Document Narratio v3.1.0 release

.gitignore

@@ -1,6 +1,5 @@
 # ---> Codex
 .codex
-AGENTS.md
 
 .DS_Store
 
@@ -52,4 +51,3 @@ pipeline.yml
 
 # Built Visual Studio Code Extensions
 *.vsix
-

.woodpecker/verify.yml

@@ -25,16 +25,9 @@ steps:
     commands:
       - go build ./...
 
-  documentation-and-examples:
-    image: golang:1.26
-    depends_on: tests
-    commands:
-      - go test ./internal/doccheck
-      - go test ./internal/config -run '^TestExamplesLoadAndValidate$'
-
   cross-build:
     image: golang:1.26
-    depends_on: [race-tests, static-analysis, build, documentation-and-examples]
+    depends_on: [race-tests, static-analysis, build]
     commands:
       - |
         set -eu

AGENTS.md

@@ -0,0 +1,30 @@
+Start with `docs/development.md` for orientation and use its policy reading guide
+to select the policies applicable to the task. Do not read the entire suite by
+default.
+
+Read and follow `docs/policy/agents.md` before recommending, planning, or
+implementing repository changes.
+
+<!-- codebase-memory-mcp:start -->
+# Codebase Knowledge Graph (codebase-memory-mcp)
+
+This project uses codebase-memory-mcp to maintain a knowledge graph of the codebase.
+ALWAYS prefer MCP graph tools over grep/glob/file-search for code discovery.
+
+## Priority Order
+1. `search_graph` — find functions, classes, routes, variables by pattern
+2. `trace_path` — trace who calls a function or what it calls
+3. `get_code_snippet` — read specific function/class source code
+4. `query_graph` — run Cypher queries for complex patterns
+5. `get_architecture` — high-level project summary
+
+## When to fall back to grep/glob
+- Searching for string literals, error messages, config values
+- Searching non-code files (Dockerfiles, shell scripts, configs)
+- When MCP tools return insufficient results
+
+## Examples
+- Find a handler: `search_graph(name_pattern=".*OrderHandler.*")`
+- Who calls it: `trace_path(function_name="OrderHandler", direction="inbound")`
+- Read source: `get_code_snippet(qualified_name="pkg/orders.OrderHandler")`
+<!-- codebase-memory-mcp:end -->

COPYRIGHT

@@ -0,0 +1,23 @@
+Narratio
+
+Copyright (C) 2026 Eric Rakestraw
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+Narratio is free software: you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+The GNU General Public License version 3 is provided in LICENSE.
+
+Narratio is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU General Public License for more details.
+
+Third-party code and assets are subject to their respective license terms.
+
+Policy documents adapted from Standard Repository Policies remain licensed
+under CC-BY-SA-4.0. See docs/oss/attribution.md for the affected material,
+upstream credit, and license links.

LICENSE

@@ -1,232 +1,674 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
-
-Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-Preamble
-
-The GNU General Public License is a free, copyleft license for software and other kinds of works.
-
-The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
-
-Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-TERMS AND CONDITIONS
-
-0. Definitions.
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on the Program.
-
-To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
-
-1. Source Code.
-The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
-A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-2. Basic Permissions.
-All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
-Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
-
-4. Conveying Verbatim Copies.
-You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
-
-5. Conveying Modified Source Versions.
-You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
-
-6. Conveying Non-Source Forms.
-You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
-A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
-
-7. Additional Terms.
-“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
-
-8. Termination.
-You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
-
-9. Acceptance Not Required for Having Copies.
-You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
-
-10. Automatic Licensing of Downstream Recipients.
-Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
-An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
-
-11. Patents.
-A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
-In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
-A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
-
-12. No Surrender of Others' Freedom.
-If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
-
-13. Use with the GNU Affero General Public License.
-Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
-
-14. Revised Versions of this License.
-The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
-
-15. Disclaimer of Warranty.
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. Limitation of Liability.
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-17. Interpretation of Sections 15 and 16.
-If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
-     narratio
-     Copyright (C) 2026  eric
-
-     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-
-     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
-If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
 
-     narratio  Copyright (C) 2026  eric
-     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
 
-The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
 
-You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
 
-The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -40,3 +40,7 @@ This requires resolvable `pipeline.yml`, `campaign.yml`, and concrete
   and maintenance rules.
 - [Testing policy](docs/policy/testing.md) — test value, boundaries, and
   sufficiency.
+
+Narratio is licensed under the [GPL v3.0 or later](COPYRIGHT).
+
+[Open Source attribution notices](docs/oss/attribution.md) are available.

docs/cli.md

@@ -44,7 +44,7 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
-- `--profile <name>`
+- `--overlay <name>`
 - `--secrets-dir <directory>`
 
 Rules:
@@ -54,9 +54,9 @@ Rules:
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
 - `--previous-session-id` is a strict expectation: the selected session file
   must contain the same `previous_session_id`.
-- `--profile` selects `profiles/<name>.yml` relative to the pipeline root. It
+- `--overlay` selects `overlays/<name>.yml` relative to the pipeline root. It
   may be supplied once; omitted, empty, and the exact name `default` select the
-  base configuration, while an unknown named profile fails. The same selection
+  base configuration, while an unknown named overlay fails. The same selection
   applies to all common-flag commands, including `regenerate-artifacts`.
 - `--secrets-dir` selects ConfigKit credential-file bootstrap explicitly. A
   relative value uses caller CWD. Without the flag, a present `secrets/`
@@ -85,19 +85,21 @@ Commands with additional positionals keep their command-specific order:
 ### `config validate`, `config show`, `config sources`, `config artifacts`, and `config diff`
 
 ```bash
-narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
 ```
 
-These commands resolve the selected profile, defaults, ordinary paths, and—if
+These commands resolve the selected overlay, defaults, ordinary paths, and—if
 a campaign is selected—the campaign-owned party. They neither discover or load
 a session nor create a workspace, manifest, run, lock, adapter, or remote
 connection. Like every pipeline-loading command, they bootstrap the selected or
 conventional secrets directory before resolving configuration; `config show`
 never includes bootstrap reports or secret values in its YAML output.
+Typed credential references, including `notarius.credentials[]`, must therefore
+resolve even though these inspection commands never construct an adapter.
 
 Campaign selection is optional for a pipeline without party-driven artifact
 families. A pipeline with `scriptorium.artifact_families` needs a selected or
@@ -105,7 +107,7 @@ configured default campaign so Narratio can expand its concrete artifacts and
 publish rules. `--campaign` and `--campaign-file` remain mutually exclusive.
 Session, range, force, and artifact-execution flags are not accepted.
 
-`config validate` writes a concise root-path, selected-profile (or `none`), and
+`config validate` writes a concise root-path, selected-overlay (or `none`), and
 effective-digest summary after successful complete validation. `config show`
 writes one deterministic, secret-free YAML document containing defaulted and
 expanded concrete configuration. It omits ConfigKit directives, artifact
@@ -113,9 +115,9 @@ family declarations, and runtime provenance.
 
 `config sources` reports the same fully validated resolution without printing
 effective values. Its header identifies the root, ordered imports, selected
-profile and overlay, selected campaign, party source, and digest. The
+overlay and its file, selected campaign, party source, and digest. The
 remaining tab-separated records are sorted as `path`, `role`, and `source`.
-Roles distinguish root, import, profile, centralized default, campaign, party,
+Roles distinguish root, import, overlay, centralized default, campaign, party,
 and generated family ownership. A generated party member has
 one family record and one party record at the same logical path. The output
 never reads or prints secret values.
@@ -131,14 +133,14 @@ party-driven families retain the campaign requirement. See
 [Scriptorium Artifact Entries](./config.md#scriptorium-artifact-entries) for the
 configuration layout.
 
-`config diff` resolves both supplied profile names independently and compares
+`config diff` resolves both supplied overlay names independently and compares
 their fully resolved, secret-free effective mappings. It does
-not accept `--profile`; the two positional names must be distinct, declared
-profiles. When party-driven families are present, both profiles must resolve to
-the same selected campaign and party. Use `--campaign-file` if profile-specific
+not accept `--overlay`; the two positional names must be distinct, valid
+overlays. When party-driven families are present, both overlays must resolve to
+the same selected campaign and party. Use `--campaign-file` if overlay-specific
 campaign configuration would otherwise select different files.
 
-Equal profiles print `no differences`. Otherwise, sorted tab-separated records
+Equal overlays print `no differences`. Otherwise, sorted tab-separated records
 use one of these forms, with compact JSON values:
 
 ```text
@@ -149,7 +151,7 @@ changed  <path>    <left-value>    <right-value>
 
 Mappings are flattened to their logical field paths; lists remain one atomic
 value. The command compares defaulted concrete artifacts and publish rules, not
-profile names, source-file layout, or formatting. It succeeds when differences
+overlay names, source-file layout, or formatting. It succeeds when differences
 are found, making it suitable for review and migration checks.
 
 ### `version`
@@ -175,6 +177,9 @@ Behavior:
 - rejects unknown endpoints and a `--from` endpoint after `--through`;
 - runs `render` before `extract`; an omitted or disabled Notarius
   configuration records an explicit `notarius_disabled` self-skip;
+- resolves every selected typed credential during the initial configuration
+  load, including Notarius credentials when extract is disabled, outside the
+  selected range, or later skipped as resumable;
 - skips already-succeeded stages unless `--force` is set or a stage-specific
   resume check finds its durable result obsolete;
 - applies `--force` only to stages in the selected range;
@@ -184,7 +189,7 @@ Behavior:
 - writes the session manifest as the sole durable progress ledger. Each
   invocation also creates its run-local directory and returns an immediate
   command summary; neither creates another durable progress record.
-- reports the resolved profile (or `none`) and effective configuration digest.
+- reports the resolved overlay (or `none`) and effective configuration digest.
 
 When `--artifacts` is present, the selected range must contain `analyze` or
 `publish`. Either consumer is sufficient, including a one-stage range.
@@ -207,6 +212,10 @@ artifacts and any prerequisites required by those targets; without
 never run. Common session/configuration options and repeatable artifact values
 pass through unchanged.
 
+The forced extraction rebuilds the complete configured Notarius bundle,
+disables Notarius checkpoint loading, and requests chunk-plan refresh.
+`--artifacts` narrows only the analysis work; it never selects Notarius lanes.
+
 Because the expansion owns `--force`, `--from`, and `--through`, callers cannot
 supply those options. The shared `run` parser reports them as duplicate
 singleton flags. The alias has no private execution options or behavior, and
@@ -249,6 +258,10 @@ Equivalent to:
 narratio run-stage analyze <session_id> --force [...common config flags]
 ```
 
+This selects only `analyze`: it does not invoke Notarius, replace extraction,
+or remove existing extract outputs. `--artifacts` narrows the forced analysis
+targets and their required analysis prerequisites.
+
 ### `publish`
 
 ```bash
@@ -291,7 +304,7 @@ Uses the same inclusive bounds, endpoint validation, force scope, and artifact
 selection contract as `run`. It validates config and prints run/skip decisions
 for selected stages only without creating the local workdir or changing the
 manifest. Resume-capable selected stages are checked against durable evidence.
-The output includes the resolved profile (or `none`) and effective configuration
+The output includes the resolved overlay (or `none`) and effective configuration
 digest without writing provenance or any manifest state.
 For `analyze`, the preview also lists explicit targets, prerequisite-only work,
 execution order, and reusable current artifacts with concise reasons. These

docs/config.md

@@ -47,24 +47,24 @@ the durable copied session input.
 `narratio config validate`, `narratio config show`, `narratio config sources`,
 and `narratio config artifacts` use the same `--config`, `--campaign`,
 `--campaign-file`, and
-`--profile` selection rules as pipeline commands, but do not select, discover,
+`--overlay` selection rules as pipeline commands, but do not select, discover,
 or load a session. They resolve configured typed credential references as part
 of the ordinary ConfigKit load but expose only their environment-variable names;
 they do not create runtime state.
-`narratio config diff <left-profile> <right-profile>` uses the same pipeline and
-campaign selectors, resolves each named profile with an independent ConfigKit
-load, and does not accept a separate `--profile` flag.
+`narratio config diff <left-overlay> <right-overlay>` uses the same pipeline and
+campaign selectors, resolves each named overlay with an independent ConfigKit
+load, and does not accept a separate `--overlay` flag.
 
 Campaign selection is optional only when the resolved pipeline has no
 `scriptorium.artifact_families`. When families are declared, Narratio selects a
 campaign through an explicit flag or `pipeline.campaigns.default_campaign_id`,
 then parses the campaign-owned party and expands concrete artifacts and any
 family publish rules before validation. `config validate` prints the resulting
-root, profile, and effective digest. `config show` emits the normalized
+root, overlay, and effective digest. `config show` emits the normalized
 effective pipeline YAML, with defaults and concrete expansion included but
 ConfigKit directives and family declarations omitted. This review projection is
 not promised to be a reloadable authoring document. `config sources` prints a stable
-source projection instead of effective values: root/import/profile/default
+source projection instead of effective values: root/import/overlay/default
 ownership plus campaign/party and generated-family records. Canonical derived
 players trace to the party. `config artifacts` lists the concrete artifact map,
 effective dependencies, and defining sources. The [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
@@ -83,7 +83,7 @@ difference.
 Use the [production/testing bundle](../examples/production-testing/pipeline.yml)
 as the complete copyable migration reference. Keep production settings in the
 base, split them into explicit additive imports, and place testing differences
-in the fixed `profiles/testing.yml` overlay. Put ordinary artifacts and families
+in the fixed `overlays/testing.yml` overlay. Put ordinary artifacts and families
 in the recommended one-definition files shown by that bundle. Convert campaign
 rosters to [canonical party input](integrations/party.md), then express character
 work as families. Inspect the result with `config validate`, `config show`,
@@ -108,11 +108,14 @@ remote state with an unsafe legacy identity must be migrated before use.
   root-only `configkit.imports` list. Imported files contribute fields to one
   logical pipeline document; they do not override fields supplied by the root
   or another import.
-- An omitted profile, an empty profile option, and the exact name `default`
+- An omitted overlay, an empty overlay option, and the exact name `default`
   select the base configuration. Any other name selects
-  `profiles/<name>.yml` relative to the pipeline root.
+  `overlays/<name>.yml` relative to the pipeline root. Move previously selected
+  `profiles/<name>.yml` files there; the old directory is not searched, and
+  `--profile` is no longer accepted for Narratio pipeline selection. Explicit
+  imports from a directory named `profiles` remain valid.
 - Campaign, session, and canonical-party documents are strict single-source
-  ConfigKit schemas. They do not enable imports, profiles, or `configkit`
+  ConfigKit schemas. They do not enable imports, overlays, or `configkit`
   directives.
 - Configured timeout and retry-delay durations must be positive. An omitted
   artifact timeout continues to inherit its configured Scriptorium timeout.
@@ -137,10 +140,10 @@ remote state with an unsafe legacy identity must be migrated before use.
   - local (`audio_dir` or `audio_files`), or
   - S3 (`audio_s3.prefix`).
 
-### Pipeline imports and profiles
+### Pipeline imports and overlays
 
 Large pipeline configurations may be split into explicitly named fragments and
-may use fixed-path profile overlays:
+may use fixed-path selected overlays:
 
 ```yaml
 configkit:
@@ -170,12 +173,12 @@ name the full field path and every source that claimed it. Narratio additionally
 rejects an artifact or artifact-family key declared by more than one base file,
 even when those files contribute disjoint children.
 
-Profile names are case-sensitive and use ConfigKit's safe fixed-path naming
+Overlay names are case-sensitive and use ConfigKit's safe fixed-path naming
 rules. Only the selected overlay is opened; a malformed unselected overlay does
-not affect a base or different-profile load. Maps merge recursively, overlay
+not affect a base or different-overlay load. Maps merge recursively, overlay
 scalars replace base scalars, and overlay lists replace base lists completely.
 Explicit `false`, zero, empty strings, empty containers, and null values remain
-explicit inputs and are not refilled by defaults. Profiles cannot inherit,
+explicit inputs and are not refilled by defaults. Overlays cannot inherit,
 stack, import files, or declare another ConfigKit control section.
 
 During ConfigKit loading, Narratio applies fresh typed defaults, recorded
@@ -183,7 +186,7 @@ entry-level defaults and normalization, read-only file-local validation, and
 ordinary path resolution before computing a deterministic effective
 configuration digest. The digest represents the normalized, secret-free
 runtime pipeline mapping; it excludes ConfigKit directives, source
-provenance, profile identity, and raw environment secret values. Equivalent
+provenance, overlay identity, and raw environment secret values. Equivalent
 effective mappings therefore have the same digest regardless of how fields are
 split among the root and imports.
 
@@ -227,8 +230,12 @@ inputs:
 - Do not place raw secrets in YAML.
 - Credential fields contain environment-variable names, represented internally
   as ConfigKit typed secret references (for example
-  `pipeline.audita.llm_api_key: AUDITA_LLM_API_KEY`). A configured reference
+  `pipeline.notarius.credentials: [NOTARIUS_LLM_API_KEY]`). A configured reference
   must resolve to a nonempty environment value during load.
+- Every surviving reference is resolved during ordinary pipeline loading,
+  regardless of whether its integration is disabled, outside the selected
+  stage range, or eligible for resume. Omit the field or set it to `null` when
+  that deployment should not require the credential.
 - Every command that loads a pipeline accepts `--secrets-dir <path>`. When the
   flag is omitted, Narratio uses a present `secrets/` directory beside the
   resolved root `pipeline.yml`; an absent conventional directory is ignored.
@@ -236,8 +243,10 @@ inputs:
   and a missing or empty explicit selection is an error.
 - Each immediate regular file whose name is a valid environment-variable name
   supplies one value. ConfigKit removes trailing CR/LF, permits a symlink as the
-  selected directory, rejects symlink entries, and limits input to 1 MiB per
-  file, 8 MiB total, and 1024 entries.
+  selected directory, rejects non-hidden symlink entries, and limits input to
+  1 MiB per file, 8 MiB total, and 1024 entries. Dot-prefixed entries (including
+  files, directories, and symlinks) are ignored and omitted from bootstrap
+  reports, but still count toward the directory entry limit.
 - An existing process environment value takes precedence over a credential file.
 - On POSIX, operators must provision the directory with no group/other access
   (normally `0700`) and files with no group/other access (normally `0600`);
@@ -325,19 +334,14 @@ Rules:
 | `pipeline.seriatim.env.filler_max_duration` | float | No | unset |
 | `pipeline.audita.binary` | string | No | `audita` |
 | `pipeline.audita.timeout` | duration | No | `3h` |
-| `pipeline.audita.llm_api_key` | secret reference | No | unset |
-| `pipeline.audita.modules[]` | list[string] | No | empty |
-| `pipeline.audita.base_url` | string | No | empty |
-| `pipeline.audita.model` | string | No | empty |
-| `pipeline.audita.total_llm_concurrency` | int | No | unset |
-| `pipeline.audita.proposal_llm_concurrency` | int | No | unset |
-| `pipeline.audita.validation_model` | string | No | empty |
-| `pipeline.audita.validation_llm_concurrency` | int | No | unset |
+| `pipeline.audita.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Audita |
+| `pipeline.audita.modules[]` | list[string] | No | unset; omit to use Audita defaults, set `[]` for no modules |
+| `pipeline.audita.overlay` | string | No | empty; no downstream overlay override |
+| `pipeline.audita.proposal_profile` | string | No | empty; no downstream proposal-profile override |
+| `pipeline.audita.validation_profile` | string | No | empty; no downstream validation-profile override |
 | `pipeline.audita.transcript_description` | string | No | empty |
 | `pipeline.audita.config_path` | string | No | empty |
 | `pipeline.audita.output_schema` | string | No | empty |
-| `pipeline.audita.work_dir_retention` | string | No | empty |
-| `pipeline.audita.report` | bool | No | `true` |
 | `pipeline.normalize.output_path` | string | No | `transcripts/final.json` |
 | `pipeline.normalize.output_schema` | string | No | `seriatim-intermediate` |
 | `pipeline.normalize.report` | bool | No | `true` |
@@ -353,10 +357,14 @@ Rules:
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.notarius.enabled` | bool | No | `false` |
 | `pipeline.notarius.binary` | string | No | `notarius` |
+| `pipeline.notarius.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Notarius |
+| `pipeline.notarius.config_overlay` | string | No | unset; exact Notarius ConfigKit overlay selector |
 | `pipeline.notarius.config_path` | string | Conditional | required when enabled; relative paths resolve from the pipeline file directory |
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
 | `pipeline.notarius.timeout` | duration | No | `3h`; must be positive |
 | `pipeline.notarius.working_directory` | string | No | directory containing resolved `config_path`; relative paths resolve from the pipeline file directory |
+| `pipeline.notarius.resume` | bool | No | `false`; request compatible Notarius checkpoint reuse during ordinary executed extraction |
+| `pipeline.notarius.chunk_cache` | string | No | empty; when set, exactly `auto`, `bypass`, or `refresh` |
 | `pipeline.notarius.references` | map[string]string | No | empty; maps normalized Notarius selectors to supported prepared Narratio source IDs; maximum 256 entries |
 | `pipeline.notarius.outputs` | map | Conditional | at least one entry when enabled |
 | `pipeline.render.enabled` | bool | No | `true` |
@@ -366,6 +374,7 @@ Rules:
 | `pipeline.render.include_segment_ids` | bool | No | `true` |
 | `pipeline.render.include_metadata` | bool | No | `false` |
 | `pipeline.scriptorium.binary` | string | No | `scriptorium` |
+| `pipeline.scriptorium.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Scriptorium |
 | `pipeline.scriptorium.config_path` | string | No | empty |
 | `pipeline.scriptorium.timeout` | duration | No | `10m` |
 | `pipeline.scriptorium.render_debug` | bool | No | `false` |
@@ -373,6 +382,111 @@ Rules:
 | `pipeline.scriptorium.artifact_families` | map | No | empty; expands one ordinary artifact per canonical party character |
 | `pipeline.notification.mode` | string | No | `noop`; the only supported notification mode until a provider is implemented |
 
+### Audita Selection and Credentials
+
+`pipeline.audita.config_path` optionally passes an Audita v2 configuration file;
+when empty, Audita uses its own native config discovery. `overlay`,
+`proposal_profile`, and `validation_profile` are independent, optional Audita
+selectors. Empty or omitted strings add no command-line override. Narratio's
+selected pipeline overlay is never inferred as an Audita overlay, and Narratio
+does not create or validate Audita's backend or PromptKit profile files. Prepare
+them with [Audita's v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+
+Omit `modules` or set it to `null` to use Audita's configured default sequence.
+Set `modules: []` to run no correction modules. A nonempty list is passed in
+order, including repetitions. Narratio does not add a reporting or debug flag;
+Audita's external configuration controls those settings.
+
+`pipeline.audita.credentials` lists secret-reference names, not values. Narratio
+resolves every listed name during pipeline loading and forwards the captured
+nonempty value under that exact name to Audita. It does not inspect Audita's
+configuration to discover names or map them to aliases. Audita v2 resolves
+credentials for **all configured backends**, even ones not selected by the
+current profiles: list every named backend credential in the selected Audita
+configuration. An unauthenticated backend needs no reference. Omission, `null`,
+or `[]` forwards nothing. A Narratio overlay replaces the entire list, and
+`[]` clears it. See the [Audita integration contract](./integrations/audita.md)
+for the subprocess and redaction boundary.
+
+<a id="notarius-configuration-profile"></a>
+
+### Notarius Configuration Overlay
+
+Migration: rename `pipeline.notarius.config_profile` to `config_overlay`.
+The old field is rejected; there is no compatibility alias. For Notarius v0.8+
+move selected downstream files from `profiles/` to `overlays/` beside its root
+configuration. This does not rename PromptKit LLM profiles.
+The renamed selector also changes extraction resume evidence for named
+selections: their existing extraction is regenerated on the next applicable
+run, with normal dependent invalidation. Omitted/base selections do not acquire
+a new invalidation solely from this rename.
+
+`pipeline.notarius.config_overlay` optionally selects a Notarius ConfigKit
+configuration overlay when extraction executes:
+
+```yaml
+notarius:
+  config_overlay: downstream-economy
+```
+
+When the field is omitted or `null`, Narratio supplies no downstream overlay
+selector and preserves Notarius's existing configuration-selection behavior.
+When present, Narratio forwards the exact string to Notarius, including an
+empty string or `default`, which explicitly select Notarius's composed base
+configuration. Notarius owns selector interpretation and validation; Narratio
+does not restrict overlay names, resolve overlay files, or rewrite the value.
+
+This selection is independent of Narratio's own `--overlay` selection. A
+Narratio overlay may explicitly select a differently named Notarius overlay,
+but Narratio never forwards its own overlay name automatically. It is also
+independent of `pipeline.notarius.credentials`: an overlay may change either or
+both fields according to the deployed Notarius configuration. See the
+[Notarius integration contract](./integrations/notarius.md) for invocation and
+failure behavior.
+
+### Notarius Credentials
+
+`pipeline.notarius.credentials` optionally lists environment-variable names
+to forward to the Notarius child process:
+
+```yaml
+notarius:
+  credentials: [OPENROUTER_API_KEY, ANTHROPIC_API_KEY]
+```
+
+The list contains variable names, not credential values. Those names must
+match the references used by the Notarius/PromptKit profiles that Notarius
+loads. Notarius owns profile lookup; Narratio neither infers those names nor
+remaps them. Omission, `null`, or `[]` forwards nothing. Each selected reference
+must resolve at pipeline load time through the process environment or existing
+secrets-directory bootstrap, even when Notarius is disabled, extract is outside
+the requested range, or a completed extraction can be reused.
+
+The Notarius child receives only Narratio's minimal execution environment plus
+these exact selected names and loaded values. Other credentials are not forwarded.
+Changing a value, name, presence, or absence does not invalidate extract's
+semantic resume evidence. The public names remain part of safe effective
+inspection, so renaming them may appear in `config diff` and change the effective
+configuration digest; rotating only their values does neither. An overlay
+replaces the whole list, including with `[]` to clear it.
+
+See the [Notarius integration contract](./integrations/notarius.md) for the
+delivery and redaction boundary.
+
+### Notarius Cache Controls
+
+`pipeline.notarius.resume` defaults to `false`. When true, an executed ordinary
+extraction passes `--resume`; the deployed Notarius configuration must already
+enable checkpoint recording and should select an explicit persistent checkpoint
+root. Narratio does not inspect or generate that configuration.
+
+`pipeline.notarius.chunk_cache` is empty by default, leaving Notarius's
+configured mode in control. A nonempty value must be `auto`, `bypass`, or
+`refresh` and is passed as `--chunk_cache`. Forced extraction takes precedence
+over both fields: it omits `--resume` and passes `--chunk_cache refresh`.
+Neither field changes Narratio's semantic extraction fingerprint, so changing
+them alone does not rerun an otherwise complete durable extraction.
+
 ### Notarius Reference Bindings
 
 `pipeline.notarius.references` maps a Notarius CLI selector to a prepared
@@ -402,8 +516,8 @@ It validates only selector structure and the prepared source vocabulary;
 Notarius owns target-slot declarations and media compatibility.
 
 Before extraction, Narratio resolves every binding from the current prepared
-session manifest and streams it into a verified invocation-local snapshot whose
-absolute path is passed to Notarius. Missing, unsafe, empty,
+session manifest and streams it into a verified, content-addressed session
+snapshot whose absolute path is passed to Notarius. Missing, unsafe, empty,
 changed-during-copy, or checksum-inconsistent prepared evidence fails with
 guidance to force `prepare`. Bindings are sorted by normalized selector and are
 part of extraction fingerprint and resume identity. See the
@@ -431,6 +545,25 @@ contract-incompatible lane fails extraction. See the
 current ten-lane D&D mapping and the [Notarius contract](./integrations/notarius.md)
 for compatibility ownership.
 
+### Scriptorium Credentials
+
+Set `scriptorium.credentials: [OPENROUTER_API_KEY]` in the pipeline file to
+forward that provider key to Scriptorium. List additional provider names only
+when the selected downstream configuration needs them. The same list applies
+to trim bounds generation, analysis (including character families), and their
+render-debug calls. Scriptorium retains provider/profile selection; Narratio
+does not pass a model-request `--api-key-env` override.
+
+As with Audita and Notarius, names are ConfigKit secret references resolved at
+pipeline load time using the existing environment/secrets bootstrap precedence,
+even when no Scriptorium stage executes. Omitted, null, or empty lists forward
+nothing. An overlay replaces the entire list; `[]` clears it. Captured values
+are forwarded under their exact names and registered for diagnostic redaction.
+Inspection and generated metadata contain names only. Credential changes do
+not invalidate completed trim or analysis work; rotating values also leaves
+the effective configuration digest unchanged. Other environment variables
+retain the shared minimal subprocess inheritance rules.
+
 ### Scriptorium Artifact Entries
 
 For each `pipeline.scriptorium.artifacts.<name>`:

docs/development.md

@@ -10,11 +10,37 @@ polished transcripts and generated artifacts. Start with the
 [Architecture](policy/architecture.md) for normative system boundaries, and the
 [Internal Overview](internal/overview.md) for implemented component ownership.
 
+Agents must read [Agent Policy](policy/agents.md) before recommending, planning,
+or implementing changes. It owns implementation discipline and the default
+commit-after-completed-work rule; it does not authorize pushing or releasing.
+
 ## Go Prerequisite
 
 Maintained development and verification require Go 1.26. Use the official Go
 1.26 toolchain before running repository commands.
 
+## Policy Reading Guide
+
+| Policy | Read before… |
+| --- | --- |
+| [Policy set provenance](policy/meta.md) | Adopting policies, checking upstream revisions, or updating the adopted policy set. |
+| [Agents](policy/agents.md) | Recommending, planning, or implementing repository changes. |
+| [Architecture](policy/architecture.md) | Planning or changing application code or its structure. |
+| [Testing](policy/testing.md) | Selecting validation for code changes, or adding, changing, removing, or evaluating tests. |
+| [Documentation](policy/documentation.md) | Writing, revising, or reorganizing documentation. |
+| [OSS](policy/oss.md) | Adding or updating dependencies or incorporated third-party material, or changing licensing or attribution. |
+| [Release](policy/release.md) | Preparing or publishing a release, changing release procedures, or making versioning and compatibility decisions. |
+
+- Read applicable policies before making decisions they govern; multiple policies
+  may apply.
+- Select policies using the task triggers above. Follow cross-references to
+  relevant sections when needed to resolve a concrete question.
+- Reuse policies already available in context; reread when changed or no longer
+  available.
+- Expand reading when the task's scope expands.
+- When revising a policy itself, read that policy and any provisions elsewhere
+  affected by the revision.
+
 ## What To Read
 
 | When working on | Read | Why |
@@ -30,7 +56,7 @@ Maintained development and verification require Go 1.26. Use the official Go
 | Adapters or external tool contracts | [Adapter Internals](internal/adapters.md) and [Integration Contracts](integrations/README.md) | The internal guide owns adapter composition and mechanics; integration documents own external formats and protocols. |
 | Manifests, artifacts, workspace paths, or publish behavior | [Manifest Internals](internal/manifest.md), [Artifact Internals](internal/artifacts.md), [Workspace Internals](internal/workspace.md), [Publish Internals](internal/stage-publish.md), and [Operations](operations.md) | These separate implementation state and resolution from operator-visible layout and lifecycle. |
 | Maintained configuration or input examples | [Configuration](config.md) and [Examples](../examples/README.md) | The reference owns field meanings; the examples directory owns complete copyable files. |
-| Preparing, validating, or publishing a release | [Release Procedure](release.md) | The maintainer procedure owns version selection, candidate validation, guarded tag publication, and optional later CI inspection. |
+| Preparing, validating, or publishing a release | [Release Policy](policy/release.md) and [Release Procedure](release.md) | Policy owns requirements; the procedure owns concrete validation, guarded publication, and optional later inspection. |
 | Proposed or unimplemented behavior | `docs/roadmap/` | Future work belongs only in roadmap documentation until implemented. |
 
 For an existing subsystem, also inspect its focused tests and package-level
@@ -38,23 +64,25 @@ contracts before changing behavior.
 
 ## Validation
 
-Use focused package tests while iterating. Every pull request and push runs the
-following repository-wide checks before it can be accepted:
+Use focused package tests while iterating. Push and pull-request CI runs these
+repository-wide checks and cross-builds the declared targets:
 
 ```sh
 go test ./...
 go test -race ./...
 go vet ./...
 go build ./...
-go test ./internal/doccheck
-go test ./internal/config -run '^TestExamplesLoadAndValidate$'
 ```
 
-The documentation check verifies local Markdown links and the dependency graph
-of the Woodpecker workflows. The configuration check loads every maintained
-pipeline and session example. Tag CI reuses this validation path before its
-asynchronous asset publication; the maintainer release boundary is documented
-in the [Release Procedure](release.md).
+The full suite includes documentation-link and Woodpecker dependency checks
+and loads maintained pipeline and session examples. For focused diagnosis,
+run `go test ./internal/doccheck` or
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'` directly;
+these are available developer tools, not additional CI steps. Tag CI
+independently revalidates the tagged source before asynchronous asset delivery;
+it is not a second synchronous release prerequisite. The normal maintainer
+entry point is the single publication command in the
+[Release Procedure](release.md).
 
 Woodpecker also runs `go test -race -shuffle=on -count=3 ./...` on its scheduled
 job to expose ordering and repeatability defects. Current runners cross-compile

docs/integrations/audita.md

@@ -1,69 +1,54 @@
 # Integration: Audita
 
-## Purpose
-Define the Audita adapter contract used by the `polish` stage.
+Narratio invokes Audita v2's `process INPUT --glossary PATH --output PATH`
+subprocess for `polish`. The configured timeout and parent cancellation bound
+execution. Narratio passes explicit `--config`, `--overlay`,
+`--proposal-profile`, `--validation-profile`, `--transcript-description`,
+`--output-schema`, and `--modules` only when selected. An omitted module list
+leaves Audita's default sequence in place; `modules: []` passes an explicit
+empty argument and runs no correction modules. Order and repetitions are kept.
+Narratio passes no debug, work-directory, or reporting flags, leaving those
+choices to Audita's own configuration.
 
-## External Boundary
+Audita owns its ConfigKit file, backend and profile definitions, native config
+discovery, and their validation. Narratio does not create an Audita
+configuration or infer downstream overlay/profile names from its own selected
+pipeline overlay. An empty Narratio Audita selector adds no CLI override.
+The [configuration reference](../config.md#audita-selection-and-credentials)
+owns Narratio's fields and defaults. Audita's
+[v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+owns its downstream file format.
 
-Narratio invokes `audita process` as a subprocess for each polish operation.
-The configured timeout and parent cancellation bound the invocation. Internal
-runner composition is documented in
-[the adapter implementation guide](../internal/adapters.md).
+Each name in `pipeline.audita.credentials` is a ConfigKit secret reference
+resolved when Narratio loads the pipeline. Narratio forwards only the selected
+names and their captured, nonempty values under those exact names, in the
+minimal child environment; it never maps them to a fixed alias or rereads the
+parent environment. Every name is registered for captured stdout/stderr and
+failure-diagnostic redaction. Audita resolves credentials for all configured
+backends, including unselected ones, so operators must list every backend
+credential that its selected configuration needs. The downstream files and
+provider output remain Audita's responsibility, outside Narratio's
+captured-stream redaction boundary.
 
-## Request Contract
-`PolishRequest` carries:
-- required transcript/glossary/output/work-dir paths;
-- optional report path (required when report mode is enabled);
-- generated config and stdout/stderr log paths;
-- optional per-invocation module override.
+The corrected transcript is the only canonical polish output. A successful
+invocation must produce a valid JSON transcript with a top-level `segments`
+array within Narratio's 64 MiB bound. Exit zero is accepted even if Audita's
+ordinary reports describe recoverable model errors or no corrections. Narratio
+does not parse report status, counts, or Markdown. It discovers only
+`errors.yml`, `recoveries.yml`, and `report.md` next to the requested output,
+each subject to a 16 MiB read bound. Missing reports are allowed, for example
+when Audita reporting is disabled externally. Available reports are diagnostic
+references, not canonical artifact outputs. See Audita's
+[ordinary output contract](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/integrations/output-files.md)
+for their schemas, and [operations](../operations.md) for placement and
+publication.
 
-The constructed runner owns static Audita settings: binary, timeout,
-credentials, default modules, model and endpoint settings, validation and output
-settings, report mode, and concurrency. The `polish` stage supplies only
-invocation-specific paths and may override modules for that invocation.
+On nonzero exit, Narratio preserves the original subprocess error and
+available run-local evidence; it never promotes a transcript merely because
+the file exists. The adapter returns safe paths, exit details, and selection
+metadata on failure. Narratio's `audita.generated.v2` YAML records the
+invocation, including arguments, paths, and credential names but never values;
+it is a diagnostic record, not a generated Audita config file.
 
-## Result Contract
-`PolishResult` returns:
-- processed transcript path;
-- optional report path;
-- work dir and generated-config/log paths;
-- exit code, duration, binary provenance;
-- adapter metadata map.
-
-## Validation and Failure Semantics
-Construction fails for invalid static config values, including:
-- empty binary;
-- non-positive timeout;
-- invalid base URL;
-- invalid output schema;
-- invalid work-dir retention value;
-- invalid concurrency values.
-
-Run fails for:
-- missing required request paths;
-- subprocess execution failure;
-- invalid processed transcript JSON (`segments` array required);
-- invalid report JSON when reporting is enabled.
-
-Processed transcript JSON is limited to 64 MiB and optional report JSON to 16
-MiB. Both must be regular files without symlinked path components.
-
-Failure results still include output/log/config/exit metadata for diagnostics.
-
-## Deterministic Behavior
-- CLI args are built from runner config + request in a fixed order.
-- A configured typed `llm_api_key` reference is resolved during pipeline load;
-  the captured value is supplied only as the child's `AUDITA_LLM_API_KEY`
-  override and is never re-read from the parent environment.
-- Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
-- Manifest writes are stage-owned; adapter itself is stateless.
-
-## Configuration
-
-Operator-selected values are defined under `pipeline.audita.*` in the
-[configuration reference](../config.md#pipeline).
-
-Maintained example with Audita config:
-
-- [Full annotated pipeline](../../examples/pipeline.full.annotated.yml)
-- [Production-shaped pipeline](../../examples/pipeline.production.yml)
+Maintained Narratio examples: [full annotated pipeline](../../examples/pipeline.full.annotated.yml)
+and [production-shaped pipeline](../../examples/pipeline.production.yml).

docs/integrations/notarius.md

@@ -7,14 +7,14 @@ lanes from the final trimmed Seriatim transcript. Narratio owns invocation,
 safe bundle discovery, lane selection, and its own artifact metadata. Notarius
 owns pipeline definitions, lane schemas, the receipt, and bundle formats.
 
-Canonical Notarius v0.6.0 references:
+Canonical Notarius v0.8.1 references:
 
-- [CLI reference](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/cli.md)
-- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/consumers/subprocess.md)
-- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/consumers/dnd-pipeline.md)
-- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/run-result.md)
-- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/json-output.md)
-- [D&D spell-catalog overlay](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.6.0/docs/integrations/dnd-spell-catalog-overlays.md)
+- [CLI reference](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/cli.md)
+- [Subprocess consumer contract](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/consumers/subprocess.md)
+- [D&D pipeline and lane contracts](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/consumers/dnd-pipeline.md)
+- [Run-result receipt](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/integrations/run-result.md)
+- [JSON output bundle](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/integrations/json-output.md)
+- [D&D spell-catalog overlay](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/integrations/dnd-spell-catalog-overlays.md)
 
 The [complete Narratio example](../../examples/pipeline.full.annotated.yml)
 records the exact current constraints for all ten D&D lanes. Treat the linked
@@ -25,19 +25,38 @@ duplicate the complete schemas.
 
 When `pipeline.notarius.enabled` is true, Narratio resolves the executable,
 configuration path, input path, output directory, and working directory to
-absolute paths. Narratio requires the Notarius v0.6.0 CLI contract when
-references are configured and invokes each binding as a separate argument
-before `--json`:
+absolute paths. Configured references require support for the `--reference`
+contract introduced in Notarius v0.6.0. Cache controls require support for the
+selected `--resume` and `--chunk_cache` flags. Notarius v0.8.1 is the tested
+cache integration baseline, not an unconditional minimum version; Narratio
+does not impose a runtime version gate. Each reference binding is a separate
+argument before `--json`. When `pipeline.notarius.config_overlay` is present,
+its exact value is another argument pair before `--json`:
 
 ```text
-notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--reference <selector>=<verified_snapshot_path>]... --json
+notarius run <pipeline_id> --config <config_path> --input <trimmed_json> --output-dir <staging_dir> [--resume] [--chunk_cache <mode>] [--reference <selector>=<verified_snapshot_path>]... [--config-overlay <name>] --json
 ```
 
-Reference paths are absolute invocation-local snapshots streamed from the
-manifest-verified canonical files prepared inside the current Narratio session
-workspace. Narratio verifies snapshot checksum and size before and after the
-subprocess, and passes only configured bindings, ordered lexically by normalized
-selector, as direct argument-vector entries without shell interpretation. A CLI
+Notarius v0.8.1 is a known supporting version for `--config-overlay`; using the
+option requires a compatible Notarius executable, but deployments that omit the
+field acquire no additional version requirement. Omitted or null configuration
+adds no flag. Supplied empty, `default`, and named selectors are forwarded
+without normalization so Notarius can apply its own ConfigKit semantics. This
+option selects a Notarius configuration overlay, not a PromptKit profile through
+`--llm-profile`, and Narratio never substitutes its own selected overlay name.
+A missing or invalid downstream overlay is an ordinary Notarius subprocess
+failure: Narratio does not retry without the selector or fall back to another
+overlay.
+
+Reference paths are absolute stable snapshots streamed from manifest-verified
+canonical files prepared inside the current Narratio session workspace. They
+live at `cache/notarius/references/<sha256>/<prepared-basename>` and retain the
+full lowercase content digest. Narratio verifies snapshot checksum and size
+before and after the subprocess, reconstructs missing or corrupt regular files
+from a still-valid prepared source, and passes only configured bindings,
+ordered lexically by normalized selector, as direct argument-vector entries
+without shell interpretation. Symlinks, directories, other non-regular
+conflicts, and prepared-source mismatches fail rather than being deleted. A CLI
 binding takes precedence over a matching external path in Notarius
 configuration. Narratio never emits `--without-reference`.
 
@@ -75,9 +94,42 @@ It does not pass a Narratio session ID or run `notarius config validate`
 automatically; the configured working directory and Narratio's minimal child
 environment apply to the subprocess.
 
+Ordinary extraction maps `pipeline.notarius.resume: true` to `--resume` and a
+nonempty `pipeline.notarius.chunk_cache` to `--chunk_cache <mode>`. Forced
+extraction always omits `--resume` and supplies `--chunk_cache refresh`.
+Notarius owns checkpoint enablement, recording, identity, and both cache roots;
+Narratio neither reads nor synthesizes its configuration. Use explicit
+persistent roots in Notarius when reuse must span subprocess invocations.
+Changing a reference path/digest or other upstream identity input correctly
+causes a cold miss. Chunk refresh bypasses lookup and publishes the accepted
+replacement for the active source; it does not delete unrelated plans or
+checkpoint state.
+
+When `pipeline.notarius.credentials` is absent, null, or empty, Narratio adds no
+credentials to that environment. When configured, each list entry names an
+environment variable whose already-loaded nonempty value is forwarded under
+that exact name. Operators must use the names referenced by the selected
+Notarius/PromptKit providers. Narratio does not inspect the Notarius configuration
+to infer providers or destination names, and it does not forward unrelated
+credentials from its parent environment or secrets directory. A Narratio
+overlay replaces the whole credential list; `[]` clears it.
+
+Every selected name is registered with Narratio's shared streaming redactor.
+Credential bytes written by the child to captured stdout, captured stderr, or
+stderr-derived failure diagnostics are replaced with `<redacted>`, including
+custom names not known to the built-in sensitive-name list. Narratio does not
+serialize the credential into arguments, stage metadata, manifests, or
+generated configuration.
+
+This captured-stream protection is not a filesystem sandbox. Notarius remains
+responsible for keeping credentials out of files it writes directly, including
+bundle artifacts and its own diagnostics. Narratio does not scan or rewrite
+arbitrary downstream files and cannot promise redaction of transformed or
+encoded credentials.
+
 ## Accepted Result
 
-Narratio's supported invocation baseline is Notarius v0.6.0. The accepted
+Narratio's tested invocation baseline is Notarius v0.8.1. The accepted
 receipt remains `notarius.run-result.v2`; reference flags do not change the
 receipt or ten-lane output contract. The receipt
 must identify the configured pipeline, and its `index_file` must be exactly
@@ -102,6 +154,8 @@ version, and, when configured, module key. Missing, duplicate, rejected, or
 incompatible required lanes fail extraction even if Notarius exited zero. A
 configured lane whose v2 validation summary is `rejected` or `incomplete` also
 fails extraction.
+An accepted reused producer may report `producer_attempt_count: 0`; Narratio
+preserves that valid summary rather than treating it as a missing field.
 Unconfigured lanes may remain in the preserved bundle but do not become
 selectable Narratio sources.
 
@@ -130,3 +184,18 @@ Configuration fields and defaults are in [Configuration](../config.md).
 Operator paths, rerun procedures, and bundle retention are in
 [Operations](../operations.md). See [Troubleshooting](../troubleshooting.md)
 for failure recovery.
+
+## Opt-in Integration Test
+
+The production-boundary cache test requires an absolute path to a locally
+built Notarius v0.8.1-compatible executable. It uses only a local
+OpenAI-compatible `httptest` provider and temporary cache/config/output roots:
+
+```sh
+NARRATIO_TEST_NOTARIUS_BINARY=/absolute/path/to/notarius \
+  GOWORK=off go test ./internal/stage \
+  -run '^TestNotariusCacheReuseIntegration$' -count=1 -v
+```
+
+When the variable is unset, the normal test suite skips this test and never
+searches `PATH`, a sibling checkout, the network, or a real provider.

docs/integrations/scriptorium.md

@@ -21,7 +21,7 @@ Both request types carry:
 - output path;
 - timeout;
 - generated config + stdout/stderr log paths;
-- optional API-key env var name;
+- optional list of already-resolved credential references;
 - optional working directory.
 
 ## Result Contract
@@ -39,7 +39,16 @@ Request validation fails for:
 - non-positive timeout;
 - empty input/var names;
 - empty input path values;
-- missing required credential env var when `APIKeyEnv` is set.
+- unresolved or empty selected credential references.
+
+Both modes use the shared credential forwarding used by Audita and Notarius:
+selected names and captured values augment the minimal child environment, and
+all selected values are registered for captured-stream redaction. The adapter
+does not reread the parent environment or override Scriptorium's provider
+selection with `--api-key-env`. Generated invocation records and result metadata
+contain `credential_env_names`, never credential values. This does not scan or
+redact files written directly by Scriptorium. Selection semantics belong in
+[Scriptorium credentials](../config.md#scriptorium-credentials).
 
 Run behavior:
 - subprocess errors propagate with context;

docs/integrations/whisperx.md

@@ -17,11 +17,20 @@ Narratio sends an HTTP `POST` to the configured transcription URL using
 The server must return a `2xx` response whose body is valid JSON. Narratio does
 not currently require a more specific response schema at this boundary.
 
-The transcription URL must be an absolute `http` or `https` URL. The audio body
-is streamed through a fresh multipart writer for every attempt, so its memory
-use is bounded by the transport buffer rather than by the complete audio file.
+The transcription URL must be an absolute `http` or `https` URL. Each
+application attempt creates one bounded multipart framing and streams the audio
+from an open file between that framing; it does not buffer the complete audio
+or spool a multipart copy. The file field precedes the language field.
 WhisperX response acquisition is capped at 10 MiB.
 
+The initial request body and any transport-requested replay use the same
+multipart boundary and framing. Every body opens an independent audio handle
+and replay starts at the beginning. Narratio closes all bodies created for the
+attempt on response, failure, timeout, or cancellation, including when a
+transport abandons an earlier body. Genuine source read/close failures remain
+request failures; deliberate early closure of an abandoned original does not
+poison a valid replay.
+
 ## Request And Result Contract
 
 Each adapter request identifies a speaker, a readable audio file, and the
@@ -43,6 +52,11 @@ transcript output.
 - Narratio waits the configured retry delay between attempts and aborts that
   wait when the parent context is canceled.
 
+Transport replay occurs inside one application attempt and does not consume an
+entry from the configured retry budget or increment the reported attempt
+count. The standard HTTP redirect policy remains in effect; body replay can
+also support body-preserving redirects.
+
 ## Validation And Failure Semantics
 
 Client construction rejects a missing or non-HTTP(S) absolute transcription URL,
@@ -55,12 +69,19 @@ failure to install the output causes the transcription to fail. Errors include
 attempt context, and the result retains attempts, final status when available,
 and elapsed duration for diagnostics.
 
+Replay makes a fresh request body available to the HTTP transport; it does not
+provide an exactly-once server guarantee and does not prove recovery from every
+proxy or protocol-level failure. A server may have received work before the
+client learns that a request failed. WhisperX operations should therefore be
+safe to retry for the same input when practical.
+
 ## Determinism And Concurrency
 
 Each audio request has stable multipart field names, and successful bytes are
 installed atomically. The transcribe stage may process speaker files in
-parallel, bounded by the configured concurrency. It records results in stable
-speaker order after all work completes; any speaker failure fails the stage.
+parallel, bounded by the configured concurrency. Each validated speaker is
+checkpointed independently; any speaker failure still fails the aggregate
+stage, while committed earlier speakers remain reusable on an ordinary retry.
 
 ## Related Canonical Docs
 

docs/internal/adapters.md

@@ -65,6 +65,18 @@ Notarius is composed only when extraction is enabled; the extract stage owns
 prepared reference resolution, receipt, bundle, and configured-lane policy.
 The adapter validates the ordered selector/absolute-path pairs and is the sole
 owner of serializing them as repeated `--reference` arguments before `--json`.
+It also serializes an effective resume request as `--resume` and a nonempty
+validated chunk mode as `--chunk_cache <mode>`. The extract stage, not the
+adapter, resolves force precedence before constructing the request.
+Its request may also carry already-resolved ConfigKit secret references.
+Audita and Scriptorium requests carry the same kind of list. All three adapters use the shared
+subprocess helper to convert their selected references into exact-name child
+environment overrides and sensitive-name registration. That helper rejects
+unresolved or empty programmatic references, but no adapter rereads the
+parent environment or inspects downstream configuration to discover names.
+Empty lists add no credential overrides. See the public [Audita](../integrations/audita.md)
+[Notarius](../integrations/notarius.md), and [Scriptorium](../integrations/scriptorium.md) contracts for selection and
+downstream-file boundaries.
 
 Application-owned object-store construction loads configured filesystem
 secrets before invoking the invocation's storage factory. Production commands

docs/internal/configuration.md

@@ -9,9 +9,9 @@ pipeline-loading boundary implemented by `internal/config`.
 `LoadPipeline` assembles and validates a pipeline in this order:
 
 1. Give ConfigKit a fresh typed `PipelineConfig` default value, the root file,
-   enabled imports, and the caller's profile selection. Omitted, empty, and
-   exact `default` selections use the base; named profiles use the fixed
-   `profiles/<name>.yml` convention.
+   enabled imports, and the caller's overlay selection. Omitted, empty, and
+   exact `default` selections use the base; named overlays use the fixed
+   `overlays/<name>.yml` convention.
 2. ConfigKit parses the root and declared imports, additively merges base
    sources, applies only the selected overlay, and strictly decodes the result.
 3. The definition resolver applies recorded entry-level and inherited defaults,
@@ -45,7 +45,7 @@ a temporary downloaded session file therefore cannot invalidate the resolved
 pipeline or campaign context.
 
 Campaign and session files use independent ConfigKit definitions with imports
-and profiles disabled. Campaign files normally load directly from their source;
+and overlays disabled. Campaign files normally load directly from their source;
 session files are first read through the 8 MiB bounded-read boundary because the
 application must reject unresolved template placeholders before passing an exact
 byte snapshot to ConfigKit. Local and remotely downloaded session bytes then use
@@ -53,8 +53,9 @@ the same typed loader and retain the existing post-load identity expectations,
 stable-input precedence, and source-relative path semantics.
 
 The application also has a separate read-only inspection resolver for `config
-validate`, `config show`, `config sources`, and `config artifacts`. It uses the same production root/profile and
-campaign selection functions, but never routes through session discovery,
+validate`, `config show`, `config sources`, and `config artifacts`. It uses the
+same production root, overlay, and campaign selection functions, but never routes
+through session discovery,
 remote-session download, adapter composition, workspace
 initialization, manifest access, or cleanup. A pipeline with retained artifact
 family declarations must resolve its selected campaign before ordinary pipeline
@@ -73,7 +74,7 @@ commands do not marshal runtime objects directly.
 `EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
 safe provenance projection for `config sources`. Pipeline ownership begins with
 the complete logical field paths projected from the schema and classifies
-each contributor as root, import, profile, or centralized default. The
+each contributor as root, import, overlay, or centralized default. The
 projection replaces generated concrete member paths with paired family and
 canonical-party records, and does the same for generated publish rules.
 Campaign records identify campaign-owned fields and party inputs; canonical
@@ -106,7 +107,7 @@ configured roster authority; player and session-party fields are unsupported.
 ## Canonical Party Domain
 
 `ParseParty` is the package-owned boundary for parsing a party source. Its
-single-source ConfigKit definition disables imports and profiles, requires
+single-source ConfigKit definition disables imports and overlays, requires
 `schema_version` through `VersionRule`, and strictly decodes the
 character-keyed typed schema before applying Narratio's party-domain checks.
 Successful metadata coordinates recover authored character-map order without a
@@ -144,14 +145,14 @@ not compatibility contracts.
 
 ## Diagnostics And Runtime Metadata
 
-Syntax, duplicate-key, merge, profile, and schema failures include the
+Syntax, duplicate-key, merge, overlay, and schema failures include the
 relevant source name and full field path. Additive conflicts report every
 claiming source so operators can repair the split without repeatedly
 rediscovering additional conflicts.
 
 The loaded pipeline retains private runtime metadata for the absolute root
-path, ordered imports, selected profile name and selection source, selected
-overlay, original ConfigKit metadata and source snapshots, effective digest,
+path, ordered imports, selected overlay name, source, and path, original
+ConfigKit metadata and source snapshots, effective digest,
 and leaf ownership. Base
 leaves retain their root/import owners, replaced leaves belong to the selected
 overlay, and centrally supplied values use the synthetic `default` owner. This
@@ -163,17 +164,21 @@ the same typed safe projection used by show and diff. Runtime Notarius paths rem
 execution, but the digest substitutes their normalized logical values captured
 before root-relative resolution, so relocating an equivalent configuration
 bundle does not change provenance. Because ConfigKit and resolution metadata
-are private, the digest excludes source layout, profile name, and ownership.
+are private, the digest excludes source layout, overlay name, and ownership.
 Configuration stores credentials as ConfigKit typed references. A successful
 load resolves their values inside the opaque typed boundary, while this safe
 projection serializes only `EnvName()` identities. Credential-value changes are
 therefore never hashed; reference-name changes remain ordinary provenance.
+The optional Notarius credential follows the same path even for disabled or
+resumable extraction; normalization copies the opaque reference without reading
+or resolving it again. Direct YAML serialization has a configuration-owned safe
+projection so only the reference name can leave this boundary.
 `recomputePipelineEffectiveDigest` is the single package-owned refresh point
 for later runtime expansion.
 
 ## Test Surfaces
 
-`pipeline_configkit_test.go` exercises real imports and fixed-path profiles,
+`pipeline_configkit_test.go` exercises real imports and fixed-path overlays,
 base selection, unselected-overlay isolation, source attribution, and Narratio's
 unique artifact/family base-declaration rule. Existing focused configuration
 tests protect defaults, explicit-value semantics, strict decoding, validation,

docs/internal/manifest.md

@@ -23,9 +23,11 @@ portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
-Decoding is strict at every typed manifest field. Unknown fields are rejected;
-the schema version remains `narratio.session-manifest.v1` and there is no
-compatibility reader that silently drops retired state. Cleanup progress uses
+Decoding rejects unknown typed fields, including informational fields inside
+`effective_config` and its nested selection. The schema version remains
+`narratio.session-manifest.v1`; there is no compatibility reader that silently
+drops retired fields. See [overlay migration](../operations.md#migrating-manifest-overlay-provenance)
+for deliberate migration of retired selection provenance. Cleanup progress uses
 only the cleanup entry in `stages`.
 
 Every persisted session manifest has a non-nil `stages` map. Each entry is
@@ -50,6 +52,45 @@ The model admits these stage states:
 - `stale`
 - `interrupted`
 
+### Transcribe-owned speaker state
+
+A `transcribe` stage record may carry `transcribe_state_version: 1` and a
+`transcribe_speakers` map keyed by the existing derived speaker ID. The version
+is the authority marker: a versioned empty map means that no earlier speaker
+completion is reusable. Absence of both fields is accepted as legacy
+aggregate-only state so current Narratio can read older manifests.
+
+Each map entry represents one completed speaker only. It binds a versioned
+fingerprint to the session-relative audio path, audio SHA-256 and size, one
+canonical `transcript_raw` output with its path, SHA-256 and size, and the
+producer run ID. Paths must be canonical and session-relative, checksums must
+be lowercase SHA-256 values, and the record and output producer identities
+must agree. Other stages cannot carry this transcribe-owned state.
+Audio size is nonnegative; WhisperX determines whether that audio can be
+transcribed. Output size remains positive and the transcript must be valid JSON.
+
+Transcribe reconciles this collection against the current prepared audio set
+and observable WhisperX semantics. Missing or corrupt regular outputs become
+work; unsafe or non-regular evidence is rejected. It saves the reconciled
+collection before HTTP dispatch and saves a detached candidate after each
+validated completion. Only after a save succeeds is the candidate installed as
+live authority. Canonical bytes produced before an unsuccessful save are not a
+completion record.
+
+Aggregate transcribe status still describes the whole invocation. A failed,
+running, stale, or interrupted aggregate may therefore retain reusable speaker
+records, while aggregate outputs are declared only after the current
+collection is complete. Ordinary retry reconciles and reuses those records.
+Force first checkpoints an empty current collection, preventing later retries
+from reviving pre-force results.
+
+Older aggregate-only transcribe success is conservatively regenerated once
+when transcribe is selected because it does not bind individual outputs to the
+audio bytes used. The session-manifest schema identifier remains
+`narratio.session-manifest.v1`; this additive state is accepted by current
+Narratio, but older strict-decoding binaries may reject manifests after these
+fields have been written.
+
 ### Analyze-owned artifact state
 
 Every `analyze` stage record carries `analyze_state_version: 1` and an
@@ -154,12 +195,31 @@ establish a current immutable snapshot.
 - writes through a sibling temporary file and atomic replacement visibility;
 - updates `updated_at` on save.
 
+### Checkpoint persistence boundary
+
+Analyze and transcribe share one private checkpoint operation in
+`internal/stage`. Their typed callers still decide when to checkpoint, validate
+their collections, populate stage-owned fields, and serialize access. The
+shared operation copies the manifest and its checkpoint-relevant mutable
+collections, applies the typed update to the copied target record, and calls
+the existing `manifest.Store` exactly once. Only after that save succeeds does
+it promote the saved target record and manifest `updated_at` into live state;
+it preserves an existing target record's identity and leaves unrelated live
+stage records in place.
+
+The copy boundary includes stage records, input and artifact slices, aggregate
+output/log/configuration slices, and the typed analyze and transcribe
+collections that callbacks or `LocalStore.Save` may modify. Metadata and other
+pointer fields remain shared read-only because neither checkpoint callback nor
+the store mutates them. This is a bounded execution helper, not a general
+manifest clone or a transaction across transcript/artifact files.
+
 Manifest replacement provides atomic visibility, not a crash- or power-loss
 durability guarantee. Callers reload after a returned save error before retrying.
-An analyze checkpoint error leaves the prior manifest as per-artifact authority.
-The runner then attempts to persist the bounded failed/stale retry collection;
-if that terminal save also fails, its error is joined with the originating
-failure and the next invocation must reconcile from the last readable manifest.
+A transcribe or analyze checkpoint error leaves the prior manifest collection
+as authority. The runner then attempts to persist the aggregate failure; if
+that terminal save also fails, its error is joined with the originating failure
+and the next invocation must reconcile from the last readable manifest.
 
 ## Execution Semantics
 
@@ -193,11 +253,11 @@ only fields returned by the new result. Marking a record stale does not clear
 those details because resume validation and diagnosis may still require them
 before execution begins.
 
-Aggregate lifecycle clearing deliberately preserves the analyze-owned
-per-artifact collection. This lets later reconciliation replace only evaluated
-entries without erasing unrelated current results. Other stages retain their
-existing aggregate-only lifecycle behavior and are forbidden from carrying the
-analyze-specific fields.
+Aggregate lifecycle clearing deliberately preserves both the transcribe-owned
+speaker collection and the analyze-owned per-artifact collection. This lets
+later reconciliation replace only non-current entries without erasing durable
+completions. Other stages retain aggregate-only lifecycle behavior and are
+forbidden from carrying either collection.
 
 A stage may explicitly return a skipped disposition and stable reason. The
 runner persists that outcome in the session manifest, clears older outputs,
@@ -228,7 +288,7 @@ evidence and focused durable validators:
 | Work | Reuse authority | Focused owners |
 | --- | --- | --- |
 | prepare | aggregate semantic fingerprint | [prepare](stage-prepare.md) |
-| transcribe | aggregate semantic fingerprint | [transcribe](stage-transcribe.md), [WhisperX](../integrations/whisperx.md) |
+| transcribe speakers | aggregate semantic fingerprint plus per-speaker input/output reconciliation | [transcribe](stage-transcribe.md), [WhisperX](../integrations/whisperx.md) |
 | merge | aggregate semantic fingerprint | [merge](stage-merge.md), [Seriatim](../integrations/seriatim.md) |
 | polish | aggregate semantic fingerprint | [polish](stage-polish.md), [Audita](../integrations/audita.md) |
 | normalize | aggregate semantic fingerprint | [normalize](stage-normalize.md), [Seriatim](../integrations/seriatim.md) |
@@ -248,10 +308,10 @@ after such a private content change.
 
 The session manifest is the authoritative stage-progress ledger across
 invocations. It retains the most recently resolved invocation's bounded
-configuration provenance. It identifies the selected profile name and source
-(`default` or `cli`) plus the effective configuration digest, but never a raw
-secret or profile content. This provenance is informational: it does not
-participate in stage resume or cache decisions. A profile change therefore
+configuration provenance. It identifies the selected overlay name and source
+(`explicit` when selected) plus the effective configuration digest, but never a raw
+secret or overlay content. This provenance is informational: it does not
+participate in stage resume or cache decisions. An overlay change therefore
 invalidates only stages whose semantic configuration changed. When a private
 external-tool model, module, prompt, or profile changes behind an unchanged
 configured identifier, use `--force` for the affected work.
@@ -310,6 +370,7 @@ where the last session transition can require operator interpretation.
 - Remote commit model and readers: `internal/artifacts/remote_commit.go`,
   `internal/artifacts/current_state_commit.go`,
 - Persistence and validation: `internal/manifest/store.go`
+- Transcribe speaker state: `internal/manifest/transcribe_state.go`
 - Package tests: `internal/manifest/*_test.go`
 - Assembled execution behavior: `internal/app/runner_test.go`,
   `internal/app/run_stage_test.go`

docs/internal/overview.md

@@ -37,7 +37,7 @@ failed stage or required manifest save prevents later stages from starting.
 | --- | --- | --- |
 | Executable | `cmd/narratio` | Process entry, standard stream wiring, argument handoff, and exit status. |
 | Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, and user-facing reporting. |
-| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and profiles, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
+| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and overlays, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
 | Pipeline stages | `internal/stage` | Canonical stage registry, shared stage contract, execution dependencies, and implemented stage behavior. |
 | External boundaries | `internal/adapters`, `internal/audio` | WhisperX HTTP, downstream subprocesses, notification, object storage, and S3 audio materialization behind Narratio contracts. |
 | Manifests | `internal/manifest` | Durable session progress, stage transitions, validation, and atomic persistence. |
@@ -53,11 +53,12 @@ adapters. The normative rules for these relationships remain in
 [Architecture](../policy/architecture.md).
 
 Command execution normalizes one private dependency value per invocation.
-Configuration reads, secret-directory reads, remote downloads, object-store
-construction, and restore phase functions use that value throughout the
-command. Public command entry points supply production defaults, while focused
-tests replace only the external or sequencing boundary they exercise without
-mutating package state.
+Pipeline configuration-path discovery, configuration reads, secret-directory
+reads, remote downloads, object-store construction, and restore phase functions
+use that value throughout the command. Public command entry points supply the
+canonical discovery and production defaults, while focused tests may provide
+invocation-owned discovery candidates or replace only the external or sequencing
+boundary they exercise without mutating package state.
 
 Pipeline execution and `session plan` share the same inclusive contiguous-range
 model and the same pure pre-execution decision over recorded status, force, and
@@ -105,7 +106,7 @@ so any earlier replacement can stale a prior cleanup result.
 
 ## Focused Documentation
 
-- [Configuration Internals](configuration.md): pipeline imports and profiles,
+- [Configuration Internals](configuration.md): pipeline imports and overlays,
   field ownership, decoding, and root-relative path semantics.
 - [Adapter Internals](adapters.md): external adapter boundaries, composition,
   failure behavior, and test surfaces.

docs/internal/stage-analyze.md

@@ -115,7 +115,11 @@ Supported source families:
 - before the first adapter call, checkpoints the reconciled starting collection
   when it removed configuration records or cleared obsolete authority. After
   each successful artifact, checkpoints the complete collection before making
-  that artifact available to the next scheduled dependent.
+  that artifact available to the next scheduled dependent. Analyze supplies
+  its typed update to the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary)
+  and refreshes its working and committed collections only after the save
+  succeeds.
 - keeps adapter output in the invocation's run-local analyze directory until
   it is a safe, non-empty, bounded regular file with a calculated checksum and
   complete output contract. Canonical replacement uses the shared atomic file

docs/internal/stage-extract.md

@@ -19,12 +19,17 @@ procedures belong in [Operations](../operations.md).
 1. resolves the final trimmed transcript from the shared artifact catalog;
 2. resolves every configured prepared reference through the shared
    manifest-authoritative identity resolver before creating run-local output;
-3. streams each verified reference into an invocation-local snapshot and
-   rejects any source change observed while copying;
+3. resolves each reference to a stable content-addressed session snapshot,
+   reusing verified bytes or reconstructing a missing/corrupt regular entry,
+   and rejects any source change observed while copying;
 4. fingerprints the byte- and provenance-bearing Notarius invocation evidence,
-   including sorted reference identities;
+   including sorted reference identities and the explicit downstream
+   configuration-overlay selection;
 5. creates a run-local staging directory and invokes the injected
-   `notarius.Runner`;
+   `notarius.Runner`, carrying the optional already-resolved credential
+   reference without exposing its value, the optional exact configuration
+   overlay, plus effective resume and chunk-cache controls after force
+   precedence;
 6. revalidates the reference snapshots, then validates the v2 successful
    receipt, confined index, management documents, configured required lane
    descriptors, validation summaries, and regular payload files;
@@ -41,14 +46,22 @@ Narratio run ID, the resolved trimmed-input identity, and invocation
 fingerprint. The input identity binds the exact transcript bytes, canonical
 source ID, producer stage/output/run identity, and resolution provenance.
 Reference metadata contains only selector, source ID, canonical session-relative
-path, checksum, and size; adapter requests receive selector and absolute
-invocation-local snapshot path, never payload contents. Snapshot bytes must
+path, checksum, and size; adapter requests receive selector and absolute stable
+snapshot path, never payload contents. Snapshot bytes must
 match the prepared identity both before and after Notarius runs, so a concurrent
 prepared-file replacement cannot make recorded provenance describe different
 bytes from those supplied to Notarius.
 Validation completes before the single durable rename, so a rejected result
 cannot expose a partial durable bundle.
 
+Snapshot destinations are owned by `internal/artifacts` under
+`cache/notarius/references/<sha256>/<prepared-basename>`. They contain no run ID
+or timestamp and can be reused across invocations. Identical bytes and basename
+share a verified file; changed bytes select a different digest directory.
+Unsafe path components and non-regular conflicts fail without recursive
+deletion. Snapshot paths are delivery details and never become manifest output
+evidence or prerequisites for reuse of an already complete extract bundle.
+
 Any executed extraction outcome that replaces a different effective outcome
 marks succeeded analysis and delivery dependents stale. Render is an independent
 sibling and remains current. Repeating the same disabled self-skip with no
@@ -59,17 +72,28 @@ outputs is stable and does not repeatedly invalidate dependent stages.
 Before the focused validator runs, the application compares extract's versioned
 semantic fingerprint. It covers enablement, Notarius pipeline identity, sorted
 reference selector/source mappings, sorted declared output contracts, and each
-canonical `narratio.extraction.<key>` output identity. It excludes executable,
+canonical `narratio.extraction.<key>` output identity. It also covers the
+explicit Notarius configuration-overlay selection; omitted, empty, and exact
+`default` selectors share the base-selection identity. It excludes executable,
 timeout, working directory, config path, and private Notarius config contents.
+Credential presence, reference name, and resolved value are likewise
+operational-only and excluded. Ordinary command loading still resolves a
+selected reference before resume evaluation, but a credential-only change does
+not rerun a valid completed extraction or stale its dependents.
 
 `internal/stage/extract_resume.go` then permits a skip only when the existing
 stage record still matches the current byte- and provenance-bearing invocation
 evidence. That evidence covers the current direct trimmed-transcript identity,
 sorted prepared-reference identities, pipeline identity, and configured output
-contracts. The same reference helper and transcript identity are resolved again
-for artifact evidence, so changing current transcript bytes, reference bytes,
-or producer identity makes the prior extraction obsolete. Operational runner
-settings do not invalidate otherwise current durable evidence.
+contracts, plus the same downstream overlay-selection identity. The same
+reference helper and transcript identity are resolved again for artifact
+evidence, so changing current transcript bytes, reference bytes, producer
+identity, or a named downstream selection makes the prior extraction obsolete.
+Operational runner settings do not invalidate otherwise current durable
+evidence. This includes `resume` and `chunk_cache`; changing them alone cannot
+make a complete extraction non-resumable. If extraction executes, ordinary
+runs forward the configured values, while force disables resume and selects
+`refresh`.
 
 A valid prepared-reference change makes extraction non-resumable. Missing,
 unsafe, or checksum-inconsistent prepared evidence is a hard validation error
@@ -82,10 +106,12 @@ contracts and provenance, regular-file status, and stored checksums. Missing or
 obsolete results are non-resumable and run again; unsafe filesystem conditions
 return an error rather than silently accepting or replacing data.
 
-Neither contract can observe files imported by Notarius configuration, profile
-contents, prompt/module definitions, or other transitive inputs. Operators must
-force extraction after changing any such private input behind a stable
-identifier.
+This sensitivity is limited to the explicit downstream selector. Narratio's
+own overlay label and whole effective-configuration digest are not blanket
+extraction invalidators. Neither contract can observe files imported by
+Notarius configuration, profile contents, prompt/module definitions, or other
+transitive inputs. Operators must force extraction after changing any such
+private input behind a stable identifier.
 
 ## Failure Behavior
 
@@ -110,9 +136,13 @@ recovery.
   `internal/stage/extract_resume.go`,
   `internal/stage/extract_test.go`,
   `internal/stage/semantic_contracts_delivery.go`
+- Stable snapshot materialization and verification:
+  `internal/stage/extract_references.go`
 - Subprocess boundary: `internal/adapters/notarius/subprocess.go`,
   `internal/adapters/notarius/subprocess_test.go`
 - Catalog hydration: `internal/artifacts/extraction_catalog.go`,
   `internal/artifacts/extraction_catalog_test.go`
 - Composition and downstream behavior: `internal/app/runner_test.go`,
   `internal/stage/analyze_test.go`, `internal/stage/publish_test.go`
+- Opt-in Notarius v0.8.1 production-boundary coverage:
+  `internal/stage/notarius_cache_integration_test.go`

docs/internal/stage-merge.md

@@ -17,7 +17,11 @@ Normalize raw transcript inputs and merge into base transcript via Seriatim.
 
 ## Key Behavior
 
-- discovers and validates raw transcript inputs.
+- discovers and validates raw transcript inputs. For versioned transcribe
+  state, discovery requires aggregate transcribe success and consumes only the
+  aggregate outputs that exactly match the current per-speaker collection.
+  Partial checkpoints and orphaned files are not merge inputs. Legacy/manual
+  workflows without versioned speaker state retain directory discovery.
 - normalizes each raw transcript (`seriatim.Normalize`) into run-local scratch output.
 - merges normalized inputs (`seriatim.Run`) into base transcript.
 - validates merged transcript and optional report JSON.
@@ -26,6 +30,8 @@ Normalize raw transcript inputs and merge into base transcript via Seriatim.
 ## Invariants
 
 - merge always consumes normalized forms of raw inputs.
+- a versioned transcribe collection is usable only through its complete,
+  successful aggregate output declaration.
 - base transcript must validate before stage success.
 - report output is config-gated.
 

docs/internal/stage-polish.md

@@ -12,37 +12,41 @@ Run Audita polishing on base transcript and produce polished transcript.
 ## Outputs
 
 - `transcripts/polished.json`
-- optional `artifacts/audita.report.json`
+
+The transcript is the only canonical output. Available `errors.yml`,
+`recoveries.yml`, and `report.md` remain beside the run-local transcript and
+are recorded as diagnostics, not artifact outputs.
 
 ## Key Behavior
 
 - resolves base transcript only from verified merge manifest output evidence.
-- invokes an Audita runner configured with static model/runtime options; the
-  invocation supplies paths and modules.
+- invokes an Audita v2 runner with external configuration selectors and
+  explicitly forwarded provider credentials; the invocation supplies paths.
 - validates processed transcript structure (`segments` array required).
-- validates optional report JSON.
-- materializes canonical outputs; records logs/generated config and adapter metadata.
+- validates reported diagnostic paths against the three fixed adjacent names.
+- materializes only the canonical transcript; records available reports with
+  stdout/stderr logs, generated invocation, and safe adapter metadata.
 
 ## Invariants
 
 - polished transcript schema validation is mandatory.
-- report output is config-gated.
+- reports are optional diagnostics; Audita's external configuration may disable
+  them. A failed invocation never promotes an incidental transcript.
 
 ## Resume Semantics
 
-The versioned semantic fingerprint covers the Audita service endpoint, model,
-validation model, module set, transcript description, output schema, selected
-external configuration path, and canonical polished-transcript identity. Module
-ordering is normalized because the configured modules form a set. Audita's
-executable, timeouts, concurrency, report and debug behavior, work retention,
-and resolved credential value are operational and do not invalidate a
-successful result. The public credential reference name may participate in
-configuration provenance but never exposes its resolved value.
+Version 2 semantic evidence covers Audita's config path, downstream overlay,
+proposal and validation profile selectors, ordered module selection (including
+the distinction between omission and an explicit empty list), transcript
+description, output schema, and canonical polished-transcript identity.
+Credentials, executable path, timeout, and diagnostics are operational and do
+not invalidate a successful result. Public credential reference names may
+participate in configuration provenance but never expose resolved values.
 
-Narratio can fingerprint a selected model, module, or configuration identifier,
-but it cannot inspect content that Audita privately resolves behind that stable
-identifier. Force `polish` after changing such private content without changing
-its identifier.
+Narratio fingerprints selections, not the contents of Audita-owned config or
+profiles. Force `polish` after changing those files behind unchanged selections.
+When polish is selected, older semantic evidence is reconsidered and the stage
+reruns; a downstream-only invocation does not eagerly run polish.
 
 ## Related Contracts And Tests
 

docs/internal/stage-transcribe.md

@@ -14,12 +14,19 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 
 ## Key Behavior
 
-- discovers prepared audio from manifest inputs or canonical audio directory.
-- derives the transcript identity from the prepared `.flac` filename.
-- dispatches one WhisperX request per prepared file through a bounded errgroup.
-- validates each output as JSON.
-- writes run-local outputs then materializes canonical transcript outputs only
-  after every planned request succeeds.
+- discovers prepared audio from manifest inputs or the canonical audio
+  directory and derives each speaker identity from its `.flac` filename.
+- hashes the current audio and reconciles it with the versioned per-speaker
+  completion collection before starting HTTP work.
+- reuses only records whose audio identity, observable WhisperX semantics,
+  canonical output location, JSON, checksum, and size remain current.
+- durably checkpoints the reconciled collection before dispatch, then sends
+  only missing or obsolete speakers through the bounded worker group.
+- validates each successful run-local response, rechecks the audio bytes,
+  materializes the canonical raw transcript, and checkpoints that speaker
+  before accepting another completion.
+- rebuilds aggregate stage outputs in stable speaker order from the complete
+  current collection, including records produced by earlier invocations.
 
 ## Invariants
 
@@ -28,21 +35,49 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 - output path returned by adapter must match requested output path.
 - an empty adapter result path means the requested path; adapters cannot select
   an alternate destination.
-- each successful output is validated before stage success, and cancellation or
-  incomplete dispatch cannot be reported as a successful result.
+- candidate collection construction, the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary),
+  and installation into live state are serialized by transcribe's mutex.
+  Expensive hashing and HTTP work remain outside that critical section.
+- a canonical file has no completion authority until its manifest checkpoint
+  succeeds. A save failure preserves the last successfully committed
+  collection for ordinary retry.
+- each successful output is validated before its checkpoint, and cancellation,
+  incomplete dispatch, or a failed aggregate save cannot be reported as
+  aggregate stage success.
+- removed audio inputs are omitted from the current collection and aggregate
+  output list; reconciliation does not delete arbitrary transcript files.
+- merge cannot consume a partial versioned collection: it requires transcribe
+  aggregate success and an exact match between current speaker records and
+  declared aggregate outputs.
 
 ## Resume Evidence
 
-Transcribe records a versioned semantic-configuration fingerprint containing
-the Narratio-visible WhisperX service URL and recognition language. Changes to
-either rerun transcription and stale its fixed descendants while leaving
-prepare reusable. Retry count/delay, concurrency, timeout, credentials, and
-diagnostic locations are operational and do not change this evidence.
+Each completed speaker record binds the speaker ID, session-relative audio
+path, streamed audio checksum and size, the Narratio-visible WhisperX service
+URL and recognition language, and the canonical transcript path, checksum,
+size, and producer run. Changed audio bytes select that speaker for replacement;
+a changed URL or language selects every speaker. Either case stales fixed
+descendants through the normal runner decision. Retry count/delay, concurrency,
+timeout, credentials, and diagnostic locations are operational and do not
+change this evidence.
+
+An ordinary retry reuses every valid speaker checkpoint even when aggregate
+transcribe status is failed, running, or stale. A succeeded stage is skipped only
+when its stored speaker set and aggregate output evidence also match the current
+collection. Otherwise, execution repairs those records without retranscribing
+reusable speakers and stales dependents through the normal runner path.
+`--force` first durably replaces
+the collection with an empty versioned collection, so a later ordinary retry
+cannot resurrect pre-force results; speakers checkpointed by that forced
+attempt remain reusable.
 
 WhisperX models or private service configuration not exposed by Narratio's
 adapter contract cannot be fingerprinted; use `--force` after changing them.
-An existing successful transcribe record without evidence reruns once when
-selected.
+An older aggregate-only transcribe record has no trustworthy audio-to-output
+binding. When transcribe is next selected, every current speaker is therefore
+generated once and recorded in the versioned collection; later invocations can
+reuse it normally.
 
 ## Related Contracts And Tests
 
@@ -51,6 +86,9 @@ selected.
 - [Configuration](../config.md#pipeline) owns concurrency and other
   operator-selected values.
 - Implementation and tests: `internal/stage/transcribe.go`,
+  `internal/stage/transcribe_reconciliation.go`,
+  `internal/stage/transcribe_execution_state.go`,
+  `internal/stage/transcribe_resume.go`,
   `internal/stage/transcribe_test.go`,
-  `internal/stage/semantic_contracts_initial.go`, and
-  `internal/stage/semantic_contracts_initial_test.go`
+  `internal/stage/transcribe_reconciliation_test.go`, and
+  `internal/stage/transcribe_checkpoint_test.go`

docs/internal/workspace.md

@@ -37,6 +37,12 @@ validates and renames the external bundle to the unique immutable Notarius
 bundle path supplied by `internal/artifacts`. Exact physical paths belong in
 [Operations](../operations.md#extraction-workflow).
 
+Prepared references delivered to Notarius use session-durable paths owned by
+`internal/artifacts` beneath
+`cache/notarius/references/<sha256>/<prepared-basename>`. These verified
+content-addressed snapshots are outside run-local layout, survive ordinary
+published-run cleanup, and are excluded from publish and restore enumeration.
+
 ## Locking
 
 `artifacts.LocalStore` enforces the single-writer session lock via an

docs/operations.md

@@ -70,19 +70,19 @@ narratio run 2026-04-04
 narratio session status 2026-04-04
 ```
 
-Run, plan, and status output identify the resolved pipeline profile (or `none`)
+Run, plan, and status output identify the resolved pipeline overlay (or `none`)
 and effective configuration digest. Status distinguishes the current resolved
 value from the last value persisted in the session manifest, which helps
-diagnose profile switches without changing resume authority.
+diagnose overlay switches without changing resume authority.
 
-Before switching an operational profile, compare its effective meaning with the
-production base through `narratio config diff default <profile>`.
+Before switching an operational overlay, compare its effective meaning with the
+production base through `narratio config diff default <overlay>`.
 The command is read-only and succeeds whether it finds differences or not. Its
 sorted records describe defaulted, expanded concrete configuration—not source
 file layout—so it can be used to review model, artifact, and publish changes
 without creating a session or run. Use `narratio config artifacts` to review the
 concrete artifact identities, definitions, outputs, and dependencies. Select the
-same campaign explicitly when profiles could resolve different campaign paths;
+same campaign explicitly when overlays could resolve different campaign paths;
 see the [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
 for syntax and record format.
 
@@ -116,18 +116,19 @@ Execution rules:
   perpetually rerun dependent work.
 
 Every aggregate stage except analyze currently provides semantic-configuration
-evidence; analyze retains its more precise per-artifact fingerprints and
-validator.
+evidence; transcribe additionally reconciles per-speaker completion evidence,
+while analyze retains its more precise per-artifact fingerprints and validator.
 Prepare additionally validates current stable/local/S3 source identity and the
 checksums of its durable prepared copies before reuse. Changed bytes, audio
 membership, S3 object identity, or missing/tampered copies rerun prepare and
 its fixed descendants without requiring `--force`. Changing prepare selection
 semantics likewise reruns all fixed descendants; changing
 WhisperX language/service identity reuses prepare; changing a Seriatim merge
-transformation reuses prepare and transcribe; and changing an Audita model
-reuses prepare, transcribe, and merge while rebuilding transcript refinement.
-A trim change invalidates both render and extract through the fixed dependency
-relation, while a render-only change preserves the extract sibling.
+transformation reuses prepare and transcribe; and changing a selected Audita
+overlay, profile, or module sequence reuses prepare, transcribe, and merge while
+rebuilding transcript refinement. A trim change invalidates both render and
+extract through the fixed dependency relation, while a render-only change
+preserves the extract sibling.
 
 Operational timeouts, retry/concurrency tuning, executable paths,
 workspace/cache/spool placement, reports, diagnostics, and secret values are
@@ -187,7 +188,68 @@ shared session lifecycle. In particular, render does not require Notarius or
 Scriptorium, extract does not require Scriptorium, and analyze does not require
 the transcription, Seriatim, Audita, or Notarius adapters.
 
-For the common post-transcript development loop, use:
+### Transcription continuation and replacement
+
+Transcribe checkpoints each validated speaker independently. If a later
+speaker exhausts HTTP retries, the process is canceled, or the aggregate stage
+save fails, the aggregate stage is not successful and downstream merge cannot
+consume the partial set. The last successfully saved speaker records and their
+canonical `transcripts/raw/<speaker>.json` files remain durable, however.
+
+After correcting the underlying problem, retry normally:
+
+```bash
+narratio run-stage transcribe 2026-04-04
+```
+
+Narratio hashes the current prepared audio, validates recorded transcript JSON,
+checksum, size, and location, and calls WhisperX only for missing or obsolete
+speakers. A changed audio file replaces only its speaker; a changed WhisperX
+URL or language makes every current speaker non-reusable. Retry, timeout, and
+concurrency tuning do not invalidate completed speakers.
+
+Use force only when every current transcript must be replaced, including after
+a WhisperX model or private server-side configuration changes behind the same
+URL and language:
+
+```bash
+narratio run-stage transcribe 2026-04-04 --force
+```
+
+Force durably clears the reusable collection before sending requests. If that
+forced attempt fails, a later ordinary retry reuses only replacement speakers
+checkpointed after the reset; it does not revive pre-force results. Do not edit
+speaker checksums or copy older JSON into the canonical directory to influence
+reuse.
+
+The first current Narratio invocation that selects transcribe for an older
+aggregate-only manifest retranscribes every current speaker once because the
+old record cannot prove which audio bytes produced each file. Subsequent runs
+reuse the new versioned evidence normally. The overall session-manifest schema
+identifier is unchanged, but older strict-decoding Narratio binaries may reject
+a manifest after current Narratio writes the additive speaker fields; retain a
+backup or complete the upgrade before relying on downgrade.
+
+Restoring a manifest does not implicitly publish or restore every raw speaker
+file. If a recorded canonical transcript is absent locally, ordinary
+reconciliation schedules that speaker again. Removing run directories does not
+remove canonical checkpointed transcripts and does not by itself invalidate
+them.
+
+## Artifact Development Workflows
+
+Choose the narrowest workflow that matches the intended replacement:
+
+| Intent | Command | Preserved and rebuilt state |
+| --- | --- | --- |
+| Rebuild analysis only | [`narratio analyze 2026-04-04`](./cli.md#analyze) | Preserves transcripts and the current extraction bundle; force-runs selected analysis artifacts and their required analysis prerequisites. |
+| Rebuild extraction and analysis | [`narratio regenerate-artifacts 2026-04-04`](./cli.md#regenerate-artifacts) | Preserves transcripts; force-runs the complete configured extraction bundle, then selected analysis. `--artifacts` narrows analysis only. |
+| Continue bounded work normally | [`narratio run 2026-04-04 --from extract --through analyze`](./cli.md#run) | Uses ordinary resume decisions: current extraction and analysis can be skipped, while incomplete or obsolete work runs. |
+
+All three stop before publication. Inspect the results and run
+[`narratio publish`](./cli.md#publish) separately when delivery is intended.
+
+For the extraction-plus-analysis development loop, use:
 
 ```bash
 narratio regenerate-artifacts 2026-04-04
@@ -220,6 +282,84 @@ earlier checkpoints are reused and execution resumes with failed, stale, or
 missing work in dependency order. `--force` is unnecessary unless the operator
 intends to replace otherwise-current artifacts.
 
+### Developing With Audita And Notarius Overlays
+
+All three applications use ConfigKit, but each owns its root configuration and
+its own `overlays/` directory beside that file. A Narratio testing overlay can
+explicitly select downstream testing overlays without requiring their names to
+match. For example, Narratio's `overlays/testing.yml` may contain:
+
+```yaml
+audita:
+  overlay: testing
+notarius:
+  config_overlay: downstream-economy
+```
+
+Place Audita's settings in `overlays/testing.yml` beside its configuration, and
+Notarius's settings in `overlays/downstream-economy.yml` beside its configuration.
+Use each tool's own schema for model/profile selection and other settings;
+Narratio neither copies those settings nor implicitly forwards its overlay name.
+Select the Narratio file with `--overlay testing` on the desired command. Each
+downstream selector is used only when its stage actually executes: `polish` for
+Audita and `extract` for Notarius. Production can omit both selectors.
+
+For Audita debug inspection, its testing overlay can include:
+
+```yaml
+diagnostics:
+  debug: true
+  work_dir: /path/to/audita-debug
+```
+
+Audita retains detailed artifacts under that directory. Inspect them there;
+Narratio does not collect or manage them. Ordinary Audita reports remain a
+separate existing integration. Leave debug disabled in Audita's production
+configuration unless deliberately needed.
+
+Notarius's debug controls are different: `debug.directory` selects a location
+but does not enable capture. Capture requires its `--debug` flag, which Narratio
+does not currently forward. Selecting a Notarius testing overlay therefore does
+not by itself enable a debug bundle. See the upstream
+[Audita configuration](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.1/docs/config.md)
+and [Notarius CLI](https://gitea.maximumdirect.net/eric/notarius/src/tag/v0.8.1/docs/cli.md)
+for their respective controls.
+
+Edits inside downstream configuration behind an unchanged selector are not
+automatically detected by Narratio. To inspect a fresh Audita debug run, explicitly
+rerun polish, for example:
+
+```sh
+narratio run SESSION --overlay testing --force --from polish --through polish
+```
+
+This replaces polish output and invalidates dependent results; it is not a
+diagnostics-only operation. Selecting testing does not create an isolated
+workspace or retain a separate current result.
+
+Notarius v0.8+ defaults to two additional eligible transient provider attempts
+per generation. Review downstream retry settings and Narratio's extraction
+timeout together; retries can increase elapsed time and provider charges.
+Notarius v0.8.1 refreshes its built-in profile checkpoint identity, so older
+checkpoints may not be reused. Source-keyed chunk plans and already published
+outputs are unaffected; no manual cache deletion is required.
+
+Selecting Narratio's `testing` overlay then supplies `downstream-economy` only
+when extraction executes. Switching that explicit selector makes a recorded
+extraction non-current and reruns it when `extract` is in the selected stage
+range; the usual dependent invalidation then applies. Selecting an overlay does
+not create a separate workspace or retain a separate current extraction result.
+
+Narratio cannot observe edits inside Notarius configuration behind an unchanged
+selector. Force extraction after such an edit when a replacement is intended.
+Use `regenerate-artifacts` when both extraction and analysis must be rebuilt;
+use `analyze` when the existing extraction bundle should be preserved. Field
+semantics belong in [Configuration](./config.md#notarius-configuration-overlay),
+with Audita selectors covered under
+[Audita selection and credentials](./config.md#audita-selection-and-credentials).
+Exact downstream invocations belong in the [Audita](./integrations/audita.md)
+and [Notarius](./integrations/notarius.md#invocation) integration contracts.
+
 ## Artifact Selection
 
 For a configured artifact family, selecting its family key expands to every
@@ -260,9 +400,14 @@ are not selectable or published implicitly.
 Configured Notarius references resolve only from the current manifest-backed
 prepared inputs. Their canonical locations are `inputs/party.yml`,
 `inputs/players.yml`, `inputs/glossary.yml`, and, when configured,
-`inputs/spell_catalog.json`. Extraction supplies Notarius with verified copies
-under `runs/<run_id>/extract/references/` so a concurrent refresh of canonical
-prepared files cannot change the bytes consumed by an in-flight invocation.
+`inputs/spell_catalog.json`. Extraction supplies Notarius with verified,
+content-addressed copies under
+`cache/notarius/references/<sha256>/<prepared-basename>`. The full lowercase
+SHA-256 digest identifies the reference bytes, so retries and later invocations
+reuse the same path while changed bytes select a new path. Older snapshots are
+retained and are not current artifact evidence. A concurrent refresh of
+canonical prepared files therefore cannot change the bytes consumed by an
+in-flight invocation.
 For a canonical party, preparation retains the validated authored party bytes
 at `inputs/party.yml` and generates `inputs/players.yml` from that roster.
 The manifest records their checksums separately, with the players input marked
@@ -297,6 +442,104 @@ Notarius extraction validates its run-local bundle and moves it once to the
 unique durable bundle path. A pre-existing durable destination is a collision;
 no duplicate promotion tree is created.
 
+`pipeline.notarius.resume` and `pipeline.notarius.chunk_cache` control work
+inside an executed Notarius invocation. Ordinary extraction forwards their
+configured values. Forced extraction always disables checkpoint loading and
+requests chunk-plan `refresh`, even when the configured mode is `bypass`.
+Refresh regenerates and replaces only the active input's accepted chunk plan;
+it is not cache deletion.
+
+Notarius checkpoint recording must be enabled in the deployed Notarius
+configuration. Narratio neither creates a Notarius pipeline/configuration nor
+reads it to infer checkpoint availability. Configure explicit persistent
+Notarius chunk-plan and checkpoint roots when reuse must survive separate
+Narratio subprocesses. A changed reference, transcript, selected profile,
+profile content, endpoint, or other Notarius checkpoint identity input can
+produce a legitimate cold miss.
+
+There are two independent resume boundaries: Narratio may skip a completed
+`extract` stage without invoking Notarius, while `--resume` allows Notarius to
+reuse compatible accepted work only after Narratio has decided extraction must
+execute. Deleting Narratio's local reference snapshots does not invalidate a
+complete durable extraction; missing snapshots are reconstructed only when a
+later extraction actually runs.
+
+## Migrating Manifest Overlay Provenance
+
+The pipeline-selection rename is a clean cutover. Manifests containing
+`effective_config.selected_profile` are rejected by strict decoding; Narratio
+does not silently discard or translate that retired field.
+
+Before using an affected local session with the new version:
+
+1. Stop Narratio activity for the session and back up its manifest.
+2. Rename only `effective_config.selected_profile` to `selected_overlay`, keeping
+   its `name` and `source`, or remove the retired informational member. If a
+   current `selected_overlay` member already exists, retain it and remove the
+   retired member rather than creating duplicate keys.
+3. Preserve the schema version, digest, stage records, checkpoint evidence,
+   output references, and other session state. Retry the intended command.
+
+This metadata is informational, not resume authority. Do not delete session
+progress or force all stages merely to perform this migration. Other unknown
+fields still require investigation rather than blanket removal.
+
+Do not edit immutable remote committed snapshots. Restoring an older snapshot
+with retired provenance requires a compatible previous Narratio version, followed
+by migration of the restored local manifest before using the new version.
+
+## Migrating Audita and Provider Credentials
+
+This is a breaking clean cutover to Audita v2. Narratio does not translate an
+Audita v1 configuration, retain old field aliases, or generate a downstream
+configuration. Update both the deployed Audita executable/configuration and
+the Narratio pipeline before running polish. Retired Narratio fields are
+rejected by strict configuration loading; account for this break when choosing
+a release version.
+
+| Previous Narratio setting | New ownership and selection |
+| --- | --- |
+| `audita.base_url` | Audita v2 `backends.<id>.endpoint` |
+| `audita.total_llm_concurrency`, `proposal_llm_concurrency`, `validation_llm_concurrency` | Audita v2 `backends.<id>.concurrency` and optional `queue_capacity`; backend capacity is shared across roles |
+| `audita.model`, `validation_model` | Audita PromptKit profile files; optionally select them from Narratio with `audita.proposal_profile` and `validation_profile` |
+| `audita.llm_api_key` | `audita.credentials: [PROVIDER_KEY_NAME]`, matching each Audita backend's `credential` name |
+| `notarius.llm_api_key` | `notarius.credentials: [PROVIDER_KEY_NAME]`, matching references in Notarius-owned profiles |
+| `audita.work_dir_retention`, `report` | Remove; Audita's external configuration owns diagnostics and reporting |
+
+An Audita configuration can also be selected through `audita.config_path`,
+and `audita.overlay` selects an Audita overlay independently of Narratio's
+`--overlay`. Narratio forwards no implicit provider key: a single provider-named
+secret source may be listed for both adapters, and an Audita-only backend key
+may be listed only for Audita. Audita resolves credentials for all configured
+backends, including those not currently selected. Notarius looks up its own
+profiles; Narratio does not discover their credential names. Credential lists
+may be cleared with `[]` in a Narratio overlay.
+
+Prepare the external file from Audita's maintained
+[local example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/minimal-config.yml),
+[service example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/production-config.yml),
+and [v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+Before switching the executable, validate the file offline:
+
+```bash
+audita config validate --config /usr/local/etc/audita/config.yml
+```
+
+Use `audita config print-effective --config /usr/local/etc/audita/config.yml --view profiles`
+to inspect downstream profile selection without contacting a provider. For a
+production Audita configuration, leave ordinary reports enabled
+and debug disabled unless an operator deliberately chooses otherwise; Narratio
+does not override those settings. Audita writes `errors.yml`, `recoveries.yml`,
+and `report.md` beside the polished output when reporting is enabled. An
+exit-zero run with a valid transcript succeeds even if those reports describe
+recoverable errors or no applied corrections. See the [Audita integration
+contract](./integrations/audita.md) for report placement and limits.
+
+Narratio's polish resume evidence tracks selected config path, Audita overlay,
+profiles, ordered modules, description, schema, and output identity. Editing
+Audita-owned files behind unchanged selectors is invisible to Narratio; force
+polish with `narratio run-stage polish <session-id> --force` after such edits.
+
 ## External Command Lifecycle
 
 When an external command is cancelled or times out, Narratio terminates its
@@ -314,6 +557,9 @@ tree and reports which stream exceeded the limit.
 
 Run-local diagnostics are:
 
+- `runs/{run_id}/polish/outputs/transcripts/errors.yml`,
+  `recoveries.yml`, and `report.md` when Audita writes them beside its
+  run-local polished transcript
 - `runs/{run_id}/extract/notarius.receipt.json`
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
@@ -327,6 +573,10 @@ Unlisted files and unsafe entries are never uploaded; a run with no declared
 current-run diagnostics uploads no run-local files. No distinguished diagnostic
 file is uploaded. The durable bundle is never scanned for implicit publication;
 only lanes named by explicit `pipeline.publish.outputs` rules are uploaded.
+To inspect a published polish report remotely, read its declared object under
+the run archive's `polish/outputs/transcripts/` prefix. Session restore does
+not restore run-archive diagnostics as canonical session files; it restores only
+the committed manifest and declared transcript/artifact objects.
 
 To intentionally replace the current extraction result, run:
 
@@ -337,13 +587,13 @@ narratio run-stage extract 2026-04-04 --force
 Narratio automatically reruns extraction when its recorded invocation contract,
 prepared Narratio reference identities, or durable output validation changes.
 The semantic portion covers Notarius enablement, pipeline identity, declared
-reference mapping, and output contracts. Executable, timeout, working directory,
-and private config-file paths are operational and do not invalidate a current
-result.
-It cannot fingerprint configuration files, profiles, prompts, modules, or
+reference mapping, output contracts, and the explicit Notarius configuration
+profile selector. Executable, timeout, working directory, and private
+config-file paths are operational and do not invalidate a current result.
+It cannot fingerprint configuration or profile contents, prompts, modules, or
 other references loaded transitively by Notarius itself. Force extraction after
-changing any of those inputs, even when the top-level Narratio and Notarius
-config paths remain the same. A forced extract
+changing any of those inputs behind an unchanged selector, even when the
+top-level Narratio and Notarius config paths remain the same. A forced extract
 marks successful downstream stages stale. Ordinary extraction failures or
 outcome changes also stale affected downstream stages, while an identical
 repeated `notarius_disabled` self-skip does not repeatedly invalidate them.
@@ -509,6 +759,7 @@ Durable session paths:
 - `logs/**`
 - `config/**`
 - `runs/**`
+- `cache/notarius/references/<sha256>/<prepared-basename>`
 
 `manifest.json` is the versioned session-progress document. Narratio accepts
 only `narratio.session-manifest.v1`. Do not edit unsupported session state to
@@ -519,6 +770,13 @@ relevant workflow requires.
 Validated Notarius bundles live below `artifacts/notarius/{run_id}/`; receipt,
 stderr, and pre-promotion output remain in the producing run's `extract`
 directory as described in [Extraction Workflow](#extraction-workflow).
+Stable reference snapshots live in the session cache path above. Ordinary
+published-run cleanup removes its selected run-local target but retains this
+cache, and publish/restore never enumerate it as an artifact. Remove a snapshot
+or digest directory manually only while no command is active for the session;
+regular missing or corrupt content is reconstructed on the next executed
+extraction, while symlinks, directories, and other unsafe conflicts must be
+investigated and removed deliberately.
 
 Run-local layout:
 
@@ -572,9 +830,10 @@ files. Existing environment variables—including empty values—always win.
 S3 `access_key_id` and `secret_access_key` are an optional pair of typed
 environment references. When both are absent, the AWS SDK retains its default
 credential provider chain. When both are configured, Narratio supplies their
-load-time resolved values through an explicit static provider. Audita's optional
-`llm_api_key` is likewise captured at pipeline load and supplied only through
-the child process's `AUDITA_LLM_API_KEY` override.
+load-time resolved values through an explicit static provider. Audita and
+Notarius credential lists likewise resolve at pipeline load. Each adapter
+receives only its listed names and captured values, with no alias mapping or
+ambient environment inheritance. See [configuration](./config.md#audita-selection-and-credentials).
 
 External adapter results are individually bounded before Narratio validates or
 materializes them. These per-file limits do not reserve disk space: prevent hard

docs/oss/attribution.md

@@ -0,0 +1,213 @@
+# Open Source Attribution Notices
+
+## Standard Repository Policies
+
+Material: `docs/policy/agents.md`, `architecture.md`, `documentation.md`,
+`testing.md`, `release.md`, `meta.md`, and `oss.md`; root `AGENTS.md` and the policy reading
+guide in `docs/development.md`, adapted for this repository.
+
+Copyright (C) 2026 Eric Rakestraw
+
+SPDX-License-Identifier: CC-BY-SA-4.0
+
+License and notices: [CC BY-SA 4.0](licenses/CC-BY-SA-4.0.txt) |
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/COPYRIGHT) |
+[LICENSE](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/LICENSE).
+
+[Source](https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843).
+
+## ConfigKit
+
+Selected module: `gitea.maximumdirect.net/eric/ConfigKit` at `v0.4.2`.
+
+Copyright (C) 2026 Eric Rakestraw
+
+SPDX-License-Identifier: LGPL-3.0-or-later
+
+License and notices: [LGPL 3.0](licenses/LGPL-3.0.txt) |
+[GPL 3.0](licenses/GPL-3.0.txt) |
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/67c03690181c5af8dde6be325abac241dae6732f/COPYRIGHT) |
+[LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/67c03690181c5af8dde6be325abac241dae6732f/LICENSE).
+
+[Source](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/67c03690181c5af8dde6be325abac241dae6732f).
+
+## YAML v3
+
+Selected module: `gopkg.in/yaml.v3` at `v3.0.1`.
+
+Copyright (c) 2006-2010 Kirill Simonov
+
+Copyright (c) 2006-2011 Kirill Simonov
+
+Copyright (c) 2011-2019 Canonical Ltd
+
+Copyright 2011-2016 Canonical Ltd.
+
+SPDX-License-Identifier: MIT AND Apache-2.0
+
+License and notices: [MIT](licenses/MIT.txt) |
+[Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE](https://github.com/go-yaml/yaml/blob/f6f7691b1fdeb513f56608cd2c32c51f8194bf51/LICENSE) |
+[NOTICE](https://github.com/go-yaml/yaml/blob/f6f7691b1fdeb513f56608cd2c32c51f8194bf51/NOTICE).
+
+[Source](https://github.com/go-yaml/yaml/commit/f6f7691b1fdeb513f56608cd2c32c51f8194bf51).
+
+## YAML v4
+
+Selected module: `go.yaml.in/yaml/v4` at `v4.0.0-rc.6`.
+
+Copyright 2006-2010 Kirill Simonov
+
+Copyright 2011-2019 Canonical Ltd
+
+Copyright 2025 The go-yaml Project Contributors
+
+SPDX-License-Identifier: MIT AND Apache-2.0
+
+License and notices: [MIT](licenses/MIT.txt) |
+[Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE](https://github.com/yaml/go-yaml/blob/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125/LICENSE) |
+[NOTICE](https://github.com/yaml/go-yaml/blob/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125/NOTICE).
+
+[Source](https://github.com/yaml/go-yaml/commit/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125).
+
+## go-cmp
+
+Selected module: `github.com/google/go-cmp` at `v0.7.0` (test-only).
+
+Copyright (c) 2017 The Go Authors. All rights reserved.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/google/go-cmp/blob/9b12f366a942ebc7254abc7f32ca05068b455fb7/LICENSE).
+
+[Source](https://github.com/google/go-cmp/commit/9b12f366a942ebc7254abc7f32ca05068b455fb7).
+
+## Go sync extension
+
+Selected module: `golang.org/x/sync` at `v0.22.0`.
+
+Copyright 2009 The Go Authors.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/golang/sync/blob/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0/LICENSE) |
+[PATENTS](https://github.com/golang/sync/blob/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0/PATENTS).
+
+[Source](https://github.com/golang/sync/commit/1eb64d4bc0cde6da1bb8ebc7f178bb577508e5d0).
+
+## Go system extension
+
+Selected module: `golang.org/x/sys` at `v0.47.0`.
+
+Copyright 2009 The Go Authors.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/golang/sys/blob/9e7e939dcafac07e8ab4cffa6e5fc74908413f00/LICENSE) |
+[PATENTS](https://github.com/golang/sys/blob/9e7e939dcafac07e8ab4cffa6e5fc74908413f00/PATENTS).
+
+[Source](https://github.com/golang/sys/commit/9e7e939dcafac07e8ab4cffa6e5fc74908413f00).
+
+## Go runtime and standard library
+
+Material: Go `1.26.7` runtime and standard library material incorporated in
+release binaries built with the declared `golang:1.26.7` CI toolchain.
+
+Copyright 2009 The Go Authors.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/golang/go/blob/e3336a22ad3f0a90bd252c95d8b5544e02674205/LICENSE) |
+[PATENTS](https://github.com/golang/go/blob/e3336a22ad3f0a90bd252c95d8b5544e02674205/PATENTS).
+
+[Source](https://github.com/golang/go/commit/e3336a22ad3f0a90bd252c95d8b5544e02674205).
+
+## AWS SDK for Go v2
+
+Selected modules under `github.com/aws/aws-sdk-go-v2` at source revision
+`2223642aeafb3b46ae924667ee47d31a1cf5a9d5`: root `v1.41.7`,
+`aws/protocol/eventstream` `v1.7.10`, `config` `v1.32.17`, `credentials`
+`v1.19.16`, `feature/ec2/imds` `v1.18.23`, `internal/configsources`
+`v1.4.23`, `internal/endpoints/v2` `v2.7.23`, `internal/v4a` `v1.4.24`,
+`service/internal/accept-encoding` `v1.13.9`, `service/internal/checksum`
+`v1.9.15`, `service/internal/presigned-url` `v1.13.23`,
+`service/internal/s3shared` `v1.19.23`, `service/signin` `v1.0.11`,
+`service/sso` `v1.30.17`, `service/ssooidc` `v1.35.21`, and `service/sts`
+`v1.42.1`.
+
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+Copyright 2014-2015 Stripe, Inc.
+
+SPDX-License-Identifier: Apache-2.0
+
+License and notices: [Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE.txt](https://github.com/aws/aws-sdk-go-v2/blob/2223642aeafb3b46ae924667ee47d31a1cf5a9d5/LICENSE.txt) |
+[NOTICE.txt](https://github.com/aws/aws-sdk-go-v2/blob/2223642aeafb3b46ae924667ee47d31a1cf5a9d5/NOTICE.txt).
+
+[Source](https://github.com/aws/aws-sdk-go-v2/commit/2223642aeafb3b46ae924667ee47d31a1cf5a9d5).
+
+## AWS SDK for Go v2 S3
+
+Selected module: `github.com/aws/aws-sdk-go-v2/service/s3` at `v1.101.0`.
+
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+Copyright 2014-2015 Stripe, Inc.
+
+SPDX-License-Identifier: Apache-2.0
+
+License and notices: [Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE.txt](https://github.com/aws/aws-sdk-go-v2/blob/84ddd08980744ac0f3bacfe7d2796c861671accc/service/s3/LICENSE.txt) |
+[NOTICE.txt](https://github.com/aws/aws-sdk-go-v2/blob/84ddd08980744ac0f3bacfe7d2796c861671accc/NOTICE.txt).
+
+[Source](https://github.com/aws/aws-sdk-go-v2/commit/84ddd08980744ac0f3bacfe7d2796c861671accc).
+
+## AWS Smithy Go
+
+Selected module: `github.com/aws/smithy-go` at `v1.25.1`.
+
+Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+SPDX-License-Identifier: Apache-2.0
+
+License and notices: [Apache 2.0](licenses/Apache-2.0.txt) |
+[LICENSE](https://github.com/aws/smithy-go/blob/e094f45e716e33a1b950cf8bbe804790bf87f965/LICENSE) |
+[NOTICE](https://github.com/aws/smithy-go/blob/e094f45e716e33a1b950cf8bbe804790bf87f965/NOTICE).
+
+[Source](https://github.com/aws/smithy-go/commit/e094f45e716e33a1b950cf8bbe804790bf87f965).
+
+## Go singleflight in AWS SDK for Go v2
+
+Material: `internal/sync/singleflight` in the selected AWS SDK root module.
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Copyright 2013 The Go Authors. All rights reserved.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/aws/aws-sdk-go-v2/blob/2223642aeafb3b46ae924667ee47d31a1cf5a9d5/internal/sync/singleflight/LICENSE).
+
+[Source](https://github.com/aws/aws-sdk-go-v2/commit/2223642aeafb3b46ae924667ee47d31a1cf5a9d5).
+
+## Go singleflight in AWS Smithy Go
+
+Material: `internal/sync/singleflight` in the selected smithy-go module.
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Copyright 2013 The Go Authors. All rights reserved.
+
+SPDX-License-Identifier: BSD-3-Clause
+
+License and notices: [BSD 3-Clause](licenses/BSD-3-Clause.txt) |
+[LICENSE](https://github.com/aws/smithy-go/blob/e094f45e716e33a1b950cf8bbe804790bf87f965/internal/sync/singleflight/LICENSE).
+
+[Source](https://github.com/aws/smithy-go/commit/e094f45e716e33a1b950cf8bbe804790bf87f965).

docs/oss/licenses/Apache-2.0.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

docs/oss/licenses/BSD-3-Clause.txt

@@ -0,0 +1,11 @@
+Copyright (c) <year> <owner>. 
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

docs/oss/licenses/CC-BY-SA-4.0.txt

@@ -0,0 +1,170 @@
+Creative Commons Attribution-ShareAlike 4.0 International
+
+ Creative Commons Corporation (“Creative Commons”) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is” basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.
+
+Considerations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors.
+
+Considerations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described.
+
+Although not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public.
+
+Creative Commons Attribution-ShareAlike 4.0 International Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.
+
+Section 1 – Definitions.
+
+     a.	Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.
+
+     b.	Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.
+
+     c.	BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License.
+
+     d.	Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.
+
+     e.	Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.
+
+     f.	Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.
+
+     g.	License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike.
+
+     h.	Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.
+
+     i.	Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.
+
+     j.	Licensor means the individual(s) or entity(ies) granting rights under this Public License.
+
+     k.	Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.
+
+     l.	Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.
+
+     m.	You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.
+
+Section 2 – Scope.
+
+     a.	License grant.
+
+          1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:
+
+               A. reproduce and Share the Licensed Material, in whole or in part; and
+
+               B. produce, reproduce, and Share Adapted Material.
+
+          2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.
+
+          3. Term. The term of this Public License is specified in Section 6(a).
+
+          4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.
+
+          5. Downstream recipients.
+
+               A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.
+
+               B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter’s License You apply.
+
+               C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.
+
+          6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).
+
+     b.	Other rights.
+
+          1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.
+
+          2. Patent and trademark rights are not licensed under this Public License.
+
+          3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.
+
+Section 3 – License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the following conditions.
+
+     a.	Attribution.
+
+          1. If You Share the Licensed Material (including in modified form), You must:
+
+               A. retain the following if it is supplied by the Licensor with the Licensed Material:
+
+                    i.	identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);
+
+                    ii.	a copyright notice;
+
+                    iii. a notice that refers to this Public License;
+
+                    iv.	a notice that refers to the disclaimer of warranties;
+
+                    v.	a URI or hyperlink to the Licensed Material to the extent reasonably practicable;
+
+               B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and
+
+               C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.
+
+          2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.
+
+          3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.
+
+     b.	ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply.
+
+          1. The Adapter’s License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License.
+
+          2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material.
+
+          3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply.
+
+Section 4 – Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:
+
+     a.	for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;
+
+     b.	if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and
+
+     c.	You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.
+For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.
+
+Section 5 – Disclaimer of Warranties and Limitation of Liability.
+
+     a.	Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.
+
+     b.	To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.
+
+     c.	The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.
+
+Section 6 – Term and Termination.
+
+     a.	This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.
+
+     b.	Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:
+
+          1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or
+
+          2. upon express reinstatement by the Licensor.
+
+     c.	For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.
+
+     d.	For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.
+
+     e.	Sections 1, 5, 6, 7, and 8 survive termination of this Public License.
+
+Section 7 – Other Terms and Conditions.
+
+     a.	The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.
+
+     b.	Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.
+
+Section 8 – Interpretation.
+
+     a.	For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.
+
+     b.	To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.
+
+     c.	No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.
+
+     d.	Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.
+
+Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.” Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons” or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

docs/oss/licenses/GPL-3.0.txt

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

docs/oss/licenses/LGPL-3.0.txt

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

docs/oss/licenses/MIT.txt

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

docs/policy/agents.md

@@ -0,0 +1,79 @@
+# Agent Policy
+
+**Base Policy Version:** 1.3
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/agents.md
+
+## Purpose
+
+Agents must read and follow these rules.
+
+## Implementation Discipline
+
+**KEY PRINCIPLES:** Write the simplest idiomatic code that satisfies the user's
+request. Do not implicitly strengthen requirements, restrictions, or guarantees
+beyond what the user actually requested.
+
+**Keep implementation machinery proportionate.** Use straightforward,
+idiomatic code and introduce only the machinery needed to support the requested
+behavior and flexibility. Optimize for conceptual simplicity and
+maintainability, not for the fewest lines, fewest options, or narrowest product
+surface.
+
+**Do not invent restrictions.** Do not reject, prohibit, constrain, cap,
+harden, or otherwise narrow behavior unless required by the user, an explicit
+repository contract, or an unavoidable correctness constraint. Preserve
+operator and caller choice where policy has not been established. If an
+additional restriction appears advisable, present it as a decision rather than
+silently implementing it.
+
+**Do not invent guarantees.** Do not strengthen public contracts, guarantees,
+or invariants beyond those expressly requested by the user.
+
+**Use the standard library.** For example: in almost every case, the best
+approach to copying files is to use the standard library. Writing custom code to
+implement power-loss protection at the application level, or to guard against
+bad actors with privileged and concurrent access to the host's filesystem,
+is wasteful, unnecessary, and not idiomatic. Stick to the simple, standard, and
+idiomatic approach unless another path is expressly requested by the user.
+
+**An implementation detail is not repository policy.** Tests and documentation
+must not elevate incidental behavior into a durable guarantee or restriction
+unless that behavior was expressly selected as part of the contract.
+
+## Git Commit Policy
+
+By default, commit each completed, nonempty unit of work using a
+concise, plain-English message describing what changed. This policy is standing
+authorization to create those local commits; a separate user request is not
+required. An explicit user instruction to leave work uncommitted takes precedence.
+
+A unit of work is a focused, reviewable outcome, including its relevant tests and
+documentation.
+Complete the appropriate validation before committing. If work is incomplete or
+validation is blocked, report that state accurately.
+
+Before committing:
+
+1. Run `git status --short` and review the relevant diff, including any staged
+   changes. Identify changes that predate the current unit of work.
+2. Exclude secrets, local environment files, generated junk, and unrelated changes.
+3. Stage only the files or hunks belonging to the completed unit. Use `git add .`
+   only when every included change belongs to that unit. Preserve unrelated
+   staged and unstaged work.
+4. Review `git diff --staged` and run appropriate checks for the change. Reuse
+   successful checks for unchanged content.
+5. Review `git log --oneline -n 10` and use
+   `git commit -m "<concise plain-English commit message>"`.
+6. Report the commit identifier and any remaining uncommitted work.
+
+If the unit cannot be safely separated from pre-existing work, leave it uncommitted
+and explain the overlap rather than silently including that work. If a commit
+fails, preserve the changes and report the failure; do not bypass hooks.
+
+Default commit authorization does not authorize pushing, publishing, amending,
+resetting, reverting, or rewriting history. Those actions require a separate user
+instruction. Do not use `git commit -a` or `git commit --no-verify` to bypass the
+staging and validation discipline above.

docs/policy/architecture.md

@@ -1,10 +1,41 @@
-# Architecture
+# Architecture Policy
 
-This document defines Narratio's intended high-level architecture and the
-invariants that changes must preserve. Implemented component details belong in
-the [Internal Overview](../internal/overview.md) and its linked documents.
-Significant architectural decision history belongs under `docs/adr/` when such
-records exist.
+**Base Policy Version:** 1.3
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/architecture.md
+
+## Purpose And Ownership
+
+The adopted policy defines the application's purpose and the architectural
+constraints contributors must follow. It owns system boundaries, responsibility
+and dependency rules, established invariants, and explicit non-goals.
+
+Describe the concrete package inventory and implementation mechanics in internal
+documentation. Link to canonical public contracts for their exact behavior and
+to ADRs for decision rationale.
+
+## Architectural Approach
+
+Hexagonal architecture is strongly recommended, including encapsulating external
+integrations and APIs within internal adapters. Keep domain and application
+logic independent of external integration details, and make dependency direction
+clear in the adopted policy.
+
+Implement that separation with proportionate, idiomatic code. Choose interfaces
+and package layout to serve the application's actual boundaries. Use adapters
+for collaborators with external integration responsibilities.
+
+## Adopted Constraints And Implemented Structure
+
+Architectural constraints govern current and future development. Record
+implemented structure accurately, proposals and implementation status in the
+roadmap, and significant decisions and rationale in ADRs. Describe a target
+structure as implemented when its changes land.
+
+Constraints must reflect deliberately selected requirements and decisions.
+Do not promote incidental implementation choices into architectural invariants.
 
 ## System Shape
 
@@ -148,13 +179,13 @@ Configuration is strict, explicit, centralized, and operator-oriented.
 - Empty configured values do not silently replace meaningful defaults.
 - Validation rejects invalid configuration before stage execution where
   practical.
-- Root-owned imports and one selected profile resolve deterministically through
+- Root-owned imports and one selected overlay resolve deterministically through
   the configuration owner; commands do not implement their own merge rules.
 - Canonical party rosters are campaign-owned. Their derived players projection
   and concrete character-family artifacts are resolved before runtime stages
   or adapters receive configuration.
 - Resume uses stage- or artifact-owned semantic evidence for observable
-  result-affecting configuration; profile identity and an effective digest are
+  result-affecting configuration; overlay identity and an effective digest are
   provenance, never blanket cache keys.
 - Session templating remains narrow and deterministic rather than becoming a
   general configuration language.

docs/policy/documentation.md

@@ -1,9 +1,15 @@
 # Documentation Policy
 
+**Base Policy Version:** 1.11
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/documentation.md
+
 ## Purpose
 
 This policy assigns each documentation topic to one canonical owner. Its goal is
-to keep Narratio documentation accurate, concise, discoverable, and resistant
+to keep Narratio's documentation accurate, concise, discoverable, and resistant
 to drift for users, operators, developers, integrators, and LLM coding agents.
 
 ## Core Rules
@@ -12,36 +18,38 @@ to drift for users, operators, developers, integrators, and LLM coding agents.
 
 Each authoritative fact belongs in one document. A non-owning document may give
 a short, stable summary for orientation, but it must link to the canonical owner
-instead of repeating volatile details.
+for volatile details.
 
 Volatile details include commands, flags, configuration fields and defaults,
-stage or integration keys, schemas, file names, paths, status codes, retry
-behavior, and runtime guarantees. If readers could reasonably treat a statement
-as a contract, maintain it only in the owning document.
+module keys, schemas, file names, paths, status codes, retry behavior, and
+runtime guarantees. If readers could reasonably treat a statement as a
+contract, maintain it only in the owning document.
 
 ### Current And Future Behavior
 
 Outside `docs/roadmap/`, documentation describes implemented behavior only.
 Partial features may be described only to their implemented boundary.
 
-ADRs are the narrow exception: an ADR may record an accepted architectural
-decision before implementation, but acceptance must not be presented as proof
-that the behavior exists. The roadmap owns implementation status and sequencing
-until the decision is implemented. Current architecture, user, operator,
-integration, and internal documentation are updated when the behavior lands.
+Architectural constraints may govern future changes. Describe current structure
+from implemented behavior.
+
+ADRs may record an accepted architectural decision before implementation. The
+roadmap owns implementation status and sequencing until the decision is
+implemented. Current architecture, user, operator, integration, and internal
+documentation are updated when the behavior lands.
 
 ### Audience And Detail
 
 Write for the document's stated audience and include only the detail needed for
-its owned topic. User and operator docs should not expose implementation detail.
-Developer docs should link to user-facing and external contracts rather than
-restate them.
+its owned topic. Keep user and operator docs focused on using and operating the
+application. Developer docs should link to user-facing and external contracts
+for their definitions.
 
 ### Examples
 
 Complete copyable files belong in `examples/`. Documentation may use the
 smallest illustrative snippet needed to explain its owned topic, but should link
-to maintained examples instead of embedding a second complete copy.
+to maintained examples for complete copyable files.
 
 Examples must be valid, secret-free, and tested where practical. Commands and
 configuration used in documentation should match the application.
@@ -57,53 +65,69 @@ secret values.
 
 | Topic | Canonical owner | Owned content | Content owned elsewhere |
 | --- | --- | --- | --- |
-| Product orientation and minimal end-to-end quickstart | `README.md` | What Narratio is, why it is useful, one shortest successful invocation, and links onward. | Complete command reference, configuration reference, operational procedures, implementation detail. |
-| Contributor entry point | `docs/development.md` | Task-oriented reading guide, minimal contributor orientation, baseline validation commands, and links to canonical docs. | Package inventory, architecture rules, subsystem behavior, detailed change recipes. |
-| Maintainer release procedure | `docs/release.md` | Version selection, candidate preparation and validation, guarded tag publication, release completion boundary, failure recovery, and optional asynchronous inspection. | Script implementation mechanics, current application contracts, and historical release summaries. |
-| Historical release summary | `docs/releases/<tag>.md` | Immutable summary, compatibility, upgrade, and changes for one released version. | Current maintainer procedure and current application contract details. |
-| Current application architecture | `docs/policy/architecture.md` | System shape, normative ownership, dependency direction, architectural boundaries, invariants, safety properties, and non-goals. | Concrete package inventory, implementation mechanics, contributor procedures, decision history, future work. |
-| Documentation organization | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
-| Testing policy | `docs/policy/testing.md` | Test philosophy, risk-based sufficiency, test boundaries, doubles, coverage guidance, regression-test policy, and criteria for adding, rewriting, or deleting tests. | Subsystem behavior, application contracts, subsystem-specific test inventories, and implementation plans. |
-| CLI contract | `docs/cli.md` | Commands, arguments, flags, invocation semantics, output conventions, and exit behavior. | End-to-end operating procedures, configuration field definitions, runtime filesystem layout, stage implementation details. |
-| Configuration contract | `docs/config.md` | Discovery and precedence, file schemas, fields, defaults, environment overrides, validation rules, and user-selectable stage or integration settings. | Complete example files, CLI syntax, runtime state lifecycle, implementation details. |
-| Operations | `docs/operations.md` | Runtime workflows, physical filesystem and remote-state layout, output and diagnostic handling, resume, cleanup, permissions, recovery, and operational limits. | CLI flag syntax, configuration field definitions, logical artifact schemas, implementation mechanics. |
-| Troubleshooting | `docs/troubleshooting.md` | Symptom-driven diagnosis, likely causes, safe inspection steps and remedies, and links to relevant contracts. | CLI syntax, configuration definitions, operational procedures, integration contracts, implementation mechanics. |
-| Public HTTP contract, if introduced | `docs/api.md` | Routes, authentication, media types, request and response schemas, status codes, pagination, caching, idempotency, rate limits, and HTTP retry semantics. | Client walkthroughs, upstream or downstream integration internals, implementation detail. |
-| Consumer guidance, if a public package or API is introduced | `docs/consumers/` | Task-oriented use of the public interface, minimal client examples, and consumer responsibilities. | HTTP wire semantics, external protocol contracts, internal implementation detail. |
-| External and durable integration contracts | `docs/integrations/` | External file formats and protocols, upstream and downstream contracts, logical artifact paths and schemas, media types, and compatibility behavior. | Physical runtime placement and lifecycle, internal transformations, CLI syntax, configuration defaults. |
-| Implemented component inventory | `docs/internal/overview.md` | Current packages and components, their implemented responsibilities, and links to focused internal docs. | Normative architecture, contributor reading policy, external contracts. |
-| Internal component behavior | Other files under `docs/internal/` | Implementation flow, internal collaborators and state transitions, package-local guarantees and failures, and relevant tests. | Global architecture invariants, configuration definitions and defaults, external schemas, operator procedures. |
-| Architectural decision history | `docs/adr/` | Significant decisions, context, alternatives, rationale, consequences, and supersession history. | Current behavior reference, implementation status, task sequencing. |
-| Future work and implementation status | `docs/roadmap/` | Proposed, accepted, deferred, or rejected work; implementation status; sequencing; and task breakdowns. | Implemented behavior reference and architectural decision rationale. |
-| Complete copyable artifacts | `examples/` | Maintained configuration, inputs, and other files intended to be copied or run. | Field-by-field reference, command reference, prose explanation. |
+| Product orientation and minimal end-to-end quickstart | `README.md` | Purpose, value, shortest successful invocation, and navigation, including licensing and attribution. | Complete command reference, configuration reference, operational procedures, implementation detail. |
+| Contributor entry point | `docs/development.md` | Task-oriented reading guide, contributor orientation, baseline validation commands, and canonical links. | Package inventory, architecture rules, subsystem behavior, detailed change recipes. |
+| Application architecture policy | `docs/policy/architecture.md` | System shape, normative ownership, dependency direction, boundaries, invariants, safety properties, and non-goals. | Concrete package inventory, implementation mechanics, contributor procedures, decision history, future work. |
+| Policy-set provenance and upstream navigation | `docs/policy/meta.md` | Policy-set origin, local authority, adoption baselines, and upstream adoption and update links. | Task-specific reading triggers, detailed adoption procedures, and formal attribution notices. |
+| Agent policy | `docs/policy/agents.md` | Proportionate, idiomatic implementation; rules against inventing requirements, restrictions, guarantees, or policy. | Application contracts, architecture, testing policy, and contributor procedures. |
+| Documentation policy | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
+| Testing policy | `docs/policy/testing.md` | Test philosophy, risk sufficiency, boundaries, doubles, coverage, regressions, and test maintenance. | Subsystem behavior, application contracts, subsystem-specific test inventories, and implementation plans. |
+| Release policy | `docs/policy/release.md` | Versioning, compatibility, release integrity and immutability, release documentation, proportionate gates, publication controls, completion, and required versus optional checks. | Repository-specific commands, product installation guidance, CLI version semantics, historical release summaries, and CI implementation detail. |
+| Open source licensing and attribution policy | `docs/policy/oss.md` | License defaults and author choices, COPYRIGHT and attribution formats, license/notice links, discoverability, maintenance, and concrete exceptions. | Component entries, license texts, release commands, and dependency security review. |
+| Project copyright and license grant | `COPYRIGHT` | Project identity, copyright holders and years, SPDX expression, grant, warranty disclaimer, and third-party statement. | Complete license texts and upstream component attribution. |
+| Project license text | `LICENSE` | Complete GPLv3 project license text. | Companion dependency license texts and upstream component attribution. |
+| Upstream component attribution | `docs/oss/attribution.md` | House Format component entries: identity, material scope and modifications where applicable, copyright, license, required notices, and license, notice, and source links. | General attribution policy, exception reasoning, research narratives, compliance commentary, and complete standard license texts. |
+| Standard dependency license texts | `docs/oss/licenses/` | Complete, verbatim standard license texts shared by applicable entries. | Project-specific upstream notices, attribution prose, and policy interpretation. |
+| Repository-specific release procedure | `docs/release.md` | Maintainer prerequisites, candidate preparation, validation and publication commands and automated guards, asynchronous deliverables, delivery status, optional consumer verification, and recovery. | General release requirements, product installation guidance, historical release summaries, and current compatibility contracts. |
+| CLI contract (if applicable) | `docs/cli.md` | Commands, arguments, flags, invocation semantics, and exit codes. | End-to-end operating procedures, configuration field definitions, runtime filesystem layout, module implementation details. |
+| Configuration contract (if applicable) | `docs/config.md` | Discovery, precedence, schema, fields, defaults, environment overrides, validation, and selectable module and validator keys. | Complete example files, CLI syntax, runtime state lifecycle, module implementation details. |
+| Operations | `docs/operations.md` | Runtime workflows, physical filesystem and state layout, output, cache and debug handling, resume, cleanup, permissions, recovery, and limits. | CLI flag syntax, configuration field definitions, logical output schemas, implementation mechanics. |
+| Troubleshooting | `docs/troubleshooting.md` | Symptom-driven diagnosis, likely causes, safe inspection, and remedies. | Canonical commands, configuration definitions, operational procedures, and integration contracts. |
+| Integration contracts for external components (if applicable) | `docs/integrations/` | External formats and protocols, upstream and downstream contracts, logical output paths and schemas, media types, and compatibility. | Physical runtime placement and lifecycle, internal transformations, CLI syntax, configuration defaults. |
+| Inventory of implemented internal packages | `docs/internal/overview.md` | Implemented packages and components, responsibilities, and links to focused internal docs. | Normative architecture, contributor reading policy, external contracts. |
+| Behavior and architecture of internal packages | Other files under `docs/internal/` | Implementation flow, collaborators, state transitions, package-local guarantees and failures, and relevant tests. | Global architecture invariants, configuration definitions and defaults, external schemas, operator procedures. |
+| Architectural decision records | `docs/adr/` | Significant decisions, context, alternatives, rationale, consequences, and supersession history. | Current behavior reference, implementation status, task sequencing. |
+| Future work and implementation status | `docs/roadmap/` | Proposed, accepted, deferred, or rejected work; implementation status, sequencing, and task breakdowns. | Implemented behavior reference and architectural decision rationale. |
+| Release-note history | `docs/releases/` | One checked-in summary per source release under the procedure; the note at its immutable tag is the release record. | Current commands, behavior, contracts, and compatibility definitions. |
+| Complete copyable artifacts | `examples/` | Maintained configuration, inputs, and other copyable or runnable files. | Field-by-field reference, command reference, prose explanation. |
 
-Documents that do not exist are required only when the corresponding interface
-or responsibility exists. Do not create placeholder API, consumer, integration,
-or operations documents for behavior the application does not have.
+Create supporting documents for existing interfaces and responsibilities when
+substantive content is available.
 
 ## Boundary Rules
 
 ### Orientation
 
-The README owns product orientation. The developer guide routes contributors.
-Architecture owns normative structure. Internal overview owns the current
-concrete component map. These documents may link to one another but should not
-maintain parallel package or behavior descriptions.
+Link among orientation, architecture, and internal documents; maintain each
+package or behavior description in its canonical owner.
 
 ### Commands, Configuration, Operations, And Troubleshooting
 
 CLI documentation answers how to invoke the application. Configuration
 documentation answers what settings mean. Operations answers what happens to
-runtime state and how to operate or recover the application. Troubleshooting
-starts from observable symptoms and links readers to the owning command,
-configuration, operational, or integration contract. When a workflow crosses
-these topics, choose the document that owns the task and link to the other
-contracts.
+runtime state and how to operate or recover the application. When a workflow
+crosses these topics, choose the document that owns the task and link to the
+other contracts. Troubleshooting begins with observable symptoms and links to the owning contract.
+
+### Releases
+
+The release policy defines requirements and invariants that every release must
+satisfy. The repository-specific release procedure defines the commands and
+workflow maintainers use to satisfy that policy. Release notes record history
+at immutable tags. Maintain current behavior in its canonical documentation,
+update it with the corresponding behavior changes, and keep release procedures
+consistent with adopted policy.
+
+### Project Licensing And Upstream Attribution
+
+README and release documents link to the canonical licensing and attribution
+materials under the [OSS policy](oss.md). The release procedure owns URL
+construction and publication mechanics.
 
 ### Contracts And Implementation
 
 Integration and API documents define externally observable shapes and
-semantics. Internal documents explain how Narratio implements or consumes those
+semantics. Internal documents explain how this application implements or consumes those
 contracts. Internal docs may name a field, file, or protocol to identify a
 dependency, but must link to its canonical contract for the definition.
 
@@ -112,8 +136,7 @@ dependency, but must link to its canonical contract for the definition.
 This policy owns what documentation and examples may contain. Architecture owns
 application security invariants. Configuration owns credential-supply
 mechanisms. Operations owns permissions and handling of sensitive runtime
-artifacts. Troubleshooting owns safe diagnostic and remediation guidance.
-Internal docs own implementation mechanisms only.
+artifacts. Internal docs own implementation mechanisms only.
 
 ## Architecture Decision Records
 

docs/policy/meta.md

@@ -0,0 +1,27 @@
+# Policy Set Provenance
+
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/meta.md
+
+## Origin And Local Authority
+
+This repository's policy set is adapted from
+[Standard Repository Policies](https://gitea.maximumdirect.net/eric/policy).
+The adopted local policies govern work in this repository. Upstream revisions
+become local policy through deliberate adoption, preserving local decisions.
+Each policy's `Upstream Source` identifies its adopted baseline.
+
+## Adoption And Updates
+
+For policy adoption, upstream revision reviews, and updates, consult the
+[upstream adoption and update guide](https://gitea.maximumdirect.net/eric/policy/src/branch/main/docs/adoption.md).
+That guide and the reference example collection are maintained upstream and
+accessed through links. Keep discovery links pointed at the current upstream
+project and guide; keep adopted-source and example links pinned to commits.
+
+The local [developer guide](../development.md) routes tasks to applicable
+policies. Formal credit and licensing notices for the copied policy material
+belong in the local [attribution document](../oss/attribution.md).

docs/policy/oss.md

@@ -0,0 +1,217 @@
+# Open Source Licensing And Attribution Policy
+
+**Base Policy Version:** 1.8
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/oss.md
+
+## Purpose And Scope
+
+This policy defines project licensing conventions and a repeatable House Format
+for upstream attribution and license notices. It covers the project's own code
+and upstream components incorporated into or distributed with the application
+or library, including relevant transitive dependencies and copied code,
+documentation, or assets.
+Determine treatment from the component's terms and actual use.
+
+Consulting development guidance or using tooling alone does not require an
+attribution entry. Copying or adapting documentation for inclusion in the
+repository is different: preserve its applicable attribution and license terms.
+A material's role as development guidance does not exempt copied documents.
+Apply any express permissions for attribution-free reuse of example formatting.
+
+The baseline is a publicly available source repository with releases published
+alongside it. The format is independent of language, forge, and build system.
+It does not require attribution for every development tool, establish license
+compatibility, or resolve every obligation arising from use or distribution.
+
+## Canonical Locations
+
+The [documentation policy](documentation.md) assigns ownership:
+
+- `COPYRIGHT`: project name, copyright statements, SPDX expression, grant,
+  warranty disclaimer, and third-party statement.
+- `LICENSE` contains the complete, unmodified project license text, including
+  incorporated companion text. Dependency attribution does not relicense the project.
+- `docs/oss/attribution.md`: canonical component entries.
+- `docs/oss/licenses/`: complete, verbatim standard and applicable companion texts.
+
+Use recognizable license filenames, such as `Apache-2.0.txt` or `LGPL-3.0.txt`.
+A shared standard text may serve multiple entries. Keep explanations outside
+license texts and preserve distinct versions and exceptions.
+
+## Narratio Licensing Scope
+
+Narratio application code remains GPL-3.0-or-later under its existing
+[COPYRIGHT](../../COPYRIGHT) and [LICENSE](../../LICENSE). Its source and release
+artifacts are hosted on Gitea; separately installed subprocess applications are
+not incorporated merely because Narratio invokes them. The
+[release procedure](../release.md) owns publication mechanics. Policy documents
+adapted from Standard Repository Policies retain CC-BY-SA-4.0 under the distinct
+scope recorded in COPYRIGHT and [attribution](../oss/attribution.md).
+
+## Upstream Reference Examples
+
+Use the commit-pinned upstream examples to create actual project notices.
+Retain their links and keep the example collection upstream; keep applicable
+license texts locally as specified above.
+
+## Project Licensing
+
+Unless the author specifies otherwise, use **GPL version 3 or later**
+(`GPL-3.0-or-later`) for applications and **LGPL version 3 or later**
+(`LGPL-3.0-or-later`) for libraries. An author's explicit choice takes precedence:
+for example, a one-off script may use MIT. Such a choice requires no exception
+rationale, additional approval, or compensating controls under this policy.
+
+These defaults guide new license selection. Adopting this policy does not
+relicense existing code or override third-party terms. Preserve an existing
+license unless the author deliberately changes it. For mixed-purpose projects,
+follow the author's selected scope rather than inferring different licenses for
+individual packages.
+
+Use the upstream [application COPYRIGHT example](https://gitea.maximumdirect.net/eric/policy/src/commit/a469273adda336625f96b9d769ea27b33999f146/examples/licensing/application/COPYRIGHT)
+or [library COPYRIGHT example](https://gitea.maximumdirect.net/eric/policy/src/commit/a469273adda336625f96b9d769ea27b33999f146/examples/licensing/library/COPYRIGHT)
+to create the project’s root `COPYRIGHT` file.
+Use verified project names, contribution years, and copyright holders.
+For another selected license, adapt the grant, SPDX expression, disclaimer, and
+text references together to reflect the author's selected grant.
+
+For GPLv3 projects, copy the complete GPLv3 text into `LICENSE`. For LGPLv3
+projects, place the complete LGPLv3 text followed by the complete GPLv3 text in
+`LICENSE`; the LGPL incorporates the GPL terms. Keep the texts unmodified and
+place project-specific statements in `COPYRIGHT`. For the default grants, the
+grant and SPDX expression in `COPYRIGHT` must expressly identify `or-later`;
+follow the author’s choice if a different grant is selected.
+
+For other licenses, provide their complete text and any required project-specific
+fields; the standard reference collection remains unchanged. Keep `COPYRIGHT`,
+`LICENSE`, SPDX expressions, and README descriptions consistent with the actual
+grant. This convention introduces no blanket requirement for per-file headers;
+preserve notices or add them where the applicable terms require them.
+
+Identify separately licensed documentation or assets in the project grant, with
+links to their attribution and license information. An application's default
+code license does not override the terms of incorporated documentation.
+
+## Upstream Attribution House Format
+
+Begin `docs/oss/attribution.md` with `# Open Source Attribution Notices`,
+followed directly by component entries. These comprise the complete document.
+
+Each entry presents these five fields in order, with blank lines between them:
+
+1. **Project name** as a level-two heading. An optional identification paragraph
+   may follow, such as `Selected module: MODULE at VERSION.` with the module and
+   version in backticks. For copied documentation, a concise `Material:` sentence
+   may identify the affected files and whether they were adapted or copied
+   without modification. A factual qualifier such as `(transitive dependency)`
+   is permitted. Limit optional identification prose to factual component and
+   material scope.
+2. **Upstream copyright statement or statements**, preserving their wording.
+   Put multiple statements in separate paragraphs. Include this field when the
+   selected upstream source supplies an applicable statement; otherwise, omit it.
+3. **SPDX license identifier or expression**, when applicable, using
+   `SPDX-License-Identifier: EXPRESSION`.
+4. **License and notice links**, beginning `License and notices:`, separated
+   by ` | `, and ending with a period. Label local standard texts by license
+   name, such as `MIT` or `Apache 2.0`. Label upstream files by their actual
+   filenames, such as `COPYRIGHT`, `LICENSE`, `NOTICE`, or `PATENTS`.
+5. **Source repository link**, rendered exactly as `[Source](COMMIT_URL).`.
+
+Use the upstream [attribution example](https://gitea.maximumdirect.net/eric/policy/src/commit/a469273adda336625f96b9d769ea27b33999f146/examples/licensing/attribution.md)
+to create the project’s `docs/oss/attribution.md`.
+The example illustrates omitted fields and multiple copyrights and licenses.
+Replace the uppercase placeholders and illustrative URLs with actual component
+information. Local license links are relative to the destination
+`docs/oss/attribution.md`; copy the applicable texts into its `licenses/`
+directory. Do not copy example entries for components the project does not use.
+
+These are five fields, not a line limit. Omit the SPDX field when no applicable
+identifier exists; identify nonstandard terms through the linked text. Preserve
+licensing alternatives and exceptions, and record a selected option when
+relevant through the factual license identification. Do not invent an identifier
+or silently resolve an unsettled licensing choice.
+
+Keep entries factual. Do not add agent-authored explanations of license
+expressions, file-level license scope, research performed, retained source
+notices, or compliance conclusions. Avoid filler such as "none is invented
+here" and embellished link labels such as "upstream LICENSE", "additional
+patent grant", or "at the imported commit". Preserve actual required upstream
+content; this rule excludes editorial additions, not required notices. Policy
+interpretation and exception reasoning belong in the adopted OSS policy or an
+appropriate decision record, not the attribution document.
+
+## License Texts And Upstream Links
+
+Link standard license texts to their local copies. Link project-specific
+notices to their upstream copies. Every upstream repository or notice link must
+identify the exact commit corresponding to the
+imported version, including the selected source revision for copied material.
+
+Classify material according to its contents. An upstream `LICENSE`,
+`COPYING`, or similar file may contain project-specific notices or exceptions
+in addition to standard wording. Link both the local standard text and the
+commit-specific upstream file when needed. Make companion license texts directly
+reachable from the entry.
+
+For project-specific license and attribution material, this policy accepts
+direct links to the applicable upstream texts as satisfying reproduction,
+inclusion, or copy requirements. This is the adopted house interpretation.
+Agents must apply it without adding local-copy requirements or seeking repeated
+approval solely because a license uses those terms.
+
+This interpretation concerns notice reproduction. Concrete obligations such as
+marking modified files or supplying corresponding source receive their own
+applicable treatment. Preserve required notices already present in incorporated
+source files; the central attribution entry does not authorize stripping them.
+
+## Discoverability
+
+End Narratio's README with two friendly statements linking to its actual grant
+in root `COPYRIGHT` and to `docs/oss/attribution.md`, using paths relative to
+the README. The statements identify Narratio's GPL v3.0-or-later grant and make
+the open source attribution notices discoverable.
+
+Each new checked-in release document and its hosted download page must end
+with links whose visible text is `COPYRIGHT | LICENSE | ATTRIBUTION`. Use absolute
+URLs to those files at the release's immutable tag or corresponding immutable source
+revision so the links work in both locations. This release navigation is distinct
+from upstream component links, which must use the imported commit.
+
+Reuse the checked-in release document as the hosted release body where supported.
+The release procedure owns concrete URLs and publication mechanics for delivering
+the links through the selected channel. Do not maintain duplicate notice lists.
+These conventions do not by themselves require separate downloadable license
+assets, source bundles, or a different binary package format.
+
+## Maintenance And Exceptions
+
+Update project licensing statements together when the author changes the grant
+or its scope. Update upstream notices in the change that adds, removes, upgrades,
+copies, or changes the distribution of a relevant component. Check the selected source's license
+and notices rather than assuming they are unchanged. Update affected entries,
+commit links, and texts; retain historical versions through Git.
+
+Check affected statements, faithful standard-text copies, and link destinations
+as part of ordinary change review. For a future release tag, check intended file
+paths against the candidate source; the tag need not resolve remotely before
+publication. Do not add publication-time network checks, CI polling, recurring
+legal sign-offs, mandatory scanners, or a full software bill of materials merely
+to implement this policy.
+
+Use the House Format routinely. Raise an exception only for a concrete obligation
+or unresolved rights question it does not address, including any arising from a
+particular distribution channel. Record the issue and selected treatment in the
+adopted OSS policy or an appropriate decision record. Attribution entries
+contain the resulting factual identification and required material, without
+repeating that reasoning. Resolve the issue before the affected use or
+distribution without reopening settled choices.
+Common ownership of projects is neither required nor a blanket exception.
+
+Apply the formatting convention prospectively. Do not rewrite published tags,
+notes, binaries, or checksums to retrofit it. Address actual omissions deliberately
+under the applicable terms and the [release correction policy](release.md#immutability-and-failure-recovery).
+Ordinary attribution maintenance and release links are preparation work, not new
+release approval gates.

docs/policy/release.md

@@ -0,0 +1,220 @@
+# Release Policy
+
+**Base Policy Version:** 1.4
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/release.md
+
+## Purpose
+
+This policy defines a proportionate workflow for validating and publishing an
+intended source revision under a fresh version. Releases should require little
+routine intervention, avoid repeated work, and preserve published contents.
+
+The repository-specific commands belong in `docs/release.md`. Historical release
+summaries belong in `docs/releases/`. The procedure must agree with the adopted
+policy and link to it rather than introduce additional release requirements.
+
+## Release Model And Completion
+
+A source release identifies one exact committed source revision through an
+immutable version tag and a version-matched, checked-in release note. The
+primary release branch is `main` unless the adopted policy specifies otherwise.
+The procedure must name the authoritative publication remote.
+
+A successful push of the intended tag, with its source commit available on the
+authoritative primary branch, completes the release. The source commit may be
+pushed before the tag or published together with it through an atomic push.
+The procedure must choose and document the supported approach.
+
+Release commands must finish at successful publication. They must not wait for
+or poll CI, require successful CI status, inspect downloadable artifacts, or
+check consumer installation or Go module availability as completion gates.
+A failed or ambiguous push requires resolving the authoritative remote state
+before declaring success or retrying; successful pushes do not require a
+separate remote read-back gate.
+
+Repositories may publish source only. Additional binaries, images, packages,
+checksums, or other declared deliverables may be published asynchronously from
+the tagged source. The procedure must identify those deliverables and the
+responsibility of their automation. Published deliverables must be traceable
+to that source and identify the same version.
+
+Track source-release completion and artifact delivery separately. Report delivery
+failures and optional investigations under artifact-delivery status.
+
+## Versioning And Compatibility
+
+Stable releases use Semantic Versioning in the form `vMAJOR.MINOR.PATCH`, with
+no leading zeroes. Prereleases require an explicit adopted policy defining
+their format and use.
+
+The selected version must be unused locally and on the authoritative remote.
+Do not require queries to every configured remote or publication service.
+A version known to have already been published must not be reused, even if the
+normal guards do not inspect that channel. Adding a distribution channel
+requires a deliberate update to the policy and procedure where needed.
+
+For releases at or after `v1.0.0`:
+
+- a major release may make intentional incompatible changes;
+- a minor release may add backward-compatible behavior; and
+- a patch release may make backward-compatible fixes.
+
+Before `v1.0.0`, a minor release may change a documented public, operational,
+configuration, data, integration, or compatibility contract when the release
+note explains the impact and required consumer action. A patch release must
+not intentionally break those contracts within its minor line.
+
+Additional compatibility promises and deliberate exceptions belong in the
+adopted policy or canonical contract documentation. Release notes explain
+changes; they do not redefine current compatibility contracts.
+
+## Release Documentation And Preparation
+
+Every new release must include `docs/releases/<version>.md` in the tagged
+source tree. Use the complete version tag as the filename and begin with a
+title containing the product name and that exact version.
+
+Include a short summary and any relevant compatibility impact or upgrade
+instructions. Choose sections suited to the release and keep the note
+proportionate to the change.
+
+Keep exact current contracts in their canonical documents and update affected
+documentation with the behavior change. Link to those documents from the note
+where useful. If annotated tags are used, derive their summary from the
+checked-in note.
+
+Include the release footer defined by the [OSS policy](oss.md#discoverability)
+in each new release document and preserve it on the hosted download page. The
+release procedure defines the concrete URLs and publication mechanics. Prepare
+these links with the release note; they do not add a network check or approval
+gate.
+
+Handle version selection, release-note content, and retirement of completed
+roadmaps during preparation. Preserve planned and deferred work and repair
+affected links when retiring roadmaps. Reuse ordinary change review for
+unintended files, credentials, and private data. Scope release-content review
+to the tagged source.
+
+## Candidate Validation
+
+Provide one publication command that validates the final committed candidate,
+checks publication state, and publishes the intended refs. A validation-only
+mode or command may be provided for diagnosis, but must not be a required step
+before publication repeats the same checks.
+
+Run the complete deterministic, offline default test suite once for the final
+candidate, following the [testing policy](testing.md). For repositories that
+publish builds, verify the required build targets. Select those targets for
+the application's actual support commitments; native testing on each platform
+and access to particular hardware are not default release prerequisites.
+
+Additional gates must address a concrete risk that the existing checks do not
+adequately cover. Do not automatically require linting, race testing, module
+hygiene audits, documentation audits, credential scans, example validation, or
+expanded platform matrices solely because they are possible. Retain such
+checks when their distinct protection justifies their cost. A one-time migration
+check must not silently become a permanent release requirement.
+
+Release tests must not require real credentials, mutable application services,
+paid APIs, provider probes, or inference calls. The procedure may describe dependency
+preparation separately from offline validation.
+
+Avoid duplicate validation across release phases. Successful checks for the
+same final candidate need not be repeated solely to satisfy another phase;
+any reuse must clearly apply to that exact candidate. Persistent validation
+caches are not required. If the candidate changes, validate the new candidate.
+Cheap publication-state checks may be repeated immediately before pushing
+because local or remote state may have changed during validation.
+
+Automate mechanical guards. Human review gates are strongly disfavored: add one
+only through an explicit project-specific policy decision explaining the
+concrete risk and why ordinary change review or automation is insufficient.
+Do not add routine confirmations for checks the command can perform itself.
+
+## Narratio Candidate Checks
+
+Narratio's candidate checker adds the following checks to the one full,
+race-enabled offline suite:
+
+- `go mod tidy -diff` detects an incomplete checked-in module graph without
+  changing source.
+- Tracked Go formatting and diff whitespace checks catch inexpensive source
+  hygiene defects before publication.
+- Race instrumentation adds distinct coverage for concurrent I/O,
+  cancellation, and shared state.
+- `go vet ./...` detects static issues not established by runtime tests.
+- The asset builder verifies the declared Linux amd64, Linux arm64, and
+  best-effort macOS arm64 binaries and checks the embedded version on the host.
+
+The checker uses `GOWORK=off` and readonly module mode for tests, vet, and
+builds. Versioned module replacements are allowed; filesystem replacements
+are not release inputs. Workspace and vendor files are not prohibited solely
+by their presence.
+
+## Publication Guards
+
+Automate the checks needed to publish the intended source under a fresh version:
+
+- the version has the adopted format and is unused locally and on the
+  authoritative remote;
+- the worktree and index are clean on the primary release branch;
+- the source being published is the exact candidate that passed validation,
+  including its matching release note;
+- the remote primary branch already identifies that candidate, or an atomic
+  source/tag push will advance it to that candidate without discarding remote
+  history; and
+- the tag identifies the validated candidate and only the intended refs are
+  published.
+
+Fetch the authoritative branch and tag state as needed for these checks.
+Do not force branch or tag updates to bypass a failed guard. Publish explicit
+refs rather than all local tags. Do not require CI success, publication-service
+availability checks, or a separate manual confirmation for each guard.
+
+## Immutability And Failure Recovery
+
+Published version tags and published contents are immutable. Do not move,
+overwrite, recreate, or delete a published tag, or replace a published artifact,
+checksum, signature, provenance statement, or release note under that version.
+The checked-in note at the immutable tag is that release's historical record.
+
+If validation fails before publication, correct and commit the candidate and
+rerun the publication command. If a push fails or its outcome is ambiguous,
+inspect the authoritative remote before retrying. Remove an unpublished local
+tag only after confirming it was never published or used by a release channel.
+An unavailable remote leaves publication status unknown; do not overwrite a tag
+to resolve uncertainty.
+
+Transient network, authentication, CI, or consumer-availability failures do not
+by themselves require a new version. Asynchronous delivery may be retried from
+the same immutable tag. Missing artifacts may be published later, provided
+existing published contents are not replaced and the additions remain consistent
+with the tagged source and any already-published checksum manifest. If that
+cannot be achieved, publish a new version.
+
+A defect requiring changes to published source or contents requires a corrected
+commit, a new semantically appropriate version, a matching release note, and
+the release procedure again. Leave the original release intact. A channel's
+yank, deprecation, or advisory mechanism may warn consumers away from a defective
+release without replacing its contents or reusing its version.
+
+## Repository Release Procedure
+
+Maintain `docs/release.md` as a short, executable maintainer runbook. It must
+identify:
+
+1. prerequisites, primary branch, and authoritative remote;
+2. version and release-note preparation;
+3. one publication command with its selected local checks and automated guards;
+4. declared deliverables, required build targets, and automation responsibilities;
+5. the successful-push completion point and separately reported delivery status;
+   and
+6. failure handling, ambiguous-push recovery, and asynchronous delivery retries.
+
+Use copyable commands where practical. Keep optional diagnostics and consumer
+verification clearly optional. The procedure must not turn preparation work,
+ordinary change review, or post-publication investigation into additional
+release gates.

docs/policy/testing.md

@@ -1,39 +1,32 @@
 # Testing Policy
 
+**Base Policy Version:** 1.3
+
+**Last Updated**: 2026-09-28
+
+**Upstream Source**: https://gitea.maximumdirect.net/eric/policy/src/commit/d84a38ebab26f048cafbe59a2246700c35d29843/docs/policy/testing.md
+
 ## Purpose
 
 Our tests exist to make **incorrect changes expensive and correct changes cheap**.
 
-We do not optimize for test count, line coverage, exhaustive isolation, or the fewest possible tests. We optimize for sufficient confidence in important behavior while imposing as little unnecessary friction as possible on future development.
+We optimize for sufficient confidence in important behavior while minimizing friction on future development.
 
 ## Every test has a cost
 
-Testing is not an unqualified good. Every test imposes both an immediate cost and a continuing lifetime cost.
-
-A test must be:
-
-- written and reviewed;
-- understood by future maintainers and coding agents;
-- executed in local and CI workflows;
-- diagnosed when it fails;
-- updated when legitimate behavior changes;
-- maintained as fixtures, APIs, and dependencies evolve; and
-- removed or rewritten when it becomes redundant, brittle, misleading, or obsolete.
-
-Tests also create cognitive and architectural friction. They can constrain refactoring, duplicate policy, slow feedback loops, add noise to failures, and cause harmless implementation changes to require unrelated edits across the suite.
+Every test has an immediate and continuing cost: writing, review, execution,
+diagnosis, fixture maintenance, and updates when legitimate behavior changes.
+Tests can also constrain refactoring, duplicate policy, and add failure noise.
 
 A test is warranted only when the confidence it provides justifies these costs.
-
-Apply this cost-benefit analysis at two levels:
+Evaluate that tradeoff at two levels:
 
 1. **Per test:** What realistic defect does this test detect, how consequential would that defect be, and is that protection worth the test's lifetime cost?
 2. **Across the suite:** Does this collection provide materially more confidence than a smaller, simpler suite would?
 
-The preferred test suite is a **lean suite that provides sufficient confidence in the risks that matter, without redundant or low-value tests**. We seek sufficient confidence with the least unnecessary testing friction, not the fewest possible tests.
+Some friction is intentional. Tests should make dangerous changes—such as breaking compatibility, corrupting data, violating security boundaries, or reintroducing subtle bugs—require deliberate review. Keep ordinary internal changes inexpensive.
 
-Some friction is intentional. Tests should make dangerous changes—such as breaking compatibility, corrupting data, violating security boundaries, or reintroducing subtle bugs—require deliberate review. They should not make ordinary internal changes needlessly expensive.
-
-The cost of a test is not a reason to omit testing by default. Do not cite maintenance cost abstractly. When omitting a plausible test, be able to state why the protected failure is low-risk, already covered, obvious, reversible, or cheaper to detect elsewhere. For consequential, subtle, or difficult-to-observe behavior, the presumption should favor testing.
+Evaluate maintenance cost against the specific failure being protected. When omitting a plausible test, be able to state why the protected failure is low-risk, already covered, obvious, reversible, or cheaper to detect elsewhere. For consequential, subtle, or difficult-to-observe behavior, the presumption should favor testing.
 
 ## Default testing style
 
@@ -55,7 +48,7 @@ Control clocks, randomness, environment variables, and other process-global or m
 
 ## What deserves tests
 
-Prioritize tests for:
+To the extent the following features are present in the application, prioritize tests for:
 
 1. Public and package-level contracts.
 2. Domain rules and important invariants.
@@ -65,15 +58,27 @@ Prioritize tests for:
 6. Previously observed or plausible regressions.
 7. Representative integration and end-to-end workflows.
 
-A package-level contract is behavior relied upon by another package or major collaborator, not every observable detail of a package implementation.
+A package-level contract comprises behavior relied upon by another package or major collaborator.
 
-For behavior involving **data integrity, destructive operations, compatibility, security, concurrency, idempotency, or recovery**, presume that durable tests are required unless the behavior is already credibly protected at another layer.
+Choose tests for requested behavior and established contracts. Tests must not
+introduce new restrictions, guarantees, or threat scenarios merely because they
+could be asserted. Follow the [agent policy](agents.md) when deciding whether a
+behavior belongs to the contract; current implementation behavior alone is not
+sufficient authority.
+
+For established behavior involving **data integrity, destructive operations,
+compatibility, security, concurrency, idempotency, or recovery**, favor durable
+tests for realistic failures whose consequences warrant protection. Identify
+the failure and the existing contract it would violate. These categories call
+for attention, not an automatic test inventory or permission to strengthen the
+application's guarantees. Account for protection already provided at other layers.
 
 Do not add tests merely because a function, branch, or line exists. Do not add a test when the same meaningful risk is already adequately protected elsewhere.
 
 ## Choose the right test boundary
 
-Test through the narrowest stable boundary that expresses the behavior clearly.
+Choose the narrowest stable boundary that expresses the behavior clearly and
+provides durable confidence with minimal incidental coupling.
 
 This is often the package API, but it may instead be:
 
@@ -81,28 +86,15 @@ This is often the package API, but it may instead be:
 - a package-level operation when several internal collaborators jointly produce the behavior; or
 - a larger integration boundary when correctness emerges from interaction with a real dependency.
 
-Do not force all behavior through oversized end-to-end tests. Do not test every private helper merely because it exists. Choose the boundary that gives durable confidence with the least incidental coupling.
-
 ## Test behavior, not implementation
 
-A test should protect a decision, contract, or invariant—not memorialize the current implementation.
+A test should protect a selected decision, contract, or invariant.
 
-Before adding or retaining a test, ask:
+A test is suspect when it primarily detects changes to private constants or
+helpers, equivalent operation ordering, incidental formatting, equivalent
+algorithms, or internal structure that preserves behavior.
 
-> What realistic defect would this test catch?
-
-A test is suspect when its main purpose is to detect that someone:
-
-- changed an internal constant;
-- renamed or split a private helper;
-- reordered equivalent internal operations;
-- changed incidental formatting;
-- replaced one correct algorithm with another; or
-- refactored internal object structure without changing behavior.
-
-Refactoring should normally require no test edits unless the refactored structure is itself part of the contract.
-
-A test can be factually correct and still have negative value. Accurately describing current behavior is not enough; the protected behavior must be important enough to justify the future friction.
+Behavioral tests should normally remain stable through internal refactoring that preserves the contract.
 
 ## Expected effects of different changes
 
@@ -119,12 +111,13 @@ A test failing is not the same as a test needing to be edited. Many tests may co
 
 ## Separate mechanism from policy
 
-Configurable thresholds and defaults must not be duplicated throughout the test suite.
+Derive expectations from test-controlled configuration and relationships.
 
-For example, do not encode an internal concurrency limit indirectly:
+For this example, assume the selected contract rejects a request to start more
+processes than a configured limit. Do not encode its production default indirectly:
 
 ```go
-// Production policy:
+// Production default:
 const maxConcurrency = 4
 
 // Brittle test:
@@ -142,25 +135,30 @@ require.NoError(t, runner.Start(limit))
 require.ErrorIs(t, runner.Start(limit+1), ErrTooMuchConcurrency)
 ```
 
-The test should prove:
+For this selected contract, the test should prove:
 
 - the configured limit is accepted; and
 - one beyond the configured limit is rejected.
 
+Rejection is not a general requirement for concurrency control. If the selected
+contract queues excess work or limits active workers while accepting larger
+batches, test that behavior instead. Do not add rejection or a configurable
+limit solely to reproduce this example.
+
 The production default should be tested exactly only when its literal value is itself a public, operational, safety, protocol, or compatibility requirement.
 
-Apply the same rule to limits, timeouts, capacities, retry counts, and ranges: test relationships and behavior, not duplicated literals.
+Apply the same rule to limits, timeouts, capacities, retry counts, and ranges: test relationships and behavior.
 
-For concurrency limits, test both kinds of behavior when relevant:
+For established concurrency limits, distinguish these behaviors where the contract requires them:
 
-1. **Configuration enforcement:** invalid or excessive requested values are handled correctly.
+1. **Configuration handling:** values are accepted or rejected according to the selected contract.
 2. **Runtime enforcement:** observed peak concurrency never exceeds the configured limit.
 
-Use a test-controlled limit and measure the behavior relative to that limit. Do not merely assert today's default value.
+Use a test-controlled limit and measure the behavior relative to that limit.
 
-## Avoid semantic duplication across layers
+## Assign each behavior a test owner
 
-Each behavior should have a clear test owner.
+Where these layers exist, assign ownership as follows:
 
 - Parser tests own parsing cases.
 - Validator tests own validation rules.
@@ -170,9 +168,7 @@ Each behavior should have a clear test owner.
 - CLI tests own argument and configuration mapping.
 - End-to-end tests prove that representative assembled workflows work.
 
-Higher-level tests should not repeat every lower-level case. A single intentional policy change should not require unrelated edits across many test files.
-
-Tests that are individually reasonable may still be collectively redundant. Evaluate the marginal value of each additional test in light of the protection already provided by the rest of the suite.
+Give each layer its distinct responsibility and keep expectation updates localized to the contract being changed.
 
 ## Use test doubles deliberately
 
@@ -193,104 +189,76 @@ Mocks are appropriate when the contract includes facts such as:
 - an expensive API is called no more than once; or
 - a security audit event is emitted.
 
-Do not use mocks merely to isolate every object or reproduce the implementation's call graph.
-
 ## Go-specific guidance
 
-Use:
+Select techniques by behavior and risk:
 
 - table-driven tests for meaningful behavioral categories and boundaries;
 - `t.TempDir()` for real filesystem behavior;
 - `httptest.Server` for realistic HTTP interactions;
-- fuzz tests for parsers, normalization, path handling, and broad input spaces;
+- fuzz tests when exploring broad input spaces, such as parsers or path handling, adds useful protection beyond representative cases;
 - golden files only when the complete output is intentionally stable;
 - integration tests where correctness depends on component interaction; and
-- a small number of representative end-to-end tests.
+- a small number of representative end-to-end tests when assembled workflows expose meaningful risks not adequately covered at narrower boundaries.
 
-Avoid exact error-string assertions unless the wording is itself contractual. Prefer `errors.Is`, `errors.As`, typed errors, or structured error fields.
+Prefer `errors.Is`, `errors.As`, typed errors, or structured error fields. Use exact error-wording assertions only when the wording is contractual.
 
-At CLI boundaries, prefer exit classifications, structured output, and the smallest stable semantic fragment needed to identify the error. Do not snapshot complete diagnostic wording unless it is contractual.
+At CLI boundaries, prefer exit classifications, structured output, and the smallest stable semantic fragment needed to identify the error. Use complete diagnostic snapshots only when the wording is contractual.
 
 Golden-file updates must require an explicit local flag. CI must not update golden files automatically, and reviewers must inspect the semantic diff before accepting an update.
 
-Keep tests readable and direct. Test helpers and fixture frameworks must earn their own maintenance cost; do not build elaborate test infrastructure for small or isolated needs.
+Keep tests readable and direct. Size test helpers and fixture frameworks to the maintenance benefit they provide.
 
 ## Coverage
 
-Coverage is a diagnostic, not a target.
-
-Use it to find untested critical branches and unexpectedly weak packages. Do not write low-value tests solely to increase a percentage, and do not infer test quality from coverage alone.
+Use coverage to locate untested critical branches and unexpectedly weak packages. Evaluate test quality through meaningful behavioral protection and choose coverage according to risk.
 
 Pure domain logic will often warrant higher coverage than CLI wiring or external adapters. Uneven coverage is acceptable when it reflects risk.
 
-Increasing coverage is valuable only when the newly covered behavior protects a meaningful risk at an acceptable cost.
-
 ## Regression tests
 
 A bug fix should normally include a regression test that fails before the fix and passes afterward.
 
-Retain the test when the defect could realistically recur and its consequences justify the ongoing cost. Prefer the narrowest durable test of the violated contract or invariant; do not preserve accidental implementation details from the original bug.
+Retain the test when the defect could realistically recur and its consequences justify the ongoing cost. Prefer the narrowest durable test of the violated contract or invariant.
 
-Not every historical bug requires a permanent test. If the underlying design has made recurrence impossible, the test has become redundant, or a stronger invariant test now subsumes it, remove or consolidate it.
+Remove or consolidate a test when the underlying design has made recurrence impossible, its protection is redundant, or a stronger invariant test subsumes it.
 
 ## Deleting or rewriting tests
 
-Tests are maintained code, not permanent historical artifacts.
-
-Delete or rewrite a test when its maintenance cost exceeds the confidence it provides.
+Delete or rewrite tests when maintenance cost exceeds their continuing
+protective value.
 
 Strong candidates include tests that:
 
 - require updates after harmless internal changes;
-- directly assert private constants without protecting a real contract;
-- duplicate the same policy across several layers;
+- assert incidental private constants or snapshot large amounts of incidental output;
 - verify mock choreography rather than outcomes;
-- snapshot large amounts of incidental output;
-- test trivial private helpers already exercised through stable package behavior;
-- protect risks already covered more effectively elsewhere;
+- duplicate policy across layers, retest trivial helpers covered by package
+  behavior, or protect risks covered more effectively elsewhere;
 - are flaky, misleading, obsolete, or disproportionately expensive to diagnose; or
 - no longer correspond to a plausible failure mode.
 
-Several brittle tests may encode one genuine requirement. Replace them with one durable behavior-level or invariant test rather than preserving all of them.
-
-Deleting a low-value test can improve the quality of the suite by reducing noise, maintenance burden, and friction around legitimate change.
+Several brittle tests may encode one genuine requirement. Consolidate them into one durable behavior-level or invariant test.
 
 ## Reviewing a proposed test
 
-Use the following questions when the value, boundary, or durability of a proposed test is not self-evident. Significant test additions should be reviewable against them, but written answers are not required for every routine test.
+Use the following questions when a proposed test needs closer evaluation. Significant test additions should be reviewable against them; written answers are optional for routine tests.
 
-1. What realistic defect would it catch?
-2. How likely is that defect?
-3. How consequential would it be?
-4. Is the behavior already protected elsewhere?
-5. At which layer should this behavior be owned?
-6. Does the test assert a durable contract or an incidental implementation detail?
-7. Could the implementation be refactored without changing the behavior and without editing this test?
-8. What should cause this test to fail?
-9. What legitimate changes should not cause this test to fail?
-10. What ongoing maintenance, execution, and diagnostic cost will the test impose?
-11. Is there a smaller or more direct test that protects the same risk?
-
-Do not add the test when its expected lifetime cost exceeds its expected protective value.
-
-When deciding not to test plausible behavior, record or be able to explain why the risk is low, already protected, obvious, reversible, or cheaper to detect elsewhere.
+1. Which requested behavior or established contract does it protect, and what realistic defect would violate it?
+2. How likely and consequential is that defect, and is it already protected elsewhere?
+3. What is the narrowest stable boundary that can test it clearly?
+4. Would a correct internal refactor or a change to an incidental default require test edits?
+5. Does its confidence justify its maintenance, execution, and diagnostic cost, or would a smaller test suffice?
 
 ## Definition of sufficient
 
 A test suite is sufficient when:
 
-- important contracts and invariants are protected;
-- meaningful boundaries and failure modes are exercised;
-- realistic and consequential regressions are credibly protected against silent recurrence;
-- behavior involving data integrity, destructive operations, compatibility, security, concurrency, idempotency, and recovery is credibly protected;
-- important external boundaries have realistic integration coverage;
-- representative complete workflows are tested;
-- failures provide useful signal rather than redundant noise;
-- legitimate internal changes usually do not require test edits; and
+- important requested behavior and established contracts are protected against realistic, consequential failures;
+- boundaries and component interactions have coverage where they introduce meaningful risks not protected elsewhere;
+- failures provide useful, distinct signals;
+- tests usually remain stable through legitimate internal changes; and
 - additional tests would mostly repeat existing protection or preserve inconsequential implementation details.
 
-Sufficiency is a risk judgment, not a coverage percentage or test count. Reassess it as the application, its users, and the consequences of failure evolve.
-
-The governing rule is:
-
-> Test heavily where failure is consequential, subtle, or difficult to detect after the fact. Test lightly where failure is obvious, reversible, and inexpensive—and retain no test whose lifetime cost exceeds the confidence it provides.
+Reassess sufficiency as the application, its users, and the consequences of
+failure evolve.

docs/release.md

@@ -1,104 +1,114 @@
 # Releasing Narratio
 
-This document is the maintainer procedure for creating a Narratio source and
-binary release. The synchronous release boundary is a successful push of one
-new tag to `origin`; Woodpecker and Gitea publication happen later and do not
-change that result.
+This is the maintainer runbook for the [Release Policy](policy/release.md).
+The source release completes when the intended tag is successfully pushed to
+`origin`; binary delivery is a separate asynchronous status.
 
-## Go prerequisite
+## Prepare the candidate
 
-Release preparation requires the maintained Go 1.26 baseline. Tag CI currently
-uses the explicitly pinned `golang:1.26.7` image for candidate validation and
-asset construction; that asynchronous work does not change the tag-push
-completion boundary.
+Use `main` and the authoritative Git remote `origin`. Install Git, a POSIX
+shell, standard Unix build tools, and Go 1.26. Have the selected Go modules
+available before offline validation. Git access must permit fetch and tag push.
+Application-provider credentials are not required; Gitea delivery credentials
+belong to CI.
 
-## Choose a version and write its note
+Choose an unused stable `vMAJOR.MINOR.PATCH` under the
+[compatibility rules](policy/release.md#versioning-and-compatibility). Narratio
+is past v1.0.0, so intentional CLI or configuration breaks require a major
+release. Update affected canonical documentation with the change. Write the
+matching `docs/releases/vMAJOR.MINOR.PATCH.md` with a short summary and any
+relevant compatibility impact or upgrade action; choose sections to suit the
+release.
 
-Narratio is past `v1.0.0`. Use an unused stable tag in the exact form
-`vMAJOR.MINOR.PATCH`:
-
-- increment `MINOR` for backward-compatible features;
-- increment `PATCH` for backward-compatible fixes; and
-- reserve a new `MAJOR` for an intentional breaking documented contract.
-
-Before preparing the candidate, create
-`docs/releases/vMAJOR.MINOR.PATCH.md` with this structure:
+End that checked-in note with these three links, replacing the version in
+each URL with the intended tag. The tag need not exist remotely yet. Check that
+`COPYRIGHT`, `LICENSE`, and `docs/oss/attribution.md` are present in the
+candidate. The tag CI reuses the checked-in note as the hosted release body.
 
 ```markdown
-# Narratio vMAJOR.MINOR.PATCH
-
-This release ...
-
-## Summary
-
-## Compatibility
-
-## Upgrade
-
-## Changes
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/narratio/src/tag/vMAJOR.MINOR.PATCH/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/narratio/src/tag/vMAJOR.MINOR.PATCH/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/narratio/src/tag/vMAJOR.MINOR.PATCH/docs/oss/attribution.md)
 ```
 
-The compatibility section identifies relevant CLI, configuration, artifact,
-integration, or operating-contract changes. The upgrade section states the
-required operator action, or explicitly says that no special action is
-required. Release notes are immutable historical summaries; link to the
-current canonical documentation for detailed behavior.
-
-Commit the note and all candidate changes, then use the ordinary development
-workflow to push that commit to `main`. Do not create a release tag before the
-candidate is committed and `origin/main` contains the exact same commit.
-
-## Validate the candidate
-
-Run the shared checker from any directory:
+Retire completed roadmaps included in the release while preserving planned or
+deferred work and repairing affected links. Review the change through the
+ordinary development workflow for unintended files, credentials, private data,
+and documentation accuracy. Commit and push the candidate to `origin/main`
+before tagging; record its exact commit if needed:
 
 ```sh
-scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH
+git rev-parse HEAD
 ```
 
-It validates the version and matching note, module hygiene, formatting,
-whitespace, uncached tests, race tests, static checks, documentation, examples,
-and three official cross-build assets. It uses `GOWORK=off`, does not contact
-application services, CI, or Gitea, and does not create tags or modify tracked
-source. Fix any failure on `main`, commit it, push it normally, and rerun the
-checker.
+## Publish
 
-The checker builds Linux assets for `amd64` and `arm64` and a macOS asset for
-`arm64`. The macOS cross-build proves compilation; it is not native macOS
-runtime evidence.
-
-## Publish the tag
-
-From a clean checkout on `main` whose `HEAD` equals `origin/main`, run:
+From a clean `main` checkout at the pushed candidate, run one command:
 
 ```sh
 scripts/release.sh vMAJOR.MINOR.PATCH
 ```
 
-The command fetches and checks `origin/main`, re-runs candidate validation,
-then fetches and checks again before creating an explicitly unsigned lightweight
-tag for the originally recorded commit. It refuses dirty, divergent, changed,
-or already-tagged candidates. It pushes only:
+It fetches `origin/main` and tags; requires local `HEAD` to equal
+`origin/main`; checks the committed note and unused version; runs the
+candidate checker **once**; then repeats cheap mutable-state guards before
+creating an unsigned lightweight tag at the recorded commit. It verifies the
+tag target and pushes only
+`refs/tags/vMAJOR.MINOR.PATCH:refs/tags/vMAJOR.MINOR.PATCH`. It does not
+commit, push `main`, force updates, or publish all tags.
 
-```text
-refs/tags/vMAJOR.MINOR.PATCH:refs/tags/vMAJOR.MINOR.PATCH
-```
+The checker runs `go mod tidy -diff`, tracked Go formatting and diff whitespace
+checks, one `go test -mod=readonly -race -count=1 ./...` full suite, and
+`go vet -mod=readonly ./...`. Its asset builder cross-builds Linux amd64,
+Linux arm64, and best-effort macOS arm64, then checks the embedded version
+on a host binary. The macOS cross-build proves compilation, not native
+runtime behavior. Owned Go commands run with `GOWORK=off`; tests, vet, and
+builds use readonly module mode. The deterministic suite includes documentation
+and maintained-example checks. The command does not contact application
+services or Gitea and does not wait for CI.
 
-It never commits changes, pushes `main`, force-pushes, moves a tag, or pushes
-all tags. A successful push of that exact ref completes the release command;
-the command prints the tag and commit, then returns without waiting for CI,
-querying Gitea, downloading assets, or checking checksums.
+A successful tag push is the source-release completion point. The command
+prints the tag and commit and exits without a separate network read-back.
+For optional diagnosis before publication, run
+`scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH`; publication will
+validate the candidate again, so this is not a required preparation step.
 
-If a failure occurs before the tag is created, correct the candidate on `main`
-and repeat validation. If the push fails after local tag creation, the local tag
-is intentionally retained for inspection and the command must not be retried
-blindly. Once the upstream tag has been pushed, it is immutable. Correct any
-defect or failed asynchronous publication with a new patch version, a new
-release note, and the complete procedure again.
+## Artifact delivery
 
-## Optional asynchronous inspection
+Tag-triggered `.woodpecker/release.yml` independently validates the tagged
+source, builds the same three targets, and publishes these Gitea downloads:
 
-After a successful tag push, a human may later inspect the tag-triggered
-Woodpecker run and the corresponding Gitea release for binaries and checksums.
-This is optional follow-up only. Automated releasers must not wait for, poll,
-or treat CI/Gitea completion as a condition of the successful tag push.
+- `narratio-vMAJOR.MINOR.PATCH-linux-amd64`
+- `narratio-vMAJOR.MINOR.PATCH-linux-arm64`
+- `narratio-vMAJOR.MINOR.PATCH-darwin-arm64` (best effort)
+- `SHA256SUMS`
+
+The builder embeds the tag version and checks host `version` output. CI
+generates checksums and uses non-overwriting publication settings. It does
+not select versions, change the source, or move tags. No image or package
+registry output is declared. Tag publication is not proof that these
+asynchronous downloads are available.
+
+## Failure and recovery
+
+If validation fails before tagging, correct and commit the candidate, push
+it to `main`, and rerun the publication command. If the tag push reports
+failure, its outcome may be ambiguous: keep the local tag and inspect the
+exact `refs/tags/vMAJOR.MINOR.PATCH` at `origin` before declaring success
+or retrying. A reachable matching remote tag at the recorded commit establishes
+publication; a confirmed absent tag permits investigation of the transport
+failure. If `origin` cannot be inspected, publication status is unknown.
+Do not move, overwrite, or automatically retry the tag. Remove a local tag
+only after confirming it was never published or used by a release channel.
+
+A transient CI or delivery failure can be retried from the same immutable
+tag. Missing assets may be added later if they match the tagged source and
+any published checksum manifest; do not overwrite existing binaries,
+checksums, or release-note contents. A source/content defect, or delivery
+that cannot be corrected without replacement, requires a new suitable
+version and matching note. Leave the original release intact.
+
+Optional consumer inspection may compare the tag's remote commit with the
+recorded candidate, check the Woodpecker delivery job and hosted Gitea note,
+download the assets into an empty directory, run `sha256sum --check
+SHA256SUMS` (or `shasum -a 256 --check SHA256SUMS` on macOS), and run
+the matching host binary's `version` command. This is separate delivery
+observation, never a source-release gate.

docs/releases/README.md

@@ -1,27 +1,23 @@
 # Release Notes
 
 This directory contains immutable historical release notes for Narratio.
-Future notes are created with the matching stable version and use this minimum
-structure:
-
-```markdown
-# Narratio vMAJOR.MINOR.PATCH
-
-This release ...
-
-## Summary
-
-## Compatibility
-
-## Upgrade
-
-## Changes
-```
+Future notes use the matching stable version and begin with
+`# Narratio vMAJOR.MINOR.PATCH`. Include a short summary and relevant
+compatibility or upgrade guidance; choose sections suited to the release.
+End each new note with the three immutable-tag notice links specified in the
+[release procedure](../release.md).
 
 See the [release procedure](../release.md) for creating a candidate and tag.
 When asynchronous publication succeeds, the corresponding Gitea release is the
 canonical source for downloadable binaries and checksums.
 
+- [v3.1.0](v3.1.0.md)
+- [v3.0.0](v3.0.0.md)
+- [v2.2.1](v2.2.1.md)
+- [v2.2.0](v2.2.0.md)
+- [v2.1.2](v2.1.2.md)
+- [v2.1.1](v2.1.1.md)
+- [v2.1.0](v2.1.0.md)
 - [v2.0.0](v2.0.0.md)
 - [v1.7.0](v1.7.0.md)
 - [v1.6.0](v1.6.0.md)

docs/releases/v2.1.0.md

@@ -0,0 +1,70 @@
+# Narratio v2.1.0
+
+This release adds explicit Notarius credential forwarding and cache reuse,
+with predictable forced regeneration and clearer artifact-development guidance.
+
+## Summary
+
+Narratio can pass one typed API-key reference to Notarius and opt into reuse of
+its accepted execution checkpoints. Stable, verified reference snapshots allow
+unchanged references to retain their cache identity across Narratio invocations.
+Configuration loading now uses ConfigKit v0.3.0.
+
+## Compatibility
+
+The new `notarius.llm_api_key`, `notarius.resume`, and `notarius.chunk_cache`
+fields are optional. Existing v2 configuration needs no schema migration.
+Configured credential references must resolve during configuration loading,
+even when extraction will not execute; omitted references add no requirement.
+
+Forced extraction now omits Notarius checkpoint loading and requests chunk-plan
+refresh. This includes `regenerate-artifacts`, which remains an alias for a
+forced run from extract through analyze. `analyze` continues to force analysis
+only, preserving extraction results and transcripts.
+
+Notarius v0.7.0 is the tested cache integration baseline, not an unconditional
+minimum-version gate. The executable must support the flags selected for the
+invocation, including `--chunk_cache refresh` for forced extraction. Reference
+bindings retain the contract introduced in Notarius v0.6.0. Receipt and artifact
+schemas are unchanged; reused producers may report zero production attempts.
+
+Supported release platforms remain Linux amd64/arm64 and best-effort macOS
+arm64. macOS validation is cross-compilation, not native runtime testing.
+
+## Upgrade
+
+No special migration is required for existing v2 configuration. To use the new
+features:
+
+- Declare `notarius.llm_api_key` with the environment-variable name expected by
+  the deployed Notarius profile, supplying its value through the existing
+  environment or secrets-directory mechanism.
+- Enable checkpoint recording in Notarius configuration before setting
+  Narratio's `notarius.resume: true`. Prefer explicit persistent Notarius cache
+  roots for service deployments. An optional `notarius.chunk_cache` overrides
+  its ordinary chunk-plan policy.
+- Expect an initial checkpoint miss when moving from old run-local reference
+  paths to stable session snapshots. No migration or deletion of old caches is
+  required. Force refreshes the current input's plan, not the whole cache.
+- Use `narratio analyze SESSION` for analysis-only iteration, and
+  `narratio regenerate-artifacts SESSION` when extraction should also be rebuilt.
+
+See [Configuration](../config.md), the
+[Notarius integration contract](../integrations/notarius.md), and
+[Artifact Development Workflows](../operations.md#artifact-development-workflows)
+for current details.
+
+## Changes
+
+- Upgraded ConfigKit from v0.1.2 to v0.3.0 and isolated pipeline-discovery tests
+  from machine configuration.
+- Added optional typed Notarius credentials, exact-name environment delivery,
+  safe configuration projections, and captured-stream redaction for custom names.
+- Added Notarius resume and chunk-cache controls with force taking precedence.
+- Added verified, content-addressed session reference snapshots that survive
+  ordinary run cleanup without becoming published artifacts.
+- Preserved relative-workspace support for snapshot delivery and confinement.
+- Kept credentials and cache-policy controls outside extract's semantic resume
+  identity, so operational changes alone do not invalidate completed results.
+- Added an opt-in real Notarius integration test using a local provider to
+  verify reuse, partial-failure recovery, and forced refresh without paid calls.

docs/releases/v2.1.1.md

@@ -0,0 +1,33 @@
+# Narratio v2.1.1
+
+This release fixes configuration loading for publish rules that explicitly set
+requiredness while relying on a derived destination.
+
+## Summary
+
+Publish rules with a derivable source and omitted `dest` now load correctly
+whether `required` is omitted, explicitly true, or explicitly false. Previously,
+explicit requiredness could trigger ConfigKit's `resolve.unrecorded_change`
+diagnostic instead of accepting valid configuration.
+
+## Compatibility
+
+This is a backward-compatible bookkeeping correction. Publish schemas,
+destination derivation, requiredness defaults, and YAML syntax support are
+unchanged. Explicit destinations and explicit false values remain intact.
+No ConfigKit upgrade or publication/storage behavior change is involved.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required. Operators
+need not add a derivable `dest`, remove explicit `required` values, or change
+flow-style YAML to block-style YAML. See the
+[configuration reference](../config.md#publish-configuration-summary).
+
+## Changes
+
+- Recorded derived publish destinations at ConfigKit's atomic sequence boundary
+  while retaining field-level resolution records.
+- Added real load/validation and safe effective-configuration regression coverage
+  for built-in and configured-artifact sources, explicit requiredness, and an
+  explicit destination that must remain unchanged.

docs/releases/v2.1.2.md

@@ -0,0 +1,26 @@
+# Narratio v2.1.2
+
+This release allows secrets directories to contain hidden metadata without
+preventing credential loading.
+
+## Summary
+
+ConfigKit v0.3.1 ignores dot-prefixed entries such as `.git`, `.gitignore`, and
+`.DS_Store` during secrets bootstrap. These entries no longer block otherwise
+valid credentials from loading and are omitted from bootstrap reports.
+
+## Compatibility
+
+This is a backward-compatible dependency bug fix. Configuration schemas,
+existing-environment precedence, and validation of non-hidden entries are
+unchanged. Hidden entries still count toward the directory entry limit.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required. See the
+[credential configuration reference](../config.md) for secrets-directory usage.
+
+## Changes
+
+- Updated ConfigKit from v0.3.0 to v0.3.1.
+- Clarified hidden-entry handling in the secrets-directory documentation.

docs/releases/v2.2.0.md

@@ -0,0 +1,53 @@
+# Narratio v2.2.0
+
+This release adds resumable per-speaker transcription, replayable WhisperX
+uploads, and explicit Notarius configuration profile selection.
+
+## Summary
+
+Successfully checkpointed speaker transcripts survive later transcription
+failures. Ordinary retry reuses valid completed speakers and processes only the
+remaining work. WhisperX uploads can now be replayed by the HTTP transport
+without buffering whole audio files.
+
+## Compatibility
+
+Existing CLI commands, speaker identities, transcript formats, and pipeline
+ordering are unchanged. Session manifests gain optional per-speaker completion
+evidence. Older manifests remain readable, but older Narratio binaries may
+reject manifests containing the new fields; downgrading after transcription
+is not transparent.
+
+The optional `pipeline.notarius.config_profile` field selects a downstream
+Notarius configuration profile independently of Narratio's own profile. Using
+it requires a Notarius version supporting `--config-profile`; v0.7.0 is a known
+supporting version. Omitting the field retains downstream default selection.
+
+## Upgrade
+
+No configuration migration is required. When transcribe is next selected for
+an older aggregate-only manifest, all current speakers are transcribed once
+to establish reusable evidence. Previously unrecorded results from failed runs
+are not automatically imported.
+
+Use ordinary run/resume to retain valid checkpoints. Forcing transcribe resets
+reuse of prior results; an ordinary retry after a failed forced invocation can
+retain replacements already checkpointed by that attempt. See the
+[operations guide](../operations.md) and
+[Notarius profile configuration](../config.md#notarius-configuration-profile).
+
+## Changes
+
+- Persist validated speaker completions independently of aggregate stage status,
+  with serialized saves for concurrent work and input/output integrity checks.
+- Rebuild aggregate transcript references when speakers are removed or those
+  references need repair, without retranscribing otherwise-current speakers.
+- Keep removed and incomplete speaker results out of versioned merge inputs.
+- Permit checkpoint evidence for zero-byte audio when WhisperX accepts it;
+  service rejection still fails normally.
+- Provide fresh streaming multipart bodies for HTTP transport replay while
+  preserving application retries, cancellation, and resource cleanup. This
+  addresses the missing-body-replay limitation, not persistent upstream
+  protocol failures or exactly-once service execution.
+- Pass explicit Notarius configuration profiles through the CLI and include
+  their selection in extraction reuse decisions.

docs/releases/v2.2.1.md

@@ -0,0 +1,35 @@
+# Narratio v2.2.1
+
+This maintenance release consolidates checkpoint persistence for transcription
+and analysis without changing their operator-facing behavior.
+
+## Summary
+
+Transcribe and analyze now share one internal operation for preparing isolated
+checkpoint candidates, saving them, and promoting successfully saved progress
+into live state. Each stage retains its own progress model and recovery policy.
+
+## Compatibility
+
+CLI commands, configuration, manifest schemas, artifact formats, and external
+integration contracts are unchanged. Speaker concurrency, artifact selection,
+force behavior, and ordinary resume semantics are preserved. No dependency
+upgrade or new external-tool version requirement is introduced.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required when upgrading
+from v2.2.0. See the [v2.2.0 release notes](v2.2.0.md) when upgrading from an
+earlier version for the original speaker-checkpoint upgrade considerations.
+
+## Changes
+
+- Replace duplicate analyze/transcribe save-and-promote sequences with a
+  shared, private checkpoint helper.
+- Isolate checkpoint collections from live state, including analyze records
+  normalized during a transcription checkpoint save.
+- Preserve transcription's caller-owned locking and failure handling, and
+  analysis's working/committed collections and rollback behavior.
+- Add focused checkpoint integrity tests while retaining stage and application
+  recovery coverage.
+- Document the shared [checkpoint persistence boundary](../internal/manifest.md#checkpoint-persistence-boundary).

docs/releases/v3.0.0.md

@@ -0,0 +1,57 @@
+# Narratio v3.0.0
+
+This major release moves Narratio pipeline selection to ConfigKit overlays and
+updates its Audita and Notarius integration contracts. Existing deployments
+must migrate configuration before running affected sessions.
+
+## Compatibility and upgrade
+
+- Replace Narratio's `--profile <name>` with `--overlay <name>` and move selected
+  `profiles/<name>.yml` files to `overlays/<name>.yml` beside the pipeline root.
+  The old flag and selected directory are no longer supported; explicit imports
+  from a directory named `profiles` remain valid. Update `config diff` positional
+  selections accordingly. See [configuration](../config.md#pipeline-imports-and-overlays)
+  and the [CLI reference](../cli.md).
+- Before opening a session manifest containing
+  `effective_config.selected_profile`, back it up and follow the
+  [manifest migration procedure](../operations.md#migrating-manifest-overlay-provenance).
+  Strict decoding rejects the retired field. Preserve the manifest's stage and
+  checkpoint state; this informational rename does not itself require rerunning
+  every stage. Immutable remote snapshots are not edited in place.
+- Deploy an Audita v2 executable and migrate its configuration before running
+  `polish`. Narratio no longer generates an Audita config or accepts the old
+  endpoint, model, concurrency, singular API-key, report, and retention fields.
+  Audita now owns backends, PromptKit profiles, reporting, and debug settings;
+  Narratio accepts optional downstream selectors and forwards only names listed
+  in `pipeline.audita.credentials`. Follow the
+  [Audita migration table](../operations.md#migrating-audita-and-provider-credentials)
+  and [integration contract](../integrations/audita.md).
+- Replace `pipeline.notarius.llm_api_key` with the
+  `pipeline.notarius.credentials` list. Rename
+  `pipeline.notarius.config_profile` to `config_overlay` and move selected
+  downstream Notarius files to its `overlays/` directory. The old fields have
+  no compatibility aliases. A named downstream overlay requires a compatible
+  Notarius executable; v0.8.1 is the tested baseline, while deployments that
+  omit the selector gain no new version requirement. See the
+  [Notarius configuration reference](../config.md#notarius-configuration-overlay)
+  and [integration contract](../integrations/notarius.md).
+
+## Changes
+
+- Narratio and downstream overlay names are independent. Operators can select
+  separate Audita and Notarius overlays from one Narratio overlay without
+  implicit name forwarding. ConfigKit is updated to v0.4.2.
+- Audita's corrected transcript remains the canonical polish output. Available
+  `errors.yml`, `recoveries.yml`, and `report.md` files are retained as bounded
+  diagnostics; missing reports are allowed, and an exit-zero valid transcript
+  succeeds even when reports describe recoverable errors or no corrections.
+- Audita and Notarius credential lists resolve at pipeline load and forward
+  captured values under their exact names, with captured subprocess output and
+  failure diagnostics redacted. Narratio does not discover backend credentials
+  from downstream configuration; operators must list the names those tools need.
+- Repository policy, license/attribution notices, release validation, and the
+  asynchronous artifact-delivery procedure are aligned with the current
+  [release runbook](../release.md). Completed implementation roadmaps have been
+  retired from the candidate source.
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.0.0/docs/oss/attribution.md)

docs/releases/v3.1.0.md

@@ -0,0 +1,40 @@
+# Narratio v3.1.0
+
+This minor release adds explicit provider-credential forwarding to Scriptorium
+for trim bounds generation and artifact analysis.
+
+## Compatibility and upgrade
+
+Existing pipelines remain valid. An omitted, null, or empty
+`pipeline.scriptorium.credentials` list continues to forward no provider keys.
+When Scriptorium needs a credential, provision its environment variable through
+Narratio's existing environment or secrets-directory mechanism and list the
+exact name in the pipeline, for example:
+
+```yaml
+scriptorium:
+  credentials: [OPENROUTER_API_KEY]
+```
+
+Selected references must resolve to nonempty values when Narratio loads the
+pipeline, even if the current command will not run Scriptorium. A Narratio
+overlay replaces the complete list, and `[]` clears it. After correcting a
+failed trim or analysis invocation, retry normally; successful work need not be
+forced solely because a credential was added or rotated. See
+[Scriptorium credentials](../config.md#scriptorium-credentials) and the
+[401 troubleshooting guide](../troubleshooting.md#scriptorium-returns-http-401-during-trim-or-analyze).
+
+## Changes
+
+- Forward selected, already-resolved credential names and values to Scriptorium
+  for trim, analysis, character-family generation, and render-debug calls.
+  Scriptorium still owns provider and profile selection; Narratio does not add
+  a model-request `--api-key-env` override.
+- Register selected values for captured subprocess-output and failure-diagnostic
+  redaction. Inspection and invocation metadata contain credential names, never
+  their values. This protection does not scan files Scriptorium writes directly.
+- Reuse the credential-forwarding boundary shared with Audita and Notarius.
+  Retire the completed Scriptorium credential-forwarding bug report from the
+  source roadmap; its history remains in Git.
+
+[COPYRIGHT](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.1.0/COPYRIGHT) | [LICENSE](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.1.0/LICENSE) | [ATTRIBUTION](https://gitea.maximumdirect.net/eric/narratio/src/tag/v3.1.0/docs/oss/attribution.md)

docs/roadmap/configkit-adoption.md

@@ -1,375 +0,0 @@
-# ConfigKit Adoption and Platform Simplification
-
-**Status:** Accepted; implementation pending
-
-## Purpose
-
-Narratio currently owns a substantial YAML configuration subsystem for strict
-decoding, explicit imports, additive composition, profile overlays, presence
-tracking, provenance, and effective-value inspection. ConfigKit was extracted
-from this implementation and now provides those generic responsibilities as a
-maintained library.
-
-Narratio 2.0 will adopt ConfigKit as its configuration foundation, remove the
-superseded generic infrastructure, and retain only Narratio-specific configuration
-policy and domain resolution. The same major release will narrow the supported
-platform set to the systems that Narratio is expected to run on in practice.
-
-This roadmap defines the desired contracts and end state. The
-[implementation plan](implementation.md) owns sequencing and completion gates.
-
-## Goals
-
-- Reduce Narratio-owned configuration code and tests by delegating generic YAML
-  mechanics to ConfigKit.
-- Establish one strict and explainable configuration lifecycle rather than
-  retaining parallel or compatibility loaders.
-- Preserve Narratio's application-specific defaults, validation, campaign/session
-  resolution, party handling, artifact-family expansion, digests, and CLI policy.
-- Make individual artifact definitions easy to organize, identify, inspect, and
-  reuse as dependencies of later artifacts.
-- Keep raw credentials out of YAML and adopt a predictable secrets-directory
-  convention that works before configuration loading.
-- Remove unsupported platform code and release obligations that provide no known
-  user value.
-- Deliver the resulting contract changes as Narratio v2.0.0 with a clear migration
-  guide.
-
-## Platform Contract
-
-Narratio's v2 platform matrix is:
-
-| Platform | Status | Required evidence and deliverables |
-| --- | --- | --- |
-| Linux amd64 | Primary, supported | Default tests, race checks, static analysis, build validation, and a release asset |
-| Linux arm64 | Primary, supported | Cross-build validation and a release asset; native validation is used when an appropriate runner is available |
-| macOS arm64 | Best effort | Cross-build validation and a release asset; native CI and platform-equivalent runtime guarantees are not required release gates |
-| macOS amd64 | Unsupported | No build gate, release asset, compatibility promise, or platform-specific maintenance |
-| Windows | Unsupported | No build gate, release asset, compatibility promise, or platform-specific maintenance |
-
-Windows- and Intel-Mac-specific code, tests, CI entries, release packaging, and
-documentation are removed when they no longer serve a supported build. Portable
-code should remain portable where doing so is natural, but accidental compilation
-on an unsupported target does not create a support commitment.
-
-Best-effort macOS arm64 support means Narratio intends to keep the target buildable
-and will consider reported defects when practical. Lack of a native runner or an
-unverified platform-specific behavior does not block a release. A target for which
-Narratio publishes an asset must still pass its configured cross-build gate.
-
-## ConfigKit Dependency and Ownership
-
-Narratio will depend on the tagged ConfigKit module at an exact reviewed version,
-initially `gitea.maximumdirect.net/eric/ConfigKit@v0.1.1`. ConfigKit is pre-1.0 and
-may make compatibility changes in later minor versions, so dependency upgrades are
-intentional changes accompanied by contract review and focused Narratio integration
-tests; Narratio does not follow an unpinned branch or automatically accept a newer
-minor release.
-
-ConfigKit owns:
-
-- bounded file, byte, and reader input;
-- the accepted YAML syntax and strict typed decoding;
-- import declarations, traversal, containment, and resource limits;
-- additive composition and conflict attribution;
-- selected-profile overlay semantics;
-- explicit input presence and source provenance;
-- application-default and recorded-resolution coordination;
-- structured configuration diagnostics;
-- secret-reference parsing and resolution;
-- secrets-directory loading and its safe report; and
-- detached effective configuration inspection supplied by its public result.
-
-Narratio owns:
-
-- pipeline, campaign, session, party, and runtime domain types;
-- configuration-file discovery and CLI selection;
-- concrete defaults, normalization, and semantic validation;
-- campaign/session identity and stable-input resolution;
-- canonical party parsing requirements and authored-byte retention;
-- character artifact-family expansion and generated ownership attribution;
-- root-relative interpretation of Narratio-owned runtime paths;
-- effective pipeline digests and semantic profile diffs;
-- command output and exit behavior; and
-- adapter and runtime initialization after configuration succeeds.
-
-Narratio must use ConfigKit through its public package. It must not import
-ConfigKit's private YAML implementation or reproduce ConfigKit's parser,
-composition, profile, provenance, or secret-bootstrap mechanics locally.
-
-## Configuration Format
-
-Narratio adopts ConfigKit's configuration conventions directly. The old Narratio
-`composition:` envelope, declared profile catalog, arbitrary overlay paths, and
-`composition.default_profile` are removed without a compatibility parser.
-
-The root pipeline uses `configkit.imports` declarations. Import paths, optional
-imports, globs, recursion, ordering, composition conflicts, containment, and limits
-have the meanings defined by the pinned ConfigKit contract. Narratio does not add a
-second import syntax or narrower application-specific traversal implementation.
-
-The unoverlaid root and its imports are the production configuration. A named
-profile is a ConfigKit overlay at `profiles/<name>.yml`; in particular,
-`profiles/testing.yml` contains inexpensive-model overrides and testing-only
-artifacts. Omitting `--profile`, or selecting ConfigKit's `default` profile, uses the
-production base. `--profile testing` applies the testing overlay. Narratio does not
-maintain a separate configured default-profile mechanism or validate unselected
-profile files.
-
-ConfigKit's rules for explicit false, zero, empty, and null values replace
-Narratio's custom presence tracking. Application defaults and normalization use a
-ConfigKit definition and recorded resolution where the final value depends on
-whether input was present. `NormalizeConfig.UnmarshalYAML` and equivalent
-parser-coupled application hooks are removed.
-
-Pipeline, campaign, session, and party inputs use the common ConfigKit loading
-boundary where its schema model can represent their types. Narratio may perform
-narrow pre- or post-load domain work, such as retaining authored party bytes,
-rejecting unresolved session-template placeholders, resolving stable inputs, and
-expanding artifact families. Such work must not recreate a second generic YAML
-loader.
-
-## Artifact Definition Ergonomics
-
-The canonical v2 configuration layout defines each ordinary Scriptorium artifact
-in its own file under `artifacts/`. The root pipeline imports the directory through
-ConfigKit, for example:
-
-```yaml
-configkit:
-  imports:
-    - glob: artifacts/*.yml
-```
-
-Each file contributes one ordinary entry at
-`scriptorium.artifacts.<artifact_key>`. The map key is the authoritative Narratio
-artifact key and therefore makes the artifact's internal identity explicit in the
-definition itself:
-
-```yaml
-# artifacts/session_recap.yml
-scriptorium:
-  artifacts:
-    session_recap:
-      enabled: true
-      prompt_id: dnd.session_recap
-      output_path: artifacts/session_recap.md
-```
-
-The canonical reusable source ID is derived without another configured identifier:
-`session_recap` becomes `narratio.artifact.session_recap`. The recommended filename
-is `<artifact_key>.yml`, but the filename is organizational rather than an identity
-source. Renaming or moving a file without changing its map key does not change the
-artifact contract. ConfigKit additive composition rejects duplicate artifact keys.
-
-The one-artifact-per-file layout is the documented happy path and is used by
-maintained examples. Narratio does not prohibit an inline artifact or another
-ConfigKit-compatible source organization merely because it differs from that
-layout. Artifact identity always comes from the effective map key, never implicitly
-from a filename or import position.
-
-Artifact families use the corresponding `artifact-families/*.yml` convention, with
-one `scriptorium.artifact_families.<family_key>` entry per file. The family key is
-explicit. Concrete member keys and source IDs continue to use Narratio's existing
-deterministic family/member naming rule after canonical party resolution.
-
-Narratio adds a read-only `narratio config artifacts` command using the ordinary
-pipeline, profile, and campaign selectors. It reports every effective ordinary
-artifact's key, canonical `narratio.artifact.<key>` source ID, defining source,
-enabled state, output path, and effective dependencies. Generated family members
-also report their family origin. Output ordering is deterministic by artifact key,
-and the command does not require a session or initialize runtime adapters.
-
-A configured-artifact input creates an implicit dependency on the referenced
-artifact. For example:
-
-```yaml
-inputs:
-  recap:
-    source: narratio.artifact.session_recap
-```
-
-The effective dependency graph is the union of explicit `depends_on` entries and
-dependencies inferred from `narratio.artifact.<key>` inputs. Inferred and explicit
-duplicates collapse to one dependency. `depends_on` remains available for an
-ordering requirement when the upstream output is not supplied as an input.
-Validation applies the same existence, self-reference, and cycle rules to both
-kinds of dependency, and diagnostics identify the declaration or input that
-introduced an invalid edge. Operators no longer need to repeat an artifact input in
-`depends_on` merely to make that input valid.
-
-## Effective Inspection, Digests, and Profile Diff
-
-ConfigKit results are the authority for composed input presence, base/profile
-origins, diagnostics, and the initial typed effective configuration. Narratio's
-configuration commands adapt those results to existing application-facing command
-formats rather than exposing ConfigKit implementation types directly.
-
-Party-dependent artifact families are expanded only after the selected campaign and
-canonical party are known. That derived state is intentionally outside ConfigKit's
-completed load snapshot. Narratio retains a narrow application-owned layer that:
-
-- records generated family/member and publish-rule attribution;
-- projects the final post-expansion pipeline for operator inspection;
-- recomputes the effective pipeline digest after expansion; and
-- ensures stages and adapters receive only the final concrete configuration.
-
-Narratio continues to own semantic `config diff` behavior because ConfigKit does
-not provide configuration diffs or fingerprints. Each side of a profile comparison
-may be loaded independently through ConfigKit. The former guarantee that both sides
-come from one parsed source snapshot is removed; operators must not rely on a
-meaningful comparison while concurrently modifying its source files. Equality is
-still based on normalized effective values rather than YAML formatting or source
-layout.
-
-## Credential and Secrets Convention
-
-Raw API keys and other credential values remain prohibited in pipeline, campaign,
-session, generated configuration, manifests, diagnostics, examples, and logs.
-Credential-bearing configuration fields use ConfigKit secret references: YAML
-contains an environment-variable name, while the resolved value remains available
-only through ConfigKit's trusted typed boundary. Fields should use credential names
-rather than legacy names ending in `_env` when the v2 schema is updated.
-
-The `pipeline.secrets.env_dir` stanza is removed. Narratio selects a secrets
-directory before parsing the pipeline using this precedence:
-
-1. an explicitly supplied `--secrets-dir PATH`; otherwise
-2. the `secrets` subdirectory beside the selected root pipeline file.
-
-The conventional directory is derived from the resolved root pipeline path, never
-from the current working directory, an imported file, or a selected profile. A
-relative explicit CLI path is resolved from the caller's current working directory,
-consistent with an ordinary command-line path argument.
-
-If an explicitly selected directory is missing or invalid, the command fails with a
-clear bootstrap diagnostic. If the conventional directory is absent, Narratio
-performs no directory bootstrap and continues; pre-existing environment variables
-may satisfy all references. If the conventional directory exists but ConfigKit
-rejects or cannot read it, the command fails. Already-set environment variables,
-including empty values, retain ConfigKit's documented precedence.
-
-Narratio explicitly calls `configkit.LoadSecretsDir` at most once for a command,
-before the first ConfigKit load that may resolve secret references and before any
-concurrent work or runtime client initialization. This application-level convention
-does not make ConfigKit's ordinary `Load` mutate process-global state. The bootstrap
-report is rendered or summarized through a safe Narratio command boundary without
-secret values.
-
-Narratio adopts ConfigKit's secret-directory rules and limits without restoring its
-old permission-mode, selected-directory-symlink, invalid-entry, byte-limit, or
-newline-trimming behavior through compatibility wrappers. Configuration inspection
-may require the referenced environment variables or the selected secrets directory
-because an ordinary successful ConfigKit load resolves effective typed secret
-references. Inspection output may show non-secret reference names where appropriate,
-but must never expose resolved values.
-
-## Validation and Diagnostics
-
-Narratio's semantic rules remain recognizable application code registered with the
-appropriate ConfigKit definition. Validation continues to reject invalid pipeline,
-campaign, session, party, adapter, publish, and artifact relationships before
-runtime work where practical. Validation order and exact prose are not compatibility
-contracts.
-
-ConfigKit diagnostic codes, paths, and source locations should be preserved through
-the application error boundary where useful. Narratio adds command context and exit
-classification but does not parse ConfigKit error strings or expose raw parser
-errors. Secret values must remain absent from success and failure diagnostics.
-
-## Compatibility and Migration
-
-This work intentionally changes supported platforms, pipeline composition syntax,
-profile layout and selection, secret configuration, YAML semantics, diagnostics,
-and some inspection prerequisites. It is released as Narratio v2.0.0.
-
-There is no runtime compatibility layer for the old `composition` or
-`pipeline.secrets` syntax. Maintained examples are converted to the ConfigKit
-format, and the v2 release documentation provides a concise migration guide that
-covers:
-
-- converting imports to `configkit.imports` declarations;
-- folding the production overlay into the base configuration;
-- placing testing overrides in `profiles/testing.yml`;
-- moving ordinary artifacts and artifact families into the recommended individual
-  definition files and using their map keys as canonical identities;
-- removing redundant `depends_on` entries when a configured-artifact input now
-  supplies the same dependency;
-- moving secret files to the conventional sibling `secrets/` directory or using
-  `--secrets-dir`;
-- renaming credential-reference fields where applicable;
-- ConfigKit's stricter YAML and explicit-value semantics;
-- the independent-load behavior of `config diff`; and
-- the removal of Windows and macOS amd64 artifacts.
-
-Obsolete application implementation, tests, documentation, examples, CI paths, and
-release machinery are removed rather than left deprecated inside the v2 codebase.
-
-## Required Changes
-
-- Add and pin the ConfigKit module dependency and establish a small application
-  integration boundary for definitions, result adaptation, and diagnostics.
-- Replace Narratio's generic YAML parsing, composition, import, profile, presence,
-  and provenance implementation with ConfigKit public APIs.
-- Express existing defaults, presence-sensitive normalization, and semantic
-  validation through ConfigKit definitions without moving Narratio domain policy
-  into the library.
-- Adapt pipeline/campaign/session/party loading and preserve the existing
-  application resolution steps that occur after their independent typed loads.
-- Rework effective configuration, sources, and diff commands around ConfigKit
-  results plus Narratio's post-party generated-attribution layer.
-- Add the maintained per-artifact and per-family file layouts, the read-only
-  `config artifacts` catalog, and effective dependency inference from configured
-  artifact inputs.
-- Convert credential configuration to typed references, add the common
-  `--secrets-dir` option, implement conventional-directory selection, and replace
-  the custom API-key directory loader with `configkit.LoadSecretsDir`.
-- Update adapters to consume resolved credentials or safe environment reference
-  names from typed configuration without independently rediscovering secret values.
-- Remove Windows and macOS amd64 build targets, release assets, CI entries,
-  platform-specific implementation, and obsolete tests and documentation.
-- Convert maintained examples and add v2 migration and release documentation.
-- Retain focused Narratio tests for domain policy and assembled application
-  behavior while deleting parser/composer/bootstrap mechanism tests now owned by
-  ConfigKit. Tests remain deterministic, offline, credential-free, and aligned with
-  the repository testing policy.
-- Update canonical architecture, configuration, CLI, operations, development,
-  internal, troubleshooting, and release documentation only as the corresponding
-  behavior is implemented.
-
-## Target End State
-
-Narratio v2.0.0 has one configuration infrastructure dependency and no duplicate
-YAML composition subsystem. Operators maintain a production base configuration,
-optional explicit imports, and fixed named overlays such as `testing`. ConfigKit
-provides strict parsing, composition, typed loading, provenance, diagnostics, and
-credential resolution; Narratio supplies domain meaning and its post-campaign
-artifact expansion.
-
-Operators can add an artifact by creating one discoverable YAML file whose map key
-is its stable Narratio identity. `config artifacts` exposes that key, its canonical
-source ID, origin, output, and effective dependency set. A later artifact can reuse
-the output through `narratio.artifact.<key>` without repeating the same edge in
-`depends_on`, while explicit ordering-only dependencies remain supported.
-
-Secrets normally live in a predictable `secrets/` directory beside the selected
-pipeline, with `--secrets-dir` available for deployment-specific placement. Raw
-credential values never enter YAML or inspection output. The bootstrap is explicit
-in application startup and ordinary ConfigKit loading remains free of process-global
-mutation.
-
-Release and CI maintenance covers Linux amd64 and arm64 as the primary platforms
-and macOS arm64 on a best-effort basis. Windows and macOS amd64 carry no remaining
-support or release burden. The repository contains no legacy configuration parser,
-profile compatibility layer, obsolete platform implementation, or redundant tests
-for behavior owned by ConfigKit.
-
-## Deferred Work
-
-- A ConfigKit reference-only inspection or typed prepare/finalize lifecycle may be
-  considered upstream if credential-free inspection becomes a demonstrated shared
-  requirement. Narratio does not implement a private substitute in this migration.
-- ConfigKit hot reload, remote providers, automatic configuration migration, and
-  application command frameworks remain outside Narratio's scope.
-- Native macOS arm64 CI may be added later when a reliable runner is available; it
-  is not required for v2.0.0.

docs/roadmap/implementation.md

@@ -1,522 +0,0 @@
-# ConfigKit Adoption Implementation Plan
-
-Status: Complete
-
-Implement the [ConfigKit adoption roadmap](configkit-adoption.md) in the order
-below. The target is Narratio v2.0.0: ConfigKit v0.1.1, the reduced platform
-matrix, and the artifact-authoring workflow described there. Each stage is a
-bounded implementation assignment for a gpt-5.6-terra coding agent. Mark a stage
-complete only after its changes and acceptance checks succeed; record a short
-completion and verification note beside its status.
-
-## Instructions for every stage
-
-- Read `docs/development.md` and all three policies under `docs/policy/`.
-  Read the relevant roadmap section and the stage-specific sources listed below.
-  Paths identify starting points, not an exhaustive edit allowlist; inspect callers
-  and tests before changing a package boundary.
-- Use the tagged ConfigKit public API. The local `../ConfigKit` checkout is useful
-  reference material, but verify its version before relying on it. The module
-  cache for v0.1.1 is an alternative. Do not require a sibling checkout, a local
-  `replace`, a Go workspace, an upstream patch, or an unpinned revision to build.
-- Keep Narratio domain policy in `internal/config`, startup and selectors in
-  `internal/app`, and credential delivery in the owning adapters. Do not build
-  a general configuration framework around ConfigKit.
-- Keep each stage buildable and run focused behavioral tests for its changed
-  boundary. Temporary migration helpers may exist between stages only where
-  named here; they must not introduce runtime format auto-detection or fallback.
-- Update each canonical current-behavior document when its behavior changes.
-  The roadmap remains the owner of unimplemented work. Preserve historical
-  release notes; their descriptions of old platforms and formats are history.
-- Tests use real ConfigKit and temporary files, with fake external adapters or
-  storage where needed. Use synthetic credentials and isolate environment
-  mutation; such tests must not run in parallel. Retain domain and security
-  coverage, remove superseded mechanism tests, and avoid exact diagnostic prose
-  or private callback choreography assertions.
-- Do not tag or publish v2.0.0 as part of this plan. Release preparation belongs
-  here; release authorization and tag publication are a later task. The existing
-  release completion boundary remains successful upstream tag push, with no CI
-  polling or waiting.
-
-## Decisions that apply across stages
-
-The roadmap is authoritative for product scope. These implementation choices
-make that scope concrete:
-
-- Enable ConfigKit imports and profile selection for pipeline files only.
-  Campaign, session, and party are single-source definitions with imports and
-  profiles disabled. Preserve their domain schemas and source-relative inputs.
-  Omitted or empty profile and the exact name `default` select the base; other
-  names use ConfigKit's fixed `profiles/<name>.yml` convention.
-- Defaults apply to absent fields. Explicit empty/zero/false/null values follow
-  ConfigKit decoding and then domain validation; do not refill invalid explicit
-  values with legacy defaults. Optional null stage sections remain absent;
-  required sections fail domain validation rather than being resurrected.
-- Keep ConfigKit metadata/result snapshots separate from runtime-only Narratio
-  state. ConfigKit discards ignored and unexported fields when detaching values;
-  attach root paths, retained party bytes, family catalogs, and digest metadata
-  after loading. No validator may mutate bound configuration.
-- Use one Narratio-owned safe effective projection for the final expanded
-  pipeline. It contains configuration values and credential reference names,
-  never resolved credential bytes. It feeds show, semantic diff, digest, and
-  catalog data. ConfigKit metadata remains the authority for input provenance;
-  Narratio adds only domain-generated attribution.
-- Rename `storage.s3.access_key_id_env` to `access_key_id`,
-  `storage.s3.secret_access_key_env` to `secret_access_key`, and
-  `audita.llm_api_key_env` to `llm_api_key`. Each is an optional `*configkit.Secret`.
-  An explicit reference always resolves during loading, even if the associated
-  stage will not execute. Require both S3 fields together or neither. With neither,
-  retain the AWS SDK default credential chain; do not synthesize mandatory secret
-  references that would break role-based authentication or local-only inspection.
-  With no Audita reference, preserve its existing downstream credential discovery.
-  Explicit references replace Narratio's old per-adapter environment lookup.
-- Keep absent S3 credentials out of defaults; migration examples explicitly name
-  the existing AWS variables when static credentials are intended. A non-nil
-  missing/empty reference fails instead of silently falling back. This preserves
-  provider-managed credentials while making explicit configuration trustworthy.
-- `config artifacts` uses the existing configuration command selectors and text
-  output convention. No new JSON mode, artifact creation wizard, inferred filename
-  identity, or profile catalog is added.
-- Preserve the roadmap's unique base artifact definition rule explicitly:
-  ConfigKit rejects conflicting leaves but can compose disjoint children of the
-  same mapping. Use its public source metadata to reject an ordinary artifact key
-  declared by multiple base files, even if their fields are disjoint. Apply the
-  same rule to family keys. A selected profile may override or extend a definition.
-  This is a narrow Narratio declaration rule, not a different merge algorithm.
-- Relax only the obsolete configuration/secrets filesystem restrictions identified
-  by the roadmap. Do not remove session restore, cleanup, publication, workspace
-  confinement, or ordinary shared-workspace mode guarantees as collateral work.
-
-## Stage 1 — Reduce the platform and release matrix
-
-Status: Complete — Reduced CI and release output to Linux amd64/arm64 and macOS
-arm64, removed Windows-only runtime implementations and accommodations, and
-verified focused tests, all three cross-builds, exact asset names, and embedded
-version reporting.
-
-Read: roadmap “Platform Contract”; `scripts/build-release-assets.sh`,
-`scripts/check-release-candidate.sh`, `.woodpecker/`, `internal/releasecheck`,
-`docs/release.md`, and platform-specific files in application, file operations,
-and subprocess packages.
-
-1. Make Linux amd64, Linux arm64, and macOS arm64 the only maintained build and
-   release targets. Remove Windows suffix/packaging branches and macOS amd64
-   targets from scripts, workflows, tests, and current documentation.
-2. Delete Windows-only implementations and tests; simplify paired build-tag
-   files where the remaining implementations can be shared. Preserve portable
-   code when retaining it adds no special support machinery. Preserve functioning
-   Unix subprocess cancellation, locking, and file operations on both supported OSes.
-3. Retain the local Linux verification gates and cross-build gates for all three
-   published assets. Do not introduce a native macOS runner requirement or claim
-   that cross-compilation verifies runtime behavior.
-4. Update architecture/operations platform statements and contributor/release
-   guidance. Keep existing release protections and the no-CI-wait boundary intact.
-
-Acceptance: focused platform/subprocess/fileops/releasecheck tests pass; build all
-three targets with `CGO_ENABLED=0`; verify the asset builder produces exactly the
-three expected versioned binaries and the host binary reports the supplied version.
-Existing release tests still prove guarded publication. No current support promise
-or asset list retains Windows or macOS amd64.
-
-## Stage 2 — Separate configuration normalization from validation
-
-Status: Complete — Added explicit deterministic pipeline normalization before
-validation, made Notarius validation read-only on accepted and rejected inputs,
-documented the boundary, and verified config race tests plus app/stage consumers.
-
-Read: `internal/config/load.go`, `defaults.go`, `normalize.go`, `validate*.go`,
-`artifact_families.go`, and ConfigKit's “Recorded application resolution”,
-“Semantic validation”, and “Defaults and typed decoding” contracts.
-
-1. Separate value-producing normalization from read-only validation, including
-   Notarius reference/output normalization currently performed by
-   `validateNotarius`. Audit all validators for map, slice, pointer, and scalar
-   mutations, including changes that would occur only on error paths.
-2. Keep reusable domain normalization ordinary package code. Validation checks the
-   already normalized candidate and must work for both loaded and programmatically
-   constructed values without silently fixing them.
-3. Inventory defaults in `load.go`: static defaults, per-map-entry/list-element
-   defaults, and inherited or presence-sensitive defaults. Retain named constants
-   in `defaults.go`. This inventory should guide code and concise comments, not
-   become a permanent parallel defaults document.
-4. Keep the current loader calling normalization explicitly before validation
-   during this preparatory stage. The ConfigKit resolver replaces that loading
-   choreography in Stage 4. Preserve family expansion as an explicit domain step.
-
-Acceptance: focused configuration tests prove normalization is deterministic and
-validation does not mutate accepted or rejected inputs. Cover representative
-Notarius normalization/collision handling and existing artifact/publish rules.
-Do not add a separate mutation test for every trivial validator.
-
-## Stage 3 — Replace composition-dependent effective projection
-
-Status: Complete — Introduced one typed safe projection for effective YAML,
-semantic values, source paths, and the versioned v3 digest; removed composition
-parsing from those consumers and verified ordering, expansion, relocation,
-nil/empty, exact-integer, CLI diff, and semantic-resume behavior.
-
-Read: `internal/config/effective_pipeline.go`, `effective_digest.go`,
-`pipeline_composition.go`, `internal/app/config_commands.go`, the config-diff
-implementation, and `docs/internal/configuration.md`.
-
-1. Introduce one package-owned, schema-specific safe projection of the effective
-   pipeline. Use explicit typed projections with stable configuration field names;
-   preserve null versus empty containers and exact integers. Ordinary nested
-   configuration types may be reused where they contain no runtime state.
-   Credential fields must be projected explicitly as reference names when Stage 7
-   changes their types. Do not introduce a generic reflection schema engine.
-2. Render this projection as deterministic YAML using the existing YAML encoder;
-   encoding output is not a replacement YAML loader. Produce semantic records
-   directly from the safe projection using standard JSON encoding/decoding with
-   number preservation if a plain value tree is useful. Do not reparse YAML or
-   reconstruct `compositionNode` trees to compare or hash effective values.
-3. Make show, diff values, and digest use that common projection. Mapping order is
-   immaterial; sequences remain atomic for diff; nil and empty remain distinct.
-   Exclude family declarations once expanded, all runtime metadata, profile names,
-   source locations, and raw credentials. Preserve logical Notarius path handling
-   so moving an equivalent bundle does not change its digest.
-4. Version the changed digest encoding explicitly using the package's digest
-   version constant. Digest/profile metadata remains provenance, never a blanket
-   resume cache key. Keep stage/artifact semantic evidence behavior intact.
-5. Decouple enumeration of effective field paths from the legacy composition
-   renderer. Input ownership can still come from the current loader until Stage 4.
-
-Acceptance: show/diff/digest tests cover equivalent monolithic/split values,
-different map insertion order, null/empty distinction, family-expanded outputs,
-and bundle relocation. A meaningful artifact change changes the digest; formatting
-and profile naming alone do not. Existing semantic resume tests pass. No effective
-projection consumer needs the custom composition parser/renderer.
-
-## Stage 4 — Cut pipeline loading over to ConfigKit
-
-Status: Complete — Replaced pipeline composition with ConfigKit v0.1.1 imports,
-fixed-path profile selection, fresh typed defaults, recorded resolution, source
-metadata adaptation, and duplicate base artifact/family enforcement; removed the
-legacy parser and verified all tests plus the configuration race suite.
-
-Read: ConfigKit v0.1.1 `docs/config.md`, `docs/consumers/README.md`, and its
-Narratio-shaped compiled example; Narratio `internal/config/load.go`,
-`composition.go`, `pipeline_composition.go`, and profile/composition tests.
-
-1. Pin `gitea.maximumdirect.net/eric/ConfigKit v0.1.1` in `go.mod`/`go.sum`.
-   Implement a small pipeline definition using `Load`, `File`, enabled imports,
-   `Options.Profile`, defaults, recorded resolution, and read-only validation.
-2. Migrate static defaults to fresh default values. Apply map-entry, list-element,
-   and inherited defaults with `Resolution.Default`/`IsExplicit`; use recorded
-   normalization for transformations from Stage 2. Do not call old post-decode
-   zero-filling defaults. Remove `NormalizeConfig.UnmarshalYAML` and its private
-   presence bit. Include publication list-entry defaults, optional section
-   allocation, and trim's Scriptorium requirement in this conversion.
-3. Perform file-local semantic checks in the definition. Defer checks needing
-   canonical party expansion or campaign/session context to the existing explicit
-   resolution boundary; do not reject references to future concrete family members
-   merely because the campaign has not loaded yet. Run full checks after expansion.
-4. Replace pipeline composition and profile loaders. `configkit.imports` is the
-   only directive; no `composition` or `_configkit` alias is accepted. Pass profile
-   selection directly under the agreed convention; unselected overlays are not read.
-   `LoadPipelineProfilePair` may remain a thin pair of independent loads, with no
-   shared parse cache or paired source-snapshot promise.
-5. Adapt ConfigKit sources and metadata to Narratio's existing reporting records.
-   Translate paths structurally using public path APIs, not error-message parsing.
-   Preserve multiple contributing locations for composite/profile-owned mappings
-   and distinguish defaults/resolution from authored values.
-   Check artifact/family map-entry ownership for duplicate base declarations using
-   those locations; ignore synthetic defaults and allow the selected overlay.
-6. Attach runtime metadata only after load succeeds. Preserve root-relative runtime
-   path interpretation and capture logical paths before making them absolute.
-   Retain family declarations and original ConfigKit metadata for later expansion.
-7. Replace generic mechanism tests with a small integration set proving actual
-   Narratio wiring. Convert fixtures affected by this stage. Delete
-   `composition.go`, obsolete pipeline traversal/overlay/presence machinery, and
-   their redundant tests once the callers are migrated.
-
-Acceptance: a real root with imports and a testing overlay loads; duplicate claims
-fail with useful source attribution, including two base files contributing disjoint
-fields to one artifact or family key; base/default selection works; malformed
-unselected profiles do not fail base loading. Omitted defaults and representative
-explicit false/zero/empty/null inputs obey the new semantics. Invalid domain values
-still fail. Commands use the new pipeline loader with no format fallback. Update
-`docs/config.md` and configuration internals for the implemented boundary.
-
-## Stage 5 — Migrate campaign, session, and canonical party loading
-
-Status: Complete — Migrated campaign, session, and canonical-party documents to
-independent ConfigKit definitions, preserved bounded session inspection, exact
-party bytes and metadata-derived authored order, and retained identity, source,
-family-expansion, and validation behavior; verified all tests and focused races.
-
-Read: `internal/config/load.go`, `party.go`, `party_resolution.go`,
-`artifact_families.go`, session-template tests, `internal/app/config_loader.go`,
-and ConfigKit source/schema/version contracts.
-
-1. Use separate ConfigKit definitions for campaign, session, and party. Replace
-   `decodeStrictYAML*` and the custom party YAML-node parser. Model the party input
-   as the existing string schema version and character-keyed typed map, with the
-   existing `alias` list, ordered class list, and optional positive class level.
-2. Keep party domain checks: valid IDs, required display names and classes,
-   trimmed/control-free names, case-insensitive name/alias ambiguity, and duplicate
-   class checks. Validate the required version through `VersionRule`. Keep an
-   exact independent copy of authored bytes outside ConfigKit's schema object.
-3. Preserve authored character order using successful metadata source coordinates
-   for the single party input when constructing `CanonicalParty.Characters`.
-   Preserve class/alias sequence order naturally. Family expansion and players
-   projection continue using their existing deterministic ID sorting. Do not keep
-   a second YAML parse just to recover mapping order.
-4. Preserve the narrow session placeholder rejection before typed load, expected
-   session/previous-session identity checks, campaign selection, stable-input
-   precedence, and local versus remotely downloaded session provenance.
-   Retain the initially loaded pipeline/campaign during remote session acquisition.
-5. Where bytes must be retained or inspected before `ConfigKit.Bytes`, bound the
-   initial read too, using the existing fileops bounded-read helper and a named
-   package constant of 8 MiB matching the pinned source limit. Otherwise prefer
-   `ConfigKit.File`. Do not read an unbounded file and rely on later rejection.
-6. Complete post-party family and publish-rule expansion, then full cross-config
-   validation and digest refresh. Keep generated origins outside the library
-   snapshot. Remove unused decoder plumbing and obsolete party parsing tests.
-
-Acceptance: retained authored party bytes are identical; domain errors, aliases,
-class order, family origins, and derived players are correct. Local and remote
-session loads preserve identity, input path bases, and the original pipeline.
-Unknown fields and disabled directives fail through ConfigKit. Focused config,
-prepare/extract, and application loading tests pass.
-
-## Stage 6 — Move secrets bootstrap before all configuration loads
-
-Status: Complete — Added invocation-scoped ConfigKit secrets bootstrap before
-all pipeline loads and adapter construction, exposed consistent explicit and
-conventional directory selection across the CLI, removed the retired pipeline
-schema and custom loader, and verified focused, full, and race test suites.
-
-Read: roadmap “Credential and Secrets Convention”; ConfigKit's bootstrap
-contract; `internal/app/secrets_env*.go`, `config_loader.go`, `config_commands.go`,
-`object_store.go`, command dependencies, and command argument owners.
-
-1. Add a shared `--secrets-dir` selector to every CLI path that loads a pipeline,
-   including configuration inspection/diff, execution aliases, planning, publish,
-   and session/storage operations. Route all through one command-owned bootstrap
-   context. Help/version and commands that do not load configuration do not bootstrap.
-2. Discover the root pipeline first. An explicit relative directory is based on
-   caller CWD; otherwise choose `secrets/` beside the resolved root pipeline.
-   An explicitly empty flag is invalid. Missing conventional directories are
-   skipped; missing explicit directories and unreadable/invalid existing directories
-   fail. Use ConfigKit's selected-directory symlink behavior without custom rejection.
-3. Call `LoadSecretsDir` at most once per command before any ConfigKit load or
-   adapter creation, including both loads of config diff and remote session lookup.
-   Use invocation state, not a package-global `sync.Once`. A new command gets its
-   own bootstrap; library config loaders themselves never mutate the environment.
-4. Present safe bootstrap warnings/failures through stderr or the existing safe
-   diagnostic boundary, never into YAML show output. Preserve the partial report
-   on bootstrap failure. Do not add rollback or reinterpret ConfigKit file rules.
-5. Remove late bootstrap calls in object-store and runner composition, the custom
-   directory reader and permission platform files, `pipeline.secrets`, its defaults
-   and validators, and their obsolete tests. Convert affected fixtures immediately.
-
-Acceptance: test absent conventional directory, explicit override from another
-CWD, invalid explicit directory, already-set empty/nonempty environment values,
-and bootstrap failure before adapter construction. A diff invocation and a remote
-session acquisition each bootstrap once. Config inspection requires no session,
-workspace writes, manifests, or runtime clients. Update CLI, config, operations,
-architecture, and troubleshooting to the new bootstrap/permission contract.
-
-## Stage 7 — Resolve typed credentials and protect all output boundaries
-
-Status: Complete — Migrated S3 and Audita credentials to optional ConfigKit
-typed references, passed resolved values directly to runtime adapters, preserved
-the AWS default provider chain when unconfigured, and verified reference-only
-inspection, provenance, generated configuration, manifest, and diagnostic
-boundaries with focused, full, and race test suites.
-
-Read: ConfigKit “Typed secret references” and rendering contracts;
-`internal/config/config.go`, `defaults.go`, `validate_adapters.go`, the safe
-projection from Stage 3, `internal/adapters/storage/s3_backend.go`,
-`internal/adapters/audita/subprocess.go`, and their composition callers.
-
-1. Implement the three renamed optional typed fields and S3 pair policy above.
-   Reject old `_env` schema keys; remove their default-name and lookup helpers.
-   Convert maintained fixtures with synthetic environment setup where references
-   are present. Do not add credentials to unrelated local pipeline fixtures.
-2. Pass resolved S3 values to the SDK adapter's explicit static provider only when
-   the pair is configured. With neither, preserve its default provider chain.
-   Pass Audita the resolved value and safe reference name; deliver the value only
-   through the child environment's existing `AUDITA_LLM_API_KEY` override.
-   Do not re-read the environment for an explicitly resolved reference.
-3. Adapt every serialization, digest, source/diff output, diagnostic, generated
-   invocation config, manifest, and provenance caller to safe reference names.
-   Never YAML-marshal ConfigKit's opaque secret directly or call `Value()` in an
-   inspection path. Secret changes alone must not alter effective digests or
-   invalidate artifact evidence; reference-name changes may change provenance.
-4. Keep ConfigKit errors structured and safe. Domain validation messages must
-   avoid raw credential values; do not unwrap private parser errors or interpolate
-   whole trusted configuration structs into error messages.
-5. Preserve downstream tool ownership for Notarius/Scriptorium credentials that
-   Narratio does not configure. Do not add a parallel credential schema for them.
-
-Acceptance: use distinctive synthetic secrets to prove no leakage in show, sources,
-diff, catalog-ready projections, success/failure diagnostics, manifests, or generated
-Audita configuration. Verify the child receives the credential and an environment
-change after loading does not change explicit delivery. Test S3 paired references,
-partial-pair rejection, missing effective references, and nil SDK fallback offline.
-Update adapter and credential documentation and remove obsolete lookup tests.
-
-## Stage 8 — Infer and normalize artifact dependencies once
-
-Status: Complete — Finalized one normalized artifact graph from explicit ordering
-edges and configured-artifact inputs (including rewritten family members), retained
-edge origins for diagnostics, and verified focused/full tests plus the full race
-suite and an assembled input-only analyze workflow.
-
-Read: `internal/config/validate_scriptorium.go`, `artifact_families.go`,
-`internal/artifactpolicy`, `internal/artifacts`, analyze planning/execution, and
-their artifact dependency and semantic-evidence tests.
-
-1. At the final configuration resolution boundary, union explicit `depends_on`
-   with configured-artifact input references. Use the existing source-ID parser;
-   do not infer edges from filenames, arbitrary strings, or non-artifact inputs.
-2. Infer after family member inputs become concrete `narratio.artifact.<key>`
-   sources. Normalize, deduplicate, and sort the effective dependency list once.
-   Keep explicit ordering-only dependencies valid. Repeated finalization must not
-   accumulate edges or alter ordering. Store source-edge attribution separately
-   from the effective graph for diagnostics and generated provenance.
-3. Apply existing existence, self-reference, enabled-dependency, output, and cycle
-   validation to the union. Remove the error requiring an input to be repeated in
-   `depends_on`. Retain diagnostics pointing to the explicit list entry or the
-   input that contributed an invalid edge, including family origin where relevant.
-4. Ensure execution, targeted analysis, planning, prerequisite closure, reuse,
-   forced regeneration, and semantic evidence consume this same concrete graph.
-   No adapter or command may infer a second graph. Refresh final projection/digest
-   after inference; equivalent explicit and inferred declarations compare equally.
-
-Acceptance: cover input-only dependency ordering, duplicate explicit/inferred edges,
-ordering-only edges, missing/self/cyclic references, and rewritten family inputs.
-Use an assembled fake-artifact workflow to prove upstream output is supplied to a
-dependent artifact and failure/resume retains successful predecessors. Existing
-force/selection and invalidation tests remain valid. Update config and analyze
-internals with the implemented inference rule.
-
-## Stage 9 — Add the effective artifact catalog command
-
-Status: Complete — Added the read-only `config artifacts` catalog over finalized
-configuration, including effective dependencies and definition/family/party
-provenance; documented it and verified focused, full, and race test suites.
-
-Read: `internal/app/config_commands.go`, config diff/source rendering, the safe
-projection and family-origin catalogs, and `docs/cli.md`.
-
-1. Add `narratio config artifacts` to dispatch and help. Reuse ordinary pipeline,
-   profile, campaign, campaign-file, and secrets-directory parsing/resolution.
-   Resolve a campaign when families require it or when explicitly selected; a
-   pipeline with only ordinary artifacts can be inspected without a campaign.
-2. Render one stable record per effective concrete artifact in key order with
-   key, `narratio.artifact.<key>` source ID, defining source location(s), enabled
-   state, output path, and sorted effective dependencies. Family members additionally
-   identify family key, character ID, defining family source, and party source.
-3. Derive identity from the map key. A profile may contribute to an existing
-   artifact, so report contributing definition locations instead of inventing
-   a single filename owner. Use a deterministic escaped tabular text rendering;
-   include a header and no records for an empty catalog. Propagate writer errors.
-4. Use the same finalized state as show/sources/diff and runtime configuration.
-   No session download, adapter initialization, manifest access, or workspace
-   materialization is allowed. Secret bootstrap remains the agreed startup exception.
-
-Acceptance: CLI tests cover ordinary and generated artifacts, disabled entries,
-profile-added/overridden artifacts, empty catalog, no-campaign ordinary inspection,
-required-campaign failure for families, stable ordering, and no runtime side effects.
-Check identity stays the same after moving an artifact file without changing its key.
-Document the command in its canonical CLI owner and link to config layout examples.
-
-## Stage 10 — Finish the operator layout and v2 migration documentation
-
-Status: Complete
-
-Completion: Reworked the maintained bundle around an unprofiled production base,
-one-entry artifact and family imports, and a testing overlay; updated the example
-harness and inspection workflows; consolidated the v2 configuration guidance; and
-added the v2.0.0 operator migration checklist. Focused documentation/example tests,
-the offline inspection walkthrough, and the full normal/race suites pass.
-
-Read: roadmap “Artifact Definition Ergonomics” and “Compatibility and Migration”;
-`examples/README.md`, existing example bundles and their loader test,
-`docs/config.md`, `docs/operations.md`, `docs/release.md`, and internal configuration
-and artifact documentation.
-
-1. Convert maintained pipeline examples to a production base with explicit
-   `configkit.imports`, `artifacts/<key>.yml`, `artifact-families/<key>.yml`, and
-   `profiles/testing.yml`. Each recommended artifact/family file defines exactly
-   one explicit map entry. Fold old production overlays into the base.
-2. Include an input-only dependency example and at least two character-family
-   examples sharing a campaign-owned party roster. Keep supported inline artifacts
-   legal; file layout is guidance, not a filename-based validation requirement.
-3. Update the example validation harness to load root configurations and selected
-   testing profiles, not attempt to load each imported fragment as a full pipeline.
-   Use synthetic environment setup for explicit references. No example includes
-   real credentials or depends on local tools/cloud services to validate.
-4. Consolidate canonical documentation updates from earlier stages. Remove current
-   references to old composition/profile catalogs, default-profile configuration,
-   secrets.env_dir, credential `_env` fields, credential-free inspection guarantees,
-   paired diff snapshots, and removed platform support. Explain explicit-value and
-   null changes without promising reloadable inspection output.
-5. Add `docs/releases/v2.0.0.md` using the release-note structure, with a concrete
-   migration checklist linking to the canonical config/CLI docs and examples.
-   Include static S3-reference migration versus SDK credential discovery, new
-   inspection prerequisites, artifact input dependency inference, and platform
-   removals. Do not claim publication or edit older immutable release notes.
-
-Acceptance: `go test ./internal/doccheck` and
-`go test ./internal/config -run '^TestExamplesLoadAndValidate$'` pass. Walk through
-the new operator examples with config validate/show/sources/diff/artifacts offline.
-Their identities, family members, origins, and testing overrides agree.
-
-## Stage 11 — Verify the complete migration and remove remaining scaffolding
-
-Status: Complete
-
-Completion: Audited the accepted roadmap and the full change set from `1558c9c`;
-no legacy configuration loader, profile/composition traversal, presence store,
-custom secrets loader, or production YAML decoder remains. The migration removes a
-net 1,235 production and 843 test Go lines; remaining configuration code owns domain
-defaults, normalization, validation, expansion, provenance, and safe projections.
-Go 1.26.7 module hygiene, tests, race tests, vet, build, documentation, examples,
-and the v2.0.0 release-candidate checker pass. Linux amd64 was tested natively;
-Linux arm64 and macOS arm64 release assets were cross-built, with native macOS
-arm64 validation remaining best effort and outside the release gate.
-
-Read: the whole feature roadmap, completed stage notes, and the current test and
-release procedures. Review the diff from the commit introducing this plan.
-
-1. Audit every roadmap requirement against current code and executable evidence.
-   Remove temporary migration adapters and any residual generic YAML parser,
-   composer, profile traversal, explicit-presence store, old secrets loader,
-   decoder hooks, or unused tests. `gopkg.in/yaml.v3` may remain for output encoding
-   and unrelated external formats; it must not supply a second configuration loader.
-2. Confirm result-owned snapshots versus final expanded configuration are handled
-   consistently; every inspection/runtime path sees normalized inferred dependencies
-   and generated publish rules. Recheck secret safety and semantic resume boundaries.
-3. Inspect current platform conditions and asset lists. Retain historical notes but
-   no active Windows/macOS amd64 obligation. Compare owned production/test code
-   before and after; report removals and any remaining complexity with reasons.
-   Do not chase a LOC quota by removing useful domain checks or regressions.
-4. Run the repository gates with the maintained Go 1.26 toolchain:
-
-   ```sh
-   go test ./...
-   go test -race ./...
-   go vet ./...
-   go build ./...
-   go test ./internal/doccheck
-   go test ./internal/config -run '^TestExamplesLoadAndValidate$'
-   ```
-
-5. Run `scripts/check-release-candidate.sh v2.0.0` after the release note and all
-   candidate changes exist. This also verifies module hygiene and all three
-   release assets with `GOWORK=off`. Resolve failures; do not bypass checks or
-   publish a tag. Record native versus cross-build evidence accurately.
-
-Acceptance: all gates pass and every roadmap outcome has direct evidence. No
-dependency on the sibling ConfigKit checkout remains. Record completion and any
-best-effort platform limitations, then hand off for a separate release decision.
-
-## Open Questions
-
-None required before implementation. The agreed roadmap and the explicit choices
-above resolve the migration decisions. Upstream credential-free inspection and
-native macOS arm64 CI remain deferred, not prerequisites for this plan.

docs/roadmap/remediation.md

@@ -1,331 +0,0 @@
-# ConfigKit Migration Review — Required Remediations
-
-Reviewed 2026-09-07 at `f7a40af`, against the changes after `1558c9c`, the
-[feature roadmap](configkit-adoption.md), and the completed
-[implementation plan](implementation.md).
-
-The main migration is implemented. The following findings are reproducible gaps
-in the intended behavior, not proposals to restore retired compatibility or
-filesystem restrictions. P2 denotes a correctness issue to fix before release;
-P3 denotes an operator-facing completeness issue also required by the accepted
-plan. No application code was changed during this review.
-
-## 1. Derive explicit publish destinations after family expansion
-
-Status: Resolved — P2
-
-Resolution: Missing destinations are now derived through one shared domain helper
-both during ConfigKit resolution and again after concrete family expansion. Explicit
-destinations remain unchanged, while unknown sources still fail read-only publish
-validation. Regression coverage verifies resolved runtime and effective inspection
-output for generated members, explicit overrides, and unknown sources.
-
-**Evidence:** `internal/config/pipeline_configkit.go:208` derives missing publish
-destinations during the ConfigKit resolver. A concrete family member does not
-exist yet, so the resolver ignores the failed derivation. After family expansion,
-`internal/config/artifact_families.go:141` calls the now-read-only publish
-validator, which rejects the still-empty destination. The previous implementation
-could derive it during that later validation.
-
-**Reproduction:** In an otherwise valid pipeline, define a family `meta` over
-`party.characters`, with output pattern `artifacts/{character_id}.md`. Select a
-valid campaign whose party contains `alice`, and add:
-
-```yaml
-publish:
-  outputs:
-    - source: narratio.artifact.meta_alice
-```
-
-`config validate --config <pipeline> --campaign-file <campaign>` fails with
-`pipeline.publish.outputs[0].dest is required when destination cannot be derived
-from "narratio.artifact.meta_alice"`. Adding `dest: artifacts/alice.md` makes the
-same configuration pass. The destination is therefore available and derivable;
-the lifecycle omits the required final normalization step.
-
-**Required change:** Complete publish destination resolution after concrete
-artifacts exist, before publish validation and final projection/digest generation.
-Share the domain derivation logic and keep validation read-only. Preserve
-explicit destinations and generated family publish-rule collision checks. Do not
-require redundant `dest` fields or revive mutation inside validators.
-
-**Acceptance:** Test an explicit publish source naming a generated member with
-omitted destination, an explicit destination override, and a genuinely unknown
-source. Validate both effective inspection and resolved runtime configuration.
-
-## 2. Stop re-defaulting an explicitly empty Notarius working directory
-
-Status: Resolved — P2
-
-Resolution: Removed both legacy blank-value fallbacks after ConfigKit resolution.
-An omitted working directory is still derived by the presence-aware resolver, an
-explicit relative directory is still rooted at the pipeline, and explicit empty or
-whitespace-only values remain empty and fail enabled-Notarius validation. Existing
-relocation-invariant digest coverage remains green.
-
-**Evidence:** ConfigKit's resolver correctly uses presence-aware defaulting at
-`internal/config/pipeline_configkit.go:180`. However,
-`internal/config/load.go:454` subsequently replaces any blank working directory
-with the config file's directory, irrespective of input presence.
-`internal/config/effective_digest.go` also applies a blank-value fallback while
-capturing logical paths. These retained legacy fallbacks bypass the new rule that
-defaults apply only to absent fields.
-
-**Reproduction:** Set `notarius.enabled: true`, a valid config path, pipeline ID
-and output map, and `notarius.working_directory: ""`. With
-`config_path: notarius/config.yml`, `config show` succeeds and reports
-`working_directory: notarius`; validation never sees the explicit invalid blank.
-
-**Required change:** Let the ConfigKit resolver own the absent-field default.
-The subsequent runtime and logical-path conversions must preserve explicit
-emptiness so enabled-Notarius validation can reject it. Remove duplicate
-value-based defaulting rather than adding another private presence mechanism.
-
-**Acceptance:** Omission still derives the expected directory; explicit empty
-and whitespace-only values fail when Notarius is enabled; a configured relative
-directory resolves from the pipeline root. Preserve digest relocation invariance.
-
-## 3. Enforce unique base definitions even when a profile removes them
-
-Status: Resolved — P2
-
-Resolution: Loading now discovers base declarations through ConfigKit's public
-historical-path enumeration and metadata history from the selected result,
-without separately resolving the base (see finding 7). Duplicate ordinary or
-family definitions therefore fail even when an overlay nulls their container or
-all of Scriptorium. A single base owner
-with a legitimate profile override remains supported.
-
-**Evidence:** `rejectDuplicateBaseDefinitions` at
-`internal/config/pipeline_configkit.go:354` enumerates only artifact/family keys
-remaining in the final typed configuration. It inspects history for those keys
-but never examines base declarations removed by an overlay.
-
-**Reproduction:** Import `first.yml` defining
-`scriptorium.artifacts.recap.prompt_id` and `second.yml` defining
-`scriptorium.artifacts.recap.output_path`. Base validation correctly rejects the
-two-file declaration. Add `profiles/clear.yml` containing:
-
-```yaml
-scriptorium:
-  artifacts: null
-```
-
-The same root with `--profile clear` passes. A selected profile can thus hide the
-base ownership conflict, contrary to the plan's unique base-definition rule.
-This concerns disjoint contributions to one artifact, not ConfigKit's generic
-conflicting-leaf checks, which still work.
-
-**Required change:** Discover the complete base declaration set through public
-ConfigKit metadata/history, including declarations displaced by an overlay, and
-validate ownership independently of final effective-key survival. Keep legitimate
-profile overrides and profile-only definitions supported. Do not reparse source
-YAML or add a second composer.
-
-**Acceptance:** Cover duplicate ordinary and family definitions hidden by a null
-artifact/family container or null Scriptorium section. Base and selected-profile
-loads must reject the same base conflict, while a single base declaration with a
-valid overlay remains accepted.
-
-## 4. Preserve null versus empty collections in effective YAML
-
-Status: Resolved — P2
-
-Resolution: Effective YAML is now emitted from the credential-safe JSON value
-projection through an output-only YAML-node conversion. Explicit nulls, empty maps,
-empty slices, booleans, strings, and exact JSON numbers retain their semantic types.
-Public show/diff tests cover null and empty maps and slices, while digest,
-credential-redaction, deterministic output, and exact-integer coverage remain intact.
-
-**Evidence:** `internal/config/effective_pipeline.go:154` marshals the typed
-projection directly with `yaml.Marshal`. The encoder emits nil slices as `[]`
-and nil maps as `{}`, while the JSON projection used by diff and digest preserves
-them as `null`. The shared input type does not guarantee shared output semantics.
-
-**Reproduction:** Set `audita.modules: null` in a valid base and
-`audita.modules: []` in `profiles/empty.yml`. Both `config show` invocations emit
-`modules: []`, but `config diff default empty` reports:
-
-```text
-changed audita.modules null []
-```
-
-The commands disagree about the effective value. The same renderer also supplies
-the resolved pipeline diagnostic written by prepare.
-
-**Required change:** Render YAML from a credential-safe projection that explicitly
-preserves nulls and empty collections, consistently with the semantic projection.
-Keep exact integers and safe credential reference names. An output-only conversion
-is appropriate; do not restore YAML decoding or a configuration parser. This
-requires truthful inspection, not a guarantee that inspection output is reloadable.
-
-**Acceptance:** Verify null versus empty maps and slices through the public show
-boundary, and agreement with diff/digest distinctions. Retain credential-leakage
-and exact-integer regression coverage.
-
-## 5. Complete provenance for generated artifacts and inferred dependencies
-
-Status: Resolved — P3
-
-Resolution: Generated catalog records now collect the complete base/profile family
-definition set from ConfigKit history. Effective source ownership for materialized
-dependency lists is rebuilt narrowly from retained explicit-list and input-edge
-origins, including mixed and generated-family dependencies. CLI tests verify a
-profiled family catalog agrees with generated source attribution and that inferred
-ordinary edges name their input contributor instead of the central default.
-
-Two new reporting paths lose available declaration information:
-
-- **Profile contributions to family members:**
-  `internal/config/artifact_catalog.go:52` fills a generated member's definitions
-  from the single `member.Source`. That source is chosen by the first matching
-  non-default family field in `artifactFamilySource`, not the full set of effective
-  contributors. Define family `meta` in the base and override its `prompt_id` in
-  `profiles/testing.yml`. `config artifacts --profile testing` reports only the
-  base file for `meta_alice`, even though `config sources` correctly attributes
-  that member's prompt to the testing overlay.
-- **Inferred ordinary dependencies:** With `second.inputs.prior.source` set to
-  `narratio.artifact.first` and no explicit dependency list, `config sources`
-  reports `scriptorium.artifacts.second.depends_on` as `default / default`.
-  `finalizeArtifactDependencies` stores the input-edge origin, but the effective
-  ownership projection retains the pre-inference default attribution from
-  `internal/config/effective_digest.go:55` and does not consult that origin.
-
-**Impact:** Operators inspecting a testing profile or following a dependency can
-be directed to the wrong file or told a user-derived value is a central default.
-Runtime ordering and generated artifact values were correct in these reproductions.
-
-**Required change:** Use ConfigKit's contributing locations for family definition
-sets, as for ordinary artifacts, and add narrow generated attribution for inferred
-dependency lists using their retained edge origins. Preserve family/character/party
-identity and deterministic ordering. Avoid introducing a second general provenance
-store or choosing a file based on the first alphabetically visited field.
-
-**Acceptance:** A profiled family catalog exposes both relevant files; an inferred
-edge points back to its input declaration; mixed explicit/inferred dependencies
-retain their relevant contributors. Verify catalog and sources agree after expansion.
-
-## 6. Surface successful secrets bootstrap reports, including skipped empty variables
-
-Status: Resolved — P3
-
-Resolution: Successful bootstrap reports now flow once through the command
-diagnostics channel, while direct internal command calls default that channel to
-discard. ConfigKit's value-free report makes skipped existing empty variables
-explicit and remains available before later typed-load failures; structured output
-stays isolated on stdout. Command-level coverage verifies successful reporting,
-skipped-empty reporting, value redaction, clean config-show output, and one report
-for a two-profile diff.
-
-**Evidence:** `internal/app/secrets_bootstrap.go:36` discards the report whenever
-`LoadSecretsDir` returns no error. Reports are only rendered when directory
-bootstrap itself fails. This does not implement the roadmap's safe bootstrap
-reporting boundary or Stage 6's warning presentation requirement.
-
-**Reproduction:** Place a synthetic key in `secrets/NARRATIO_REVIEW_KEY`, reference
-it from `audita.llm_api_key`, and invoke config validation with
-`NARRATIO_REVIEW_KEY=` in the environment. ConfigKit correctly skips the file
-because the variable already exists, then typed loading fails with `secret.empty`.
-Narratio shows only that load failure, omitting the bootstrap report's
-`skipped_existing` and `ExistingEmpty` information. A successful load likewise
-discards all bootstrap results.
-
-**Required change:** Retain and render or summarize the safe report once per
-invocation through a diagnostic output channel, including when a later typed load
-fails. Make skipped-existing-empty outcomes explicit. Preserve process environment
-precedence and the existing partial report on failure; keep values out of all
-diagnostics and keep structured/YAML stdout uncontaminated. Do not add bootstrap
-rollback, retries, or repeated directory loading.
-
-**Acceptance:** Command-level tests demonstrate safe success/report output and a
-useful skipped-empty diagnostic, without leaking a synthetic secret or polluting
-show output. A two-profile diff still bootstraps and reports only once.
-
-## 7. Do not resolve unused base credentials when loading a profile
-
-Status: Resolved — P2
-
-Resolution: Upgraded to released ConfigKit v0.1.2 and replaced the extra base load
-with `Metadata.HistoricalPaths()` enumeration of declaration paths in the selected
-result. Ownership checks still inspect base-layer history for both ordinary
-artifacts and families, even when overlays remove them. Regression tests verify
-that a profile can replace an unset production credential with a resolvable testing
-reference or remove it with null. Existing hidden-duplicate and legitimate-override
-tests remain intact. No local dependency replacement or second composer is needed.
-
-Follow-up review: 2026-09-07 at `3ce1981`. The original six reproductions are
-addressed, but the fix for finding 3 introduces this regression.
-
-**Evidence:** `internal/config/pipeline_configkit.go:49-57` loads the base again
-without a profile to check duplicate base definitions. This calls the complete
-typed ConfigKit loader, including secret resolution, domain resolution, and
-validation—not just declaration ownership inspection. Consequently, loading a
-valid testing profile also requires credentials from the unselected base.
-
-**Reproduction:** In an otherwise valid base, set `audita.llm_api_key` to
-`NARRATIO_REVIEW_PROD_KEY`. In `profiles/testing.yml`, replace it with
-`NARRATIO_REVIEW_TEST_KEY`. Leave the production variable unset and supply only
-the testing variable with a synthetic value. `config validate --config <root>
---profile testing` fails with `secret.unset` at the base credential declaration.
-Supplying both variables makes it pass. A profile that instead sets
-`audita.llm_api_key: null` also fails when the unused production variable is
-unset. Both failures were reproduced through the current CLI.
-
-**Impact:** Operators cannot use an independent testing credential environment
-or remove a production credential requirement through a profile. Commands fail
-despite having all credentials required by their effective configuration. The
-extra full load also unnecessarily repeats configuration processing.
-
-**Required change:** Enforce unique base ownership without requiring the
-unselected base to succeed as a separately resolved runtime configuration.
-Inspect complete declaration history through ConfigKit's public metadata,
-including declarations displaced by overlays. If additional upstream metadata
-support is needed, address that explicitly rather than requiring unused secrets,
-suppressing arbitrary load failures, reparsing YAML, or restoring a second
-composer. Preserve the duplicate-definition protection added for finding 3.
-
-**Acceptance:** Add public-boundary regression tests for a profile replacing an
-unset production credential with an available testing credential, and for a
-profile removing that credential with null. Both must load successfully without
-the production variable. Retain failures for duplicate base ordinary/family
-definitions hidden by null overlays, along with legitimate profile override and
-profile-only definition coverage. Resolve secrets only for the selected effective
-configuration.
-
-## Follow-up verification
-
-After adopting ConfigKit v0.1.2 and completing finding 7, the full
-`scripts/check-release-candidate.sh v2.0.0` check passed: module hygiene,
-formatting/whitespace, uncached tests and race tests, vet, build, documentation,
-maintained examples, and Linux amd64/arm64 plus macOS arm64 release cross-builds.
-`go mod verify` also passed. The new credential regressions failed before the
-ownership-check fix and passed afterward. No local module replacements, release
-tags, or pushes were used.
-
-At `3ce1981`, `go test ./...`, `go test -race ./...`, `go vet ./...`, and
-`go build ./...` passed. The new finding was reproduced with a freshly built CLI,
-temporary configuration files, and synthetic credentials; no external adapters
-or cloud services were invoked. That review pass changed only this review record.
-
-## Original verification and scope
-
-The following checks passed at the reviewed commit:
-
-- `go test ./...`
-- `go test -race ./...`
-- `go vet ./...`
-- `go build ./...`
-- The release asset builder for `v2.0.0`, producing exactly Linux amd64, Linux
-  arm64, and macOS arm64 assets; the Linux amd64 binary reported the expected version.
-
-The existing full suites include documentation and maintained-example checks.
-The findings above were additionally reproduced through a freshly built CLI with
-isolated temporary YAML fixtures and synthetic credentials. No live downstream
-tools or cloud services were invoked. Linux arm64 and macOS arm64 were cross-built,
-not tested natively. No tag was created or pushed.
-
-The migration removes a net 1,235 production Go lines and 843 test Go lines versus
-`1558c9c` (physical diff lines, including comments and whitespace). ConfigKit owns
-generic loading/composition; Narratio retains domain resolution, orchestration,
-safe inspection, and adapter delivery. These findings require completing that
-design, not reversing the simplification.

docs/troubleshooting.md

@@ -102,7 +102,7 @@ Safe fix:
 
 Relevant reference: [Canonical Party Input](./integrations/party.md).
 
-## Unexpected imported or profile value
+## Unexpected imported or overlay value
 
 Symptom:
 
@@ -112,21 +112,21 @@ Symptom:
 Diagnostics:
 
 ```bash
-narratio config sources --config /path/pipeline.yml --profile testing
+narratio config sources --config /path/pipeline.yml --overlay testing
 ```
 
 Add `--campaign` or `--campaign-file` when the pipeline has party-driven
 artifact families. The output identifies each effective logical field's root,
-import, profile, default, campaign, party, or family source without printing
+import, overlay, default, campaign, party, or family source without printing
 the field value or credential contents.
 
 Safe fix:
 
 - move a duplicated base field so it has one owner;
-- correct the selected profile or its overlay; or
+- correct the selected overlay; or
 - correct the campaign party/family declaration that owns generated values.
 
-To review what would actually change before switching profiles, run `config
+To review what would actually change before switching overlays, run `config
 diff` with the same pipeline and campaign selectors. It compares normalized
 effective values rather than YAML formatting or source-file layout.
 
@@ -213,6 +213,170 @@ input validation.
 
 Relevant reference: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior).
 
+## Transcription retries speakers that previously finished
+
+Symptom:
+
+- an ordinary transcribe retry calls WhisperX for a speaker that appeared to
+  finish earlier; or
+- an older successful session retranscribes all speakers once after upgrade.
+
+Likely causes:
+
+- the earlier response or canonical file was not followed by a successful
+  speaker manifest checkpoint;
+- the prepared audio bytes/path, WhisperX URL, or language changed;
+- the canonical transcript is missing, unsafe, non-regular, invalid JSON, or
+  no longer matches its recorded size/checksum;
+- the previous invocation used `--force`, which durably cleared pre-force
+  speaker authority; or
+- the manifest has only legacy aggregate transcribe state and cannot bind old
+  outputs to their source audio.
+
+Safe fix:
+
+- inspect the reported speaker and filesystem error, repair the prepared input
+  or canonical-output path when needed, then retry transcribe normally;
+- allow a legacy aggregate-only record to regenerate once; and
+- do not edit the manifest or copy an old JSON file into place as a substitute
+  for a successful checkpoint.
+
+```bash
+narratio run-stage transcribe 2026-04-04
+```
+
+Valid earlier speaker checkpoints remain reusable even while aggregate
+transcribe status is failed or interrupted. Merge remains gated until
+transcribe reaches aggregate success with the complete current set.
+
+Relevant reference: [Operations: Transcription continuation and replacement](./operations.md#transcription-continuation-and-replacement).
+
+## WhisperX model changed but transcription was reused
+
+Symptom:
+
+- WhisperX model weights, prompts, or private server configuration changed at
+  the same configured URL, but Narratio still considers speaker transcripts
+  current.
+
+Likely cause:
+
+- Narratio can fingerprint its configured URL and language, not private state
+  loaded behind the service boundary.
+
+Safe fix:
+
+- explicitly force transcribe to establish a durable reset, then use ordinary
+  retry if the replacement attempt is interrupted.
+
+```bash
+narratio run-stage transcribe 2026-04-04 --force
+```
+
+Transport replay and application retries do not provide an exactly-once remote
+execution guarantee. Investigate server-side failures or duplicate work using
+WhisperX diagnostics; do not infer completion from a server log without the
+local speaker checkpoint.
+
+Relevant references: [WhisperX integration](./integrations/whisperx.md) and
+[Transcribe internals](./internal/stage-transcribe.md).
+
+## Transcription manifest checkpoint failed
+
+Symptom:
+
+- transcribe reports that a speaker completed but the session manifest could
+  not be saved.
+
+Likely causes:
+
+- the workspace is unwritable or out of space;
+- the manifest path or parent directory is unsafe or the wrong type; or
+- a transient filesystem error interrupted atomic replacement.
+
+Safe fix:
+
+- correct the reported filesystem or permission problem and retry transcribe
+  normally. Narratio reconciles from the last readable collection and reuses
+  only successfully checkpointed speakers.
+
+A canonical raw transcript left by the failed checkpoint is incidental and
+does not become reusable authority. Preserve the manifest and diagnostics if
+the failure repeats; do not advertise the file by editing manifest evidence.
+
+Relevant references: [Manifest persistence](./internal/manifest.md#persistence-semantics)
+and [Transcribe internals](./internal/stage-transcribe.md).
+
+## Notarius credential reference unavailable
+
+Symptom:
+
+- configuration loading reports `secret.unset`, `secret.empty`, or an invalid
+  name in `pipeline.notarius.credentials`, including during inspection or a
+  run that would not execute extraction.
+
+Likely causes:
+
+- the named environment variable is absent or empty;
+- the selected secrets directory lacks a file with that exact name;
+- a process environment variable exists but is empty, so bootstrap correctly
+  leaves it in place; or
+- the Narratio reference name does not match `api_key_env` in the selected
+  Notarius/PromptKit profile.
+
+Safe fix:
+
+- set the exact nonempty environment variable or provide an equivalently named
+  file through the conventional or explicit secrets directory;
+- remove, set to `null`, or set to `[]` when that deployment needs no credential;
+  and
+- use `config show`, `config sources`, and `config diff` to inspect the public
+  reference name and ownership without exposing its value.
+
+Narratio resolves selected credential references during ordinary pipeline
+loading, before stage selection or resume. Credential changes alone do not
+invalidate a completed extraction, but the current reference must still resolve
+for the command to proceed.
+
+Relevant references: [Secrets](./config.md#secrets-handling) and
+[Notarius credentials](./config.md#notarius-credentials).
+
+## Audita v2 configuration or credential failure
+
+Symptom:
+
+- Narratio rejects a retired `pipeline.audita` field during loading, reports
+  `secret.unset` or `secret.empty` for a listed credential, or Audita rejects
+  its external configuration or selected profile when polish runs.
+
+Likely causes:
+
+- the Narratio pipeline still uses v1 endpoint, model, capacity, singular key,
+  report, or retention settings;
+- the named key is missing or empty, including a present but empty process
+  environment variable that takes precedence over a secrets-directory file;
+- Audita's external v2 file references a backend credential name not forwarded
+  by `pipeline.audita.credentials`, including a backend not selected by the
+  current profile; or
+- an Audita overlay or profile selector names a missing downstream definition.
+
+Safe fix:
+
+- follow the [migration table](./operations.md#migrating-audita-and-provider-credentials)
+  and use a supported Audita v2 executable and configuration;
+- provide each needed provider-named variable through the environment or
+  secrets directory, and list that same name in `pipeline.audita.credentials`;
+- validate the external file offline with
+  `audita config validate --config <file>` before switching executables; and
+- inspect Audita's effective profile selection separately from Narratio's
+  `config show`. Narratio does not infer downstream selectors.
+
+An exit-zero polish with a valid transcript succeeds even when Audita reports
+recoverable errors or no corrections. Missing reports are allowed when Audita
+reporting is disabled externally. Edits to Audita-owned files behind unchanged
+selectors require `narratio run-stage polish <session-id> --force` to replace a
+previously successful result. See the [Audita integration contract](./integrations/audita.md).
+
 ## Notarius executable missing
 
 Symptom:
@@ -289,6 +453,59 @@ Do not point Notarius directly at the original source path or edit the manifest
 checksum. Relevant references: [Notarius reference configuration](./config.md#notarius-reference-bindings)
 and [Operations: Extraction Workflow](./operations.md#extraction-workflow).
 
+## Notarius reference snapshot cache conflict
+
+Symptom:
+
+- extraction reports that a path beneath
+  `cache/notarius/references/<sha256>/` is a symlink, directory, or another
+  non-regular or unsafe entry.
+
+Safe fix:
+
+- stop commands for the affected session and inspect the exact reported path;
+- investigate unexpected links or special files as possible tampering; and
+- remove only the reported conflicting leaf or digest directory after
+  confirming it belongs to the reconstructible reference cache.
+
+A missing snapshot or corrupt regular snapshot is reconstructed automatically
+from currently verified prepared input. Do not recursively delete the session
+root, edit the manifest checksum, or remove cache entries while extraction is
+active.
+
+Relevant reference: [Operations: Extraction Workflow](./operations.md#extraction-workflow).
+
+## Notarius resume executes work instead of reusing it
+
+Symptom:
+
+- Narratio executes `extract`, and Notarius makes provider calls despite
+  `pipeline.notarius.resume: true`.
+
+Likely causes:
+
+- checkpoint recording is disabled in the Notarius configuration;
+- Notarius is using a nonpersistent or different checkpoint root;
+- transcript/reference bytes, reference paths, pipeline/profile content,
+  local-backend endpoint, selected lanes, or another checkpoint identity input
+  changed; or
+- Narratio extraction was forced, which deliberately omits `--resume`.
+
+Safe fix:
+
+- validate the deployed Notarius configuration and configure explicit
+  persistent chunk-plan and checkpoint roots;
+- inspect Notarius checkpoint decision reason codes for a legitimate cold miss;
+  and
+- retry without force only when reuse is intended.
+
+Remember that Narratio skipping a completed `extract` stage is separate from
+Notarius reusing work inside an extraction that does execute. Narratio does not
+read the Notarius configuration to infer checkpoint enablement.
+
+Relevant references: [Notarius cache controls](./config.md#notarius-cache-controls)
+and [Notarius integration](./integrations/notarius.md).
+
 ## Notarius reference selector or generated-handoff collision
 
 Symptom:
@@ -361,10 +578,10 @@ Symptom:
 
 Likely causes:
 
-- the executable/config path, pipeline ID, timeout, working directory, or
-  configured output contracts changed;
+- the pipeline ID or configured output contracts changed;
 - a configured prepared reference selector, source, path, checksum, or byte
   size changed;
+- the direct trimmed transcript identity or bytes changed; or
 - the durable bundle, index, lane set, provenance, regular-file status, or
   checksum no longer validates.
 
@@ -374,6 +591,11 @@ Safe fix:
   an unsafe path or bundle symlink error as filesystem corruption or tampering
   and investigate it rather than replacing files manually.
 
+Executable, config path, timeout, working directory, and Notarius credential
+changes are operational and do not by themselves invalidate reusable extraction
+evidence. A newly selected credential must nevertheless resolve during command
+configuration loading.
+
 ## Notarius transitive configuration changed
 
 Symptom:
@@ -488,18 +710,22 @@ Symptom:
   or unsupported; or
 - restore rejects a committed remote session manifest for the same reason.
 
-Likely cause:
+Likely causes:
 
 - the manifest predates the supported canonical state contract. Narratio
   rejects it at the schema boundary rather than interpreting aggregate output
-  lists or incidental files as current authority.
+  lists or incidental files as current authority; or
+- an older strict-decoding Narratio binary is reading a current manifest that
+  contains additive transcribe speaker state it does not recognize.
 
 Safe fix:
 
 - for unsupported local state, move the old manifest aside and regenerate, or
   restore a verified current committed snapshot when one is authoritative;
 - for unsupported committed remote state, regenerate healthy local state as
-  needed and republish the session.
+  needed and republish the session; and
+- for a downgrade rejection, return to the current binary or restore a verified
+  pre-upgrade backup. Do not delete only the speaker fields by hand.
 
 ```bash
 narratio run 2026-04-04
@@ -511,7 +737,21 @@ old files into canonical paths merely to influence selection; availability is
 manifest-owned.
 
 Relevant references: [Operations: Stage Execution and Continuation Behavior](./operations.md#stage-execution-and-continuation-behavior)
-and [Manifest Internals](./internal/manifest.md#analyze-owned-artifact-state).
+and [Manifest Internals](./internal/manifest.md#transcribe-owned-speaker-state).
+
+## Scriptorium returns HTTP 401 during trim or analyze
+
+Check that Narratio's pipeline selects the credential names required by
+Scriptorium, for example `scriptorium.credentials: [OPENROUTER_API_KEY]`.
+Provision the values through the existing environment or secrets directory;
+exporting a key without selecting it does not forward it to the child process.
+See [Scriptorium credentials](config.md#scriptorium-credentials).
+
+Once corrected, retry the failed run normally; forcing previously successful
+transcription or analysis is unnecessary. If authentication still fails, check
+the selected Scriptorium backend, credential validity, and provider access
+without printing keys. A 401 can indicate an invalid key as well as a missing
+one.
 
 ## Scriptorium private input changed without a rerun
 
@@ -726,7 +966,7 @@ Diagnostics:
 
 ```bash
 ls -la /path/to/secrets_dir
-env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|SCRIPTORIUM'
+env | sed 's/=.*//' | grep -E 'OBJECT_STORAGE|AWS|AUDITA|NOTARIUS|SCRIPTORIUM'
 ```
 
 Safe fix:

examples/README.md

@@ -14,16 +14,16 @@ in the [configuration reference](../docs/config.md).
 - [Production-base/testing-overlay bundle](production-testing/pipeline.yml):
   explicit `conf.d` imports, one ordinary artifact per `artifacts/<key>.yml`,
   one family per `artifact-families/<key>.yml`, and the fixed
-  `profiles/testing.yml` overlay. Production values live in the base. The
+  `overlays/testing.yml` overlay. Production values live in the base. The
   bundle demonstrates an input-only artifact dependency, two character families
   sharing the campaign party, and a testing-only disabled artifact. Inspect it
   offline with:
 
   ```sh
   narratio config validate --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
-  narratio config show --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
-  narratio config sources --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
-  narratio config artifacts --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
+  narratio config show --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config sources --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config artifacts --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
   narratio config diff default testing --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
   ```
 
@@ -60,17 +60,21 @@ with the sample campaign and a compatible local- or S3-audio session.
   [glossary](campaigns/sample-campaign/glossary.yml), and canonical
   [party](campaigns/sample-campaign/party.yml) fixture, plus an optional
   [spell-catalog overlay](campaigns/sample-campaign/spell_catalog.json) that
-  follows the Notarius v0.6 contract. Narratio derives the players projection
+  follows the Notarius v0.7 contract. Narratio derives the players projection
   from this party source.
 - [Sample speaker audio](audio/sample-speaker.flac) is a text placeholder that
   reserves the expected filename and directory shape. Replace it with a real
   FLAC file before running transcription.
 
 The examples contain environment-variable names but no credential values. Set
-`OBJECT_STORAGE_KEY_ID`, `OBJECT_STORAGE_KEY`, and `AUDITA_LLM_API_KEY` to
-nonempty synthetic or real values before loading the production-shaped and full
-annotated pipelines. They use fictional campaign content and reserved example
-domains.
+`OBJECT_STORAGE_KEY_ID`, `OBJECT_STORAGE_KEY`, `AUDITA_LLM_API_KEY`, and
+`NOTARIUS_LLM_API_KEY` to nonempty synthetic or real values before loading the
+examples that reference them. They use fictional campaign content and reserved
+example domains. The Audita and Notarius names are example references, not
+implicit aliases: external backend/profile configurations must use those exact
+names, or the Narratio credential lists must be changed to match. See the
+[Audita v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+for maintained downstream configuration examples.
 
 For a deployed bundle, keep credential files out of source control in a
 `secrets/` directory beside the root `pipeline.yml`, one file per referenced

examples/pipeline.full.annotated.yml

@@ -90,22 +90,18 @@ seriatim:
     filler_max_duration: 1.25
 
 audita:
-  # Optional overrides; defaults shown explicitly where applicable.
+  # Optional overrides. Audita owns its own configuration and profiles.
   binary: audita
   timeout: 3h
-  llm_api_key: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
-  base_url: ""
-  model: ""
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_model: ""
-  validation_llm_concurrency: 1
+  # Names must match credentials on every backend in the Audita v2 config.
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules for Audita's default sequence; modules: [] disables corrections.
+  overlay: ""
+  proposal_profile: ""
+  validation_profile: ""
   transcript_description: ""
   config_path: /usr/local/etc/audita/config.yml
   output_schema: audita-v1
-  work_dir_retention: auto
-  report: true
 
 normalize:
   # Optional; defaults shown explicitly.
@@ -128,13 +124,26 @@ trim:
     report: false
 
 notarius:
-  # Optional structured extraction between trim and render.
+  # Optional structured extraction after render and before analyze.
   enabled: true
   binary: notarius
+  # Optional environment-variable references. Match these names to the
+  # selected Notarius/PromptKit providers; never put credential values here.
+  credentials: [NOTARIUS_LLM_API_KEY]
+  # Optionally select a Notarius ConfigKit overlay when extraction runs. This
+  # is independent of Narratio's selected overlay and may use a different name.
+  # See docs/config.md and docs/integrations/notarius.md for the contracts.
+  # config_overlay: downstream-economy
   config_path: /usr/local/etc/notarius/config.yml
   pipeline_id: dnd-session
   timeout: 3h
   working_directory: /usr/local/etc/notarius
+  # Reuse compatible accepted Notarius checkpoints during executed extraction.
+  # The Notarius config must enable recording and provide persistent cache roots.
+  resume: true
+  # auto uses or creates a source-addressed chunk plan. Forced Narratio
+  # extraction overrides this with refresh and disables checkpoint loading.
+  chunk_cache: auto
   # External campaign references use prepared Narratio source IDs. Omit an
   # optional binding when the selected Notarius pipeline does not need it.
   references:
@@ -208,6 +217,9 @@ notarius:
 
 scriptorium:
   binary: scriptorium
+  # Select provider names provisioned through Narratio's environment/secrets.
+  # Used for trim, analysis, and render-debug calls; no provider override.
+  # credentials: [OPENROUTER_API_KEY, RAKESTRAWHOME_API_KEY]
   config_path: /usr/local/etc/scriptorium/config.yml
   timeout: 10m
   render_debug: false

examples/pipeline.production.yml

@@ -57,14 +57,9 @@ seriatim:
 audita:
   binary: audita
   timeout: 3h
-  llm_api_key: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules to use Audita defaults; modules: [] disables corrections.
   output_schema: audita-v1
-  work_dir_retention: auto
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_llm_concurrency: 1
-  report: true
 
 normalize:
   output_path: transcripts/final.json
@@ -73,6 +68,7 @@ normalize:
 
 scriptorium:
   binary: scriptorium
+  # credentials: [OPENROUTER_API_KEY] # Enable when this provider is configured.
   config_path: /usr/local/etc/scriptorium/config.yml
   timeout: 10m
   render_debug: false

examples/production-testing/conf.d/transcript.yml

@@ -10,8 +10,8 @@ audita:
   binary: audita
   modules: [glossary, grammar]
   output_schema: audita-v1
-  model: narratio-production-model-placeholder
-  validation_model: narratio-production-validator-placeholder
+  proposal_profile: narratio-production-model-placeholder
+  validation_profile: narratio-production-validator-placeholder
 
 normalize:
   output_path: transcripts/final.json

examples/production-testing/overlays/testing.yml

@@ -1,6 +1,6 @@
 audita:
-  model: narratio-testing-model-placeholder
-  validation_model: narratio-testing-validator-placeholder
+  proposal_profile: narratio-testing-model-placeholder
+  validation_profile: narratio-testing-validator-placeholder
 
 scriptorium:
   artifacts:

go.mod

@@ -3,7 +3,7 @@ module gitea.maximumdirect.net/eric/narratio
 go 1.26.0
 
 require (
-	gitea.maximumdirect.net/eric/ConfigKit v0.1.2
+	gitea.maximumdirect.net/eric/ConfigKit v0.4.2
 	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0

go.sum

@@ -1,5 +1,5 @@
-gitea.maximumdirect.net/eric/ConfigKit v0.1.2 h1:uZ5Mvf271SLItXEvUpQYfAvCOVYj9RaoG0auCcbCcSU=
-gitea.maximumdirect.net/eric/ConfigKit v0.1.2/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.2 h1:ZMxmv8pOnLtAx2hFTf8Z+pHKUbR89xErkBhwjr4yK24=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.2/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
 github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
 github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=

internal/adapters/audita/fake.go

@@ -17,13 +17,11 @@ func (n *NoopRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if err := ctx.Err(); err != nil {
 		return PolishResult{}, err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, false); err != nil {
 		return PolishResult{}, err
 	}
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
 		StdoutLogPath:           req.StdoutLogPath,
 		StderrLogPath:           req.StderrLogPath,
 		GeneratedConfigPath:     req.GeneratedConfigPath,
@@ -47,18 +45,20 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if f.Err != nil {
 		return PolishResult{}, f.Err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, true); err != nil {
 		return PolishResult{}, err
 	}
 	res := f.Result
 	if res.ProcessedTranscriptPath == "" {
 		res.ProcessedTranscriptPath = req.OutputProcessedPath
 	}
-	if res.ReportPath == "" {
-		res.ReportPath = req.ReportPath
-	}
-	if res.WorkDir == "" {
-		res.WorkDir = req.WorkDir
+	if res.Reports == (ReportBundle{}) {
+		dir := filepath.Dir(req.OutputProcessedPath)
+		res.Reports = ReportBundle{
+			ErrorsPath:     filepath.Join(dir, "errors.yml"),
+			RecoveriesPath: filepath.Join(dir, "recoveries.yml"),
+			OverviewPath:   filepath.Join(dir, "report.md"),
+		}
 	}
 	if res.StdoutLogPath == "" {
 		res.StdoutLogPath = req.StdoutLogPath
@@ -75,10 +75,10 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	return res, nil
 }
 
-func materializePlaceholders(req PolishRequest) error {
+func materializePlaceholders(req PolishRequest, reports bool) error {
 	if req.GeneratedConfigPath != "" {
 		payload := map[string]any{
-			"schema":                 "audita.generated.v1",
+			"schema":                 "audita.generated.v2",
 			"placeholder":            true,
 			"merged_transcript_path": req.MergedTranscriptPath,
 			"output_path":            req.OutputProcessedPath,
@@ -103,11 +103,18 @@ func materializePlaceholders(req PolishRequest) error {
 	}); err != nil {
 		return err
 	}
-	if err := writeJSONIfRequested(req.ReportPath, map[string]any{
-		"schema": "audita.report.v1",
-		"steps":  []any{},
-	}); err != nil {
-		return err
+	if !reports {
+		return nil
+	}
+	for _, report := range []struct{ name, contents string }{
+		{"errors.yml", "schema: audita-errors\nversion: 1\nstatus: completed\nerrors: []\n"},
+		{"recoveries.yml", "schema: audita-recoveries\nversion: 1\nstatus: completed\nrecoveries: []\n"},
+		{"report.md", "# Audita report\n"},
+	} {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), report.name)
+		if err := fileops.WriteFileAtomic(path, []byte(report.contents), fileops.WorkspaceFileMode); err != nil {
+			return fmt.Errorf("write report %q: %w", path, err)
+		}
 	}
 	return nil
 }

internal/adapters/audita/runner.go

@@ -11,24 +11,29 @@ type Runner interface {
 	Run(ctx context.Context, req PolishRequest) (PolishResult, error)
 }
 
-// PolishRequest describes an audita invocation.
+// PolishRequest describes an Audita invocation. Nil Modules uses the runner's
+// configured selection; a non-nil empty slice selects no modules.
 type PolishRequest struct {
 	GeneratedConfigPath  string
 	MergedTranscriptPath string
 	OutputProcessedPath  string
 	GlossaryPath         string
-	ReportPath           string
-	WorkDir              string
 	Modules              []string
 	StdoutLogPath        string
 	StderrLogPath        string
 }
 
-// PolishResult describes a polish output.
+// ReportBundle contains optional reports adjacent to the requested output.
+type ReportBundle struct {
+	ErrorsPath     string
+	RecoveriesPath string
+	OverviewPath   string
+}
+
+// PolishResult describes a polish output and available diagnostics.
 type PolishResult struct {
 	ProcessedTranscriptPath string
-	ReportPath              string
-	WorkDir                 string
+	Reports                 ReportBundle
 	StdoutLogPath           string
 	StderrLogPath           string
 	GeneratedConfigPath     string

internal/adapters/audita/subprocess.go

@@ -3,12 +3,14 @@ package audita
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"net/url"
-	"strconv"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
@@ -16,93 +18,27 @@ import (
 // MaxProcessedOutputBytes bounds Audita's processed-transcript JSON result.
 const MaxProcessedOutputBytes int64 = 64 * 1024 * 1024
 
-// MaxReportOutputBytes bounds Audita's optional report JSON result.
+// MaxReportOutputBytes bounds each optional Audita report.
 const MaxReportOutputBytes int64 = 16 * 1024 * 1024
 
 // SubprocessRunnerConfig defines deterministic settings for Audita CLI execution.
 type SubprocessRunnerConfig struct {
-	Binary                   string
-	Timeout                  time.Duration
-	LLMAPIKey                string
-	LLMAPIKeyReference       string
-	Modules                  []string
-	BaseURL                  string
-	Model                    string
-	TranscriptDescription    string
-	ConfigPath               string
-	OutputSchema             string
-	WorkDirRetention         string
-	TotalLLMConcurrency      *int
-	ProposalLLMConcurrency   *int
-	ValidationModel          string
-	ValidationLLMConcurrency *int
-	Report                   bool
+	Binary                string
+	Timeout               time.Duration
+	Credentials           []configkit.Secret
+	Modules               []string
+	Overlay               string
+	ProposalProfile       string
+	ValidationProfile     string
+	TranscriptDescription string
+	ConfigPath            string
+	OutputSchema          string
 }
 
 // SubprocessRunner invokes Audita via subprocess.
 type SubprocessRunner struct {
-	binary                   string
-	timeout                  time.Duration
-	llmAPIKey                string
-	llmAPIKeyReference       string
-	modules                  []string
-	baseURL                  string
-	model                    string
-	transcriptDescription    string
-	configPath               string
-	outputSchema             string
-	workDirRetention         string
-	totalLLMConcurrency      *int
-	proposalLLMConcurrency   *int
-	validationModel          string
-	validationLLMConcurrency *int
-	report                   bool
-}
-
-// NewSubprocessRunnerFromConfigValues parses config-derived values once.
-func NewSubprocessRunnerFromConfigValues(
-	binary string,
-	timeout string,
-	llmAPIKey string,
-	llmAPIKeyReference string,
-	modules []string,
-	baseURL string,
-	model string,
-	transcriptDescription string,
-	configPath string,
-	outputSchema string,
-	workDirRetention string,
-	totalLLMConcurrency *int,
-	proposalLLMConcurrency *int,
-	validationModel string,
-	validationLLMConcurrency *int,
-	report bool,
-) (*SubprocessRunner, error) {
-	if strings.TrimSpace(timeout) == "" {
-		return nil, fmt.Errorf("audita timeout is required")
-	}
-	parsedTimeout, err := time.ParseDuration(timeout)
-	if err != nil {
-		return nil, fmt.Errorf("parse audita timeout %q: %w", timeout, err)
-	}
-	return NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   binary,
-		Timeout:                  parsedTimeout,
-		LLMAPIKey:                llmAPIKey,
-		LLMAPIKeyReference:       llmAPIKeyReference,
-		Modules:                  modules,
-		BaseURL:                  baseURL,
-		Model:                    model,
-		TranscriptDescription:    transcriptDescription,
-		ConfigPath:               configPath,
-		OutputSchema:             outputSchema,
-		WorkDirRetention:         workDirRetention,
-		TotalLLMConcurrency:      totalLLMConcurrency,
-		ProposalLLMConcurrency:   proposalLLMConcurrency,
-		ValidationModel:          validationModel,
-		ValidationLLMConcurrency: validationLLMConcurrency,
-		Report:                   report,
-	})
+	cfg SubprocessRunnerConfig
+	run func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error)
 }
 
 // NewSubprocessRunner constructs a validated Audita subprocess runner.
@@ -113,281 +49,177 @@ func NewSubprocessRunner(cfg SubprocessRunnerConfig) (*SubprocessRunner, error)
 	if cfg.Timeout <= 0 {
 		return nil, fmt.Errorf("audita timeout must be > 0")
 	}
-	if (cfg.LLMAPIKey == "") != (strings.TrimSpace(cfg.LLMAPIKeyReference) == "") {
-		return nil, fmt.Errorf("audita credential value and reference must be provided together")
-	}
 	for i, module := range cfg.Modules {
 		if strings.TrimSpace(module) == "" {
 			return nil, fmt.Errorf("audita module at index %d is empty", i)
 		}
 	}
-	if strings.TrimSpace(cfg.BaseURL) != "" {
-		u, err := url.Parse(cfg.BaseURL)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			if err != nil {
-				return nil, fmt.Errorf("audita base url %q is invalid: %w", cfg.BaseURL, err)
-			}
-			return nil, fmt.Errorf("audita base url %q is invalid", cfg.BaseURL)
-		}
-	}
-	if cfg.TotalLLMConcurrency != nil && *cfg.TotalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita total llm concurrency must be > 0 when provided")
-	}
-	if cfg.ProposalLLMConcurrency != nil && *cfg.ProposalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita proposal llm concurrency must be > 0 when provided")
-	}
-	if cfg.ValidationLLMConcurrency != nil && *cfg.ValidationLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita validation llm concurrency must be > 0 when provided")
-	}
 	switch strings.TrimSpace(cfg.OutputSchema) {
 	case "", "bare-segments", "audita-v1":
 	default:
 		return nil, fmt.Errorf("audita output schema must be one of: bare-segments, audita-v1")
 	}
-	switch strings.TrimSpace(cfg.WorkDirRetention) {
-	case "", "always", "auto", "never":
-	default:
-		return nil, fmt.Errorf("audita work dir retention must be one of: always, auto, never")
+	cfg.Binary = strings.TrimSpace(cfg.Binary)
+	cfg.Credentials = append([]configkit.Secret(nil), cfg.Credentials...)
+	cfg.Modules = cloneModules(cfg.Modules)
+	for i := range cfg.Modules {
+		cfg.Modules[i] = strings.TrimSpace(cfg.Modules[i])
 	}
-
-	modules := make([]string, len(cfg.Modules))
-	for i, m := range cfg.Modules {
-		modules[i] = strings.TrimSpace(m)
-	}
-
-	return &SubprocessRunner{
-		binary:                   strings.TrimSpace(cfg.Binary),
-		timeout:                  cfg.Timeout,
-		llmAPIKey:                cfg.LLMAPIKey,
-		llmAPIKeyReference:       strings.TrimSpace(cfg.LLMAPIKeyReference),
-		modules:                  modules,
-		baseURL:                  strings.TrimSpace(cfg.BaseURL),
-		model:                    strings.TrimSpace(cfg.Model),
-		transcriptDescription:    strings.TrimSpace(cfg.TranscriptDescription),
-		configPath:               strings.TrimSpace(cfg.ConfigPath),
-		outputSchema:             strings.TrimSpace(cfg.OutputSchema),
-		workDirRetention:         strings.TrimSpace(cfg.WorkDirRetention),
-		totalLLMConcurrency:      cfg.TotalLLMConcurrency,
-		proposalLLMConcurrency:   cfg.ProposalLLMConcurrency,
-		validationModel:          strings.TrimSpace(cfg.ValidationModel),
-		validationLLMConcurrency: cfg.ValidationLLMConcurrency,
-		report:                   cfg.Report,
-	}, nil
+	return &SubprocessRunner{cfg: cfg, run: subprocess.Run}, nil
 }
 
-// Run executes Audita process with deterministic flags and validates output artifacts.
+func cloneModules(modules []string) []string {
+	if modules == nil {
+		return nil
+	}
+	return append([]string{}, modules...)
+}
+
+// Run executes Audita process and validates its corrected transcript.
 func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishResult, error) {
 	if r == nil {
 		return PolishResult{}, fmt.Errorf("audita subprocess runner is nil")
 	}
-	if strings.TrimSpace(req.MergedTranscriptPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita merged transcript path is required")
+	for _, field := range []struct{ name, value string }{
+		{"merged transcript path", req.MergedTranscriptPath},
+		{"glossary path", req.GlossaryPath},
+		{"output processed path", req.OutputProcessedPath},
+	} {
+		if strings.TrimSpace(field.value) == "" {
+			return PolishResult{}, fmt.Errorf("audita %s is required", field.name)
+		}
 	}
-	if strings.TrimSpace(req.GlossaryPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita glossary path is required")
+	modules := req.Modules
+	if modules == nil {
+		modules = r.cfg.Modules
 	}
-	if strings.TrimSpace(req.OutputProcessedPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita output processed path is required")
+	for i, module := range modules {
+		if strings.TrimSpace(module) == "" {
+			return PolishResult{}, fmt.Errorf("audita module at index %d is empty", i)
+		}
 	}
-	if strings.TrimSpace(req.WorkDir) == "" {
-		return PolishResult{}, fmt.Errorf("audita work dir is required")
+	modules = cloneModules(modules)
+	for i := range modules {
+		modules[i] = strings.TrimSpace(modules[i])
 	}
-	if r.report && strings.TrimSpace(req.ReportPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita report is enabled but report path is missing")
+	args := r.buildArgs(req, modules)
+	env, names, err := subprocess.CredentialEnvironment(r.cfg.Credentials)
+	if err != nil {
+		return PolishResult{}, fmt.Errorf("audita credentials: %w", err)
 	}
-
-	reqModules := req.Modules
-	if reqModules == nil {
-		reqModules = append([]string(nil), r.modules...)
-	}
-	args := r.buildArgs(req, reqModules)
-
-	credentialPresent := r.llmAPIKeyReference != ""
-	env := map[string]string{}
-	if credentialPresent {
-		env["AUDITA_LLM_API_KEY"] = r.llmAPIKey
-	}
-
 	if req.GeneratedConfigPath != "" {
-		if err := r.writeInvocationConfig(req, args, reqModules, credentialPresent); err != nil {
+		if err := r.writeInvocationConfig(req, args, modules, names); err != nil {
 			return PolishResult{}, fmt.Errorf("write audita invocation config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
-
-	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:      r.binary,
-		Args:            args,
-		Timeout:         r.timeout,
-		EnvOverrides:    env,
-		DiagnosticOwner: "audita",
-		StdoutLogPath:   req.StdoutLogPath,
-		StderrLogPath:   req.StderrLogPath,
+	run := r.run
+	if run == nil {
+		run = subprocess.Run
+	}
+	runRes, runErr := run(ctx, subprocess.RunRequest{
+		Executable: r.cfg.Binary, Args: args, Timeout: r.cfg.Timeout,
+		EnvOverrides: env, SensitiveEnvNames: names, DiagnosticOwner: "audita",
+		StdoutLogPath: req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
 	})
-	if err != nil {
-		wrappedMessage := fmt.Sprintf(
-			"run audita process (binary=%q, stdout_log=%q, stderr_log=%q)",
-			r.binary,
-			req.StdoutLogPath,
-			req.StderrLogPath,
-		)
-		wrappedMessage = addSubprocessStreamHint(wrappedMessage, err)
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf(
-			"%s: %w",
-			wrappedMessage,
-			err,
-		)
+	result := r.result(req, modules, names, runRes)
+	if runErr != nil {
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("run audita process (binary=%q, output_dir=%q, stdout_log=%q, stderr_log=%q): %w",
+			r.cfg.Binary, filepath.Dir(req.OutputProcessedPath), req.StdoutLogPath, req.StderrLogPath, runErr)
 	}
-
 	if err := validateProcessedOutput(req.OutputProcessedPath); err != nil {
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
 	}
-	if r.report {
-		if err := validateJSONFile(req.ReportPath); err != nil {
-			return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita report output %q: %w", req.ReportPath, err)
-		}
+	reports, err := discoverReports(req.OutputProcessedPath)
+	if err != nil {
+		return result, err
 	}
-
-	return PolishResult{
-		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
-		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    reqModules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyReference,
-			"credential_present":         credentialPresent,
-		},
-	}, nil
+	result.Reports = reports
+	return result, nil
 }
 
-func (r *SubprocessRunner) failureResult(req PolishRequest, modules []string, runRes subprocess.RunResult, credentialPresent bool) PolishResult {
+func (r *SubprocessRunner) result(req PolishRequest, modules, names []string, runRes subprocess.RunResult) PolishResult {
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
+		StdoutLogPath:           req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
+		GeneratedConfigPath: req.GeneratedConfigPath, ExitCode: runRes.ExitCode,
+		Duration: runRes.Duration, InvokedBinary: r.cfg.Binary,
 		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    modules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyReference,
-			"credential_present":         credentialPresent,
+			"adapter": "audita_subprocess", "modules": modules,
+			"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+			"validation_profile":     r.cfg.ValidationProfile,
+			"transcript_description": r.cfg.TranscriptDescription,
+			"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+			"credential_names": names,
 		},
 	}
 }
 
 func (r *SubprocessRunner) buildArgs(req PolishRequest, modules []string) []string {
-	args := []string{
-		"process",
-		req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-	}
-	if r.baseURL != "" {
-		args = append(args, "--base-url", r.baseURL)
-	}
-	if r.model != "" {
-		args = append(args, "--model", r.model)
-	}
-	if len(modules) > 0 {
+	args := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath}
+	if modules != nil {
 		args = append(args, "--modules", strings.Join(modules, ","))
 	}
-	if r.report {
-		args = append(args, "--report-json", req.ReportPath)
-	}
-	if r.transcriptDescription != "" {
-		args = append(args, "--transcript-description", r.transcriptDescription)
-	}
-	if r.configPath != "" {
-		args = append(args, "--config", r.configPath)
-	}
-	if r.outputSchema != "" {
-		args = append(args, "--output-schema", r.outputSchema)
-	}
-	if r.workDirRetention != "" {
-		args = append(args, "--work-dir-retention", r.workDirRetention)
-	}
-	if r.totalLLMConcurrency != nil {
-		args = append(args, "--total-llm-concurrency", strconv.Itoa(*r.totalLLMConcurrency))
-	}
-	if r.proposalLLMConcurrency != nil {
-		args = append(args, "--proposal-llm-concurrency", strconv.Itoa(*r.proposalLLMConcurrency))
-	}
-	if r.validationModel != "" {
-		args = append(args, "--validation-model", r.validationModel)
-	}
-	if r.validationLLMConcurrency != nil {
-		args = append(args, "--validation-llm-concurrency", strconv.Itoa(*r.validationLLMConcurrency))
+	for _, setting := range []struct{ flag, value string }{
+		{"--config", r.cfg.ConfigPath}, {"--overlay", r.cfg.Overlay},
+		{"--proposal-profile", r.cfg.ProposalProfile}, {"--validation-profile", r.cfg.ValidationProfile},
+		{"--transcript-description", r.cfg.TranscriptDescription}, {"--output-schema", r.cfg.OutputSchema},
+	} {
+		if setting.value != "" {
+			args = append(args, setting.flag, setting.value)
+		}
 	}
 	return args
 }
 
-func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args []string, modules []string, credentialPresent bool) error {
-	payload := map[string]any{
-		"schema":                     "audita.generated.v1",
-		"binary":                     r.binary,
-		"args":                       args,
-		"timeout":                    r.timeout.String(),
-		"modules":                    modules,
-		"base_url":                   r.baseURL,
-		"model":                      r.model,
-		"transcript_description":     r.transcriptDescription,
-		"config_path":                r.configPath,
-		"output_schema":              r.outputSchema,
-		"work_dir_retention":         r.workDirRetention,
-		"validation_model":           r.validationModel,
-		"total_llm_concurrency":      r.totalLLMConcurrency,
-		"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-		"validation_llm_concurrency": r.validationLLMConcurrency,
-		"report_enabled":             r.report,
-		"merged_transcript_path":     req.MergedTranscriptPath,
-		"glossary_path":              req.GlossaryPath,
-		"output_path":                req.OutputProcessedPath,
-		"report_path":                req.ReportPath,
-		"work_dir":                   req.WorkDir,
-		"credential_env_var":         r.llmAPIKeyReference,
-		"credential_present":         credentialPresent,
+func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args, modules, names []string) error {
+	return writeGeneratedYAML(req.GeneratedConfigPath, map[string]any{
+		"schema": "audita.generated.v2", "binary": r.cfg.Binary, "args": args,
+		"timeout": r.cfg.Timeout.String(), "modules": modules,
+		"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+		"validation_profile":     r.cfg.ValidationProfile,
+		"transcript_description": r.cfg.TranscriptDescription,
+		"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+		"merged_transcript_path": req.MergedTranscriptPath, "glossary_path": req.GlossaryPath,
+		"output_path": req.OutputProcessedPath, "credential_names": names,
+	})
+}
+
+func discoverReports(outputPath string) (ReportBundle, error) {
+	var reports ReportBundle
+	for _, report := range []struct {
+		name string
+		dest *string
+	}{
+		{"errors.yml", &reports.ErrorsPath},
+		{"recoveries.yml", &reports.RecoveriesPath},
+		{"report.md", &reports.OverviewPath},
+	} {
+		path := filepath.Join(filepath.Dir(outputPath), report.name)
+		info, err := os.Lstat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return reports, fmt.Errorf("inspect audita report %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return reports, fmt.Errorf("audita report %q is not a regular file", path)
+		}
+		if _, err := fileops.ReadFileBounded(path, MaxReportOutputBytes); err != nil {
+			return reports, fmt.Errorf("audita report %q exceeds or cannot be read within %d-byte limit: %w", path, MaxReportOutputBytes, err)
+		}
+		*report.dest = path
 	}
-	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
+	return reports, nil
 }
 
 func validateProcessedOutput(path string) error {
-	data, err := readAuditaResult(path, MaxProcessedOutputBytes, "processed transcript")
+	data, err := fileops.ReadFileBounded(path, MaxProcessedOutputBytes)
 	if err != nil {
-		return err
+		return fmt.Errorf("audita processed transcript result exceeds or cannot be read within %d-byte limit: %w", MaxProcessedOutputBytes, err)
 	}
-
 	var payload map[string]any
 	if err := json.Unmarshal(data, &payload); err != nil {
 		return fmt.Errorf("parse json: %w", err)
@@ -401,34 +233,3 @@ func validateProcessedOutput(path string) error {
 	}
 	return nil
 }
-
-func addSubprocessStreamHint(message string, runErr error) string {
-	if runErr == nil {
-		return message
-	}
-	lower := strings.ToLower(runErr.Error())
-	if strings.Contains(lower, "bad file descriptor") || strings.Contains(lower, "exit code 120") {
-		return message + "; hint=audita child process may have started with invalid stderr/stdout descriptors"
-	}
-	return message
-}
-
-func validateJSONFile(path string) error {
-	data, err := readAuditaResult(path, MaxReportOutputBytes, "report")
-	if err != nil {
-		return err
-	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		return fmt.Errorf("parse json: %w", err)
-	}
-	return nil
-}
-
-func readAuditaResult(path string, limit int64, category string) ([]byte, error) {
-	data, err := fileops.ReadFileBounded(path, limit)
-	if err != nil {
-		return nil, fmt.Errorf("audita %s result exceeds or cannot be read within %d-byte limit: %w", category, limit, err)
-	}
-	return data, nil
-}

internal/adapters/audita/subprocess_test.go

@@ -2,630 +2,262 @@ package audita
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 )
 
-func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
-
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	wrapper := writeAuditaHelperWrapper(t)
-	totalLLMConcurrency := 3
-	proposalLLMConcurrency := 2
-	validationLLMConcurrency := 2
-	runner, err := NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   wrapper,
-		Timeout:                  mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:                "super-secret",
-		LLMAPIKeyReference:       "OPENAI_KEY_SOURCE",
-		Modules:                  []string{"glossary", "homophones", "glossary"},
-		BaseURL:                  "https://openrouter.ai/api/v1",
-		Model:                    "openrouter/google/gemma-4-31b-it",
-		TranscriptDescription:    "Campaign Session 42",
-		ConfigPath:               "/etc/audita/config.yml",
-		OutputSchema:             "audita-v1",
-		WorkDirRetention:         "auto",
-		TotalLLMConcurrency:      &totalLLMConcurrency,
-		ProposalLLMConcurrency:   &proposalLLMConcurrency,
-		ValidationModel:          "openrouter/google/gemma-4-31b-it",
-		ValidationLLMConcurrency: &validationLLMConcurrency,
-		Report:                   true,
-	})
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-	t.Setenv("OPENAI_KEY_SOURCE", "changed-after-resolution")
-
+func auditaTestRequest(t *testing.T) PolishRequest {
+	t.Helper()
 	dir := t.TempDir()
-	req := PolishRequest{
-		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: filepath.Join(dir, "base.json"),
+	return PolishRequest{
+		MergedTranscriptPath: filepath.Join(dir, "merged.json"),
 		GlossaryPath:         filepath.Join(dir, "glossary.yml"),
 		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		ReportPath:           filepath.Join(dir, "audita.report.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
-	}
-	writeAuditaTestFile(t, req.MergedTranscriptPath, `{"segments":[]}`)
-	writeAuditaTestFile(t, req.GlossaryPath, "terms: []\n")
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.ProcessedTranscriptPath != req.OutputProcessedPath {
-		t.Fatalf("ProcessedTranscriptPath = %q, want %q", res.ProcessedTranscriptPath, req.OutputProcessedPath)
-	}
-	if res.ReportPath != req.ReportPath {
-		t.Fatalf("ReportPath = %q, want %q", res.ReportPath, req.ReportPath)
-	}
-	if res.WorkDir != req.WorkDir {
-		t.Fatalf("WorkDir = %q, want %q", res.WorkDir, req.WorkDir)
-	}
-	if res.InvokedBinary != wrapper {
-		t.Fatalf("InvokedBinary = %q, want %q", res.InvokedBinary, wrapper)
-	}
-	if res.ExitCode != 0 {
-		t.Fatalf("ExitCode = %d, want 0", res.ExitCode)
-	}
-	if res.Duration <= 0 {
-		t.Fatalf("Duration = %s, want > 0", res.Duration)
-	}
-	assertJSONFileAudita(t, req.OutputProcessedPath)
-	assertJSONFileAudita(t, req.ReportPath)
-	if _, err := os.Stat(req.StdoutLogPath); err != nil {
-		t.Fatalf("stdout log missing: %v", err)
-	}
-	if _, err := os.Stat(req.StderrLogPath); err != nil {
-		t.Fatalf("stderr log missing: %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	wantArgs := []string{
-		"process", req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-		"--base-url", "https://openrouter.ai/api/v1",
-		"--model", "openrouter/google/gemma-4-31b-it",
-		"--modules", "glossary,homophones,glossary",
-		"--report-json", req.ReportPath,
-		"--transcript-description", "Campaign Session 42",
-		"--config", "/etc/audita/config.yml",
-		"--output-schema", "audita-v1",
-		"--work-dir-retention", "auto",
-		"--total-llm-concurrency", "3",
-		"--proposal-llm-concurrency", "2",
-		"--validation-model", "openrouter/google/gemma-4-31b-it",
-		"--validation-llm-concurrency", "2",
-	}
-	if strings.Join(rec.Args, "\n") != strings.Join(wantArgs, "\n") {
-		t.Fatalf("args = %#v, want %#v", rec.Args, wantArgs)
-	}
-	if rec.Env["AUDITA_LLM_API_KEY"] != "super-secret" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want propagated secret", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-	if rec.Env["AUDITA_LLM_CONCURRENCY"] != "" {
-		t.Fatalf("AUDITA_LLM_CONCURRENCY = %q, want empty/omitted", rec.Env["AUDITA_LLM_CONCURRENCY"])
-	}
-
-	cfgData, err := os.ReadFile(req.GeneratedConfigPath)
-	if err != nil {
-		t.Fatalf("read generated config: %v", err)
-	}
-	if strings.Contains(string(cfgData), "super-secret") {
-		t.Fatalf("generated config must not contain credential value")
-	}
-}
-
-func TestSubprocessRunnerRejectsIncompleteResolvedCredential(t *testing.T) {
-	_, err := NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyReference: "MISSING_AUDITA_KEY",
-	})
-	if err == nil || !strings.Contains(err.Error(), "credential value and reference must be provided together") {
-		t.Fatalf("NewSubprocessRunner() error = %v, want credential pair error", err)
-	}
-}
-
-func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		Modules:   []string{"glossary"},
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.Metadata["credential_present"] != false {
-		t.Fatalf("credential_present = %#v, want false", res.Metadata["credential_present"])
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_LLM_API_KEY"] != "" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want omitted/empty", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-}
-
-func TestSubprocessRunnerOmitsUnspecifiedParentEnvironment(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("AUDITA_INHERITED_MARKER", "inherited-from-parent")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		Modules:   []string{"glossary"},
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-		LLMAPIKey: "",
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_INHERITED_MARKER"] != "" {
-		t.Fatalf("AUDITA_INHERITED_MARKER = %q, want omitted from the child environment", rec.Env["AUDITA_INHERITED_MARKER"])
-	}
-}
-
-func TestSubprocessRunnerOmitsModulesFlagWhenNotConfigured(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--modules" {
-			t.Fatalf("args contained --modules unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerOmitsBaseURLAndModelFlagsWhenNotConfigured(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--base-url" {
-			t.Fatalf("args contained --base-url unexpectedly: %#v", rec.Args)
-		}
-		if rec.Args[i] == "--model" {
-			t.Fatalf("args contained --model unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "run audita process") {
-		t.Fatalf("error = %q, want subprocess context", err.Error())
-	}
-	if !strings.Contains(err.Error(), "exit code") {
-		t.Fatalf("error = %q, want exit code context", err.Error())
-	}
-	if !strings.Contains(err.Error(), req.StdoutLogPath) || !strings.Contains(err.Error(), req.StderrLogPath) {
-		t.Fatalf("error = %q, want stdout/stderr log paths", err.Error())
-	}
-	if strings.Contains(err.Error(), "super-secret") {
-		t.Fatalf("failure diagnostic exposed credential value: %q", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailureAddsStderrDescriptorHint(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail_bad_fd")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "hint=audita child process may have started with invalid stderr/stdout descriptors") {
-		t.Fatalf("error = %q, want stderr descriptor hint", err.Error())
-	}
-}
-
-func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "missing_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita processed output") {
-		t.Fatalf("error = %q, want output validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "parse json") {
-		t.Fatalf("error = %q, want parse json context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSegmentsMissingFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "segments_missing")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "segments") {
-		t.Fatalf("error = %q, want segments validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_report")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita report output") {
-		t.Fatalf("error = %q, want report validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerConstructorValidation(t *testing.T) {
-	_, err := NewSubprocessRunnerFromConfigValues("", "3h", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected binary validation error")
-	}
-	_, err = NewSubprocessRunnerFromConfigValues("audita", "bad", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected timeout parse error")
-	}
-	_, err = NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:             "audita",
-		Timeout:            mustParseAuditaDuration(t, "1s"),
-		LLMAPIKey:          "synthetic-secret",
-		LLMAPIKeyReference: "AUDITA_LLM_API_KEY",
-		Modules:            []string{"glossary"},
-		BaseURL:            "://",
-		Model:              "openrouter/google/gemma-4-31b-it",
-	})
-	if err == nil {
-		t.Fatal("expected base url validation error")
-	}
-}
-
-type auditaHelperRecord struct {
-	Args []string          `json:"args"`
-	Env  map[string]string `json:"env"`
-}
-
-func TestAuditaSubprocessHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_AUDITA_HELPER") != "1" {
-		return
-	}
-
-	args := os.Args
-	start := -1
-	for i := range args {
-		if args[i] == "--" {
-			start = i + 1
-			break
-		}
-	}
-	if start < 0 || start >= len(args) {
-		_, _ = os.Stderr.WriteString("missing -- args separator\n")
-		os.Exit(2)
-	}
-	procArgs := args[start:]
-	outPath := auditaFlagValue(procArgs, "--output")
-	reportPath := auditaFlagValue(procArgs, "--report-json")
-	recordPath := os.Getenv("AUDITA_HELPER_RECORD_PATH")
-	if strings.TrimSpace(recordPath) != "" {
-		rec := auditaHelperRecord{
-			Args: procArgs,
-			Env: map[string]string{
-				"AUDITA_LLM_API_KEY":      os.Getenv("AUDITA_LLM_API_KEY"),
-				"AUDITA_LLM_CONCURRENCY":  os.Getenv("AUDITA_LLM_CONCURRENCY"),
-				"AUDITA_INHERITED_MARKER": os.Getenv("AUDITA_INHERITED_MARKER"),
-			},
-		}
-		data, _ := json.Marshal(rec)
-		_ = os.MkdirAll(filepath.Dir(recordPath), 0o755)
-		_ = os.WriteFile(recordPath, data, 0o644)
-	}
-
-	mode := os.Getenv("AUDITA_HELPER_MODE")
-	switch mode {
-	case "success":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		_, _ = os.Stdout.WriteString("audita helper success stdout\n")
-		_, _ = os.Stderr.WriteString("audita helper success stderr\n")
-		os.Exit(0)
-	case "fail":
-		_, _ = os.Stderr.WriteString("audita helper failure\n")
-		os.Exit(8)
-	case "fail_bad_fd":
-		_, _ = os.Stderr.WriteString("OSError: [Errno 9] Bad file descriptor\n")
-		os.Exit(120)
-	case "missing_output":
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_output":
-		writeAuditaHelperFile(outPath, `not-json`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "segments_missing":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1"}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_report":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `not-json`)
-		}
-		os.Exit(0)
-	default:
-		_, _ = os.Stderr.WriteString(fmt.Sprintf("unknown helper mode %q\n", mode))
-		os.Exit(2)
-	}
-}
-
-func mustAuditaRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
-	t.Helper()
-	r, err := NewSubprocessRunner(cfg)
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-	return r
-}
-
-func auditaReqForTest(t *testing.T, withReport bool) PolishRequest {
-	t.Helper()
-	dir := t.TempDir()
-	merged := filepath.Join(dir, "base.json")
-	glossary := filepath.Join(dir, "glossary.yml")
-	writeAuditaTestFile(t, merged, `{"segments":[]}`)
-	writeAuditaTestFile(t, glossary, "terms: []\n")
-	req := PolishRequest{
 		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: merged,
-		GlossaryPath:         glossary,
-		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
+		StdoutLogPath:        filepath.Join(dir, "stdout.log"),
+		StderrLogPath:        filepath.Join(dir, "stderr.log"),
 	}
-	if withReport {
-		req.ReportPath = filepath.Join(dir, "audita.report.json")
-	}
-	return req
 }
 
-func writeAuditaHelperWrapper(t *testing.T) string {
+func auditaTestRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
 	t.Helper()
-	exe, err := os.Executable()
+	if cfg.Binary == "" {
+		cfg.Binary = "audita"
+	}
+	if cfg.Timeout == 0 {
+		cfg.Timeout = time.Second
+	}
+	runner, err := NewSubprocessRunner(cfg)
 	if err != nil {
-		t.Fatalf("os.Executable() error = %v", err)
+		t.Fatal(err)
 	}
-	path := filepath.Join(t.TempDir(), "audita-helper-wrapper.sh")
-	content := "#!/bin/sh\nexec \"" + exe + "\" -test.run=TestAuditaSubprocessHelper -- \"$@\"\n"
-	if err := os.WriteFile(path, []byte(content), 0o755); err != nil {
-		t.Fatalf("WriteFile(%q) error = %v", path, err)
-	}
-	return path
+	return runner
 }
 
-func writeAuditaTestFile(t *testing.T, path, contents string) {
+func auditaTestSecret(t *testing.T, name, value string) configkit.Secret {
 	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatalf("MkdirAll(%q): %v", path, err)
+	t.Setenv(name, value)
+	type loaded struct {
+		Credential configkit.Secret `yaml:"credential"`
 	}
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
-		t.Fatalf("WriteFile(%q): %v", path, err)
+	result, err := configkit.Load(configkit.Bytes("credential.yml", []byte("credential: "+name+"\n")), configkit.Options[loaded]{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result.Config.Credential
+}
+
+func writeAuditaTestFile(t *testing.T, path, value string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+		t.Fatal(err)
 	}
 }
 
-func writeAuditaHelperFile(path, contents string) {
-	if strings.TrimSpace(path) == "" {
-		return
-	}
-	_ = os.MkdirAll(filepath.Dir(path), 0o755)
-	_ = os.WriteFile(path, []byte(contents), 0o644)
-}
-
-func auditaFlagValue(args []string, name string) string {
-	for i := 0; i < len(args)-1; i++ {
-		if args[i] == name {
-			return args[i+1]
+func TestSubprocessRunnerUsesV2InvocationAndCapturedCredentials(t *testing.T) {
+	const first = "NARRATIO_AUDITA_CUSTOM_ONE"
+	const second = "NARRATIO_AUDITA_CUSTOM_TWO"
+	firstSecret := auditaTestSecret(t, first, "loaded-one")
+	secondSecret := auditaTestSecret(t, second, "loaded-two")
+	t.Setenv(first, "parent-changed")
+	t.Setenv(second, "parent-changed-too")
+	t.Setenv("NARRATIO_AUDITA_UNSELECTED", "not-forwarded")
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{
+		Credentials: []configkit.Secret{firstSecret, secondSecret},
+		Modules:     []string{"grammar", "glossary", "grammar"},
+		Overlay:     "testing", ProposalProfile: "proposal", ValidationProfile: "validation",
+		TranscriptDescription: "campaign", ConfigPath: "/etc/audita/config.yml", OutputSchema: "audita-v1",
+	})
+	req := auditaTestRequest(t)
+	var captured subprocess.RunRequest
+	runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+		captured = processReq
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+			writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), name), "recoverable diagnostic\n")
 		}
+		return subprocess.RunResult{}, nil
 	}
-	return ""
-}
-
-func readAuditaHelperRecord(t *testing.T, path string) auditaHelperRecord {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	result, err := runner.Run(context.Background(), req)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var rec auditaHelperRecord
-	if err := json.Unmarshal(data, &rec); err != nil {
-		t.Fatalf("json unmarshal helper record: %v", err)
+	want := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath,
+		"--modules", "grammar,glossary,grammar", "--config", "/etc/audita/config.yml", "--overlay", "testing",
+		"--proposal-profile", "proposal", "--validation-profile", "validation", "--transcript-description", "campaign", "--output-schema", "audita-v1"}
+	if !reflect.DeepEqual(captured.Args, want) {
+		t.Fatalf("args = %#v, want %#v", captured.Args, want)
 	}
-	return rec
-}
-
-func assertJSONFileAudita(t *testing.T, path string) {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[first] != "loaded-one" || captured.EnvOverrides[second] != "loaded-two" || captured.EnvOverrides["NARRATIO_AUDITA_UNSELECTED"] != "" {
+		t.Fatalf("credential forwarding = %#v", captured.EnvOverrides)
+	}
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{first, second}) {
+		t.Fatalf("sensitive names = %#v", captured.SensitiveEnvNames)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath == "" || result.Reports.OverviewPath == "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+	generated, err := os.ReadFile(req.GeneratedConfigPath)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		t.Fatalf("json unmarshal %q: %v", path, err)
+	if !strings.Contains(string(generated), "audita.generated.v2") || !strings.Contains(string(generated), first) || strings.Contains(string(generated), "loaded-one") {
+		t.Fatalf("unsafe or incomplete generated invocation: %s", generated)
 	}
 }
 
-func mustParseAuditaDuration(t *testing.T, value string) time.Duration {
-	t.Helper()
-	d, err := time.ParseDuration(value)
-	if err != nil {
-		t.Fatalf("time.ParseDuration(%q) error = %v", value, err)
+func TestSubprocessRunnerModulePresenceAndReportAbsence(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		configured []string
+		requested  []string
+		wantFlag   bool
+		wantValue  string
+	}{
+		{"omitted", nil, nil, false, ""},
+		{"configured", []string{"grammar", "grammar"}, nil, true, "grammar,grammar"},
+		{"empty override", []string{"grammar"}, []string{}, true, ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Modules: test.configured})
+			req := auditaTestRequest(t)
+			req.Modules = test.requested
+			runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+				index := -1
+				for i, arg := range processReq.Args {
+					if arg == "--modules" {
+						index = i
+					}
+					if strings.HasPrefix(arg, "--report") || arg == "--debug" || arg == "--work-dir" {
+						t.Fatalf("retired or unwanted flag %q", arg)
+					}
+				}
+				if (index >= 0) != test.wantFlag || (index >= 0 && processReq.Args[index+1] != test.wantValue) {
+					t.Fatalf("args = %#v", processReq.Args)
+				}
+				writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+				return subprocess.RunResult{}, nil
+			}
+			result, err := runner.Run(context.Background(), req)
+			if err != nil || result.Reports != (ReportBundle{}) {
+				t.Fatalf("result = %#v, error = %v", result, err)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerRejectsMissingOrMalformedTranscript(t *testing.T) {
+	for _, output := range []string{"", `{"segments":"wrong"}`} {
+		t.Run(output, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+			req := auditaTestRequest(t)
+			runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+				if output != "" {
+					writeAuditaTestFile(t, req.OutputProcessedPath, output)
+				}
+				return subprocess.RunResult{}, nil
+			}
+			if _, err := runner.Run(context.Background(), req); err == nil {
+				t.Fatal("missing or malformed transcript was accepted")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerPreservesFailureAndAvailableReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita exited after writing output")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml"), "status: failed\n")
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	result, err := runner.Run(context.Background(), req)
+	if !errors.Is(err, processFailure) || !strings.Contains(err.Error(), filepath.Dir(req.OutputProcessedPath)) {
+		t.Fatalf("error = %v", err)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath != "" || result.Reports.OverviewPath != "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+}
+
+func TestSubprocessRunnerDoesNotMaskProcessFailureWithReportError(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita process failed")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	if _, err := runner.Run(context.Background(), req); !errors.Is(err, processFailure) {
+		t.Fatalf("error = %v, want original process error", err)
+	}
+}
+
+func TestSubprocessRunnerBoundsAdjacentReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{}, nil
+	}
+	if _, err := runner.Run(context.Background(), req); err == nil || !strings.Contains(err.Error(), "errors.yml") || !strings.Contains(err.Error(), "16777216") {
+		t.Fatalf("error = %v, want named report limit", err)
+	}
+}
+
+func TestSubprocessRunnerRedactsCustomCredentialStreams(t *testing.T) {
+	const first = "NARRATIO_AUDITA_STREAM_ONE"
+	const second = "NARRATIO_AUDITA_STREAM_TWO"
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "success", true: "failure"}[fail], func(t *testing.T) {
+			firstSecret := auditaTestSecret(t, first, "audita-first-secret")
+			secondSecret := auditaTestSecret(t, second, "audita-second-secret")
+			req := auditaTestRequest(t)
+			body := "#!/bin/sh\nprintf '%s\\n' \"$" + first + "\"\nprintf '%s\\n' \"$" + second + "\" >&2\n"
+			if fail {
+				body += "exit 7\n"
+			} else {
+				body += "printf '{\"segments\":[]}' > \"" + req.OutputProcessedPath + "\"\n"
+			}
+			binary := filepath.Join(t.TempDir(), "audita-helper")
+			writeAuditaTestFile(t, binary, body)
+			if err := os.Chmod(binary, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Binary: binary, Credentials: []configkit.Secret{firstSecret, secondSecret}})
+			_, err := runner.Run(context.Background(), req)
+			if (err != nil) != fail {
+				t.Fatalf("error = %v, fail = %v", err, fail)
+			}
+			for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+				data, readErr := os.ReadFile(path)
+				if readErr != nil {
+					t.Fatal(readErr)
+				}
+				if strings.Contains(string(data), "audita-first-secret") || strings.Contains(string(data), "audita-second-secret") || !strings.Contains(string(data), "<redacted>") {
+					t.Fatalf("unredacted stream %q: %s", path, data)
+				}
+			}
+			if fail && (strings.Contains(err.Error(), "audita-first-secret") || strings.Contains(err.Error(), "audita-second-secret")) {
+				t.Fatalf("unredacted failure: %v", err)
+			}
+		})
 	}
-	return d
 }

internal/adapters/notarius/fake.go

@@ -1,6 +1,10 @@
 package notarius
 
-import "context"
+import (
+	"context"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
 
 // FakeRunner is a configurable in-memory runner for stage tests.
 type FakeRunner struct {
@@ -15,6 +19,11 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 		return RunResult{}, err
 	}
 	copyRequest := req
+	copyRequest.Credentials = append([]configkit.Secret(nil), req.Credentials...)
+	if req.ConfigOverlay != nil {
+		profile := *req.ConfigOverlay
+		copyRequest.ConfigOverlay = &profile
+	}
 	copyRequest.References = append([]ReferenceBinding(nil), req.References...)
 	f.Requests = append(f.Requests, copyRequest)
 	if f.Err != nil {

internal/adapters/notarius/runner.go

@@ -4,6 +4,8 @@ package notarius
 import (
 	"context"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
 const ReceiptSchemaVersion = "notarius.run-result.v2"
@@ -22,7 +24,10 @@ type ReferenceBinding struct {
 
 // RunRequest contains the resolved inputs and diagnostic destinations for one invocation.
 type RunRequest struct {
-	Binary           string
+	Binary string
+	// Credentials are already-resolved environment references selected for Notarius.
+	Credentials      []configkit.Secret
+	ConfigOverlay    *string
 	ConfigPath       string
 	PipelineID       string
 	InputPath        string
@@ -31,6 +36,8 @@ type RunRequest struct {
 	ReceiptPath      string
 	LogPath          string
 	Timeout          time.Duration
+	Resume           bool
+	ChunkCache       string
 	References       []ReferenceBinding
 }
 

internal/adapters/notarius/subprocess.go

@@ -52,6 +52,10 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return RunResult{}, err
 	}
+	envOverrides, sensitiveEnvNames, err := subprocess.CredentialEnvironment(req.Credentials)
+	if err != nil {
+		return RunResult{}, fmt.Errorf("notarius credentials: %w", err)
+	}
 
 	args := []string{
 		"run", req.PipelineID,
@@ -59,18 +63,29 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 		"--input", req.InputPath,
 		"--output-dir", req.OutputRoot,
 	}
+	if req.Resume {
+		args = append(args, "--resume")
+	}
+	if req.ChunkCache != "" {
+		args = append(args, "--chunk_cache", req.ChunkCache)
+	}
 	for _, reference := range references {
 		args = append(args, "--reference", reference.Selector+"="+reference.Path)
 	}
+	if req.ConfigOverlay != nil {
+		args = append(args, "--config-overlay", *req.ConfigOverlay)
+	}
 	args = append(args, "--json")
 	processResult, err := r.run(ctx, subprocess.RunRequest{
-		Executable:      req.Binary,
-		Args:            args,
-		WorkingDir:      req.WorkingDirectory,
-		Timeout:         req.Timeout,
-		DiagnosticOwner: "notarius",
-		StdoutLogPath:   req.ReceiptPath,
-		StderrLogPath:   req.LogPath,
+		Executable:        req.Binary,
+		Args:              args,
+		WorkingDir:        req.WorkingDirectory,
+		Timeout:           req.Timeout,
+		DiagnosticOwner:   "notarius",
+		StdoutLogPath:     req.ReceiptPath,
+		StderrLogPath:     req.LogPath,
+		EnvOverrides:      envOverrides,
+		SensitiveEnvNames: sensitiveEnvNames,
 	})
 	baseResult := RunResult{
 		ReceiptPath: req.ReceiptPath,
@@ -143,6 +158,9 @@ func validateRunRequest(req RunRequest) ([]ReferenceBinding, error) {
 	if req.Timeout <= 0 {
 		return nil, fmt.Errorf("notarius timeout must be positive")
 	}
+	if !validChunkCacheMode(req.ChunkCache) {
+		return nil, fmt.Errorf("notarius chunk cache mode must be empty, auto, bypass, or refresh")
+	}
 	for label, path := range map[string]string{
 		"config":            req.ConfigPath,
 		"input":             req.InputPath,
@@ -201,6 +219,15 @@ func validateRunRequest(req RunRequest) ([]ReferenceBinding, error) {
 	return references, nil
 }
 
+func validChunkCacheMode(mode string) bool {
+	switch mode {
+	case "", "auto", "bypass", "refresh":
+		return true
+	default:
+		return false
+	}
+}
+
 type receiptDocument struct {
 	SchemaVersion             string                      `json:"schema_version"`
 	RunID                     string                      `json:"run_id"`
@@ -248,7 +275,7 @@ func validateValidationSummaries(documents []validationSummaryDocument) ([]Valid
 		if document.Status != "complete" && document.Status != "rejected" && document.Status != "incomplete" {
 			return nil, fmt.Errorf("notarius validation summary status %q is invalid", document.Status)
 		}
-		if document.ProducerAttemptCount == nil || *document.ProducerAttemptCount <= 0 || !validTerminalAction(document.TerminalAction) {
+		if document.ProducerAttemptCount == nil || *document.ProducerAttemptCount < 0 || !validTerminalAction(document.TerminalAction) {
 			return nil, fmt.Errorf("notarius validation summary is missing required fields")
 		}
 		summaries = append(summaries, ValidationSummary{

internal/adapters/notarius/subprocess_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	sharedsubprocess "gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 )
 
@@ -76,6 +77,178 @@ func TestSubprocessRunnerBuildsExactInvocationAndDiscoversBundle(t *testing.T) {
 	}
 }
 
+func TestSubprocessRunnerMapsCacheControlsToArguments(t *testing.T) {
+	tests := []struct {
+		name       string
+		resume     bool
+		chunkCache string
+		want       []string
+	}{
+		{name: "resume", resume: true, want: []string{"--resume"}},
+		{name: "auto", chunkCache: "auto", want: []string{"--chunk_cache", "auto"}},
+		{name: "bypass", chunkCache: "bypass", want: []string{"--chunk_cache", "bypass"}},
+		{name: "refresh", chunkCache: "refresh", want: []string{"--chunk_cache", "refresh"}},
+		{name: "resume and mode", resume: true, chunkCache: "auto", want: []string{"--resume", "--chunk_cache", "auto"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.Resume = test.resume
+			req.ChunkCache = test.chunkCache
+			var captured sharedsubprocess.RunRequest
+			runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				captured = processReq
+				writeValidBundleAndReceipt(t, req, false)
+				return sharedsubprocess.RunResult{ExitCode: 0}, nil
+			}}
+
+			if _, err := runner.Run(context.Background(), req); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			want := []string{
+				"run", req.PipelineID, "--config", req.ConfigPath, "--input", req.InputPath,
+				"--output-dir", req.OutputRoot,
+			}
+			want = append(want, test.want...)
+			want = append(want, "--json")
+			if !reflect.DeepEqual(captured.Args, want) {
+				t.Fatalf("subprocess args = %#v, want %#v", captured.Args, want)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerMapsConfigOverlayToArgumentPair(t *testing.T) {
+	tests := []struct {
+		name     string
+		supplied bool
+		value    string
+	}{
+		{name: "omitted"},
+		{name: "empty", supplied: true},
+		{name: "default", supplied: true, value: "default"},
+		{name: "named", supplied: true, value: "inexpensive"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			if test.supplied {
+				req.ConfigOverlay = &test.value
+			}
+			var captured sharedsubprocess.RunRequest
+			runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				captured = processReq
+				writeValidBundleAndReceipt(t, req, false)
+				return sharedsubprocess.RunResult{ExitCode: 0}, nil
+			}}
+
+			if _, err := runner.Run(context.Background(), req); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			flagIndex := -1
+			for index, arg := range captured.Args {
+				if arg == "--config-overlay" {
+					flagIndex = index
+					break
+				}
+			}
+			if !test.supplied {
+				if flagIndex >= 0 {
+					t.Fatalf("subprocess args unexpectedly contain config overlay: %#v", captured.Args)
+				}
+				return
+			}
+			if flagIndex < 0 || flagIndex+2 >= len(captured.Args) || captured.Args[flagIndex+1] != test.value || captured.Args[flagIndex+2] != "--json" {
+				t.Fatalf("config overlay argument boundary = %#v, want flag, exact value, then --json", captured.Args)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidChunkCacheBeforeLaunch(t *testing.T) {
+	for _, mode := range []string{"AUTO", "invalid", " auto "} {
+		t.Run(mode, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.ChunkCache = mode
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), "chunk cache mode") {
+				t.Fatalf("Run() error = %v, want chunk cache validation failure", err)
+			}
+			if started {
+				t.Fatal("subprocess started with invalid chunk cache mode")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_LLM_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_OTHER_KEY"
+	const loadedValue = "loaded-notarius-credential"
+	const otherValue = "loaded-notarius-other-credential"
+	credential := loadTestCredential(t, envName, loadedValue)
+	otherCredential := loadTestCredential(t, otherName, otherValue)
+	t.Setenv(envName, "changed-parent-credential")
+	t.Setenv(otherName, "changed-parent-other-credential")
+
+	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*credential, *otherCredential}
+	var captured sharedsubprocess.RunRequest
+	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+		captured = processReq
+		writeValidBundleAndReceipt(t, req, false)
+		return sharedsubprocess.RunResult{ExitCode: 0}, nil
+	}}
+	if _, err := runner.Run(context.Background(), req); err != nil {
+		t.Fatalf("Run() error = %v", err)
+	}
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[envName] != loadedValue || captured.EnvOverrides[otherName] != otherValue {
+		t.Fatal("subprocess did not receive exactly the loaded credential overrides")
+	}
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName, otherName}) {
+		t.Fatalf("sensitive environment names = %#v, want configured reference name", captured.SensitiveEnvNames)
+	}
+	wantArgs := []string{
+		"run", req.PipelineID, "--config", req.ConfigPath, "--input", req.InputPath,
+		"--output-dir", req.OutputRoot, "--json",
+	}
+	if !reflect.DeepEqual(captured.Args, wantArgs) {
+		t.Fatalf("subprocess args = %#v, want %#v", captured.Args, wantArgs)
+	}
+}
+
+func TestSubprocessRunnerRejectsInvalidProgrammaticCredentialBeforeLaunch(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		reference configkit.Secret
+	}{
+		{name: "unresolved", reference: configkit.SecretEnv("NARRATIO_NOTARIUS_UNRESOLVED_KEY")},
+		{name: "empty", reference: configkit.SecretEnv("")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			req := validRunRequest(t)
+			req.Credentials = []configkit.Secret{test.reference}
+			started := false
+			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
+				started = true
+				return sharedsubprocess.RunResult{}, nil
+			}}
+			_, err := runner.Run(context.Background(), req)
+			if err == nil || !strings.Contains(err.Error(), "resolved and nonempty") {
+				t.Fatalf("Run() error = %v, want credential validation failure", err)
+			}
+			if started {
+				t.Fatal("subprocess started with an invalid credential")
+			}
+		})
+	}
+}
+
 func TestSubprocessRunnerBuildsOrderedReferenceArguments(t *testing.T) {
 	req := validRunRequest(t)
 	referenceRoot := t.TempDir()
@@ -172,16 +345,25 @@ func TestSubprocessRunnerRejectsInvalidReferencesBeforeLaunch(t *testing.T) {
 }
 
 func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_OTHER_KEY"
+	const canary = "notarius-captured-stream-canary"
+	const otherCanary = "notarius-captured-stream-other-canary"
+	const unrelated = "NARRATIO_NOTARIUS_UNRELATED_PARENT_KEY"
 	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	writeValidBundleAndReceipt(t, req, false)
 	receiptFixture := req.ReceiptPath + ".fixture"
 	data, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
-	if err := os.WriteFile(receiptFixture, data, 0o644); err != nil {
-		t.Fatalf("WriteFile(receipt fixture) error = %v", err)
+	var receipt map[string]any
+	if err := json.Unmarshal(data, &receipt); err != nil {
+		t.Fatalf("decode receipt fixture: %v", err)
 	}
+	receipt["credential_echo"] = canary + " " + otherCanary
+	writeJSONFile(t, receiptFixture, receipt)
 	if err := os.Remove(req.ReceiptPath); err != nil {
 		t.Fatalf("Remove(receipt) error = %v", err)
 	}
@@ -193,27 +375,67 @@ func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T)
 	script := writeShellScript(t, `#!/bin/sh
 pwd > "$NOTARIUS_CAPTURE_DIR/working-directory"
 printf '%s' "$NOTARIUS_INHERITED_VALUE" > "$NOTARIUS_CAPTURE_DIR/environment"
-printf 'diagnostic stream\n' >&2
+if [ "$`+envName+`" != '`+canary+`' ]; then
+  printf 'selected credential mismatch\n' >&2
+  exit 8
+fi
+if [ "$`+otherName+`" != '`+otherCanary+`' ]; then
+  printf 'other selected credential mismatch\n' >&2
+  exit 10
+fi
+if [ -n "$`+unrelated+`" ]; then
+  printf 'unrelated credential inherited\n' >&2
+  exit 9
+fi
+printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 cat "$NOTARIUS_RECEIPT_FIXTURE"
 `)
 	req.Binary = script
 	t.Setenv("NOTARIUS_CAPTURE_DIR", captureDir)
 	t.Setenv("NOTARIUS_INHERITED_VALUE", "inherited-value")
 	t.Setenv("NOTARIUS_RECEIPT_FIXTURE", receiptFixture)
+	t.Setenv(unrelated, "unrelated-parent-credential")
 
 	if _, err := NewSubprocessRunner().Run(context.Background(), req); err != nil {
 		t.Fatalf("Run() error = %v", err)
 	}
 	assertTextFile(t, filepath.Join(captureDir, "working-directory"), req.WorkingDirectory+"\n")
 	assertTextFile(t, filepath.Join(captureDir, "environment"), "")
-	assertTextFile(t, req.LogPath, "diagnostic stream\n")
+	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 	receiptBytes, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
-	if strings.Contains(string(receiptBytes), "diagnostic stream") {
-		t.Fatal("receipt contains stderr output")
+	assertRedactedCredentialBytes(t, receiptBytes, canary)
+	assertRedactedCredentialBytes(t, receiptBytes, otherCanary)
+}
+
+func TestSubprocessRunnerRedactsCredentialOnProcessFailure(t *testing.T) {
+	const envName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_OTHER_KEY"
+	const canary = "notarius-failure-stream-canary"
+	const otherCanary = "notarius-failure-stream-other-canary"
+	req := validRunRequest(t)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
+	req.Binary = writeShellScript(t, `#!/bin/sh
+printf '%s\n' "$`+envName+`"
+printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
+exit 7
+`)
+	_, err := NewSubprocessRunner().Run(context.Background(), req)
+	if err == nil {
+		t.Fatal("Run() error = nil, want process failure")
 	}
+	if strings.Contains(err.Error(), canary) || strings.Contains(err.Error(), otherCanary) || !strings.Contains(err.Error(), "<redacted>") {
+		t.Fatal("process failure did not return redacted diagnostics")
+	}
+	assertRedactedCredentialFile(t, req.ReceiptPath, canary)
+	assertRedactedCredentialFile(t, req.ReceiptPath, otherCanary)
+	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 }
 
 func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T) {
@@ -231,6 +453,10 @@ func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			req := validRunRequest(t)
+			if test.name == "nonzero" {
+				profile := "missing-profile"
+				req.ConfigOverlay = &profile
+			}
 			req.Binary = writeShellScript(t, "#!/bin/sh\n"+test.scriptBody)
 			req.Timeout = test.timeout
 			ctx := context.Background()
@@ -527,7 +753,8 @@ func TestLoadDiagnosticSummariesValidateBoundsAndTolerateUnknownFields(t *testin
 }
 
 func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
-	req := RunRequest{PipelineID: "pipeline", References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
+	profile := "testing"
+	req := RunRequest{PipelineID: "pipeline", ConfigOverlay: &profile, References: []ReferenceBinding{{Selector: "party", Path: "/references/party.json"}}}
 	want := RunResult{BundleRoot: "/bundle"}
 	fake := &FakeRunner{Result: want}
 	got, err := fake.Run(context.Background(), req)
@@ -538,6 +765,10 @@ func TestFakeRunnerCapturesRequestsAndHonorsContextAndError(t *testing.T) {
 	if fake.Requests[0].References[0].Path != "/references/party.json" {
 		t.Fatalf("fake retained aliased request references: %#v", fake.Requests[0].References)
 	}
+	profile = "changed"
+	if *fake.Requests[0].ConfigOverlay != "testing" {
+		t.Fatalf("fake retained aliased config overlay: %q", *fake.Requests[0].ConfigOverlay)
+	}
 
 	wantErr := errors.New("configured failure")
 	fake.Err = wantErr
@@ -579,6 +810,56 @@ func validRunRequest(t *testing.T) RunRequest {
 	}
 }
 
+func loadTestCredential(t *testing.T, envName, value string) *configkit.Secret {
+	t.Helper()
+	t.Setenv(envName, value)
+	type testConfig struct {
+		Credential *configkit.Secret `yaml:"credential"`
+	}
+	result, err := configkit.Load(configkit.Bytes("credential.yml", []byte("credential: "+envName+"\n")), configkit.Options[testConfig]{})
+	if err != nil {
+		t.Fatalf("load test credential: %v", err)
+	}
+	return result.Config.Credential
+}
+
+func assertRedactedCredentialFile(t *testing.T, path, canary string) {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("ReadFile(%q) error = %v", path, err)
+	}
+	assertRedactedCredentialBytes(t, data, canary)
+}
+
+func assertRedactedCredentialBytes(t *testing.T, data []byte, canary string) {
+	t.Helper()
+	text := string(data)
+	if strings.Contains(text, canary) || !strings.Contains(text, "<redacted>") {
+		t.Fatal("captured stream did not contain the required redaction marker")
+	}
+}
+
+func TestValidateValidationSummariesAcceptsReusedProducerWithoutAttempts(t *testing.T) {
+	zero := 0
+	summaries, err := validateValidationSummaries([]validationSummaryDocument{{
+		Stage: "chunk", Status: "complete", ProducerAttemptCount: &zero, TerminalAction: "accepted",
+	}})
+	if err != nil {
+		t.Fatalf("validateValidationSummaries() error = %v", err)
+	}
+	if len(summaries) != 1 || summaries[0].ProducerAttemptCount != 0 {
+		t.Fatalf("summaries = %#v, want one reused producer with zero attempts", summaries)
+	}
+
+	negative := -1
+	if _, err := validateValidationSummaries([]validationSummaryDocument{{
+		Stage: "chunk", Status: "complete", ProducerAttemptCount: &negative, TerminalAction: "accepted",
+	}}); err == nil {
+		t.Fatal("validateValidationSummaries() negative producer attempts error = nil")
+	}
+}
+
 func writeValidBundleAndReceipt(t *testing.T, req RunRequest, includeUnknown bool) {
 	t.Helper()
 	bundle := filepath.Join(req.OutputRoot, "notarius-run-1")

internal/adapters/scriptorium/fake.go

@@ -3,6 +3,7 @@ package scriptorium
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
@@ -65,6 +66,7 @@ func (f *FakeRunner) RunArtifact(ctx context.Context, req RunArtifactRequest) (A
 	if err := ctx.Err(); err != nil {
 		return ArtifactResult{}, err
 	}
+	req.Credentials = slices.Clone(req.Credentials)
 	f.RunRequests = append(f.RunRequests, req)
 	if f.RunErr != nil {
 		return ArtifactResult{}, f.RunErr
@@ -105,6 +107,7 @@ func (f *FakeRunner) RenderArtifact(ctx context.Context, req RenderArtifactReque
 	if err := ctx.Err(); err != nil {
 		return ArtifactResult{}, err
 	}
+	req.Credentials = slices.Clone(req.Credentials)
 	f.RenderRequests = append(f.RenderRequests, req)
 	if f.RenderErr != nil {
 		return ArtifactResult{}, f.RenderErr

internal/adapters/scriptorium/runner.go

@@ -4,6 +4,8 @@ package scriptorium
 import (
 	"context"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
 const (
@@ -32,7 +34,7 @@ type RunArtifactRequest struct {
 	StderrLogPath       string
 	GeneratedConfigPath string
 	Timeout             time.Duration
-	APIKeyEnv           string
+	Credentials         []configkit.Secret
 	WorkingDir          string
 }
 
@@ -49,7 +51,7 @@ type RenderArtifactRequest struct {
 	StderrLogPath       string
 	GeneratedConfigPath string
 	Timeout             time.Duration
-	APIKeyEnv           string
+	Credentials         []configkit.Secret
 	WorkingDir          string
 }
 

internal/adapters/scriptorium/subprocess.go

@@ -28,7 +28,12 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 	if r == nil {
 		return ArtifactResult{}, fmt.Errorf("scriptorium subprocess runner is nil")
 	}
-	credentialPresent, err := validateCommonRunRequest(req.Binary, req.ConfigPath, req.PromptID, req.OutputPath, req.Timeout, req.APIKeyEnv, req.InputPaths, req.Vars)
+	err := validateCommonRunRequest(req.Binary, req.ConfigPath, req.PromptID, req.OutputPath, req.Timeout, req.InputPaths, req.Vars)
+	if err != nil {
+		return ArtifactResult{}, err
+	}
+
+	envOverrides, sensitiveNames, err := subprocess.CredentialEnvironment(req.Credentials)
 	if err != nil {
 		return ArtifactResult{}, err
 	}
@@ -46,8 +51,7 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 			InputPaths:        cloneStringMap(req.InputPaths),
 			Vars:              cloneStringMap(req.Vars),
 			OutputPath:        req.OutputPath,
-			APIKeyEnv:         strings.TrimSpace(req.APIKeyEnv),
-			APIKeyEnvPresent:  credentialPresent,
+			CredentialNames:   sensitiveNames,
 			WorkingDir:        req.WorkingDir,
 			RenderFormat:      "",
 			RenderPromptStore: false,
@@ -56,7 +60,6 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 		}
 	}
 
-	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
 		Executable:        req.Binary,
 		Args:              args,
@@ -80,12 +83,11 @@ func (r *SubprocessRunner) RunArtifact(ctx context.Context, req RunArtifactReque
 		PromptID:            req.PromptID,
 		ProfileID:           req.ProfileID,
 		Metadata: map[string]any{
-			"adapter":             "scriptorium_subprocess",
-			"config_path":         strings.TrimSpace(req.ConfigPath),
-			"inputs_count":        len(req.InputPaths),
-			"vars_count":          len(req.Vars),
-			"api_key_env":         strings.TrimSpace(req.APIKeyEnv),
-			"api_key_env_present": credentialPresent,
+			"adapter":              "scriptorium_subprocess",
+			"config_path":          strings.TrimSpace(req.ConfigPath),
+			"inputs_count":         len(req.InputPaths),
+			"vars_count":           len(req.Vars),
+			"credential_env_names": sensitiveNames,
 		},
 	}
 
@@ -114,7 +116,12 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 	if r == nil {
 		return ArtifactResult{}, fmt.Errorf("scriptorium subprocess runner is nil")
 	}
-	credentialPresent, err := validateCommonRunRequest(req.Binary, req.ConfigPath, req.PromptID, req.OutputPath, req.Timeout, req.APIKeyEnv, req.InputPaths, req.Vars)
+	err := validateCommonRunRequest(req.Binary, req.ConfigPath, req.PromptID, req.OutputPath, req.Timeout, req.InputPaths, req.Vars)
+	if err != nil {
+		return ArtifactResult{}, err
+	}
+
+	envOverrides, sensitiveNames, err := subprocess.CredentialEnvironment(req.Credentials)
 	if err != nil {
 		return ArtifactResult{}, err
 	}
@@ -132,8 +139,7 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 			InputPaths:        cloneStringMap(req.InputPaths),
 			Vars:              cloneStringMap(req.Vars),
 			OutputPath:        req.OutputPath,
-			APIKeyEnv:         strings.TrimSpace(req.APIKeyEnv),
-			APIKeyEnvPresent:  credentialPresent,
+			CredentialNames:   sensitiveNames,
 			WorkingDir:        req.WorkingDir,
 			RenderFormat:      "json",
 			RenderPromptStore: false,
@@ -142,7 +148,6 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 		}
 	}
 
-	envOverrides, sensitiveNames := credentialEnvironment(req.APIKeyEnv)
 	runRes, runErr := subprocess.Run(ctx, subprocess.RunRequest{
 		Executable:        req.Binary,
 		Args:              args,
@@ -166,13 +171,12 @@ func (r *SubprocessRunner) RenderArtifact(ctx context.Context, req RenderArtifac
 		PromptID:            req.PromptID,
 		ProfileID:           req.ProfileID,
 		Metadata: map[string]any{
-			"adapter":             "scriptorium_subprocess",
-			"config_path":         strings.TrimSpace(req.ConfigPath),
-			"inputs_count":        len(req.InputPaths),
-			"vars_count":          len(req.Vars),
-			"api_key_env":         strings.TrimSpace(req.APIKeyEnv),
-			"api_key_env_present": credentialPresent,
-			"format":              "json",
+			"adapter":              "scriptorium_subprocess",
+			"config_path":          strings.TrimSpace(req.ConfigPath),
+			"inputs_count":         len(req.InputPaths),
+			"vars_count":           len(req.Vars),
+			"credential_env_names": sensitiveNames,
+			"format":               "json",
 		},
 	}
 
@@ -191,57 +195,39 @@ func validateCommonRunRequest(
 	promptID string,
 	outputPath string,
 	timeout time.Duration,
-	apiKeyEnv string,
 	inputPaths map[string]string,
 	vars map[string]string,
-) (bool, error) {
+) error {
 	if strings.TrimSpace(binary) == "" {
-		return false, fmt.Errorf("scriptorium binary is required")
+		return fmt.Errorf("scriptorium binary is required")
 	}
 	if strings.TrimSpace(configPath) == "" && configPath != "" {
-		return false, fmt.Errorf("scriptorium config path must be non-empty when provided")
+		return fmt.Errorf("scriptorium config path must be non-empty when provided")
 	}
 	if strings.TrimSpace(promptID) == "" {
-		return false, fmt.Errorf("scriptorium prompt id is required")
+		return fmt.Errorf("scriptorium prompt id is required")
 	}
 	if strings.TrimSpace(outputPath) == "" {
-		return false, fmt.Errorf("scriptorium output path is required")
+		return fmt.Errorf("scriptorium output path is required")
 	}
 	if timeout <= 0 {
-		return false, fmt.Errorf("scriptorium timeout must be > 0")
+		return fmt.Errorf("scriptorium timeout must be > 0")
 	}
 	for name, path := range inputPaths {
 		if strings.TrimSpace(name) == "" {
-			return false, fmt.Errorf("scriptorium input names must be non-empty")
+			return fmt.Errorf("scriptorium input names must be non-empty")
 		}
 		if strings.TrimSpace(path) == "" {
-			return false, fmt.Errorf("scriptorium input %q path is required", name)
+			return fmt.Errorf("scriptorium input %q path is required", name)
 		}
 	}
 	for name := range vars {
 		if strings.TrimSpace(name) == "" {
-			return false, fmt.Errorf("scriptorium variable names must be non-empty")
+			return fmt.Errorf("scriptorium variable names must be non-empty")
 		}
 	}
 
-	trimmedEnv := strings.TrimSpace(apiKeyEnv)
-	if trimmedEnv == "" {
-		return false, nil
-	}
-	value, ok := os.LookupEnv(trimmedEnv)
-	if !ok || strings.TrimSpace(value) == "" {
-		return false, fmt.Errorf("scriptorium required credential environment variable %s is not set", trimmedEnv)
-	}
-	return true, nil
-}
-
-func credentialEnvironment(apiKeyEnv string) (map[string]string, []string) {
-	name := strings.TrimSpace(apiKeyEnv)
-	if name == "" {
-		return nil, nil
-	}
-	value, _ := os.LookupEnv(name)
-	return map[string]string{name: value}, []string{name}
+	return nil
 }
 
 func buildRunArgs(req RunArtifactRequest) []string {
@@ -258,9 +244,6 @@ func buildRunArgs(req RunArtifactRequest) []string {
 	for _, kv := range sortedKeyValues(req.Vars) {
 		args = append(args, "--var", kv)
 	}
-	if envName := strings.TrimSpace(req.APIKeyEnv); envName != "" {
-		args = append(args, "--api-key-env", envName)
-	}
 	args = append(args, "--timeout", req.Timeout.String())
 	args = append(args, "--out", req.OutputPath)
 	return args
@@ -280,9 +263,6 @@ func buildRenderArgs(req RenderArtifactRequest) []string {
 	for _, kv := range sortedKeyValues(req.Vars) {
 		args = append(args, "--var", kv)
 	}
-	if envName := strings.TrimSpace(req.APIKeyEnv); envName != "" {
-		args = append(args, "--api-key-env", envName)
-	}
 	args = append(args, "--timeout", req.Timeout.String())
 	args = append(args, "--format", "json")
 	args = append(args, "--out", req.OutputPath)
@@ -316,8 +296,7 @@ type invocationPayload struct {
 	InputPaths        map[string]string
 	Vars              map[string]string
 	OutputPath        string
-	APIKeyEnv         string
-	APIKeyEnvPresent  bool
+	CredentialNames   []string
 	WorkingDir        string
 	RenderFormat      string
 	RenderPromptStore bool
@@ -336,8 +315,7 @@ func writeInvocationConfig(path string, payload invocationPayload) error {
 		"input_paths":          payload.InputPaths,
 		"vars":                 payload.Vars,
 		"output_path":          payload.OutputPath,
-		"api_key_env":          payload.APIKeyEnv,
-		"api_key_env_present":  payload.APIKeyEnvPresent,
+		"credential_env_names": payload.CredentialNames,
 		"working_dir":          payload.WorkingDir,
 		"render_format":        payload.RenderFormat,
 		"render_prompt_logged": payload.RenderPromptStore,

internal/adapters/scriptorium/subprocess_test.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
 func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *testing.T) {
@@ -16,6 +18,13 @@ func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *tes
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "run_success")
 	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
+	loaded, err := configkit.Load[struct {
+		Credentials []configkit.Secret `yaml:"credentials"`
+	}](configkit.Bytes("test.yml", []byte("credentials: [OPENAI_KEY_SOURCE]\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OPENAI_KEY_SOURCE", "changed-after-load")
 	recordPath := filepath.Join(t.TempDir(), "record.json")
 	t.Setenv("SCRIPTORIUM_HELPER_RECORD_PATH", recordPath)
 
@@ -34,7 +43,7 @@ func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *tes
 		StderrLogPath:       filepath.Join(dir, "logs", "scriptorium.run.stderr.log"),
 		GeneratedConfigPath: filepath.Join(dir, "config", "scriptorium.run.generated.yml"),
 		Timeout:             mustParseScriptoriumDuration(t, "2s"),
-		APIKeyEnv:           "OPENAI_KEY_SOURCE",
+		Credentials:         loaded.Config.Credentials,
 	}
 	writeScriptoriumFile(t, req.InputPaths["transcript"], `{"segments":[]}`)
 	writeScriptoriumFile(t, req.InputPaths["other"], "notes\n")
@@ -70,7 +79,6 @@ func TestSubprocessRunnerRunSuccessBuildsDeterministicArgsAndCapturesLogs(t *tes
 		"--input", "transcript=" + req.InputPaths["transcript"],
 		"--var", "campaign_name=Icewind Dale",
 		"--var", "session_id=2026-05-03",
-		"--api-key-env", "OPENAI_KEY_SOURCE",
 		"--timeout", "2s",
 		"--out", req.OutputPath,
 	}
@@ -94,13 +102,31 @@ func TestSubprocessRunnerRunExitCodeOneFails(t *testing.T) {
 	t.Setenv("GO_WANT_SCRIPTORIUM_HELPER", "1")
 	t.Setenv("SCRIPTORIUM_HELPER_MODE", "fail_exit1")
 	t.Setenv("SCRIPTORIUM_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
+	t.Setenv("CUSTOM_PROVIDER_KEY", "synthetic-failure-secret")
+	loaded, loadErr := configkit.Load[struct {
+		Credentials []configkit.Secret `yaml:"credentials"`
+	}](configkit.Bytes("test.yml", []byte("credentials: [CUSTOM_PROVIDER_KEY]\n")))
+	if loadErr != nil {
+		t.Fatal(loadErr)
+	}
 
 	runner := NewSubprocessRunner()
 	req := runReqForTest(t, writeScriptoriumHelperWrapper(t))
+	req.Credentials = loaded.Config.Credentials
 	res, err := runner.RunArtifact(context.Background(), req)
 	if err == nil {
 		t.Fatal("RunArtifact() error = nil, want non-nil")
 	}
+	if strings.Contains(err.Error(), "synthetic-failure-secret") {
+		t.Fatal("failure leaked credential")
+	}
+	data, readErr := os.ReadFile(req.StderrLogPath)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if strings.Contains(string(data), "synthetic-failure-secret") || !strings.Contains(string(data), "<redacted>") {
+		t.Fatal("failure log did not redact selected credential")
+	}
 	if res.ExitCode != 1 {
 		t.Fatalf("ExitCode = %d, want 1", res.ExitCode)
 	}
@@ -245,6 +271,7 @@ func TestScriptoriumSubprocessHelper(t *testing.T) {
 		os.Exit(0)
 	case "fail_exit1":
 		_, _ = os.Stderr.WriteString("scriptorium helper failure\n")
+		_, _ = os.Stderr.WriteString(os.Getenv("CUSTOM_PROVIDER_KEY"))
 		os.Exit(1)
 	case "fail_exit2_with_output":
 		writeScriptoriumHelperFile(outputPath, "validation failed artifact\n")

internal/adapters/subprocess/credentials.go

@@ -0,0 +1,29 @@
+package subprocess
+
+import (
+	"fmt"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// CredentialEnvironment returns captured secret values and names for a child
+// invocation. References must already have been resolved by ConfigKit.
+func CredentialEnvironment(credentials []configkit.Secret) (map[string]string, []string, error) {
+	if len(credentials) == 0 {
+		return nil, nil, nil
+	}
+	overrides := make(map[string]string, len(credentials))
+	names := make([]string, 0, len(credentials))
+	for _, credential := range credentials {
+		name := credential.EnvName()
+		value := credential.Value()
+		if !credential.IsResolved() || value == "" {
+			return nil, nil, fmt.Errorf("credential %q must be resolved and nonempty", name)
+		}
+		if _, exists := overrides[name]; !exists {
+			names = append(names, name)
+			overrides[name] = value
+		}
+	}
+	return overrides, names, nil
+}

internal/adapters/subprocess/credentials_test.go

@@ -0,0 +1,51 @@
+package subprocess
+
+import (
+	"reflect"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestCredentialEnvironmentUsesCapturedReferences(t *testing.T) {
+	t.Setenv("CUSTOM_ALPHA_KEY", "alpha-value")
+	t.Setenv("SECOND_PROVIDER_TOKEN", "second-value")
+	t.Setenv("UNSELECTED_SECRET", "unselected-value")
+	type configuration struct {
+		Credentials []configkit.Secret `yaml:"credentials"`
+	}
+	loaded, err := configkit.Load[configuration](configkit.Bytes("credentials.yml", []byte("credentials: [CUSTOM_ALPHA_KEY, SECOND_PROVIDER_TOKEN, CUSTOM_ALPHA_KEY]\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CUSTOM_ALPHA_KEY", "later-value")
+	overrides, names, err := CredentialEnvironment(loaded.Config.Credentials)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(overrides, map[string]string{"CUSTOM_ALPHA_KEY": "alpha-value", "SECOND_PROVIDER_TOKEN": "second-value"}) ||
+		!reflect.DeepEqual(names, []string{"CUSTOM_ALPHA_KEY", "SECOND_PROVIDER_TOKEN"}) {
+		t.Fatalf("credential selection = %#v, %#v", overrides, names)
+	}
+	overrides["CUSTOM_ALPHA_KEY"] = "modified"
+	names[0] = "modified"
+	again, againNames, err := CredentialEnvironment(loaded.Config.Credentials)
+	if err != nil || again["CUSTOM_ALPHA_KEY"] != "alpha-value" || againNames[0] != "CUSTOM_ALPHA_KEY" {
+		t.Fatalf("credential conversion retained mutable result: %#v, %#v, %v", again, againNames, err)
+	}
+}
+
+func TestCredentialEnvironmentHandlesEmptyAndUnresolvedReferences(t *testing.T) {
+	for _, credentials := range [][]configkit.Secret{nil, {}} {
+		overrides, names, err := CredentialEnvironment(credentials)
+		if err != nil || len(overrides) != 0 || len(names) != 0 {
+			t.Fatalf("empty credentials = %#v, %#v, %v", overrides, names, err)
+		}
+	}
+	for _, credentials := range [][]configkit.Secret{{configkit.SecretEnv("UNRESOLVED_KEY")}, {{}}} {
+		overrides, names, err := CredentialEnvironment(credentials)
+		if err == nil || overrides != nil || names != nil {
+			t.Fatalf("unresolved credentials = %#v, %#v, %v", overrides, names, err)
+		}
+	}
+}

internal/adapters/whisperx/http.go

@@ -6,14 +6,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"mime/multipart"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
-	"path/filepath"
 	"strings"
-	"sync"
 	"time"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
@@ -21,7 +18,6 @@ import (
 
 const (
 	defaultMaxWhisperXResponseBytes int64 = 10 * 1024 * 1024
-	whisperXUploadBufferSize              = 32 * 1024
 )
 
 // HTTPClientConfig contains parsed, deterministic WhisperX HTTP client settings.
@@ -192,21 +188,32 @@ func (c *HTTPClient) Transcribe(ctx context.Context, req TranscribeRequest) (Tra
 }
 
 func (c *HTTPClient) doTranscribeAttempt(ctx context.Context, audioPath string) (int, []byte, error) {
-	upload := newMultipartUpload(ctx, audioPath, c.language, c.openAudio)
-	defer upload.Close()
+	upload, err := newMultipartBodyFactory(ctx, audioPath, c.language, c.openAudio)
+	if err != nil {
+		return 0, nil, fmt.Errorf("prepare whisperx request body: %w", err)
+	}
+	defer func() { _ = upload.Close() }()
+	body, err := upload.NewBody()
+	if err != nil {
+		return 0, nil, fmt.Errorf("open whisperx request body: %w", err)
+	}
 
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.url.String(), upload)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.url.String(), body)
 	if err != nil {
 		return 0, nil, fmt.Errorf("build whisperx request: %w", err)
 	}
 	req.Header.Set("Content-Type", upload.contentType)
 	req.Header.Set("Expect", "100-continue")
+	req.GetBody = upload.NewBody
 
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
 		_ = upload.Close()
-		if producerErr := upload.Wait(); producerErr != nil {
-			return 0, nil, fmt.Errorf("stream whisperx request body: %w", producerErr)
+		if sourceErr := upload.SourceError(true); sourceErr != nil {
+			return 0, nil, fmt.Errorf("stream whisperx request body: %w", sourceErr)
+		}
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return 0, nil, fmt.Errorf("perform whisperx request: %w", ctxErr)
 		}
 		return 0, nil, fmt.Errorf("perform whisperx request: %w", err)
 	}
@@ -214,8 +221,8 @@ func (c *HTTPClient) doTranscribeAttempt(ctx context.Context, audioPath string)
 
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		_ = upload.Close()
-		if producerErr := upload.Wait(); producerErr != nil {
-			return resp.StatusCode, nil, fmt.Errorf("stream whisperx request body: %w", producerErr)
+		if sourceErr := upload.SourceError(false); sourceErr != nil {
+			return resp.StatusCode, nil, fmt.Errorf("stream whisperx request body: %w", sourceErr)
 		}
 		if _, err := readWhisperXResponse(resp.Body, c.maxResponseBytes); err != nil {
 			return resp.StatusCode, nil, fmt.Errorf("read whisperx response body: %w", err)
@@ -223,13 +230,19 @@ func (c *HTTPClient) doTranscribeAttempt(ctx context.Context, audioPath string)
 		return resp.StatusCode, nil, fmt.Errorf("whisperx returned status %d", resp.StatusCode)
 	}
 
-	if err := upload.Wait(); err != nil {
-		return resp.StatusCode, nil, fmt.Errorf("stream whisperx request body: %w", err)
+	data, responseErr := readWhisperXResponse(resp.Body, c.maxResponseBytes)
+	_ = upload.Close()
+	if sourceErr := upload.SourceError(false); sourceErr != nil {
+		if responseErr != nil {
+			return resp.StatusCode, nil, fmt.Errorf("stream whisperx request body: %w", errors.Join(sourceErr, responseErr))
+		}
+		return resp.StatusCode, nil, fmt.Errorf("stream whisperx request body: %w", sourceErr)
 	}
-
-	data, err := readWhisperXResponse(resp.Body, c.maxResponseBytes)
-	if err != nil {
-		return resp.StatusCode, nil, fmt.Errorf("read whisperx response body: %w", err)
+	if err := ctx.Err(); err != nil {
+		return resp.StatusCode, nil, fmt.Errorf("complete whisperx request: %w", err)
+	}
+	if responseErr != nil {
+		return resp.StatusCode, nil, fmt.Errorf("read whisperx response body: %w", responseErr)
 	}
 	return resp.StatusCode, data, nil
 }
@@ -286,161 +299,6 @@ func isHTTPURLScheme(scheme string) bool {
 	}
 }
 
-type multipartUpload struct {
-	reader      *io.PipeReader
-	writer      *io.PipeWriter
-	contentType string
-	done        chan struct{}
-
-	mu      sync.Mutex
-	audio   io.Closer
-	err     error
-	aborted bool
-}
-
-func newMultipartUpload(ctx context.Context, audioPath, language string, openAudio func(string) (io.ReadCloser, error)) *multipartUpload {
-	reader, writer := io.Pipe()
-	multipartWriter := multipart.NewWriter(writer)
-	upload := &multipartUpload{
-		reader:      reader,
-		writer:      writer,
-		contentType: multipartWriter.FormDataContentType(),
-		done:        make(chan struct{}),
-	}
-
-	go func() {
-		err := upload.write(ctx, multipartWriter, audioPath, language, openAudio)
-		if err != nil {
-			_ = writer.CloseWithError(err)
-		} else {
-			_ = writer.Close()
-		}
-		upload.mu.Lock()
-		upload.err = err
-		upload.audio = nil
-		upload.mu.Unlock()
-		close(upload.done)
-	}()
-
-	go func() {
-		select {
-		case <-ctx.Done():
-			upload.abort()
-		case <-upload.done:
-		}
-	}()
-
-	return upload
-}
-
-func (u *multipartUpload) Read(p []byte) (int, error) {
-	return u.reader.Read(p)
-}
-
-func (u *multipartUpload) Close() error {
-	u.abort()
-	return nil
-}
-
-func (u *multipartUpload) Wait() error {
-	<-u.done
-	u.mu.Lock()
-	defer u.mu.Unlock()
-	return u.err
-}
-
-func (u *multipartUpload) write(ctx context.Context, writer *multipart.Writer, audioPath, language string, openAudio func(string) (io.ReadCloser, error)) error {
-	fileWriter, err := writer.CreateFormFile("file", filepath.Base(audioPath))
-	if err != nil {
-		return u.producerError(ctx, fmt.Errorf("create multipart file field: %w", err))
-	}
-
-	audioFile, err := openAudio(audioPath)
-	if err != nil {
-		return u.producerError(ctx, fmt.Errorf("open audio file %q: %w", audioPath, err))
-	}
-	u.setAudio(audioFile)
-
-	_, copyErr := io.CopyBuffer(fileWriter, &contextReader{ctx: ctx, reader: audioFile}, make([]byte, whisperXUploadBufferSize))
-	closeErr := audioFile.Close()
-	u.clearAudio(audioFile)
-	if copyErr != nil {
-		return u.producerError(ctx, fmt.Errorf("copy audio file %q: %w", audioPath, copyErr))
-	}
-	if closeErr != nil {
-		return u.producerError(ctx, fmt.Errorf("close audio file %q: %w", audioPath, closeErr))
-	}
-
-	if err := writer.WriteField("language", language); err != nil {
-		return u.producerError(ctx, fmt.Errorf("write language form field: %w", err))
-	}
-	if err := writer.Close(); err != nil {
-		return u.producerError(ctx, fmt.Errorf("close multipart writer: %w", err))
-	}
-	return nil
-}
-
-func (u *multipartUpload) producerError(ctx context.Context, err error) error {
-	if ctx.Err() != nil {
-		return ctx.Err()
-	}
-	u.mu.Lock()
-	aborted := u.aborted
-	u.mu.Unlock()
-	if aborted {
-		return nil
-	}
-	return err
-}
-
-func (u *multipartUpload) setAudio(audio io.Closer) {
-	u.mu.Lock()
-	u.audio = audio
-	aborted := u.aborted
-	u.mu.Unlock()
-	if aborted {
-		_ = audio.Close()
-	}
-}
-
-func (u *multipartUpload) clearAudio(audio io.Closer) {
-	u.mu.Lock()
-	if u.audio == audio {
-		u.audio = nil
-	}
-	u.mu.Unlock()
-}
-
-func (u *multipartUpload) abort() {
-	u.mu.Lock()
-	if u.aborted {
-		u.mu.Unlock()
-		return
-	}
-	u.aborted = true
-	audio := u.audio
-	u.mu.Unlock()
-
-	_ = u.reader.Close()
-	if audio != nil {
-		_ = audio.Close()
-	}
-}
-
-type contextReader struct {
-	ctx    context.Context
-	reader io.Reader
-}
-
-func (r *contextReader) Read(p []byte) (int, error) {
-	select {
-	case <-r.ctx.Done():
-		return 0, r.ctx.Err()
-	default:
-		return r.reader.Read(p)
-	}
-}
-
 func writeFileAtomic(path string, data []byte, perm os.FileMode) error {
 	if strings.TrimSpace(path) == "" {
 		return fmt.Errorf("path is required")

internal/adapters/whisperx/http_replay_test.go

@@ -0,0 +1,261 @@
+package whisperx
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestHTTPClientTransportReplaysAbandonedMultipartBody(t *testing.T) {
+	var opens atomic.Int32
+	var closes atomic.Int32
+	transport := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		partial := make([]byte, 17)
+		if _, err := io.ReadFull(request.Body, partial); err != nil {
+			return nil, err
+		}
+		if err := request.Body.Close(); err != nil {
+			return nil, err
+		}
+		if request.GetBody == nil {
+			return nil, errors.New("request GetBody is nil")
+		}
+		replay, err := request.GetBody()
+		if err != nil {
+			return nil, err
+		}
+		replayedBytes, err := io.ReadAll(replay)
+		if err != nil {
+			_ = replay.Close()
+			return nil, err
+		}
+		if err := replay.Close(); err != nil {
+			return nil, err
+		}
+		parts := parseMultipartParts(t, request.Header.Get("Content-Type"), replayedBytes)
+		if len(parts) != 2 || parts[0].name != "file" || parts[0].filename != "audio.flac" || string(parts[0].data) != "audio-data" {
+			t.Fatalf("replayed file part = %#v, want exact audio.flac payload", parts)
+		}
+		if parts[1].name != "language" || string(parts[1].data) != "en" {
+			t.Fatalf("replayed language part = %#v, want language=en", parts[1])
+		}
+		return whisperXJSONResponse(request), nil
+	})
+	client := newReplayTestHTTPClient(t, transport)
+	client.openAudio = func(string) (io.ReadCloser, error) {
+		opens.Add(1)
+		return &countedReadCloser{Reader: strings.NewReader("audio-data"), closes: &closes}, nil
+	}
+	outPath := filepath.Join(t.TempDir(), "raw.json")
+
+	result, err := client.Transcribe(context.Background(), TranscribeRequest{
+		AudioPath:               "audio.flac",
+		OutputRawTranscriptPath: outPath,
+	})
+	if err != nil {
+		t.Fatalf("Transcribe() error = %v", err)
+	}
+	if result.Attempts != 1 {
+		t.Fatalf("application attempts = %d, want 1", result.Attempts)
+	}
+	verifyJSONFile(t, outPath)
+	if got := opens.Load(); got != 2 {
+		t.Fatalf("audio opens = %d, want original and replay", got)
+	}
+	if got := closes.Load(); got != 2 {
+		t.Fatalf("audio closes = %d, want all body handles disposed", got)
+	}
+}
+
+func TestHTTPClientTransportReturnsReplayOpenFailure(t *testing.T) {
+	replayErr := errors.New("replay open failed")
+	var opens atomic.Int32
+	var closes atomic.Int32
+	transport := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		if _, err := io.ReadFull(request.Body, make([]byte, 1)); err != nil {
+			return nil, err
+		}
+		_ = request.Body.Close()
+		_, err := request.GetBody()
+		return nil, err
+	})
+	client := newReplayTestHTTPClient(t, transport)
+	client.openAudio = func(string) (io.ReadCloser, error) {
+		if opens.Add(1) == 2 {
+			return nil, replayErr
+		}
+		return &countedReadCloser{Reader: strings.NewReader("audio-data"), closes: &closes}, nil
+	}
+	outPath := filepath.Join(t.TempDir(), "raw.json")
+
+	result, err := client.Transcribe(context.Background(), TranscribeRequest{
+		AudioPath:               "audio.flac",
+		OutputRawTranscriptPath: outPath,
+	})
+	if !errors.Is(err, replayErr) {
+		t.Fatalf("Transcribe() error = %v, want replay open failure", err)
+	}
+	if result.Attempts != 1 {
+		t.Fatalf("application attempts = %d, want 1", result.Attempts)
+	}
+	if got := closes.Load(); got != 1 {
+		t.Fatalf("audio closes = %d, want original disposed", got)
+	}
+	if _, statErr := os.Stat(outPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("output should not exist, stat error = %v", statErr)
+	}
+}
+
+func TestHTTPClientTransportCannotSwallowReplayReadFailure(t *testing.T) {
+	replayErr := errors.New("replay read failed")
+	var opens atomic.Int32
+	transport := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		if _, err := io.ReadFull(request.Body, make([]byte, 1)); err != nil {
+			return nil, err
+		}
+		_ = request.Body.Close()
+		replay, err := request.GetBody()
+		if err != nil {
+			return nil, err
+		}
+		_, _ = io.ReadAll(replay)
+		_ = replay.Close()
+		return whisperXJSONResponse(request), nil
+	})
+	client := newReplayTestHTTPClient(t, transport)
+	client.openAudio = func(string) (io.ReadCloser, error) {
+		if opens.Add(1) == 2 {
+			return &failingReadCloser{first: []byte("partial"), err: replayErr}, nil
+		}
+		return io.NopCloser(strings.NewReader("audio-data")), nil
+	}
+	outPath := filepath.Join(t.TempDir(), "raw.json")
+
+	_, err := client.Transcribe(context.Background(), TranscribeRequest{
+		AudioPath:               "audio.flac",
+		OutputRawTranscriptPath: outPath,
+	})
+	if !errors.Is(err, replayErr) {
+		t.Fatalf("Transcribe() error = %v, want replay read failure", err)
+	}
+	if _, statErr := os.Stat(outPath); !errors.Is(statErr, os.ErrNotExist) {
+		t.Fatalf("output should not exist, stat error = %v", statErr)
+	}
+}
+
+func TestHTTPClientTransportEarlyResponseDisposesOriginalBody(t *testing.T) {
+	var closes atomic.Int32
+	client := newReplayTestHTTPClient(t, roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		return whisperXJSONResponse(request), nil
+	}))
+	client.openAudio = func(string) (io.ReadCloser, error) {
+		return &countedReadCloser{Reader: strings.NewReader("audio-data"), closes: &closes}, nil
+	}
+
+	_, err := client.Transcribe(context.Background(), TranscribeRequest{
+		AudioPath:               "audio.flac",
+		OutputRawTranscriptPath: filepath.Join(t.TempDir(), "raw.json"),
+	})
+	if err != nil {
+		t.Fatalf("Transcribe() error = %v", err)
+	}
+	if got := closes.Load(); got != 1 {
+		t.Fatalf("audio closes = %d, want early-response body disposed", got)
+	}
+}
+
+func TestHTTPClientParentCancellationDuringReplayClosesEveryBody(t *testing.T) {
+	var opens atomic.Int32
+	var originalCloses atomic.Int32
+	replaySource := newSignalingBlockedReadCloser()
+	transport := roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		if _, err := io.ReadFull(request.Body, make([]byte, 1)); err != nil {
+			return nil, err
+		}
+		_ = request.Body.Close()
+		replay, err := request.GetBody()
+		if err != nil {
+			return nil, err
+		}
+		_, _ = io.ReadAll(replay)
+		_ = replay.Close()
+		return nil, request.Context().Err()
+	})
+	client := newReplayTestHTTPClient(t, transport)
+	client.openAudio = func(string) (io.ReadCloser, error) {
+		if opens.Add(1) == 1 {
+			return &countedReadCloser{Reader: strings.NewReader("audio-data"), closes: &originalCloses}, nil
+		}
+		return replaySource, nil
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() {
+		_, err := client.Transcribe(ctx, TranscribeRequest{
+			AudioPath:               "audio.flac",
+			OutputRawTranscriptPath: filepath.Join(t.TempDir(), "raw.json"),
+		})
+		done <- err
+	}()
+
+	select {
+	case <-replaySource.blocked:
+		cancel()
+	case <-time.After(time.Second):
+		cancel()
+		t.Fatal("replay source did not block")
+	}
+	select {
+	case err := <-done:
+		if !errors.Is(err, context.Canceled) {
+			t.Fatalf("Transcribe() error = %v, want context cancellation", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("Transcribe() did not return after replay cancellation")
+	}
+	if got := originalCloses.Load(); got != 1 {
+		t.Fatalf("original audio closes = %d, want 1", got)
+	}
+	select {
+	case <-replaySource.closed:
+	case <-time.After(time.Second):
+		t.Fatal("replay audio source was not closed")
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (roundTrip roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
+	return roundTrip(request)
+}
+
+func newReplayTestHTTPClient(t *testing.T, transport http.RoundTripper) *HTTPClient {
+	t.Helper()
+	client, err := NewHTTPClient(HTTPClientConfig{
+		TranscribeURL: "http://whisperx.test/transcribe",
+		Language:      "en",
+		Timeout:       time.Second,
+		HTTPClient:    &http.Client{Transport: transport},
+	})
+	if err != nil {
+		t.Fatalf("NewHTTPClient() error = %v", err)
+	}
+	return client
+}
+
+func whisperXJSONResponse(request *http.Request) *http.Response {
+	return &http.Response{
+		StatusCode: http.StatusOK,
+		Status:     "200 OK",
+		Header:     make(http.Header),
+		Body:       io.NopCloser(strings.NewReader(`{"source":"transport-replay","segments":[]}`)),
+		Request:    request,
+	}
+}

internal/adapters/whisperx/http_test.go

@@ -365,7 +365,7 @@ func TestHTTPClientEarlyServerResponseReturns(t *testing.T) {
 	}
 }
 
-func TestHTTPClientCancellationReleasesBlockedProducer(t *testing.T) {
+func TestHTTPClientCancellationReleasesBlockedSource(t *testing.T) {
 	release := make(chan struct{})
 	source := newGatedReadCloser([]byte("audio-data"), release)
 	firstByteReceived := make(chan struct{})

internal/adapters/whisperx/multipart_body.go

@@ -0,0 +1,263 @@
+package whisperx
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"path/filepath"
+	"sync"
+)
+
+type multipartBodyFactory struct {
+	ctx         context.Context
+	audioPath   string
+	openAudio   func(string) (io.ReadCloser, error)
+	prefix      []byte
+	suffix      []byte
+	contentType string
+
+	mu     sync.Mutex
+	closed bool
+	bodies []*multipartBody
+}
+
+func newMultipartBodyFactory(
+	ctx context.Context,
+	audioPath string,
+	language string,
+	openAudio func(string) (io.ReadCloser, error),
+) (*multipartBodyFactory, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	if openAudio == nil {
+		return nil, fmt.Errorf("audio opener is required")
+	}
+	var framing bytes.Buffer
+	writer := multipart.NewWriter(&framing)
+	if _, err := writer.CreateFormFile("file", filepath.Base(audioPath)); err != nil {
+		return nil, fmt.Errorf("create multipart file field: %w", err)
+	}
+	prefixLength := framing.Len()
+	if err := writer.WriteField("language", language); err != nil {
+		return nil, fmt.Errorf("write language form field: %w", err)
+	}
+	if err := writer.Close(); err != nil {
+		return nil, fmt.Errorf("close multipart framing: %w", err)
+	}
+	framingBytes := framing.Bytes()
+	return &multipartBodyFactory{
+		ctx:         ctx,
+		audioPath:   audioPath,
+		openAudio:   openAudio,
+		prefix:      append([]byte(nil), framingBytes[:prefixLength]...),
+		suffix:      append([]byte(nil), framingBytes[prefixLength:]...),
+		contentType: writer.FormDataContentType(),
+	}, nil
+}
+
+func (factory *multipartBodyFactory) NewBody() (io.ReadCloser, error) {
+	factory.mu.Lock()
+	if factory.closed {
+		factory.mu.Unlock()
+		return nil, fmt.Errorf("multipart body factory is closed")
+	}
+	if err := factory.ctx.Err(); err != nil {
+		factory.mu.Unlock()
+		return nil, err
+	}
+	audio, err := factory.openAudio(factory.audioPath)
+	if err != nil {
+		factory.mu.Unlock()
+		return nil, fmt.Errorf("open audio file %q: %w", factory.audioPath, err)
+	}
+	if err := factory.ctx.Err(); err != nil {
+		factory.mu.Unlock()
+		_ = audio.Close()
+		return nil, err
+	}
+	source := &multipartAudioSource{audio: audio, closeDone: make(chan struct{})}
+	body := &multipartBody{
+		ctx:    factory.ctx,
+		source: source,
+		reader: io.MultiReader(bytes.NewReader(factory.prefix), source, bytes.NewReader(factory.suffix)),
+	}
+	factory.bodies = append(factory.bodies, body)
+	factory.mu.Unlock()
+	stopCancel := context.AfterFunc(factory.ctx, func() {
+		_ = body.Close()
+	})
+	body.mu.Lock()
+	body.stopCancel = stopCancel
+	closed := body.closed
+	body.mu.Unlock()
+	if closed {
+		stopCancel()
+	}
+	if err := factory.ctx.Err(); err != nil {
+		_ = body.Close()
+		return nil, err
+	}
+	return body, nil
+}
+
+func (factory *multipartBodyFactory) Close() error {
+	factory.mu.Lock()
+	if factory.closed {
+		bodies := append([]*multipartBody(nil), factory.bodies...)
+		factory.mu.Unlock()
+		return multipartBodyCloseErrors(bodies)
+	}
+	factory.closed = true
+	bodies := append([]*multipartBody(nil), factory.bodies...)
+	factory.mu.Unlock()
+	for _, body := range bodies {
+		_ = body.Close()
+	}
+	return multipartBodyCloseErrors(bodies)
+}
+
+func (factory *multipartBodyFactory) SourceError(includeAbandoned bool) error {
+	factory.mu.Lock()
+	bodies := append([]*multipartBody(nil), factory.bodies...)
+	factory.mu.Unlock()
+	var result error
+	for _, body := range bodies {
+		if err := body.sourceError(includeAbandoned); err != nil {
+			result = errors.Join(result, err)
+		}
+	}
+	return result
+}
+
+func multipartBodyCloseErrors(bodies []*multipartBody) error {
+	var result error
+	for _, body := range bodies {
+		if err := body.sourceError(false); err != nil {
+			result = errors.Join(result, err)
+		}
+	}
+	return result
+}
+
+type multipartBody struct {
+	ctx        context.Context
+	reader     io.Reader
+	source     *multipartAudioSource
+	stopCancel func() bool
+
+	mu        sync.Mutex
+	closed    bool
+	abandoned bool
+}
+
+func (body *multipartBody) Read(buffer []byte) (int, error) {
+	if err := body.ctx.Err(); err != nil {
+		return 0, err
+	}
+	body.mu.Lock()
+	closed := body.closed
+	body.mu.Unlock()
+	if closed {
+		return 0, io.ErrClosedPipe
+	}
+	return body.reader.Read(buffer)
+}
+
+func (body *multipartBody) Close() error {
+	body.mu.Lock()
+	if body.closed {
+		body.mu.Unlock()
+		return body.source.Close()
+	}
+	body.closed = true
+	body.abandoned = !body.source.reachedEOF()
+	stopCancel := body.stopCancel
+	body.mu.Unlock()
+	if stopCancel != nil {
+		stopCancel()
+	}
+	return body.source.Close()
+}
+
+func (body *multipartBody) sourceError(includeAbandoned bool) error {
+	body.mu.Lock()
+	abandoned := body.abandoned
+	body.mu.Unlock()
+	err := body.source.Err()
+	if err != nil {
+		return err
+	}
+	if abandoned && !includeAbandoned {
+		return nil
+	}
+	return nil
+}
+
+type multipartAudioSource struct {
+	audio io.ReadCloser
+
+	mu          sync.Mutex
+	closing     bool
+	eof         bool
+	readErr     error
+	closeErr    error
+	closeDone   chan struct{}
+	closeResult error
+	closed      bool
+}
+
+func (source *multipartAudioSource) Read(buffer []byte) (int, error) {
+	n, err := source.audio.Read(buffer)
+	source.mu.Lock()
+	switch {
+	case errors.Is(err, io.EOF):
+		source.eof = true
+	case err != nil && !source.closing:
+		source.readErr = errors.Join(source.readErr, err)
+	}
+	source.mu.Unlock()
+	return n, err
+}
+
+func (source *multipartAudioSource) Close() error {
+	source.mu.Lock()
+	if source.closed {
+		done := source.closeDone
+		source.mu.Unlock()
+		<-done
+		source.mu.Lock()
+		err := source.closeResult
+		source.mu.Unlock()
+		return err
+	}
+	source.closed = true
+	source.closing = true
+	reachedEOF := source.eof
+	source.mu.Unlock()
+
+	err := source.audio.Close()
+	source.mu.Lock()
+	source.closeResult = err
+	if err != nil && reachedEOF {
+		source.closeErr = err
+	}
+	close(source.closeDone)
+	source.mu.Unlock()
+	return err
+}
+
+func (source *multipartAudioSource) reachedEOF() bool {
+	source.mu.Lock()
+	defer source.mu.Unlock()
+	return source.eof
+}
+
+func (source *multipartAudioSource) Err() error {
+	source.mu.Lock()
+	defer source.mu.Unlock()
+	return errors.Join(source.readErr, source.closeErr)
+}

internal/adapters/whisperx/multipart_body_test.go

@@ -0,0 +1,327 @@
+package whisperx
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"mime"
+	"mime/multipart"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestMultipartBodyReplayUsesIdenticalFraming(t *testing.T) {
+	factory := newTestMultipartBodyFactory(t, context.Background(), "audio-data")
+	defer factory.Close()
+
+	original, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() original error = %v", err)
+	}
+	replay, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() replay error = %v", err)
+	}
+	originalBytes, err := io.ReadAll(original)
+	if err != nil {
+		t.Fatalf("ReadAll(original) error = %v", err)
+	}
+	replayBytes, err := io.ReadAll(replay)
+	if err != nil {
+		t.Fatalf("ReadAll(replay) error = %v", err)
+	}
+	if !bytes.Equal(originalBytes, replayBytes) {
+		t.Fatal("original and replay multipart bytes differ")
+	}
+
+	parts := parseMultipartParts(t, factory.contentType, replayBytes)
+	if len(parts) != 2 {
+		t.Fatalf("part count = %d, want 2", len(parts))
+	}
+	if parts[0].name != "file" || parts[0].filename != "audio.flac" || string(parts[0].data) != "audio-data" {
+		t.Fatalf("file part = %#v, want file/audio.flac with exact audio", parts[0])
+	}
+	if parts[1].name != "language" || string(parts[1].data) != "en" {
+		t.Fatalf("language part = %#v, want language=en", parts[1])
+	}
+}
+
+func TestMultipartBodyReplayRestartsAfterPartialOriginal(t *testing.T) {
+	factory := newTestMultipartBodyFactory(t, context.Background(), "audio-data")
+	defer factory.Close()
+
+	original, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() original error = %v", err)
+	}
+	partial := make([]byte, len(factory.prefix)+3)
+	if _, err := io.ReadFull(original, partial); err != nil {
+		t.Fatalf("ReadFull(original) error = %v", err)
+	}
+	if err := original.Close(); err != nil {
+		t.Fatalf("Close(original) error = %v", err)
+	}
+
+	replay, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() replay error = %v", err)
+	}
+	replayBytes, err := io.ReadAll(replay)
+	if err != nil {
+		t.Fatalf("ReadAll(replay) error = %v", err)
+	}
+	parts := parseMultipartParts(t, factory.contentType, replayBytes)
+	if got := string(parts[0].data); got != "audio-data" {
+		t.Fatalf("replayed audio = %q, want complete payload", got)
+	}
+	if err := factory.SourceError(false); err != nil {
+		t.Fatalf("SourceError(false) = %v, want abandoned original ignored", err)
+	}
+}
+
+func TestMultipartBodySimultaneousBodiesUseIndependentSources(t *testing.T) {
+	var opens atomic.Int32
+	var closes atomic.Int32
+	factory, err := newMultipartBodyFactory(context.Background(), "audio.flac", "en", func(string) (io.ReadCloser, error) {
+		opens.Add(1)
+		return &countedReadCloser{Reader: strings.NewReader("audio-data"), closes: &closes}, nil
+	})
+	if err != nil {
+		t.Fatalf("newMultipartBodyFactory() error = %v", err)
+	}
+
+	first, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() first error = %v", err)
+	}
+	second, err := factory.NewBody()
+	if err != nil {
+		t.Fatalf("NewBody() second error = %v", err)
+	}
+	var firstBytes, secondBytes []byte
+	var firstErr, secondErr error
+	var group sync.WaitGroup
+	group.Add(2)
+	go func() {
+		defer group.Done()
+		firstBytes, firstErr = io.ReadAll(first)
+	}()
+	go func() {
+		defer group.Done()
+		secondBytes, secondErr = io.ReadAll(second)
+	}()
+	group.Wait()
+	if firstErr != nil || secondErr != nil {
+		t.Fatalf("concurrent reads returned (%v, %v)", firstErr, secondErr)
+	}
+	if !bytes.Equal(firstBytes, secondBytes) {
+		t.Fatal("independent body bytes differ")
+	}
+	if got := opens.Load(); got != 2 {
+		t.Fatalf("audio opens = %d, want 2", got)
+	}
+	if err := factory.Close(); err != nil {
+		t.Fatalf("Close() error = %v", err)
+	}
+	if err := factory.Close(); err != nil {
+		t.Fatalf("second Close() error = %v", err)
+	}
+	if got := closes.Load(); got != 2 {
+		t.Fatalf("audio closes = %d, want 2", got)
+	}
+}
+
+func TestMultipartBodyReportsSourceFailures(t *testing.T) {
+	t.Run("read", func(t *testing.T) {
+		sourceErr := errors.New("read source")
+		factory, err := newMultipartBodyFactory(context.Background(), "audio.flac", "en", func(string) (io.ReadCloser, error) {
+			return &failingReadCloser{first: []byte("partial"), err: sourceErr}, nil
+		})
+		if err != nil {
+			t.Fatalf("newMultipartBodyFactory() error = %v", err)
+		}
+		body, err := factory.NewBody()
+		if err != nil {
+			t.Fatalf("NewBody() error = %v", err)
+		}
+		if _, err := io.ReadAll(body); !errors.Is(err, sourceErr) {
+			t.Fatalf("ReadAll() error = %v, want source failure", err)
+		}
+		_ = body.Close()
+		if err := factory.SourceError(false); !errors.Is(err, sourceErr) {
+			t.Fatalf("SourceError(false) = %v, want source failure", err)
+		}
+	})
+
+	t.Run("close after complete read", func(t *testing.T) {
+		closeErr := errors.New("close source")
+		factory, err := newMultipartBodyFactory(context.Background(), "audio.flac", "en", func(string) (io.ReadCloser, error) {
+			return &errorCloseReadCloser{Reader: strings.NewReader("audio-data"), err: closeErr}, nil
+		})
+		if err != nil {
+			t.Fatalf("newMultipartBodyFactory() error = %v", err)
+		}
+		body, err := factory.NewBody()
+		if err != nil {
+			t.Fatalf("NewBody() error = %v", err)
+		}
+		if _, err := io.ReadAll(body); err != nil {
+			t.Fatalf("ReadAll() error = %v", err)
+		}
+		if err := body.Close(); !errors.Is(err, closeErr) {
+			t.Fatalf("Close() error = %v, want source close failure", err)
+		}
+		if err := factory.SourceError(false); !errors.Is(err, closeErr) {
+			t.Fatalf("SourceError(false) = %v, want source close failure", err)
+		}
+	})
+}
+
+func TestMultipartBodyCloseAndCancelReleaseBlockedSource(t *testing.T) {
+	for _, test := range []struct {
+		name    string
+		release func(context.CancelFunc, io.ReadCloser)
+	}{
+		{name: "close", release: func(_ context.CancelFunc, body io.ReadCloser) { _ = body.Close() }},
+		{name: "cancel", release: func(cancel context.CancelFunc, _ io.ReadCloser) { cancel() }},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			source := newSignalingBlockedReadCloser()
+			factory, err := newMultipartBodyFactory(ctx, "audio.flac", "en", func(string) (io.ReadCloser, error) {
+				return source, nil
+			})
+			if err != nil {
+				t.Fatalf("newMultipartBodyFactory() error = %v", err)
+			}
+			defer factory.Close()
+			body, err := factory.NewBody()
+			if err != nil {
+				t.Fatalf("NewBody() error = %v", err)
+			}
+			readDone := make(chan error, 1)
+			go func() {
+				_, err := io.ReadAll(body)
+				readDone <- err
+			}()
+			select {
+			case <-source.blocked:
+			case <-time.After(time.Second):
+				t.Fatal("audio source did not block")
+			}
+			test.release(cancel, body)
+			select {
+			case <-source.closed:
+			case <-time.After(time.Second):
+				t.Fatal("audio source was not closed")
+			}
+			select {
+			case <-readDone:
+			case <-time.After(time.Second):
+				t.Fatal("blocked body read did not return")
+			}
+			if test.name == "cancel" {
+				if _, err := factory.NewBody(); !errors.Is(err, context.Canceled) {
+					t.Fatalf("NewBody() after cancellation error = %v, want context.Canceled", err)
+				}
+			}
+		})
+	}
+}
+
+func newTestMultipartBodyFactory(t *testing.T, ctx context.Context, audio string) *multipartBodyFactory {
+	t.Helper()
+	factory, err := newMultipartBodyFactory(ctx, "audio.flac", "en", func(string) (io.ReadCloser, error) {
+		return io.NopCloser(strings.NewReader(audio)), nil
+	})
+	if err != nil {
+		t.Fatalf("newMultipartBodyFactory() error = %v", err)
+	}
+	return factory
+}
+
+type multipartTestPart struct {
+	name     string
+	filename string
+	data     []byte
+}
+
+func parseMultipartParts(t *testing.T, contentType string, body []byte) []multipartTestPart {
+	t.Helper()
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if err != nil {
+		t.Fatalf("ParseMediaType() error = %v", err)
+	}
+	if mediaType != "multipart/form-data" {
+		t.Fatalf("media type = %q, want multipart/form-data", mediaType)
+	}
+	reader := multipart.NewReader(bytes.NewReader(body), params["boundary"])
+	var parts []multipartTestPart
+	for {
+		part, err := reader.NextPart()
+		if errors.Is(err, io.EOF) {
+			return parts
+		}
+		if err != nil {
+			t.Fatalf("NextPart() error = %v", err)
+		}
+		data, err := io.ReadAll(part)
+		if err != nil {
+			t.Fatalf("ReadAll(part %q) error = %v", part.FormName(), err)
+		}
+		parts = append(parts, multipartTestPart{name: part.FormName(), filename: part.FileName(), data: data})
+	}
+}
+
+type countedReadCloser struct {
+	io.Reader
+	closes *atomic.Int32
+	once   sync.Once
+}
+
+func (reader *countedReadCloser) Close() error {
+	reader.once.Do(func() { reader.closes.Add(1) })
+	return nil
+}
+
+type errorCloseReadCloser struct {
+	io.Reader
+	err error
+}
+
+func (reader *errorCloseReadCloser) Close() error { return reader.err }
+
+type signalingBlockedReadCloser struct {
+	blocked chan struct{}
+	closed  chan struct{}
+	once    sync.Once
+	read    bool
+}
+
+func newSignalingBlockedReadCloser() *signalingBlockedReadCloser {
+	return &signalingBlockedReadCloser{blocked: make(chan struct{}), closed: make(chan struct{})}
+}
+
+func (reader *signalingBlockedReadCloser) Read(buffer []byte) (int, error) {
+	if !reader.read {
+		reader.read = true
+		return copy(buffer, "audio-data"), nil
+	}
+	reader.once.Do(func() { close(reader.blocked) })
+	<-reader.closed
+	return 0, errors.New("audio source closed")
+}
+
+func (reader *signalingBlockedReadCloser) Close() error {
+	select {
+	case <-reader.closed:
+	default:
+		close(reader.closed)
+	}
+	return nil
+}

internal/app/analyze_artifacts_commands_test.go

@@ -272,13 +272,18 @@ func TestExecuteAnalyzeRejectsPositionalArgsAndForceFlag(t *testing.T) {
 }
 
 func TestExecuteAnalyzeMissingConfigUsesRunStageLoadingPath(t *testing.T) {
+	deps, missingPath, executor := guardedMissingPipelineDiscovery(t)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"analyze", "2026-05-03"}, &stdout, &stderr)
+	code := executeWithDependencies([]string{"analyze", "2026-05-03"}, &stdout, &stderr, deps, executor)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), "analyze: no pipeline config path provided and no default pipeline config found; searched:") {
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty", stdout.String())
+	}
+	if got := stderr.String(); !strings.Contains(got, "analyze: no pipeline config path provided") ||
+		!strings.Contains(got, "no default pipeline config found") || !strings.Contains(got, missingPath) {
 		t.Fatalf("stderr = %q, want pipeline discovery error", stderr.String())
 	}
 }
@@ -371,13 +376,18 @@ func TestExecutePublishUnknownArtifactFailsValidation(t *testing.T) {
 }
 
 func TestExecutePublishMissingConfigUsesRunStageLoadingPath(t *testing.T) {
+	deps, missingPath, executor := guardedMissingPipelineDiscovery(t)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"publish", "2026-05-03"}, &stdout, &stderr)
+	code := executeWithDependencies([]string{"publish", "2026-05-03"}, &stdout, &stderr, deps, executor)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), "publish: no pipeline config path provided and no default pipeline config found; searched:") {
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty", stdout.String())
+	}
+	if got := stderr.String(); !strings.Contains(got, "publish: no pipeline config path provided") ||
+		!strings.Contains(got, "no default pipeline config found") || !strings.Contains(got, missingPath) {
 		t.Fatalf("stderr = %q, want pipeline discovery error", stderr.String())
 	}
 }

internal/app/assembled_workflow_test.go

@@ -256,12 +256,12 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath}, &validated); err != nil {
 		t.Fatalf("validate production base: %v", err)
 	}
-	if !strings.Contains(validated.String(), "profile=none") {
-		t.Fatalf("validate output = %q, want unprofiled production base", validated.String())
+	if !strings.Contains(validated.String(), "overlay=none") {
+		t.Fatalf("validate output = %q, want production base", validated.String())
 	}
 	for _, command := range []func(context.Context, []string, io.Writer) error{ConfigShow, ConfigSources} {
 		if err := command(context.Background(), []string{
-			"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing",
+			"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing",
 		}, io.Discard); err != nil {
 			t.Fatalf("testing inspection command %T: %v", command, err)
 		}
@@ -272,19 +272,19 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	}, &diff); err != nil {
 		t.Fatalf("compare profiles: %v", err)
 	}
-	if !strings.Contains(diff.String(), "audita.model") || !strings.Contains(diff.String(), "character_items_arannis.profile_id") {
-		t.Fatalf("profile diff = %q, want model and expanded family changes", diff.String())
+	if !strings.Contains(diff.String(), "audita.proposal_profile") || !strings.Contains(diff.String(), "character_items_arannis.profile_id") {
+		t.Fatalf("profile diff = %q, want proposal profile and expanded family changes", diff.String())
 	}
 
 	common := []string{
 		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath,
-		"--session", sessionPath, "--profile", "testing",
+		"--session", sessionPath, "--overlay", "testing",
 	}
 	var planned bytes.Buffer
 	if err := Plan(context.Background(), common, &planned); err != nil {
 		t.Fatalf("plan testing bundle: %v", err)
 	}
-	if !strings.Contains(planned.String(), "profile=testing") {
+	if !strings.Contains(planned.String(), "overlay=testing") {
 		t.Fatalf("plan output = %q, want testing provenance", planned.String())
 	}
 
@@ -305,7 +305,7 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	if !reflect.DeepEqual(capturedPlan.Names(), []string{"analyze"}) {
 		t.Fatalf("bounded plan = %#v, want analyze only", capturedPlan.Names())
 	}
-	if profile, ok := config.SelectedPipelineProfile(capturedCfg.Pipeline); !ok || profile.Name != "testing" {
+	if profile, ok := config.SelectedPipelineOverlay(capturedCfg.Pipeline); !ok || profile.Name != "testing" {
 		t.Fatalf("captured profile = %#v, selected=%t", profile, ok)
 	}
 	if digest := config.EffectivePipelineDigest(capturedCfg.Pipeline); digest == "" || !strings.Contains(runOut.String(), "digest="+digest) {
@@ -391,7 +391,7 @@ func loadAssembledSplitBundleConfig(t *testing.T, profile string) *config.Config
 	pipelinePath, campaignPath, sessionPath := assembledSplitBundlePaths()
 	options := config.SessionLoadOptions{}
 	if profile != "" {
-		options.Profile = &profile
+		options.Overlay = &profile
 	}
 	cfg, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, options)
 	if err != nil {
@@ -415,8 +415,8 @@ func assertAssembledProvenance(t *testing.T, store *manifest.LocalStore, summary
 		t.Fatal(err)
 	}
 	value := session.EffectiveConfig
-	profileMatches := value != nil && ((profile == "" && value.SelectedProfile == nil) ||
-		(profile != "" && value.SelectedProfile != nil && value.SelectedProfile.Name == profile))
+	profileMatches := value != nil && ((profile == "" && value.SelectedOverlay == nil) ||
+		(profile != "" && value.SelectedOverlay != nil && value.SelectedOverlay.Name == profile))
 	if !profileMatches || value.EffectiveConfigDigest != digest {
 		t.Fatalf("effective configuration provenance = %#v, want profile=%q digest=%q", value, profile, digest)
 	}

internal/app/bounded_run_test.go

@@ -57,7 +57,7 @@ func TestBoundedRunParsingRejectsDuplicateSingletons(t *testing.T) {
 		{name: "through mixed", args: []string{"session", "--through", "analyze", "--through=publish"}, want: "--through may be specified only once"},
 		{name: "force separate", args: []string{"session", "--force", "--force"}, want: "--force may be specified only once"},
 		{name: "force equals", args: []string{"session", "--force=true", "--force=false"}, want: "--force may be specified only once"},
-		{name: "profile", args: []string{"session", "--profile", "production", "--profile=testing"}, want: "--profile may be specified only once"},
+		{name: "overlay", args: []string{"session", "--overlay", "production", "--overlay=testing"}, want: "--overlay may be specified only once"},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -69,29 +69,29 @@ func TestBoundedRunParsingRejectsDuplicateSingletons(t *testing.T) {
 	}
 }
 
-func TestBoundedRunParsingRetainsExplicitProfilePresence(t *testing.T) {
-	withoutProfile, err := parseBoundedRunRequest("run", []string{"session"}, io.Discard)
+func TestBoundedRunParsingRetainsExplicitOverlayPresence(t *testing.T) {
+	withoutOverlay, err := parseBoundedRunRequest("run", []string{"session"}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := withoutProfile.Config.sessionOptions().Profile; got != nil {
-		t.Fatalf("omitted profile = %#v, want nil", got)
+	if got := withoutOverlay.Config.sessionOptions().Overlay; got != nil {
+		t.Fatalf("omitted overlay = %#v, want nil", got)
 	}
 
-	withProfile, err := parseBoundedRunRequest("run", []string{"session", "--profile", "testing"}, io.Discard)
+	withOverlay, err := parseBoundedRunRequest("run", []string{"session", "--overlay", "testing"}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := withProfile.Config.sessionOptions().Profile; got == nil || *got != "testing" {
-		t.Fatalf("explicit profile = %#v, want testing", got)
+	if got := withOverlay.Config.sessionOptions().Overlay; got == nil || *got != "testing" {
+		t.Fatalf("explicit overlay = %#v, want testing", got)
 	}
 
-	explicitEmpty, err := parseBoundedRunRequest("run", []string{"session", "--profile", ""}, io.Discard)
+	explicitEmpty, err := parseBoundedRunRequest("run", []string{"session", "--overlay", ""}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := explicitEmpty.Config.sessionOptions().Profile; got == nil || *got != "" {
-		t.Fatalf("explicit empty profile = %#v, want non-nil empty", got)
+	if got := explicitEmpty.Config.sessionOptions().Overlay; got == nil || *got != "" {
+		t.Fatalf("explicit empty overlay = %#v, want non-nil empty", got)
 	}
 }
 

internal/app/clean.go

@@ -93,7 +93,7 @@ func cleanAllLocalWithDependencies(flags commonConfigFlags, dryRun, clearCache b
 		strings.TrimSpace(flags.previousSessionID) != "" {
 		return fmt.Errorf("clean: --all cannot be combined with --campaign, --campaign-file, --session, a session_id, or --previous-session-id")
 	}
-	_, pipelineCfg, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Profile: flags.profile.pointer()}, flags.secretsDir.pointer(), deps)
+	_, pipelineCfg, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Overlay: flags.overlay.pointer()}, flags.secretsDir.pointer(), deps)
 	if err != nil {
 		return fmt.Errorf("clean: %w", err)
 	}

internal/app/command_dependencies.go

@@ -11,6 +11,7 @@ import (
 
 type commandDependencies struct {
 	diagnostics                io.Writer
+	resolvePipelineConfigPath  func(string) (string, error)
 	loadPipelineConfig         func(string, config.PipelineLoadOptions) (*config.PipelineConfig, error)
 	downloadObjectToTemp       func(context.Context, storage.ObjectStore, string, string) (string, error)
 	loadSecretsDir             func(string) (*configkit.SecretsReport, error)
@@ -25,6 +26,9 @@ func normalizeCommandDependencies(deps commandDependencies) commandDependencies
 	if deps.diagnostics == nil {
 		deps.diagnostics = io.Discard
 	}
+	if deps.resolvePipelineConfigPath == nil {
+		deps.resolvePipelineConfigPath = resolvePipelineConfigPath
+	}
 	if deps.loadPipelineConfig == nil {
 		deps.loadPipelineConfig = config.LoadPipelineWithOptions
 	}

internal/app/commands_test.go

@@ -59,9 +59,10 @@ func TestExecuteValidCommands(t *testing.T) {
 
 func TestExecuteMissingRequiredFlags(t *testing.T) {
 	cases := []struct {
-		name string
-		args []string
-		want string
+		name                string
+		args                []string
+		want                string
+		controlledDiscovery bool
 	}{
 		{name: "run missing session", args: []string{"run"}, want: "run: session_id is required"},
 		{name: "plan old top-level removed", args: []string{"plan"}, want: `unknown command: "plan"`},
@@ -69,7 +70,7 @@ func TestExecuteMissingRequiredFlags(t *testing.T) {
 		{name: "resume removed", args: []string{"resume"}, want: `unknown command: "resume"`},
 		{name: "run-stage missing name", args: []string{"run-stage", "--config", "a", "--session", "b"}, want: "run-stage: expected stage name and session_id"},
 		{name: "run-stage missing session", args: []string{"run-stage", "polish"}, want: "run-stage: expected stage name and session_id"},
-		{name: "run missing config uses defaults", args: []string{"run", "2026-05-03", "--session", "session.yml"}, want: "run: no pipeline config path provided and no default pipeline config found; searched:"},
+		{name: "run missing config uses defaults", args: []string{"run", "2026-05-03", "--session", "session.yml"}, want: "run: no pipeline config path provided", controlledDiscovery: true},
 	}
 
 	for _, tc := range cases {
@@ -77,7 +78,13 @@ func TestExecuteMissingRequiredFlags(t *testing.T) {
 			var stdout bytes.Buffer
 			var stderr bytes.Buffer
 
-			code := Execute(tc.args, &stdout, &stderr)
+			deps := commandDependencies{}
+			executor := pipelineExecutor(executePlan)
+			missingPath := ""
+			if tc.controlledDiscovery {
+				deps, missingPath, executor = guardedMissingPipelineDiscovery(t)
+			}
+			code := executeWithDependencies(tc.args, &stdout, &stderr, deps, executor)
 			if code == 0 {
 				t.Fatalf("exit code = 0, want non-zero")
 			}
@@ -87,6 +94,11 @@ func TestExecuteMissingRequiredFlags(t *testing.T) {
 			if !strings.Contains(stderr.String(), tc.want) {
 				t.Fatalf("stderr = %q, want to contain %q", stderr.String(), tc.want)
 			}
+			if tc.controlledDiscovery {
+				if got := stderr.String(); !strings.Contains(got, "no default pipeline config found") || !strings.Contains(got, missingPath) {
+					t.Fatalf("stderr = %q, want controlled searched path %q", got, missingPath)
+				}
+			}
 		})
 	}
 }
@@ -217,7 +229,7 @@ seriatim:
   binary: ` + seriatimBinary + `
 audita:
   binary: ` + auditaBinary + `
-  llm_api_key: OPENROUTER_API_KEY
+  credentials: [OPENROUTER_API_KEY]
 notification:
   mode: noop
 `
@@ -262,6 +274,28 @@ inputs:
 	if !strings.Contains(stdout.String(), "stage=polish executed=1 skipped=0") {
 		t.Fatalf("stdout = %q, want polish execution", stdout.String())
 	}
+	recorded, err := (&manifest.LocalStore{}).Load(context.Background(), filepath.Join(workRoot, "manifest.json"))
+	if err != nil {
+		t.Fatalf("load polished manifest: %v", err)
+	}
+	polish := recorded.Stages["polish"]
+	if polish == nil || len(polish.Outputs) != 1 || polish.Outputs[0].Kind != "transcript_polished" {
+		t.Fatalf("polish outputs = %#v, want only canonical transcript", polish)
+	}
+	if len(polish.Logs) != 5 || len(polish.GeneratedConfigs) != 1 {
+		t.Fatalf("polish diagnostics = %#v, want logs, reports, and invocation", polish)
+	}
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		found := false
+		for _, path := range polish.Logs {
+			if filepath.Base(path) == name {
+				found = true
+			}
+		}
+		if !found {
+			t.Fatalf("report %q absent from manifest diagnostics: %#v", name, polish.Logs)
+		}
+	}
 	foundReference := false
 	if err := filepath.WalkDir(workRoot, func(path string, entry os.DirEntry, walkErr error) error {
 		if walkErr != nil || entry.IsDir() {
@@ -766,10 +800,18 @@ func TestAuditaAppHelper(t *testing.T) {
 		os.Exit(2)
 	}
 	processArgs := args[start:]
+	if len(processArgs) < 2 || processArgs[0] != "process" {
+		_, _ = os.Stderr.WriteString("expected Audita v2 process invocation\n")
+		os.Exit(2)
+	}
+	for _, arg := range processArgs {
+		if arg == "--report-json" || arg == "--work-dir" || arg == "--debug" || arg == "--reporting=false" {
+			_, _ = os.Stderr.WriteString("retired or unwanted Audita flag\n")
+			os.Exit(2)
+		}
+	}
 
 	outputPath := appSeriatimFlagValue(processArgs, "--output")
-	reportPath := appSeriatimFlagValue(processArgs, "--report-json")
-	workDir := appSeriatimFlagValue(processArgs, "--work-dir")
 	if strings.TrimSpace(outputPath) == "" {
 		_, _ = os.Stderr.WriteString("missing --output\n")
 		os.Exit(2)
@@ -782,19 +824,9 @@ func TestAuditaAppHelper(t *testing.T) {
 		_, _ = os.Stderr.WriteString(fmt.Sprintf("write output: %v\n", err))
 		os.Exit(2)
 	}
-	if strings.TrimSpace(reportPath) != "" {
-		if err := os.MkdirAll(filepath.Dir(reportPath), 0o755); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("mkdir report dir: %v\n", err))
-			os.Exit(2)
-		}
-		if err := os.WriteFile(reportPath, []byte(`{"report":true}`), 0o644); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("write report: %v\n", err))
-			os.Exit(2)
-		}
-	}
-	if strings.TrimSpace(workDir) != "" {
-		if err := os.MkdirAll(workDir, 0o755); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("mkdir work dir: %v\n", err))
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		if err := os.WriteFile(filepath.Join(filepath.Dir(outputPath), name), []byte("status: completed\n"), 0o644); err != nil {
+			_, _ = os.Stderr.WriteString(fmt.Sprintf("write %s: %v\n", name, err))
 			os.Exit(2)
 		}
 	}

internal/app/config_artifacts_test.go

@@ -80,22 +80,22 @@ func TestConfigArtifactsReportsGeneratedFamilyProvenance(t *testing.T) {
 	}
 }
 
-func TestConfigArtifactsReportsProfiledFamilyContributors(t *testing.T) {
+func TestConfigArtifactsReportsOverlayFamilyContributors(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	profilePath := filepath.Join(filepath.Dir(pipelinePath), "profiles", "testing.yml")
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	overlayPath := filepath.Join(filepath.Dir(pipelinePath), "overlays", "testing.yml")
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifact_families:
     character_note:
       prompt_id: dnd.character_note.testing
 `)
 
-	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}
+	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}
 	var catalog bytes.Buffer
 	if err := ConfigArtifacts(context.Background(), args, &catalog); err != nil {
 		t.Fatal(err)
 	}
 	records := catalogRecordsByKey(t, catalog.String())
-	if got := strings.Split(records["character_note_arannis"][2], ","); !reflect.DeepEqual(got, []string{pipelinePath, profilePath}) {
+	if got := strings.Split(records["character_note_arannis"][2], ","); !reflect.DeepEqual(got, []string{overlayPath, pipelinePath}) {
 		t.Fatalf("generated family definitions = %#v", got)
 	}
 
@@ -103,16 +103,16 @@ func TestConfigArtifactsReportsProfiledFamilyContributors(t *testing.T) {
 	if err := ConfigSources(context.Background(), args, &sources); err != nil {
 		t.Fatal(err)
 	}
-	want := "scriptorium.artifacts.character_note_arannis.prompt_id\tfamily\t" + profilePath
+	want := "scriptorium.artifacts.character_note_arannis.prompt_id\tfamily\t" + overlayPath
 	if !strings.Contains(sources.String(), want) {
-		t.Fatalf("sources output missing profiled family contributor %q:\n%s", want, sources.String())
+		t.Fatalf("sources output missing overlay family contributor %q:\n%s", want, sources.String())
 	}
 }
 
-func TestConfigArtifactsReportsBaseAndProfileContributors(t *testing.T) {
+func TestConfigArtifactsReportsBaseAndOverlayContributors(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, pipelinePath, `workspace:
   root: /srv/narratio
 whisperx:
@@ -124,26 +124,26 @@ scriptorium:
       enabled: false
       output_path: artifacts/notes.md
 `)
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifacts:
     notes:
       enabled: true
       prompt_id: notes
-    profile_only:
+    overlay_only:
       enabled: false
-      output_path: artifacts/profile-only.md
+      output_path: artifacts/overlay-only.md
 `)
 
 	var out bytes.Buffer
-	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatal(err)
 	}
 	records := catalogRecordsByKey(t, out.String())
-	if got := strings.Split(records["notes"][2], ","); !reflect.DeepEqual(got, []string{pipelinePath, profilePath}) {
+	if got := strings.Split(records["notes"][2], ","); !reflect.DeepEqual(got, []string{overlayPath, pipelinePath}) {
 		t.Fatalf("notes definitions = %#v", got)
 	}
-	if got := records["profile_only"][2]; got != profilePath {
-		t.Fatalf("profile-only definition = %q, want %q", got, profilePath)
+	if got := records["overlay_only"][2]; got != overlayPath {
+		t.Fatalf("overlay-only definition = %q, want %q", got, overlayPath)
 	}
 }
 

internal/app/config_commands.go

@@ -17,7 +17,7 @@ type inspectionFlags struct {
 	pipelinePath     string
 	campaignPath     string
 	campaignFilePath string
-	profile          singletonStringFlag
+	overlay          singletonStringFlag
 	secretsDir       singletonStringFlag
 }
 
@@ -77,8 +77,8 @@ func configValidateWithDependencies(_ context.Context, args []string, out io.Wri
 	if err != nil {
 		return fmt.Errorf("config validate: %w", err)
 	}
-	_, err = fmt.Fprintf(out, "Configuration valid: root=%s; profile=%s; digest=%s\n",
-		inspectionRootPath(resolved), inspectionProfile(resolved.Pipeline), config.EffectivePipelineDigest(resolved.Pipeline))
+	_, err = fmt.Fprintf(out, "Configuration valid: root=%s; overlay=%s; digest=%s\n",
+		inspectionRootPath(resolved), inspectionOverlay(resolved.Pipeline), config.EffectivePipelineDigest(resolved.Pipeline))
 	return err
 }
 
@@ -214,12 +214,12 @@ func parseInspectionFlags(command string, args []string, out io.Writer) (inspect
 	fs.StringVar(&flags.pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
 	fs.StringVar(&flags.campaignPath, "campaign", "", "campaign ID")
 	fs.StringVar(&flags.campaignFilePath, "campaign-file", "", "path to campaign.yml")
-	flags.profile.name = "profile"
-	fs.Var(&flags.profile, "profile", "named pipeline profile")
+	flags.overlay.name = "overlay"
+	fs.Var(&flags.overlay, "overlay", "named pipeline overlay")
 	flags.secretsDir.name = "secrets-dir"
 	fs.Var(&flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.Usage = func() {
-		fmt.Fprintf(out, "Usage: narratio %s [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <path>]\n\n", command)
+		fmt.Fprintf(out, "Usage: narratio %s [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <path>]\n\n", command)
 		fmt.Fprintln(out, "Resolves configuration without a session, workspace, manifest, adapters, or external services.")
 		fmt.Fprintln(out)
 		fmt.Fprintln(out, "Flags:")
@@ -238,7 +238,7 @@ func parseInspectionFlags(command string, args []string, out io.Writer) (inspect
 }
 
 func resolveInspectionConfigWithDependencies(flags inspectionFlags, deps commandDependencies) (*inspectionConfig, error) {
-	pipelinePath, pipeline, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Profile: flags.profile.pointer()}, flags.secretsDir.pointer(), deps)
+	pipelinePath, pipeline, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Overlay: flags.overlay.pointer()}, flags.secretsDir.pointer(), deps)
 	if err != nil {
 		return nil, err
 	}
@@ -315,9 +315,9 @@ func inspectionRootPath(resolved *inspectionConfig) string {
 	return resolved.PipelinePath
 }
 
-func inspectionProfile(pipeline *config.PipelineConfig) string {
-	if profile, ok := config.SelectedPipelineProfile(pipeline); ok {
-		return profile.Name
+func inspectionOverlay(pipeline *config.PipelineConfig) string {
+	if overlay, ok := config.SelectedPipelineOverlay(pipeline); ok {
+		return overlay.Name
 	}
 	return "none"
 }
@@ -325,7 +325,7 @@ func inspectionProfile(pipeline *config.PipelineConfig) string {
 func writeConfigCommandUsage(out io.Writer) {
 	fmt.Fprintln(out, "Usage: narratio config <validate|show|sources|artifacts|diff>")
 	fmt.Fprintln(out)
-	fmt.Fprintln(out, "Use config validate to check an effective pipeline, config show to print normalized YAML, config sources to report ownership, config artifacts to list concrete artifacts, or config diff to compare two profiles.")
+	fmt.Fprintln(out, "Use config validate to check an effective pipeline, config show to print normalized YAML, config sources to report ownership, config artifacts to list concrete artifacts, or config diff to compare two overlays.")
 }
 
 func writeInspectionSourceHeader(out io.Writer, resolved *inspectionConfig) error {
@@ -343,11 +343,11 @@ func writeInspectionSourceHeader(out io.Writer, resolved *inspectionConfig) erro
 			return err
 		}
 	}
-	if profile, ok := config.SelectedPipelineProfile(resolved.Pipeline); ok {
-		if _, err := fmt.Fprintf(out, "profile: name=%s selection=%s overlay=%s\n", profile.Name, profile.Source, config.NormalizedConfigurationPath(profile.OverlayPath)); err != nil {
+	if overlay, ok := config.SelectedPipelineOverlay(resolved.Pipeline); ok {
+		if _, err := fmt.Fprintf(out, "overlay: name=%s selection=%s path=%s\n", overlay.Name, overlay.Source, config.NormalizedConfigurationPath(overlay.OverlayPath)); err != nil {
 			return err
 		}
-	} else if _, err := fmt.Fprintln(out, "profile: none"); err != nil {
+	} else if _, err := fmt.Fprintln(out, "overlay: none"); err != nil {
 		return err
 	}
 	if resolved.Campaign == nil {

internal/app/config_commands_test.go

@@ -34,6 +34,7 @@ func TestConfigCommandHelpAndDispatch(t *testing.T) {
 		{name: "stage flag", args: []string{"config", "show", "--from", "prepare"}, want: "flag provided but not defined", code: 1},
 		{name: "force flag", args: []string{"config", "show", "--force"}, want: "flag provided but not defined", code: 1},
 		{name: "artifact flag", args: []string{"config", "show", "--artifacts", "recap"}, want: "flag provided but not defined", code: 1},
+		{name: "retired selector", args: []string{"config", "validate", "--profile", "testing"}, want: "flag provided but not defined", code: 1},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			var stdout, stderr bytes.Buffer
@@ -102,7 +103,7 @@ whisperx:
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath}, &validateOut); err != nil {
 		t.Fatalf("ConfigValidate() error = %v", err)
 	}
-	if !strings.Contains(validateOut.String(), "Configuration valid: root=") || !strings.Contains(validateOut.String(), "; profile=none; digest=") {
+	if !strings.Contains(validateOut.String(), "Configuration valid: root=") || !strings.Contains(validateOut.String(), "; overlay=none; digest=") {
 		t.Fatalf("validate output = %q", validateOut.String())
 	}
 
@@ -127,7 +128,7 @@ whisperx:
 	if strings.Contains(sourcesOut.String(), secret) {
 		t.Fatalf("sources output leaked a raw secret: %q", sourcesOut.String())
 	}
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
 	var diffOut bytes.Buffer
 	if err := ConfigDiff(context.Background(), []string{"production", "testing", "--config", pipelinePath}, &diffOut); err != nil {
 		t.Fatalf("ConfigDiff() error = %v", err)
@@ -143,10 +144,10 @@ whisperx:
 	}
 }
 
-func TestConfigDiffReportsSemanticProfileChanges(t *testing.T) {
+func TestConfigDiffReportsSemanticOverlayChanges(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, _, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, `workspace:
+	writeInspectionOverlays(t, pipelinePath, `workspace:
   cleanup_after_publish: true
 publish:
   upload_run: true
@@ -203,7 +204,7 @@ scriptorium:
 		t.Fatalf("reversed ConfigDiff() error = %v", err)
 	}
 	if !strings.Contains(reversed.String(), "changed\twhisperx.language\t\"fr\"\t\"en\"\n") {
-		t.Fatalf("reversed diff did not independently resolve profiles:\n%s", reversed.String())
+		t.Fatalf("reversed diff did not independently resolve overlays:\n%s", reversed.String())
 	}
 }
 
@@ -219,7 +220,7 @@ audita:
 scriptorium:
   artifacts: null
 `)
-	mustWriteTestFile(t, filepath.Join(dir, "profiles", "empty.yml"), `audita:
+	mustWriteTestFile(t, filepath.Join(dir, "overlays", "empty.yml"), `audita:
   modules: []
 scriptorium:
   artifacts: {}
@@ -229,7 +230,7 @@ scriptorium:
 	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath}, &base); err != nil {
 		t.Fatal(err)
 	}
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "empty"}, &empty); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "empty"}, &empty); err != nil {
 		t.Fatal(err)
 	}
 	for _, want := range []string{"modules: null\n", "artifacts: null\n"} {
@@ -239,7 +240,7 @@ scriptorium:
 	}
 	for _, want := range []string{"modules: []\n", "artifacts: {}\n"} {
 		if !strings.Contains(empty.String(), want) {
-			t.Fatalf("empty-profile show output missing %q:\n%s", want, empty.String())
+			t.Fatalf("empty-overlay show output missing %q:\n%s", want, empty.String())
 		}
 	}
 
@@ -259,7 +260,7 @@ scriptorium:
 
 func TestConfigDiffComparesExpandedFamiliesAndPublishRules(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	writeInspectionProfiles(t, pipelinePath, `scriptorium:
+	writeInspectionOverlays(t, pipelinePath, `scriptorium:
   artifact_families:
     character_note:
       enabled: false
@@ -301,11 +302,11 @@ func TestConfigDiffComparesExpandedFamiliesAndPublishRules(t *testing.T) {
 func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: en\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: en\n")
 
 	var equal bytes.Buffer
 	if err := ConfigDiff(context.Background(), []string{"production", "testing", "--config", pipelinePath}, &equal); err != nil {
-		t.Fatalf("ConfigDiff() equal profiles error = %v", err)
+		t.Fatalf("ConfigDiff() equal overlays error = %v", err)
 	}
 	if got := equal.String(); got != "no differences\n" {
 		t.Fatalf("equal diff output = %q", got)
@@ -316,7 +317,7 @@ func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 		{"production", "--config", pipelinePath},
 		{"production", "production", "--config", pipelinePath},
 		{"unknown", "testing", "--config", pipelinePath},
-		{"production", "testing", "--config", pipelinePath, "--profile", "production"},
+		{"production", "testing", "--config", pipelinePath, "--overlay", "production"},
 		{"production", "testing", "--config", pipelinePath, "--config", pipelinePath},
 		{"production", "testing", "--config", pipelinePath, "--campaign", "sample-campaign", "--campaign-file", campaignPath},
 	} {
@@ -326,10 +327,10 @@ func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 	}
 }
 
-func TestConfigDiffBootstrapsSecretsOnceForBothProfiles(t *testing.T) {
+func TestConfigDiffBootstrapsSecretsOnceForBothOverlays(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, _, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
 	secretsDir := t.TempDir()
 	const secretName = "NARRATIO_DIFF_BOOTSTRAP_REPORT"
 	restoreEnvAfterTest(t, secretName)
@@ -367,10 +368,12 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 	const firstCanary = "inspection-credential-canary-one"
 	const secondCanary = "inspection-credential-canary-two"
 	for name, value := range map[string]string{
-		"NARRATIO_INSPECT_ACCESS":  firstCanary,
-		"NARRATIO_INSPECT_SECRET":  firstCanary,
-		"NARRATIO_INSPECT_LLM_ONE": firstCanary,
-		"NARRATIO_INSPECT_LLM_TWO": secondCanary,
+		"NARRATIO_INSPECT_ACCESS":       firstCanary,
+		"NARRATIO_INSPECT_SECRET":       firstCanary,
+		"NARRATIO_INSPECT_LLM_ONE":      firstCanary,
+		"NARRATIO_INSPECT_LLM_TWO":      secondCanary,
+		"NARRATIO_INSPECT_NOTARIUS_ONE": firstCanary,
+		"NARRATIO_INSPECT_NOTARIUS_TWO": secondCanary,
 	} {
 		t.Setenv(name, value)
 	}
@@ -384,43 +387,75 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
     access_key_id: NARRATIO_INSPECT_ACCESS
     secret_access_key: NARRATIO_INSPECT_SECRET
 `, 1)
+	pipelineYAML += `notarius:
+  enabled: false
+  credentials: [NARRATIO_INSPECT_NOTARIUS_ONE]
+`
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	writeInspectionProfiles(t, pipelinePath,
-		"audita:\n  model: production\n  llm_api_key: NARRATIO_INSPECT_LLM_ONE\n",
-		"audita:\n  model: testing\n  llm_api_key: NARRATIO_INSPECT_LLM_TWO\n",
+	writeInspectionOverlays(t, pipelinePath,
+		"audita:\n  proposal_profile: production\n  credentials: [NARRATIO_INSPECT_LLM_ONE]\n",
+		"audita:\n  proposal_profile: testing\n  credentials: [NARRATIO_INSPECT_LLM_TWO]\nnotarius:\n  credentials: [NARRATIO_INSPECT_NOTARIUS_TWO]\n",
 	)
+	mustWriteTestFile(t, filepath.Join(filepath.Dir(pipelinePath), "overlays", "without-notarius-key.yml"), "notarius:\n  credentials: []\n")
+
+	var validate bytes.Buffer
+	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &validate); err != nil {
+		t.Fatalf("config validate: %v", err)
+	}
 
 	var show bytes.Buffer
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &show); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &show); err != nil {
 		t.Fatalf("config show: %v", err)
 	}
 	var sources bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &sources); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &sources); err != nil {
 		t.Fatalf("config sources: %v", err)
 	}
 	var catalog bytes.Buffer
-	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &catalog); err != nil {
+	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &catalog); err != nil {
 		t.Fatalf("config artifacts: %v", err)
 	}
 	var diff bytes.Buffer
 	if err := ConfigDiff(context.Background(), []string{"production", "testing", "--config", pipelinePath}, &diff); err != nil {
 		t.Fatalf("config diff: %v", err)
 	}
+	var removed bytes.Buffer
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "without-notarius-key"}, &removed); err != nil {
+		t.Fatalf("config show with removed Notarius credential: %v", err)
+	}
 	for label, output := range map[string]string{"show": show.String(), "sources": sources.String(), "artifacts": catalog.String(), "diff": diff.String()} {
 		if strings.Contains(output, firstCanary) || strings.Contains(output, secondCanary) {
 			t.Fatalf("%s output exposed credential value: %q", label, output)
 		}
 	}
-	for _, reference := range []string{"NARRATIO_INSPECT_ACCESS", "NARRATIO_INSPECT_SECRET", "NARRATIO_INSPECT_LLM_ONE"} {
+	for _, reference := range []string{"NARRATIO_INSPECT_ACCESS", "NARRATIO_INSPECT_SECRET", "NARRATIO_INSPECT_LLM_ONE", "NARRATIO_INSPECT_NOTARIUS_ONE"} {
 		if !strings.Contains(show.String(), reference) {
 			t.Fatalf("show omitted safe credential reference %q: %q", reference, show.String())
 		}
 	}
-	if !strings.Contains(diff.String(), "NARRATIO_INSPECT_LLM_ONE") || !strings.Contains(diff.String(), "NARRATIO_INSPECT_LLM_TWO") {
+	if !strings.Contains(diff.String(), "NARRATIO_INSPECT_LLM_ONE") || !strings.Contains(diff.String(), "NARRATIO_INSPECT_LLM_TWO") ||
+		!strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") || !strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_TWO") {
 		t.Fatalf("diff omitted safe credential references: %q", diff.String())
 	}
+	if !strings.Contains(sources.String(), "notarius.credentials") {
+		t.Fatalf("sources omitted Notarius credential ownership: %q", sources.String())
+	}
+	if strings.Contains(removed.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") {
+		t.Fatalf("empty overlay did not remove Notarius credential: %q", removed.String())
+	}
+}
+
+func TestConfigValidateRejectsUnavailableNotariusCredential(t *testing.T) {
+	const envName = "NARRATIO_INSPECT_NOTARIUS_MISSING"
+	restoreEnvAfterTest(t, envName)
+	path := filepath.Join(t.TempDir(), "pipeline.yml")
+	mustWriteTestFile(t, path, "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n")
+	err := ConfigValidate(context.Background(), []string{"--config", path}, io.Discard)
+	if err == nil || !strings.Contains(err.Error(), "secret.unset") {
+		t.Fatalf("ConfigValidate() error = %v, want unavailable credential failure", err)
+	}
 }
 
 func TestConfigCommandsInspectMaintainedSplitBundleWithoutRuntimeState(t *testing.T) {
@@ -441,36 +476,36 @@ func TestConfigCommandsInspectMaintainedSplitBundleWithoutRuntimeState(t *testin
 	if err := ConfigDiff(context.Background(), []string{"default", "testing", "--config", pipelinePath, "--campaign-file", campaignPath}, &diff); err != nil {
 		t.Fatalf("ConfigDiff() error = %v", err)
 	}
-	if !strings.Contains(diff.String(), "audita.model") {
-		t.Fatalf("split bundle profile diff = %q, want model change", diff.String())
+	if !strings.Contains(diff.String(), "audita.proposal_profile") {
+		t.Fatalf("split bundle overlay diff = %q, want proposal profile change", diff.String())
 	}
 	if _, err := os.Stat(workspacePath); !os.IsNotExist(err) {
 		t.Fatalf("inspection created example workspace: %v", err)
 	}
 }
 
-func writeInspectionProfiles(t *testing.T, pipelinePath, production, testing string) {
+func writeInspectionOverlays(t *testing.T, pipelinePath, production, testing string) {
 	t.Helper()
-	profilesDir := filepath.Join(filepath.Dir(pipelinePath), "profiles")
-	mustWriteTestFile(t, filepath.Join(profilesDir, "production.yml"), production)
-	mustWriteTestFile(t, filepath.Join(profilesDir, "testing.yml"), testing)
+	overlaysDir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
+	mustWriteTestFile(t, filepath.Join(overlaysDir, "production.yml"), production)
+	mustWriteTestFile(t, filepath.Join(overlaysDir, "testing.yml"), testing)
 }
 
-func TestConfigCommandsSelectProfilesAndCampaigns(t *testing.T) {
+func TestConfigCommandsSelectOverlaysAndCampaigns(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
 	var defaultOut bytes.Buffer
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath}, &defaultOut); err != nil {
 		t.Fatalf("default ConfigValidate() error = %v", err)
 	}
-	if !strings.Contains(defaultOut.String(), "profile=none") {
+	if !strings.Contains(defaultOut.String(), "overlay=none") {
 		t.Fatalf("default output = %q", defaultOut.String())
 	}
 
 	var explicitOut bytes.Buffer
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &explicitOut); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &explicitOut); err != nil {
 		t.Fatalf("explicit ConfigShow() error = %v", err)
 	}
 	if !strings.Contains(explicitOut.String(), "language: fr") {
@@ -555,9 +590,9 @@ whisperx:
 func TestConfigSourcesReportsStableOwnership(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
-	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}
+	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}
 	var first, second bytes.Buffer
 	if err := ConfigSources(context.Background(), args, &first); err != nil {
 		t.Fatalf("first ConfigSources() error = %v", err)
@@ -572,13 +607,13 @@ func TestConfigSourcesReportsStableOwnership(t *testing.T) {
 	for _, want := range []string{
 		"root: ",
 		"imports: none",
-		"profile: name=testing selection=explicit overlay=",
+		"overlay: name=testing selection=explicit path=",
 		"campaign: id=sample-campaign source=",
 		"party: source=",
 		"digest: ",
 		"path\trole\tsource\n",
 		"workspace.root\troot\t",
-		"whisperx.language\tprofile\t",
+		"whisperx.language\toverlay\t",
 		"derived.players\tparty\t",
 		"trim.enabled\tdefault\tdefault",
 	} {
@@ -613,10 +648,10 @@ func TestConfigSourcesReportsCanonicalFamilyAndPublishOrigins(t *testing.T) {
 	}
 }
 
-func TestConfigSourcesPreservesProfileOwnershipThroughFamilyExpansion(t *testing.T) {
+func TestConfigSourcesPreservesOverlayOwnershipThroughFamilyExpansion(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	profilePath := filepath.Join(filepath.Dir(pipelinePath), "profiles", "testing.yml")
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	overlayPath := filepath.Join(filepath.Dir(pipelinePath), "overlays", "testing.yml")
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifact_families:
     character_note:
       enabled: true
@@ -624,12 +659,12 @@ func TestConfigSourcesPreservesProfileOwnershipThroughFamilyExpansion(t *testing
 `)
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatalf("ConfigSources() error = %v", err)
 	}
-	want := "scriptorium.artifacts.character_note_arannis.enabled\tfamily\t" + profilePath
+	want := "scriptorium.artifacts.character_note_arannis.enabled\tfamily\t" + overlayPath
 	if !strings.Contains(out.String(), want) {
-		t.Fatalf("sources output missing profile-generated ownership %q:\n%s", want, out.String())
+		t.Fatalf("sources output missing overlay-generated ownership %q:\n%s", want, out.String())
 	}
 }
 
@@ -637,7 +672,7 @@ func TestConfigSourcesAttributesInferredArtifactDependencies(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
 	inputPath := filepath.Join(dir, "input-only.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, pipelinePath, `configkit:
   imports:
     - path: input-only.yml
@@ -667,7 +702,7 @@ scriptorium:
         prior:
           source: narratio.artifact.first
 `)
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifacts:
     mixed:
       inputs:
@@ -676,13 +711,13 @@ scriptorium:
 `)
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatal(err)
 	}
 	for _, want := range []string{
 		"scriptorium.artifacts.input_only.depends_on\timport\t" + inputPath,
 		"scriptorium.artifacts.mixed.depends_on\troot\t" + pipelinePath,
-		"scriptorium.artifacts.mixed.depends_on\tprofile\t" + profilePath,
+		"scriptorium.artifacts.mixed.depends_on\toverlay\t" + overlayPath,
 	} {
 		if !strings.Contains(out.String(), want) {
 			t.Fatalf("sources output missing dependency contributor %q:\n%s", want, out.String())
@@ -693,11 +728,11 @@ scriptorium:
 	}
 }
 
-func TestConfigSourcesReportsRootImportProfileAndDefaultOwnership(t *testing.T) {
+func TestConfigSourcesReportsRootImportOverlayAndDefaultOwnership(t *testing.T) {
 	dir := t.TempDir()
 	rootPath := filepath.Join(dir, "pipeline.yml")
 	importPath := filepath.Join(dir, "base.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, rootPath, `configkit:
   imports:
     - path: base.yml
@@ -707,19 +742,19 @@ whisperx:
   transcribe_url: https://transcription.example.com/transcribe
 `)
 	mustWriteTestFile(t, importPath, "storage:\n  backend: local\n")
-	mustWriteTestFile(t, profilePath, "whisperx:\n  language: fr\n")
+	mustWriteTestFile(t, overlayPath, "whisperx:\n  language: fr\n")
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", rootPath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", rootPath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatalf("ConfigSources() error = %v", err)
 	}
 	output := out.String()
 	for _, want := range []string{
 		"import: " + importPath,
-		"profile: name=testing selection=explicit overlay=" + profilePath,
+		"overlay: name=testing selection=explicit path=" + overlayPath,
 		"workspace.root\troot\t" + rootPath,
 		"storage.backend\timport\t" + importPath,
-		"whisperx.language\tprofile\t" + profilePath,
+		"whisperx.language\toverlay\t" + overlayPath,
 		"trim.enabled\tdefault\tdefault",
 	} {
 		if !strings.Contains(output, want) {

internal/app/config_diff.go

@@ -20,8 +20,8 @@ type configDiffFlags struct {
 }
 
 type configDiffRequest struct {
-	leftProfile  string
-	rightProfile string
+	leftOverlay  string
+	rightOverlay string
 	flags        configDiffFlags
 }
 
@@ -37,7 +37,7 @@ type configDiffRecord struct {
 	Right string
 }
 
-// ConfigDiff compares two explicitly selected profiles through the same
+// ConfigDiff compares two explicitly selected overlays through the same
 // read-only configuration resolution boundary used by config validate, show,
 // and sources. Differences describe normalized effective values rather than
 // the layout of root, import, or overlay files.
@@ -100,7 +100,7 @@ func configDiffWithDependencies(_ context.Context, args []string, out io.Writer,
 }
 
 func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, error) {
-	profiles, flagArgs := splitConfigDiffArguments(args)
+	overlays, flagArgs := splitConfigDiffArguments(args)
 	fs := flag.NewFlagSet("config diff", flag.ContinueOnError)
 	fs.SetOutput(out)
 	var request configDiffRequest
@@ -113,9 +113,9 @@ func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, er
 	fs.Var(&request.flags.campaignFilePath, "campaign-file", "path to campaign.yml")
 	fs.Var(&request.flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.Usage = func() {
-		fmt.Fprintln(out, "Usage: narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <path>]")
+		fmt.Fprintln(out, "Usage: narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <path>]")
 		fmt.Fprintln(out)
-		fmt.Fprintln(out, "Compares fully resolved profiles without a session, workspace, manifest, adapters, or external services.")
+		fmt.Fprintln(out, "Compares fully resolved overlays without a session, workspace, manifest, adapters, or external services.")
 		fmt.Fprintln(out)
 		fmt.Fprintln(out, "Flags:")
 		fs.PrintDefaults()
@@ -123,30 +123,30 @@ func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, er
 	if err := fs.Parse(flagArgs); err != nil {
 		return configDiffRequest{}, fmt.Errorf("config diff: invalid flags: %w", err)
 	}
-	profiles = append(profiles, fs.Args()...)
-	if len(profiles) != 2 || strings.TrimSpace(profiles[0]) == "" || strings.TrimSpace(profiles[1]) == "" {
-		return configDiffRequest{}, fmt.Errorf("config diff: exactly two non-empty profile names are required")
+	overlays = append(overlays, fs.Args()...)
+	if len(overlays) != 2 || strings.TrimSpace(overlays[0]) == "" || strings.TrimSpace(overlays[1]) == "" {
+		return configDiffRequest{}, fmt.Errorf("config diff: exactly two non-empty overlay names are required")
 	}
-	if profiles[0] == profiles[1] {
-		return configDiffRequest{}, fmt.Errorf("config diff: profile names must differ")
+	if overlays[0] == overlays[1] {
+		return configDiffRequest{}, fmt.Errorf("config diff: overlay names must differ")
 	}
 	if request.flags.campaignPath.set && request.flags.campaignFilePath.set {
 		return configDiffRequest{}, fmt.Errorf("config diff: --campaign and --campaign-file are mutually exclusive")
 	}
-	request.leftProfile = profiles[0]
-	request.rightProfile = profiles[1]
+	request.leftOverlay = overlays[0]
+	request.rightOverlay = overlays[1]
 	return request, nil
 }
 
 // splitConfigDiffArguments accepts the documented positional-first syntax and
-// also permits flags before or between profile names. Values belonging to the
+// also permits flags before or between overlay names. Values belonging to the
 // supported string flags stay with their flag so they are not mistaken for
-// profile names.
-func splitConfigDiffArguments(args []string) (profiles, flagArgs []string) {
+// overlay names.
+func splitConfigDiffArguments(args []string) (overlays, flagArgs []string) {
 	for index := 0; index < len(args); index++ {
 		argument := args[index]
 		if !strings.HasPrefix(argument, "-") || argument == "-" {
-			profiles = append(profiles, argument)
+			overlays = append(overlays, argument)
 			continue
 		}
 		flagArgs = append(flagArgs, argument)
@@ -161,12 +161,12 @@ func splitConfigDiffArguments(args []string) (profiles, flagArgs []string) {
 		index++
 		flagArgs = append(flagArgs, args[index])
 	}
-	return profiles, flagArgs
+	return overlays, flagArgs
 }
 
 func configDiffStringFlag(name string) bool {
 	switch name {
-	case "config", "campaign", "campaign-file", "profile", "secrets-dir":
+	case "config", "campaign", "campaign-file", "secrets-dir":
 		return true
 	default:
 		return false
@@ -175,13 +175,13 @@ func configDiffStringFlag(name string) bool {
 
 func resolveConfigDiff(request configDiffRequest, deps commandDependencies) (*configDiffResolved, error) {
 	deps = normalizeCommandDependencies(deps)
-	pipelinePath, leftPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Profile: &request.leftProfile}, request.flags.secretsDir.pointer(), deps)
+	pipelinePath, leftPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Overlay: &request.leftOverlay}, request.flags.secretsDir.pointer(), deps)
 	if err != nil {
-		return nil, fmt.Errorf("load left pipeline profile: %w", err)
+		return nil, fmt.Errorf("load left pipeline overlay: %w", err)
 	}
-	_, rightPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Profile: &request.rightProfile}, request.flags.secretsDir.pointer(), deps)
+	_, rightPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Overlay: &request.rightOverlay}, request.flags.secretsDir.pointer(), deps)
 	if err != nil {
-		return nil, fmt.Errorf("load right pipeline profile: %w", err)
+		return nil, fmt.Errorf("load right pipeline overlay: %w", err)
 	}
 	needsCampaign := pipelineHasArtifactFamilies(leftPipeline) || pipelineHasArtifactFamilies(rightPipeline)
 	hasCampaignSelection := request.flags.campaignPath.set || request.flags.campaignFilePath.set
@@ -259,7 +259,7 @@ func resolveSharedDiffCampaignPath(left, right *config.PipelineConfig, flags con
 		return "", rightErr
 	}
 	if leftPath != rightPath {
-		return "", fmt.Errorf("profile selections resolve different campaign files; specify --campaign-file to compare one campaign")
+		return "", fmt.Errorf("overlay selections resolve different campaign files; specify --campaign-file to compare one campaign")
 	}
 	return leftPath, nil
 }

internal/app/config_loader.go

@@ -46,7 +46,7 @@ func loadCommandConfigWithDependencies(ctx context.Context, pipelineFlag, campai
 		}
 	}()
 
-	base, err := loadPipelineCampaignConfigWithDependencies(pipelineFlag, campaignFlag, campaignFileFlag, config.PipelineLoadOptions{Profile: sessionOpts.Profile}, secretsDir, deps)
+	base, err := loadPipelineCampaignConfigWithDependencies(pipelineFlag, campaignFlag, campaignFileFlag, config.PipelineLoadOptions{Overlay: sessionOpts.Overlay}, secretsDir, deps)
 	if err != nil {
 		return nil, err
 	}
@@ -163,7 +163,7 @@ func loadPipelineCampaignConfigWithDependencies(pipelineFlag, campaignFlag, camp
 
 func loadPipelineConfigWithDependencies(pipelineFlag string, opts config.PipelineLoadOptions, secretsDir *string, deps commandDependencies) (string, *config.PipelineConfig, error) {
 	deps = normalizeCommandDependencies(deps)
-	resolvedPipelinePath, err := resolvePipelineConfigPath(pipelineFlag)
+	resolvedPipelinePath, err := deps.resolvePipelineConfigPath(pipelineFlag)
 	if err != nil {
 		return "", nil, err
 	}

internal/app/config_provenance.go

@@ -14,13 +14,13 @@ func effectiveConfigProvenance(cfg *config.Config) *manifest.EffectiveConfigProv
 	provenance := &manifest.EffectiveConfigProvenance{
 		EffectiveConfigDigest: config.EffectivePipelineDigest(cfg.Pipeline),
 	}
-	if selected, ok := config.SelectedPipelineProfile(cfg.Pipeline); ok {
-		provenance.SelectedProfile = &manifest.SelectedProfileProvenance{
+	if selected, ok := config.SelectedPipelineOverlay(cfg.Pipeline); ok {
+		provenance.SelectedOverlay = &manifest.SelectedOverlayProvenance{
 			Name:   selected.Name,
 			Source: selected.Source,
 		}
 	}
-	if provenance.SelectedProfile == nil && provenance.EffectiveConfigDigest == "" {
+	if provenance.SelectedOverlay == nil && provenance.EffectiveConfigDigest == "" {
 		return nil
 	}
 	return provenance
@@ -35,30 +35,30 @@ func applyEffectiveConfigProvenance(m *manifest.Manifest, cfg *config.Config) {
 func effectiveConfigSummary(cfg *config.Config) string {
 	provenance := effectiveConfigProvenance(cfg)
 	if provenance == nil {
-		return "profile=none digest=unavailable"
+		return "overlay=none digest=unavailable"
 	}
-	profile := "none"
-	if provenance.SelectedProfile != nil {
-		profile = provenance.SelectedProfile.Name + " (" + provenance.SelectedProfile.Source + ")"
+	overlay := "none"
+	if provenance.SelectedOverlay != nil {
+		overlay = provenance.SelectedOverlay.Name + " (" + provenance.SelectedOverlay.Source + ")"
 	}
 	digest := provenance.EffectiveConfigDigest
 	if digest == "" {
 		digest = "unavailable"
 	}
-	return fmt.Sprintf("profile=%s digest=%s", profile, digest)
+	return fmt.Sprintf("overlay=%s digest=%s", overlay, digest)
 }
 
 func persistedEffectiveConfigSummary(provenance *manifest.EffectiveConfigProvenance) string {
 	if provenance == nil {
-		return "profile=none digest=unavailable"
+		return "overlay=none digest=unavailable"
 	}
-	profile := "none"
-	if provenance.SelectedProfile != nil {
-		profile = provenance.SelectedProfile.Name + " (" + provenance.SelectedProfile.Source + ")"
+	overlay := "none"
+	if provenance.SelectedOverlay != nil {
+		overlay = provenance.SelectedOverlay.Name + " (" + provenance.SelectedOverlay.Source + ")"
 	}
 	digest := provenance.EffectiveConfigDigest
 	if digest == "" {
 		digest = "unavailable"
 	}
-	return fmt.Sprintf("profile=%s digest=%s", profile, digest)
+	return fmt.Sprintf("overlay=%s digest=%s", overlay, digest)
 }

internal/app/extract_lifecycle_test.go

@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"sort"
 	"strings"
 	"testing"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/notarius"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifactmodel"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifactpolicy"
@@ -181,12 +183,16 @@ func TestExtractLifecyclePrepareBindsVerifiedReferenceSnapshots(t *testing.T) {
 	for index, expected := range want {
 		binding := request.References[index]
 		canonical := filepath.Join(paths.InputsDir, expected.filename)
-		snapshot := filepath.Join(
-			artifacts.SessionRunNotariusReferencesDirForCampaign(
-				cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID, loaded.RunID,
-			),
-			expected.filename,
+		descriptor, ok := artifactpolicy.DescribePreparedInputSource(expected.sourceID)
+		if !ok {
+			t.Fatalf("DescribePreparedInputSource(%q) ok = false", expected.sourceID)
+		}
+		snapshot, err := artifacts.SessionNotariusReferenceSnapshotPath(
+			paths, lifecycleInputChecksum(t, loaded, descriptor.ManifestKind), expected.filename,
 		)
+		if err != nil {
+			t.Fatalf("SessionNotariusReferenceSnapshotPath(%q) error = %v", expected.sourceID, err)
+		}
 		if binding.Selector != expected.selector || binding.Path != snapshot || binding.Path == canonical || binding.Path == originalPaths[expected.sourceID] {
 			t.Fatalf("reference[%d] = %#v, want selector %q snapshot %q and not prepared/source paths", index, binding, expected.selector, snapshot)
 		}
@@ -393,6 +399,140 @@ func TestExtractLifecycleFailureInvalidatesAndOrdinaryRetryRerunsDownstream(t *t
 	}
 }
 
+func TestExtractLifecycleRetryReusesStableSnapshotsAndChangedReferenceSelectsNewPath(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	configureLifecycleReferences(t, cfg)
+	runner.failuresRemaining = 1
+	plan := prepareExtractLifecyclePlan(t)
+
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err == nil {
+		t.Fatal("first executeStages() error = nil, want extraction failure")
+	}
+	if len(runner.requests) != 1 {
+		t.Fatalf("failed requests = %d, want 1", len(runner.requests))
+	}
+	firstPaths := lifecycleReferencePaths(runner.requests[0])
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("retry executeStages() error = %v", err)
+	}
+	if len(runner.requests) != 2 {
+		t.Fatalf("retry requests = %d, want 2", len(runner.requests))
+	}
+	if secondPaths := lifecycleReferencePaths(runner.requests[1]); !reflect.DeepEqual(secondPaths, firstPaths) {
+		t.Fatalf("snapshot paths changed on retry:\nfirst %#v\nsecond %#v", firstPaths, secondPaths)
+	}
+
+	partyDocument, err := config.ParseParty([]byte(`schema_version: narratio.party.v1
+characters:
+  changed:
+    player: {name: Eric}
+    character:
+      name: Changed
+      classes: [{name: wizard}]
+`))
+	if err != nil {
+		t.Fatalf("ParseParty(changed party) error = %v", err)
+	}
+	cfg.Party.Canonical = partyDocument
+	persisted := loadLifecycleManifest(t, cfg)
+	prepare, err := stage.Select("prepare")
+	if err != nil {
+		t.Fatalf("stage.Select(prepare) error = %v", err)
+	}
+	if _, err := prepare.Run(context.Background(), env, persisted); err != nil {
+		t.Fatalf("prepare.Run() error = %v", err)
+	}
+	if err := (&manifest.LocalStore{}).Save(context.Background(), manifestPathFor(cfg), persisted); err != nil {
+		t.Fatalf("Save(reprepared manifest) error = %v", err)
+	}
+	extractPlan, _ := BuildSingleStagePlan("extract")
+	if _, err := executeStages(context.Background(), cfg, extractPlan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("changed-reference executeStages() error = %v", err)
+	}
+	if len(runner.requests) != 3 {
+		t.Fatalf("changed-reference requests = %d, want 3", len(runner.requests))
+	}
+	thirdPaths := lifecycleReferencePaths(runner.requests[2])
+	if thirdPaths["party"] == firstPaths["party"] {
+		t.Fatalf("changed party retained snapshot path %q", thirdPaths["party"])
+	}
+	if thirdPaths["players"] == firstPaths["players"] {
+		t.Fatalf("changed party retained derived players snapshot path %q", thirdPaths["players"])
+	}
+	for selector, firstPath := range firstPaths {
+		if selector != "party" && selector != "players" && thirdPaths[selector] != firstPath {
+			t.Fatalf("unchanged %s snapshot path = %q, want %q", selector, thirdPaths[selector], firstPath)
+		}
+		if _, err := os.Stat(firstPath); err != nil {
+			t.Fatalf("old %s snapshot %q was not retained: %v", selector, firstPath, err)
+		}
+	}
+}
+
+func TestExtractLifecycleCacheControlsAndSnapshotLossDoNotInvalidateCompleteResult(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	configureLifecycleReferences(t, cfg)
+	if _, err := executeStages(context.Background(), cfg, prepareExtractLifecyclePlan(t), RunOptions{Env: env}); err != nil {
+		t.Fatalf("initial executeStages() error = %v", err)
+	}
+	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
+	cacheRoot := artifacts.SessionNotariusReferenceCacheDir(paths)
+	if err := os.RemoveAll(cacheRoot); err != nil {
+		t.Fatalf("RemoveAll(snapshot cache) error = %v", err)
+	}
+	cfg.Pipeline.Notarius.Resume = true
+	cfg.Pipeline.Notarius.ChunkCache = "bypass"
+	extractPlan, _ := BuildSingleStagePlan("extract")
+	summary, err := executeStages(context.Background(), cfg, extractPlan, RunOptions{Env: env})
+	if err != nil {
+		t.Fatalf("resume executeStages() error = %v", err)
+	}
+	if len(summary.Executed) != 0 || !reflect.DeepEqual(summary.Skipped, []string{"extract"}) || len(runner.requests) != 1 {
+		t.Fatalf("resume summary = %#v requests=%d", summary, len(runner.requests))
+	}
+	if _, err := os.Stat(cacheRoot); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("skipped extraction recreated snapshot cache: %v", err)
+	}
+}
+
+func TestAnalyzeOnlyLifecyclePreservesExtractionWithoutInvokingNotarius(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	extractPlan, _ := BuildSingleStagePlan("extract")
+	if _, err := executeStages(context.Background(), cfg, extractPlan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("extract executeStages() error = %v", err)
+	}
+	before := loadLifecycleManifest(t, cfg).Stages["extract"]
+	beforeJSON, _ := json.Marshal(before)
+	analyzeRuns := 0
+	if _, err := executeStages(context.Background(), cfg, []stage.Stage{countingStage{name: "analyze", runs: &analyzeRuns}}, RunOptions{Env: env, Force: true}); err != nil {
+		t.Fatalf("analyze-only executeStages() error = %v", err)
+	}
+	after := loadLifecycleManifest(t, cfg).Stages["extract"]
+	afterJSON, _ := json.Marshal(after)
+	if analyzeRuns != 1 || len(runner.requests) != 1 || string(afterJSON) != string(beforeJSON) {
+		t.Fatalf("analyze-only lifecycle changed extraction: analyze=%d requests=%d\nbefore=%s\nafter=%s", analyzeRuns, len(runner.requests), beforeJSON, afterJSON)
+	}
+	for _, output := range after.Outputs {
+		if _, err := os.Stat(output.LocalPath); err != nil {
+			t.Fatalf("analyze-only lifecycle removed extract output %q: %v", output.LocalPath, err)
+		}
+	}
+}
+
+func TestForcedArtifactRegenerationUsesOrdinaryExtractAndAnalyzePath(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	cfg.Pipeline.Notarius.Resume = true
+	cfg.Pipeline.Notarius.ChunkCache = "bypass"
+	analyzeRuns := 0
+	plan := extractionLifecyclePlan(t, &analyzeRuns)
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env, Force: true, SelectedArtifacts: []string{"session_recap"}}); err != nil {
+		t.Fatalf("forced artifact regeneration error = %v", err)
+	}
+	if len(runner.requests) != 1 || runner.requests[0].Resume || runner.requests[0].ChunkCache != "refresh" || analyzeRuns != 1 {
+		t.Fatalf("forced path request=%#v analyze=%d", runner.requests, analyzeRuns)
+	}
+}
+
 func TestExtractLifecycleForcedSelfSkipInvalidatesDownstream(t *testing.T) {
 	cfg, env, _ := extractionLifecycleFixture(t, false)
 	markLifecycleStageSucceeded(t, cfg, "analyze")
@@ -485,6 +625,273 @@ func TestExtractLifecycleSkipsCurrentResumableResult(t *testing.T) {
 	}
 }
 
+func TestExtractLifecycleCredentialChangesRemainResumable(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		before func(*testing.T) *configkit.Secret
+		after  func(*testing.T) *configkit.Secret
+	}{
+		{
+			name: "added",
+			after: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_ADDED_KEY", "added-value")
+			},
+		},
+		{
+			name: "removed",
+			before: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_REMOVED_KEY", "removed-value")
+			},
+		},
+		{
+			name: "renamed",
+			before: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_FIRST_KEY", "first-value")
+			},
+			after: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_SECOND_KEY", "second-value")
+			},
+		},
+		{
+			name: "value rotated",
+			before: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_ROTATED_KEY", "first-value")
+			},
+			after: func(t *testing.T) *configkit.Secret {
+				return loadLifecycleNotariusCredential(t, "NARRATIO_LIFECYCLE_ROTATED_KEY", "second-value")
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			cfg, env, runner := extractionLifecycleFixture(t, true)
+			if test.before != nil {
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.before(t)}
+			}
+			analyzeRuns := 0
+			plan := extractionLifecyclePlan(t, &analyzeRuns)
+			if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
+				t.Fatalf("initial executeStages() error = %v", err)
+			}
+			cfg.Pipeline.Notarius.Credentials = nil
+			if test.after != nil {
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.after(t)}
+			}
+			resumed, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
+			if err != nil {
+				t.Fatalf("resume executeStages() error = %v", err)
+			}
+			if len(resumed.Executed) != 0 || len(resumed.Skipped) != 2 || len(runner.requests) != 1 || analyzeRuns != 1 {
+				t.Fatalf("credential-only change reexecuted work: summary=%#v requests=%d analyze=%d", resumed, len(runner.requests), analyzeRuns)
+			}
+			loaded := loadLifecycleManifest(t, cfg)
+			if loaded.Stages["extract"].Status != manifest.StatusSucceeded || loaded.Stages["analyze"].Status != manifest.StatusSucceeded {
+				t.Fatalf("credential-only change invalidated stages: extract=%q analyze=%q", loaded.Stages["extract"].Status, loaded.Stages["analyze"].Status)
+			}
+		})
+	}
+}
+
+func TestExtractLifecycleConfigOverlayChangesRerunExtractionAndDependents(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	selected := "inexpensive"
+	cfg.Pipeline.Notarius.ConfigOverlay = &selected
+	analyzeRuns := 0
+	plan := extractionLifecyclePlan(t, &analyzeRuns)
+
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("initial executeStages() error = %v", err)
+	}
+	if len(runner.requests) != 1 || runner.requests[0].ConfigOverlay == nil || *runner.requests[0].ConfigOverlay != selected || analyzeRuns != 1 {
+		t.Fatalf("initial requests=%#v analyze=%d, want selected extraction and analysis", runner.requests, analyzeRuns)
+	}
+	reused, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
+	if err != nil {
+		t.Fatalf("reuse executeStages() error = %v", err)
+	}
+	if len(reused.Executed) != 0 || len(runner.requests) != 1 || analyzeRuns != 1 {
+		t.Fatalf("same-profile reuse summary=%#v requests=%d analyze=%d", reused, len(runner.requests), analyzeRuns)
+	}
+
+	markLifecycleStageSucceeded(t, cfg, "render")
+	markLifecycleStageSucceeded(t, cfg, "publish")
+	before := loadLifecycleManifest(t, cfg)
+	trimBefore, err := json.Marshal(before.Stages["trim"])
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	changed := "experimental"
+	cfg.Pipeline.Notarius.ConfigOverlay = &changed
+	rerun, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
+	if err != nil {
+		t.Fatalf("changed-profile executeStages() error = %v", err)
+	}
+	if len(rerun.Executed) != 2 || len(runner.requests) != 2 || runner.requests[1].ConfigOverlay == nil || *runner.requests[1].ConfigOverlay != changed || analyzeRuns != 2 {
+		t.Fatalf("changed-profile summary=%#v requests=%#v analyze=%d", rerun, runner.requests, analyzeRuns)
+	}
+	after := loadLifecycleManifest(t, cfg)
+	trimAfter, err := json.Marshal(after.Stages["trim"])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(trimAfter) != string(trimBefore) {
+		t.Fatalf("profile change altered upstream trim record:\nbefore=%s\nafter=%s", trimBefore, trimAfter)
+	}
+	if after.Stages["render"].Status != manifest.StatusSucceeded || after.Stages["analyze"].Status != manifest.StatusSucceeded || after.Stages["publish"].Status != manifest.StatusStale {
+		t.Fatalf("changed-profile lifecycle render=%#v analyze=%#v publish=%#v", after.Stages["render"], after.Stages["analyze"], after.Stages["publish"])
+	}
+
+	cfg.Pipeline.Notarius.ConfigOverlay = nil
+	returned, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
+	if err != nil {
+		t.Fatalf("return-to-base executeStages() error = %v", err)
+	}
+	if len(returned.Executed) != 2 || len(runner.requests) != 3 || runner.requests[2].ConfigOverlay != nil || analyzeRuns != 3 {
+		t.Fatalf("return-to-base summary=%#v requests=%#v analyze=%d", returned, runner.requests, analyzeRuns)
+	}
+	final := loadLifecycleManifest(t, cfg)
+	if final.Stages["trim"].Status != manifest.StatusSucceeded || final.Stages["render"].Status != manifest.StatusSucceeded {
+		t.Fatalf("return-to-base invalidated upstream siblings: trim=%#v render=%#v", final.Stages["trim"], final.Stages["render"])
+	}
+}
+
+func TestExtractLifecycleConfigOverlayFailureClearsCurrentResultAndDependents(t *testing.T) {
+	cfg, env, runner := extractionLifecycleFixture(t, true)
+	selected := "inexpensive"
+	cfg.Pipeline.Notarius.ConfigOverlay = &selected
+	analyzeRuns := 0
+	plan := extractionLifecyclePlan(t, &analyzeRuns)
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("initial executeStages() error = %v", err)
+	}
+	markLifecycleStageSucceeded(t, cfg, "render")
+	markLifecycleStageSucceeded(t, cfg, "publish")
+
+	changed := "missing-profile"
+	cfg.Pipeline.Notarius.ConfigOverlay = &changed
+	runner.failuresRemaining = 1
+	if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err == nil {
+		t.Fatal("changed-profile executeStages() error = nil, want downstream failure")
+	}
+	failed := loadLifecycleManifest(t, cfg)
+	extract := failed.Stages["extract"]
+	if extract.Status != manifest.StatusFailed || len(extract.Outputs) != 0 || len(extract.Logs) != 0 || len(extract.GeneratedConfigs) != 0 || len(extract.Metadata) != 0 {
+		t.Fatalf("failed changed-profile extraction advertised prior success: %#v", extract)
+	}
+	if failed.Stages["trim"].Status != manifest.StatusSucceeded || failed.Stages["render"].Status != manifest.StatusSucceeded ||
+		failed.Stages["analyze"].Status != manifest.StatusStale || failed.Stages["publish"].Status != manifest.StatusStale || analyzeRuns != 1 {
+		t.Fatalf("failed changed-profile lifecycle trim=%#v render=%#v analyze=%#v publish=%#v analyzeRuns=%d",
+			failed.Stages["trim"], failed.Stages["render"], failed.Stages["analyze"], failed.Stages["publish"], analyzeRuns)
+	}
+	if len(runner.requests) != 2 || runner.requests[1].ConfigOverlay == nil || *runner.requests[1].ConfigOverlay != changed {
+		t.Fatalf("failed request = %#v, want changed selector", runner.requests)
+	}
+}
+
+func TestExtractLifecycleRealConfigOverlaysSelectNotariusExplicitly(t *testing.T) {
+	seed, env, runner := extractionLifecycleFixture(t, true)
+	workspace := seed.Pipeline.Workspace.Root
+	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspace)
+	pipelineFile, err := os.OpenFile(pipelinePath, os.O_APPEND|os.O_WRONLY, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, writeErr := pipelineFile.WriteString(`notarius:
+  enabled: true
+  binary: ` + filepath.Join(workspace, "notarius") + `
+  config_path: notarius.yml
+  pipeline_id: dnd-session
+  timeout: 45m
+  outputs:
+    npc_registry:
+      lane_id: npc-registry
+      media_type: application/json
+      schema_id: notarius.dnd.npc_registry
+      schema_version: v1
+      module_key: dnd/npc-registry
+`)
+	closeErr := pipelineFile.Close()
+	if writeErr != nil || closeErr != nil {
+		t.Fatalf("write Notarius configuration: %v / %v", writeErr, closeErr)
+	}
+	if err := os.WriteFile(filepath.Join(filepath.Dir(pipelinePath), "notarius.yml"), []byte("pipelines: {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	profilesDir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
+	if err := os.MkdirAll(profilesDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	for name, contents := range map[string]string{
+		"testing":           "whisperx:\n  language: fr\nnotarius:\n  config_overlay: downstream-economy\n",
+		"narratio-only":     "whisperx:\n  language: de\n",
+		"narratio-only-two": "whisperx:\n  language: es\n",
+	} {
+		if err := os.WriteFile(filepath.Join(profilesDir, name+".yml"), []byte(contents), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	load := func(profile string) *config.Config {
+		t.Helper()
+		loaded, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{Overlay: &profile})
+		if err != nil {
+			t.Fatalf("load profile %q: %v", profile, err)
+		}
+		return loaded
+	}
+	plan, err := BuildSingleStagePlan("extract")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testingConfig := load("testing")
+	runner.cfg = testingConfig.Pipeline.Notarius
+	if _, err := executeStages(context.Background(), testingConfig, plan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("execute testing profile: %v", err)
+	}
+	if len(runner.requests) != 1 || runner.requests[0].ConfigOverlay == nil || *runner.requests[0].ConfigOverlay != "downstream-economy" {
+		t.Fatalf("testing profile request = %#v, want explicit differently named downstream selector", runner.requests)
+	}
+
+	narratioOnly := load("narratio-only")
+	runner.cfg = narratioOnly.Pipeline.Notarius
+	if _, err := executeStages(context.Background(), narratioOnly, plan, RunOptions{Env: env}); err != nil {
+		t.Fatalf("execute Narratio-only profile: %v", err)
+	}
+	if len(runner.requests) != 2 || runner.requests[1].ConfigOverlay != nil {
+		t.Fatalf("Narratio-only profile request = %#v, want no automatic downstream selector", runner.requests)
+	}
+
+	narratioOnlyTwo := load("narratio-only-two")
+	runner.cfg = narratioOnlyTwo.Pipeline.Notarius
+	reused, err := executeStages(context.Background(), narratioOnlyTwo, plan, RunOptions{Env: env})
+	if err != nil {
+		t.Fatalf("execute second Narratio-only profile: %v", err)
+	}
+	if len(reused.Executed) != 0 || len(runner.requests) != 2 {
+		t.Fatalf("Narratio profile label/effective digest broadened invalidation: summary=%#v requests=%#v", reused, runner.requests)
+	}
+}
+
+func TestPreparedPipelineAndManifestExcludeNotariusCredentialValue(t *testing.T) {
+	const name = "NARRATIO_LIFECYCLE_PERSISTED_KEY"
+	const canary = "notarius-persisted-credential-canary"
+	cfg, env, _ := extractionLifecycleFixture(t, true)
+	cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*loadLifecycleNotariusCredential(t, name, canary)}
+	if _, err := executeStages(context.Background(), cfg, prepareExtractLifecyclePlan(t), RunOptions{Env: env}); err != nil {
+		t.Fatalf("executeStages() error = %v", err)
+	}
+	paths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root).SessionPathsFor(cfg.Session.Campaign, cfg.Session.SessionID)
+	for _, path := range []string{paths.ManifestPath, filepath.Join(paths.InputsDir, "pipeline.resolved.yml")} {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("ReadFile(%q) error = %v", path, err)
+		}
+		if strings.Contains(string(data), canary) {
+			t.Fatalf("persisted Narratio file %q contains the credential value", path)
+		}
+	}
+}
+
 func TestExtractLifecycleRerunsAfterDirectTranscriptChange(t *testing.T) {
 	cfg, env, runner := extractionLifecycleFixture(t, true)
 	analyzeRuns := 0
@@ -696,6 +1103,14 @@ func lifecycleInputChecksum(t *testing.T, m *manifest.Manifest, kind string) str
 	return ""
 }
 
+func lifecycleReferencePaths(request notarius.RunRequest) map[string]string {
+	paths := make(map[string]string, len(request.References))
+	for _, reference := range request.References {
+		paths[reference.Selector] = reference.Path
+	}
+	return paths
+}
+
 func lifecycleDndOutputs() map[string]config.NotariusOutputConfig {
 	return map[string]config.NotariusOutputConfig{
 		"item_registry":        {LaneID: "item-registry", MediaType: "application/json", SchemaID: "notarius.dnd.item_registry", SchemaVersion: "v1", ModuleKey: "dnd/item-registry"},
@@ -761,3 +1176,17 @@ func extractionLifecycleFixture(t *testing.T, enabled bool) (*config.Config, *st
 	runner := &materializingNotariusRunner{cfg: cfg.Pipeline.Notarius}
 	return cfg, &stage.Env{Notarius: runner}, runner
 }
+
+func loadLifecycleNotariusCredential(t *testing.T, name, value string) *configkit.Secret {
+	t.Helper()
+	t.Setenv(name, value)
+	path := filepath.Join(t.TempDir(), "pipeline.yml")
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+name+"]\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	pipeline, err := config.LoadPipeline(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &pipeline.Notarius.Credentials[0]
+}

internal/app/operator_helpers.go

@@ -23,7 +23,7 @@ type commonConfigFlags struct {
 	sessionPath       string
 	sessionID         string
 	previousSessionID string
-	profile           singletonStringFlag
+	overlay           singletonStringFlag
 	secretsDir        singletonStringFlag
 }
 
@@ -34,8 +34,8 @@ func addCommonConfigFlags(fs *flag.FlagSet, flags *commonConfigFlags) {
 	fs.StringVar(&flags.sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&flags.sessionID, "session-id", "", "session identifier")
 	fs.StringVar(&flags.previousSessionID, "previous-session-id", "", "expected previous session identifier")
-	flags.profile.name = "profile"
-	fs.Var(&flags.profile, "profile", "named pipeline profile")
+	flags.overlay.name = "overlay"
+	fs.Var(&flags.overlay, "overlay", "named pipeline overlay")
 	flags.secretsDir.name = "secrets-dir"
 	fs.Var(&flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 }
@@ -44,7 +44,7 @@ func (f commonConfigFlags) sessionOptions() config.SessionLoadOptions {
 	return config.SessionLoadOptions{
 		SessionID:         f.sessionID,
 		PreviousSessionID: f.previousSessionID,
-		Profile:           f.profile.pointer(),
+		Overlay:           f.overlay.pointer(),
 	}
 }
 

internal/app/operator_helpers_test.go

@@ -164,19 +164,19 @@ func TestExecuteSessionInitRequiresSessionID(t *testing.T) {
 }
 
 func TestExecuteSessionInitMissingDefaultConfigReportsSearchedPaths(t *testing.T) {
-	origPipelineDefaults := append([]string(nil), config.DefaultPipelineConfigSearchPaths...)
-	config.DefaultPipelineConfigSearchPaths = []string{filepath.Join(t.TempDir(), "missing-pipeline.yml")}
-	t.Cleanup(func() {
-		config.DefaultPipelineConfigSearchPaths = origPipelineDefaults
-	})
+	deps, missingPath, executor := guardedMissingPipelineDiscovery(t)
 
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
-	code := Execute([]string{"session", "init", "2026-06-07", "--remote"}, &stdout, &stderr)
+	code := executeWithDependencies([]string{"session", "init", "2026-06-07", "--remote"}, &stdout, &stderr, deps, executor)
 	if code == 0 {
 		t.Fatal("exit code = 0, want non-zero")
 	}
-	if !strings.Contains(stderr.String(), "session init: no pipeline config path provided and no default pipeline config found; searched:") {
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty", stdout.String())
+	}
+	if got := stderr.String(); !strings.Contains(got, "session init: no pipeline config path provided") ||
+		!strings.Contains(got, "no default pipeline config found") || !strings.Contains(got, missingPath) {
 		t.Fatalf("stderr = %q, want default pipeline searched-path error", stderr.String())
 	}
 }

internal/app/operator_session_init.go

@@ -27,7 +27,7 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 	fs := flag.NewFlagSet("session init", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var pipelinePath, campaignPath, campaignFilePath, sessionID, previousSessionID, date, title, output, audioS3Prefix, audioDir string
-	var profile singletonStringFlag
+	var overlay singletonStringFlag
 	var secretsDir singletonStringFlag
 	var remote, force bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
@@ -40,8 +40,8 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 	fs.StringVar(&output, "output", "", "local output session.yml path")
 	fs.StringVar(&audioS3Prefix, "audio-s3-prefix", "", "session audio S3 prefix")
 	fs.StringVar(&audioDir, "audio-dir", "", "local audio directory")
-	profile.name = "profile"
-	fs.Var(&profile, "profile", "named pipeline profile")
+	overlay.name = "overlay"
+	fs.Var(&overlay, "overlay", "named pipeline overlay")
 	secretsDir.name = "secrets-dir"
 	fs.Var(&secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.BoolVar(&remote, "remote", false, "write session.yml to S3 session prefix")
@@ -59,7 +59,7 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 		return fmt.Errorf("session init: --audio-dir and --audio-s3-prefix are mutually exclusive")
 	}
 
-	base, err := loadPipelineCampaignConfigWithDependencies(pipelinePath, campaignPath, campaignFilePath, config.PipelineLoadOptions{Profile: profile.pointer()}, secretsDir.pointer(), deps)
+	base, err := loadPipelineCampaignConfigWithDependencies(pipelinePath, campaignPath, campaignFilePath, config.PipelineLoadOptions{Overlay: overlay.pointer()}, secretsDir.pointer(), deps)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}

internal/app/overlay_commands_test.go

@@ -11,10 +11,10 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 
-func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
+func TestRunOverlaySelectionFlowsThroughSharedLoader(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
 	var language string
 	executor := func(_ context.Context, cfg *config.Config, _ BoundedPlan, _ RunOptions) (*RunSummary, error) {
@@ -23,12 +23,17 @@ func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
-		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "testing",
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", "testing",
 	}, io.Discard, executor); err != nil {
 		t.Fatal(err)
 	}
 	if language != "fr" {
-		t.Fatalf("explicit profile language = %q, want fr", language)
+		t.Fatalf("explicit overlay language = %q, want fr", language)
+	}
+	if err := runWithPipelineExecutor(context.Background(), []string{
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "testing",
+	}, io.Discard, executor); err == nil {
+		t.Fatal("retired pipeline selector was accepted")
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
@@ -40,25 +45,25 @@ func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
 		t.Fatalf("base configuration language = %q, want en", language)
 	}
 
-	for _, profile := range []string{"unknown"} {
+	for _, overlay := range []string{"unknown"} {
 		err := runWithPipelineExecutor(context.Background(), []string{
-			"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", profile,
+			"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", overlay,
 		}, io.Discard, executor)
-		if err == nil || !strings.Contains(err.Error(), "profile") {
-			t.Fatalf("profile %q error = %v, want selection rejection", profile, err)
+		if err == nil || !strings.Contains(err.Error(), "overlay") {
+			t.Fatalf("overlay %q error = %v, want selection rejection", overlay, err)
 		}
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
-		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "",
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", "",
 	}, io.Discard, executor); err != nil {
-		t.Fatalf("explicit empty profile should select base: %v", err)
+		t.Fatalf("explicit empty overlay should select base: %v", err)
 	}
 }
 
-func enableCommandTestProfiles(t *testing.T, pipelinePath string) {
+func enableCommandTestOverlays(t *testing.T, pipelinePath string) {
 	t.Helper()
-	dir := filepath.Join(filepath.Dir(pipelinePath), "profiles")
+	dir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}

internal/app/pipeline_config_path_test.go

@@ -1,10 +1,16 @@
 package app
 
 import (
+	"bytes"
+	"context"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 
 func TestResolvePipelineConfigPathWithCandidatesExplicitWins(t *testing.T) {
@@ -55,11 +61,57 @@ func TestResolvePipelineConfigPathWithCandidatesPrecedence(t *testing.T) {
 }
 
 func TestResolvePipelineConfigPathWithCandidatesMissing(t *testing.T) {
-	_, err := resolvePipelineConfigPathWithCandidates("", []string{"/does/not/exist/one.yml", "/does/not/exist/two.yml"})
+	directory := t.TempDir()
+	first := filepath.Join(directory, "one.yml")
+	second := filepath.Join(directory, "two.yml")
+	_, err := resolvePipelineConfigPathWithCandidates("", []string{first, second})
 	if err == nil {
 		t.Fatal("expected error, got nil")
 	}
 	if !strings.Contains(err.Error(), "no default pipeline config found") {
 		t.Fatalf("error = %q, want missing-defaults context", err.Error())
 	}
+	if !strings.Contains(err.Error(), first) || !strings.Contains(err.Error(), second) {
+		t.Fatalf("error = %q, want controlled searched paths", err.Error())
+	}
+}
+
+func TestExecuteMissingExplicitConfigDiscoversExistingDefaultBeforeLoading(t *testing.T) {
+	directory := t.TempDir()
+	missing := filepath.Join(directory, "missing.yml")
+	existing := filepath.Join(directory, "pipeline.yml")
+	if err := os.WriteFile(existing, []byte("workspace:\n  root: ./tmp\n"), 0o644); err != nil {
+		t.Fatalf("write default pipeline: %v", err)
+	}
+
+	controlledErr := errors.New("controlled pipeline loader boundary")
+	loadedPath := ""
+	deps := commandDependenciesForPipelineCandidates(missing, existing)
+	deps.loadPipelineConfig = func(path string, _ config.PipelineLoadOptions) (*config.PipelineConfig, error) {
+		loadedPath = path
+		return nil, controlledErr
+	}
+	deps.loadSecretsDir = func(string) (*configkit.SecretsReport, error) {
+		t.Fatal("absent conventional secrets directory unexpectedly invoked bootstrap loader")
+		return nil, nil
+	}
+
+	var stdout bytes.Buffer
+	var stderr bytes.Buffer
+	code := executeWithDependencies([]string{"config", "validate"}, &stdout, &stderr, deps, func(context.Context, *config.Config, BoundedPlan, RunOptions) (*RunSummary, error) {
+		t.Fatal("config validation unexpectedly invoked pipeline executor")
+		return nil, nil
+	})
+	if code == 0 {
+		t.Fatal("exit code = 0, want controlled loader failure")
+	}
+	if loadedPath != existing {
+		t.Fatalf("loader path = %q, want discovered default %q", loadedPath, existing)
+	}
+	if stdout.Len() != 0 {
+		t.Fatalf("stdout = %q, want empty", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), controlledErr.Error()) {
+		t.Fatalf("stderr = %q, want controlled loader error", stderr.String())
+	}
 }

internal/app/provider_credentials_integration_test.go

@@ -0,0 +1,280 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
+	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
+)
+
+const (
+	sharedProviderName = "NARRATIO_SHARED_PROVIDER_KEY"
+	auditaOnlyName     = "NARRATIO_AUDITA_ONLY_KEY"
+	sharedProviderKey  = "synthetic-shared-provider-value"
+	auditaOnlyKey      = "synthetic-audita-only-value"
+)
+
+func TestCommandsShareProviderCredentialAcrossAdapters(t *testing.T) {
+	configDir := t.TempDir()
+	workspace := t.TempDir()
+	secretsDir := filepath.Join(configDir, "secrets")
+	for name, value := range map[string]string{
+		sharedProviderName: sharedProviderKey,
+		auditaOnlyName:     auditaOnlyKey,
+	} {
+		restoreEnvAfterTest(t, name)
+		if err := os.Unsetenv(name); err != nil {
+			t.Fatal(err)
+		}
+		mustWriteSecretFile(t, filepath.Join(secretsDir, name), value+"\n")
+	}
+	fixture := writeProviderProcessWrapper(t)
+	seriatim := writeSeriatimAppTestWrapper(t)
+	configPath := filepath.Join(configDir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, configDir)
+	sessionPath := filepath.Join(configDir, "session.yml")
+	notariusConfig := filepath.Join(configDir, "notarius.yml")
+	mustWriteTestFile(t, notariusConfig, "pipelines: {}\n")
+	mustWriteTestFile(t, configPath, `workspace:
+  root: `+workspace+`
+storage:
+  backend: local
+whisperx:
+  transcribe_url: https://example.com/transcribe
+seriatim:
+  binary: `+seriatim+`
+audita:
+  binary: `+fixture+`
+  credentials: [`+sharedProviderName+`, `+auditaOnlyName+`]
+scriptorium:
+  binary: `+fixture+`
+  credentials: [`+sharedProviderName+`]
+  render_debug: true
+  artifacts:
+    recap:
+      enabled: true
+      prompt_id: recap
+      output_path: artifacts/recap.md
+      inputs:
+        transcript:
+          source: narratio.transcript.final_trimmed
+notarius:
+  enabled: true
+  binary: `+fixture+`
+  config_path: `+notariusConfig+`
+  pipeline_id: dnd-session
+  credentials: [`+sharedProviderName+`]
+  outputs:
+    npc_registry:
+      lane_id: npc-registry
+      media_type: application/json
+      schema_id: notarius.dnd.npc_registry
+      schema_version: v1
+      module_key: dnd/npc-registry
+notification:
+  mode: noop
+`)
+	mustWriteTestFile(t, sessionPath, `session_id: 2026-05-03
+campaign: sample-campaign
+inputs:
+  audio_dir: ./audio
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+`)
+
+	var stdout, stderr bytes.Buffer
+	if code := Execute([]string{"config", "show", "--config", configPath}, &stdout, &stderr); code != 0 {
+		t.Fatalf("config show exit = %d; stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), sharedProviderName) || !strings.Contains(stdout.String(), auditaOnlyName) {
+		t.Fatalf("config show omitted reference names: %q", stdout.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+
+	workRoot := filepath.Join(workspace, "work", "sample-campaign", "2026-05-03")
+	manifestPath := filepath.Join(workRoot, "manifest.json")
+	basePath := filepath.Join(workRoot, "transcripts", "base.json")
+	mustWriteTestFile(t, basePath, `{"schema":"seriatim-intermediate","segments":[]}`)
+	seedCurrentBuiltInEvidence(t, manifestPath, "2026-05-03", "sample-campaign", "merge", artifacts.TranscriptOutputKindBase, artifacts.ArtifactTranscriptBase, basePath)
+	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "[]\n")
+	args := []string{"--config", configPath, "--campaign-file", campaignPath, "--session", sessionPath}
+	stdout.Reset()
+	stderr.Reset()
+	if code := Execute(append([]string{"run-stage", "polish", "2026-05-03", "--force"}, args...), &stdout, &stderr); code != 0 {
+		t.Fatalf("polish exit = %d; stderr=%q", code, stderr.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+	m, err := (&manifest.LocalStore{}).Load(context.Background(), manifestPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if polish := m.Stages["polish"]; polish == nil || len(polish.Outputs) != 1 || len(polish.Logs) != 5 {
+		t.Fatalf("polish did not retain canonical transcript and ordinary reports: %#v", polish)
+	}
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		found := false
+		for _, path := range m.Stages["polish"].Logs {
+			found = found || filepath.Base(path) == name
+		}
+		if !found {
+			t.Fatalf("missing polish report %q", name)
+		}
+	}
+
+	trimmedPath := filepath.Join(workRoot, "transcripts", "final.trimmed.json")
+	mustWriteTestFile(t, trimmedPath, `{"segments":[]}`)
+	setCurrentBuiltInEvidence(t, m, "trim", artifacts.TranscriptOutputKindFinalTrimmed, artifacts.ArtifactTranscriptFinalTrimmed, trimmedPath)
+	if err := (&manifest.LocalStore{}).Save(context.Background(), manifestPath, m); err != nil {
+		t.Fatal(err)
+	}
+	stdout.Reset()
+	stderr.Reset()
+	if code := Execute(append([]string{"run-stage", "extract", "2026-05-03", "--force"}, args...), &stdout, &stderr); code != 0 {
+		t.Fatalf("extract exit = %d; stderr=%q", code, stderr.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+	if !strings.Contains(stdout.String(), "stage=extract executed=1") {
+		t.Fatalf("extract did not execute: %q", stdout.String())
+	}
+	redactedLogs := 0
+	stdout.Reset()
+	stderr.Reset()
+	if code := Execute(append([]string{"analyze", "2026-05-03"}, args...), &stdout, &stderr); code != 0 {
+		t.Fatalf("analyze exit = %d; stderr=%q", code, stderr.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+	if err := filepath.WalkDir(workRoot, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil || entry.IsDir() {
+			return walkErr
+		}
+		data, err := os.ReadFile(path)
+		if err == nil {
+			assertNoProviderValues(t, data)
+			if strings.HasSuffix(path, ".stderr.log") && bytes.Contains(data, []byte("<redacted>")) {
+				redactedLogs++
+			}
+		}
+		return err
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if redactedLogs < 4 {
+		t.Fatalf("redacted subprocess logs = %d, want Audita, Notarius and Scriptorium run/render", redactedLogs)
+	}
+}
+
+func assertNoProviderValues(t *testing.T, content ...[]byte) {
+	t.Helper()
+	for _, data := range content {
+		if bytes.Contains(data, []byte(sharedProviderKey)) || bytes.Contains(data, []byte(auditaOnlyKey)) {
+			t.Fatal("credential value appeared in inspection or workspace output")
+		}
+	}
+}
+
+func writeProviderProcessWrapper(t *testing.T) string {
+	t.Helper()
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "provider-process.sh")
+	if err := os.WriteFile(path, []byte("#!/bin/sh\nexec \""+exe+"\" -test.run=TestProviderCredentialProcessFixture -- \"$@\"\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestProviderCredentialProcessFixture(t *testing.T) {
+	if !appHelperInvocation() {
+		return
+	}
+	start := -1
+	for i, arg := range os.Args {
+		if arg == "--" {
+			start = i + 1
+			break
+		}
+	}
+	if start < 0 || start >= len(os.Args) {
+		os.Exit(2)
+	}
+	args := os.Args[start:]
+	if os.Getenv(sharedProviderName) != sharedProviderKey {
+		_, _ = os.Stderr.WriteString("shared credential not forwarded\n")
+		os.Exit(2)
+	}
+	if appSeriatimFlagValue(args, "--prompt") != "" {
+		if _, present := os.LookupEnv(auditaOnlyName); present {
+			os.Exit(2)
+		}
+		if appSeriatimFlagValue(args, "--api-key-env") != "" {
+			os.Exit(2)
+		}
+		output := appSeriatimFlagValue(args, "--out")
+		if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+			os.Exit(2)
+		}
+		if err := os.WriteFile(output, []byte("{}\n"), 0o644); err != nil {
+			os.Exit(2)
+		}
+		_, _ = os.Stdout.WriteString(sharedProviderKey + "\n")
+		_, _ = os.Stderr.WriteString(sharedProviderKey + "\n")
+		os.Exit(0)
+	}
+	switch args[0] {
+	case "process":
+		if os.Getenv(auditaOnlyName) != auditaOnlyKey {
+			_, _ = os.Stderr.WriteString("Audita-only credential not forwarded\n")
+			os.Exit(2)
+		}
+		output := appSeriatimFlagValue(args, "--output")
+		if output == "" {
+			os.Exit(2)
+		}
+		if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+			os.Exit(2)
+		}
+		if err := os.WriteFile(output, []byte(`{"schema":"audita.processed.v1","segments":[]}`), 0o644); err != nil {
+			os.Exit(2)
+		}
+		for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+			if err := os.WriteFile(filepath.Join(filepath.Dir(output), name), []byte("status: completed\n"), 0o644); err != nil {
+				os.Exit(2)
+			}
+		}
+	case "run":
+		if _, present := os.LookupEnv(auditaOnlyName); present {
+			_, _ = os.Stderr.WriteString("Audita-only credential reached Notarius\n")
+			os.Exit(2)
+		}
+		root := appSeriatimFlagValue(args, "--output-dir")
+		bundle := filepath.Join(root, "fixture-run")
+		if err := os.MkdirAll(filepath.Join(bundle, "lanes"), 0o755); err != nil {
+			os.Exit(2)
+		}
+		for name, value := range map[string]string{
+			"manifest.json": "{}", "rejected.json": `{"rejected":[]}`,
+			"warnings.json":    `{"schema_version":"notarius.warnings.v2","group_count":0,"occurrence_count":0,"groups":[]}`,
+			"diagnostics.json": `{"schema_version":"notarius.diagnostics.v1","group_count":0,"occurrence_count":0,"truncated":false,"unrepresented_occurrence_count":0,"groups":[]}`,
+			"lanes/npc.json":   `{"records":[]}`,
+			"index.json":       `{"manifest_file":"manifest.json","output_files":[{"lane_id":"npc-registry","file":"lanes/npc.json","media_type":"application/json","module_key":"dnd/npc-registry","schema_id":"notarius.dnd.npc_registry","schema_version":"v1"}],"rejected_file":"rejected.json","warnings_file":"warnings.json","diagnostics_file":"diagnostics.json"}`,
+		} {
+			if err := os.WriteFile(filepath.Join(bundle, filepath.FromSlash(name)), []byte(value), 0o644); err != nil {
+				os.Exit(2)
+			}
+		}
+		_, _ = os.Stdout.WriteString(fmt.Sprintf(`{"schema_version":"notarius.run-result.v2","run_id":"fixture-run","pipeline_id":"dnd-session","output_directory":%q,"index_file":"index.json","normalized_output_count":1,"rejected_output_count":0,"warning_group_count":0,"warning_occurrence_count":0,"diagnostic_group_count":0,"diagnostic_occurrence_count":0,"diagnostics_truncated":false,"validation_status":"approved"}`, bundle))
+	default:
+		os.Exit(2)
+	}
+	_, _ = os.Stderr.WriteString(sharedProviderKey + "\n")
+	os.Exit(0)
+}

internal/app/regenerate_artifacts_test.go

@@ -14,7 +14,7 @@ import (
 func TestRegenerateArtifactsForwardsCanonicalPipelineRequest(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 	var capturedPlan BoundedPlan
 	var capturedOptions RunOptions
 	executor := func(_ context.Context, cfg *config.Config, plan BoundedPlan, options RunOptions) (*RunSummary, error) {
@@ -30,7 +30,7 @@ func TestRegenerateArtifactsForwardsCanonicalPipelineRequest(t *testing.T) {
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
-		"--profile", "testing",
+		"--overlay", "testing",
 	}, io.Discard, io.Discard, executor)
 	if code != 0 {
 		t.Fatalf("executeWithPipelineExecutor() code = %d, want 0", code)

internal/app/restore_commit_test.go

@@ -44,6 +44,28 @@ func TestCommittedRestorePlanUsesOnlyDeclaredObjects(t *testing.T) {
 	}
 }
 
+func TestCommittedRestoreDoesNotRequirePolishRunDiagnostics(t *testing.T) {
+	cfg := restorePlanConfig(t)
+	fake := &storage.FakeBackend{}
+	current := seedCommittedRestoreSnapshot(t, cfg, fake, "20260519T010203Z-a1b2c3d4", map[string][]byte{
+		"transcripts/full.json": []byte(`{"segments":[]}`),
+	})
+	diagnostic := filepath.Join(cfg.Pipeline.Workspace.Root, "runs", current.RunID, "polish", "outputs", "transcripts", "errors.yml")
+	current.Manifest.Stages["polish"] = &manifest.StageRecord{
+		Name: "polish", Status: manifest.StatusSucceeded,
+		Logs: []string{diagnostic},
+	}
+	plan, err := buildRestorePlan(context.Background(), cfg, current, fake, RestorePlanOptions{})
+	if err != nil {
+		t.Fatalf("buildRestorePlan() error = %v", err)
+	}
+	for _, action := range plan.Actions {
+		if strings.Contains(action.LocalRelativePath, "errors.yml") {
+			t.Fatalf("diagnostic became a required restore target: %#v", action)
+		}
+	}
+}
+
 func TestCommittedRestoreDownloadsCarriedOutputFromDeclaredRun(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	fake := &storage.FakeBackend{}

internal/app/restore_execution_test.go

@@ -82,6 +82,28 @@ func TestExecuteRestoreRoundTripsPublishedExtractionAndManifestMetadata(t *testi
 	remoteManifest.RunID = "20260519T010203Z-a1b2c3d4"
 	producerRoot := "/prior/workspace/work/sample-campaign/2026-05-03"
 	remoteManifest.LocalWorkDir = filepath.Join(producerRoot, "runs", remoteManifest.RunID)
+	rawRelative := "transcripts/raw/alice.json"
+	rawOutput := manifest.ArtifactRecord{
+		Kind: "transcript_raw", LocalPath: filepath.Join(producerRoot, filepath.FromSlash(rawRelative)),
+		ProducerRunID: remoteManifest.RunID, Checksum: strings.Repeat("b", 64),
+	}
+	remoteManifest.MarkStageSucceeded("transcribe", time.Now().UTC(), []manifest.ArtifactRecord{rawOutput})
+	remoteManifest.Stages["transcribe"].TranscribeStateVersion = manifest.TranscribeStateContractVersion
+	remoteManifest.Stages["transcribe"].TranscribeSpeakers = map[string]manifest.TranscribeSpeakerRecord{
+		"alice": {
+			FingerprintVersion: manifest.TranscribeFingerprintContractVersion,
+			Fingerprint:        strings.Repeat("c", 64),
+			AudioPath:          "audio/alice.flac",
+			AudioSHA256:        strings.Repeat("a", 64),
+			AudioSize:          12,
+			Output: manifest.ArtifactRecord{
+				Kind: "transcript_raw", LocalPath: rawRelative,
+				ProducerRunID: remoteManifest.RunID, Checksum: strings.Repeat("b", 64),
+			},
+			OutputSize:    15,
+			ProducerRunID: remoteManifest.RunID,
+		},
+	}
 	remoteManifest.Stages["extract"] = &manifest.StageRecord{
 		Name: "extract", Status: manifest.StatusSucceeded,
 		Outputs: []manifest.ArtifactRecord{{
@@ -121,6 +143,13 @@ func TestExecuteRestoreRoundTripsPublishedExtractionAndManifestMetadata(t *testi
 	if want := filepath.Join(sessionRoot, "artifacts", "encounters.json"); lane.LocalPath != want {
 		t.Fatalf("rebased extraction path = %q, want %q", lane.LocalPath, want)
 	}
+	speaker := restored.Stages["transcribe"].TranscribeSpeakers["alice"]
+	if speaker.AudioPath != "audio/alice.flac" || speaker.Output.LocalPath != rawRelative {
+		t.Fatalf("restored speaker paths = %#v, want session-relative paths", speaker)
+	}
+	if _, err := os.Stat(filepath.Join(sessionRoot, filepath.FromSlash(rawRelative))); !os.IsNotExist(err) {
+		t.Fatalf("unpublished raw transcript should not be restored; stat err=%v", err)
+	}
 }
 
 func TestExecuteRestoreIncludeAudioRestoresAudio(t *testing.T) {

internal/app/restore_plan_test.go

@@ -24,6 +24,7 @@ func TestRestorePlanDefaultScope(t *testing.T) {
 	seedCurrentRestoreObject(t, store, current, current.SessionPrefix+"audio/alice.flac", []byte("audio"))
 	seedRestoreObject(store, current.SessionPrefix+"runs/20260519T010203Z-a1b2/manifest.json", []byte("{}"))
 	seedRestoreObject(store, current.SessionPrefix+"logs/publish.log", []byte("log"))
+	seedRestoreObject(store, current.SessionPrefix+"cache/notarius/references/ignored/party.yml", []byte("cache"))
 
 	plan, err := buildRestorePlan(context.Background(), cfg, current, store, RestorePlanOptions{})
 	if err != nil {