(t, merged, `{"segments":[]}`)
-	writeAuditaTestFile(t, glossary, "terms: []\n")
-	req := PolishRequest{
 		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: merged,
-		GlossaryPath:         glossary,
-		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
+		StdoutLogPath:        filepath.Join(dir, "stdout.log"),
+		StderrLogPath:        filepath.Join(dir, "stderr.log"),
 	}
-	if withReport {
-		req.ReportPath = filepath.Join(dir, "audita.report.json")
-	}
-	return req
 }
 
-func writeAuditaHelperWrapper(t *testing.T) string {
+func auditaTestRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
 	t.Helper()
-	exe, err := os.Executable()
+	if cfg.Binary == "" {
+		cfg.Binary = "audita"
+	}
+	if cfg.Timeout == 0 {
+		cfg.Timeout = time.Second
+	}
+	runner, err := NewSubprocessRunner(cfg)
 	if err != nil {
-		t.Fatalf("os.Executable() error = %v", err)
+		t.Fatal(err)
 	}
-	path := filepath.Join(t.TempDir(), "audita-helper-wrapper.sh")
-	content := "#!/bin/sh\nexec \"" + exe + "\" -test.run=TestAuditaSubprocessHelper -- \"$@\"\n"
-	if err := os.WriteFile(path, []byte(content), 0o755); err != nil {
-		t.Fatalf("WriteFile(%q) error = %v", path, err)
-	}
-	return path
+	return runner
 }
 
-func writeAuditaTestFile(t *testing.T, path, contents string) {
+func auditaTestSecret(t *testing.T, name, value string) configkit.Secret {
 	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatalf("MkdirAll(%q): %v", path, err)
+	t.Setenv(name, value)
+	type loaded struct {
+		Credential configkit.Secret `yaml:"credential"`
 	}
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
-		t.Fatalf("WriteFile(%q): %v", path, err)
+	result, err := configkit.Load(configkit.Bytes("credential.yml", []byte("credential: "+name+"\n")), configkit.Options[loaded]{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result.Config.Credential
+}
+
+func writeAuditaTestFile(t *testing.T, path, value string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+		t.Fatal(err)
 	}
 }
 
-func writeAuditaHelperFile(path, contents string) {
-	if strings.TrimSpace(path) == "" {
-		return
-	}
-	_ = os.MkdirAll(filepath.Dir(path), 0o755)
-	_ = os.WriteFile(path, []byte(contents), 0o644)
-}
-
-func auditaFlagValue(args []string, name string) string {
-	for i := 0; i < len(args)-1; i++ {
-		if args[i] == name {
-			return args[i+1]
+func TestSubprocessRunnerUsesV2InvocationAndCapturedCredentials(t *testing.T) {
+	const first = "NARRATIO_AUDITA_CUSTOM_ONE"
+	const second = "NARRATIO_AUDITA_CUSTOM_TWO"
+	firstSecret := auditaTestSecret(t, first, "loaded-one")
+	secondSecret := auditaTestSecret(t, second, "loaded-two")
+	t.Setenv(first, "parent-changed")
+	t.Setenv(second, "parent-changed-too")
+	t.Setenv("NARRATIO_AUDITA_UNSELECTED", "not-forwarded")
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{
+		Credentials: []configkit.Secret{firstSecret, secondSecret},
+		Modules:     []string{"grammar", "glossary", "grammar"},
+		Overlay:     "testing", ProposalProfile: "proposal", ValidationProfile: "validation",
+		TranscriptDescription: "campaign", ConfigPath: "/etc/audita/config.yml", OutputSchema: "audita-v1",
+	})
+	req := auditaTestRequest(t)
+	var captured subprocess.RunRequest
+	runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+		captured = processReq
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+			writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), name), "recoverable diagnostic\n")
 		}
+		return subprocess.RunResult{}, nil
 	}
-	return ""
-}
-
-func readAuditaHelperRecord(t *testing.T, path string) auditaHelperRecord {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	result, err := runner.Run(context.Background(), req)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var rec auditaHelperRecord
-	if err := json.Unmarshal(data, &rec); err != nil {
-		t.Fatalf("json unmarshal helper record: %v", err)
+	want := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath,
+		"--modules", "grammar,glossary,grammar", "--config", "/etc/audita/config.yml", "--overlay", "testing",
+		"--proposal-profile", "proposal", "--validation-profile", "validation", "--transcript-description", "campaign", "--output-schema", "audita-v1"}
+	if !reflect.DeepEqual(captured.Args, want) {
+		t.Fatalf("args = %#v, want %#v", captured.Args, want)
 	}
-	return rec
-}
-
-func assertJSONFileAudita(t *testing.T, path string) {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[first] != "loaded-one" || captured.EnvOverrides[second] != "loaded-two" || captured.EnvOverrides["NARRATIO_AUDITA_UNSELECTED"] != "" {
+		t.Fatalf("credential forwarding = %#v", captured.EnvOverrides)
+	}
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{first, second}) {
+		t.Fatalf("sensitive names = %#v", captured.SensitiveEnvNames)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath == "" || result.Reports.OverviewPath == "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+	generated, err := os.ReadFile(req.GeneratedConfigPath)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		t.Fatalf("json unmarshal %q: %v", path, err)
+	if !strings.Contains(string(generated), "audita.generated.v2") || !strings.Contains(string(generated), first) || strings.Contains(string(generated), "loaded-one") {
+		t.Fatalf("unsafe or incomplete generated invocation: %s", generated)
 	}
 }
 
-func mustParseAuditaDuration(t *testing.T, value string) time.Duration {
-	t.Helper()
-	d, err := time.ParseDuration(value)
-	if err != nil {
-		t.Fatalf("time.ParseDuration(%q) error = %v", value, err)
+func TestSubprocessRunnerModulePresenceAndReportAbsence(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		configured []string
+		requested  []string
+		wantFlag   bool
+		wantValue  string
+	}{
+		{"omitted", nil, nil, false, ""},
+		{"configured", []string{"grammar", "grammar"}, nil, true, "grammar,grammar"},
+		{"empty override", []string{"grammar"}, []string{}, true, ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Modules: test.configured})
+			req := auditaTestRequest(t)
+			req.Modules = test.requested
+			runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+				index := -1
+				for i, arg := range processReq.Args {
+					if arg == "--modules" {
+						index = i
+					}
+					if strings.HasPrefix(arg, "--report") || arg == "--debug" || arg == "--work-dir" {
+						t.Fatalf("retired or unwanted flag %q", arg)
+					}
+				}
+				if (index >= 0) != test.wantFlag || (index >= 0 && processReq.Args[index+1] != test.wantValue) {
+					t.Fatalf("args = %#v", processReq.Args)
+				}
+				writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+				return subprocess.RunResult{}, nil
+			}
+			result, err := runner.Run(context.Background(), req)
+			if err != nil || result.Reports != (ReportBundle{}) {
+				t.Fatalf("result = %#v, error = %v", result, err)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerRejectsMissingOrMalformedTranscript(t *testing.T) {
+	for _, output := range []string{"", `{"segments":"wrong"}`} {
+		t.Run(output, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+			req := auditaTestRequest(t)
+			runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+				if output != "" {
+					writeAuditaTestFile(t, req.OutputProcessedPath, output)
+				}
+				return subprocess.RunResult{}, nil
+			}
+			if _, err := runner.Run(context.Background(), req); err == nil {
+				t.Fatal("missing or malformed transcript was accepted")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerPreservesFailureAndAvailableReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita exited after writing output")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml"), "status: failed\n")
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	result, err := runner.Run(context.Background(), req)
+	if !errors.Is(err, processFailure) || !strings.Contains(err.Error(), filepath.Dir(req.OutputProcessedPath)) {
+		t.Fatalf("error = %v", err)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath != "" || result.Reports.OverviewPath != "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+}
+
+func TestSubprocessRunnerDoesNotMaskProcessFailureWithReportError(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita process failed")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	if _, err := runner.Run(context.Background(), req); !errors.Is(err, processFailure) {
+		t.Fatalf("error = %v, want original process error", err)
+	}
+}
+
+func TestSubprocessRunnerBoundsAdjacentReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{}, nil
+	}
+	if _, err := runner.Run(context.Background(), req); err == nil || !strings.Contains(err.Error(), "errors.yml") || !strings.Contains(err.Error(), "16777216") {
+		t.Fatalf("error = %v, want named report limit", err)
+	}
+}
+
+func TestSubprocessRunnerRedactsCustomCredentialStreams(t *testing.T) {
+	const first = "NARRATIO_AUDITA_STREAM_ONE"
+	const second = "NARRATIO_AUDITA_STREAM_TWO"
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "success", true: "failure"}[fail], func(t *testing.T) {
+			firstSecret := auditaTestSecret(t, first, "audita-first-secret")
+			secondSecret := auditaTestSecret(t, second, "audita-second-secret")
+			req := auditaTestRequest(t)
+			body := "#!/bin/sh\nprintf '%s\\n' \"$" + first + "\"\nprintf '%s\\n' \"$" + second + "\" >&2\n"
+			if fail {
+				body += "exit 7\n"
+			} else {
+				body += "printf '{\"segments\":[]}' > \"" + req.OutputProcessedPath + "\"\n"
+			}
+			binary := filepath.Join(t.TempDir(), "audita-helper")
+			writeAuditaTestFile(t, binary, body)
+			if err := os.Chmod(binary, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Binary: binary, Credentials: []configkit.Secret{firstSecret, secondSecret}})
+			_, err := runner.Run(context.Background(), req)
+			if (err != nil) != fail {
+				t.Fatalf("error = %v, fail = %v", err, fail)
+			}
+			for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+				data, readErr := os.ReadFile(path)
+				if readErr != nil {
+					t.Fatal(readErr)
+				}
+				if strings.Contains(string(data), "audita-first-secret") || strings.Contains(string(data), "audita-second-secret") || !strings.Contains(string(data), "<redacted>") {
+					t.Fatalf("unredacted stream %q: %s", path, data)
+				}
+			}
+			if fail && (strings.Contains(err.Error(), "audita-first-secret") || strings.Contains(err.Error(), "audita-second-secret")) {
+				t.Fatalf("unredacted failure: %v", err)
+			}
+		})
 	}
-	return d
 }

internal/adapters/notarius/fake.go

@@ -1,6 +1,10 @@
 package notarius
 
-import "context"
+import (
+	"context"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
 
 // FakeRunner is a configurable in-memory runner for stage tests.
 type FakeRunner struct {
@@ -14,7 +18,14 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 	if err := ctx.Err(); err != nil {
 		return RunResult{}, err
 	}
-	f.Requests = append(f.Requests, req)
+	copyRequest := req
+	copyRequest.Credentials = append([]configkit.Secret(nil), req.Credentials...)
+	if req.ConfigProfile != nil {
+		profile := *req.ConfigProfile
+		copyRequest.ConfigProfile = &profile
+	}
+	copyRequest.References = append([]ReferenceBinding(nil), req.References...)
+	f.Requests = append(f.Requests, copyRequest)
 	if f.Err != nil {
 		return RunResult{}, f.Err
 	}

internal/adapters/notarius/runner.go

@@ -4,18 +4,30 @@ package notarius
 import (
 	"context"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
-const ReceiptSchemaVersion = "notarius.run-result.v1"
+const ReceiptSchemaVersion = "notarius.run-result.v2"
 
 // Runner is the adapter boundary for a complete Notarius pipeline invocation.
 type Runner interface {
 	Run(ctx context.Context, req RunRequest) (RunResult, error)
 }
 
+// ReferenceBinding maps one normalized Notarius selector to an absolute
+// external reference path.
+type ReferenceBinding struct {
+	Selector string
+	Path     string
+}
+
 // RunRequest contains the resolved inputs and diagnostic destinations for one invocation.
 type RunRequest struct {
-	Binary           string
+	Binary string
+	// Credentials are already-resolved environment references selected for Notarius.
+	Credentials      []configkit.Secret
+	ConfigProfile    *string
 	ConfigPath       string
 	PipelineID       string
 	InputPath        string
@@ -24,20 +36,43 @@ type RunRequest struct {
 	ReceiptPath      string
 	LogPath          string
 	Timeout          time.Duration
+	Resume           bool
+	ChunkCache       string
+	References       []ReferenceBinding
 }
 
 // Receipt is the transport-neutral successful run receipt.
 type Receipt struct {
-	SchemaVersion         string
-	RunID                 string
-	PipelineID            string
-	OutputDirectory       string
-	IndexFile             string
-	NormalizedOutputCount int
-	RejectedOutputCount   int
-	WarningCount          int
-	ValidationStatus      string
-	DebugDirectory        string
+	SchemaVersion             string
+	RunID                     string
+	PipelineID                string
+	OutputDirectory           string
+	IndexFile                 string
+	NormalizedOutputCount     int
+	RejectedOutputCount       int
+	WarningGroupCount         int
+	WarningOccurrenceCount    int
+	DiagnosticGroupCount      int
+	DiagnosticOccurrenceCount int
+	DiagnosticsTruncated      bool
+	ValidationStatus          string
+	ValidationSummaries       []ValidationSummary
+	DebugDirectory            string
+}
+
+// ValidationSummary retains the bounded outcome of one Notarius producer result.
+type ValidationSummary struct {
+	Stage                string
+	StepID               string
+	LaneID               string
+	ModuleKey            string
+	ChunkID              string
+	Status               string
+	RejectingValidators  []string
+	ReasonCodes          []string
+	IncompleteValidators []string
+	ProducerAttemptCount int
+	TerminalAction       string
 }
 
 // LaneDescriptor identifies one normalized lane payload discovered through the index.
@@ -72,6 +107,8 @@ type Index struct {
 	RejectedPath    string
 	WarningsFile    string
 	WarningsPath    string
+	DiagnosticsFile string
+	DiagnosticsPath string
 	Lanes           []LaneDescriptor
 	ChunkMap        *PipelineDescriptor
 	EvidenceContext *PipelineDescriptor
@@ -90,8 +127,29 @@ type RejectionSummary struct {
 
 // WarningSummary retains structured warning identity without free-form messages.
 type WarningSummary struct {
-	Scope      string
-	ReasonCode string
+	Disposition     string
+	Category        string
+	ReasonCode      string
+	Origin          DiagnosticOrigin
+	OccurrenceCount int
+}
+
+// DiagnosticOrigin identifies the framework-owned pipeline location of a finding.
+type DiagnosticOrigin struct {
+	Stage        string
+	StepID       string
+	LaneID       string
+	ModuleKey    string
+	ValidatorKey string
+}
+
+// DiagnosticSummary retains bounded advisory or observation group metadata.
+type DiagnosticSummary struct {
+	Disposition     string
+	Category        string
+	ReasonCode      string
+	Origin          DiagnosticOrigin
+	OccurrenceCount int
 }
 
 // RunResult describes a successfully decoded and validated Notarius bundle.
@@ -105,4 +163,5 @@ type RunResult struct {
 	Duration    time.Duration
 	Rejections  []RejectionSummary
 	Warnings    []WarningSummary
+	Diagnostics []DiagnosticSummary
 }

internal/adapters/notarius/subprocess.go

@@ -5,23 +5,30 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gitea.maximumdirect.net/eric/narratio/internal/notariusref"
 	"gitea.maximumdirect.net/eric/narratio/internal/pathsafe"
 )
 
 const (
-	maxReceiptBytes       = 1 << 20
-	maxIndexBytes         = 4 << 20
-	maxSummaryBytes       = 4 << 20
-	canonicalIndexFile    = "index.json"
-	canonicalManifestFile = "manifest.json"
-	canonicalRejectedFile = "rejected.json"
-	canonicalWarningsFile = "warnings.json"
+	maxReceiptBytes          = 1 << 20
+	maxIndexBytes            = 4 << 20
+	maxSummaryBytes          = 4 << 20
+	canonicalIndexFile       = "index.json"
+	canonicalManifestFile    = "manifest.json"
+	canonicalRejectedFile    = "rejected.json"
+	canonicalWarningsFile    = "warnings.json"
+	canonicalDiagnosticsFile = "diagnostics.json"
+	warningsSchemaVersion    = "notarius.warnings.v2"
+	diagnosticsSchemaVersion = "notarius.diagnostics.v1"
+	maxWarningGroups         = 128
+	maxDiagnosticGroups      = 256
+	maxFindingSamples        = 3
 )
 
 type subprocessRun func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error)
@@ -41,24 +48,44 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if r == nil || r.run == nil {
 		return RunResult{}, fmt.Errorf("notarius subprocess runner is nil")
 	}
-	if err := validateRunRequest(req); err != nil {
+	references, err := validateRunRequest(req)
+	if err != nil {
 		return RunResult{}, err
 	}
+	envOverrides, sensitiveEnvNames, err := subprocess.CredentialEnvironment(req.Credentials)
+	if err != nil {
+		return RunResult{}, fmt.Errorf("notarius credentials: %w", err)
+	}
 
 	args := []string{
 		"run", req.PipelineID,
 		"--config", req.ConfigPath,
 		"--input", req.InputPath,
 		"--output-dir", req.OutputRoot,
-		"--json",
 	}
+	if req.Resume {
+		args = append(args, "--resume")
+	}
+	if req.ChunkCache != "" {
+		args = append(args, "--chunk_cache", req.ChunkCache)
+	}
+	for _, reference := range references {
+		args = append(args, "--reference", reference.Selector+"="+reference.Path)
+	}
+	if req.ConfigProfile != nil {
+		args = append(args, "--config-profile", *req.ConfigProfile)
+	}
+	args = append(args, "--json")
 	processResult, err := r.run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDirectory,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.ReceiptPath,
-		StderrLogPath: req.LogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDirectory,
+		Timeout:           req.Timeout,
+		DiagnosticOwner:   "notarius",
+		StdoutLogPath:     req.ReceiptPath,
+		StderrLogPath:     req.LogPath,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveEnvNames,
 	})
 	baseResult := RunResult{
 		ReceiptPath: req.ReceiptPath,
@@ -94,24 +121,45 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return baseResult, err
 	}
+	diagnostics, diagnosticOccurrences, diagnosticsTruncated, err := loadDiagnostics(index.DiagnosticsPath)
+	if err != nil {
+		return baseResult, err
+	}
+	if receipt.NormalizedOutputCount != len(index.Lanes) || receipt.RejectedOutputCount != len(rejections) ||
+		receipt.WarningGroupCount != len(warnings) || receipt.DiagnosticGroupCount != len(diagnostics) {
+		return baseResult, fmt.Errorf("notarius receipt counts do not match published bundle")
+	}
+	warningOccurrences, err := sumWarningOccurrences(warnings)
+	if err != nil {
+		return baseResult, err
+	}
+	if receipt.WarningOccurrenceCount != warningOccurrences ||
+		receipt.DiagnosticOccurrenceCount != diagnosticOccurrences ||
+		receipt.DiagnosticsTruncated != diagnosticsTruncated {
+		return baseResult, fmt.Errorf("notarius receipt occurrence counts do not match published bundle")
+	}
 
 	baseResult.Receipt = receipt
 	baseResult.Index = index
 	baseResult.BundleRoot = bundleRoot
 	baseResult.Rejections = rejections
 	baseResult.Warnings = warnings
+	baseResult.Diagnostics = diagnostics
 	return baseResult, nil
 }
 
-func validateRunRequest(req RunRequest) error {
+func validateRunRequest(req RunRequest) ([]ReferenceBinding, error) {
 	if strings.TrimSpace(req.Binary) == "" {
-		return fmt.Errorf("notarius binary is required")
+		return nil, fmt.Errorf("notarius binary is required")
 	}
 	if strings.TrimSpace(req.PipelineID) == "" {
-		return fmt.Errorf("notarius pipeline id is required")
+		return nil, fmt.Errorf("notarius pipeline id is required")
 	}
 	if req.Timeout <= 0 {
-		return fmt.Errorf("notarius timeout must be positive")
+		return nil, fmt.Errorf("notarius timeout must be positive")
+	}
+	if !validChunkCacheMode(req.ChunkCache) {
+		return nil, fmt.Errorf("notarius chunk cache mode must be empty, auto, bypass, or refresh")
 	}
 	for label, path := range map[string]string{
 		"config":            req.ConfigPath,
@@ -122,47 +170,133 @@ func validateRunRequest(req RunRequest) error {
 		"log":               req.LogPath,
 	} {
 		if strings.TrimSpace(path) == "" {
-			return fmt.Errorf("notarius %s path is required", label)
+			return nil, fmt.Errorf("notarius %s path is required", label)
 		}
 		if !filepath.IsAbs(path) {
-			return fmt.Errorf("notarius %s path must be absolute", label)
+			return nil, fmt.Errorf("notarius %s path must be absolute", label)
 		}
 	}
 	if filepath.Clean(req.ReceiptPath) == filepath.Clean(req.LogPath) {
-		return fmt.Errorf("notarius receipt and log paths must be different")
+		return nil, fmt.Errorf("notarius receipt and log paths must be different")
+	}
+	references := make([]ReferenceBinding, 0, len(req.References))
+	selectors := make(map[string]struct{}, len(req.References))
+	for index, binding := range req.References {
+		selector, err := notariusref.NormalizeSelector(binding.Selector)
+		if err != nil {
+			return nil, fmt.Errorf("notarius reference %d selector: %w", index, err)
+		}
+		if _, duplicate := selectors[selector]; duplicate {
+			return nil, fmt.Errorf("notarius reference selector %q is duplicated", selector)
+		}
+		selectors[selector] = struct{}{}
+		if strings.TrimSpace(binding.Path) == "" {
+			return nil, fmt.Errorf("notarius reference %q path is required", selector)
+		}
+		if !filepath.IsAbs(binding.Path) {
+			return nil, fmt.Errorf("notarius reference %q path must be absolute", selector)
+		}
+		references = append(references, ReferenceBinding{Selector: selector, Path: binding.Path})
 	}
 	if err := requireRegularFile(req.ConfigPath); err != nil {
-		return fmt.Errorf("validate notarius config path: %w", err)
+		return nil, fmt.Errorf("validate notarius config path: %w", err)
 	}
 	if err := requireRegularFile(req.InputPath); err != nil {
-		return fmt.Errorf("validate notarius input path: %w", err)
+		return nil, fmt.Errorf("validate notarius input path: %w", err)
 	}
 	if err := requireDirectory(req.OutputRoot); err != nil {
-		return fmt.Errorf("validate notarius output root: %w", err)
+		return nil, fmt.Errorf("validate notarius output root: %w", err)
 	}
 	if err := requireDirectory(req.WorkingDirectory); err != nil {
-		return fmt.Errorf("validate notarius working directory: %w", err)
+		return nil, fmt.Errorf("validate notarius working directory: %w", err)
 	}
 	if err := validateLogDestination(req.ReceiptPath); err != nil {
-		return fmt.Errorf("validate notarius receipt path: %w", err)
+		return nil, fmt.Errorf("validate notarius receipt path: %w", err)
 	}
 	if err := validateLogDestination(req.LogPath); err != nil {
-		return fmt.Errorf("validate notarius log path: %w", err)
+		return nil, fmt.Errorf("validate notarius log path: %w", err)
+	}
+	return references, nil
+}
+
+func validChunkCacheMode(mode string) bool {
+	switch mode {
+	case "", "auto", "bypass", "refresh":
+		return true
+	default:
+		return false
 	}
-	return nil
 }
 
 type receiptDocument struct {
-	SchemaVersion         string `json:"schema_version"`
-	RunID                 string `json:"run_id"`
-	PipelineID            string `json:"pipeline_id"`
-	OutputDirectory       string `json:"output_directory"`
-	IndexFile             string `json:"index_file"`
-	NormalizedOutputCount *int   `json:"normalized_output_count"`
-	RejectedOutputCount   *int   `json:"rejected_output_count"`
-	WarningCount          *int   `json:"warning_count"`
-	ValidationStatus      string `json:"validation_status"`
-	DebugDirectory        string `json:"debug_directory"`
+	SchemaVersion             string                      `json:"schema_version"`
+	RunID                     string                      `json:"run_id"`
+	PipelineID                string                      `json:"pipeline_id"`
+	OutputDirectory           string                      `json:"output_directory"`
+	IndexFile                 string                      `json:"index_file"`
+	NormalizedOutputCount     *int                        `json:"normalized_output_count"`
+	RejectedOutputCount       *int                        `json:"rejected_output_count"`
+	WarningGroupCount         *int                        `json:"warning_group_count"`
+	WarningOccurrenceCount    *int                        `json:"warning_occurrence_count"`
+	DiagnosticGroupCount      *int                        `json:"diagnostic_group_count"`
+	DiagnosticOccurrenceCount *int                        `json:"diagnostic_occurrence_count"`
+	DiagnosticsTruncated      *bool                       `json:"diagnostics_truncated"`
+	ValidationStatus          string                      `json:"validation_status"`
+	ValidationSummaries       []validationSummaryDocument `json:"validation_summaries"`
+	DebugDirectory            string                      `json:"debug_directory"`
+}
+
+type validationSummaryDocument struct {
+	Stage                string   `json:"stage"`
+	StepID               string   `json:"step_id"`
+	LaneID               string   `json:"lane_id"`
+	ModuleKey            string   `json:"module_key"`
+	ChunkID              string   `json:"chunk_id"`
+	Status               string   `json:"status"`
+	RejectingValidators  []string `json:"rejecting_validators"`
+	ReasonCodes          []string `json:"reason_codes"`
+	IncompleteValidators []string `json:"incomplete_validators"`
+	ProducerAttemptCount *int     `json:"producer_attempt_count"`
+	TerminalAction       string   `json:"terminal_action"`
+}
+
+func validValidationStatus(value string) bool {
+	switch value {
+	case "approved", "rejected", "incomplete":
+		return true
+	default:
+		return false
+	}
+}
+
+func validateValidationSummaries(documents []validationSummaryDocument) ([]ValidationSummary, error) {
+	summaries := make([]ValidationSummary, 0, len(documents))
+	for _, document := range documents {
+		if document.Status != "complete" && document.Status != "rejected" && document.Status != "incomplete" {
+			return nil, fmt.Errorf("notarius validation summary status %q is invalid", document.Status)
+		}
+		if document.ProducerAttemptCount == nil || *document.ProducerAttemptCount < 0 || !validTerminalAction(document.TerminalAction) {
+			return nil, fmt.Errorf("notarius validation summary is missing required fields")
+		}
+		summaries = append(summaries, ValidationSummary{
+			Stage: document.Stage, StepID: document.StepID, LaneID: document.LaneID,
+			ModuleKey: document.ModuleKey, ChunkID: document.ChunkID, Status: document.Status,
+			RejectingValidators:  append([]string(nil), document.RejectingValidators...),
+			ReasonCodes:          append([]string(nil), document.ReasonCodes...),
+			IncompleteValidators: append([]string(nil), document.IncompleteValidators...),
+			ProducerAttemptCount: *document.ProducerAttemptCount, TerminalAction: document.TerminalAction,
+		})
+	}
+	return summaries, nil
+}
+
+func validTerminalAction(value string) bool {
+	switch value {
+	case "accepted", "reject_output", "warn_continue", "fail_run":
+		return true
+	default:
+		return false
+	}
 }
 
 func loadReceipt(path, pipelineID string) (Receipt, error) {
@@ -176,7 +310,9 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 	if strings.TrimSpace(document.RunID) == "" || strings.TrimSpace(document.PipelineID) == "" ||
 		strings.TrimSpace(document.OutputDirectory) == "" || strings.TrimSpace(document.ValidationStatus) == "" ||
 		document.NormalizedOutputCount == nil ||
-		document.RejectedOutputCount == nil || document.WarningCount == nil {
+		document.RejectedOutputCount == nil || document.WarningGroupCount == nil ||
+		document.WarningOccurrenceCount == nil || document.DiagnosticGroupCount == nil ||
+		document.DiagnosticOccurrenceCount == nil || document.DiagnosticsTruncated == nil {
 		return Receipt{}, fmt.Errorf("notarius receipt is missing required fields")
 	}
 	if document.IndexFile != canonicalIndexFile {
@@ -185,9 +321,18 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 	if document.PipelineID != pipelineID {
 		return Receipt{}, fmt.Errorf("notarius receipt pipeline id %q does not match requested pipeline %q", document.PipelineID, pipelineID)
 	}
-	if *document.NormalizedOutputCount < 0 || *document.RejectedOutputCount < 0 || *document.WarningCount < 0 {
+	if *document.NormalizedOutputCount < 0 || *document.RejectedOutputCount < 0 ||
+		*document.WarningGroupCount < 0 || *document.WarningOccurrenceCount < 0 ||
+		*document.DiagnosticGroupCount < 0 || *document.DiagnosticOccurrenceCount < 0 {
 		return Receipt{}, fmt.Errorf("notarius receipt counts must be non-negative")
 	}
+	if !validValidationStatus(document.ValidationStatus) {
+		return Receipt{}, fmt.Errorf("notarius receipt validation_status %q is invalid", document.ValidationStatus)
+	}
+	validationSummaries, err := validateValidationSummaries(document.ValidationSummaries)
+	if err != nil {
+		return Receipt{}, err
+	}
 	if !filepath.IsAbs(document.OutputDirectory) {
 		return Receipt{}, fmt.Errorf("notarius receipt output directory must be absolute")
 	}
@@ -195,16 +340,21 @@ func loadReceipt(path, pipelineID string) (Receipt, error) {
 		return Receipt{}, fmt.Errorf("notarius receipt debug directory must be absolute when present")
 	}
 	return Receipt{
-		SchemaVersion:         document.SchemaVersion,
-		RunID:                 document.RunID,
-		PipelineID:            document.PipelineID,
-		OutputDirectory:       filepath.Clean(document.OutputDirectory),
-		IndexFile:             document.IndexFile,
-		NormalizedOutputCount: *document.NormalizedOutputCount,
-		RejectedOutputCount:   *document.RejectedOutputCount,
-		WarningCount:          *document.WarningCount,
-		ValidationStatus:      document.ValidationStatus,
-		DebugDirectory:        document.DebugDirectory,
+		SchemaVersion:             document.SchemaVersion,
+		RunID:                     document.RunID,
+		PipelineID:                document.PipelineID,
+		OutputDirectory:           filepath.Clean(document.OutputDirectory),
+		IndexFile:                 document.IndexFile,
+		NormalizedOutputCount:     *document.NormalizedOutputCount,
+		RejectedOutputCount:       *document.RejectedOutputCount,
+		WarningGroupCount:         *document.WarningGroupCount,
+		WarningOccurrenceCount:    *document.WarningOccurrenceCount,
+		DiagnosticGroupCount:      *document.DiagnosticGroupCount,
+		DiagnosticOccurrenceCount: *document.DiagnosticOccurrenceCount,
+		DiagnosticsTruncated:      *document.DiagnosticsTruncated,
+		ValidationStatus:          document.ValidationStatus,
+		ValidationSummaries:       validationSummaries,
+		DebugDirectory:            document.DebugDirectory,
 	}, nil
 }
 
@@ -213,6 +363,7 @@ type indexDocument struct {
 	OutputFiles     *[]laneDocument   `json:"output_files"`
 	RejectedFile    string            `json:"rejected_file"`
 	WarningsFile    string            `json:"warnings_file"`
+	DiagnosticsFile string            `json:"diagnostics_file"`
 	ChunkMap        *pipelineDocument `json:"chunk_map"`
 	EvidenceContext *pipelineDocument `json:"evidence_context"`
 }
@@ -249,6 +400,7 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 		{name: "manifest_file", got: document.ManifestFile, want: canonicalManifestFile},
 		{name: "rejected_file", got: document.RejectedFile, want: canonicalRejectedFile},
 		{name: "warnings_file", got: document.WarningsFile, want: canonicalWarningsFile},
+		{name: "diagnostics_file", got: document.DiagnosticsFile, want: canonicalDiagnosticsFile},
 	} {
 		if field.got != field.want {
 			return Index{}, fmt.Errorf("notarius index %s %q is incompatible; want %q", field.name, field.got, field.want)
@@ -259,10 +411,11 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 	}
 
 	index := Index{
-		Path:         indexPath,
-		ManifestFile: document.ManifestFile,
-		RejectedFile: document.RejectedFile,
-		WarningsFile: document.WarningsFile,
+		Path:            indexPath,
+		ManifestFile:    document.ManifestFile,
+		RejectedFile:    document.RejectedFile,
+		WarningsFile:    document.WarningsFile,
+		DiagnosticsFile: document.DiagnosticsFile,
 	}
 	var err error
 	if index.ManifestPath, err = resolveRegularFile(bundleRoot, index.ManifestFile); err != nil {
@@ -274,6 +427,9 @@ func loadIndex(bundleRoot, indexPath string) (Index, error) {
 	if index.WarningsPath, err = resolveRegularFile(bundleRoot, index.WarningsFile); err != nil {
 		return Index{}, fmt.Errorf("resolve notarius warning file: %w", err)
 	}
+	if index.DiagnosticsPath, err = resolveRegularFile(bundleRoot, index.DiagnosticsFile); err != nil {
+		return Index{}, fmt.Errorf("resolve notarius diagnostics file: %w", err)
+	}
 
 	seenLanes := make(map[string]struct{}, len(*document.OutputFiles))
 	for _, lane := range *document.OutputFiles {
@@ -361,12 +517,34 @@ func loadRejections(path string) ([]RejectionSummary, error) {
 	return summaries, nil
 }
 
-type warningDocument struct {
-	Warnings *[]struct {
+type findingGroupDocument struct {
+	Disposition     string                   `json:"disposition"`
+	Category        string                   `json:"category"`
+	ReasonCode      string                   `json:"reason_code"`
+	Origin          diagnosticOriginDocument `json:"origin"`
+	OccurrenceCount *int                     `json:"occurrence_count"`
+	Samples         *[]struct {
 		Scope      string `json:"scope"`
-		ReasonCode string `json:"reason_code"`
 		Message    string `json:"message"`
-	} `json:"warnings"`
+		ChunkID    string `json:"chunk_id"`
+		ChunkIndex *int   `json:"chunk_index"`
+	} `json:"samples"`
+	OmittedSampleCount *int `json:"omitted_sample_count"`
+}
+
+type diagnosticOriginDocument struct {
+	Stage        string `json:"stage"`
+	StepID       string `json:"step_id"`
+	LaneID       string `json:"lane_id"`
+	ModuleKey    string `json:"module_key"`
+	ValidatorKey string `json:"validator_key"`
+}
+
+type warningDocument struct {
+	SchemaVersion   string                  `json:"schema_version"`
+	GroupCount      *int                    `json:"group_count"`
+	OccurrenceCount *int                    `json:"occurrence_count"`
+	Groups          *[]findingGroupDocument `json:"groups"`
 }
 
 func loadWarnings(path string) ([]WarningSummary, error) {
@@ -374,46 +552,155 @@ func loadWarnings(path string) ([]WarningSummary, error) {
 	if err := decodeBoundedJSON(path, maxSummaryBytes, &document); err != nil {
 		return nil, fmt.Errorf("decode notarius warnings: %w", err)
 	}
-	if document.Warnings == nil {
-		return nil, fmt.Errorf("notarius warning document is missing warnings array")
+	if document.SchemaVersion != warningsSchemaVersion || document.GroupCount == nil ||
+		document.OccurrenceCount == nil || document.Groups == nil {
+		return nil, fmt.Errorf("notarius warning document is missing or incompatible required fields")
 	}
-	summaries := make([]WarningSummary, 0, len(*document.Warnings))
-	for _, item := range *document.Warnings {
-		if strings.TrimSpace(item.ReasonCode) == "" || strings.TrimSpace(item.Message) == "" {
-			return nil, fmt.Errorf("notarius warning entries require reason_code and message")
+	if *document.GroupCount < 0 || *document.GroupCount > maxWarningGroups || *document.OccurrenceCount < 0 ||
+		*document.GroupCount != len(*document.Groups) {
+		return nil, fmt.Errorf("notarius warning document counts are inconsistent")
+	}
+	summaries := make([]WarningSummary, 0, len(*document.Groups))
+	occurrences := 0
+	for _, group := range *document.Groups {
+		if err := validateFindingGroup(group); err != nil {
+			return nil, fmt.Errorf("notarius warning group: %w", err)
 		}
-		summaries = append(summaries, WarningSummary{Scope: item.Scope, ReasonCode: item.ReasonCode})
+		if group.Disposition != "warning" {
+			return nil, fmt.Errorf("notarius warning group disposition %q is invalid", group.Disposition)
+		}
+		if *group.OccurrenceCount > int(^uint(0)>>1)-occurrences {
+			return nil, fmt.Errorf("notarius warning occurrence count overflows")
+		}
+		occurrences += *group.OccurrenceCount
+		summaries = append(summaries, WarningSummary{
+			Disposition: group.Disposition, Category: group.Category, ReasonCode: group.ReasonCode,
+			Origin: diagnosticOrigin(group.Origin), OccurrenceCount: *group.OccurrenceCount,
+		})
+	}
+	if occurrences != *document.OccurrenceCount {
+		return nil, fmt.Errorf("notarius warning document occurrence count is inconsistent")
 	}
 	return summaries, nil
 }
 
+type diagnosticDocument struct {
+	SchemaVersion                string                  `json:"schema_version"`
+	GroupCount                   *int                    `json:"group_count"`
+	OccurrenceCount              *int                    `json:"occurrence_count"`
+	Truncated                    *bool                   `json:"truncated"`
+	UnrepresentedOccurrenceCount *int                    `json:"unrepresented_occurrence_count"`
+	Groups                       *[]findingGroupDocument `json:"groups"`
+}
+
+func loadDiagnostics(path string) ([]DiagnosticSummary, int, bool, error) {
+	var document diagnosticDocument
+	if err := decodeBoundedJSON(path, maxSummaryBytes, &document); err != nil {
+		return nil, 0, false, fmt.Errorf("decode notarius diagnostics: %w", err)
+	}
+	if document.SchemaVersion != diagnosticsSchemaVersion || document.GroupCount == nil ||
+		document.OccurrenceCount == nil || document.Truncated == nil ||
+		document.UnrepresentedOccurrenceCount == nil || document.Groups == nil {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document is missing or incompatible required fields")
+	}
+	if *document.GroupCount < 0 || *document.GroupCount > maxDiagnosticGroups || *document.OccurrenceCount < 0 ||
+		*document.UnrepresentedOccurrenceCount < 0 || *document.GroupCount != len(*document.Groups) {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document counts are inconsistent")
+	}
+	if !*document.Truncated && *document.UnrepresentedOccurrenceCount != 0 {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document has unrepresented occurrences without truncation")
+	}
+	summaries := make([]DiagnosticSummary, 0, len(*document.Groups))
+	representedOccurrences := 0
+	for _, group := range *document.Groups {
+		if err := validateFindingGroup(group); err != nil {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic group: %w", err)
+		}
+		if group.Disposition != "advisory" && group.Disposition != "observation" {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic group disposition %q is invalid", group.Disposition)
+		}
+		if *group.OccurrenceCount > int(^uint(0)>>1)-representedOccurrences {
+			return nil, 0, false, fmt.Errorf("notarius diagnostic occurrence count overflows")
+		}
+		representedOccurrences += *group.OccurrenceCount
+		summaries = append(summaries, DiagnosticSummary{
+			Disposition: group.Disposition, Category: group.Category, ReasonCode: group.ReasonCode,
+			Origin: diagnosticOrigin(group.Origin), OccurrenceCount: *group.OccurrenceCount,
+		})
+	}
+	if *document.UnrepresentedOccurrenceCount > int(^uint(0)>>1)-representedOccurrences ||
+		representedOccurrences+*document.UnrepresentedOccurrenceCount != *document.OccurrenceCount {
+		return nil, 0, false, fmt.Errorf("notarius diagnostics document occurrence count is inconsistent")
+	}
+	return summaries, *document.OccurrenceCount, *document.Truncated, nil
+}
+
+func validateFindingGroup(group findingGroupDocument) error {
+	if strings.TrimSpace(group.Disposition) == "" || strings.TrimSpace(group.Category) == "" ||
+		strings.TrimSpace(group.ReasonCode) == "" || !validDiagnosticOriginStage(group.Origin.Stage) ||
+		!validDiagnosticCategory(group.Disposition, group.Category) ||
+		group.OccurrenceCount == nil || *group.OccurrenceCount <= 0 || group.Samples == nil ||
+		group.OmittedSampleCount == nil || *group.OmittedSampleCount < 0 {
+		return fmt.Errorf("missing required fields")
+	}
+	if len(*group.Samples) == 0 || len(*group.Samples) > maxFindingSamples ||
+		*group.OmittedSampleCount != *group.OccurrenceCount-len(*group.Samples) {
+		return fmt.Errorf("sample counts are inconsistent")
+	}
+	for _, sample := range *group.Samples {
+		if strings.TrimSpace(sample.Scope) == "" || strings.TrimSpace(sample.Message) == "" ||
+			(sample.ChunkIndex != nil && *sample.ChunkIndex < 0) {
+			return fmt.Errorf("samples require scope and message")
+		}
+	}
+	return nil
+}
+
+func validDiagnosticCategory(disposition, category string) bool {
+	switch disposition {
+	case "warning":
+		return category == "configuration" || category == "degradation" ||
+			category == "validation_incomplete" || category == "fallback"
+	case "advisory":
+		return category == "data_quality"
+	case "observation":
+		return category == "normalization"
+	default:
+		return false
+	}
+}
+
+func validDiagnosticOriginStage(stage string) bool {
+	switch stage {
+	case "references", "chunk", "extract", "merge", "normalize":
+		return true
+	default:
+		return false
+	}
+}
+
+func diagnosticOrigin(document diagnosticOriginDocument) DiagnosticOrigin {
+	return DiagnosticOrigin{
+		Stage: document.Stage, StepID: document.StepID, LaneID: document.LaneID,
+		ModuleKey: document.ModuleKey, ValidatorKey: document.ValidatorKey,
+	}
+}
+
+func sumWarningOccurrences(values []WarningSummary) (int, error) {
+	total := 0
+	for _, value := range values {
+		if value.OccurrenceCount > int(^uint(0)>>1)-total {
+			return 0, fmt.Errorf("notarius warning occurrence count overflows")
+		}
+		total += value.OccurrenceCount
+	}
+	return total, nil
+}
+
 func decodeBoundedJSON(path string, limit int64, destination any) error {
-	inspected, err := os.Lstat(path)
+	data, err := fileops.ReadFileBounded(path, limit)
 	if err != nil {
-		return err
-	}
-	if inspected.Mode()&os.ModeSymlink != 0 || !inspected.Mode().IsRegular() {
-		return fmt.Errorf("path %q must be a regular file without symlinks", path)
-	}
-	file, err := os.Open(path)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = file.Close() }()
-	opened, err := file.Stat()
-	if err != nil {
-		return err
-	}
-	if !opened.Mode().IsRegular() || !os.SameFile(inspected, opened) {
-		return fmt.Errorf("file %q changed before it could be read", path)
-	}
-	reader := io.LimitReader(file, limit+1)
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return err
-	}
-	if int64(len(data)) > limit {
-		return fmt.Errorf("file %q exceeds %d-byte limit", path, limit)
+		return fmt.Errorf("notarius JSON result exceeds or cannot be read within %d-byte limit: %w", limit, err)
 	}
 	if err := json.Unmarshal(data, destination); err != nil {
 		return err

internal/adapters/notarius/subprocess_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	sharedsubprocess "gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 )
 
@@ -52,6 +53,10 @@ func TestSubprocessRunnerBuildsExactInvocationAndDiscoversBundle(t *testing.T) {
 	if result.Receipt.SchemaVersion != ReceiptSchemaVersion || result.Receipt.RunID != "notarius-run-1" {
 		t.Fatalf("receipt = %#v", result.Receipt)
 	}
+	if len(result.Receipt.ValidationSummaries) != 1 || result.Receipt.ValidationSummaries[0].LaneID != "npc-registry" ||
+		result.Receipt.ValidationSummaries[0].Status != "complete" {
+		t.Fatalf("validation summaries = %#v", result.Receipt.ValidationSummaries)
+	}
 	if len(result.Index.Lanes) != 1 || result.Index.Lanes[0].LaneID != "npc-registry" {
 		t.Fatalf("lanes = %#v", result.Index.Lanes)
 	}
@@ -64,22 +69,301 @@ func TestSubprocessRunnerBuildsExactInvocationAndDiscoversBundle(t *testing.T) {
 	if len(result.Rejections) != 1 || result.Rejections[0].LaneID != "spells" || result.Rejections[0].ReasonCode != "invalid_spell" {
 		t.Fatalf("rejections = %#v", result.Rejections)
 	}
-	if len(result.Warnings) != 1 || result.Warnings[0].Scope != "lane:npc-registry" || result.Warnings[0].ReasonCode != "normalized_name" {
+	if len(result.Warnings) != 1 || result.Warnings[0].Category != "degradation" || result.Warnings[0].ReasonCode != "normalized_name" {
 		t.Fatalf("warnings = %#v", result.Warnings)
 	}
+	if len(result.Diagnostics) != 1 || result.Diagnostics[0].Category != "data_quality" || result.Diagnostics[0].ReasonCode != "low_confidence" {
+		t.Fatalf("diagnostics = %#v", result.Diagnostics)
+	}
 }
 
-func TestSubprocessRunnerInheritsEnvironmentAndSeparatesStreams(t *testing.T) {
+func TestSubprocessRunnerMapsCacheControlsToArguments(t *testing.T) {
+	tests := []struct {
+		name       string
+		resume     bool
+		chunkCache string
+		want       []string
+	}{
+		{name: "resume", resume: true, want: []string{"--resume"}},
+		{name: "auto", chunkCache: "auto", want: []string{"--chunk_cache", "auto"}},
+		{name: "bypass", chunkCache: "bypass", want: []string{"--chunk_cache", "bypass"}},
+		{name: "refresh", chunkCache: "refresh", want: []string{"--chunk_cache", "refresh"}},
+		{name: "resume and mode", resume: true, chunkCache: "auto", want: []string{"--resume", "--chunk_cache", "auto"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.Resume = test.resume
+			req.ChunkCache = test.chunkCache
+			var captured sharedsubprocess.RunRequest
+			runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				captured = processReq
+				writeValidBundleAndReceipt(t, req, false)
+				return sharedsubprocess.RunResult{ExitCode: 0}, nil
+			}}
+
+			if _, err := runner.Run(context.Background(), req); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			want := []string{
+				"run", req.PipelineID, "--config", req.ConfigPath, "--input", req.InputPath,
+				"--output-dir", req.OutputRoot,
+			}
+			want = append(want, test.want...)
+			want = append(want, "--json")
+			if !reflect.DeepEqual(captured.Args, want) {
+				t.Fatalf("subprocess args = %#v, want %#v", captured.Args, want)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerMapsConfigProfileToArgumentPair(t *testing.T) {
+	tests := []struct {
+		name     string
+		supplied bool
+		value    string
+	}{
+		{name: "omitted"},
+		{name: "empty", supplied: true},
+		{name: "default", supplied: true, value: "default"},
+		{name: "named", supplied: true, value: "inexpensive"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			if test.supplied {
+				req.ConfigProfile = &test.value
+			}
+			var captured sharedsubprocess.RunRequest
+			runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				captured = processReq
+				writeValidBundleAndReceipt(t, req, false)
+				return sharedsubprocess.RunResult{ExitCode: 0}, nil
+			}}
+
+			if _, err := runner.Run(context.Background(), req); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			flagIndex := -1
+			for index, arg := range captured.Args {
+				if arg == "--config-profile" {
+					flagIndex = index
+					break
+				}
+			}
+			if !test.supplied {
+				if flagIndex >= 0 {
+					t.Fatalf("subprocess args unexpectedly contain config profile: %#v", captured.Args)
+				}
+				return
+			}
+			if flagIndex < 0 || flagIndex+2 >= len(captured.Args) || captured.Args[flagIndex+1] != test.value || captured.Args[flagIndex+2] != "--json" {
+				t.Fatalf("config profile argument boundary = %#v, want flag, exact value, then --json", captured.Args)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidChunkCacheBeforeLaunch(t *testing.T) {
+	for _, mode := range []string{"AUTO", "invalid", " auto "} {
+		t.Run(mode, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.ChunkCache = mode
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), "chunk cache mode") {
+				t.Fatalf("Run() error = %v, want chunk cache validation failure", err)
+			}
+			if started {
+				t.Fatal("subprocess started with invalid chunk cache mode")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_LLM_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_OTHER_KEY"
+	const loadedValue = "loaded-notarius-credential"
+	const otherValue = "loaded-notarius-other-credential"
+	credential := loadTestCredential(t, envName, loadedValue)
+	otherCredential := loadTestCredential(t, otherName, otherValue)
+	t.Setenv(envName, "changed-parent-credential")
+	t.Setenv(otherName, "changed-parent-other-credential")
+
 	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*credential, *otherCredential}
+	var captured sharedsubprocess.RunRequest
+	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+		captured = processReq
+		writeValidBundleAndReceipt(t, req, false)
+		return sharedsubprocess.RunResult{ExitCode: 0}, nil
+	}}
+	if _, err := runner.Run(context.Background(), req); err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[envName] != loadedValue || captured.EnvOverrides[otherName] != otherValue {
+		t.Fatal("subprocess did not receive exactly the loaded credential overrides")
+	}
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName, otherName}) {
+		t.Fatalf("sensitive environment names = %#v, want configured reference name", captured.SensitiveEnvNames)
+	}
+	wantArgs := []string{
+		"run", req.PipelineID, "--config", req.ConfigPath, "--input", req.InputPath,
+		"--output-dir", req.OutputRoot, "--json",
+	}
+	if !reflect.DeepEqual(captured.Args, wantArgs) {
+		t.Fatalf("subprocess args = %#v, want %#v", captured.Args, wantArgs)
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidProgrammaticCredentialBeforeLaunch(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		reference configkit.Secret
+	}{
+		{name: "unresolved", reference: configkit.SecretEnv("NARRATIO_NOTARIUS_UNRESOLVED_KEY")},
+		{name: "empty", reference: configkit.SecretEnv("")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.Credentials = []configkit.Secret{test.reference}
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), "resolved and nonempty") {
+				t.Fatalf("Run() error = %v, want credential validation failure", err)
+			}
+			if started {
+				t.Fatal("subprocess started with an invalid credential")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerBuildsOrderedReferenceArguments(t *testing.T) {
+	req := validRunRequest(t)
+	referenceRoot := t.TempDir()
+	req.References = []ReferenceBinding{
+		{Selector: " party ", Path: filepath.Join(referenceRoot, "party context=primary.json")},
+		{Selector: " npc-registry . extract . glossary ", Path: filepath.Join(referenceRoot, "glossary.json")},
+	}
+	originalReferences := append([]ReferenceBinding(nil), req.References...)
+	var captured sharedsubprocess.RunRequest
+	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+		captured = processReq
+		writeValidBundleAndReceipt(t, req, false)
+		return sharedsubprocess.RunResult{ExitCode: 0}, nil
+	}}
+
+	if _, err := runner.Run(context.Background(), req); err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	wantArgs := []string{
+		"run", req.PipelineID,
+		"--config", req.ConfigPath,
+		"--input", req.InputPath,
+		"--output-dir", req.OutputRoot,
+		"--reference", "party=" + req.References[0].Path,
+		"--reference", "npc-registry.extract.glossary=" + req.References[1].Path,
+		"--json",
+	}
+	if !reflect.DeepEqual(captured.Args, wantArgs) {
+		t.Fatalf("subprocess args = %#v, want %#v", captured.Args, wantArgs)
+	}
+	if !reflect.DeepEqual(req.References, originalReferences) {
+		t.Fatalf("Run() mutated caller references = %#v, want %#v", req.References, originalReferences)
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidReferencesBeforeLaunch(t *testing.T) {
+	tests := []struct {
+		name       string
+		references func(string) []ReferenceBinding
+		wantErr    string
+	}{
+		{
+			name: "invalid selector",
+			references: func(root string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "lane.prepare.party", Path: filepath.Join(root, "party.json")}}
+			},
+			wantErr: "selector",
+		},
+		{
+			name: "duplicate normalized selector",
+			references: func(root string) []ReferenceBinding {
+				return []ReferenceBinding{
+					{Selector: "lane.party", Path: filepath.Join(root, "party.json")},
+					{Selector: " lane . party ", Path: filepath.Join(root, "party-2.json")},
+				}
+			},
+			wantErr: "duplicated",
+		},
+		{
+			name: "empty path",
+			references: func(string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "party", Path: "  "}}
+			},
+			wantErr: "path is required",
+		},
+		{
+			name: "relative path",
+			references: func(string) []ReferenceBinding {
+				return []ReferenceBinding{{Selector: "party", Path: "references/party.json"}}
+			},
+			wantErr: "path must be absolute",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.References = tt.references(t.TempDir())
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Run() error = %v, want containing %q", err, tt.wantErr)
+			}
+			if started {
+				t.Fatal("subprocess started after request validation failure")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_OTHER_KEY"
+	const canary = "notarius-captured-stream-canary"
+	const otherCanary = "notarius-captured-stream-other-canary"
+	const unrelated = "NARRATIO_NOTARIUS_UNRELATED_PARENT_KEY"
+	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	writeValidBundleAndReceipt(t, req, false)
 	receiptFixture := req.ReceiptPath + ".fixture"
 	data, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
-	if err := os.WriteFile(receiptFixture, data, 0o644); err != nil {
-		t.Fatalf("WriteFile(receipt fixture) error = %v", err)
+	var receipt map[string]any
+	if err := json.Unmarshal(data, &receipt); err != nil {
+		t.Fatalf("decode receipt fixture: %v", err)
 	}
+	receipt["credential_echo"] = canary + " " + otherCanary
+	writeJSONFile(t, receiptFixture, receipt)
 	if err := os.Remove(req.ReceiptPath); err != nil {
 		t.Fatalf("Remove(receipt) error = %v", err)
 	}
@@ -91,27 +375,67 @@ func TestSubprocessRunnerInheritsEnvironmentAndSeparatesStreams(t *testing.T) {
 	script := writeShellScript(t, `#!/bin/sh
 pwd > "$NOTARIUS_CAPTURE_DIR/working-directory"
 printf '%s' "$NOTARIUS_INHERITED_VALUE" > "$NOTARIUS_CAPTURE_DIR/environment"
-printf 'diagnostic stream\n' >&2
+if [ "$`+envName+`" != '`+canary+`' ]; then
+  printf 'selected credential mismatch\n' >&2
+  exit 8
+fi
+if [ "$`+otherName+`" != '`+otherCanary+`' ]; then
+  printf 'other selected credential mismatch\n' >&2
+  exit 10
+fi
+if [ -n "$`+unrelated+`" ]; then
+  printf 'unrelated credential inherited\n' >&2
+  exit 9
+fi
+printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 cat "$NOTARIUS_RECEIPT_FIXTURE"
 `)
 	req.Binary = script
 	t.Setenv("NOTARIUS_CAPTURE_DIR", captureDir)
 	t.Setenv("NOTARIUS_INHERITED_VALUE", "inherited-value")
 	t.Setenv("NOTARIUS_RECEIPT_FIXTURE", receiptFixture)
+	t.Setenv(unrelated, "unrelated-parent-credential")
 
 	if _, err := NewSubprocessRunner().Run(context.Background(), req); err != nil {
 		t.Fatalf("Run() error = %v", err)
 	}
 	assertTextFile(t, filepath.Join(captureDir, "working-directory"), req.WorkingDirectory+"\n")
-	assertTextFile(t, filepath.Join(captureDir, "environment"), "inherited-value")
-	assertTextFile(t, req.LogPath, "diagnostic stream\n")
+	assertTextFile(t, filepath.Join(captureDir, "environment"), "")
+	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 	receiptBytes, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
-	if strings.Contains(string(receiptBytes), "diagnostic stream") {
-		t.Fatal("receipt contains stderr output")
+	assertRedactedCredentialBytes(t, receiptBytes, canary)
+	assertRedactedCredentialBytes(t, receiptBytes, otherCanary)
+}
+
+func TestSubprocessRunnerRedactsCredentialOnProcessFailure(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_OTHER_KEY"
+	const canary = "notarius-failure-stream-canary"
+	const otherCanary = "notarius-failure-stream-other-canary"
+	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
+	req.Binary = writeShellScript(t, `#!/bin/sh
+printf '%s\n' "$`+envName+`"
+printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
+exit 7
+`)
+	_, err := NewSubprocessRunner().Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("Run() error = nil, want process failure")
 	}
+	if strings.Contains(err.Error(), canary) || strings.Contains(err.Error(), otherCanary) || !strings.Contains(err.Error(), "<redacted>") {
+		t.Fatal("process failure did not return redacted diagnostics")
+	}
+	assertRedactedCredentialFile(t, req.ReceiptPath, canary)
+	assertRedactedCredentialFile(t, req.ReceiptPath, otherCanary)
+	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 }
 
 func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T) {
@@ -129,6 +453,10 @@ func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			req := validRunRequest(t)
+			if test.name == "nonzero" {
+				profile := "missing-profile"
+				req.ConfigProfile = &profile
+			}
 			req.Binary = writeShellScript(t, "#!/bin/sh\n"+test.scriptBody)
 			req.Timeout = test.timeout
 			ctx := context.Background()
@@ -171,8 +499,10 @@ func TestLoadReceiptValidation(t *testing.T) {
 	valid := map[string]any{
 		"schema_version": ReceiptSchemaVersion, "run_id": "run-1", "pipeline_id": "pipeline-1",
 		"output_directory": filepath.Join(root, "outputs", "run-1"), "index_file": "index.json",
-		"normalized_output_count": 1, "rejected_output_count": 0, "warning_count": 0,
-		"validation_status": "approved", "future_field": true,
+		"normalized_output_count": 1, "rejected_output_count": 0,
+		"warning_group_count": 0, "warning_occurrence_count": 0,
+		"diagnostic_group_count": 0, "diagnostic_occurrence_count": 0,
+		"diagnostics_truncated": false, "validation_status": "approved", "future_field": true,
 	}
 	tests := []struct {
 		name      string
@@ -183,11 +513,12 @@ func TestLoadReceiptValidation(t *testing.T) {
 	}{
 		{name: "unknown fields tolerated", wantOK: true},
 		{name: "malformed", raw: []byte("{")},
-		{name: "unsupported version", mutate: func(v map[string]any) { v["schema_version"] = "notarius.run-result.v2" }},
+		{name: "unsupported version", mutate: func(v map[string]any) { v["schema_version"] = "notarius.run-result.v1" }},
 		{name: "missing field", mutate: func(v map[string]any) { delete(v, "run_id") }},
 		{name: "pipeline mismatch", mutate: func(v map[string]any) { v["pipeline_id"] = "other" }},
 		{name: "relative output", mutate: func(v map[string]any) { v["output_directory"] = "run-1" }},
-		{name: "negative count", mutate: func(v map[string]any) { v["warning_count"] = -1 }},
+		{name: "negative count", mutate: func(v map[string]any) { v["warning_group_count"] = -1 }},
+		{name: "invalid validation status", mutate: func(v map[string]any) { v["validation_status"] = "valid" }},
 		{
 			name: "nested index", mutate: func(v map[string]any) { v["index_file"] = "nested/index.json" },
 			wantError: `index_file "nested/index.json"`,
@@ -369,22 +700,26 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 	root := t.TempDir()
 	rejectedPath := filepath.Join(root, "rejected.json")
 	warningsPath := filepath.Join(root, "warnings.json")
+	diagnosticsPath := filepath.Join(root, "diagnostics.json")
 	writeJSONFile(t, rejectedPath, map[string]any{"rejected": []any{map[string]any{
 		"stage": "validate", "lane_id": "spells", "reason_code": "invalid", "message": "do not retain this", "future": true,
 	}}, "future": true})
-	writeJSONFile(t, warningsPath, map[string]any{"warnings": []any{map[string]any{
-		"scope": "lane:spells", "reason_code": "bounded", "message": "do not retain this", "future": true,
-	}}, "future": true})
+	writeJSONFile(t, warningsPath, findingEnvelope(warningsSchemaVersion, []any{findingGroup("warning", "degradation", "bounded", "normalize", 2)}, 2, false, 0))
+	writeJSONFile(t, diagnosticsPath, findingEnvelope(diagnosticsSchemaVersion, []any{findingGroup("advisory", "data_quality", "low_confidence", "normalize", 3)}, 4, true, 1))
 	rejections, err := loadRejections(rejectedPath)
 	if err != nil || len(rejections) != 1 || rejections[0].ReasonCode != "invalid" {
 		t.Fatalf("loadRejections() = %#v, %v", rejections, err)
 	}
 	warnings, err := loadWarnings(warningsPath)
-	if err != nil || len(warnings) != 1 || warnings[0].Scope != "lane:spells" {
+	if err != nil || len(warnings) != 1 || warnings[0].Category != "degradation" || warnings[0].OccurrenceCount != 2 {
 		t.Fatalf("loadWarnings() = %#v, %v", warnings, err)
 	}
+	diagnostics, occurrences, truncated, err := loadDiagnostics(diagnosticsPath)
+	if err != nil || len(diagnostics) != 1 || occurrences != 4 || !truncated || diagnostics[0].Category != "data_quality" {
+		t.Fatalf("loadDiagnostics() = %#v, %d, %t, %v", diagnostics, occurrences, truncated, err)
+	}
 
-	for name, path := range map[string]string{"rejections": rejectedPath, "warnings": warningsPath} {
+	for name, path := range map[string]string{"rejections": rejectedPath, "warnings": warningsPath, "diagnostics": diagnosticsPath} {
 		t.Run("malformed "+name, func(t *testing.T) {
 			if err := os.WriteFile(path, []byte("{"), 0o644); err != nil {
 				t.Fatalf("WriteFile() error = %v", err)
@@ -392,8 +727,10 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 			var err error
 			if name == "rejections" {
 				_, err = loadRejections(path)
-			} else {
+			} else if name == "warnings" {
 				_, err = loadWarnings(path)
+			} else {
+				_, _, _, err = loadDiagnostics(path)
 			}
 			if err == nil {
 				t.Fatal("summary decoder error = nil")
@@ -410,16 +747,28 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 	if _, err := loadRejections(oversized); err == nil || !strings.Contains(err.Error(), "exceeds") {
 		t.Fatalf("loadRejections(oversized) error = %v", err)
 	}
+	if _, _, _, err := loadDiagnostics(oversized); err == nil || !strings.Contains(err.Error(), "exceeds") {
+		t.Fatalf("loadDiagnostics(oversized) error = %v", err)
+	}
 }
 
 func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
-	req := RunRequest{PipelineID: "pipeline"}
+	profile := "testing"
+	req := RunRequest{PipelineID: "pipeline", ConfigProfile: &profile, References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
 	want := RunResult{BundleRoot: "/bundle"}
 	fake := &FakeRunner{Result: want}
 	got, err := fake.Run(context.Background(), req)
 	if err != nil || !reflect.DeepEqual(got, want) || !reflect.DeepEqual(fake.Requests, []RunRequest{req}) {
 		t.Fatalf("Run() = %#v, %v; requests = %#v", got, err, fake.Requests)
 	}
+	req.References[0].Path = "/references/changed.json"
+	if fake.Requests[0].References[0].Path != "/references/party.json" {
+		t.Fatalf("fake retained aliased request references: %#v", fake.Requests[0].References)
+	}
+	profile = "changed"
+	if *fake.Requests[0].ConfigProfile != "testing" {
+		t.Fatalf("fake retained aliased config profile: %q", *fake.Requests[0].ConfigProfile)
+	}
 
 	wantErr := errors.New("configured failure")
 	fake.Err = wantErr
@@ -461,6 +810,56 @@ func validRunRequest(t *testing.T) RunRequest {
 	}
 }
 
+func loadTestCredential(t *testing.T, envName, value string) *configkit.Secret {
+	t.Helper()
+	t.Setenv(envName, value)
+	type testConfig struct {
+		Credential *configkit.Secret `yaml:"credential"`
+	}
+	result, err := configkit.Load(configkit.Bytes("credential.yml", []byte("credential: "+envName+"\n")), configkit.Options[testConfig]{})
+	if err != nil {
+		t.Fatalf("load test credential: %v", err)
+	}
+	return result.Config.Credential
+}
+
+func assertRedactedCredentialFile(t *testing.T, path, canary string) {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%q) error = %v", path, err)
+	}
+	assertRedactedCredentialBytes(t, data, canary)
+}
+
+func assertRedactedCredentialBytes(t *testing.T, data []byte, canary string) {
+	t.Helper()
+	text := string(data)
+	if strings.Contains(text, canary) || !strings.Contains(text, "<redacted>") {
+		t.Fatal("captured stream did not contain the required redaction marker")
+	}
+}
+
+func TestValidateValidationSummariesAcceptsReusedProducerWithoutAttempts(t *testing.T) {
+	zero := 0
+	summaries, err := validateValidationSummaries([]validationSummaryDocument{{
+		Stage: "chunk", Status: "complete", ProducerAttemptCount: &zero, TerminalAction: "accepted",
+	}})
+	if err != nil {
+		t.Fatalf("validateValidationSummaries() error = %v", err)
+	}
+	if len(summaries) != 1 || summaries[0].ProducerAttemptCount != 0 {
+		t.Fatalf("summaries = %#v, want one reused producer with zero attempts", summaries)
+	}
+
+	negative := -1
+	if _, err := validateValidationSummaries([]validationSummaryDocument{{
+		Stage: "chunk", Status: "complete", ProducerAttemptCount: &negative, TerminalAction: "accepted",
+	}}); err == nil {
+		t.Fatal("validateValidationSummaries() negative producer attempts error = nil")
+	}
+}
+
 func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown bool) {
 	t.Helper()
 	bundle := filepath.Join(req.OutputRoot, "notarius-run-1")
@@ -478,13 +877,12 @@ func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown boo
 		}
 	}
 	rejection := map[string]any{"stage": "validate", "lane_id": "spells", "reason_code": "invalid_spell", "message": strings.Repeat("external detail", 20)}
-	warning := map[string]any{"scope": "lane:npc-registry", "reason_code": "normalized_name", "message": strings.Repeat("external warning", 20)}
 	if includeUnknown {
 		rejection["future"] = true
-		warning["future"] = true
 	}
 	writeJSONFile(t, filepath.Join(bundle, "rejected.json"), map[string]any{"rejected": []any{rejection}, "future": true})
-	writeJSONFile(t, filepath.Join(bundle, "warnings.json"), map[string]any{"warnings": []any{warning}, "future": true})
+	writeJSONFile(t, filepath.Join(bundle, "warnings.json"), findingEnvelope(warningsSchemaVersion, []any{findingGroup("warning", "degradation", "normalized_name", "normalize", 2)}, 2, false, 0))
+	writeJSONFile(t, filepath.Join(bundle, "diagnostics.json"), findingEnvelope(diagnosticsSchemaVersion, []any{findingGroup("advisory", "data_quality", "low_confidence", "normalize", 3)}, 4, true, 1))
 	index := validIndexValue([]any{map[string]any{
 		"lane_id": "npc-registry", "file": "lanes/npc.json", "media_type": "application/json",
 		"module_key": "dnd/npc-registry", "schema_id": "notarius.dnd.npc_registry",
@@ -503,7 +901,13 @@ func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown boo
 	receipt := map[string]any{
 		"schema_version": ReceiptSchemaVersion, "run_id": "notarius-run-1", "pipeline_id": req.PipelineID,
 		"output_directory": bundle, "index_file": "index.json", "normalized_output_count": 1,
-		"rejected_output_count": 1, "warning_count": 1, "validation_status": "rejected",
+		"rejected_output_count": 1, "warning_group_count": 1, "warning_occurrence_count": 2,
+		"diagnostic_group_count": 1, "diagnostic_occurrence_count": 4,
+		"diagnostics_truncated": true, "validation_status": "rejected",
+		"validation_summaries": []any{map[string]any{
+			"stage": "normalize", "lane_id": "npc-registry", "status": "complete",
+			"producer_attempt_count": 1, "terminal_action": "accepted",
+		}},
 	}
 	if includeUnknown {
 		receipt["future"] = true
@@ -517,7 +921,7 @@ func createBundleSkeleton(t *testing.T) string {
 	if err := os.MkdirAll(filepath.Join(bundle, "lanes"), 0o755); err != nil {
 		t.Fatalf("MkdirAll(bundle) error = %v", err)
 	}
-	for _, name := range []string{"manifest.json", "rejected.json", "warnings.json", "lanes/npc.json", "chunk-map.json"} {
+	for _, name := range []string{"manifest.json", "rejected.json", "warnings.json", "diagnostics.json", "lanes/npc.json", "chunk-map.json"} {
 		if err := os.WriteFile(filepath.Join(bundle, filepath.FromSlash(name)), []byte("{}"), 0o644); err != nil {
 			t.Fatalf("WriteFile(%q) error = %v", name, err)
 		}
@@ -528,10 +932,31 @@ func createBundleSkeleton(t *testing.T) string {
 func validIndexValue(lanes []any) map[string]any {
 	return map[string]any{
 		"manifest_file": "manifest.json", "output_files": lanes,
-		"rejected_file": "rejected.json", "warnings_file": "warnings.json",
+		"rejected_file": "rejected.json", "warnings_file": "warnings.json", "diagnostics_file": "diagnostics.json",
 	}
 }
 
+func findingGroup(disposition, category, reasonCode, origin string, occurrences int) map[string]any {
+	return map[string]any{
+		"disposition": disposition, "category": category, "reason_code": reasonCode,
+		"origin": map[string]any{"stage": origin, "lane_id": "npc-registry"}, "occurrence_count": occurrences,
+		"samples":              []any{map[string]any{"scope": "lane:npc-registry", "message": "external detail"}},
+		"omitted_sample_count": occurrences - 1,
+	}
+}
+
+func findingEnvelope(schema string, groups []any, occurrences int, truncated bool, unrepresented int) map[string]any {
+	value := map[string]any{
+		"schema_version": schema, "group_count": len(groups), "occurrence_count": occurrences,
+		"groups": groups,
+	}
+	if schema == diagnosticsSchemaVersion {
+		value["truncated"] = truncated
+		value["unrepresented_occurrence_count"] = unrepresented
+	}
+	return value
+}
+
 func writeJSONFile(t *testing.T, path string, value any) {
 	t.Helper()
 	data, err := json.Marshal(value)

internal/adapters/scriptorium/fake.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op scriptorium adapter.
@@ -142,7 +142,7 @@ func (f *FakeRunner) RenderArtifact(ctx context.Context, req RenderArtifactReque
 
 func materializeRunPlaceholders(req RunArtifactRequest) error {
 	if req.OutputPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputPath, []byte("scriptorium noop/fake run artifact\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputPath, []byte("scriptorium noop/fake run artifact\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write run output %q: %w", req.OutputPath, err)
 		}
 	}
@@ -154,17 +154,17 @@ func materializeRunPlaceholders(req RunArtifactRequest) error {
 			"prompt_id":   req.PromptID,
 			"output_path": req.OutputPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake run stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake run stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake run stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake run stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -173,7 +173,7 @@ func materializeRunPlaceholders(req RunArtifactRequest) error {
 
 func materializeRenderPlaceholders(req RenderArtifactRequest) error {
 	if req.OutputPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputPath, []byte("{\"schema\":\"scriptorium.render.v1\",\"placeholder\":true}\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputPath, []byte("{\"schema\":\"scriptorium.render.v1\",\"placeholder\":true}\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write render output %q: %w", req.OutputPath, err)
 		}
 	}
@@ -185,17 +185,17 @@ func materializeRenderPlaceholders(req RenderArtifactRequest) error {
 			"prompt_id":   req.PromptID,
 			"output_path": req.OutputPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake render stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("scriptorium noop/fake render stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake render stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("scriptorium noop/fake render stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}

internal/adapters/scriptorium/generated_config.go

@@ -0,0 +1,19 @@
+package scriptorium
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/scriptorium/subprocess.go

@@ -9,8 +9,12 @@ import (
 	"time"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxOutputFileBytes bounds one Scriptorium artifact result.
+const MaxOutputFileBytes int64 = 64 * 1024 * 1024
+
 // SubprocessRunner invokes Scriptorium through its public CLI.
 type SubprocessRunner struct{}
 
@@ -52,13 +56,17 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 		}
 	}
 
+	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDir,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDir,
+		Timeout:           req.Timeout,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveNames,
+		DiagnosticOwner:   "scriptorium",
+		StdoutLogPath:     req.StdoutLogPath,
+		StderrLogPath:     req.StderrLogPath,
 	})
 
 	result := ArtifactResult{
@@ -134,13 +142,17 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 		}
 	}
 
+	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    req.Binary,
-		Args:          args,
-		WorkingDir:    req.WorkingDir,
-		Timeout:       req.Timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDir,
+		Timeout:           req.Timeout,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveNames,
+		DiagnosticOwner:   "scriptorium",
+		StdoutLogPath:     req.StdoutLogPath,
+		StderrLogPath:     req.StderrLogPath,
 	})
 
 	result := ArtifactResult{
@@ -223,6 +235,15 @@ func validateCommonRunRequest(
 	return true, nil
 }
 
+func credentialEnvironment(apiKeyEnv string) (map[string]string, []string) {
+	name := strings.TrimSpace(apiKeyEnv)
+	if name == "" {
+		return nil, nil
+	}
+	value, _ := os.LookupEnv(name)
+	return map[string]string{name: value}, []string{name}
+}
+
 func buildRunArgs(req RunArtifactRequest) []string {
 	args := []string{"run", "--prompt", strings.TrimSpace(req.PromptID)}
 	if cfgPath := strings.TrimSpace(req.ConfigPath); cfgPath != "" {
@@ -321,18 +342,15 @@ func writeInvocationConfig(path string, payload invocationPayload) error {
 		"render_format":        payload.RenderFormat,
 		"render_prompt_logged": payload.RenderPromptStore,
 	}
-	return subprocess.WriteYAMLAtomic(path, data, 0o644)
+	return writeGeneratedYAML(path, data)
 }
 
 func validateNonEmptyOutput(path string) error {
-	info, err := os.Stat(path)
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
 	if err != nil {
-		return fmt.Errorf("stat file: %w", err)
+		return fmt.Errorf("scriptorium artifact output exceeds or cannot be read within %d-byte limit: %w", MaxOutputFileBytes, err)
 	}
-	if info.IsDir() {
-		return fmt.Errorf("path is a directory")
-	}
-	if info.Size() <= 0 {
+	if len(data) == 0 {
 		return fmt.Errorf("file is empty")
 	}
 	return nil

internal/adapters/scriptorium/subprocess_test.go

@@ -6,16 +6,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 	"time"
 )
 
 func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "run_success")
@@ -95,9 +91,6 @@ func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *tes
 }
 
 func TestSubprocessRunnerRunExitCodeOneFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "fail_exit1")
 	t.Setenv("SCRIPTORIUM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -118,9 +111,6 @@ func TestSubprocessRunnerRunExitCodeOneFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerRunExitCodeTwoReturnsValidationFailureAndPreservesOutput(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "fail_exit2_with_output")
 	t.Setenv("SCRIPTORIUM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -144,9 +134,6 @@ func TestSubprocessRunnerRunExitCodeTwoReturnsValidationFailureAndPreservesOutpu
 }
 
 func TestSubprocessRunnerRunMissingOutputOnSuccessFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "run_success_missing_output")
 	t.Setenv("SCRIPTORIUM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -166,9 +153,6 @@ func TestSubprocessRunnerRunMissingOutputOnSuccessFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderSuccess(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "render_success")
 	recordPath := filepath.Join(t.TempDir(), "record.json")

internal/adapters/seriatim/fake.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"fmt"
 
-	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
 // NoopRunner is a deterministic no-op seriatim adapter.
@@ -260,7 +260,7 @@ func (f *FakeRunner) Render(ctx context.Context, req RenderRequest) (RenderResul
 
 func materializePlaceholders(req MergeRequest) error {
 	if req.OutputMergedTranscriptPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputMergedTranscriptPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputMergedTranscriptPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write merged transcript %q: %w", req.OutputMergedTranscriptPath, err)
 		}
 	}
@@ -271,22 +271,22 @@ func materializePlaceholders(req MergeRequest) error {
 			"input_transcript_paths": req.InputTranscriptPaths,
 			"output_path":            req.OutputMergedTranscriptPath,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
 	if req.ReportPath != "" {
-		if err := subprocess.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write report %q: %w", req.ReportPath, err)
 		}
 	}
@@ -295,7 +295,7 @@ func materializePlaceholders(req MergeRequest) error {
 
 func materializeTrimPlaceholders(req TrimRequest) error {
 	if req.OutputTrimmedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputTrimmedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputTrimmedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write trimmed transcript %q: %w", req.OutputTrimmedPath, err)
 		}
 	}
@@ -308,17 +308,17 @@ func materializeTrimPlaceholders(req TrimRequest) error {
 			"output_path":   req.OutputTrimmedPath,
 			"keep_selector": req.KeepSelector,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake trim stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake trim stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake trim stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake trim stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
@@ -327,7 +327,7 @@ func materializeTrimPlaceholders(req TrimRequest) error {
 
 func materializeNormalizePlaceholders(req NormalizeRequest) error {
 	if req.OutputNormalizedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputNormalizedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputNormalizedPath, []byte(`{"schema":"seriatim.intermediate.v1","segments":[]}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write normalized transcript %q: %w", req.OutputNormalizedPath, err)
 		}
 	}
@@ -343,22 +343,22 @@ func materializeNormalizePlaceholders(req NormalizeRequest) error {
 		if req.ReportPath != "" {
 			payload["report_path"] = req.ReportPath
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake normalize stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake normalize stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake normalize stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake normalize stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}
 	if req.ReportPath != "" {
-		if err := subprocess.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.ReportPath, []byte(`{"schema":"seriatim.report.v1","placeholder":true}`), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write report %q: %w", req.ReportPath, err)
 		}
 	}
@@ -367,7 +367,7 @@ func materializeNormalizePlaceholders(req NormalizeRequest) error {
 
 func materializeRenderPlaceholders(req RenderRequest) error {
 	if req.OutputRenderedPath != "" {
-		if err := subprocess.WriteFileAtomic(req.OutputRenderedPath, []byte("# Transcript\n\nRendered markdown placeholder.\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.OutputRenderedPath, []byte("# Transcript\n\nRendered markdown placeholder.\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write rendered transcript %q: %w", req.OutputRenderedPath, err)
 		}
 	}
@@ -384,17 +384,17 @@ func materializeRenderPlaceholders(req RenderRequest) error {
 			"include_segment_ids": req.IncludeSegmentIDs,
 			"include_metadata":    req.IncludeMetadata,
 		}
-		if err := subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644); err != nil {
+		if err := writeGeneratedYAML(req.GeneratedConfigPath, payload); err != nil {
 			return fmt.Errorf("write generated config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
 	if req.StdoutLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake render stdout placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StdoutLogPath, []byte("seriatim noop/fake render stdout placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stdout log %q: %w", req.StdoutLogPath, err)
 		}
 	}
 	if req.StderrLogPath != "" {
-		if err := subprocess.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake render stderr placeholder\n"), 0o644); err != nil {
+		if err := fileops.WriteFileAtomic(req.StderrLogPath, []byte("seriatim noop/fake render stderr placeholder\n"), fileops.WorkspaceFileMode); err != nil {
 			return fmt.Errorf("write stderr log %q: %w", req.StderrLogPath, err)
 		}
 	}

internal/adapters/seriatim/generated_config.go

@@ -0,0 +1,19 @@
+package seriatim
+
+import (
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
+	"gopkg.in/yaml.v3"
+)
+
+func writeGeneratedYAML(path string, payload any) error {
+	data, err := yaml.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshal generated YAML for %q: %w", path, err)
+	}
+	if err := fileops.WriteFileAtomic(path, data, fileops.WorkspaceFileMode); err != nil {
+		return fmt.Errorf("write generated YAML %q: %w", path, err)
+	}
+	return nil
+}

internal/adapters/seriatim/subprocess.go

@@ -4,15 +4,18 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
 	"strconv"
 	"strings"
 	"time"
 	"unicode/utf8"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
+	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
 
+// MaxOutputFileBytes bounds each Seriatim JSON or rendered-text result.
+const MaxOutputFileBytes int64 = 64 * 1024 * 1024
+
 // EnvConfig defines optional Seriatim environment tuning values.
 type EnvConfig struct {
 	OverlapWordRunGap           *float64
@@ -129,12 +132,13 @@ func (r *SubprocessRunner) Run(ctx context.Context, req MergeRequest) (MergeResu
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    r.binary,
-		Args:          args,
-		Timeout:       r.timeout,
-		EnvOverrides:  env,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      r.binary,
+		Args:            args,
+		Timeout:         r.timeout,
+		EnvOverrides:    env,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return MergeResult{
@@ -232,11 +236,12 @@ func (r *SubprocessRunner) Trim(ctx context.Context, req TrimRequest) (TrimResul
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return TrimResult{
@@ -320,11 +325,12 @@ func (r *SubprocessRunner) Normalize(ctx context.Context, req NormalizeRequest)
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return NormalizeResult{
@@ -425,11 +431,12 @@ func (r *SubprocessRunner) Render(ctx context.Context, req RenderRequest) (Rende
 	}
 
 	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:    binary,
-		Args:          args,
-		Timeout:       timeout,
-		StdoutLogPath: req.StdoutLogPath,
-		StderrLogPath: req.StderrLogPath,
+		Executable:      binary,
+		Args:            args,
+		Timeout:         timeout,
+		DiagnosticOwner: "seriatim",
+		StdoutLogPath:   req.StdoutLogPath,
+		StderrLogPath:   req.StderrLogPath,
 	})
 	if err != nil {
 		return RenderResult{
@@ -546,7 +553,7 @@ func (r *SubprocessRunner) writeMergeInvocationConfig(req MergeRequest, args []s
 		payload["coalesce_gap"] = *r.coalesceGap
 	}
 
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func buildTrimArgs(req TrimRequest) []string {
@@ -598,7 +605,7 @@ func writeTrimInvocationConfig(req TrimRequest, args []string, binary string, ti
 		"output_path":   req.OutputTrimmedPath,
 		"keep_selector": req.KeepSelector,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func writeNormalizeInvocationConfig(req NormalizeRequest, args []string, binary string, timeout time.Duration, outputSchema string) error {
@@ -613,7 +620,7 @@ func writeNormalizeInvocationConfig(req NormalizeRequest, args []string, binary
 		"output_schema": outputSchema,
 		"report_path":   req.ReportPath,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func writeRenderInvocationConfig(req RenderRequest, args []string, binary string, timeout time.Duration, format string) error {
@@ -631,13 +638,13 @@ func writeRenderInvocationConfig(req RenderRequest, args []string, binary string
 		"include_segment_ids": req.IncludeSegmentIDs,
 		"include_metadata":    req.IncludeMetadata,
 	}
-	return subprocess.WriteYAMLAtomic(req.GeneratedConfigPath, payload, 0o644)
+	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
 }
 
 func validateJSONFile(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "JSON output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 	var v any
 	if err := json.Unmarshal(data, &v); err != nil {
@@ -647,9 +654,9 @@ func validateJSONFile(path string) error {
 }
 
 func validateJSONFileWithSegments(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "transcript JSON output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 
 	var payload map[string]any
@@ -668,9 +675,9 @@ func validateJSONFileWithSegments(path string) error {
 }
 
 func validateNonEmptyTextFile(path string) error {
-	data, err := os.ReadFile(path)
+	data, err := readSeriatimResult(path, "rendered text output")
 	if err != nil {
-		return fmt.Errorf("read file: %w", err)
+		return err
 	}
 	if len(data) == 0 {
 		return fmt.Errorf("file is empty")
@@ -683,3 +690,11 @@ func validateNonEmptyTextFile(path string) error {
 	}
 	return nil
 }
+
+func readSeriatimResult(path, category string) ([]byte, error) {
+	data, err := fileops.ReadFileBounded(path, MaxOutputFileBytes)
+	if err != nil {
+		return nil, fmt.Errorf("seriatim %s exceeds or cannot be read within %d-byte limit: %w", category, MaxOutputFileBytes, err)
+	}
+	return data, nil
+}

internal/adapters/seriatim/subprocess_test.go

@@ -6,16 +6,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"runtime"
 	"strings"
 	"testing"
 	"time"
 )
 
 func TestSubprocessRunnerSuccessWithReportArgsAndEnv(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "success")
@@ -131,9 +127,6 @@ func TestSubprocessRunnerSuccessWithReportArgsAndEnv(t *testing.T) {
 }
 
 func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "fail")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -153,9 +146,6 @@ func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
 }
 
 func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "missing_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -172,9 +162,6 @@ func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "invalid_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -191,9 +178,6 @@ func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "invalid_report")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -210,9 +194,6 @@ func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerTrimSuccessInvocationAndProvenance(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "trim_success")
@@ -297,9 +278,6 @@ func TestSubprocessRunnerTrimSuccessInvocationAndProvenance(t *testing.T) {
 }
 
 func TestSubprocessRunnerTrimSubprocessFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "fail")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -319,9 +297,6 @@ func TestSubprocessRunnerTrimSubprocessFailure(t *testing.T) {
 }
 
 func TestSubprocessRunnerTrimMissingOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "missing_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -338,9 +313,6 @@ func TestSubprocessRunnerTrimMissingOutputFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerTrimInvalidOutputJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "invalid_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -357,9 +329,6 @@ func TestSubprocessRunnerTrimInvalidOutputJSONFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerTrimOutputMissingSegmentsFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "trim_missing_segments")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -376,9 +345,6 @@ func TestSubprocessRunnerTrimOutputMissingSegmentsFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeSuccessInvocationAndProvenance(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_success")
@@ -453,9 +419,6 @@ func TestSubprocessRunnerNormalizeSuccessInvocationAndProvenance(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeSubprocessFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "fail")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -475,9 +438,6 @@ func TestSubprocessRunnerNormalizeSubprocessFailure(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeMissingOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_missing_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -494,9 +454,6 @@ func TestSubprocessRunnerNormalizeMissingOutputFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeInvalidOutputJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_invalid_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -513,9 +470,6 @@ func TestSubprocessRunnerNormalizeInvalidOutputJSONFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeOutputMissingSegmentsFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_missing_segments")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -532,9 +486,6 @@ func TestSubprocessRunnerNormalizeOutputMissingSegmentsFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeReportMissingFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_report_missing")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -551,9 +502,6 @@ func TestSubprocessRunnerNormalizeReportMissingFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerNormalizeInvalidReportJSONFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "normalize_invalid_report")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -570,9 +518,6 @@ func TestSubprocessRunnerNormalizeInvalidReportJSONFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderSuccessInvocationAndProvenance(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "render_success")
@@ -639,9 +584,6 @@ func TestSubprocessRunnerRenderSuccessInvocationAndProvenance(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderWithoutTitleOmitsTitleArg(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "render_success")
 	recordPath := filepath.Join(t.TempDir(), "record.json")
@@ -663,9 +605,6 @@ func TestSubprocessRunnerRenderWithoutTitleOmitsTitleArg(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderSubprocessFailure(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "fail")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -682,9 +621,6 @@ func TestSubprocessRunnerRenderSubprocessFailure(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderMissingOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "missing_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
@@ -701,9 +637,6 @@ func TestSubprocessRunnerRenderMissingOutputFails(t *testing.T) {
 }
 
 func TestSubprocessRunnerRenderEmptyOutputFails(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("helper wrapper script uses /bin/sh")
-	}
 	t.Setenv("GO_WANT_SERIATIM_HELPER", "1")
 	t.Setenv("SERIATIM_HELPER_MODE", "render_empty_output")
 	t.Setenv("SERIATIM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))