Update COPYRIGHT and LICENSE contents to align with the house standard

.gitignore

@@ -1,6 +1,5 @@
 # ---> Codex
 .codex
-AGENTS.md
 
 .DS_Store
 
@@ -52,4 +51,3 @@ pipeline.yml
 
 # Built Visual Studio Code Extensions
 *.vsix
-

AGENTS.md

@@ -0,0 +1,5 @@
+Please review `docs/development.md` for initial orientation in this repository
+and follow its task-specific reading guide.
+
+Review and follow `docs/policy/agents.md` before recommending, planning, or
+implementing any changes to this repository.

COPYRIGHT

@@ -0,0 +1,19 @@
+Narratio
+
+Copyright (C) 2026 Eric Rakestraw
+
+SPDX-License-Identifier: GPL-3.0-or-later
+
+Narratio is free software: you can redistribute it and/or modify it
+under the terms of the GNU Lesser General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+The GNU General Public License version 3 is provided in LICENSE.
+
+Narratio is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Lesser General Public License for more details.
+
+Third-party code and assets are subject to their respective license terms.

LICENSE

@@ -1,232 +1,674 @@
-GNU GENERAL PUBLIC LICENSE
-Version 3, 29 June 2007
-
-Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-Preamble
-
-The GNU General Public License is a free, copyleft license for software and other kinds of works.
-
-The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
-
-When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
-
-To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
-
-For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
-
-Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
-
-For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
-
-Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
-
-Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
-
-The precise terms and conditions for copying, distribution and modification follow.
-
-TERMS AND CONDITIONS
-
-0. Definitions.
-
-“This License” refers to version 3 of the GNU General Public License.
-
-“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
-
-“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
-
-To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
-
-A “covered work” means either the unmodified Program or a work based on the Program.
-
-To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
-
-To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
-
-An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
-
-1. Source Code.
-The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
-
-A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
-
-The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
-
-The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
-
-The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
-
-The Corresponding Source for a work in source code form is that same work.
-
-2. Basic Permissions.
-All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
-
-You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
-
-Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
-
-3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
-
-When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
-
-4. Conveying Verbatim Copies.
-You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
-
-You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
-
-5. Conveying Modified Source Versions.
-You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
-
-     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
-
-     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
-
-     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
-
-     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
-
-A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
-
-6. Conveying Non-Source Forms.
-You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
-
-     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
-
-     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
-
-     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
-
-     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
-
-     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
-
-A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
-
-A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
-
-“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
-
-If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
-
-The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
-
-Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
-
-7. Additional Terms.
-“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
-
-When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
-
-Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
-
-     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
-
-     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
-
-     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
-
-     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
-
-     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
-
-     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
-
-All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
-
-If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
-
-Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
-
-8. Termination.
-You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
-
-However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
-
-Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
-
-Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
-
-9. Acceptance Not Required for Having Copies.
-You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
-
-10. Automatic Licensing of Downstream Recipients.
-Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
-
-An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
-
-You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
-
-11. Patents.
-A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
-
-A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
-
-Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
-
-In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
-
-If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
-
-If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
-
-A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
-
-Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
-
-12. No Surrender of Others' Freedom.
-If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
-
-13. Use with the GNU Affero General Public License.
-Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
-
-14. Revised Versions of this License.
-The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
-
-If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
-
-Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
-
-15. Disclaimer of Warranty.
-THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. Limitation of Liability.
-IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-17. Interpretation of Sections 15 and 16.
-If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Programs
-
-If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
-
-To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
-
-     narratio
-     Copyright (C) 2026  eric
-
-     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
-
-     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
-
-     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
-If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
 
-     narratio  Copyright (C) 2026  eric
-     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
 
-The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
 
-You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
 
-The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

docs/cli.md

@@ -44,7 +44,7 @@ Most session-aware commands accept:
 - `--session <session.yml>`
 - `--session-id <session_id>`
 - `--previous-session-id <session_id>`
-- `--profile <name>`
+- `--overlay <name>`
 - `--secrets-dir <directory>`
 
 Rules:
@@ -54,9 +54,9 @@ Rules:
 - if both positional `<session_id>` and `--session-id` are provided, values must match.
 - `--previous-session-id` is a strict expectation: the selected session file
   must contain the same `previous_session_id`.
-- `--profile` selects `profiles/<name>.yml` relative to the pipeline root. It
+- `--overlay` selects `overlays/<name>.yml` relative to the pipeline root. It
   may be supplied once; omitted, empty, and the exact name `default` select the
-  base configuration, while an unknown named profile fails. The same selection
+  base configuration, while an unknown named overlay fails. The same selection
   applies to all common-flag commands, including `regenerate-artifacts`.
 - `--secrets-dir` selects ConfigKit credential-file bootstrap explicitly. A
   relative value uses caller CWD. Without the flag, a present `secrets/`
@@ -85,20 +85,20 @@ Commands with additional positionals keep their command-specific order:
 ### `config validate`, `config show`, `config sources`, `config artifacts`, and `config diff`
 
 ```bash
-narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <directory>]
-narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
+narratio config validate [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config show [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config sources [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config artifacts [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <directory>]
+narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <directory>]
 ```
 
-These commands resolve the selected profile, defaults, ordinary paths, and—if
+These commands resolve the selected overlay, defaults, ordinary paths, and—if
 a campaign is selected—the campaign-owned party. They neither discover or load
 a session nor create a workspace, manifest, run, lock, adapter, or remote
 connection. Like every pipeline-loading command, they bootstrap the selected or
 conventional secrets directory before resolving configuration; `config show`
 never includes bootstrap reports or secret values in its YAML output.
-Typed credential references, including `notarius.llm_api_key`, must therefore
+Typed credential references, including `notarius.credentials[]`, must therefore
 resolve even though these inspection commands never construct an adapter.
 
 Campaign selection is optional for a pipeline without party-driven artifact
@@ -107,7 +107,7 @@ configured default campaign so Narratio can expand its concrete artifacts and
 publish rules. `--campaign` and `--campaign-file` remain mutually exclusive.
 Session, range, force, and artifact-execution flags are not accepted.
 
-`config validate` writes a concise root-path, selected-profile (or `none`), and
+`config validate` writes a concise root-path, selected-overlay (or `none`), and
 effective-digest summary after successful complete validation. `config show`
 writes one deterministic, secret-free YAML document containing defaulted and
 expanded concrete configuration. It omits ConfigKit directives, artifact
@@ -115,9 +115,9 @@ family declarations, and runtime provenance.
 
 `config sources` reports the same fully validated resolution without printing
 effective values. Its header identifies the root, ordered imports, selected
-profile and overlay, selected campaign, party source, and digest. The
+overlay and its file, selected campaign, party source, and digest. The
 remaining tab-separated records are sorted as `path`, `role`, and `source`.
-Roles distinguish root, import, profile, centralized default, campaign, party,
+Roles distinguish root, import, overlay, centralized default, campaign, party,
 and generated family ownership. A generated party member has
 one family record and one party record at the same logical path. The output
 never reads or prints secret values.
@@ -133,14 +133,14 @@ party-driven families retain the campaign requirement. See
 [Scriptorium Artifact Entries](./config.md#scriptorium-artifact-entries) for the
 configuration layout.
 
-`config diff` resolves both supplied profile names independently and compares
+`config diff` resolves both supplied overlay names independently and compares
 their fully resolved, secret-free effective mappings. It does
-not accept `--profile`; the two positional names must be distinct, declared
-profiles. When party-driven families are present, both profiles must resolve to
-the same selected campaign and party. Use `--campaign-file` if profile-specific
+not accept `--overlay`; the two positional names must be distinct, valid
+overlays. When party-driven families are present, both overlays must resolve to
+the same selected campaign and party. Use `--campaign-file` if overlay-specific
 campaign configuration would otherwise select different files.
 
-Equal profiles print `no differences`. Otherwise, sorted tab-separated records
+Equal overlays print `no differences`. Otherwise, sorted tab-separated records
 use one of these forms, with compact JSON values:
 
 ```text
@@ -151,7 +151,7 @@ changed  <path>    <left-value>    <right-value>
 
 Mappings are flattened to their logical field paths; lists remain one atomic
 value. The command compares defaulted concrete artifacts and publish rules, not
-profile names, source-file layout, or formatting. It succeeds when differences
+overlay names, source-file layout, or formatting. It succeeds when differences
 are found, making it suitable for review and migration checks.
 
 ### `version`
@@ -178,7 +178,7 @@ Behavior:
 - runs `render` before `extract`; an omitted or disabled Notarius
   configuration records an explicit `notarius_disabled` self-skip;
 - resolves every selected typed credential during the initial configuration
-  load, including a Notarius credential when extract is disabled, outside the
+  load, including Notarius credentials when extract is disabled, outside the
   selected range, or later skipped as resumable;
 - skips already-succeeded stages unless `--force` is set or a stage-specific
   resume check finds its durable result obsolete;
@@ -189,7 +189,7 @@ Behavior:
 - writes the session manifest as the sole durable progress ledger. Each
   invocation also creates its run-local directory and returns an immediate
   command summary; neither creates another durable progress record.
-- reports the resolved profile (or `none`) and effective configuration digest.
+- reports the resolved overlay (or `none`) and effective configuration digest.
 
 When `--artifacts` is present, the selected range must contain `analyze` or
 `publish`. Either consumer is sufficient, including a one-stage range.
@@ -304,7 +304,7 @@ Uses the same inclusive bounds, endpoint validation, force scope, and artifact
 selection contract as `run`. It validates config and prints run/skip decisions
 for selected stages only without creating the local workdir or changing the
 manifest. Resume-capable selected stages are checked against durable evidence.
-The output includes the resolved profile (or `none`) and effective configuration
+The output includes the resolved overlay (or `none`) and effective configuration
 digest without writing provenance or any manifest state.
 For `analyze`, the preview also lists explicit targets, prerequisite-only work,
 execution order, and reusable current artifacts with concise reasons. These

docs/config.md

@@ -47,24 +47,24 @@ the durable copied session input.
 `narratio config validate`, `narratio config show`, `narratio config sources`,
 and `narratio config artifacts` use the same `--config`, `--campaign`,
 `--campaign-file`, and
-`--profile` selection rules as pipeline commands, but do not select, discover,
+`--overlay` selection rules as pipeline commands, but do not select, discover,
 or load a session. They resolve configured typed credential references as part
 of the ordinary ConfigKit load but expose only their environment-variable names;
 they do not create runtime state.
-`narratio config diff <left-profile> <right-profile>` uses the same pipeline and
-campaign selectors, resolves each named profile with an independent ConfigKit
-load, and does not accept a separate `--profile` flag.
+`narratio config diff <left-overlay> <right-overlay>` uses the same pipeline and
+campaign selectors, resolves each named overlay with an independent ConfigKit
+load, and does not accept a separate `--overlay` flag.
 
 Campaign selection is optional only when the resolved pipeline has no
 `scriptorium.artifact_families`. When families are declared, Narratio selects a
 campaign through an explicit flag or `pipeline.campaigns.default_campaign_id`,
 then parses the campaign-owned party and expands concrete artifacts and any
 family publish rules before validation. `config validate` prints the resulting
-root, profile, and effective digest. `config show` emits the normalized
+root, overlay, and effective digest. `config show` emits the normalized
 effective pipeline YAML, with defaults and concrete expansion included but
 ConfigKit directives and family declarations omitted. This review projection is
 not promised to be a reloadable authoring document. `config sources` prints a stable
-source projection instead of effective values: root/import/profile/default
+source projection instead of effective values: root/import/overlay/default
 ownership plus campaign/party and generated-family records. Canonical derived
 players trace to the party. `config artifacts` lists the concrete artifact map,
 effective dependencies, and defining sources. The [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
@@ -83,7 +83,7 @@ difference.
 Use the [production/testing bundle](../examples/production-testing/pipeline.yml)
 as the complete copyable migration reference. Keep production settings in the
 base, split them into explicit additive imports, and place testing differences
-in the fixed `profiles/testing.yml` overlay. Put ordinary artifacts and families
+in the fixed `overlays/testing.yml` overlay. Put ordinary artifacts and families
 in the recommended one-definition files shown by that bundle. Convert campaign
 rosters to [canonical party input](integrations/party.md), then express character
 work as families. Inspect the result with `config validate`, `config show`,
@@ -108,11 +108,14 @@ remote state with an unsafe legacy identity must be migrated before use.
   root-only `configkit.imports` list. Imported files contribute fields to one
   logical pipeline document; they do not override fields supplied by the root
   or another import.
-- An omitted profile, an empty profile option, and the exact name `default`
+- An omitted overlay, an empty overlay option, and the exact name `default`
   select the base configuration. Any other name selects
-  `profiles/<name>.yml` relative to the pipeline root.
+  `overlays/<name>.yml` relative to the pipeline root. Move previously selected
+  `profiles/<name>.yml` files there; the old directory is not searched, and
+  `--profile` is no longer accepted for Narratio pipeline selection. Explicit
+  imports from a directory named `profiles` remain valid.
 - Campaign, session, and canonical-party documents are strict single-source
-  ConfigKit schemas. They do not enable imports, profiles, or `configkit`
+  ConfigKit schemas. They do not enable imports, overlays, or `configkit`
   directives.
 - Configured timeout and retry-delay durations must be positive. An omitted
   artifact timeout continues to inherit its configured Scriptorium timeout.
@@ -137,10 +140,10 @@ remote state with an unsafe legacy identity must be migrated before use.
   - local (`audio_dir` or `audio_files`), or
   - S3 (`audio_s3.prefix`).
 
-### Pipeline imports and profiles
+### Pipeline imports and overlays
 
 Large pipeline configurations may be split into explicitly named fragments and
-may use fixed-path profile overlays:
+may use fixed-path selected overlays:
 
 ```yaml
 configkit:
@@ -170,12 +173,12 @@ name the full field path and every source that claimed it. Narratio additionally
 rejects an artifact or artifact-family key declared by more than one base file,
 even when those files contribute disjoint children.
 
-Profile names are case-sensitive and use ConfigKit's safe fixed-path naming
+Overlay names are case-sensitive and use ConfigKit's safe fixed-path naming
 rules. Only the selected overlay is opened; a malformed unselected overlay does
-not affect a base or different-profile load. Maps merge recursively, overlay
+not affect a base or different-overlay load. Maps merge recursively, overlay
 scalars replace base scalars, and overlay lists replace base lists completely.
 Explicit `false`, zero, empty strings, empty containers, and null values remain
-explicit inputs and are not refilled by defaults. Profiles cannot inherit,
+explicit inputs and are not refilled by defaults. Overlays cannot inherit,
 stack, import files, or declare another ConfigKit control section.
 
 During ConfigKit loading, Narratio applies fresh typed defaults, recorded
@@ -183,7 +186,7 @@ entry-level defaults and normalization, read-only file-local validation, and
 ordinary path resolution before computing a deterministic effective
 configuration digest. The digest represents the normalized, secret-free
 runtime pipeline mapping; it excludes ConfigKit directives, source
-provenance, profile identity, and raw environment secret values. Equivalent
+provenance, overlay identity, and raw environment secret values. Equivalent
 effective mappings therefore have the same digest regardless of how fields are
 split among the root and imports.
 
@@ -227,7 +230,7 @@ inputs:
 - Do not place raw secrets in YAML.
 - Credential fields contain environment-variable names, represented internally
   as ConfigKit typed secret references (for example
-  `pipeline.notarius.llm_api_key: NOTARIUS_LLM_API_KEY`). A configured reference
+  `pipeline.notarius.credentials: [NOTARIUS_LLM_API_KEY]`). A configured reference
   must resolve to a nonempty environment value during load.
 - Every surviving reference is resolved during ordinary pipeline loading,
   regardless of whether its integration is disabled, outside the selected
@@ -331,19 +334,14 @@ Rules:
 | `pipeline.seriatim.env.filler_max_duration` | float | No | unset |
 | `pipeline.audita.binary` | string | No | `audita` |
 | `pipeline.audita.timeout` | duration | No | `3h` |
-| `pipeline.audita.llm_api_key` | secret reference | No | unset |
-| `pipeline.audita.modules[]` | list[string] | No | empty |
-| `pipeline.audita.base_url` | string | No | empty |
-| `pipeline.audita.model` | string | No | empty |
-| `pipeline.audita.total_llm_concurrency` | int | No | unset |
-| `pipeline.audita.proposal_llm_concurrency` | int | No | unset |
-| `pipeline.audita.validation_model` | string | No | empty |
-| `pipeline.audita.validation_llm_concurrency` | int | No | unset |
+| `pipeline.audita.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Audita |
+| `pipeline.audita.modules[]` | list[string] | No | unset; omit to use Audita defaults, set `[]` for no modules |
+| `pipeline.audita.overlay` | string | No | empty; no downstream overlay override |
+| `pipeline.audita.proposal_profile` | string | No | empty; no downstream proposal-profile override |
+| `pipeline.audita.validation_profile` | string | No | empty; no downstream validation-profile override |
 | `pipeline.audita.transcript_description` | string | No | empty |
 | `pipeline.audita.config_path` | string | No | empty |
 | `pipeline.audita.output_schema` | string | No | empty |
-| `pipeline.audita.work_dir_retention` | string | No | empty |
-| `pipeline.audita.report` | bool | No | `true` |
 | `pipeline.normalize.output_path` | string | No | `transcripts/final.json` |
 | `pipeline.normalize.output_schema` | string | No | `seriatim-intermediate` |
 | `pipeline.normalize.report` | bool | No | `true` |
@@ -359,7 +357,7 @@ Rules:
 | `pipeline.trim.seriatim.report` | bool | No | `false` |
 | `pipeline.notarius.enabled` | bool | No | `false` |
 | `pipeline.notarius.binary` | string | No | `notarius` |
-| `pipeline.notarius.llm_api_key` | secret reference | No | unset; exact environment-variable name forwarded to Notarius |
+| `pipeline.notarius.credentials[]` | list[secret reference] | No | empty; exact environment-variable names forwarded to Notarius |
 | `pipeline.notarius.config_profile` | string | No | unset; exact Notarius ConfigKit profile selector |
 | `pipeline.notarius.config_path` | string | Conditional | required when enabled; relative paths resolve from the pipeline file directory |
 | `pipeline.notarius.pipeline_id` | string | Conditional | required when enabled |
@@ -383,6 +381,32 @@ Rules:
 | `pipeline.scriptorium.artifact_families` | map | No | empty; expands one ordinary artifact per canonical party character |
 | `pipeline.notification.mode` | string | No | `noop`; the only supported notification mode until a provider is implemented |
 
+### Audita Selection and Credentials
+
+`pipeline.audita.config_path` optionally passes an Audita v2 configuration file;
+when empty, Audita uses its own native config discovery. `overlay`,
+`proposal_profile`, and `validation_profile` are independent, optional Audita
+selectors. Empty or omitted strings add no command-line override. Narratio's
+selected pipeline overlay is never inferred as an Audita overlay, and Narratio
+does not create or validate Audita's backend or PromptKit profile files. Prepare
+them with [Audita's v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+
+Omit `modules` or set it to `null` to use Audita's configured default sequence.
+Set `modules: []` to run no correction modules. A nonempty list is passed in
+order, including repetitions. Narratio does not add a reporting or debug flag;
+Audita's external configuration controls those settings.
+
+`pipeline.audita.credentials` lists secret-reference names, not values. Narratio
+resolves every listed name during pipeline loading and forwards the captured
+nonempty value under that exact name to Audita. It does not inspect Audita's
+configuration to discover names or map them to aliases. Audita v2 resolves
+credentials for **all configured backends**, even ones not selected by the
+current profiles: list every named backend credential in the selected Audita
+configuration. An unauthenticated backend needs no reference. Omission, `null`,
+or `[]` forwards nothing. A Narratio overlay replaces the entire list, and
+`[]` clears it. See the [Audita integration contract](./integrations/audita.md)
+for the subprocess and redaction boundary.
+
 ### Notarius Configuration Profile
 
 `pipeline.notarius.config_profile` optionally selects a Notarius ConfigKit
@@ -400,38 +424,39 @@ empty string or `default`, which explicitly select Notarius's composed base
 configuration. Notarius owns selector interpretation and validation; Narratio
 does not restrict profile names, resolve profile files, or rewrite the value.
 
-This selection is independent of Narratio's own `--profile` selection. A
+This selection is independent of Narratio's own `--overlay` selection. A
 Narratio overlay may explicitly select a differently named Notarius overlay,
-but Narratio never forwards its own profile name automatically. It is also
-independent of `pipeline.notarius.llm_api_key`: an overlay may change either or
+but Narratio never forwards its own overlay name automatically. It is also
+independent of `pipeline.notarius.credentials`: an overlay may change either or
 both fields according to the deployed Notarius configuration. See the
 [Notarius integration contract](./integrations/notarius.md) for invocation and
 failure behavior.
 
-### Notarius Credential
+### Notarius Credentials
 
-`pipeline.notarius.llm_api_key` optionally names the one environment variable
+`pipeline.notarius.credentials` optionally lists environment-variable names
 to forward to the Notarius child process:
 
 ```yaml
 notarius:
-  llm_api_key: OPENROUTER_API_KEY
+  credentials: [OPENROUTER_API_KEY, ANTHROPIC_API_KEY]
 ```
 
-The field contains the variable name, not a credential value. That name must
-match `api_key_env` in the Notarius/PromptKit profile selected by the deployed
-Notarius pipeline; Narratio does not infer or remap provider names. Omission or
-`null` forwards nothing. A non-null selected reference must resolve at pipeline
-load time through the process environment or existing secrets-directory
-bootstrap, even when Notarius is disabled, extract is outside the requested
-range, or a completed extraction can be reused.
+The list contains variable names, not credential values. Those names must
+match the references used by the Notarius/PromptKit profiles that Notarius
+loads. Notarius owns profile lookup; Narratio neither infers those names nor
+remaps them. Omission, `null`, or `[]` forwards nothing. Each selected reference
+must resolve at pipeline load time through the process environment or existing
+secrets-directory bootstrap, even when Notarius is disabled, extract is outside
+the requested range, or a completed extraction can be reused.
 
 The Notarius child receives only Narratio's minimal execution environment plus
-this exact selected name and loaded value. Other credentials are not forwarded.
-Changing the value, name, presence, or absence does not invalidate extract's
-semantic resume evidence. The public name remains part of safe effective
-inspection, so renaming it may appear in `config diff` and change the effective
-configuration digest; rotating only its value does neither.
+these exact selected names and loaded values. Other credentials are not forwarded.
+Changing a value, name, presence, or absence does not invalidate extract's
+semantic resume evidence. The public names remain part of safe effective
+inspection, so renaming them may appear in `config diff` and change the effective
+configuration digest; rotating only their values does neither. An overlay
+replaces the whole list, including with `[]` to clear it.
 
 See the [Notarius integration contract](./integrations/notarius.md) for the
 delivery and redaction boundary.

docs/development.md

@@ -10,6 +10,10 @@ polished transcripts and generated artifacts. Start with the
 [Architecture](policy/architecture.md) for normative system boundaries, and the
 [Internal Overview](internal/overview.md) for implemented component ownership.
 
+Agents must read [Agent Policy](policy/agents.md) before recommending, planning,
+or implementing changes. It owns implementation discipline and the default
+commit-after-completed-work rule; it does not authorize pushing or releasing.
+
 ## Go Prerequisite
 
 Maintained development and verification require Go 1.26. Use the official Go
@@ -30,7 +34,7 @@ Maintained development and verification require Go 1.26. Use the official Go
 | Adapters or external tool contracts | [Adapter Internals](internal/adapters.md) and [Integration Contracts](integrations/README.md) | The internal guide owns adapter composition and mechanics; integration documents own external formats and protocols. |
 | Manifests, artifacts, workspace paths, or publish behavior | [Manifest Internals](internal/manifest.md), [Artifact Internals](internal/artifacts.md), [Workspace Internals](internal/workspace.md), [Publish Internals](internal/stage-publish.md), and [Operations](operations.md) | These separate implementation state and resolution from operator-visible layout and lifecycle. |
 | Maintained configuration or input examples | [Configuration](config.md) and [Examples](../examples/README.md) | The reference owns field meanings; the examples directory owns complete copyable files. |
-| Preparing, validating, or publishing a release | [Release Procedure](release.md) | The maintainer procedure owns version selection, candidate validation, guarded tag publication, and optional later CI inspection. |
+| Preparing, validating, or publishing a release | [Release Policy](policy/release.md) and [Release Procedure](release.md) | Policy owns requirements and exceptions; the procedure owns concrete validation, guarded publication, and optional later inspection. |
 | Proposed or unimplemented behavior | `docs/roadmap/` | Future work belongs only in roadmap documentation until implemented. |
 
 For an existing subsystem, also inspect its focused tests and package-level

docs/integrations/audita.md

@@ -1,69 +1,54 @@
 # Integration: Audita
 
-## Purpose
-Define the Audita adapter contract used by the `polish` stage.
+Narratio invokes Audita v2's `process INPUT --glossary PATH --output PATH`
+subprocess for `polish`. The configured timeout and parent cancellation bound
+execution. Narratio passes explicit `--config`, `--overlay`,
+`--proposal-profile`, `--validation-profile`, `--transcript-description`,
+`--output-schema`, and `--modules` only when selected. An omitted module list
+leaves Audita's default sequence in place; `modules: []` passes an explicit
+empty argument and runs no correction modules. Order and repetitions are kept.
+Narratio passes no debug, work-directory, or reporting flags, leaving those
+choices to Audita's own configuration.
 
-## External Boundary
+Audita owns its ConfigKit file, backend and profile definitions, native config
+discovery, and their validation. Narratio does not create an Audita
+configuration or infer downstream overlay/profile names from its own selected
+pipeline overlay. An empty Narratio Audita selector adds no CLI override.
+The [configuration reference](../config.md#audita-selection-and-credentials)
+owns Narratio's fields and defaults. Audita's
+[v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+owns its downstream file format.
 
-Narratio invokes `audita process` as a subprocess for each polish operation.
-The configured timeout and parent cancellation bound the invocation. Internal
-runner composition is documented in
-[the adapter implementation guide](../internal/adapters.md).
+Each name in `pipeline.audita.credentials` is a ConfigKit secret reference
+resolved when Narratio loads the pipeline. Narratio forwards only the selected
+names and their captured, nonempty values under those exact names, in the
+minimal child environment; it never maps them to a fixed alias or rereads the
+parent environment. Every name is registered for captured stdout/stderr and
+failure-diagnostic redaction. Audita resolves credentials for all configured
+backends, including unselected ones, so operators must list every backend
+credential that its selected configuration needs. The downstream files and
+provider output remain Audita's responsibility, outside Narratio's
+captured-stream redaction boundary.
 
-## Request Contract
-`PolishRequest` carries:
-- required transcript/glossary/output/work-dir paths;
-- optional report path (required when report mode is enabled);
-- generated config and stdout/stderr log paths;
-- optional per-invocation module override.
+The corrected transcript is the only canonical polish output. A successful
+invocation must produce a valid JSON transcript with a top-level `segments`
+array within Narratio's 64 MiB bound. Exit zero is accepted even if Audita's
+ordinary reports describe recoverable model errors or no corrections. Narratio
+does not parse report status, counts, or Markdown. It discovers only
+`errors.yml`, `recoveries.yml`, and `report.md` next to the requested output,
+each subject to a 16 MiB read bound. Missing reports are allowed, for example
+when Audita reporting is disabled externally. Available reports are diagnostic
+references, not canonical artifact outputs. See Audita's
+[ordinary output contract](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/integrations/output-files.md)
+for their schemas, and [operations](../operations.md) for placement and
+publication.
 
-The constructed runner owns static Audita settings: binary, timeout,
-credentials, default modules, model and endpoint settings, validation and output
-settings, report mode, and concurrency. The `polish` stage supplies only
-invocation-specific paths and may override modules for that invocation.
+On nonzero exit, Narratio preserves the original subprocess error and
+available run-local evidence; it never promotes a transcript merely because
+the file exists. The adapter returns safe paths, exit details, and selection
+metadata on failure. Narratio's `audita.generated.v2` YAML records the
+invocation, including arguments, paths, and credential names but never values;
+it is a diagnostic record, not a generated Audita config file.
 
-## Result Contract
-`PolishResult` returns:
-- processed transcript path;
-- optional report path;
-- work dir and generated-config/log paths;
-- exit code, duration, binary provenance;
-- adapter metadata map.
-
-## Validation and Failure Semantics
-Construction fails for invalid static config values, including:
-- empty binary;
-- non-positive timeout;
-- invalid base URL;
-- invalid output schema;
-- invalid work-dir retention value;
-- invalid concurrency values.
-
-Run fails for:
-- missing required request paths;
-- subprocess execution failure;
-- invalid processed transcript JSON (`segments` array required);
-- invalid report JSON when reporting is enabled.
-
-Processed transcript JSON is limited to 64 MiB and optional report JSON to 16
-MiB. Both must be regular files without symlinked path components.
-
-Failure results still include output/log/config/exit metadata for diagnostics.
-
-## Deterministic Behavior
-- CLI args are built from runner config + request in a fixed order.
-- A configured typed `llm_api_key` reference is resolved during pipeline load;
-  the captured value is supplied only as the child's `AUDITA_LLM_API_KEY`
-  override and is never re-read from the parent environment.
-- Generated invocation YAML (`audita.generated.v1`) is emitted when requested.
-- Manifest writes are stage-owned; adapter itself is stateless.
-
-## Configuration
-
-Operator-selected values are defined under `pipeline.audita.*` in the
-[configuration reference](../config.md#pipeline).
-
-Maintained example with Audita config:
-
-- [Full annotated pipeline](../../examples/pipeline.full.annotated.yml)
-- [Production-shaped pipeline](../../examples/pipeline.production.yml)
+Maintained Narratio examples: [full annotated pipeline](../../examples/pipeline.full.annotated.yml)
+and [production-shaped pipeline](../../examples/pipeline.production.yml).

docs/integrations/notarius.md

@@ -43,7 +43,7 @@ field acquire no additional version requirement. Omitted or null configuration
 adds no flag. Supplied empty, `default`, and named selectors are forwarded
 without normalization so Notarius can apply its own ConfigKit semantics. This
 option selects a Notarius configuration overlay, not a PromptKit profile through
-`--llm-profile`, and Narratio never substitutes its own selected profile name.
+`--llm-profile`, and Narratio never substitutes its own selected overlay name.
 A missing or invalid downstream overlay is an ordinary Notarius subprocess
 failure: Narratio does not retry without the selector or fall back to another
 profile.
@@ -105,15 +105,16 @@ causes a cold miss. Chunk refresh bypasses lookup and publishes the accepted
 replacement for the active source; it does not delete unrelated plans or
 checkpoint state.
 
-When `pipeline.notarius.llm_api_key` is absent or null, Narratio adds no
-credential to that environment. When configured, the field names an environment
-variable whose already-loaded nonempty value is forwarded under that exact
-name. Operators must use the same name as the `api_key_env` in the selected
-Notarius/PromptKit profile. Narratio does not inspect the Notarius configuration
-to infer a provider or destination name, and it does not forward unrelated
-credentials from its parent environment or secrets directory.
+When `pipeline.notarius.credentials` is absent, null, or empty, Narratio adds no
+credentials to that environment. When configured, each list entry names an
+environment variable whose already-loaded nonempty value is forwarded under
+that exact name. Operators must use the names referenced by the selected
+Notarius/PromptKit providers. Narratio does not inspect the Notarius configuration
+to infer providers or destination names, and it does not forward unrelated
+credentials from its parent environment or secrets directory. A Narratio
+overlay replaces the whole credential list; `[]` clears it.
 
-The selected name is registered with Narratio's shared streaming redactor.
+Every selected name is registered with Narratio's shared streaming redactor.
 Credential bytes written by the child to captured stdout, captured stderr, or
 stderr-derived failure diagnostics are replaced with `<redacted>`, including
 custom names not known to the built-in sensitive-name list. Narratio does not

docs/internal/adapters.md

@@ -68,11 +68,15 @@ owner of serializing them as repeated `--reference` arguments before `--json`.
 It also serializes an effective resume request as `--resume` and a nonempty
 validated chunk mode as `--chunk_cache <mode>`. The extract stage, not the
 adapter, resolves force precedence before constructing the request.
-Its request may also carry one already-resolved opaque ConfigKit secret
-reference. Only the Notarius adapter reads that value, rejects an unresolved or
-empty programmatic reference, and maps the exact configured name/value into the
-shared subprocess override and sensitive-name fields. It never rereads the
-parent environment. A nil reference preserves the previous invocation.
+Its request may also carry already-resolved ConfigKit secret references.
+Audita's request carries the same kind of list. Both adapters use the shared
+subprocess helper to convert their selected references into exact-name child
+environment overrides and sensitive-name registration. That helper rejects
+unresolved or empty programmatic references, but neither adapter rereads the
+parent environment or inspects downstream configuration to discover names.
+Empty lists add no credential overrides. See the public [Audita](../integrations/audita.md)
+and [Notarius](../integrations/notarius.md) contracts for selection and
+downstream-file boundaries.
 
 Application-owned object-store construction loads configured filesystem
 secrets before invoking the invocation's storage factory. Production commands

docs/internal/configuration.md

@@ -9,9 +9,9 @@ pipeline-loading boundary implemented by `internal/config`.
 `LoadPipeline` assembles and validates a pipeline in this order:
 
 1. Give ConfigKit a fresh typed `PipelineConfig` default value, the root file,
-   enabled imports, and the caller's profile selection. Omitted, empty, and
-   exact `default` selections use the base; named profiles use the fixed
-   `profiles/<name>.yml` convention.
+   enabled imports, and the caller's overlay selection. Omitted, empty, and
+   exact `default` selections use the base; named overlays use the fixed
+   `overlays/<name>.yml` convention.
 2. ConfigKit parses the root and declared imports, additively merges base
    sources, applies only the selected overlay, and strictly decodes the result.
 3. The definition resolver applies recorded entry-level and inherited defaults,
@@ -45,7 +45,7 @@ a temporary downloaded session file therefore cannot invalidate the resolved
 pipeline or campaign context.
 
 Campaign and session files use independent ConfigKit definitions with imports
-and profiles disabled. Campaign files normally load directly from their source;
+and overlays disabled. Campaign files normally load directly from their source;
 session files are first read through the 8 MiB bounded-read boundary because the
 application must reject unresolved template placeholders before passing an exact
 byte snapshot to ConfigKit. Local and remotely downloaded session bytes then use
@@ -53,8 +53,9 @@ the same typed loader and retain the existing post-load identity expectations,
 stable-input precedence, and source-relative path semantics.
 
 The application also has a separate read-only inspection resolver for `config
-validate`, `config show`, `config sources`, and `config artifacts`. It uses the same production root/profile and
-campaign selection functions, but never routes through session discovery,
+validate`, `config show`, `config sources`, and `config artifacts`. It uses the
+same production root, overlay, and campaign selection functions, but never routes
+through session discovery,
 remote-session download, adapter composition, workspace
 initialization, manifest access, or cleanup. A pipeline with retained artifact
 family declarations must resolve its selected campaign before ordinary pipeline
@@ -73,7 +74,7 @@ commands do not marshal runtime objects directly.
 `EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
 safe provenance projection for `config sources`. Pipeline ownership begins with
 the complete logical field paths projected from the schema and classifies
-each contributor as root, import, profile, or centralized default. The
+each contributor as root, import, overlay, or centralized default. The
 projection replaces generated concrete member paths with paired family and
 canonical-party records, and does the same for generated publish rules.
 Campaign records identify campaign-owned fields and party inputs; canonical
@@ -106,7 +107,7 @@ configured roster authority; player and session-party fields are unsupported.
 ## Canonical Party Domain
 
 `ParseParty` is the package-owned boundary for parsing a party source. Its
-single-source ConfigKit definition disables imports and profiles, requires
+single-source ConfigKit definition disables imports and overlays, requires
 `schema_version` through `VersionRule`, and strictly decodes the
 character-keyed typed schema before applying Narratio's party-domain checks.
 Successful metadata coordinates recover authored character-map order without a
@@ -144,14 +145,14 @@ not compatibility contracts.
 
 ## Diagnostics And Runtime Metadata
 
-Syntax, duplicate-key, merge, profile, and schema failures include the
+Syntax, duplicate-key, merge, overlay, and schema failures include the
 relevant source name and full field path. Additive conflicts report every
 claiming source so operators can repair the split without repeatedly
 rediscovering additional conflicts.
 
 The loaded pipeline retains private runtime metadata for the absolute root
-path, ordered imports, selected profile name and selection source, selected
-overlay, original ConfigKit metadata and source snapshots, effective digest,
+path, ordered imports, selected overlay name, source, and path, original
+ConfigKit metadata and source snapshots, effective digest,
 and leaf ownership. Base
 leaves retain their root/import owners, replaced leaves belong to the selected
 overlay, and centrally supplied values use the synthetic `default` owner. This
@@ -163,7 +164,7 @@ the same typed safe projection used by show and diff. Runtime Notarius paths rem
 execution, but the digest substitutes their normalized logical values captured
 before root-relative resolution, so relocating an equivalent configuration
 bundle does not change provenance. Because ConfigKit and resolution metadata
-are private, the digest excludes source layout, profile name, and ownership.
+are private, the digest excludes source layout, overlay name, and ownership.
 Configuration stores credentials as ConfigKit typed references. A successful
 load resolves their values inside the opaque typed boundary, while this safe
 projection serializes only `EnvName()` identities. Credential-value changes are
@@ -177,7 +178,7 @@ for later runtime expansion.
 
 ## Test Surfaces
 
-`pipeline_configkit_test.go` exercises real imports and fixed-path profiles,
+`pipeline_configkit_test.go` exercises real imports and fixed-path overlays,
 base selection, unselected-overlay isolation, source attribution, and Narratio's
 unique artifact/family base-declaration rule. Existing focused configuration
 tests protect defaults, explicit-value semantics, strict decoding, validation,

docs/internal/manifest.md

@@ -23,9 +23,11 @@ portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
-Decoding is strict at every typed manifest field. Unknown fields are rejected;
-the schema version remains `narratio.session-manifest.v1` and there is no
-compatibility reader that silently drops retired state. Cleanup progress uses
+Decoding rejects unknown typed fields, including informational fields inside
+`effective_config` and its nested selection. The schema version remains
+`narratio.session-manifest.v1`; there is no compatibility reader that silently
+drops retired fields. See [overlay migration](../operations.md#migrating-manifest-overlay-provenance)
+for deliberate migration of retired selection provenance. Cleanup progress uses
 only the cleanup entry in `stages`.
 
 Every persisted session manifest has a non-nil `stages` map. Each entry is
@@ -193,6 +195,25 @@ establish a current immutable snapshot.
 - writes through a sibling temporary file and atomic replacement visibility;
 - updates `updated_at` on save.
 
+### Checkpoint persistence boundary
+
+Analyze and transcribe share one private checkpoint operation in
+`internal/stage`. Their typed callers still decide when to checkpoint, validate
+their collections, populate stage-owned fields, and serialize access. The
+shared operation copies the manifest and its checkpoint-relevant mutable
+collections, applies the typed update to the copied target record, and calls
+the existing `manifest.Store` exactly once. Only after that save succeeds does
+it promote the saved target record and manifest `updated_at` into live state;
+it preserves an existing target record's identity and leaves unrelated live
+stage records in place.
+
+The copy boundary includes stage records, input and artifact slices, aggregate
+output/log/configuration slices, and the typed analyze and transcribe
+collections that callbacks or `LocalStore.Save` may modify. Metadata and other
+pointer fields remain shared read-only because neither checkpoint callback nor
+the store mutates them. This is a bounded execution helper, not a general
+manifest clone or a transaction across transcript/artifact files.
+
 Manifest replacement provides atomic visibility, not a crash- or power-loss
 durability guarantee. Callers reload after a returned save error before retrying.
 A transcribe or analyze checkpoint error leaves the prior manifest collection
@@ -287,10 +308,10 @@ after such a private content change.
 
 The session manifest is the authoritative stage-progress ledger across
 invocations. It retains the most recently resolved invocation's bounded
-configuration provenance. It identifies the selected profile name and source
-(`default` or `cli`) plus the effective configuration digest, but never a raw
-secret or profile content. This provenance is informational: it does not
-participate in stage resume or cache decisions. A profile change therefore
+configuration provenance. It identifies the selected overlay name and source
+(`explicit` when selected) plus the effective configuration digest, but never a raw
+secret or overlay content. This provenance is informational: it does not
+participate in stage resume or cache decisions. An overlay change therefore
 invalidates only stages whose semantic configuration changed. When a private
 external-tool model, module, prompt, or profile changes behind an unchanged
 configured identifier, use `--force` for the affected work.

docs/internal/overview.md

@@ -37,7 +37,7 @@ failed stage or required manifest save prevents later stages from starting.
 | --- | --- | --- |
 | Executable | `cmd/narratio` | Process entry, standard stream wiring, argument handoff, and exit status. |
 | Application orchestration | `internal/app` | Command dispatch, configuration selection, secret-file environment loading, production composition, session locking, planning, execution, restore, and user-facing reporting. |
-| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and profiles, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
+| Configuration | [`internal/config`](configuration.md) | ConfigKit-backed pipeline imports and overlays, canonical party and family expansion, strict YAML loading, defaults, normalization, session templating, and validation. |
 | Pipeline stages | `internal/stage` | Canonical stage registry, shared stage contract, execution dependencies, and implemented stage behavior. |
 | External boundaries | `internal/adapters`, `internal/audio` | WhisperX HTTP, downstream subprocesses, notification, object storage, and S3 audio materialization behind Narratio contracts. |
 | Manifests | `internal/manifest` | Durable session progress, stage transitions, validation, and atomic persistence. |
@@ -106,7 +106,7 @@ so any earlier replacement can stale a prior cleanup result.
 
 ## Focused Documentation
 
-- [Configuration Internals](configuration.md): pipeline imports and profiles,
+- [Configuration Internals](configuration.md): pipeline imports and overlays,
   field ownership, decoding, and root-relative path semantics.
 - [Adapter Internals](adapters.md): external adapter boundaries, composition,
   failure behavior, and test surfaces.

docs/internal/stage-analyze.md

@@ -115,7 +115,11 @@ Supported source families:
 - before the first adapter call, checkpoints the reconciled starting collection
   when it removed configuration records or cleared obsolete authority. After
   each successful artifact, checkpoints the complete collection before making
-  that artifact available to the next scheduled dependent.
+  that artifact available to the next scheduled dependent. Analyze supplies
+  its typed update to the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary)
+  and refreshes its working and committed collections only after the save
+  succeeds.
 - keeps adapter output in the invocation's run-local analyze directory until
   it is a safe, non-empty, bounded regular file with a calculated checksum and
   complete output contract. Canonical replacement uses the shared atomic file

docs/internal/stage-polish.md

@@ -12,37 +12,41 @@ Run Audita polishing on base transcript and produce polished transcript.
 ## Outputs
 
 - `transcripts/polished.json`
-- optional `artifacts/audita.report.json`
+
+The transcript is the only canonical output. Available `errors.yml`,
+`recoveries.yml`, and `report.md` remain beside the run-local transcript and
+are recorded as diagnostics, not artifact outputs.
 
 ## Key Behavior
 
 - resolves base transcript only from verified merge manifest output evidence.
-- invokes an Audita runner configured with static model/runtime options; the
-  invocation supplies paths and modules.
+- invokes an Audita v2 runner with external configuration selectors and
+  explicitly forwarded provider credentials; the invocation supplies paths.
 - validates processed transcript structure (`segments` array required).
-- validates optional report JSON.
-- materializes canonical outputs; records logs/generated config and adapter metadata.
+- validates reported diagnostic paths against the three fixed adjacent names.
+- materializes only the canonical transcript; records available reports with
+  stdout/stderr logs, generated invocation, and safe adapter metadata.
 
 ## Invariants
 
 - polished transcript schema validation is mandatory.
-- report output is config-gated.
+- reports are optional diagnostics; Audita's external configuration may disable
+  them. A failed invocation never promotes an incidental transcript.
 
 ## Resume Semantics
 
-The versioned semantic fingerprint covers the Audita service endpoint, model,
-validation model, module set, transcript description, output schema, selected
-external configuration path, and canonical polished-transcript identity. Module
-ordering is normalized because the configured modules form a set. Audita's
-executable, timeouts, concurrency, report and debug behavior, work retention,
-and resolved credential value are operational and do not invalidate a
-successful result. The public credential reference name may participate in
-configuration provenance but never exposes its resolved value.
+Version 2 semantic evidence covers Audita's config path, downstream overlay,
+proposal and validation profile selectors, ordered module selection (including
+the distinction between omission and an explicit empty list), transcript
+description, output schema, and canonical polished-transcript identity.
+Credentials, executable path, timeout, and diagnostics are operational and do
+not invalidate a successful result. Public credential reference names may
+participate in configuration provenance but never expose resolved values.
 
-Narratio can fingerprint a selected model, module, or configuration identifier,
-but it cannot inspect content that Audita privately resolves behind that stable
-identifier. Force `polish` after changing such private content without changing
-its identifier.
+Narratio fingerprints selections, not the contents of Audita-owned config or
+profiles. Force `polish` after changing those files behind unchanged selections.
+When polish is selected, older semantic evidence is reconsidered and the stage
+reruns; a downstream-only invocation does not eagerly run polish.
 
 ## Related Contracts And Tests
 

docs/internal/stage-transcribe.md

@@ -35,9 +35,10 @@ Generate raw per-speaker transcripts from prepared audio using WhisperX.
 - output path returned by adapter must match requested output path.
 - an empty adapter result path means the requested path; adapters cannot select
   an alternate destination.
-- candidate collection construction, manifest save, and installation into live
-  state are serialized. Expensive hashing and HTTP work remain outside that
-  critical section.
+- candidate collection construction, the shared
+  [checkpoint persistence boundary](manifest.md#checkpoint-persistence-boundary),
+  and installation into live state are serialized by transcribe's mutex.
+  Expensive hashing and HTTP work remain outside that critical section.
 - a canonical file has no completion authority until its manifest checkpoint
   succeeds. A save failure preserves the last successfully committed
   collection for ordinary retry.

docs/operations.md

@@ -70,19 +70,19 @@ narratio run 2026-04-04
 narratio session status 2026-04-04
 ```
 
-Run, plan, and status output identify the resolved pipeline profile (or `none`)
+Run, plan, and status output identify the resolved pipeline overlay (or `none`)
 and effective configuration digest. Status distinguishes the current resolved
 value from the last value persisted in the session manifest, which helps
-diagnose profile switches without changing resume authority.
+diagnose overlay switches without changing resume authority.
 
-Before switching an operational profile, compare its effective meaning with the
-production base through `narratio config diff default <profile>`.
+Before switching an operational overlay, compare its effective meaning with the
+production base through `narratio config diff default <overlay>`.
 The command is read-only and succeeds whether it finds differences or not. Its
 sorted records describe defaulted, expanded concrete configuration—not source
 file layout—so it can be used to review model, artifact, and publish changes
 without creating a session or run. Use `narratio config artifacts` to review the
 concrete artifact identities, definitions, outputs, and dependencies. Select the
-same campaign explicitly when profiles could resolve different campaign paths;
+same campaign explicitly when overlays could resolve different campaign paths;
 see the [CLI reference](cli.md#config-validate-config-show-config-sources-config-artifacts-and-config-diff)
 for syntax and record format.
 
@@ -124,10 +124,11 @@ membership, S3 object identity, or missing/tampered copies rerun prepare and
 its fixed descendants without requiring `--force`. Changing prepare selection
 semantics likewise reruns all fixed descendants; changing
 WhisperX language/service identity reuses prepare; changing a Seriatim merge
-transformation reuses prepare and transcribe; and changing an Audita model
-reuses prepare, transcribe, and merge while rebuilding transcript refinement.
-A trim change invalidates both render and extract through the fixed dependency
-relation, while a render-only change preserves the extract sibling.
+transformation reuses prepare and transcribe; and changing a selected Audita
+overlay, profile, or module sequence reuses prepare, transcribe, and merge while
+rebuilding transcript refinement. A trim change invalidates both render and
+extract through the fixed dependency relation, while a render-only change
+preserves the extract sibling.
 
 Operational timeouts, retry/concurrency tuning, executable paths,
 workspace/cache/spool placement, reports, diagnostics, and secret values are
@@ -284,17 +285,17 @@ intends to replace otherwise-current artifacts.
 ### Developing With A Notarius Configuration Profile
 
 A Narratio development overlay can explicitly select a Notarius overlay without
-requiring the names to match. For example, `profiles/testing.yml` may contain:
+requiring the names to match. For example, `overlays/testing.yml` may contain:
 
 ```yaml
 notarius:
   config_profile: downstream-economy
 ```
 
-Selecting Narratio's `testing` profile then supplies `downstream-economy` only
+Selecting Narratio's `testing` overlay then supplies `downstream-economy` only
 when extraction executes. Switching that explicit selector makes a recorded
 extraction non-current and reruns it when `extract` is in the selected stage
-range; the usual dependent invalidation then applies. Selecting a profile does
+range; the usual dependent invalidation then applies. Selecting an overlay does
 not create a separate workspace or retain a separate current extraction result.
 
 Narratio cannot observe edits inside Notarius configuration behind an unchanged
@@ -409,6 +410,82 @@ execute. Deleting Narratio's local reference snapshots does not invalidate a
 complete durable extraction; missing snapshots are reconstructed only when a
 later extraction actually runs.
 
+## Migrating Manifest Overlay Provenance
+
+The pipeline-selection rename is a clean cutover. Manifests containing
+`effective_config.selected_profile` are rejected by strict decoding; Narratio
+does not silently discard or translate that retired field.
+
+Before using an affected local session with the new version:
+
+1. Stop Narratio activity for the session and back up its manifest.
+2. Rename only `effective_config.selected_profile` to `selected_overlay`, keeping
+   its `name` and `source`, or remove the retired informational member. If a
+   current `selected_overlay` member already exists, retain it and remove the
+   retired member rather than creating duplicate keys.
+3. Preserve the schema version, digest, stage records, checkpoint evidence,
+   output references, and other session state. Retry the intended command.
+
+This metadata is informational, not resume authority. Do not delete session
+progress or force all stages merely to perform this migration. Other unknown
+fields still require investigation rather than blanket removal.
+
+Do not edit immutable remote committed snapshots. Restoring an older snapshot
+with retired provenance requires a compatible previous Narratio version, followed
+by migration of the restored local manifest before using the new version.
+
+## Migrating Audita and Provider Credentials
+
+This is a breaking clean cutover to Audita v2. Narratio does not translate an
+Audita v1 configuration, retain old field aliases, or generate a downstream
+configuration. Update both the deployed Audita executable/configuration and
+the Narratio pipeline before running polish. Retired Narratio fields are
+rejected by strict configuration loading; account for this break when choosing
+a release version.
+
+| Previous Narratio setting | New ownership and selection |
+| --- | --- |
+| `audita.base_url` | Audita v2 `backends.<id>.endpoint` |
+| `audita.total_llm_concurrency`, `proposal_llm_concurrency`, `validation_llm_concurrency` | Audita v2 `backends.<id>.concurrency` and optional `queue_capacity`; backend capacity is shared across roles |
+| `audita.model`, `validation_model` | Audita PromptKit profile files; optionally select them from Narratio with `audita.proposal_profile` and `validation_profile` |
+| `audita.llm_api_key` | `audita.credentials: [PROVIDER_KEY_NAME]`, matching each Audita backend's `credential` name |
+| `notarius.llm_api_key` | `notarius.credentials: [PROVIDER_KEY_NAME]`, matching references in Notarius-owned profiles |
+| `audita.work_dir_retention`, `report` | Remove; Audita's external configuration owns diagnostics and reporting |
+
+An Audita configuration can also be selected through `audita.config_path`,
+and `audita.overlay` selects an Audita overlay independently of Narratio's
+`--overlay`. Narratio forwards no implicit provider key: a single provider-named
+secret source may be listed for both adapters, and an Audita-only backend key
+may be listed only for Audita. Audita resolves credentials for all configured
+backends, including those not currently selected. Notarius looks up its own
+profiles; Narratio does not discover their credential names. Credential lists
+may be cleared with `[]` in a Narratio overlay.
+
+Prepare the external file from Audita's maintained
+[local example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/minimal-config.yml),
+[service example](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/examples/production-config.yml),
+and [v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md).
+Before switching the executable, validate the file offline:
+
+```bash
+audita config validate --config /usr/local/etc/audita/config.yml
+```
+
+Use `audita config print-effective --config /usr/local/etc/audita/config.yml --view profiles`
+to inspect downstream profile selection without contacting a provider. For a
+production Audita configuration, leave ordinary reports enabled
+and debug disabled unless an operator deliberately chooses otherwise; Narratio
+does not override those settings. Audita writes `errors.yml`, `recoveries.yml`,
+and `report.md` beside the polished output when reporting is enabled. An
+exit-zero run with a valid transcript succeeds even if those reports describe
+recoverable errors or no applied corrections. See the [Audita integration
+contract](./integrations/audita.md) for report placement and limits.
+
+Narratio's polish resume evidence tracks selected config path, Audita overlay,
+profiles, ordered modules, description, schema, and output identity. Editing
+Audita-owned files behind unchanged selectors is invisible to Narratio; force
+polish with `narratio run-stage polish <session-id> --force` after such edits.
+
 ## External Command Lifecycle
 
 When an external command is cancelled or times out, Narratio terminates its
@@ -426,6 +503,9 @@ tree and reports which stream exceeded the limit.
 
 Run-local diagnostics are:
 
+- `runs/{run_id}/polish/outputs/transcripts/errors.yml`,
+  `recoveries.yml`, and `report.md` when Audita writes them beside its
+  run-local polished transcript
 - `runs/{run_id}/extract/notarius.receipt.json`
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
@@ -439,6 +519,10 @@ Unlisted files and unsafe entries are never uploaded; a run with no declared
 current-run diagnostics uploads no run-local files. No distinguished diagnostic
 file is uploaded. The durable bundle is never scanned for implicit publication;
 only lanes named by explicit `pipeline.publish.outputs` rules are uploaded.
+To inspect a published polish report remotely, read its declared object under
+the run archive's `polish/outputs/transcripts/` prefix. Session restore does
+not restore run-archive diagnostics as canonical session files; it restores only
+the committed manifest and declared transcript/artifact objects.
 
 To intentionally replace the current extraction result, run:
 
@@ -692,9 +776,10 @@ files. Existing environment variables—including empty values—always win.
 S3 `access_key_id` and `secret_access_key` are an optional pair of typed
 environment references. When both are absent, the AWS SDK retains its default
 credential provider chain. When both are configured, Narratio supplies their
-load-time resolved values through an explicit static provider. Audita's optional
-`llm_api_key` is likewise captured at pipeline load and supplied only through
-the child process's `AUDITA_LLM_API_KEY` override.
+load-time resolved values through an explicit static provider. Audita and
+Notarius credential lists likewise resolve at pipeline load. Each adapter
+receives only its listed names and captured values, with no alias mapping or
+ambient environment inheritance. See [configuration](./config.md#audita-selection-and-credentials).
 
 External adapter results are individually bounded before Narratio validates or
 materializes them. These per-file limits do not reserve disk space: prevent hard

docs/policy/agents.md

@@ -0,0 +1,95 @@
+# Agent Policy
+
+**Base Policy Version:** 1.1
+
+**Last Updated**: 2026-09-25
+
+## Purpose
+
+Agents working in this repository must read and adhere to the following house rules.
+
+## Implementation Discipline
+
+**KEY PRINCIPLES:** Write the simplest idiomatic code that satisfies the user's
+request. Do not implicitly strengthen requirements, restrictions, or guarantees
+beyond what the user actually requested.
+
+Simplify the mechanism, not the user's choices.
+
+**Keep implementation machinery proportionate.** Use straightforward,
+idiomatic code and introduce only the machinery needed to support the requested
+behavior and flexibility. Optimize for conceptual simplicity and
+maintainability, not for the fewest lines, fewest options, or narrowest product
+surface.
+
+**Do not invent restrictions.** Do not reject, prohibit, constrain, cap,
+harden, or otherwise narrow behavior unless required by the user, an explicit
+repository contract, or an unavoidable correctness constraint. Preserve
+operator and caller choice where policy has not been established. If an
+additional restriction appears advisable, present it as a decision rather than
+silently implementing it.
+
+A correctness constraint must follow from the requested behavior or an
+established invariant, not from the convenience of the chosen implementation.
+Explain the specific failure it prevents and why a less restrictive
+implementation cannot satisfy the contract.
+
+**Do not invent guarantees.** Do not strengthen public contracts, guarantees,
+or invariants beyond those expressly requested by the user.
+
+**Use the standard library.** For example: in almost every case, the best
+approach to copying files is to use the standard library. Writing custom code to
+implement power-loss protection at the application level, or to guard against
+bad actors with privileged and concurrent access to the host's filesystem,
+is wasteful, unnecessary, and not idiomatic. Stick to the simple, standard, and
+idiomatic approach unless another path is expressly requested by the user.
+
+**An implementation detail is not repository policy.** Tests and documentation
+must not elevate incidental behavior into a durable guarantee or restriction
+unless that behavior was expressly selected as part of the contract. Existing
+explicit contracts remain authoritative; changing or weakening one requires a
+deliberate decision rather than being inferred from this principle.
+
+Agent-authored plans, tests, documentation, and prior implementations are not
+evidence that an additional restriction was deliberately approved. Identify the
+authorizing requirement or decision; when that authority is unclear, surface
+the ambiguity rather than treating repetition as approval.
+
+Standard-library guidance does not authorize weakening Narratio's established
+filesystem, manifest, or publication contracts. Preserve them unless a deliberate
+decision changes them.
+
+## Git Commit Policy
+
+By default, create a commit after completing each coherent unit of work, using a
+concise, plain-English message describing what changed. This policy is standing
+authorization to create those local commits; a separate user request is not
+required. An explicit user instruction to leave work uncommitted takes precedence.
+
+A unit of work is a focused, reviewable outcome, including its relevant tests and
+documentation. Do not commit after every intermediate edit or create empty commits.
+Complete the appropriate validation before committing. If work is incomplete or
+validation is blocked, report that state rather than presenting it as completed.
+
+Before committing:
+
+1. Run `git status --short` and review the relevant diff, including any staged
+   changes. Identify changes that predate the current unit of work.
+2. Exclude secrets, local environment files, generated junk, and unrelated changes.
+3. Stage only the files or hunks belonging to the completed unit. Use `git add .`
+   only when every included change belongs to that unit. Do not disturb unrelated
+   staged or unstaged work.
+4. Review `git diff --staged` and run appropriate checks for the change. Do not
+   repeat checks already passed for unchanged content merely to create a commit.
+5. Review `git log --oneline -n 10` and use
+   `git commit -m "<concise plain-English commit message>"`.
+6. Report the commit identifier and any remaining uncommitted work.
+
+If the unit cannot be safely separated from pre-existing work, leave it uncommitted
+and explain the overlap rather than silently including that work. If a commit
+fails, preserve the changes and report the failure; do not bypass hooks.
+
+Default commit authorization does not authorize pushing, publishing, amending,
+resetting, reverting, or rewriting history. Those actions require a separate user
+instruction. Do not use `git commit -a` or `git commit --no-verify` to bypass the
+staging and validation discipline above.

docs/policy/architecture.md

@@ -1,5 +1,9 @@
 # Architecture
 
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
 This document defines Narratio's intended high-level architecture and the
 invariants that changes must preserve. Implemented component details belong in
 the [Internal Overview](../internal/overview.md) and its linked documents.
@@ -148,13 +152,13 @@ Configuration is strict, explicit, centralized, and operator-oriented.
 - Empty configured values do not silently replace meaningful defaults.
 - Validation rejects invalid configuration before stage execution where
   practical.
-- Root-owned imports and one selected profile resolve deterministically through
+- Root-owned imports and one selected overlay resolve deterministically through
   the configuration owner; commands do not implement their own merge rules.
 - Canonical party rosters are campaign-owned. Their derived players projection
   and concrete character-family artifacts are resolved before runtime stages
   or adapters receive configuration.
 - Resume uses stage- or artifact-owned semantic evidence for observable
-  result-affecting configuration; profile identity and an effective digest are
+  result-affecting configuration; overlay identity and an effective digest are
   provenance, never blanket cache keys.
 - Session templating remains narrow and deterministic rather than becoming a
   general configuration language.

docs/policy/documentation.md

@@ -1,5 +1,9 @@
 # Documentation Policy
 
+**Base Policy Version:** 1.1
+
+**Last Updated**: 2026-09-25
+
 ## Purpose
 
 This policy assigns each documentation topic to one canonical owner. Its goal is
@@ -59,7 +63,9 @@ secret values.
 | --- | --- | --- | --- |
 | Product orientation and minimal end-to-end quickstart | `README.md` | What Narratio is, why it is useful, one shortest successful invocation, and links onward. | Complete command reference, configuration reference, operational procedures, implementation detail. |
 | Contributor entry point | `docs/development.md` | Task-oriented reading guide, minimal contributor orientation, baseline validation commands, and links to canonical docs. | Package inventory, architecture rules, subsystem behavior, detailed change recipes. |
-| Maintainer release procedure | `docs/release.md` | Version selection, candidate preparation and validation, guarded tag publication, release completion boundary, failure recovery, and optional asynchronous inspection. | Script implementation mechanics, current application contracts, and historical release summaries. |
+| Agent policy | `docs/policy/agents.md` | Agent implementation discipline, authority boundaries, and local commit policy. | Application contracts, architecture, testing policy, and contributor procedures. |
+| Release policy | `docs/policy/release.md` | Versioning, release integrity, documentation and validation requirements, immutability, publication controls, and explicit exceptions. | Repository-specific commands, installation, historical summaries, and CI implementation detail. |
+| Maintainer release procedure | `docs/release.md` | Prerequisites, concrete candidate validation and publication commands, deliverables, failure recovery, and optional consumer-facing inspection. | General release requirements and exceptions, current application contracts, and historical release summaries. |
 | Historical release summary | `docs/releases/<tag>.md` | Immutable summary, compatibility, upgrade, and changes for one released version. | Current maintainer procedure and current application contract details. |
 | Current application architecture | `docs/policy/architecture.md` | System shape, normative ownership, dependency direction, architectural boundaries, invariants, safety properties, and non-goals. | Concrete package inventory, implementation mechanics, contributor procedures, decision history, future work. |
 | Documentation organization | `docs/policy/documentation.md` | Documentation ownership, audience boundaries, maintenance rules, and ADR/document lifecycle. | Application architecture or product behavior. |
@@ -100,6 +106,14 @@ configuration, operational, or integration contract. When a workflow crosses
 these topics, choose the document that owns the task and link to the other
 contracts.
 
+### Releases
+
+[Release policy](release.md) owns requirements and explicit exceptions;
+[the release procedure](../release.md) owns the commands used to satisfy them.
+Release notes record history at an immutable tag. Neither the procedure nor a
+release note may silently weaken policy or substitute for updates to current
+canonical documentation.
+
 ### Contracts And Implementation
 
 Integration and API documents define externally observable shapes and

docs/policy/release.md

@@ -0,0 +1,221 @@
+# Release Policy
+
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
+## Purpose
+
+This policy defines the minimum requirements for selecting, validating,
+publishing, verifying, and correcting releases. Its goal is to make every
+release intentional, reproducible from an exact source revision, documented
+for consumers, and safe from retrospective replacement.
+
+The repository-specific commands that implement these requirements belong in
+`docs/release.md`. Historical release summaries belong in `docs/releases/`.
+Neither document may weaken this policy, including its explicit repository
+exceptions.
+
+## Release Model
+
+A release consists of:
+
+- one exact source commit reachable from the repository's primary branch;
+- one immutable version tag identifying that commit;
+- one version-matched, checked-in release note; and
+- every artifact, image, package, registry entry, or other deliverable the
+  repository declares for that release.
+
+The repository's primary branch is `main` unless an adopted policy documents
+an exception. A release candidate must be committed and pushed to that branch
+before its release tag is published.
+
+The source tag is the authoritative release identity. Published deliverables
+must be traceable to the tagged source and must agree with its version. A
+repository may publish source only. When it publishes additional deliverables,
+its release procedure must enumerate them and define how each is built,
+identified, published, and verified.
+
+Release automation may validate or publish a release only when its exact
+responsibility is documented. Automation must not silently change the source
+candidate, move a published tag, replace a published deliverable, or repair a
+release in place.
+
+## Versioning And Compatibility
+
+Stable releases use Semantic Versioning in the form `vMAJOR.MINOR.PATCH`, with
+no leading zeroes. Each version must be unused locally and in every configured
+remote or publication channel before publication begins.
+
+Unless an adopted policy explicitly supports and defines prereleases,
+prerelease versions are not permitted.
+
+For releases at or after `v1.0.0`:
+
+- a major release may make intentional incompatible changes;
+- a minor release may add backward-compatible behavior; and
+- a patch release may make backward-compatible fixes.
+
+Before `v1.0.0`, a minor release may change a documented public, operational,
+configuration, data, integration, or compatibility contract when the release
+note explains the impact and required consumer action. A patch release must
+not intentionally break those contracts within its minor line.
+
+A repository with additional compatibility promises must define them in its
+adopted policy or canonical contract documentation. A release note may explain
+a compatibility change, but it must not redefine the current compatibility
+contract.
+
+## Release Documentation
+
+Every release made under this policy must include
+`docs/releases/<version>.md` in the tagged source tree. The filename must use
+the complete version tag, and the document must begin with a title containing
+the product name and that exact version.
+
+Every new release note must contain these sections:
+
+```markdown
+# <Product> vMAJOR.MINOR.PATCH
+
+This release ...
+
+## Summary
+
+## Compatibility
+
+## Upgrade
+
+## Changes
+```
+
+Use an explicit statement such as "No action required" when a section has no
+substantive content.
+
+Release notes are immutable historical summaries. They should link to current
+canonical documentation for exact behavior. Every affected canonical document
+must be updated in the same candidate; a release note must not substitute for
+current documentation or defer required documentation changes.
+
+## Candidate Preparation And Validation
+
+Each repository must provide one documented release-check command or script
+that exercises the complete set of automated source-candidate gates. The
+repository-specific procedure must state all additional manual gates.
+
+The required gates are:
+
+- dependency or module hygiene appropriate to the language and ecosystem;
+- the complete deterministic, offline default test suite;
+- static analysis and linting used by the repository;
+- formatting and whitespace checks;
+- validation of maintained examples, configuration, schemas, generated
+  sources, and documentation commands where applicable;
+- review of changed local documentation links;
+- removal of obsolete roadmap documents under `docs/roadmap/` that describe
+  completed work included in the release; and
+- review for unintended files, generated output, credentials, private data,
+  and unrelated changes.
+
+## Publication Guards
+
+Immediately before publication, the maintainer or release automation must
+fetch the current primary branch and tags from the authoritative remote and
+verify all of the following:
+
+- the version has the required format and is not already published;
+- the current branch is the primary release branch;
+- the worktree and index are clean;
+- the current commit is the recorded, validated candidate;
+- the authoritative remote branch points to that same commit;
+- the matching release note exists in that commit and has the required title
+  and sections;
+- all required approvals and automated gates succeeded for that commit; and
+- no local or remote tag already uses the selected version.
+
+Create the version tag against the guarded commit and verify its target before
+publishing it. Publish only the exact intended ref and deliverables. Broad
+operations such as `git push --tags` are discouraged because they can publish
+unreviewed refs unrelated to the release.
+
+The repository-specific procedure must make these guards executable or give
+copyable commands for performing them.
+
+## Immutability And Correction
+
+Published version tags and published deliverables are immutable. Do not move,
+overwrite, recreate, or delete a published tag. Do not replace an artifact,
+image, package, checksum, signature, provenance statement, or release note
+under an already published version.
+
+If validation fails before publication, correct the candidate, rerun the
+complete gates, and repeat the publication guards. An unpublished local tag
+may be removed after confirming that it was never published or used by a
+release channel.
+
+If publication or post-publication verification reveals a defect, leave the
+published release intact. Correct the defect on the primary branch, choose a
+new patch version or other semantically appropriate new version, write a new
+matching release note, and perform the complete release procedure again.
+
+A distribution channel's supported yank, deprecation, or advisory mechanism
+may warn consumers away from a defective release, but it must not replace that
+release's contents or reuse its version.
+
+## Repository Release Procedure
+
+Every adopting repository must maintain `docs/release.md` as the canonical
+maintainer runbook for implementing this policy. It must define, in execution
+order:
+
+1. maintainer prerequisites and required access;
+2. version selection and compatibility review;
+3. release-note creation;
+4. candidate preparation and the complete validation command;
+5. candidate commit, push, and exact commit recording;
+6. publication guards;
+7. exact tag and deliverable publication commands;
+8. authoritative remote and consumer-facing verification; and
+9. failure handling and correction.
+
+The procedure should use copyable, fail-fast commands where practical. It must
+name the primary branch, authoritative remote, tag form, published
+deliverables, supported build targets, release automation responsibilities,
+and consumer verification path. It must link to this policy instead of
+restating or redefining its requirements.
+
+## Policy Exceptions
+
+### Tag-push completion and asynchronous deliverables
+
+Narratio's automated release responsibility ends when the exact intended tag is
+successfully pushed to `origin`. It must not wait for, poll, or check CI/Gitea
+results, download assets, or verify their checksums as a completion condition.
+Binary and checksum publication is asynchronous; consumer-facing inspection is
+optional follow-up, not a gate on the source release.
+
+This deliberately qualifies the base policy's complete-deliverable and
+post-publication verification requirements. CI reliability is outside the
+release command's scope; an unavailable publication service must not cause an
+automated releaser to wait indefinitely or claim to repair a published version.
+
+Compensating controls are complete local candidate validation (including supported
+cross-builds and a host version check), exact source/tag guards, immutable source
+tags, asynchronous build validation, and non-overwriting asset publication.
+Successful tag publication is not evidence that binary assets are available.
+Optional inspection and corrective-release procedures belong in
+[the release procedure](../release.md).
+
+### Authoritative publication scope
+
+Narratio's synchronous publication guards inspect the authoritative `origin`
+remote and its `main` branch, not every configured Git remote or a Gitea release
+entry. The command does not add release-service or registry availability checks.
+This qualifies the base policy's all-channel unused-version requirement.
+
+Other remotes are not Narratio release authorities, and Gitea asset publication
+is asynchronous. The compensating controls are local and origin tag uniqueness,
+exact candidate matching, and the publisher's non-overwrite settings. Any known
+already-published version or conflicting deliverable remains ineligible for
+reuse: choose a new version rather than bypassing guards. A future additional
+distribution channel requires deliberate policy/procedure updates.

docs/policy/testing.md

@@ -1,5 +1,9 @@
 # Testing Policy
 
+**Base Policy Version:** 1.0
+
+**Last Updated**: 2026-09-25
+
 ## Purpose
 
 Our tests exist to make **incorrect changes expensive and correct changes cheap**.

docs/release.md

@@ -1,71 +1,97 @@
 # Releasing Narratio
 
-This document is the maintainer procedure for creating a Narratio source and
-binary release. The synchronous release boundary is a successful push of one
-new tag to `origin`; Woodpecker and Gitea publication happen later and do not
-change that result.
+This is the maintainer runbook for the [Release Policy](policy/release.md).
+Its [explicit exceptions](policy/release.md#policy-exceptions) preserve the
+successful tag push as the automated responsibility boundary. Binary publication
+is asynchronous; later consumer-facing inspection is optional.
+
+## Prerequisites and publication scope
+
+Use a checkout on `main` with Git authentication permitting fetches and pushes
+to `origin`, the authoritative Git remote. Install Git, a POSIX shell, standard
+Unix build tools, and the Go toolchain below. Make required modules available
+before offline validation. No model/provider credentials are needed. Gitea
+publication credentials belong to CI's secret store, not the local command.
+
+Synchronous guards inspect local tags and `origin`, not every configured remote
+or Gitea release entry. Do not select a version known to have been published in
+any channel, even if these guards cannot see it.
 
 ## Go prerequisite
 
 Release preparation requires the maintained Go 1.26 baseline. Tag CI currently
-uses the explicitly pinned `golang:1.26.7` image for candidate validation and
-asset construction; that asynchronous work does not change the tag-push
-completion boundary.
+uses the explicitly pinned `golang:1.26.7` image for validation and asset builds.
+That asynchronous work does not change the tag-push completion boundary.
 
 ## Choose a version and write its note
 
-Narratio is past `v1.0.0`. Use an unused stable tag in the exact form
-`vMAJOR.MINOR.PATCH`:
+Select an unused stable version under the
+[versioning rules](policy/release.md#versioning-and-compatibility). Narratio is
+past v1.0.0; intentional CLI/configuration breaks require a major release.
 
-- increment `MINOR` for backward-compatible features;
-- increment `PATCH` for backward-compatible fixes; and
-- reserve a new `MAJOR` for an intentional breaking documented contract.
+Create `docs/releases/vMAJOR.MINOR.PATCH.md` using the
+[required note structure](policy/release.md#release-documentation).
+Describe CLI, configuration, artifact, integration, and operating-contract
+changes, and the required operator action. Link to current canonical
+documentation for exact behavior.
 
-Before preparing the candidate, create
-`docs/releases/vMAJOR.MINOR.PATCH.md` with this structure:
+## Prepare and record the candidate
 
-```markdown
-# Narratio vMAJOR.MINOR.PATCH
+Before committing, perform these manual reviews in addition to automated checks:
 
-This release ...
+- Confirm compatibility/version selection and update affected canonical
+  documentation and maintained examples.
+- Remove completed roadmap documents covering work included in this release;
+  retain pending work. Their history remains in Git. Do not delete historical
+  release notes.
+- Review the diff, staged changes, and untracked files for credentials, private
+  data, generated output, unintended files, and unrelated changes.
+- Review changed documentation links and behavior-bearing commands. Automated
+  link checks supplement rather than replace review.
 
-## Summary
+Commit the note and candidate changes, then push that commit to `main` through
+the ordinary development workflow. Record the exact candidate:
 
-## Compatibility
-
-## Upgrade
-
-## Changes
+```sh
+git rev-parse HEAD
 ```
 
-The compatibility section identifies relevant CLI, configuration, artifact,
-integration, or operating-contract changes. The upgrade section states the
-required operator action, or explicitly says that no special action is
-required. Release notes are immutable historical summaries; link to the
-current canonical documentation for detailed behavior.
-
-Commit the note and all candidate changes, then use the ordinary development
-workflow to push that commit to `main`. Do not create a release tag before the
-candidate is committed and `origin/main` contains the exact same commit.
+Do not create a tag until `origin/main` points to that same commit. If the
+candidate changes, repeat the reviews and validation.
 
 ## Validate the candidate
 
-Run the shared checker from any directory:
+From the repository root, run:
 
 ```sh
 scripts/check-release-candidate.sh vMAJOR.MINOR.PATCH
 ```
 
+The script also works when invoked by its absolute path from another directory.
 It validates the version and matching note, module hygiene, formatting,
 whitespace, uncached tests, race tests, static checks, documentation, examples,
-and three official cross-build assets. It uses `GOWORK=off`, does not contact
-application services, CI, or Gitea, and does not create tags or modify tracked
-source. Fix any failure on `main`, commit it, push it normally, and rerun the
-checker.
+and three cross-build assets. It uses `GOWORK=off`, does not contact application
+services, CI, or Gitea, and does not create tags or modify tracked source.
+Fix failures on `main`, commit, push normally, and rerun validation.
 
-The checker builds Linux assets for `amd64` and `arm64` and a macOS asset for
-`arm64`. The macOS cross-build proves compilation; it is not native macOS
-runtime evidence.
+The macOS cross-build proves compilation, not native runtime behavior.
+
+## Declared deliverables and automation
+
+The source release is the exact version tag at the validated commit.
+The tag-triggered `.woodpecker/release.yml` validates the tagged source,
+runs `scripts/build-release-assets.sh`, and publishes these Gitea assets:
+
+- `narratio-vMAJOR.MINOR.PATCH-linux-amd64`
+- `narratio-vMAJOR.MINOR.PATCH-linux-arm64`
+- `narratio-vMAJOR.MINOR.PATCH-darwin-arm64` (best effort)
+- `SHA256SUMS`
+
+The builder embeds the version, disables ambient Go workspaces, and checks a
+host binary's `version` output. The release publisher uses the matching
+checked-in note and generates SHA-256 checksums. Existing files are skipped and
+overwrite is disabled. No image or package-registry deliverable is declared.
+CI does not choose versions, modify source candidates, or move tags.
 
 ## Publish the tag
 
@@ -78,27 +104,64 @@ scripts/release.sh vMAJOR.MINOR.PATCH
 The command fetches and checks `origin/main`, re-runs candidate validation,
 then fetches and checks again before creating an explicitly unsigned lightweight
 tag for the originally recorded commit. It refuses dirty, divergent, changed,
-or already-tagged candidates. It pushes only:
+or already-tagged candidates. It verifies the local tag target and pushes only:
 
 ```text
 refs/tags/vMAJOR.MINOR.PATCH:refs/tags/vMAJOR.MINOR.PATCH
 ```
 
-It never commits changes, pushes `main`, force-pushes, moves a tag, or pushes
-all tags. A successful push of that exact ref completes the release command;
-the command prints the tag and commit, then returns without waiting for CI,
-querying Gitea, downloading assets, or checking checksums.
+It never commits changes, pushes `main`, force-pushes, moves tags, or pushes all
+tags. Successful publication of that ref completes the command; it prints the
+tag and commit and returns without waiting for CI, querying Gitea, downloading
+assets, or checking checksums.
 
-If a failure occurs before the tag is created, correct the candidate on `main`
-and repeat validation. If the push fails after local tag creation, the local tag
-is intentionally retained for inspection and the command must not be retried
-blindly. Once the upstream tag has been pushed, it is immutable. Correct any
-defect or failed asynchronous publication with a new patch version, a new
-release note, and the complete procedure again.
+## Failure handling
+
+Before tag creation, correct the candidate on `main` and repeat validation.
+If a push fails after local tag creation, the local tag is retained for inspection.
+Do not retry blindly or assume the remote received nothing: a connection failure
+can leave publication uncertain. Inspect the exact remote ref before taking any
+local-tag cleanup action. This is recovery from a failed command, not a
+post-success publication gate.
+
+After publication, follow the
+[immutability and correction rules](policy/release.md#immutability-and-correction).
+Correct defects or failed asynchronous publication with a new semantically
+appropriate version, matching note, and the complete procedure. Never replace
+existing tagged assets in place.
 
 ## Optional asynchronous inspection
 
-After a successful tag push, a human may later inspect the tag-triggered
-Woodpecker run and the corresponding Gitea release for binaries and checksums.
-This is optional follow-up only. Automated releasers must not wait for, poll,
-or treat CI/Gitea completion as a condition of the successful tag push.
+A human may later inspect the tag-triggered Woodpecker job and Gitea release.
+This is optional follow-up, never part of the automated releaser's completion
+criteria. Do not wait for or poll CI/Gitea from the release command.
+
+For optional source verification, substitute the released version below and
+compare the remote target to the recorded candidate hash:
+
+```sh
+git ls-remote --tags origin refs/tags/vMAJOR.MINOR.PATCH
+git rev-parse 'refs/tags/vMAJOR.MINOR.PATCH^{commit}'
+```
+
+Download the three named binaries and `SHA256SUMS` from the matching Gitea release
+into an empty inspection directory. In that directory, verify on Linux:
+
+```sh
+sha256sum --check SHA256SUMS
+```
+
+On macOS, use `shasum -a 256 --check SHA256SUMS`. After successful verification,
+make the matching host binary executable and run its version command, for example
+on Linux amd64 (replace the version in both commands):
+
+```sh
+chmod +x ./narratio-vMAJOR.MINOR.PATCH-linux-amd64
+./narratio-vMAJOR.MINOR.PATCH-linux-amd64 version
+```
+
+Expected output is `narratio vMAJOR.MINOR.PATCH`. Use only the matching architecture
+on other supported hosts. Checksums establish consistency with the downloaded
+checksum file, not a new signature or independent authenticity guarantee.
+Missing assets are an asynchronous publication problem, not grounds to move or
+reuse the successfully published source tag.

docs/releases/v2.2.1.md

@@ -0,0 +1,35 @@
+# Narratio v2.2.1
+
+This maintenance release consolidates checkpoint persistence for transcription
+and analysis without changing their operator-facing behavior.
+
+## Summary
+
+Transcribe and analyze now share one internal operation for preparing isolated
+checkpoint candidates, saving them, and promoting successfully saved progress
+into live state. Each stage retains its own progress model and recovery policy.
+
+## Compatibility
+
+CLI commands, configuration, manifest schemas, artifact formats, and external
+integration contracts are unchanged. Speaker concurrency, artifact selection,
+force behavior, and ordinary resume semantics are preserved. No dependency
+upgrade or new external-tool version requirement is introduced.
+
+## Upgrade
+
+No special upgrade action or configuration migration is required when upgrading
+from v2.2.0. See the [v2.2.0 release notes](v2.2.0.md) when upgrading from an
+earlier version for the original speaker-checkpoint upgrade considerations.
+
+## Changes
+
+- Replace duplicate analyze/transcribe save-and-promote sequences with a
+  shared, private checkpoint helper.
+- Isolate checkpoint collections from live state, including analyze records
+  normalized during a transcription checkpoint save.
+- Preserve transcription's caller-owned locking and failure handling, and
+  analysis's working/committed collections and rollback behavior.
+- Add focused checkpoint integrity tests while retaining stage and application
+  recovery coverage.
+- Document the shared [checkpoint persistence boundary](../internal/manifest.md#checkpoint-persistence-boundary).

docs/roadmap/audita.md

@@ -0,0 +1,288 @@
+# Adopt Audita v2 and ConfigKit v0.4.0
+
+Status: implemented (2026-09-25); release pending.
+
+## Goal
+
+Migrate Narratio's `polish` integration from Audita's former command/configuration
+contract to Audita v2.0.0. Keep Narratio responsible for orchestration and Audita
+responsible for correction behavior and LLM execution configuration.
+
+Adopt a consistent provider-named credential list for both Audita and Notarius,
+so operators define each secret once and explicitly share it with the downstream
+applications that need it. This is a clean cutover without backward-compatibility
+shims.
+
+Adopt ConfigKit v0.4.0 and use “overlay” consistently for Narratio's selected
+pipeline configuration, distinct from downstream LLM model profiles.
+
+Production runs use Audita's default reporting configuration: Narratio passes
+neither `--debug` nor `--reporting=false`. Normal reports remain available without
+enabling debug diagnostics. Adding debug reporting through Narratio's testing
+profile is deferred.
+
+This document defines the intended end state, migration scope, and policy.
+The [implementation plan](implementation.md) owns implementation sequencing and
+verification steps.
+
+## Baseline and upstream contract
+
+The baseline is Narratio v2.2.1 and the Audita checkout tagged v2.0.0. Upstream
+references are Audita's `docs/migrations/v2.md`, `docs/cli.md`,
+`docs/integrations/subprocess.md`, and `docs/integrations/output-files.md`,
+available in the sibling `../audita/` checkout. Narratio's current contract is
+documented in [Integration: Audita](../integrations/audita.md).
+
+The current integration is not compatible with Audita v2:
+
+- It requests `--report-json` by default; that flag has been removed.
+- It can pass retired endpoint, model, concurrency, and work-directory-retention
+  flags.
+- It expects one JSON report instead of the normal v2 report bundle.
+- Its single forwarded `AUDITA_LLM_API_KEY` has no implicit meaning in v2;
+  an Audita backend must explicitly reference that environment variable.
+- Its semantic fingerprint sorts modules, although Audita treats module order
+  and repetitions as meaningful.
+
+Audita v2 requires a version-2 configuration file. An explicit `--config` selects
+one; otherwise Audita performs its own documented discovery. Backend definitions
+own endpoints, credentials, and capacity. PromptKit profiles own models and
+per-attempt controls. Audita owns retry/repair policy and operation deadlines.
+Narratio's generated invocation YAML is a diagnostic record, not a substitute
+for that Audita configuration file.
+
+## Target architecture
+
+Retain the existing subprocess boundary and `polish` stage. Do not introduce a
+second correction engine, an in-process Audita dependency, or a generic external
+tool configuration framework.
+
+Narratio owns:
+
+- Selection of the executable and the overall invocation timeout/cancellation.
+- Transcript and glossary inputs, run-local output placement, validation of the
+  corrected transcript, and promotion to the existing polished transcript
+  identity.
+- Explicit configuration/profile selections and supported domain overrides.
+- Deliberate credential forwarding, secret-safe invocation diagnostics, and
+  manifest references to results and reports.
+- Existing stage completion, resume, force, publish, restore, and cleanup
+  behavior.
+
+Audita owns its configuration schema and discovery, backend/model configuration,
+provider execution, correction sequence, recovery behavior, and report contents.
+Narratio does not translate old settings into a generated v2 configuration or
+duplicate Audita's complete validation logic.
+
+## Configuration and invocation migration
+
+### ConfigKit and pipeline overlays
+
+Upgrade Narratio's ConfigKit dependency from v0.3.1 to v0.4.0. ConfigKit's
+selected-configuration terminology changes from profile to overlay: the Go API
+uses `Options.Overlay`, `LayerOverlay`, and `CodeOverlay*`; source layers and
+diagnostic codes use `overlay` and `overlay.*`. Composition, precedence, secret
+resolution, and lifecycle semantics otherwise remain unchanged.
+
+Narratio's pipeline-selection interface becomes `--overlay`, selecting
+`overlays/<name>.yml` beside the root pipeline file. Remove `--profile` and old
+selected-directory discovery without aliases or fallbacks. Preserve existing
+base selection for omission, explicit empty selection, and `default`.
+Configuration inspection, diff descriptions, internal selection names, and
+newly written selection provenance use overlay terminology as well.
+
+Maintain existing value-based digest and stage-reuse semantics; renaming
+informational selection provenance is not a reason to invalidate completed
+work or automatically rewrite historical manifests. Strict manifest decoding
+rejects retired provenance fields; operators must deliberately migrate that
+informational member on a backed-up manifest, preserving execution/checkpoint
+state. Update maintained examples and operator migration guidance for the
+directory, flag, and provenance changes.
+
+This rename does not apply to downstream model profiles, Scriptorium
+`profile_id`, Audita's proposal/validation profiles, or Notarius's
+`config_profile`. Nor does it prohibit ordinary explicit imports from a directory
+named `profiles`. Narratio overlays do not automatically select downstream
+overlays or profiles. These are independently owned choices.
+
+### Audita v2 configuration
+
+Keep binary, timeout, explicit config-path selection, and surviving explicit
+domain overrides such as transcript description, output schema, and modules.
+Allow Audita's native configuration discovery when no config path is selected;
+do not impose an additional requirement to supply an explicit path.
+
+Provide optional Audita overlay, proposal-profile, and validation-profile
+selectors, passed through to their corresponding CLI flags. Omission leaves
+Audita's own defaults and validation-profile inheritance in control. These are
+Audita selectors, not automatic translations of Narratio overlay names.
+
+Retire the Narratio settings that mirror removed Audita endpoint/model/capacity
+flags and work-directory retention. Move their operational meaning into the
+operator-maintained Audita configuration and profiles. Remove stale adapter
+fields, validation, invocation metadata, examples, and tests along with them.
+Remove the old report toggle and both adapters' singular `llm_api_key` fields
+from accepted Narratio configuration. Do not retain deprecated aliases,
+automatic conversion, ignored fields, or a v1 execution path. Existing strict
+configuration decoding rejects removed fields. Provide migration guidance and a
+release compatibility notice rather than runtime compatibility machinery.
+
+Preserve the distinction between omitted modules and an explicitly empty module
+list: omission requests Audita's configured/default sequence; an empty list
+requests no correction modules. Preserve order and repetitions rather than
+sorting or deduplicating. Do not broaden this into a change to unrelated
+adapters' module semantics.
+
+Normal invocations no longer pass `--report-json`, `--work-dir-retention`, or
+debug-work-directory flags as a way to obtain reports. They need no reporting
+override: Audita writes its ordinary report bundle by default. The old
+Narratio `report` toggle must not silently become `--reporting=false`.
+
+The production Audita configuration must also retain reporting enabled and debug
+disabled. Omitting CLI flags does not override an operator's explicit external
+configuration. Document this distinction rather than silently adding forced
+boolean overrides or rejecting otherwise valid Audita configuration.
+
+## Credentials
+
+Define secrets once under provider-oriented environment-variable names, such as
+`OPENROUTER_API_KEY` and `RAKESTRAWHOME_API_KEY`, through the process environment
+or Narratio's existing secrets-directory bootstrap. These names are examples,
+not a fixed provider registry; application-specific names are not required.
+
+Add `pipeline.audita.credentials` and `pipeline.notarius.credentials` as lists
+of Narratio typed secret references. Each entry names the environment variable
+whose captured value is forwarded under that exact name. Omission or an empty
+list forwards no credentials. The same reference may appear in both adapters'
+lists without duplicating its stored secret value. An illustrative configuration
+fragment is:
+
+```yaml
+pipeline:
+  audita:
+    credentials:
+      - OPENROUTER_API_KEY
+      - RAKESTRAWHOME_API_KEY
+  notarius:
+    credentials:
+      - OPENROUTER_API_KEY
+```
+
+Resolve references through the existing configuration/secret-loading mechanism
+before adapter execution, preserving its nonempty-value requirement. Forward
+the captured values rather than rereading the parent environment during a run.
+Retain the minimal child execution environment plus each adapter's explicit
+credential list; do not forward every secret found during bootstrap.
+
+Audita backends select these names through `credential`; the current Notarius
+PromptKit profiles select them through `api_key_env`. Narratio neither inspects
+downstream configuration to infer required credentials nor translates names,
+registers providers, or duplicates backend configuration. Audita resolves
+credentials for every surviving configured backend, even one not selected by
+a profile, so its list must cover all those references.
+
+Generalize Notarius's current single-name forwarding and replace Audita's fixed
+`AUDITA_LLM_API_KEY` destination with this shared convention. Use existing shared
+secret and subprocess facilities, extending narrow helpers where needed rather
+than introducing a new secret-management framework. Register every forwarded
+credential with captured-output redaction, including custom names and multiple
+keys. Values must not enter arguments, generated configuration, manifests,
+logs, or examples. As today, downstream tools remain responsible for files they
+write directly; this does not add arbitrary downstream-file scanning.
+
+## Ordinary reports and result handling
+
+Replace the old `audita.report.json` handling with Audita's normal `errors.yml`,
+`recoveries.yml`, and `report.md` bundle. With a file output, Audita writes these
+beside the corrected transcript; an arbitrary report destination is not supplied
+through the removed report flag.
+
+Discover the reports at their defined run-local locations and retain them as
+diagnostics using Narratio's existing manifest and diagnostic lifecycle. Keep
+them distinguishable from the canonical polished transcript. Adapt report
+references, publication/restore coverage, and operator inspection guidance so
+the bundle is not lost or confused with an older run's JSON report. Do not
+fabricate a legacy JSON report or delete historical diagnostics as part of the
+migration.
+
+Retain existing bounded, confined file handling. Replace JSON-specific report
+handling with only the validation needed for consuming the v2 bundle; do not
+introduce a second comprehensive report-schema validator or make incidental
+Markdown wording a contract. Report locations must be discoverable without
+parsing human-readable stderr. Detailed report-counter ingestion is not required
+for this migration.
+
+Audita's exit status remains authoritative. Exit zero with a valid corrected
+transcript may include recoverable LLM failures, including a normalized result
+with no model corrections. Preserve the reports so operators can assess that
+outcome; do not add an unrequested fail-on-recovery or minimum-correction policy.
+
+Conversely, a nonzero exit must fail polish even if a transcript file exists:
+Audita can fail while writing required reports after writing the transcript.
+Preserve available failure diagnostics without requiring early failures to have
+produced a complete report bundle. Failed output must not become the canonical
+successful result.
+
+## Resume and semantic evidence
+
+Update polish's semantic evidence for the new result-affecting selections and
+remove retired endpoint/model fields. Include explicit config/overlay/profile
+selection and preserve ordered module semantics, including omitted versus empty
+selection. Version the changed evidence so incompatible older evidence is not
+mistaken for a valid match when polish is considered for reuse.
+
+Keep the existing boundary for opaque downstream configuration: Narratio does
+not recursively hash Audita configuration, overlays, and profile contents.
+Operators force polish when changing contents behind unchanged selectors.
+Timeouts, credential values, reporting details, and other execution-only settings
+must not become blanket semantic invalidation keys. Do not rerun unrelated or
+unselected stages merely because the integration was upgraded.
+
+## Migration guidance and verification
+
+Update the canonical [configuration reference](../config.md),
+[Audita integration contract](../integrations/audita.md),
+[Notarius integration contract](../integrations/notarius.md),
+[polish internals](../internal/stage-polish.md), maintained examples, and relevant
+operations/troubleshooting guidance when implementation lands. Cover:
+
+- Moving selected Narratio pipeline files to `overlays/`, replacing `--profile`
+  with `--overlay`, and distinguishing configuration overlays from model profiles.
+- Updating ConfigKit API/source attribution and verifying unchanged effective
+  values retain existing semantic reuse behavior.
+- Preparing and validating an Audita v2 configuration and its profiles before
+  switching the executable; copying an old v1 configuration is insufficient.
+- Moving endpoint, model, capacity, and credential selections to their v2 owners.
+- Replacing both singular `llm_api_key` settings with explicit `credentials`
+  lists, storing each provider key once, and matching downstream credential
+  references to those names. State clearly that old fields are removed.
+- Using normal reports to inspect recoveries and failures without debug mode.
+- Force/resume expectations and the treatment of existing completed sessions.
+- The explicitly deferred nature of Narratio testing-profile debug support.
+
+Verification should exercise the real adapter boundary with offline subprocess
+fixtures and focused stage/configuration tests: accepted v2 arguments, omitted
+defaults, ordered/empty modules, secret-safe forwarding, successful report
+capture, recoverable-error success, nonzero exit with an existing transcript,
+failure diagnostics, and semantic reuse/invalidation. Update existing behavioral
+tests rather than retaining assertions for removed flags or exact stderr prose.
+Where practical, verify invocation against the tagged Audita CLI without live
+provider calls. Follow the repository's testing and documentation policies.
+
+Credential tests must cover both adapters, multiple custom names, reuse of one
+secret by both tools, no forwarding of unselected secrets, captured-value
+semantics, and redaction of every forwarded value. Verify removal of obsolete
+configuration fields without preserving their compatibility behavior.
+
+## Scope boundaries
+
+No changes to pipeline order, transcript identity, downstream artifact
+definitions, or provider algorithms are intended. No automatic v1 configuration
+converter, Audita-internal resume mechanism, runtime binary-version negotiation,
+or live-service release gate is required. Debug-profile integration and ingestion
+of Audita's debug-only execution artifacts are future work.
+
+The Notarius change is limited to credential configuration, forwarding, and
+associated diagnostics/documentation/tests; extraction and cache behavior are
+unchanged. This migration breaks existing pipeline configurations using removed
+fields; account for that explicitly in Narratio release versioning.

docs/roadmap/implementation.md

@@ -1,416 +1,465 @@
-# Implementation Plan: Speaker Checkpoints and Replayable Uploads
-
-Status: Implementation complete; Stages 1-7 complete.
-
-## Scope and Instructions
-
-Implement [the feature roadmap](transcribe-checkpoints-and-replay.md). This plan
-replaces the completed Notarius-profile plan; that work remains in Git history.
-Complete the numbered stages in order, one bounded implementation prompt per
-stage for gpt-5.6-terra. Record completion and actual verification results here.
-Intermediate stages are not a finished feature and must not be released alone.
-
-Before working, read `AGENTS.md`, `docs/development.md`, all three policies in
-`docs/policy/`, the roadmap, and the stage-specific preparation below. Use the
-maintained Go 1.26 toolchain. Preserve operator choices, speaker filenames,
-bounded concurrency, streaming, and existing credentials/settings. Do not add
-new commands, dependencies, service requirements, arbitrary speaker limits,
-strict transcript schemas, or a generic checkpoint framework. No release or
-upstream service work is part of this plan.
-
-## Settled Design Decisions
-
-### Progress Representation and Recovery
-
-Add optional `transcribe_state_version` (version 1) and `transcribe_speakers`
-to `manifest.StageRecord`. The latter is a map keyed by the existing derived
-speaker ID, containing completed results only. Absence means that work must be
-done; a separate pending/running/failed state machine is unnecessary. Aggregate
-stage status/error remains authoritative for invocation failure. A versioned
-empty collection is meaningful: no earlier completions are reusable.
-
-Use a typed `TranscribeSpeakerRecord` with fingerprint version/digest,
-session-relative audio path, audio SHA-256 and size, one `ArtifactRecord` output
-of kind `transcript_raw`, output size, and producer run ID. The output carries
-its session-relative canonical path and SHA-256. No new transcript source IDs,
-synthetic schema contracts, timestamps, or historical attempt collections are
-needed. Existing aggregate diagnostics can retain attempt/status/duration data
-for work performed in the current invocation; do not fabricate that information
-for reused outputs.
-
-Keep the session-manifest schema identifier unchanged for this optional additive
-state; validate supported per-stage versions and retain strict decoding. New
-Narratio reads old manifests. Old binaries may reject the added fields under
-their existing strict decoding; document this downgrade limitation.
-
-For pre-feature manifests with no speaker evidence, regenerate transcription
-once when transcribe is next selected, even if the aggregate status succeeded.
-Old records do not bind individual transcript results to the audio bytes they
-used. Do not guess that association from current files, old `per_file` metadata,
-or abandoned run directories. This is the conservative upgrade path, not a new
-general migration system. No other stage or unselected range is forcibly run.
-
-### Reuse and Persistence
-
-Compute a versioned per-speaker fingerprint from speaker ID, session-relative
-audio identity, actual audio SHA-256/size, and the existing transcribe semantic
-configuration fingerprint (URL and language). Do not include invocation ID,
-absolute workspace root, concurrency, retry settings, timeout, or credentials.
-Stream input hashing with cancellation; do not trust stored input checksums
-alone. Recheck input bytes before accepting a new result to catch changes
-observed during transcription; fail that job without checkpointing mismatched
-evidence. This is not a hostile-filesystem snapshot or concurrent-editor
-transaction guarantee and requires no extra audio copies or file locks.
-
-Validate reusable output identity, canonical location, JSON, checksum, and size.
-Use existing confinement/file primitives. Missing or corrupt regular outputs
-become work; unsafe paths/non-regular conflicts follow existing safety errors,
-not recursive deletion. Missing required audio is an input error, not permission
-to reuse an unverifiable transcript. Removed inputs are removed from the current
-collection and aggregate outputs without deleting arbitrary files.
-
-One stage-owned mutex serializes candidate collection construction, manifest
-save, and installation of committed state. Save a detached candidate and only
-then update live authority, following analyze's pattern. Workers must not mutate
-the live manifest outside that serialized section. Keep expensive HTTP work
-outside the mutex. Stop dispatch/acceptance on checkpoint failure, join workers
-before return, and preserve the last successfully committed collection.
-
-Before launching requests, durably checkpoint the reconciled collection. For
-force, that collection is empty: this prevents later ordinary retries from
-resurrecting pre-force outputs. If this initial save fails, do not start requests
-or overwrite outputs. Force again clears the current collection again; ordinary
-retry retains replacements already checkpointed after the previous force.
-
-Save each validated result at its canonical raw-transcript location before
-checkpointing it. Run-local files remain staging/diagnostics, not reuse
-dependencies. Bytes left by an unsuccessful checkpoint have no completion
-authority. A worker may checkpoint a completed result using the parent stage
-context even if a sibling canceled the work context; parent cancellation or a
-checkpoint failure may prevent that save. Guarantee retention of committed
-work, not all responses that happened to finish during cancellation.
-
-### Multipart Replay Mechanism
-
-Replace the pipe/producer upload mechanism with a small pull-based multipart
-body backed by the audio reader. Use `mime/multipart.Writer` to encode a bounded
-metadata prefix and suffix around the file payload: capture the prefix after
-`CreateFormFile`, then encode the language field and closing boundary as the
-suffix. Generate this framing once per application attempt. Each body combines
-fresh readers for prefix, freshly opened audio, and suffix using `io.MultiReader`.
-No full-audio buffer or temporary multipart spool is needed.
-
-The initial body and `Request.GetBody` use the same factory/framing. Each owns
-an independent audio handle. Give bodies idempotent Close and context-triggered
-closure (for example `context.AfterFunc`), without holding a mutex across a
-blocking Read. Read/Close coordination must release a blocked source and retain
-genuine source-read/close errors while not treating deliberate early closure as
-source failure. The attempt owns cleanup of all created bodies, including
-replays; reject new body creation after its context expires.
-
-Remove the old producer `Wait` dependency. Track body-local source errors with
-synchronization so a swallowed upload read error cannot become a successful
-transcript, and a deliberately closed original body cannot poison a successful
-replay. Keep the outer retry policy and per-attempt context. Do not add replay
-counters to the user retry budget or depend on Go's exact internal retry count.
-Preserve ordinary HTTP redirect policy; body replay can also enable Go's
-body-preserving redirects. Do not introduce a new redirect restriction.
-
-## Stage 1: Add Durable Speaker Completion State
-
-Status: Complete.
-
-Completion marker (2026-09-21): Added optional versioned transcribe-owned
-per-speaker completion records, strict load/save validation, isolated collection
-cloning, legacy aggregate-only compatibility, and lifecycle-preservation
-coverage. Verified with `go test ./internal/manifest` and `git diff --check`.
-
-Preparation: `internal/manifest/manifest.go`, `store.go`, `analyze_state.go`,
-their tests, and `docs/internal/manifest.md`.
-
-1. Implement the additive fields, record type, version constants, validation,
-   and deep-copy helper described above in a focused transcribe state file.
-2. Validate ownership by the transcribe stage, supported versions, required
-   completed-record evidence, output kind, safe relative paths, SHA-256 values,
-   sizes, and producer identity consistency. Use existing speaker IDs as-is;
-   do not apply analysis-artifact key regexes or copy unrelated analysis limits.
-3. Integrate validation with both load and save. Preserve speaker state through
-   running/failed/stale transitions and aggregate result clearing. Generic stage
-   invalidation does not discard checkpoints; reconciliation checks their data.
-4. Test round-trip populated and versioned-empty collections, old manifests
-   without fields, malformed evidence, deep-copy isolation, and lifecycle
-   preservation. Avoid imposing JSON formatting or map order as contracts.
-
-Verify: `go test ./internal/manifest`.
-
-Done when durable storage can represent partial completion independently of
-aggregate status, without activating new stage behavior yet.
-
-## Stage 2: Implement Read-Only Speaker Reconciliation
-
-Status: Complete.
-
-Completion marker (2026-09-21): Extracted shared deterministic transcribe job
-construction and added read-only, cancellation-aware per-speaker input and
-output reconciliation. Covered unchanged reuse, semantic and operational
-settings, changed/added/removed inputs, legacy and forced work, missing/corrupt
-outputs, unsafe evidence, and missing audio without connecting runtime skip or
-checkpoint behavior. Verified with
-`go test ./internal/stage ./internal/manifest` and `git diff --check`.
-
-Preparation: `internal/stage/transcribe.go`, `semantic_contracts_initial.go`,
-`analyze_reconciliation.go`, `extract_resume.go`, their tests, and the artifact
-path/integrity helpers they use.
-
-1. Extract the existing audio discovery/job construction into a shared,
-   transcribe-local reconciliation path. Preserve current input selection and
-   speaker identity behavior. Build sorted jobs and classify completed results
-   against the current input set and evidence defined above.
-2. Add pure fingerprint construction and streamed input/output inspection.
-   Resolve manifest input paths with existing session-relative/absolute reading
-   helpers; do not change input precedence or assume the current working directory
-   is the session root. Newly written checkpoint paths are always relative.
-3. Return current records and work-to-do without writing files or manifest state.
-   Force selects all work and an empty starting collection; old unversioned
-   transcribe state supplies no reusable records. Do not connect aggregate skip
-   validation until execution can produce the new evidence in Stage 3.
-4. Test unchanged reuse; one changed audio among unchanged speakers; URL/language
-   changes; operational-setting exclusions; added/removed speakers; missing and
-   corrupt regular outputs; unsafe record paths; missing audio; and force.
-   Prefer compact tables and real temporary files over mocked hashing.
-
-Verify: `go test ./internal/stage ./internal/manifest`.
-
-Done when one read-only decision path describes exactly which speakers need
-work, without altering existing runtime behavior prematurely.
-
-## Stage 3: Execute and Checkpoint Speakers Incrementally
-
-Status: Complete.
-
-Completion marker (2026-09-21): Connected reconciliation to bounded execution,
-durably checkpointed the starting and per-speaker collections through detached
-manifest candidates, preserved committed work across failures and cancellation,
-rebuilt deterministic aggregate outputs from reusable evidence, and added
-speaker-aware resume validation. Updated production-style fixtures and covered
-serialized concurrent saves, force/retry replacement, input rechecks, save
-failures, partial recovery, and aggregate reconstruction. Verified with
-`go test ./internal/stage ./internal/app`, `go test -race ./internal/stage`, and
-`git diff --check`.
-
-Preparation: `internal/stage/transcribe.go`, `analyze_execution_state.go`,
-`run_local.go`,
-`internal/app/runner.go`, and transcribe/checkpoint test fixtures.
-
-1. Wire reconciliation into Run, require the existing ManifestStore collaborator,
-   and checkpoint the starting collection before launching HTTP work. Implement
-   detached candidate saves and serialized live-state updates. Audit Store.Save's
-   normalization side effects so a failed candidate save cannot mutate shared
-   authority; use detached records/collections wherever it may write.
-2. Retain bounded errgroup execution and fail-fast cancellation. Check the work
-   context before beginning each queued request. After success, validate adapter
-   output path/JSON, recheck audio evidence, materialize canonical bytes, compute
-   output evidence, and checkpoint the new record. Check a checkpoint-failure
-   latch under the serialization lock before accepting further completions.
-3. Preserve committed successes on all error/cancellation exits, including
-   starting-save, canonical-write, per-speaker-save, and aggregate-save failures.
-   Return meaningful speaker/error context and let the runner retain its existing
-   terminal failure behavior. Do not report partial aggregate outputs as success.
-4. Assemble final outputs in deterministic speaker order from the reconciled
-   completed records, including reused speakers, with original producer IDs and
-   checksums. If all records are current but aggregate status is failed/running,
-   finish without WhisperX calls and rebuild the aggregate success.
-5. Implement `transcribeStage.ValidateResume` using the same read-only
-   reconciliation, so a succeeded stage cannot skip changed audio or invalid
-   transcripts. Retain the existing URL/language semantic check and runner
-   invalidation behavior; no whole-config digest invalidation.
-6. Adapt existing tests that require no canonical partial files: the new contract
-   permits checkpointed files but forbids aggregate success. Update fixtures to
-   provide real manifest stores and records rather than a production fallback
-   that silently disables checkpointing.
-7. Test A/B completion followed by C failure and D unattempted (concurrency 1),
-   reload and retry only C/D; concurrently finishing speakers without lost saves;
-   failure and cancellation after a checkpoint; save failure retaining earlier
-   authority; and force failure followed by ordinary retry without old-result reuse.
-
-Verify: `go test ./internal/stage ./internal/app` and
-`go test -race ./internal/stage`.
-
-Done when incremental progress and aggregate success work together safely under
-ordinary, concurrent, canceled, and forced execution.
-
-## Stage 4: Verify Runner, Merge, and Durable Lifecycle Integration
-
-Status: Complete.
-
-Completion marker (2026-09-22): Added real-persistence application coverage for
-cross-invocation retry, interrupted running state, failed aggregate saves,
-force/reset persistence, downstream invalidation, and one-time legacy upgrade.
-Versioned merge input discovery now requires aggregate success and an exact
-match between current speaker evidence and declared aggregate outputs, while
-legacy/manual directory fallback remains available. Restore coverage preserves
-session-relative speaker paths, leaves unpublished raw transcripts absent, and
-canonical transcripts remain reusable after run-directory cleanup. Verified
-with `go test ./internal/app ./internal/stage ./internal/manifest`,
-`go test -race ./internal/app`, and `git diff --check`.
-
-Preparation: `internal/app/runner.go`, `runner_runtime.go`,
-`analyze_checkpoint_recovery_test.go`, `runner_terminal_failure_test.go`,
-`restore_manifest_paths.go`, `internal/stage/merge.go`, and existing publish,
-restore, and cleanup tests routed from `docs/internal/overview.md`.
-
-1. Add application-level tests with real manifest persistence and fake WhisperX:
-   failed stage across separate invocations; all speakers committed before a
-   failed aggregate save; interrupted running state; force/reset persistence;
-   and unchanged upstream/succeeded downstream invalidation behavior. Inject
-   errors at durable boundaries, not every private method call.
-2. Close `discoverRawTranscripts`' directory-scan fallback for versioned
-   transcribe state: incomplete aggregate state is not usable, and completed
-   state consumes only declared current aggregate outputs. Keep legacy/manual
-   fallback behavior for manifests without the new state rather than banning
-   previously allowed standalone workflows. Test that partial files and removed
-   speaker files cannot leak into a versioned merge, including direct stage calls.
-3. Audit manifest copies/projections, remote manifest publication, restored path
-   handling, and cleanup. Preserve relative speaker paths on restore and verify
-   they resolve under the destination session, not the producer machine. Reuse
-   existing confinement validation, not a second path-policy layer.
-4. Add focused round-trip coverage through existing publish/restore fixtures for
-   speaker records. Restored outputs absent from the published selection are
-   non-reusable locally; do not silently expand remote publication to every raw
-   speaker or upload audio as a new default. Removing run directories must not
-   remove canonical checkpointed transcripts or make reuse require run files.
-5. Verify old succeeded manifests are readable and rerun once when transcribe is
-   selected, then reuse normally. Keep old manifests usable for other commands
-   and bounded ranges. Do not automatically import old unrecorded JSON files.
-
-Verify: `go test ./internal/app ./internal/stage ./internal/manifest` and
-`go test -race ./internal/app`.
-
-Done when the new authority survives runner and storage lifecycles and cannot
-expose incomplete transcripts downstream.
-
-## Stage 5: Implement Replayable Streaming Multipart Bodies
-
-Status: Complete.
-
-Completion marker (2026-09-22): Replaced the producer-goroutine/pipe upload
-with bounded standard-library multipart framing and independently opened,
-pull-based streaming bodies shared by the initial request and `GetBody`.
-Bodies are tracked, idempotently closed, canceled with their attempt context,
-and retain genuine read/close failures without treating an intentionally
-abandoned original as a replay failure. Added focused coverage for identical
-framing, partial-read restart, simultaneous handles, source failures, and
-blocked-reader release. Verified with `go test ./internal/adapters/whisperx`,
-`go test -race ./internal/adapters/whisperx` (including ten repeated runs), and
-`git diff --check`.
-
-Preparation: `internal/adapters/whisperx/http.go`, `http_test.go`,
-`docs/integrations/whisperx.md`, and the installed Go net/http Request/GetBody
-contract. Keep this change inside the WhisperX adapter.
-
-1. Implement the pull-based framing/body factory described above, using standard
-   multipart encoding rather than hand-escaped MIME headers. Add no new payload
-   cap or upload-size setting. Preserve file-before-language wire semantics and
-   the existing form names.
-2. Install the initial body and GetBody with the same per-attempt boundary.
-   Track and close all opened bodies even if a custom transport returns early;
-   make cleanup/context callbacks safe against overlapping reads and closes.
-   A GetBody failure must be returned, not converted into an empty upload.
-3. Replace pipe-specific Wait/error paths in doTranscribeAttempt with source-error
-   handling appropriate to pull bodies. Genuine source errors remain visible;
-   intentional closure during transport retry is not itself a source error.
-   Keep response bounds, JSON validation, output installation, retry
-   classification/delay, cancellation, and application attempt reporting intact.
-4. Remove obsolete producer-only helpers rather than retaining two upload paths.
-   Adapt tests tied to producer goroutines to assert streaming and resource
-   release, which are the actual contracts.
-5. Add focused body tests: original/replayed bytes parse identically; replay
-   after partial consumption starts from the beginning; simultaneous bodies use
-   independent handles; source failures propagate; Close/cancel releases a
-   blocked reader without deadlock. Use synthetic audio and gated readers.
-
-Verify: `go test ./internal/adapters/whisperx` and
-`go test -race ./internal/adapters/whisperx`.
-
-Done when replay is available without whole-file buffering or producer-lifetime
-ambiguity, and all existing HTTP behavior tests still pass.
-
-## Stage 6: Verify Replay Through the HTTP Adapter Boundary
-
-Status: Complete.
-
-Completion marker (2026-09-22): Added a deterministic transport regression
-that abandons a partially consumed original request, obtains and parses a fresh
-multipart replay from `GetBody`, and installs the returned transcript within one
-application attempt. Covered replay open/read failures, early responses,
-parent cancellation during replay, and disposal of every opened source, while
-proving an abandoned original does not poison a valid replay. Added a real HTTP
-retry-exhaustion integration that durably retains an earlier speaker and resumes
-only the uncommitted speakers. This controlled boundary verifies Narratio's
-replay contract, not recovery from every real proxy protocol failure. Verified
-with `go test ./internal/adapters/whisperx ./internal/app ./internal/stage`,
-`go test -race ./internal/adapters/whisperx ./internal/app ./internal/stage`,
-ten repeated race-enabled adapter runs, and `git diff --check`.
-
-Preparation: Existing injectable HTTPClient/RoundTripper seam and local-server
-tests in `internal/adapters/whisperx/http_test.go`; app WhisperX wiring tests.
-
-1. Add a deterministic transport-boundary regression: consume part of the
-   original request, close it as a transport would, call GetBody, consume and
-   parse the replay using the request Content-Type, then return valid JSON.
-   Verify exact audio/language, installed output, and one application attempt.
-   This must fail before replay support; merely checking non-nil GetBody is
-   insufficient. Do not assert Go's internal retry count or require a flaky
-   handcrafted HTTP/2 peer in the default suite.
-2. Cover replay-open/read failure, early response, parent cancellation during
-   replay, and disposal of all body handles. Reuse Stage 5 body coverage rather
-   than repeat every low-level case. Prove an intentionally abandoned original
-   body does not turn a valid replay response into failure.
-3. Retain local HTTP tests for application retries, non-retryable responses,
-   response limits, invalid JSON, and bounded streaming; exercise that an
-   exhausted HTTP failure still leaves earlier speaker checkpoints reusable
-   using the existing stage/app seams.
-4. Record the verification boundary honestly: controlled transport replay proves
-   Narratio's body contract, not recovery from every real proxy PROTOCOL_ERROR.
-
-Verify: `go test ./internal/adapters/whisperx ./internal/app ./internal/stage`
-and race tests for changed packages.
-
-Done when the replay defect is protected at the adapter boundary and the
-application retry/checkpoint behavior remains intact.
-
-## Stage 7: Document and Validate the Completed Feature
-
-Status: Complete.
-
-Completion marker (2026-09-22): Updated the canonical transcribe, merge,
-manifest, WhisperX, operations, and troubleshooting documentation for durable
-speaker reconciliation, serialized checkpoints, aggregate gating, durable
-force reset, legacy upgrade and downgrade limits, replayable streaming bodies,
-resource ownership, and the absence of an exactly-once remote guarantee.
-Reviewed the completed implementation against the feature roadmap and
-implementation-discipline guidance. Verified with `go test ./...`,
-`go test -race ./...`, `go vet ./...`, `go build ./...`,
-`go test ./internal/doccheck`,
+# Implementation Plan: Audita v2 and Shared Provider Credentials
+
+Status: Complete (2026-09-25).
+
+## Scope and working instructions
+
+Implement [the Audita roadmap](audita.md). The baseline is Narratio commit
+`70f1dbf` (v2.2.1), with ConfigKit v0.4.0 and Audita v2.0.0 as the target
+upstream contracts. This replaces the completed checkpoint-refactoring plan,
+which remains in Git history.
+
+Complete Stage 1 through Stage 8 in order, one bounded implementation prompt per
+stage for gpt-5.6-terra. Record completion and actual verification results under
+each stage. These instructions apply to the implementation sprint; the planning
+pass changes documentation only. Intermediate stages are not release candidates.
+Do not add compatibility code to make intermediate states look like a supported
+release.
+
+Before each stage, read `AGENTS.md`, `docs/development.md`, and all policies
+under `docs/policy/`: agents, architecture, documentation, testing, and release.
+Read this plan's selected design and that stage's preparation. Use Go 1.26 and graph-first code
+discovery; inspect current files when graph results are incomplete. Preserve
+unrelated changes. Test at behavioral owners rather than replicating every case
+across configuration, adapter, stage, and command tests.
+
+The user approved a clean cutover: no Audita v1 runner, deprecated aliases,
+compatibility shims, generated configuration conversion, or silently ignored
+old settings. Do not broaden that decision into a purge of unrelated legacy
+code or historical session data.
+
+## Selected design
+
+### ConfigKit and Narratio overlay terminology
+
+Upgrade ConfigKit from v0.3.1 to v0.4.0 before adapter work. Rename its
+`Options.Profile`, `LayerProfile`, and any `CodeProfile*` uses to their overlay
+equivalents. Selected pipeline files move from `profiles/<name>.yml` to
+`overlays/<name>.yml`; no fallback directory or alias is permitted.
+
+Rename Narratio's pipeline-selection flag to `--overlay` everywhere it is
+accepted, including convenience commands and configuration inspection. Rename
+application-owned selection types/helpers, help, errors, and current inspection
+labels consistently. `config diff` still takes two positional selections,
+now described as overlays. Preserve omission, explicit empty, and `default`
+as base selection; do not add a persistent default selector or new precedence.
+
+Rename newly written informational provenance to overlay terminology, including
+`selected_overlay` in manifest configuration provenance. Do not add a dual-field
+reader, automatically rewrite historical manifests, or introduce a manifest-version
+rejection solely for this informational rename. Existing strict typed decoding
+rejects retired provenance fields. Document backed-up operator migration of
+that informational member without changing execution/checkpoint state; it does
+not become resume authority. Preserve
+semantic fingerprints and effective-value digest rules when values are unchanged.
+
+Only Narratio pipeline configuration selection is renamed. Keep model/profile
+fields such as Scriptorium `profile_id`, Audita `proposal_profile` and
+`validation_profile`, and Notarius `config_profile` unchanged. Explicit imports
+from directories named `profiles` remain legal; only selected pipeline overlay
+discovery changes. Do not globally replace the word “profile.”
+
+### Configuration and credentials
+
+- Both `pipeline.audita.credentials` and `pipeline.notarius.credentials` are
+  lists of ConfigKit secret references. Use `[]configkit.Secret`; each element
+  is an actual reference rather than a nullable pointer. Existing ConfigKit
+  validation owns name/value resolution. Omitted, null, or empty lists mean no
+  additional credential forwarding.
+- Define each key once through existing environment/secrets-directory bootstrap.
+  Forward it under its original name to each adapter whose list includes it.
+  No alias mappings, provider registry, downstream config inspection, extra
+  bootstrap, or inheritance of the entire environment.
+- Repeated names need no new rejection rule: forwarding the same captured
+  reference once suffices. Arbitrary valid variable names remain supported;
+  provider names in the roadmap are examples, not an allowlist.
+- Add a narrow shared helper in `internal/adapters/subprocess` converting resolved
+  references to `EnvOverrides` and `SensitiveEnvNames`. It checks the existing
+  resolved/nonempty requirement for direct adapter callers but never resolves
+  secrets or rereads environment values. Errors expose no values. Both adapters
+  use it; the ConfigKit upgrade is owned by Stage 1, not this helper. No new
+  credential service is needed.
+- Configuration projections and diagnostic metadata contain reference names
+  only. Register all forwarded names for existing captured-stream redaction.
+  Downstream tools remain responsible for files they write themselves.
+- Remove both singular `llm_api_key` fields. For Audita also remove `base_url`,
+  `model`, `validation_model`, `total_llm_concurrency`,
+  `proposal_llm_concurrency`, `validation_llm_concurrency`,
+  `work_dir_retention`, and `report`, including defaults and projections.
+- Retain Audita `binary`, `timeout`, `config_path`, `transcript_description`,
+  `output_schema`, and `modules`. Add optional string selectors `overlay`,
+  `proposal_profile`, and `validation_profile`: empty/unset means no CLI
+  override. Audita owns downstream file/profile validation and native config
+  discovery. Narratio overlay names are not implicitly Audita overlay names.
+- Preserve nil versus non-nil empty `modules` through loading, projection,
+  cloning, composition, adapter defaults, and request overrides. Nil omits the
+  flag; empty passes `--modules` with an empty argument; nonempty joins in order
+  with repetitions intact. A nil request override uses the configured selection.
+  Avoid clones that collapse empty slices to nil. YAML null follows unset
+  behavior. Other adapters' module semantics do not change.
+
+### Invocation, reports, and failure
+
+Use `process INPUT --glossary PATH --output PATH` plus selected surviving
+overrides. Production passes no reporting or debug switches, including
+`--debug`, `--reporting=false`, `--report-dir`, or `--work-dir`.
+Remove required `WorkDir` and legacy `ReportPath` request/result plumbing.
+Document production external-config defaults without forcibly overriding or
+rejecting deliberate external reporting/debug choices.
+
+Replace Audita's long positional config-values constructor with typed runner
+configuration. Keep timeout parsing in composition and subprocess cancellation
+through the existing runner. No version probe or automatic config-validation
+subprocess is required.
+
+The corrected transcript remains the only canonical polish output, with existing
+identity, path, validation, and bounded file handling. Discover exactly
+`errors.yml`, `recoveries.yml`, and `report.md` beside the requested output.
+Represent available paths in a small typed report bundle in `PolishResult`.
+Fixed names belong to the adapter; do not parse stderr or recursively scan.
+
+Reports are diagnostics, not a new correctness gate:
+
+- Bound reads of present reports using the existing named 16 MiB report limit;
+  retain confined regular-file handling and errors identifying Audita, the file,
+  and limit. No new smaller limits or report schema/status/count validation is
+  necessary when Narratio only preserves bytes; Markdown needs no parser.
+- Missing files are not independently fatal: external configuration can disable
+  reports and early failures may produce none. Default-reporting success tests
+  must nevertheless demonstrate capture of all three files.
+- On process failure, preserve available diagnostics and the original error;
+  report-inspection errors must not hide it. Never promote an output merely
+  because it exists following a nonzero exit.
+- Exit zero with a valid transcript may include recoverable errors or no model
+  corrections. Accept it without a fail-on-recovery or minimum-correction rule.
+
+Keep reports next to the run-local transcript, not in a second canonical
+destination. Register present report paths in the existing `StageResult.Logs`
+diagnostic collection alongside stdout/stderr, with safe bundle-path metadata.
+Reuse current manifest-driven diagnostic publication rather than adding a
+manifest schema or new publish source IDs. Physical placement does not define
+canonical artifact identity. Existing diagnostic retention/cleanup rules apply.
+
+On failure, retain run-local files and expose the output/report directory in
+contextual errors. Do not add runner-wide failed-result persistence merely to
+register those files. Do not fabricate legacy JSON reports or delete historical
+reports. Normal successful stage-record replacement removes obsolete current
+output references.
+
+Generated invocation YAML becomes `audita.generated.v2`, recording actual
+arguments, selections, paths, and credential names, never values. This remains
+a diagnostic invocation record, not an Audita configuration file.
+
+### Resume boundary
+
+Bump only polish semantic-config version from 1 to 2. Record config path,
+overlay/proposal/validation selectors, ordered modules with presence preserved,
+transcript description, output schema, and existing output identity. Remove old
+endpoint/model fields. Existing runner comparison reconsiders obsolete evidence
+when polish is selected; do not synthesize equivalent fingerprints or expand
+normal dependency/selection invalidation.
+
+Credentials, binary path, timeout, and diagnostics are not semantic keys. Do not
+hash downstream config/profile contents; operators force polish after edits
+behind unchanged selections. Notarius credential migration does not change
+extraction fingerprints, references, force, resume, or chunk-cache behavior.
+
+## Stage 1: Adopt ConfigKit v0.4.0 and pipeline overlays
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/app ./internal/manifest`,
+`go test ./...`, `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check` passed.
+
+Preparation: ConfigKit v0.4.0 release notes and selected-overlay migration guide
+in `../ConfigKit/docs/`; Narratio `internal/config/pipeline_configkit.go`,
+`artifact_catalog.go`, `load.go`, `effective_digest.go`; CLI flag parsing and
+config commands in `internal/app/`; configuration provenance in
+`internal/manifest/manifest.go`; current config/CLI docs and pipeline examples.
+
+1. Update `go.mod`/`go.sum` to ConfigKit v0.4.0 using normal module tooling;
+   do not leave a local replacement or change unrelated dependencies.
+   Replace removed ConfigKit APIs in loading, ownership, and artifact catalog
+   inspection. Account for source layer `overlay` and diagnostic prefix
+   `overlay.*` wherever they are consumed or asserted.
+2. Rename Narratio's pipeline selector to `--overlay` across all commands and
+   aliases, load options, pair loading, inspection, provenance, and tests.
+   Preserve explicit-presence handling through convenience commands and existing
+   base/default selection. Remove `--profile` rather than retaining an alias.
+   Apply the selected design's informational manifest-provenance treatment.
+3. Move maintained selected pipeline files and generated fixture paths to
+   `overlays/`. Update current canonical documentation, policy terminology,
+   examples, and user-visible migration guidance with the directory/flag break.
+   Do not rewrite historical release notes, rename downstream model profiles,
+   or prohibit ordinary explicit imports from a directory named `profiles`.
+4. Adapt existing config/app tests to prove base and named-overlay selection,
+   imported defaults plus overrides, secret replacement/removal, source attribution
+   through character-family expansion, config diff, and convenient-command
+   forwarding. Add focused checks that the retired flag is rejected and the old
+   directory is not a discovery fallback. Do not freeze incidental error wording.
+5. Verify unchanged effective values retain digest and stage-reuse behavior;
+   only diagnostic source labels/paths and selected provenance terminology change.
+   Test current provenance round trips and strict rejection of unknown/retired
+   provenance fields. Document deliberate operator migration; do not add a
+   compatibility decoder, semantic invalidation rule, or schema-version gate.
+6. Run focused and full tests before proceeding so failures from the dependency
+   and terminology change are separated from adapter migrations. No Audita or
+   Notarius credential/CLI behavior changes in this stage.
+
+Verify: `go test ./internal/config ./internal/app ./internal/manifest`,
+`go test ./...`, `go test ./internal/doccheck`,
 `go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
 `git diff --check`.
 
-1. Update canonical transcribe and manifest internals for the collection,
-   reconciliation, durable-reset force behavior, serialized saves, and aggregate
-   gate. Remove obsolete all-speakers-before-canonical-write descriptions.
-2. Update the WhisperX contract for replayable bounded streaming, application
-   attempts versus transport replay, resource ownership, and the lack of an
-   exactly-once server guarantee. Do not claim the remote protocol issue is fixed.
-3. Update operations/troubleshooting with ordinary resume versus force, durable
-   partial success, old-manifest one-time retranscription on selecting transcribe,
-   downgrade limitations, and private-model-change guidance. No new CLI flags
-   or promises of automatic historical-file recovery. Keep detailed wire and
-   storage contracts in their canonical owners.
-4. Review changes against the feature roadmap and the implementation-discipline
-   guidance. Do not elevate selected storage encoding, internal ordering, test
-   synchronization, or exact error wording into new product guarantees.
-5. Run the full repository gates below; document results and update completion
-   statuses only after they pass. Leave release preparation for a separate task.
+Done when Narratio uses ConfigKit v0.4.0, exposes pipeline overlays consistently,
+has no old selector/directory fallback, and preserves configuration semantics and
+downstream model-profile concepts.
+
+## Stage 2: Add shared resolved-credential forwarding
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/adapters/subprocess`,
+`go test -race ./internal/adapters/subprocess`, and `git diff --check` passed.
+
+Preparation: `internal/adapters/subprocess/run.go`, its environment/redaction
+helpers and tests; `internal/adapters/notarius/subprocess.go`;
+`internal/config/credential_projection.go`; the pinned ConfigKit secret API.
+
+1. Add the narrow helper described above. Return an independent environment map
+   and selected sensitive names. No logging/serialization of values and no
+   changes to minimal child environment inheritance.
+2. Test multiple custom names, empty lists, repeated names, unresolved references,
+   and captured values after the parent environment changes. Reuse existing
+   split/overlapping-stream redaction coverage rather than repeating its matrix.
+3. Leave production callers unchanged until their migrations.
+
+Verify: `go test ./internal/adapters/subprocess` and
+`go test -race ./internal/adapters/subprocess`.
+
+Done when both adapters can reuse one small conversion mechanism without adding
+a resolver, provider policy, or ambient-secret inheritance.
+
+## Stage 3: Migrate Notarius to credential lists
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/adapters/notarius ./internal/stage ./internal/app`,
+`go test -race ./internal/adapters/notarius`, and `git diff --check` passed.
+
+Preparation: `internal/config/config.go`, `credential_projection.go`, loading/
+inspection tests; `internal/adapters/notarius/runner.go`, `subprocess.go`;
+`internal/stage/extract.go` and its request construction;
+`docs/integrations/notarius.md` and secret handling in `docs/config.md`.
+
+1. Replace the singular field with the typed list across configuration,
+   projection, request types, stage wiring, and adapter execution. Use Stage 2's
+   helper and register all selected names for redaction.
+2. Update name-only metadata and config-show/diff/effective projections. Test
+   real ConfigKit loading, overlay list replacement, and empty-list clearing.
+   Preserve bootstrap precedence and existing load-time reference resolution,
+   including references outside the selected stage range.
+3. Migrate maintained examples, fixtures, and current Notarius configuration/
+   integration documentation for this field. Ordinary strict decoding rejects
+   the old field; do not add a compatibility parser.
+4. Cover multi-key forwarding, unselected-key exclusion, empty selection,
+   captured-value behavior, and custom-name redaction on success/failure.
+   Keep extraction cache/reference/output tests as regression protection,
+   not occasions to redesign extraction.
+
+Verify: `go test ./internal/config ./internal/adapters/notarius ./internal/stage ./internal/app`
+and `go test -race ./internal/adapters/notarius`.
+
+Done when Notarius uses credential lists end to end and no active singular
+credential path remains.
+
+## Stage 4: Cut Audita configuration and adapter over to v2
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/config ./internal/adapters/audita ./internal/stage ./internal/app`,
+`go test -race ./internal/adapters/audita`, `go test ./...`, and
+`git diff --check` passed.
+
+Preparation: Audita v2.0.0 `docs/migrations/v2.md`, `docs/cli.md`,
+`docs/integrations/subprocess.md`, and `docs/integrations/output-files.md` in
+`../audita/`; Narratio `internal/adapters/audita/`,
+`internal/app/runner.go` (`buildDefaultAuditaRunner`), and config types,
+defaults, validation, and credential projection.
+
+1. Replace the Audita configuration surface as selected above, updating defaults,
+   validation, safe projection, examples, and config fixtures. Prove nil/empty
+   modules survive real configuration loading and overlay overrides.
+2. Migrate runner construction, selectors, and credential forwarding. Remove
+   retired flags, fixed credential alias, required work-directory plumbing, and
+   old JSON-report validation. Add the typed report bundle.
+3. Implement adjacent report discovery, bounded reads, failure results, and
+   generated invocation v2. Share metadata construction between success/failure
+   instead of maintaining duplicate field maps.
+4. Rewrite the Audita subprocess fixture to model v2 argument acceptance and
+   output placement. Cover omitted/selected selectors, ordered/repeated/empty
+   modules, no report/debug switches, malformed/missing transcript, ordinary
+   reports, externally disabled reporting, recoverable-error success, and
+   nonzero exit after transcript creation. Cover multiple custom credential names
+   and redaction; preserve timeout/cancellation coverage at its existing owner.
+5. Make mechanical polish and app-fixture adjustments needed to compile: remove
+   obsolete request/metadata fields and old report materialization. Stage 5 owns
+   complete diagnostic integration. Remove retired fingerprint members as needed
+   to compile; Stage 6 completes the replacement semantic contract. These are
+   bounded call-site changes, not permission to introduce transitional shims.
+
+Verify: `go test ./internal/config ./internal/adapters/audita ./internal/stage ./internal/app`
+and `go test -race ./internal/adapters/audita`.
+
+Done when configuration composes a v2-only adapter and subprocess tests prove its
+credential/transcript/report boundary. Stages 5 and 6 complete diagnostic and
+semantic integration; all stages are required before release.
+
+## Stage 5: Integrate polish reports with diagnostic lifecycle
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/stage ./internal/app ./internal/manifest ./internal/artifacts`,
+`go test -race ./internal/stage ./internal/app`, and `git diff --check` passed.
+
+Preparation: `internal/stage/polish.go`, `polish_test.go`, `run_local.go`,
+`stage.go`, `publish_sources.go`; result application in `internal/app/runner.go`;
+publish/restore diagnostic tests; `docs/internal/stage-polish.md`.
+
+1. Finish stage integration: materialize only the canonical polished transcript;
+   register available adjacent reports as diagnostics plus safe metadata and
+   existing logs/generated invocation references. Remove old `audita_report`
+   production and stale stage metadata.
+2. Use existing authoritative-path checks for the requested transcript and fixed
+   adjacent report paths. Do not accept arbitrary fake-returned paths, scan
+   directories, or copy reports to a second destination. Preserve workspace
+   handling/modes.
+3. On execution failure, preserve canonical transcript authority and run-local
+   diagnostics, with actionable directory/log context and original error identity.
+   Test failure after output creation.
+4. Adapt the fake and app helper. With real manifest/store collaborators, prove
+   successful promotion, report references, absence of report canonical outputs,
+   and current-run diagnostic publication. Preserve restore's existing scope of
+   declared committed transcript/artifact objects: run-archive diagnostics do not
+   become automatically restored canonical objects. Test that report references
+   do not create new required canonical restore targets. Document remote diagnostic
+   inspection separately; no new diagnostic-restore feature is authorized.
+5. Leave historical files untouched. Update tests expecting a second canonical
+   polish output without introducing a manifest-format migration.
+
+Verify: `go test ./internal/stage ./internal/app ./internal/manifest ./internal/artifacts`
+and `go test -race ./internal/stage ./internal/app`.
+
+Done when reports use existing diagnostic lifecycle and failed execution cannot
+promote an incidental transcript.
+
+## Stage 6: Complete semantic evidence and resume behavior
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/stage ./internal/app`,
+`go test -race ./internal/stage ./internal/app`, and `git diff --check` passed.
+
+Preparation: `internal/stage/semantic_contracts_refinement.go`, semantic
+fingerprint tests, app runner semantic comparison tests, and extraction semantic
+configuration tests (locate their current owners through graph discovery).
+
+1. Implement polish evidence version 2 and the selected payload. Remove sorting;
+   preserve nil/empty distinction in payload encoding and copies.
+2. Test changes from module order/repetition/presence and external selectors.
+   Credentials and execution-only settings do not change evidence. Avoid
+   assertions on incidental digest literals.
+3. Exercise old-version evidence through runner resume behavior: selected polish
+   is reconsidered and normal dependent invalidation applies. Downstream-only
+   bounded execution does not unexpectedly invoke polish. Unchanged new evidence
+   reuses valid completed output.
+4. Confirm credential-list changes leave extraction semantic/cache behavior
+   unchanged. No downstream file-content scanning or eager fingerprint migration.
+
+Verify: `go test ./internal/stage ./internal/app` and
+`go test -race ./internal/stage ./internal/app`.
+
+Done when selections affect reuse accurately without blanket credential/config
+invalidation or changes to unselected-stage execution.
+
+## Stage 7: Complete operator migration documentation and examples
+
+Status: Complete (2026-09-25).
+
+Verification: `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check` passed.
+
+Preparation: documentation policy; `docs/config.md`, `docs/operations.md`,
+`docs/troubleshooting.md`, both integration guides,
+`docs/internal/adapters.md`, `docs/internal/stage-polish.md`, and pipeline examples.
+
+1. Complete current-behavior documentation as implementation lands. Configuration
+   owns fields/defaults; integrations own external contracts; operations owns
+   placement and migration; internal docs explain ownership and link onward.
+2. Provide an old-to-new migration table: endpoints/capacity move to Audita
+   backends, models to profiles, role selection to selectors, and credentials to
+   provider-named lists. Remove report/retention settings. Explain Audita's
+   all-configured-backend credential resolution and Notarius's profile lookup.
+3. Describe preparing and validating Audita v2 config offline with its documented
+   command before switching executables. Link upstream examples rather than
+   building a downstream configuration generator. Explain ordinary reports,
+   recoverable-error success, and force after edits behind unchanged selectors.
+4. Production examples omit modules when upstream defaults are intended;
+   `modules: []` deliberately disables correction modules. Production external
+   Audita config keeps reports enabled/debug disabled, without Narratio flag
+   overrides. Testing-profile debug integration remains deferred.
+5. Document the configuration-breaking clean cutover for release-version
+   consideration. Do not edit historical release records, tag a release, or
+   remove unrelated roadmaps.
+
+Verify: `go test ./internal/doccheck`,
+`go test ./internal/config -run '^TestExamplesLoadAndValidate$'`, and
+`git diff --check`.
+
+Done when operators can migrate using valid examples without obsolete fields,
+implicit credential aliases, or retired CLI/report expectations.
+
+## Stage 8: Verify assembled behavior and audit scope
+
+Status: Complete (2026-09-25).
+
+Verification: the offline app-level shared/Audita-only credential scenario
+passed with config bootstrap, both subprocess fixtures, safe inspection/logging,
+and ordinary polish reports. The tagged Audita v2.0.0 CLI validated its minimal
+configuration and produced a transcript plus all three reports with an empty
+module sequence and no provider request. Active-reference and scope audits found
+no removed production fields or compatibility path; remaining old names occur in
+migration guidance, explicit-rejection checks, or historical fixtures. `go test
+./...`, `go test -race ./...`, `go vet ./...`, `go build ./...`, `go test
+./internal/doccheck`, `go test ./internal/config -run
+'^TestExamplesLoadAndValidate$'`, and `git diff --check` passed.
+
+Preparation: cumulative diff, this plan, feature roadmap, app configuration/
+subprocess integration tests, and all policies.
+
+1. Adapt or add one representative offline app-level scenario showing one
+   provider-named secret source supplying both adapters and another key selected
+   only for Audita. Use real config/bootstrap/composition with subprocess fixtures.
+   Prove safe inspection/logging and successful polish reports. Leave exhaustive
+   flag/redaction cases at lower layers.
+2. Where the tagged Audita checkout is available, smoke-test CLI acceptance and
+   ordinary transcript/reports offline with an explicit minimal v2 config,
+   unauthenticated backend/profile fixtures, and an empty module sequence.
+   No provider requests or production credentials. This is optional local evidence,
+   not a default test dependent on sibling checkouts or installed tools.
+3. Audit active references to removed fields/flags/aliases; historical release
+   notes and completed roadmaps are not compatibility code. Review tests
+   collectively for duplication while retaining consequential failure coverage.
+4. Confirm no provider-name restrictions, duplicate-name rejection, downstream
+   content hashing, fail-on-recovery rule, mandatory explicit config path, debug
+   requirement, live-service gate, pipeline-order change, or Notarius cache change
+   slipped in. Do not require missing reports when disabled externally. Surface
+   additional policy choices rather than encoding them silently in tests.
+5. Run every gate below and record actual results. Mark complete only after all
+   stages and gates pass. No release, tag, push, or unrelated cleanup in this plan.
 
 ```sh
 go test ./...
@@ -422,10 +471,12 @@ go test ./internal/config -run '^TestExamplesLoadAndValidate$'
 git diff --check
 ```
 
+Done when the assembled v2 integration and shared credentials meet the roadmap,
+verification passes, and no compatibility machinery remains within scope.
+
 ## Open Questions
 
-None requiring user input. The agreed roadmap supplies the product decisions;
-this plan selects a completed-only manifest collection, conservative old-record
-handling, and pull-based replay as implementation choices. No stronger remote
-reliability guarantee, new operator restriction, or generic orchestration
-surface is proposed.
+None requiring a product decision before implementation. The user settled the
+clean cutover and shared provider-named lists. Reports use existing diagnostics
+without new content-based success criteria; debug-profile work remains deferred.
+Release version selection belongs to the later release procedure.

docs/roadmap/remediation.md

@@ -1,4 +1,127 @@
-# Transcription Checkpoint Review Remediation
+# Audita v2 and ConfigKit Migration Review Remediation
+
+Status: Complete.
+
+Reviewed `83eaa96` through `fae18bf` against the approved clean-cutover decisions,
+[feature roadmap](audita.md), and [implementation plan](implementation.md).
+Review date: 2026-09-25. No production changes were made. The previous completed
+transcription review is retained below as historical context.
+
+## 1. Preserve omitted modules in direct YAML serialization
+
+Priority: P2. Status: Complete.
+
+The safe YAML projection now omits nil modules while retaining explicit empty
+and ordered/repeated selections. A round-trip regression failed before the fix
+and passes afterward. Config package tests, including credential-safety coverage,
+and its race tests pass.
+
+Location: `internal/config/credential_projection.go:25` (`AuditaConfig.MarshalYAML`),
+especially the plain slice field at line 30 and assignment at line 40.
+
+The direct safe YAML projection passes a nil module slice to yaml.v3, which
+serializes it as `modules: []`. Loading that output produces a non-nil empty
+slice. Under the new Audita contract these are different instructions: nil
+delegates to Audita's configuration/default sequence; empty passes an explicit
+empty module argument and disables correction modules. Serialization therefore
+silently changes behavior for a configuration that is subsequently reloaded.
+
+Evidence: a temporary package test marshaled
+`AuditaConfig{Binary: "audita", Timeout: "3h"}`, unmarshaled it into another
+`AuditaConfig`, and required `Modules == nil`. It failed with output containing
+`modules: []`. The test was removed after reproduction. This concerns direct
+`yaml.Marshal` of the typed configuration; ordinary CLI `config show` uses
+`MarshalEffectivePipeline` through a separate JSON/value-tree projection and
+does not use this faulty path.
+
+Required remediation:
+
+- Make the direct safe YAML projection preserve nil as null or omission and
+  explicit empty as `[]`. Do not simply add `omitempty` to the slice: that would
+  instead erase the explicit empty selection.
+- Keep credential serialization name-only and preserve module order/repetitions.
+- Add a small round-trip regression covering nil, explicit empty, and an ordered
+  repeated selection; retain effective-output inspection coverage without
+  duplicating its whole test matrix.
+
+## 2. Remove the unapproved manifest compatibility decoder
+
+Priority: P2. Status: Complete.
+
+Removed the permissive custom decoder; ordinary strict typed decoding now
+applies to provenance as well. Replaced historical-acceptance coverage with
+retired/unknown-field rejection tests, all of which failed before removal.
+Current provenance round-trip coverage remains intact. Corrected the roadmap,
+plan, internal contract, and operator guidance for narrow backed-up migration
+without discarding execution/checkpoint state or changing resume authority.
+
+Location: `internal/manifest/manifest.go:79-89`,
+`internal/manifest/store_test.go:78`, and `docs/internal/manifest.md`'s decoding
+contract. Also correct the conflicting migration language in the plan/roadmap.
+
+The new `EffectiveConfigProvenance.UnmarshalJSON` bypasses the manifest store's
+`DisallowUnknownFields` by using permissive `json.Unmarshal` for the entire
+provenance object. It accepts retired `selected_profile` data and silently
+discards it. It also silently accepts unknown current provenance fields,
+including unknown nested selection fields, rather than limiting behavior to
+the renamed label.
+
+The user expressly selected a clean cutover without backward-compatibility
+shims. This adds precisely such a shim and a new historical-input acceptance
+guarantee. The regression test explicitly requires the old selection to load,
+and the internal guide now declares permissive informational-field decoding.
+
+The plan contributed to this divergence: it said existing generic decoding
+would handle historical optional provenance and required old manifests to load.
+That assumption was false; the baseline store already strictly decoded these
+fields. Repetition in the plan, tests, and documentation does not authorize
+overriding the user's clean-cutover decision.
+
+Required remediation:
+
+- Remove the custom compatibility unmarshaler and retain ordinary strict typed
+  decoding for the new `selected_overlay` representation. Do not add dual fields,
+  special retired-field handling, automatic manifest rewrites, or a format-version
+  bump just for this rename.
+- Replace the historical-acceptance test with coverage for current provenance
+  round trips and unknown/retired provenance rejection through the real store.
+- Correct the plan and current documentation to acknowledge the upgrade effect:
+  manifests with retired provenance require deliberate operator migration before
+  loading. Document narrow removal/renaming of retired informational provenance
+  on a backed-up manifest, preserving execution/checkpoint state; do not advise
+  deleting all session progress or rerunning everything.
+- Keep provenance informational: this correction does not authorize adding it
+  to semantic resume keys or invalidating work based on overlay identity alone.
+
+If transparent historical-manifest acceptance is desired instead, obtain an
+explicit exception to the clean-cutover decision before retaining a compatibility
+reader. Do not treat that exception as already granted.
+
+## Review verification
+
+The following records the original review, before remediation.
+
+- Existing `go test ./...` passed.
+- Race tests passed for subprocess, Audita, Notarius, config, stage, app, and
+  manifest packages after removing the temporary reproduction.
+- `go vet ./...` passed.
+- The temporary direct-YAML regression failed as described above.
+- Source inspection and the new historical-provenance test establish finding 2;
+  `LocalStore.LoadReader` still uses strict decoding outside the custom hook.
+
+The primary architecture is otherwise in place: ConfigKit v0.4.0 overlays,
+shared named credential forwarding/redaction, a v2-only Audita subprocess
+adapter, ordinary reports as diagnostics, and versioned ordered-module polish
+evidence. No live model/provider runs were performed during this review.
+
+## Migration remediation verification
+
+Completed on 2026-09-25. Both new regressions failed before their respective
+fixes. After remediation, `go test ./...`, `go test -race ./...`,
+`go vet ./...`, `go build ./...`, documentation checks, maintained configuration
+example checks, and `git diff --check` passed. No live provider runs were needed.
+
+## Historical completed transcription review
 
 Status: Complete.
 
@@ -7,7 +130,7 @@ upload-replay roadmap and the original user request. No production changes were
 made during review. The two failures below were reproduced with temporary tests
 using the existing stage fixtures; those temporary tests were removed afterward.
 
-## 1. Reconcile Aggregate State Even When No Speaker Needs HTTP Work
+### 1. Reconcile Aggregate State Even When No Speaker Needs HTTP Work
 
 Priority: P2. Status: Complete.
 
@@ -54,7 +177,7 @@ an added speaker), plus incomplete/inconsistent aggregate output coverage.
 Exercise the runner skip path and assert zero additional WhisperX requests,
 correct rebuilt outputs, and no removed speaker reaching merge.
 
-## 2. Remove the Unrequested Positive Audio-Size Requirement
+### 2. Remove the Unrequested Positive Audio-Size Requirement
 
 Priority: P2. Status: Complete.
 
@@ -94,7 +217,7 @@ Verification: cover a zero-size record round-trip and successful adapter result
 being checkpointed/reused for that input; retain negative-size rejection and
 ordinary downstream-failure tests.
 
-## Verification After Remediation
+### Verification After Remediation
 
 Completed on 2026-09-22 with Go 1.26.8: focused stage/application tests,
 changed-package race tests, `go test ./...`, `go test -race ./...`,

docs/roadmap/transcribe-checkpoints-and-replay.md

@@ -15,9 +15,9 @@ peer `PROTOCOL_ERROR` and an inability to replay the request body without
 `Request.GetBody`.
 
 These are related reliability improvements, not a promise to eliminate all
-service failures. This document owns the target state and scope; the
-[implementation plan](implementation.md) owns ordered changes and concrete
-storage and replay decisions.
+service failures. This document records the target state and scope. The
+completed implementation sequence is retained in Git history; current behavior
+is documented in the canonical guides linked below.
 
 ## Pre-implementation Limitations
 

docs/troubleshooting.md

@@ -102,7 +102,7 @@ Safe fix:
 
 Relevant reference: [Canonical Party Input](./integrations/party.md).
 
-## Unexpected imported or profile value
+## Unexpected imported or overlay value
 
 Symptom:
 
@@ -112,21 +112,21 @@ Symptom:
 Diagnostics:
 
 ```bash
-narratio config sources --config /path/pipeline.yml --profile testing
+narratio config sources --config /path/pipeline.yml --overlay testing
 ```
 
 Add `--campaign` or `--campaign-file` when the pipeline has party-driven
 artifact families. The output identifies each effective logical field's root,
-import, profile, default, campaign, party, or family source without printing
+import, overlay, default, campaign, party, or family source without printing
 the field value or credential contents.
 
 Safe fix:
 
 - move a duplicated base field so it has one owner;
-- correct the selected profile or its overlay; or
+- correct the selected overlay; or
 - correct the campaign party/family declaration that owns generated values.
 
-To review what would actually change before switching profiles, run `config
+To review what would actually change before switching overlays, run `config
 diff` with the same pipeline and campaign selectors. It compares normalized
 effective values rather than YAML formatting or source-file layout.
 
@@ -312,7 +312,7 @@ and [Transcribe internals](./internal/stage-transcribe.md).
 Symptom:
 
 - configuration loading reports `secret.unset`, `secret.empty`, or an invalid
-  name for `pipeline.notarius.llm_api_key`, including during inspection or a
+  name in `pipeline.notarius.credentials`, including during inspection or a
   run that would not execute extraction.
 
 Likely causes:
@@ -328,7 +328,7 @@ Safe fix:
 
 - set the exact nonempty environment variable or provide an equivalently named
   file through the conventional or explicit secrets directory;
-- remove or set the field to `null` when that deployment needs no credential;
+- remove, set to `null`, or set to `[]` when that deployment needs no credential;
   and
 - use `config show`, `config sources`, and `config diff` to inspect the public
   reference name and ownership without exposing its value.
@@ -339,7 +339,43 @@ invalidate a completed extraction, but the current reference must still resolve
 for the command to proceed.
 
 Relevant references: [Secrets](./config.md#secrets-handling) and
-[Notarius credential](./config.md#notarius-credential).
+[Notarius credentials](./config.md#notarius-credentials).
+
+## Audita v2 configuration or credential failure
+
+Symptom:
+
+- Narratio rejects a retired `pipeline.audita` field during loading, reports
+  `secret.unset` or `secret.empty` for a listed credential, or Audita rejects
+  its external configuration or selected profile when polish runs.
+
+Likely causes:
+
+- the Narratio pipeline still uses v1 endpoint, model, capacity, singular key,
+  report, or retention settings;
+- the named key is missing or empty, including a present but empty process
+  environment variable that takes precedence over a secrets-directory file;
+- Audita's external v2 file references a backend credential name not forwarded
+  by `pipeline.audita.credentials`, including a backend not selected by the
+  current profile; or
+- an Audita overlay or profile selector names a missing downstream definition.
+
+Safe fix:
+
+- follow the [migration table](./operations.md#migrating-audita-and-provider-credentials)
+  and use a supported Audita v2 executable and configuration;
+- provide each needed provider-named variable through the environment or
+  secrets directory, and list that same name in `pipeline.audita.credentials`;
+- validate the external file offline with
+  `audita config validate --config <file>` before switching executables; and
+- inspect Audita's effective profile selection separately from Narratio's
+  `config show`. Narratio does not infer downstream selectors.
+
+An exit-zero polish with a valid transcript succeeds even when Audita reports
+recoverable errors or no corrections. Missing reports are allowed when Audita
+reporting is disabled externally. Edits to Audita-owned files behind unchanged
+selectors require `narratio run-stage polish <session-id> --force` to replace a
+previously successful result. See the [Audita integration contract](./integrations/audita.md).
 
 ## Notarius executable missing
 

examples/README.md

@@ -14,16 +14,16 @@ in the [configuration reference](../docs/config.md).
 - [Production-base/testing-overlay bundle](production-testing/pipeline.yml):
   explicit `conf.d` imports, one ordinary artifact per `artifacts/<key>.yml`,
   one family per `artifact-families/<key>.yml`, and the fixed
-  `profiles/testing.yml` overlay. Production values live in the base. The
+  `overlays/testing.yml` overlay. Production values live in the base. The
   bundle demonstrates an input-only artifact dependency, two character families
   sharing the campaign party, and a testing-only disabled artifact. Inspect it
   offline with:
 
   ```sh
   narratio config validate --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
-  narratio config show --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
-  narratio config sources --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
-  narratio config artifacts --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --profile testing
+  narratio config show --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config sources --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
+  narratio config artifacts --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml --overlay testing
   narratio config diff default testing --config examples/production-testing/pipeline.yml --campaign-file examples/campaigns/sample-campaign/campaign.yml
   ```
 
@@ -70,7 +70,11 @@ The examples contain environment-variable names but no credential values. Set
 `OBJECT_STORAGE_KEY_ID`, `OBJECT_STORAGE_KEY`, `AUDITA_LLM_API_KEY`, and
 `NOTARIUS_LLM_API_KEY` to nonempty synthetic or real values before loading the
 examples that reference them. They use fictional campaign content and reserved
-example domains.
+example domains. The Audita and Notarius names are example references, not
+implicit aliases: external backend/profile configurations must use those exact
+names, or the Narratio credential lists must be changed to match. See the
+[Audita v2 migration guide](https://gitea.maximumdirect.net/eric/audita/src/tag/v2.0.0/docs/migrations/v2.md)
+for maintained downstream configuration examples.
 
 For a deployed bundle, keep credential files out of source control in a
 `secrets/` directory beside the root `pipeline.yml`, one file per referenced

examples/pipeline.full.annotated.yml

@@ -90,22 +90,18 @@ seriatim:
     filler_max_duration: 1.25
 
 audita:
-  # Optional overrides; defaults shown explicitly where applicable.
+  # Optional overrides. Audita owns its own configuration and profiles.
   binary: audita
   timeout: 3h
-  llm_api_key: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
-  base_url: ""
-  model: ""
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_model: ""
-  validation_llm_concurrency: 1
+  # Names must match credentials on every backend in the Audita v2 config.
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules for Audita's default sequence; modules: [] disables corrections.
+  overlay: ""
+  proposal_profile: ""
+  validation_profile: ""
   transcript_description: ""
   config_path: /usr/local/etc/audita/config.yml
   output_schema: audita-v1
-  work_dir_retention: auto
-  report: true
 
 normalize:
   # Optional; defaults shown explicitly.
@@ -131,11 +127,11 @@ notarius:
   # Optional structured extraction after render and before analyze.
   enabled: true
   binary: notarius
-  # Optional environment-variable reference. Match this name to api_key_env in
-  # the selected Notarius/PromptKit profile; never put the credential here.
-  llm_api_key: NOTARIUS_LLM_API_KEY
+  # Optional environment-variable references. Match these names to the
+  # selected Notarius/PromptKit providers; never put credential values here.
+  credentials: [NOTARIUS_LLM_API_KEY]
   # Optionally select a Notarius ConfigKit overlay when extraction runs. This
-  # is independent of Narratio's selected profile and may use a different name.
+  # is independent of Narratio's selected overlay and may use a different name.
   # See docs/config.md and docs/integrations/notarius.md for the contracts.
   # config_profile: downstream-economy
   config_path: /usr/local/etc/notarius/config.yml

examples/pipeline.production.yml

@@ -57,14 +57,9 @@ seriatim:
 audita:
   binary: audita
   timeout: 3h
-  llm_api_key: AUDITA_LLM_API_KEY
-  modules: [glossary, homophones, spoken_word, grammar]
+  credentials: [AUDITA_LLM_API_KEY]
+  # Omit modules to use Audita defaults; modules: [] disables corrections.
   output_schema: audita-v1
-  work_dir_retention: auto
-  total_llm_concurrency: 2
-  proposal_llm_concurrency: 1
-  validation_llm_concurrency: 1
-  report: true
 
 normalize:
   output_path: transcripts/final.json

examples/production-testing/conf.d/transcript.yml

@@ -10,8 +10,8 @@ audita:
   binary: audita
   modules: [glossary, grammar]
   output_schema: audita-v1
-  model: narratio-production-model-placeholder
-  validation_model: narratio-production-validator-placeholder
+  proposal_profile: narratio-production-model-placeholder
+  validation_profile: narratio-production-validator-placeholder
 
 normalize:
   output_path: transcripts/final.json

examples/production-testing/overlays/testing.yml

@@ -1,6 +1,6 @@
 audita:
-  model: narratio-testing-model-placeholder
-  validation_model: narratio-testing-validator-placeholder
+  proposal_profile: narratio-testing-model-placeholder
+  validation_profile: narratio-testing-validator-placeholder
 
 scriptorium:
   artifacts:

go.mod

@@ -3,7 +3,7 @@ module gitea.maximumdirect.net/eric/narratio
 go 1.26.0
 
 require (
-	gitea.maximumdirect.net/eric/ConfigKit v0.3.1
+	gitea.maximumdirect.net/eric/ConfigKit v0.4.0
 	github.com/aws/aws-sdk-go-v2/config v1.32.17
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.16
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0

go.sum

@@ -1,5 +1,5 @@
-gitea.maximumdirect.net/eric/ConfigKit v0.3.1 h1:etfTI/dxO3NnS18La0V6IeUh/Iv+3PjVfEyaN8hTuOM=
-gitea.maximumdirect.net/eric/ConfigKit v0.3.1/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.0 h1:fo+vKff3zTGeWqJIA38NtT84b6OUP//9ZmBH3lFuKgk=
+gitea.maximumdirect.net/eric/ConfigKit v0.4.0/go.mod h1:tYWpsrbLyu05r8+1MapWp5fN6ZrX9I8hU2xEPedYmYk=
 github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
 github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=

internal/adapters/audita/fake.go

@@ -17,13 +17,11 @@ func (n *NoopRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if err := ctx.Err(); err != nil {
 		return PolishResult{}, err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, false); err != nil {
 		return PolishResult{}, err
 	}
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
 		StdoutLogPath:           req.StdoutLogPath,
 		StderrLogPath:           req.StderrLogPath,
 		GeneratedConfigPath:     req.GeneratedConfigPath,
@@ -47,18 +45,20 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	if f.Err != nil {
 		return PolishResult{}, f.Err
 	}
-	if err := materializePlaceholders(req); err != nil {
+	if err := materializePlaceholders(req, true); err != nil {
 		return PolishResult{}, err
 	}
 	res := f.Result
 	if res.ProcessedTranscriptPath == "" {
 		res.ProcessedTranscriptPath = req.OutputProcessedPath
 	}
-	if res.ReportPath == "" {
-		res.ReportPath = req.ReportPath
-	}
-	if res.WorkDir == "" {
-		res.WorkDir = req.WorkDir
+	if res.Reports == (ReportBundle{}) {
+		dir := filepath.Dir(req.OutputProcessedPath)
+		res.Reports = ReportBundle{
+			ErrorsPath:     filepath.Join(dir, "errors.yml"),
+			RecoveriesPath: filepath.Join(dir, "recoveries.yml"),
+			OverviewPath:   filepath.Join(dir, "report.md"),
+		}
 	}
 	if res.StdoutLogPath == "" {
 		res.StdoutLogPath = req.StdoutLogPath
@@ -75,10 +75,10 @@ func (f *FakeRunner) Run(ctx context.Context, req PolishRequest) (PolishResult,
 	return res, nil
 }
 
-func materializePlaceholders(req PolishRequest) error {
+func materializePlaceholders(req PolishRequest, reports bool) error {
 	if req.GeneratedConfigPath != "" {
 		payload := map[string]any{
-			"schema":                 "audita.generated.v1",
+			"schema":                 "audita.generated.v2",
 			"placeholder":            true,
 			"merged_transcript_path": req.MergedTranscriptPath,
 			"output_path":            req.OutputProcessedPath,
@@ -103,11 +103,18 @@ func materializePlaceholders(req PolishRequest) error {
 	}); err != nil {
 		return err
 	}
-	if err := writeJSONIfRequested(req.ReportPath, map[string]any{
-		"schema": "audita.report.v1",
-		"steps":  []any{},
-	}); err != nil {
-		return err
+	if !reports {
+		return nil
+	}
+	for _, report := range []struct{ name, contents string }{
+		{"errors.yml", "schema: audita-errors\nversion: 1\nstatus: completed\nerrors: []\n"},
+		{"recoveries.yml", "schema: audita-recoveries\nversion: 1\nstatus: completed\nrecoveries: []\n"},
+		{"report.md", "# Audita report\n"},
+	} {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), report.name)
+		if err := fileops.WriteFileAtomic(path, []byte(report.contents), fileops.WorkspaceFileMode); err != nil {
+			return fmt.Errorf("write report %q: %w", path, err)
+		}
 	}
 	return nil
 }

internal/adapters/audita/runner.go

@@ -11,24 +11,29 @@ type Runner interface {
 	Run(ctx context.Context, req PolishRequest) (PolishResult, error)
 }
 
-// PolishRequest describes an audita invocation.
+// PolishRequest describes an Audita invocation. Nil Modules uses the runner's
+// configured selection; a non-nil empty slice selects no modules.
 type PolishRequest struct {
 	GeneratedConfigPath  string
 	MergedTranscriptPath string
 	OutputProcessedPath  string
 	GlossaryPath         string
-	ReportPath           string
-	WorkDir              string
 	Modules              []string
 	StdoutLogPath        string
 	StderrLogPath        string
 }
 
-// PolishResult describes a polish output.
+// ReportBundle contains optional reports adjacent to the requested output.
+type ReportBundle struct {
+	ErrorsPath     string
+	RecoveriesPath string
+	OverviewPath   string
+}
+
+// PolishResult describes a polish output and available diagnostics.
 type PolishResult struct {
 	ProcessedTranscriptPath string
-	ReportPath              string
-	WorkDir                 string
+	Reports                 ReportBundle
 	StdoutLogPath           string
 	StderrLogPath           string
 	GeneratedConfigPath     string

internal/adapters/audita/subprocess.go

@@ -3,12 +3,14 @@ package audita
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"net/url"
-	"strconv"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 	"gitea.maximumdirect.net/eric/narratio/internal/fileops"
 )
@@ -16,93 +18,27 @@ import (
 // MaxProcessedOutputBytes bounds Audita's processed-transcript JSON result.
 const MaxProcessedOutputBytes int64 = 64 * 1024 * 1024
 
-// MaxReportOutputBytes bounds Audita's optional report JSON result.
+// MaxReportOutputBytes bounds each optional Audita report.
 const MaxReportOutputBytes int64 = 16 * 1024 * 1024
 
 // SubprocessRunnerConfig defines deterministic settings for Audita CLI execution.
 type SubprocessRunnerConfig struct {
-	Binary                   string
-	Timeout                  time.Duration
-	LLMAPIKey                string
-	LLMAPIKeyReference       string
-	Modules                  []string
-	BaseURL                  string
-	Model                    string
-	TranscriptDescription    string
-	ConfigPath               string
-	OutputSchema             string
-	WorkDirRetention         string
-	TotalLLMConcurrency      *int
-	ProposalLLMConcurrency   *int
-	ValidationModel          string
-	ValidationLLMConcurrency *int
-	Report                   bool
+	Binary                string
+	Timeout               time.Duration
+	Credentials           []configkit.Secret
+	Modules               []string
+	Overlay               string
+	ProposalProfile       string
+	ValidationProfile     string
+	TranscriptDescription string
+	ConfigPath            string
+	OutputSchema          string
 }
 
 // SubprocessRunner invokes Audita via subprocess.
 type SubprocessRunner struct {
-	binary                   string
-	timeout                  time.Duration
-	llmAPIKey                string
-	llmAPIKeyReference       string
-	modules                  []string
-	baseURL                  string
-	model                    string
-	transcriptDescription    string
-	configPath               string
-	outputSchema             string
-	workDirRetention         string
-	totalLLMConcurrency      *int
-	proposalLLMConcurrency   *int
-	validationModel          string
-	validationLLMConcurrency *int
-	report                   bool
-}
-
-// NewSubprocessRunnerFromConfigValues parses config-derived values once.
-func NewSubprocessRunnerFromConfigValues(
-	binary string,
-	timeout string,
-	llmAPIKey string,
-	llmAPIKeyReference string,
-	modules []string,
-	baseURL string,
-	model string,
-	transcriptDescription string,
-	configPath string,
-	outputSchema string,
-	workDirRetention string,
-	totalLLMConcurrency *int,
-	proposalLLMConcurrency *int,
-	validationModel string,
-	validationLLMConcurrency *int,
-	report bool,
-) (*SubprocessRunner, error) {
-	if strings.TrimSpace(timeout) == "" {
-		return nil, fmt.Errorf("audita timeout is required")
-	}
-	parsedTimeout, err := time.ParseDuration(timeout)
-	if err != nil {
-		return nil, fmt.Errorf("parse audita timeout %q: %w", timeout, err)
-	}
-	return NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   binary,
-		Timeout:                  parsedTimeout,
-		LLMAPIKey:                llmAPIKey,
-		LLMAPIKeyReference:       llmAPIKeyReference,
-		Modules:                  modules,
-		BaseURL:                  baseURL,
-		Model:                    model,
-		TranscriptDescription:    transcriptDescription,
-		ConfigPath:               configPath,
-		OutputSchema:             outputSchema,
-		WorkDirRetention:         workDirRetention,
-		TotalLLMConcurrency:      totalLLMConcurrency,
-		ProposalLLMConcurrency:   proposalLLMConcurrency,
-		ValidationModel:          validationModel,
-		ValidationLLMConcurrency: validationLLMConcurrency,
-		Report:                   report,
-	})
+	cfg SubprocessRunnerConfig
+	run func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error)
 }
 
 // NewSubprocessRunner constructs a validated Audita subprocess runner.
@@ -113,281 +49,177 @@ func NewSubprocessRunner(cfg SubprocessRunnerConfig) (*SubprocessRunner, error)
 	if cfg.Timeout <= 0 {
 		return nil, fmt.Errorf("audita timeout must be > 0")
 	}
-	if (cfg.LLMAPIKey == "") != (strings.TrimSpace(cfg.LLMAPIKeyReference) == "") {
-		return nil, fmt.Errorf("audita credential value and reference must be provided together")
-	}
 	for i, module := range cfg.Modules {
 		if strings.TrimSpace(module) == "" {
 			return nil, fmt.Errorf("audita module at index %d is empty", i)
 		}
 	}
-	if strings.TrimSpace(cfg.BaseURL) != "" {
-		u, err := url.Parse(cfg.BaseURL)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			if err != nil {
-				return nil, fmt.Errorf("audita base url %q is invalid: %w", cfg.BaseURL, err)
-			}
-			return nil, fmt.Errorf("audita base url %q is invalid", cfg.BaseURL)
-		}
-	}
-	if cfg.TotalLLMConcurrency != nil && *cfg.TotalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita total llm concurrency must be > 0 when provided")
-	}
-	if cfg.ProposalLLMConcurrency != nil && *cfg.ProposalLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita proposal llm concurrency must be > 0 when provided")
-	}
-	if cfg.ValidationLLMConcurrency != nil && *cfg.ValidationLLMConcurrency <= 0 {
-		return nil, fmt.Errorf("audita validation llm concurrency must be > 0 when provided")
-	}
 	switch strings.TrimSpace(cfg.OutputSchema) {
 	case "", "bare-segments", "audita-v1":
 	default:
 		return nil, fmt.Errorf("audita output schema must be one of: bare-segments, audita-v1")
 	}
-	switch strings.TrimSpace(cfg.WorkDirRetention) {
-	case "", "always", "auto", "never":
-	default:
-		return nil, fmt.Errorf("audita work dir retention must be one of: always, auto, never")
+	cfg.Binary = strings.TrimSpace(cfg.Binary)
+	cfg.Credentials = append([]configkit.Secret(nil), cfg.Credentials...)
+	cfg.Modules = cloneModules(cfg.Modules)
+	for i := range cfg.Modules {
+		cfg.Modules[i] = strings.TrimSpace(cfg.Modules[i])
 	}
-
-	modules := make([]string, len(cfg.Modules))
-	for i, m := range cfg.Modules {
-		modules[i] = strings.TrimSpace(m)
-	}
-
-	return &SubprocessRunner{
-		binary:                   strings.TrimSpace(cfg.Binary),
-		timeout:                  cfg.Timeout,
-		llmAPIKey:                cfg.LLMAPIKey,
-		llmAPIKeyReference:       strings.TrimSpace(cfg.LLMAPIKeyReference),
-		modules:                  modules,
-		baseURL:                  strings.TrimSpace(cfg.BaseURL),
-		model:                    strings.TrimSpace(cfg.Model),
-		transcriptDescription:    strings.TrimSpace(cfg.TranscriptDescription),
-		configPath:               strings.TrimSpace(cfg.ConfigPath),
-		outputSchema:             strings.TrimSpace(cfg.OutputSchema),
-		workDirRetention:         strings.TrimSpace(cfg.WorkDirRetention),
-		totalLLMConcurrency:      cfg.TotalLLMConcurrency,
-		proposalLLMConcurrency:   cfg.ProposalLLMConcurrency,
-		validationModel:          strings.TrimSpace(cfg.ValidationModel),
-		validationLLMConcurrency: cfg.ValidationLLMConcurrency,
-		report:                   cfg.Report,
-	}, nil
+	return &SubprocessRunner{cfg: cfg, run: subprocess.Run}, nil
 }
 
-// Run executes Audita process with deterministic flags and validates output artifacts.
+func cloneModules(modules []string) []string {
+	if modules == nil {
+		return nil
+	}
+	return append([]string{}, modules...)
+}
+
+// Run executes Audita process and validates its corrected transcript.
 func (r *SubprocessRunner) Run(ctx context.Context, req PolishRequest) (PolishResult, error) {
 	if r == nil {
 		return PolishResult{}, fmt.Errorf("audita subprocess runner is nil")
 	}
-	if strings.TrimSpace(req.MergedTranscriptPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita merged transcript path is required")
+	for _, field := range []struct{ name, value string }{
+		{"merged transcript path", req.MergedTranscriptPath},
+		{"glossary path", req.GlossaryPath},
+		{"output processed path", req.OutputProcessedPath},
+	} {
+		if strings.TrimSpace(field.value) == "" {
+			return PolishResult{}, fmt.Errorf("audita %s is required", field.name)
+		}
 	}
-	if strings.TrimSpace(req.GlossaryPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita glossary path is required")
+	modules := req.Modules
+	if modules == nil {
+		modules = r.cfg.Modules
 	}
-	if strings.TrimSpace(req.OutputProcessedPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita output processed path is required")
+	for i, module := range modules {
+		if strings.TrimSpace(module) == "" {
+			return PolishResult{}, fmt.Errorf("audita module at index %d is empty", i)
+		}
 	}
-	if strings.TrimSpace(req.WorkDir) == "" {
-		return PolishResult{}, fmt.Errorf("audita work dir is required")
+	modules = cloneModules(modules)
+	for i := range modules {
+		modules[i] = strings.TrimSpace(modules[i])
 	}
-	if r.report && strings.TrimSpace(req.ReportPath) == "" {
-		return PolishResult{}, fmt.Errorf("audita report is enabled but report path is missing")
+	args := r.buildArgs(req, modules)
+	env, names, err := subprocess.CredentialEnvironment(r.cfg.Credentials)
+	if err != nil {
+		return PolishResult{}, fmt.Errorf("audita credentials: %w", err)
 	}
-
-	reqModules := req.Modules
-	if reqModules == nil {
-		reqModules = append([]string(nil), r.modules...)
-	}
-	args := r.buildArgs(req, reqModules)
-
-	credentialPresent := r.llmAPIKeyReference != ""
-	env := map[string]string{}
-	if credentialPresent {
-		env["AUDITA_LLM_API_KEY"] = r.llmAPIKey
-	}
-
 	if req.GeneratedConfigPath != "" {
-		if err := r.writeInvocationConfig(req, args, reqModules, credentialPresent); err != nil {
+		if err := r.writeInvocationConfig(req, args, modules, names); err != nil {
 			return PolishResult{}, fmt.Errorf("write audita invocation config %q: %w", req.GeneratedConfigPath, err)
 		}
 	}
-
-	runRes, err := subprocess.Run(ctx, subprocess.RunRequest{
-		Executable:      r.binary,
-		Args:            args,
-		Timeout:         r.timeout,
-		EnvOverrides:    env,
-		DiagnosticOwner: "audita",
-		StdoutLogPath:   req.StdoutLogPath,
-		StderrLogPath:   req.StderrLogPath,
+	run := r.run
+	if run == nil {
+		run = subprocess.Run
+	}
+	runRes, runErr := run(ctx, subprocess.RunRequest{
+		Executable: r.cfg.Binary, Args: args, Timeout: r.cfg.Timeout,
+		EnvOverrides: env, SensitiveEnvNames: names, DiagnosticOwner: "audita",
+		StdoutLogPath: req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
 	})
-	if err != nil {
-		wrappedMessage := fmt.Sprintf(
-			"run audita process (binary=%q, stdout_log=%q, stderr_log=%q)",
-			r.binary,
-			req.StdoutLogPath,
-			req.StderrLogPath,
-		)
-		wrappedMessage = addSubprocessStreamHint(wrappedMessage, err)
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf(
-			"%s: %w",
-			wrappedMessage,
-			err,
-		)
+	result := r.result(req, modules, names, runRes)
+	if runErr != nil {
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("run audita process (binary=%q, output_dir=%q, stdout_log=%q, stderr_log=%q): %w",
+			r.cfg.Binary, filepath.Dir(req.OutputProcessedPath), req.StdoutLogPath, req.StderrLogPath, runErr)
 	}
-
 	if err := validateProcessedOutput(req.OutputProcessedPath); err != nil {
-		return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
+		result.Reports, _ = discoverReports(req.OutputProcessedPath)
+		return result, fmt.Errorf("validate audita processed output %q: %w", req.OutputProcessedPath, err)
 	}
-	if r.report {
-		if err := validateJSONFile(req.ReportPath); err != nil {
-			return r.failureResult(req, reqModules, runRes, credentialPresent), fmt.Errorf("validate audita report output %q: %w", req.ReportPath, err)
-		}
+	reports, err := discoverReports(req.OutputProcessedPath)
+	if err != nil {
+		return result, err
 	}
-
-	return PolishResult{
-		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
-		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    reqModules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyReference,
-			"credential_present":         credentialPresent,
-		},
-	}, nil
+	result.Reports = reports
+	return result, nil
 }
 
-func (r *SubprocessRunner) failureResult(req PolishRequest, modules []string, runRes subprocess.RunResult, credentialPresent bool) PolishResult {
+func (r *SubprocessRunner) result(req PolishRequest, modules, names []string, runRes subprocess.RunResult) PolishResult {
 	return PolishResult{
 		ProcessedTranscriptPath: req.OutputProcessedPath,
-		ReportPath:              req.ReportPath,
-		WorkDir:                 req.WorkDir,
-		StdoutLogPath:           req.StdoutLogPath,
-		StderrLogPath:           req.StderrLogPath,
-		GeneratedConfigPath:     req.GeneratedConfigPath,
-		ExitCode:                runRes.ExitCode,
-		Duration:                runRes.Duration,
-		InvokedBinary:           r.binary,
+		StdoutLogPath:           req.StdoutLogPath, StderrLogPath: req.StderrLogPath,
+		GeneratedConfigPath: req.GeneratedConfigPath, ExitCode: runRes.ExitCode,
+		Duration: runRes.Duration, InvokedBinary: r.cfg.Binary,
 		Metadata: map[string]any{
-			"adapter":                    "audita_subprocess",
-			"modules":                    modules,
-			"base_url":                   r.baseURL,
-			"model":                      r.model,
-			"transcript_description":     r.transcriptDescription,
-			"config_path":                r.configPath,
-			"output_schema":              r.outputSchema,
-			"work_dir_retention":         r.workDirRetention,
-			"validation_model":           r.validationModel,
-			"total_llm_concurrency":      r.totalLLMConcurrency,
-			"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-			"validation_llm_concurrency": r.validationLLMConcurrency,
-			"credential_env_var":         r.llmAPIKeyReference,
-			"credential_present":         credentialPresent,
+			"adapter": "audita_subprocess", "modules": modules,
+			"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+			"validation_profile":     r.cfg.ValidationProfile,
+			"transcript_description": r.cfg.TranscriptDescription,
+			"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+			"credential_names": names,
 		},
 	}
 }
 
 func (r *SubprocessRunner) buildArgs(req PolishRequest, modules []string) []string {
-	args := []string{
-		"process",
-		req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-	}
-	if r.baseURL != "" {
-		args = append(args, "--base-url", r.baseURL)
-	}
-	if r.model != "" {
-		args = append(args, "--model", r.model)
-	}
-	if len(modules) > 0 {
+	args := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath}
+	if modules != nil {
 		args = append(args, "--modules", strings.Join(modules, ","))
 	}
-	if r.report {
-		args = append(args, "--report-json", req.ReportPath)
-	}
-	if r.transcriptDescription != "" {
-		args = append(args, "--transcript-description", r.transcriptDescription)
-	}
-	if r.configPath != "" {
-		args = append(args, "--config", r.configPath)
-	}
-	if r.outputSchema != "" {
-		args = append(args, "--output-schema", r.outputSchema)
-	}
-	if r.workDirRetention != "" {
-		args = append(args, "--work-dir-retention", r.workDirRetention)
-	}
-	if r.totalLLMConcurrency != nil {
-		args = append(args, "--total-llm-concurrency", strconv.Itoa(*r.totalLLMConcurrency))
-	}
-	if r.proposalLLMConcurrency != nil {
-		args = append(args, "--proposal-llm-concurrency", strconv.Itoa(*r.proposalLLMConcurrency))
-	}
-	if r.validationModel != "" {
-		args = append(args, "--validation-model", r.validationModel)
-	}
-	if r.validationLLMConcurrency != nil {
-		args = append(args, "--validation-llm-concurrency", strconv.Itoa(*r.validationLLMConcurrency))
+	for _, setting := range []struct{ flag, value string }{
+		{"--config", r.cfg.ConfigPath}, {"--overlay", r.cfg.Overlay},
+		{"--proposal-profile", r.cfg.ProposalProfile}, {"--validation-profile", r.cfg.ValidationProfile},
+		{"--transcript-description", r.cfg.TranscriptDescription}, {"--output-schema", r.cfg.OutputSchema},
+	} {
+		if setting.value != "" {
+			args = append(args, setting.flag, setting.value)
+		}
 	}
 	return args
 }
 
-func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args []string, modules []string, credentialPresent bool) error {
-	payload := map[string]any{
-		"schema":                     "audita.generated.v1",
-		"binary":                     r.binary,
-		"args":                       args,
-		"timeout":                    r.timeout.String(),
-		"modules":                    modules,
-		"base_url":                   r.baseURL,
-		"model":                      r.model,
-		"transcript_description":     r.transcriptDescription,
-		"config_path":                r.configPath,
-		"output_schema":              r.outputSchema,
-		"work_dir_retention":         r.workDirRetention,
-		"validation_model":           r.validationModel,
-		"total_llm_concurrency":      r.totalLLMConcurrency,
-		"proposal_llm_concurrency":   r.proposalLLMConcurrency,
-		"validation_llm_concurrency": r.validationLLMConcurrency,
-		"report_enabled":             r.report,
-		"merged_transcript_path":     req.MergedTranscriptPath,
-		"glossary_path":              req.GlossaryPath,
-		"output_path":                req.OutputProcessedPath,
-		"report_path":                req.ReportPath,
-		"work_dir":                   req.WorkDir,
-		"credential_env_var":         r.llmAPIKeyReference,
-		"credential_present":         credentialPresent,
+func (r *SubprocessRunner) writeInvocationConfig(req PolishRequest, args, modules, names []string) error {
+	return writeGeneratedYAML(req.GeneratedConfigPath, map[string]any{
+		"schema": "audita.generated.v2", "binary": r.cfg.Binary, "args": args,
+		"timeout": r.cfg.Timeout.String(), "modules": modules,
+		"overlay": r.cfg.Overlay, "proposal_profile": r.cfg.ProposalProfile,
+		"validation_profile":     r.cfg.ValidationProfile,
+		"transcript_description": r.cfg.TranscriptDescription,
+		"config_path":            r.cfg.ConfigPath, "output_schema": r.cfg.OutputSchema,
+		"merged_transcript_path": req.MergedTranscriptPath, "glossary_path": req.GlossaryPath,
+		"output_path": req.OutputProcessedPath, "credential_names": names,
+	})
+}
+
+func discoverReports(outputPath string) (ReportBundle, error) {
+	var reports ReportBundle
+	for _, report := range []struct {
+		name string
+		dest *string
+	}{
+		{"errors.yml", &reports.ErrorsPath},
+		{"recoveries.yml", &reports.RecoveriesPath},
+		{"report.md", &reports.OverviewPath},
+	} {
+		path := filepath.Join(filepath.Dir(outputPath), report.name)
+		info, err := os.Lstat(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return reports, fmt.Errorf("inspect audita report %q: %w", path, err)
+		}
+		if !info.Mode().IsRegular() {
+			return reports, fmt.Errorf("audita report %q is not a regular file", path)
+		}
+		if _, err := fileops.ReadFileBounded(path, MaxReportOutputBytes); err != nil {
+			return reports, fmt.Errorf("audita report %q exceeds or cannot be read within %d-byte limit: %w", path, MaxReportOutputBytes, err)
+		}
+		*report.dest = path
 	}
-	return writeGeneratedYAML(req.GeneratedConfigPath, payload)
+	return reports, nil
 }
 
 func validateProcessedOutput(path string) error {
-	data, err := readAuditaResult(path, MaxProcessedOutputBytes, "processed transcript")
+	data, err := fileops.ReadFileBounded(path, MaxProcessedOutputBytes)
 	if err != nil {
-		return err
+		return fmt.Errorf("audita processed transcript result exceeds or cannot be read within %d-byte limit: %w", MaxProcessedOutputBytes, err)
 	}
-
 	var payload map[string]any
 	if err := json.Unmarshal(data, &payload); err != nil {
 		return fmt.Errorf("parse json: %w", err)
@@ -401,34 +233,3 @@ func validateProcessedOutput(path string) error {
 	}
 	return nil
 }
-
-func addSubprocessStreamHint(message string, runErr error) string {
-	if runErr == nil {
-		return message
-	}
-	lower := strings.ToLower(runErr.Error())
-	if strings.Contains(lower, "bad file descriptor") || strings.Contains(lower, "exit code 120") {
-		return message + "; hint=audita child process may have started with invalid stderr/stdout descriptors"
-	}
-	return message
-}
-
-func validateJSONFile(path string) error {
-	data, err := readAuditaResult(path, MaxReportOutputBytes, "report")
-	if err != nil {
-		return err
-	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		return fmt.Errorf("parse json: %w", err)
-	}
-	return nil
-}
-
-func readAuditaResult(path string, limit int64, category string) ([]byte, error) {
-	data, err := fileops.ReadFileBounded(path, limit)
-	if err != nil {
-		return nil, fmt.Errorf("audita %s result exceeds or cannot be read within %d-byte limit: %w", category, limit, err)
-	}
-	return data, nil
-}

internal/adapters/audita/subprocess_test.go

@@ -2,630 +2,262 @@ package audita
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+	"gitea.maximumdirect.net/eric/narratio/internal/adapters/subprocess"
 )
 
-func TestSubprocessRunnerSuccessArgsEnvAndValidation(t *testing.T) {
-
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	wrapper := writeAuditaHelperWrapper(t)
-	totalLLMConcurrency := 3
-	proposalLLMConcurrency := 2
-	validationLLMConcurrency := 2
-	runner, err := NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:                   wrapper,
-		Timeout:                  mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:                "super-secret",
-		LLMAPIKeyReference:       "OPENAI_KEY_SOURCE",
-		Modules:                  []string{"glossary", "homophones", "glossary"},
-		BaseURL:                  "https://openrouter.ai/api/v1",
-		Model:                    "openrouter/google/gemma-4-31b-it",
-		TranscriptDescription:    "Campaign Session 42",
-		ConfigPath:               "/etc/audita/config.yml",
-		OutputSchema:             "audita-v1",
-		WorkDirRetention:         "auto",
-		TotalLLMConcurrency:      &totalLLMConcurrency,
-		ProposalLLMConcurrency:   &proposalLLMConcurrency,
-		ValidationModel:          "openrouter/google/gemma-4-31b-it",
-		ValidationLLMConcurrency: &validationLLMConcurrency,
-		Report:                   true,
-	})
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-	t.Setenv("OPENAI_KEY_SOURCE", "changed-after-resolution")
-
+func auditaTestRequest(t *testing.T) PolishRequest {
+	t.Helper()
 	dir := t.TempDir()
-	req := PolishRequest{
-		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: filepath.Join(dir, "base.json"),
+	return PolishRequest{
+		MergedTranscriptPath: filepath.Join(dir, "merged.json"),
 		GlossaryPath:         filepath.Join(dir, "glossary.yml"),
 		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		ReportPath:           filepath.Join(dir, "audita.report.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
-	}
-	writeAuditaTestFile(t, req.MergedTranscriptPath, `{"segments":[]}`)
-	writeAuditaTestFile(t, req.GlossaryPath, "terms: []\n")
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.ProcessedTranscriptPath != req.OutputProcessedPath {
-		t.Fatalf("ProcessedTranscriptPath = %q, want %q", res.ProcessedTranscriptPath, req.OutputProcessedPath)
-	}
-	if res.ReportPath != req.ReportPath {
-		t.Fatalf("ReportPath = %q, want %q", res.ReportPath, req.ReportPath)
-	}
-	if res.WorkDir != req.WorkDir {
-		t.Fatalf("WorkDir = %q, want %q", res.WorkDir, req.WorkDir)
-	}
-	if res.InvokedBinary != wrapper {
-		t.Fatalf("InvokedBinary = %q, want %q", res.InvokedBinary, wrapper)
-	}
-	if res.ExitCode != 0 {
-		t.Fatalf("ExitCode = %d, want 0", res.ExitCode)
-	}
-	if res.Duration <= 0 {
-		t.Fatalf("Duration = %s, want > 0", res.Duration)
-	}
-	assertJSONFileAudita(t, req.OutputProcessedPath)
-	assertJSONFileAudita(t, req.ReportPath)
-	if _, err := os.Stat(req.StdoutLogPath); err != nil {
-		t.Fatalf("stdout log missing: %v", err)
-	}
-	if _, err := os.Stat(req.StderrLogPath); err != nil {
-		t.Fatalf("stderr log missing: %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	wantArgs := []string{
-		"process", req.MergedTranscriptPath,
-		"--glossary", req.GlossaryPath,
-		"--output", req.OutputProcessedPath,
-		"--work-dir", req.WorkDir,
-		"--base-url", "https://openrouter.ai/api/v1",
-		"--model", "openrouter/google/gemma-4-31b-it",
-		"--modules", "glossary,homophones,glossary",
-		"--report-json", req.ReportPath,
-		"--transcript-description", "Campaign Session 42",
-		"--config", "/etc/audita/config.yml",
-		"--output-schema", "audita-v1",
-		"--work-dir-retention", "auto",
-		"--total-llm-concurrency", "3",
-		"--proposal-llm-concurrency", "2",
-		"--validation-model", "openrouter/google/gemma-4-31b-it",
-		"--validation-llm-concurrency", "2",
-	}
-	if strings.Join(rec.Args, "\n") != strings.Join(wantArgs, "\n") {
-		t.Fatalf("args = %#v, want %#v", rec.Args, wantArgs)
-	}
-	if rec.Env["AUDITA_LLM_API_KEY"] != "super-secret" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want propagated secret", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-	if rec.Env["AUDITA_LLM_CONCURRENCY"] != "" {
-		t.Fatalf("AUDITA_LLM_CONCURRENCY = %q, want empty/omitted", rec.Env["AUDITA_LLM_CONCURRENCY"])
-	}
-
-	cfgData, err := os.ReadFile(req.GeneratedConfigPath)
-	if err != nil {
-		t.Fatalf("read generated config: %v", err)
-	}
-	if strings.Contains(string(cfgData), "super-secret") {
-		t.Fatalf("generated config must not contain credential value")
-	}
-}
-
-func TestSubprocessRunnerRejectsIncompleteResolvedCredential(t *testing.T) {
-	_, err := NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKeyReference: "MISSING_AUDITA_KEY",
-	})
-	if err == nil || !strings.Contains(err.Error(), "credential value and reference must be provided together") {
-		t.Fatalf("NewSubprocessRunner() error = %v, want credential pair error", err)
-	}
-}
-
-func TestSubprocessRunnerUnconfiguredCredentialEnvOmitsCredential(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		Modules:   []string{"glossary"},
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-
-	res, err := runner.Run(context.Background(), req)
-	if err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	if res.Metadata["credential_present"] != false {
-		t.Fatalf("credential_present = %#v, want false", res.Metadata["credential_present"])
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_LLM_API_KEY"] != "" {
-		t.Fatalf("AUDITA_LLM_API_KEY = %q, want omitted/empty", rec.Env["AUDITA_LLM_API_KEY"])
-	}
-}
-
-func TestSubprocessRunnerOmitsUnspecifiedParentEnvironment(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	t.Setenv("AUDITA_INHERITED_MARKER", "inherited-from-parent")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		Modules:   []string{"glossary"},
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-		LLMAPIKey: "",
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-
-	rec := readAuditaHelperRecord(t, recordPath)
-	if rec.Env["AUDITA_INHERITED_MARKER"] != "" {
-		t.Fatalf("AUDITA_INHERITED_MARKER = %q, want omitted from the child environment", rec.Env["AUDITA_INHERITED_MARKER"])
-	}
-}
-
-func TestSubprocessRunnerOmitsModulesFlagWhenNotConfigured(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		BaseURL:   "https://openrouter.ai/api/v1",
-		Model:     "openrouter/google/gemma-4-31b-it",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--modules" {
-			t.Fatalf("args contained --modules unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerOmitsBaseURLAndModelFlagsWhenNotConfigured(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "success")
-	recordPath := filepath.Join(t.TempDir(), "record.json")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", recordPath)
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:    writeAuditaHelperWrapper(t),
-		Timeout:   mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey: "",
-		Report:    false,
-	})
-	req := auditaReqForTest(t, false)
-	if _, err := runner.Run(context.Background(), req); err != nil {
-		t.Fatalf("Run() error = %v", err)
-	}
-	rec := readAuditaHelperRecord(t, recordPath)
-	for i := 0; i < len(rec.Args); i++ {
-		if rec.Args[i] == "--base-url" {
-			t.Fatalf("args contained --base-url unexpectedly: %#v", rec.Args)
-		}
-		if rec.Args[i] == "--model" {
-			t.Fatalf("args contained --model unexpectedly: %#v", rec.Args)
-		}
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailure(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "run audita process") {
-		t.Fatalf("error = %q, want subprocess context", err.Error())
-	}
-	if !strings.Contains(err.Error(), "exit code") {
-		t.Fatalf("error = %q, want exit code context", err.Error())
-	}
-	if !strings.Contains(err.Error(), req.StdoutLogPath) || !strings.Contains(err.Error(), req.StderrLogPath) {
-		t.Fatalf("error = %q, want stdout/stderr log paths", err.Error())
-	}
-	if strings.Contains(err.Error(), "super-secret") {
-		t.Fatalf("failure diagnostic exposed credential value: %q", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSubprocessFailureAddsStderrDescriptorHint(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "fail_bad_fd")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "hint=audita child process may have started with invalid stderr/stdout descriptors") {
-		t.Fatalf("error = %q, want stderr descriptor hint", err.Error())
-	}
-}
-
-func TestSubprocessRunnerMissingOutputFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "missing_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita processed output") {
-		t.Fatalf("error = %q, want output validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidOutputJSONFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_output")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "parse json") {
-		t.Fatalf("error = %q, want parse json context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerSegmentsMissingFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "segments_missing")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             false,
-	})
-	req := auditaReqForTest(t, false)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "segments") {
-		t.Fatalf("error = %q, want segments validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerInvalidReportJSONFails(t *testing.T) {
-	t.Setenv("GO_WANT_AUDITA_HELPER", "1")
-	t.Setenv("AUDITA_HELPER_MODE", "invalid_report")
-	t.Setenv("OPENAI_KEY_SOURCE", "super-secret")
-	t.Setenv("AUDITA_HELPER_RECORD_PATH", filepath.Join(t.TempDir(), "record.json"))
-
-	runner := mustAuditaRunner(t, SubprocessRunnerConfig{
-		Binary:             writeAuditaHelperWrapper(t),
-		Timeout:            mustParseAuditaDuration(t, "2s"),
-		LLMAPIKey:          "super-secret",
-		LLMAPIKeyReference: "OPENAI_KEY_SOURCE",
-		Modules:            []string{"glossary"},
-		BaseURL:            "https://openrouter.ai/api/v1",
-		Model:              "openrouter/google/gemma-4-31b-it",
-		Report:             true,
-	})
-	req := auditaReqForTest(t, true)
-	_, err := runner.Run(context.Background(), req)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "validate audita report output") {
-		t.Fatalf("error = %q, want report validation context", err.Error())
-	}
-}
-
-func TestSubprocessRunnerConstructorValidation(t *testing.T) {
-	_, err := NewSubprocessRunnerFromConfigValues("", "3h", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected binary validation error")
-	}
-	_, err = NewSubprocessRunnerFromConfigValues("audita", "bad", "synthetic-secret", "AUDITA_LLM_API_KEY", []string{"glossary"}, "https://openrouter.ai/api/v1", "openrouter/google/gemma-4-31b-it", "", "", "", "", nil, nil, "", nil, true)
-	if err == nil {
-		t.Fatal("expected timeout parse error")
-	}
-	_, err = NewSubprocessRunner(SubprocessRunnerConfig{
-		Binary:             "audita",
-		Timeout:            mustParseAuditaDuration(t, "1s"),
-		LLMAPIKey:          "synthetic-secret",
-		LLMAPIKeyReference: "AUDITA_LLM_API_KEY",
-		Modules:            []string{"glossary"},
-		BaseURL:            "://",
-		Model:              "openrouter/google/gemma-4-31b-it",
-	})
-	if err == nil {
-		t.Fatal("expected base url validation error")
-	}
-}
-
-type auditaHelperRecord struct {
-	Args []string          `json:"args"`
-	Env  map[string]string `json:"env"`
-}
-
-func TestAuditaSubprocessHelper(t *testing.T) {
-	if os.Getenv("GO_WANT_AUDITA_HELPER") != "1" {
-		return
-	}
-
-	args := os.Args
-	start := -1
-	for i := range args {
-		if args[i] == "--" {
-			start = i + 1
-			break
-		}
-	}
-	if start < 0 || start >= len(args) {
-		_, _ = os.Stderr.WriteString("missing -- args separator\n")
-		os.Exit(2)
-	}
-	procArgs := args[start:]
-	outPath := auditaFlagValue(procArgs, "--output")
-	reportPath := auditaFlagValue(procArgs, "--report-json")
-	recordPath := os.Getenv("AUDITA_HELPER_RECORD_PATH")
-	if strings.TrimSpace(recordPath) != "" {
-		rec := auditaHelperRecord{
-			Args: procArgs,
-			Env: map[string]string{
-				"AUDITA_LLM_API_KEY":      os.Getenv("AUDITA_LLM_API_KEY"),
-				"AUDITA_LLM_CONCURRENCY":  os.Getenv("AUDITA_LLM_CONCURRENCY"),
-				"AUDITA_INHERITED_MARKER": os.Getenv("AUDITA_INHERITED_MARKER"),
-			},
-		}
-		data, _ := json.Marshal(rec)
-		_ = os.MkdirAll(filepath.Dir(recordPath), 0o755)
-		_ = os.WriteFile(recordPath, data, 0o644)
-	}
-
-	mode := os.Getenv("AUDITA_HELPER_MODE")
-	switch mode {
-	case "success":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		_, _ = os.Stdout.WriteString("audita helper success stdout\n")
-		_, _ = os.Stderr.WriteString("audita helper success stderr\n")
-		os.Exit(0)
-	case "fail":
-		_, _ = os.Stderr.WriteString("audita helper failure\n")
-		os.Exit(8)
-	case "fail_bad_fd":
-		_, _ = os.Stderr.WriteString("OSError: [Errno 9] Bad file descriptor\n")
-		os.Exit(120)
-	case "missing_output":
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_output":
-		writeAuditaHelperFile(outPath, `not-json`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "segments_missing":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1"}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `{"schema":"audita.report.v1","steps":[]}`)
-		}
-		os.Exit(0)
-	case "invalid_report":
-		writeAuditaHelperFile(outPath, `{"schema":"audita.processed.v1","segments":[]}`)
-		if reportPath != "" {
-			writeAuditaHelperFile(reportPath, `not-json`)
-		}
-		os.Exit(0)
-	default:
-		_, _ = os.Stderr.WriteString(fmt.Sprintf("unknown helper mode %q\n", mode))
-		os.Exit(2)
-	}
-}
-
-func mustAuditaRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
-	t.Helper()
-	r, err := NewSubprocessRunner(cfg)
-	if err != nil {
-		t.Fatalf("NewSubprocessRunner() error = %v", err)
-	}
-	return r
-}
-
-func auditaReqForTest(t *testing.T, withReport bool) PolishRequest {
-	t.Helper()
-	dir := t.TempDir()
-	merged := filepath.Join(dir, "base.json")
-	glossary := filepath.Join(dir, "glossary.yml")
-	writeAuditaTestFile(t, merged, `{"segments":[]}`)
-	writeAuditaTestFile(t, glossary, "terms: []\n")
-	req := PolishRequest{
 		GeneratedConfigPath:  filepath.Join(dir, "audita.generated.yml"),
-		MergedTranscriptPath: merged,
-		GlossaryPath:         glossary,
-		OutputProcessedPath:  filepath.Join(dir, "polished.json"),
-		WorkDir:              filepath.Join(dir, "artifacts", "audita-work"),
-		StdoutLogPath:        filepath.Join(dir, "audita.stdout.log"),
-		StderrLogPath:        filepath.Join(dir, "audita.stderr.log"),
+		StdoutLogPath:        filepath.Join(dir, "stdout.log"),
+		StderrLogPath:        filepath.Join(dir, "stderr.log"),
 	}
-	if withReport {
-		req.ReportPath = filepath.Join(dir, "audita.report.json")
-	}
-	return req
 }
 
-func writeAuditaHelperWrapper(t *testing.T) string {
+func auditaTestRunner(t *testing.T, cfg SubprocessRunnerConfig) *SubprocessRunner {
 	t.Helper()
-	exe, err := os.Executable()
+	if cfg.Binary == "" {
+		cfg.Binary = "audita"
+	}
+	if cfg.Timeout == 0 {
+		cfg.Timeout = time.Second
+	}
+	runner, err := NewSubprocessRunner(cfg)
 	if err != nil {
-		t.Fatalf("os.Executable() error = %v", err)
+		t.Fatal(err)
 	}
-	path := filepath.Join(t.TempDir(), "audita-helper-wrapper.sh")
-	content := "#!/bin/sh\nexec \"" + exe + "\" -test.run=TestAuditaSubprocessHelper -- \"$@\"\n"
-	if err := os.WriteFile(path, []byte(content), 0o755); err != nil {
-		t.Fatalf("WriteFile(%q) error = %v", path, err)
-	}
-	return path
+	return runner
 }
 
-func writeAuditaTestFile(t *testing.T, path, contents string) {
+func auditaTestSecret(t *testing.T, name, value string) configkit.Secret {
 	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-		t.Fatalf("MkdirAll(%q): %v", path, err)
+	t.Setenv(name, value)
+	type loaded struct {
+		Credential configkit.Secret `yaml:"credential"`
 	}
-	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
-		t.Fatalf("WriteFile(%q): %v", path, err)
+	result, err := configkit.Load(configkit.Bytes("credential.yml", []byte("credential: "+name+"\n")), configkit.Options[loaded]{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return result.Config.Credential
+}
+
+func writeAuditaTestFile(t *testing.T, path, value string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(value), 0o600); err != nil {
+		t.Fatal(err)
 	}
 }
 
-func writeAuditaHelperFile(path, contents string) {
-	if strings.TrimSpace(path) == "" {
-		return
-	}
-	_ = os.MkdirAll(filepath.Dir(path), 0o755)
-	_ = os.WriteFile(path, []byte(contents), 0o644)
-}
-
-func auditaFlagValue(args []string, name string) string {
-	for i := 0; i < len(args)-1; i++ {
-		if args[i] == name {
-			return args[i+1]
+func TestSubprocessRunnerUsesV2InvocationAndCapturedCredentials(t *testing.T) {
+	const first = "NARRATIO_AUDITA_CUSTOM_ONE"
+	const second = "NARRATIO_AUDITA_CUSTOM_TWO"
+	firstSecret := auditaTestSecret(t, first, "loaded-one")
+	secondSecret := auditaTestSecret(t, second, "loaded-two")
+	t.Setenv(first, "parent-changed")
+	t.Setenv(second, "parent-changed-too")
+	t.Setenv("NARRATIO_AUDITA_UNSELECTED", "not-forwarded")
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{
+		Credentials: []configkit.Secret{firstSecret, secondSecret},
+		Modules:     []string{"grammar", "glossary", "grammar"},
+		Overlay:     "testing", ProposalProfile: "proposal", ValidationProfile: "validation",
+		TranscriptDescription: "campaign", ConfigPath: "/etc/audita/config.yml", OutputSchema: "audita-v1",
+	})
+	req := auditaTestRequest(t)
+	var captured subprocess.RunRequest
+	runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+		captured = processReq
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+			writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), name), "recoverable diagnostic\n")
 		}
+		return subprocess.RunResult{}, nil
 	}
-	return ""
-}
-
-func readAuditaHelperRecord(t *testing.T, path string) auditaHelperRecord {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	result, err := runner.Run(context.Background(), req)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var rec auditaHelperRecord
-	if err := json.Unmarshal(data, &rec); err != nil {
-		t.Fatalf("json unmarshal helper record: %v", err)
+	want := []string{"process", req.MergedTranscriptPath, "--glossary", req.GlossaryPath, "--output", req.OutputProcessedPath,
+		"--modules", "grammar,glossary,grammar", "--config", "/etc/audita/config.yml", "--overlay", "testing",
+		"--proposal-profile", "proposal", "--validation-profile", "validation", "--transcript-description", "campaign", "--output-schema", "audita-v1"}
+	if !reflect.DeepEqual(captured.Args, want) {
+		t.Fatalf("args = %#v, want %#v", captured.Args, want)
 	}
-	return rec
-}
-
-func assertJSONFileAudita(t *testing.T, path string) {
-	t.Helper()
-	data, err := os.ReadFile(path)
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[first] != "loaded-one" || captured.EnvOverrides[second] != "loaded-two" || captured.EnvOverrides["NARRATIO_AUDITA_UNSELECTED"] != "" {
+		t.Fatalf("credential forwarding = %#v", captured.EnvOverrides)
+	}
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{first, second}) {
+		t.Fatalf("sensitive names = %#v", captured.SensitiveEnvNames)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath == "" || result.Reports.OverviewPath == "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+	generated, err := os.ReadFile(req.GeneratedConfigPath)
 	if err != nil {
-		t.Fatalf("ReadFile(%q): %v", path, err)
+		t.Fatal(err)
 	}
-	var v any
-	if err := json.Unmarshal(data, &v); err != nil {
-		t.Fatalf("json unmarshal %q: %v", path, err)
+	if !strings.Contains(string(generated), "audita.generated.v2") || !strings.Contains(string(generated), first) || strings.Contains(string(generated), "loaded-one") {
+		t.Fatalf("unsafe or incomplete generated invocation: %s", generated)
 	}
 }
 
-func mustParseAuditaDuration(t *testing.T, value string) time.Duration {
-	t.Helper()
-	d, err := time.ParseDuration(value)
-	if err != nil {
-		t.Fatalf("time.ParseDuration(%q) error = %v", value, err)
+func TestSubprocessRunnerModulePresenceAndReportAbsence(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		configured []string
+		requested  []string
+		wantFlag   bool
+		wantValue  string
+	}{
+		{"omitted", nil, nil, false, ""},
+		{"configured", []string{"grammar", "grammar"}, nil, true, "grammar,grammar"},
+		{"empty override", []string{"grammar"}, []string{}, true, ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Modules: test.configured})
+			req := auditaTestRequest(t)
+			req.Modules = test.requested
+			runner.run = func(_ context.Context, processReq subprocess.RunRequest) (subprocess.RunResult, error) {
+				index := -1
+				for i, arg := range processReq.Args {
+					if arg == "--modules" {
+						index = i
+					}
+					if strings.HasPrefix(arg, "--report") || arg == "--debug" || arg == "--work-dir" {
+						t.Fatalf("retired or unwanted flag %q", arg)
+					}
+				}
+				if (index >= 0) != test.wantFlag || (index >= 0 && processReq.Args[index+1] != test.wantValue) {
+					t.Fatalf("args = %#v", processReq.Args)
+				}
+				writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+				return subprocess.RunResult{}, nil
+			}
+			result, err := runner.Run(context.Background(), req)
+			if err != nil || result.Reports != (ReportBundle{}) {
+				t.Fatalf("result = %#v, error = %v", result, err)
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerRejectsMissingOrMalformedTranscript(t *testing.T) {
+	for _, output := range []string{"", `{"segments":"wrong"}`} {
+		t.Run(output, func(t *testing.T) {
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+			req := auditaTestRequest(t)
+			runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+				if output != "" {
+					writeAuditaTestFile(t, req.OutputProcessedPath, output)
+				}
+				return subprocess.RunResult{}, nil
+			}
+			if _, err := runner.Run(context.Background(), req); err == nil {
+				t.Fatal("missing or malformed transcript was accepted")
+			}
+		})
+	}
+}
+
+func TestSubprocessRunnerPreservesFailureAndAvailableReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita exited after writing output")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		writeAuditaTestFile(t, filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml"), "status: failed\n")
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	result, err := runner.Run(context.Background(), req)
+	if !errors.Is(err, processFailure) || !strings.Contains(err.Error(), filepath.Dir(req.OutputProcessedPath)) {
+		t.Fatalf("error = %v", err)
+	}
+	if result.Reports.ErrorsPath == "" || result.Reports.RecoveriesPath != "" || result.Reports.OverviewPath != "" {
+		t.Fatalf("reports = %#v", result.Reports)
+	}
+}
+
+func TestSubprocessRunnerDoesNotMaskProcessFailureWithReportError(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	processFailure := errors.New("audita process failed")
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{ExitCode: 7}, processFailure
+	}
+	if _, err := runner.Run(context.Background(), req); !errors.Is(err, processFailure) {
+		t.Fatalf("error = %v, want original process error", err)
+	}
+}
+
+func TestSubprocessRunnerBoundsAdjacentReports(t *testing.T) {
+	runner := auditaTestRunner(t, SubprocessRunnerConfig{})
+	req := auditaTestRequest(t)
+	runner.run = func(context.Context, subprocess.RunRequest) (subprocess.RunResult, error) {
+		writeAuditaTestFile(t, req.OutputProcessedPath, `{"segments":[]}`)
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), "errors.yml")
+		if err := os.WriteFile(path, make([]byte, MaxReportOutputBytes+1), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		return subprocess.RunResult{}, nil
+	}
+	if _, err := runner.Run(context.Background(), req); err == nil || !strings.Contains(err.Error(), "errors.yml") || !strings.Contains(err.Error(), "16777216") {
+		t.Fatalf("error = %v, want named report limit", err)
+	}
+}
+
+func TestSubprocessRunnerRedactsCustomCredentialStreams(t *testing.T) {
+	const first = "NARRATIO_AUDITA_STREAM_ONE"
+	const second = "NARRATIO_AUDITA_STREAM_TWO"
+	for _, fail := range []bool{false, true} {
+		t.Run(map[bool]string{false: "success", true: "failure"}[fail], func(t *testing.T) {
+			firstSecret := auditaTestSecret(t, first, "audita-first-secret")
+			secondSecret := auditaTestSecret(t, second, "audita-second-secret")
+			req := auditaTestRequest(t)
+			body := "#!/bin/sh\nprintf '%s\\n' \"$" + first + "\"\nprintf '%s\\n' \"$" + second + "\" >&2\n"
+			if fail {
+				body += "exit 7\n"
+			} else {
+				body += "printf '{\"segments\":[]}' > \"" + req.OutputProcessedPath + "\"\n"
+			}
+			binary := filepath.Join(t.TempDir(), "audita-helper")
+			writeAuditaTestFile(t, binary, body)
+			if err := os.Chmod(binary, 0o700); err != nil {
+				t.Fatal(err)
+			}
+			runner := auditaTestRunner(t, SubprocessRunnerConfig{Binary: binary, Credentials: []configkit.Secret{firstSecret, secondSecret}})
+			_, err := runner.Run(context.Background(), req)
+			if (err != nil) != fail {
+				t.Fatalf("error = %v, fail = %v", err, fail)
+			}
+			for _, path := range []string{req.StdoutLogPath, req.StderrLogPath} {
+				data, readErr := os.ReadFile(path)
+				if readErr != nil {
+					t.Fatal(readErr)
+				}
+				if strings.Contains(string(data), "audita-first-secret") || strings.Contains(string(data), "audita-second-secret") || !strings.Contains(string(data), "<redacted>") {
+					t.Fatalf("unredacted stream %q: %s", path, data)
+				}
+			}
+			if fail && (strings.Contains(err.Error(), "audita-first-secret") || strings.Contains(err.Error(), "audita-second-secret")) {
+				t.Fatalf("unredacted failure: %v", err)
+			}
+		})
 	}
-	return d
 }

internal/adapters/notarius/fake.go

@@ -1,6 +1,10 @@
 package notarius
 
-import "context"
+import (
+	"context"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
 
 // FakeRunner is a configurable in-memory runner for stage tests.
 type FakeRunner struct {
@@ -15,6 +19,7 @@ func (f *FakeRunner) Run(ctx context.Context, req RunRequest) (RunResult, error)
 		return RunResult{}, err
 	}
 	copyRequest := req
+	copyRequest.Credentials = append([]configkit.Secret(nil), req.Credentials...)
 	if req.ConfigProfile != nil {
 		profile := *req.ConfigProfile
 		copyRequest.ConfigProfile = &profile

internal/adapters/notarius/runner.go

@@ -25,8 +25,8 @@ type ReferenceBinding struct {
 // RunRequest contains the resolved inputs and diagnostic destinations for one invocation.
 type RunRequest struct {
 	Binary string
-	// LLMAPIKey is an optional already-resolved credential reference.
-	LLMAPIKey        *configkit.Secret
+	// Credentials are already-resolved environment references selected for Notarius.
+	Credentials      []configkit.Secret
 	ConfigProfile    *string
 	ConfigPath       string
 	PipelineID       string

internal/adapters/notarius/subprocess.go

@@ -52,19 +52,9 @@ func (r *SubprocessRunner) Run(ctx context.Context, req RunRequest) (RunResult,
 	if err != nil {
 		return RunResult{}, err
 	}
-	var envOverrides map[string]string
-	var sensitiveEnvNames []string
-	if req.LLMAPIKey != nil {
-		if !req.LLMAPIKey.IsResolved() {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		name := req.LLMAPIKey.EnvName()
-		value := req.LLMAPIKey.Value()
-		if value == "" {
-			return RunResult{}, fmt.Errorf("notarius LLM API credential must be resolved and nonempty")
-		}
-		envOverrides = map[string]string{name: value}
-		sensitiveEnvNames = []string{name}
+	envOverrides, sensitiveEnvNames, err := subprocess.CredentialEnvironment(req.Credentials)
+	if err != nil {
+		return RunResult{}, fmt.Errorf("notarius credentials: %w", err)
 	}
 
 	args := []string{

internal/adapters/notarius/subprocess_test.go

@@ -188,12 +188,16 @@ func TestSubprocessRunnerRejectsInvalidChunkCacheBeforeLaunch(t *testing.T) {
 
 func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_LLM_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_OTHER_KEY"
 	const loadedValue = "loaded-notarius-credential"
+	const otherValue = "loaded-notarius-other-credential"
 	credential := loadTestCredential(t, envName, loadedValue)
+	otherCredential := loadTestCredential(t, otherName, otherValue)
 	t.Setenv(envName, "changed-parent-credential")
+	t.Setenv(otherName, "changed-parent-other-credential")
 
 	req := validRunRequest(t)
-	req.LLMAPIKey = credential
+	req.Credentials = []configkit.Secret{*credential, *otherCredential}
 	var captured sharedsubprocess.RunRequest
 	runner := &SubprocessRunner{run: func(_ context.Context, processReq sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
 		captured = processReq
@@ -203,10 +207,10 @@ func TestSubprocessRunnerForwardsLoadedCredentialWithoutRereadingEnvironment(t *
 	if _, err := runner.Run(context.Background(), req); err != nil {
 		t.Fatalf("Run() error = %v", err)
 	}
-	if len(captured.EnvOverrides) != 1 || captured.EnvOverrides[envName] != loadedValue {
-		t.Fatal("subprocess did not receive exactly the loaded credential override")
+	if len(captured.EnvOverrides) != 2 || captured.EnvOverrides[envName] != loadedValue || captured.EnvOverrides[otherName] != otherValue {
+		t.Fatal("subprocess did not receive exactly the loaded credential overrides")
 	}
-	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName}) {
+	if !reflect.DeepEqual(captured.SensitiveEnvNames, []string{envName, otherName}) {
 		t.Fatalf("sensitive environment names = %#v, want configured reference name", captured.SensitiveEnvNames)
 	}
 	wantArgs := []string{
@@ -228,7 +232,7 @@ func TestSubprocessRunnerRejectsInvalidProgrammaticCredentialBeforeLaunch(t *tes
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			req := validRunRequest(t)
-			req.LLMAPIKey = &test.reference
+			req.Credentials = []configkit.Secret{test.reference}
 			started := false
 			runner := &SubprocessRunner{run: func(context.Context, sharedsubprocess.RunRequest) (sharedsubprocess.RunResult, error) {
 				started = true
@@ -342,10 +346,12 @@ func TestSubprocessRunnerRejectsInvalidReferencesBeforeLaunch(t *testing.T) {
 
 func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_CAPTURE_OTHER_KEY"
 	const canary = "notarius-captured-stream-canary"
+	const otherCanary = "notarius-captured-stream-other-canary"
 	const unrelated = "NARRATIO_NOTARIUS_UNRELATED_PARENT_KEY"
 	req := validRunRequest(t)
-	req.LLMAPIKey = loadTestCredential(t, envName, canary)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	writeValidBundleAndReceipt(t, req, false)
 	receiptFixture := req.ReceiptPath + ".fixture"
 	data, err := os.ReadFile(req.ReceiptPath)
@@ -356,7 +362,7 @@ func TestSubprocessRunnerUsesMinimalEnvironmentAndSeparatesStreams(t *testing.T)
 	if err := json.Unmarshal(data, &receipt); err != nil {
 		t.Fatalf("decode receipt fixture: %v", err)
 	}
-	receipt["credential_echo"] = canary
+	receipt["credential_echo"] = canary + " " + otherCanary
 	writeJSONFile(t, receiptFixture, receipt)
 	if err := os.Remove(req.ReceiptPath); err != nil {
 		t.Fatalf("Remove(receipt) error = %v", err)
@@ -373,11 +379,16 @@ if [ "$`+envName+`" != '`+canary+`' ]; then
   printf 'selected credential mismatch\n' >&2
   exit 8
 fi
+if [ "$`+otherName+`" != '`+otherCanary+`' ]; then
+  printf 'other selected credential mismatch\n' >&2
+  exit 10
+fi
 if [ -n "$`+unrelated+`" ]; then
   printf 'unrelated credential inherited\n' >&2
   exit 9
 fi
 printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 cat "$NOTARIUS_RECEIPT_FIXTURE"
 `)
 	req.Binary = script
@@ -392,32 +403,39 @@ cat "$NOTARIUS_RECEIPT_FIXTURE"
 	assertTextFile(t, filepath.Join(captureDir, "working-directory"), req.WorkingDirectory+"\n")
 	assertTextFile(t, filepath.Join(captureDir, "environment"), "")
 	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 	receiptBytes, err := os.ReadFile(req.ReceiptPath)
 	if err != nil {
 		t.Fatalf("ReadFile(receipt) error = %v", err)
 	}
 	assertRedactedCredentialBytes(t, receiptBytes, canary)
+	assertRedactedCredentialBytes(t, receiptBytes, otherCanary)
 }
 
 func TestSubprocessRunnerRedactsCredentialOnProcessFailure(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_KEY"
+	const otherName = "NARRATIO_NOTARIUS_CUSTOM_FAILURE_OTHER_KEY"
 	const canary = "notarius-failure-stream-canary"
+	const otherCanary = "notarius-failure-stream-other-canary"
 	req := validRunRequest(t)
-	req.LLMAPIKey = loadTestCredential(t, envName, canary)
+	req.Credentials = []configkit.Secret{*loadTestCredential(t, envName, canary), *loadTestCredential(t, otherName, otherCanary)}
 	req.Binary = writeShellScript(t, `#!/bin/sh
 printf '%s\n' "$`+envName+`"
 printf '%s\n' "$`+envName+`" >&2
+printf '%s\n' "$`+otherName+`" >&2
 exit 7
 `)
 	_, err := NewSubprocessRunner().Run(context.Background(), req)
 	if err == nil {
 		t.Fatal("Run() error = nil, want process failure")
 	}
-	if strings.Contains(err.Error(), canary) || !strings.Contains(err.Error(), "<redacted>") {
+	if strings.Contains(err.Error(), canary) || strings.Contains(err.Error(), otherCanary) || !strings.Contains(err.Error(), "<redacted>") {
 		t.Fatal("process failure did not return redacted diagnostics")
 	}
 	assertRedactedCredentialFile(t, req.ReceiptPath, canary)
+	assertRedactedCredentialFile(t, req.ReceiptPath, otherCanary)
 	assertRedactedCredentialFile(t, req.LogPath, canary)
+	assertRedactedCredentialFile(t, req.LogPath, otherCanary)
 }
 
 func TestSubprocessRunnerReturnsProcessFailuresWithoutParsingStdout(t *testing.T) {

internal/adapters/subprocess/credentials.go

@@ -0,0 +1,29 @@
+package subprocess
+
+import (
+	"fmt"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+// CredentialEnvironment returns captured secret values and names for a child
+// invocation. References must already have been resolved by ConfigKit.
+func CredentialEnvironment(credentials []configkit.Secret) (map[string]string, []string, error) {
+	if len(credentials) == 0 {
+		return nil, nil, nil
+	}
+	overrides := make(map[string]string, len(credentials))
+	names := make([]string, 0, len(credentials))
+	for _, credential := range credentials {
+		name := credential.EnvName()
+		value := credential.Value()
+		if !credential.IsResolved() || value == "" {
+			return nil, nil, fmt.Errorf("credential %q must be resolved and nonempty", name)
+		}
+		if _, exists := overrides[name]; !exists {
+			names = append(names, name)
+			overrides[name] = value
+		}
+	}
+	return overrides, names, nil
+}

internal/adapters/subprocess/credentials_test.go

@@ -0,0 +1,51 @@
+package subprocess
+
+import (
+	"reflect"
+	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
+)
+
+func TestCredentialEnvironmentUsesCapturedReferences(t *testing.T) {
+	t.Setenv("CUSTOM_ALPHA_KEY", "alpha-value")
+	t.Setenv("SECOND_PROVIDER_TOKEN", "second-value")
+	t.Setenv("UNSELECTED_SECRET", "unselected-value")
+	type configuration struct {
+		Credentials []configkit.Secret `yaml:"credentials"`
+	}
+	loaded, err := configkit.Load[configuration](configkit.Bytes("credentials.yml", []byte("credentials: [CUSTOM_ALPHA_KEY, SECOND_PROVIDER_TOKEN, CUSTOM_ALPHA_KEY]\n")))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("CUSTOM_ALPHA_KEY", "later-value")
+	overrides, names, err := CredentialEnvironment(loaded.Config.Credentials)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(overrides, map[string]string{"CUSTOM_ALPHA_KEY": "alpha-value", "SECOND_PROVIDER_TOKEN": "second-value"}) ||
+		!reflect.DeepEqual(names, []string{"CUSTOM_ALPHA_KEY", "SECOND_PROVIDER_TOKEN"}) {
+		t.Fatalf("credential selection = %#v, %#v", overrides, names)
+	}
+	overrides["CUSTOM_ALPHA_KEY"] = "modified"
+	names[0] = "modified"
+	again, againNames, err := CredentialEnvironment(loaded.Config.Credentials)
+	if err != nil || again["CUSTOM_ALPHA_KEY"] != "alpha-value" || againNames[0] != "CUSTOM_ALPHA_KEY" {
+		t.Fatalf("credential conversion retained mutable result: %#v, %#v, %v", again, againNames, err)
+	}
+}
+
+func TestCredentialEnvironmentHandlesEmptyAndUnresolvedReferences(t *testing.T) {
+	for _, credentials := range [][]configkit.Secret{nil, {}} {
+		overrides, names, err := CredentialEnvironment(credentials)
+		if err != nil || len(overrides) != 0 || len(names) != 0 {
+			t.Fatalf("empty credentials = %#v, %#v, %v", overrides, names, err)
+		}
+	}
+	for _, credentials := range [][]configkit.Secret{{configkit.SecretEnv("UNRESOLVED_KEY")}, {{}}} {
+		overrides, names, err := CredentialEnvironment(credentials)
+		if err == nil || overrides != nil || names != nil {
+			t.Fatalf("unresolved credentials = %#v, %#v, %v", overrides, names, err)
+		}
+	}
+}

internal/app/assembled_workflow_test.go

@@ -256,12 +256,12 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath}, &validated); err != nil {
 		t.Fatalf("validate production base: %v", err)
 	}
-	if !strings.Contains(validated.String(), "profile=none") {
-		t.Fatalf("validate output = %q, want unprofiled production base", validated.String())
+	if !strings.Contains(validated.String(), "overlay=none") {
+		t.Fatalf("validate output = %q, want production base", validated.String())
 	}
 	for _, command := range []func(context.Context, []string, io.Writer) error{ConfigShow, ConfigSources} {
 		if err := command(context.Background(), []string{
-			"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing",
+			"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing",
 		}, io.Discard); err != nil {
 			t.Fatalf("testing inspection command %T: %v", command, err)
 		}
@@ -272,19 +272,19 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	}, &diff); err != nil {
 		t.Fatalf("compare profiles: %v", err)
 	}
-	if !strings.Contains(diff.String(), "audita.model") || !strings.Contains(diff.String(), "character_items_arannis.profile_id") {
-		t.Fatalf("profile diff = %q, want model and expanded family changes", diff.String())
+	if !strings.Contains(diff.String(), "audita.proposal_profile") || !strings.Contains(diff.String(), "character_items_arannis.profile_id") {
+		t.Fatalf("profile diff = %q, want proposal profile and expanded family changes", diff.String())
 	}
 
 	common := []string{
 		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath,
-		"--session", sessionPath, "--profile", "testing",
+		"--session", sessionPath, "--overlay", "testing",
 	}
 	var planned bytes.Buffer
 	if err := Plan(context.Background(), common, &planned); err != nil {
 		t.Fatalf("plan testing bundle: %v", err)
 	}
-	if !strings.Contains(planned.String(), "profile=testing") {
+	if !strings.Contains(planned.String(), "overlay=testing") {
 		t.Fatalf("plan output = %q, want testing provenance", planned.String())
 	}
 
@@ -305,7 +305,7 @@ func TestAssembledSplitBundleCommandsUseOneEffectiveFamilyConfiguration(t *testi
 	if !reflect.DeepEqual(capturedPlan.Names(), []string{"analyze"}) {
 		t.Fatalf("bounded plan = %#v, want analyze only", capturedPlan.Names())
 	}
-	if profile, ok := config.SelectedPipelineProfile(capturedCfg.Pipeline); !ok || profile.Name != "testing" {
+	if profile, ok := config.SelectedPipelineOverlay(capturedCfg.Pipeline); !ok || profile.Name != "testing" {
 		t.Fatalf("captured profile = %#v, selected=%t", profile, ok)
 	}
 	if digest := config.EffectivePipelineDigest(capturedCfg.Pipeline); digest == "" || !strings.Contains(runOut.String(), "digest="+digest) {
@@ -391,7 +391,7 @@ func loadAssembledSplitBundleConfig(t *testing.T, profile string) *config.Config
 	pipelinePath, campaignPath, sessionPath := assembledSplitBundlePaths()
 	options := config.SessionLoadOptions{}
 	if profile != "" {
-		options.Profile = &profile
+		options.Overlay = &profile
 	}
 	cfg, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, options)
 	if err != nil {
@@ -415,8 +415,8 @@ func assertAssembledProvenance(t *testing.T, store *manifest.LocalStore, summary
 		t.Fatal(err)
 	}
 	value := session.EffectiveConfig
-	profileMatches := value != nil && ((profile == "" && value.SelectedProfile == nil) ||
-		(profile != "" && value.SelectedProfile != nil && value.SelectedProfile.Name == profile))
+	profileMatches := value != nil && ((profile == "" && value.SelectedOverlay == nil) ||
+		(profile != "" && value.SelectedOverlay != nil && value.SelectedOverlay.Name == profile))
 	if !profileMatches || value.EffectiveConfigDigest != digest {
 		t.Fatalf("effective configuration provenance = %#v, want profile=%q digest=%q", value, profile, digest)
 	}

internal/app/bounded_run_test.go

@@ -57,7 +57,7 @@ func TestBoundedRunParsingRejectsDuplicateSingletons(t *testing.T) {
 		{name: "through mixed", args: []string{"session", "--through", "analyze", "--through=publish"}, want: "--through may be specified only once"},
 		{name: "force separate", args: []string{"session", "--force", "--force"}, want: "--force may be specified only once"},
 		{name: "force equals", args: []string{"session", "--force=true", "--force=false"}, want: "--force may be specified only once"},
-		{name: "profile", args: []string{"session", "--profile", "production", "--profile=testing"}, want: "--profile may be specified only once"},
+		{name: "overlay", args: []string{"session", "--overlay", "production", "--overlay=testing"}, want: "--overlay may be specified only once"},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -69,29 +69,29 @@ func TestBoundedRunParsingRejectsDuplicateSingletons(t *testing.T) {
 	}
 }
 
-func TestBoundedRunParsingRetainsExplicitProfilePresence(t *testing.T) {
-	withoutProfile, err := parseBoundedRunRequest("run", []string{"session"}, io.Discard)
+func TestBoundedRunParsingRetainsExplicitOverlayPresence(t *testing.T) {
+	withoutOverlay, err := parseBoundedRunRequest("run", []string{"session"}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := withoutProfile.Config.sessionOptions().Profile; got != nil {
-		t.Fatalf("omitted profile = %#v, want nil", got)
+	if got := withoutOverlay.Config.sessionOptions().Overlay; got != nil {
+		t.Fatalf("omitted overlay = %#v, want nil", got)
 	}
 
-	withProfile, err := parseBoundedRunRequest("run", []string{"session", "--profile", "testing"}, io.Discard)
+	withOverlay, err := parseBoundedRunRequest("run", []string{"session", "--overlay", "testing"}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := withProfile.Config.sessionOptions().Profile; got == nil || *got != "testing" {
-		t.Fatalf("explicit profile = %#v, want testing", got)
+	if got := withOverlay.Config.sessionOptions().Overlay; got == nil || *got != "testing" {
+		t.Fatalf("explicit overlay = %#v, want testing", got)
 	}
 
-	explicitEmpty, err := parseBoundedRunRequest("run", []string{"session", "--profile", ""}, io.Discard)
+	explicitEmpty, err := parseBoundedRunRequest("run", []string{"session", "--overlay", ""}, io.Discard)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := explicitEmpty.Config.sessionOptions().Profile; got == nil || *got != "" {
-		t.Fatalf("explicit empty profile = %#v, want non-nil empty", got)
+	if got := explicitEmpty.Config.sessionOptions().Overlay; got == nil || *got != "" {
+		t.Fatalf("explicit empty overlay = %#v, want non-nil empty", got)
 	}
 }
 

internal/app/clean.go

@@ -93,7 +93,7 @@ func cleanAllLocalWithDependencies(flags commonConfigFlags, dryRun, clearCache b
 		strings.TrimSpace(flags.previousSessionID) != "" {
 		return fmt.Errorf("clean: --all cannot be combined with --campaign, --campaign-file, --session, a session_id, or --previous-session-id")
 	}
-	_, pipelineCfg, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Profile: flags.profile.pointer()}, flags.secretsDir.pointer(), deps)
+	_, pipelineCfg, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Overlay: flags.overlay.pointer()}, flags.secretsDir.pointer(), deps)
 	if err != nil {
 		return fmt.Errorf("clean: %w", err)
 	}

internal/app/commands_test.go

@@ -229,7 +229,7 @@ seriatim:
   binary: ` + seriatimBinary + `
 audita:
   binary: ` + auditaBinary + `
-  llm_api_key: OPENROUTER_API_KEY
+  credentials: [OPENROUTER_API_KEY]
 notification:
   mode: noop
 `
@@ -274,6 +274,28 @@ inputs:
 	if !strings.Contains(stdout.String(), "stage=polish executed=1 skipped=0") {
 		t.Fatalf("stdout = %q, want polish execution", stdout.String())
 	}
+	recorded, err := (&manifest.LocalStore{}).Load(context.Background(), filepath.Join(workRoot, "manifest.json"))
+	if err != nil {
+		t.Fatalf("load polished manifest: %v", err)
+	}
+	polish := recorded.Stages["polish"]
+	if polish == nil || len(polish.Outputs) != 1 || polish.Outputs[0].Kind != "transcript_polished" {
+		t.Fatalf("polish outputs = %#v, want only canonical transcript", polish)
+	}
+	if len(polish.Logs) != 5 || len(polish.GeneratedConfigs) != 1 {
+		t.Fatalf("polish diagnostics = %#v, want logs, reports, and invocation", polish)
+	}
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		found := false
+		for _, path := range polish.Logs {
+			if filepath.Base(path) == name {
+				found = true
+			}
+		}
+		if !found {
+			t.Fatalf("report %q absent from manifest diagnostics: %#v", name, polish.Logs)
+		}
+	}
 	foundReference := false
 	if err := filepath.WalkDir(workRoot, func(path string, entry os.DirEntry, walkErr error) error {
 		if walkErr != nil || entry.IsDir() {
@@ -778,10 +800,18 @@ func TestAuditaAppHelper(t *testing.T) {
 		os.Exit(2)
 	}
 	processArgs := args[start:]
+	if len(processArgs) < 2 || processArgs[0] != "process" {
+		_, _ = os.Stderr.WriteString("expected Audita v2 process invocation\n")
+		os.Exit(2)
+	}
+	for _, arg := range processArgs {
+		if arg == "--report-json" || arg == "--work-dir" || arg == "--debug" || arg == "--reporting=false" {
+			_, _ = os.Stderr.WriteString("retired or unwanted Audita flag\n")
+			os.Exit(2)
+		}
+	}
 
 	outputPath := appSeriatimFlagValue(processArgs, "--output")
-	reportPath := appSeriatimFlagValue(processArgs, "--report-json")
-	workDir := appSeriatimFlagValue(processArgs, "--work-dir")
 	if strings.TrimSpace(outputPath) == "" {
 		_, _ = os.Stderr.WriteString("missing --output\n")
 		os.Exit(2)
@@ -794,19 +824,9 @@ func TestAuditaAppHelper(t *testing.T) {
 		_, _ = os.Stderr.WriteString(fmt.Sprintf("write output: %v\n", err))
 		os.Exit(2)
 	}
-	if strings.TrimSpace(reportPath) != "" {
-		if err := os.MkdirAll(filepath.Dir(reportPath), 0o755); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("mkdir report dir: %v\n", err))
-			os.Exit(2)
-		}
-		if err := os.WriteFile(reportPath, []byte(`{"report":true}`), 0o644); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("write report: %v\n", err))
-			os.Exit(2)
-		}
-	}
-	if strings.TrimSpace(workDir) != "" {
-		if err := os.MkdirAll(workDir, 0o755); err != nil {
-			_, _ = os.Stderr.WriteString(fmt.Sprintf("mkdir work dir: %v\n", err))
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		if err := os.WriteFile(filepath.Join(filepath.Dir(outputPath), name), []byte("status: completed\n"), 0o644); err != nil {
+			_, _ = os.Stderr.WriteString(fmt.Sprintf("write %s: %v\n", name, err))
 			os.Exit(2)
 		}
 	}

internal/app/config_artifacts_test.go

@@ -80,22 +80,22 @@ func TestConfigArtifactsReportsGeneratedFamilyProvenance(t *testing.T) {
 	}
 }
 
-func TestConfigArtifactsReportsProfiledFamilyContributors(t *testing.T) {
+func TestConfigArtifactsReportsOverlayFamilyContributors(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	profilePath := filepath.Join(filepath.Dir(pipelinePath), "profiles", "testing.yml")
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	overlayPath := filepath.Join(filepath.Dir(pipelinePath), "overlays", "testing.yml")
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifact_families:
     character_note:
       prompt_id: dnd.character_note.testing
 `)
 
-	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}
+	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}
 	var catalog bytes.Buffer
 	if err := ConfigArtifacts(context.Background(), args, &catalog); err != nil {
 		t.Fatal(err)
 	}
 	records := catalogRecordsByKey(t, catalog.String())
-	if got := strings.Split(records["character_note_arannis"][2], ","); !reflect.DeepEqual(got, []string{pipelinePath, profilePath}) {
+	if got := strings.Split(records["character_note_arannis"][2], ","); !reflect.DeepEqual(got, []string{overlayPath, pipelinePath}) {
 		t.Fatalf("generated family definitions = %#v", got)
 	}
 
@@ -103,16 +103,16 @@ func TestConfigArtifactsReportsProfiledFamilyContributors(t *testing.T) {
 	if err := ConfigSources(context.Background(), args, &sources); err != nil {
 		t.Fatal(err)
 	}
-	want := "scriptorium.artifacts.character_note_arannis.prompt_id\tfamily\t" + profilePath
+	want := "scriptorium.artifacts.character_note_arannis.prompt_id\tfamily\t" + overlayPath
 	if !strings.Contains(sources.String(), want) {
-		t.Fatalf("sources output missing profiled family contributor %q:\n%s", want, sources.String())
+		t.Fatalf("sources output missing overlay family contributor %q:\n%s", want, sources.String())
 	}
 }
 
-func TestConfigArtifactsReportsBaseAndProfileContributors(t *testing.T) {
+func TestConfigArtifactsReportsBaseAndOverlayContributors(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, pipelinePath, `workspace:
   root: /srv/narratio
 whisperx:
@@ -124,26 +124,26 @@ scriptorium:
       enabled: false
       output_path: artifacts/notes.md
 `)
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifacts:
     notes:
       enabled: true
       prompt_id: notes
-    profile_only:
+    overlay_only:
       enabled: false
-      output_path: artifacts/profile-only.md
+      output_path: artifacts/overlay-only.md
 `)
 
 	var out bytes.Buffer
-	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatal(err)
 	}
 	records := catalogRecordsByKey(t, out.String())
-	if got := strings.Split(records["notes"][2], ","); !reflect.DeepEqual(got, []string{pipelinePath, profilePath}) {
+	if got := strings.Split(records["notes"][2], ","); !reflect.DeepEqual(got, []string{overlayPath, pipelinePath}) {
 		t.Fatalf("notes definitions = %#v", got)
 	}
-	if got := records["profile_only"][2]; got != profilePath {
-		t.Fatalf("profile-only definition = %q, want %q", got, profilePath)
+	if got := records["overlay_only"][2]; got != overlayPath {
+		t.Fatalf("overlay-only definition = %q, want %q", got, overlayPath)
 	}
 }
 

internal/app/config_commands.go

@@ -17,7 +17,7 @@ type inspectionFlags struct {
 	pipelinePath     string
 	campaignPath     string
 	campaignFilePath string
-	profile          singletonStringFlag
+	overlay          singletonStringFlag
 	secretsDir       singletonStringFlag
 }
 
@@ -77,8 +77,8 @@ func configValidateWithDependencies(_ context.Context, args []string, out io.Wri
 	if err != nil {
 		return fmt.Errorf("config validate: %w", err)
 	}
-	_, err = fmt.Fprintf(out, "Configuration valid: root=%s; profile=%s; digest=%s\n",
-		inspectionRootPath(resolved), inspectionProfile(resolved.Pipeline), config.EffectivePipelineDigest(resolved.Pipeline))
+	_, err = fmt.Fprintf(out, "Configuration valid: root=%s; overlay=%s; digest=%s\n",
+		inspectionRootPath(resolved), inspectionOverlay(resolved.Pipeline), config.EffectivePipelineDigest(resolved.Pipeline))
 	return err
 }
 
@@ -214,12 +214,12 @@ func parseInspectionFlags(command string, args []string, out io.Writer) (inspect
 	fs.StringVar(&flags.pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
 	fs.StringVar(&flags.campaignPath, "campaign", "", "campaign ID")
 	fs.StringVar(&flags.campaignFilePath, "campaign-file", "", "path to campaign.yml")
-	flags.profile.name = "profile"
-	fs.Var(&flags.profile, "profile", "named pipeline profile")
+	flags.overlay.name = "overlay"
+	fs.Var(&flags.overlay, "overlay", "named pipeline overlay")
 	flags.secretsDir.name = "secrets-dir"
 	fs.Var(&flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.Usage = func() {
-		fmt.Fprintf(out, "Usage: narratio %s [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--profile <name>] [--secrets-dir <path>]\n\n", command)
+		fmt.Fprintf(out, "Usage: narratio %s [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--overlay <name>] [--secrets-dir <path>]\n\n", command)
 		fmt.Fprintln(out, "Resolves configuration without a session, workspace, manifest, adapters, or external services.")
 		fmt.Fprintln(out)
 		fmt.Fprintln(out, "Flags:")
@@ -238,7 +238,7 @@ func parseInspectionFlags(command string, args []string, out io.Writer) (inspect
 }
 
 func resolveInspectionConfigWithDependencies(flags inspectionFlags, deps commandDependencies) (*inspectionConfig, error) {
-	pipelinePath, pipeline, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Profile: flags.profile.pointer()}, flags.secretsDir.pointer(), deps)
+	pipelinePath, pipeline, err := loadPipelineConfigWithDependencies(flags.pipelinePath, config.PipelineLoadOptions{Overlay: flags.overlay.pointer()}, flags.secretsDir.pointer(), deps)
 	if err != nil {
 		return nil, err
 	}
@@ -315,9 +315,9 @@ func inspectionRootPath(resolved *inspectionConfig) string {
 	return resolved.PipelinePath
 }
 
-func inspectionProfile(pipeline *config.PipelineConfig) string {
-	if profile, ok := config.SelectedPipelineProfile(pipeline); ok {
-		return profile.Name
+func inspectionOverlay(pipeline *config.PipelineConfig) string {
+	if overlay, ok := config.SelectedPipelineOverlay(pipeline); ok {
+		return overlay.Name
 	}
 	return "none"
 }
@@ -325,7 +325,7 @@ func inspectionProfile(pipeline *config.PipelineConfig) string {
 func writeConfigCommandUsage(out io.Writer) {
 	fmt.Fprintln(out, "Usage: narratio config <validate|show|sources|artifacts|diff>")
 	fmt.Fprintln(out)
-	fmt.Fprintln(out, "Use config validate to check an effective pipeline, config show to print normalized YAML, config sources to report ownership, config artifacts to list concrete artifacts, or config diff to compare two profiles.")
+	fmt.Fprintln(out, "Use config validate to check an effective pipeline, config show to print normalized YAML, config sources to report ownership, config artifacts to list concrete artifacts, or config diff to compare two overlays.")
 }
 
 func writeInspectionSourceHeader(out io.Writer, resolved *inspectionConfig) error {
@@ -343,11 +343,11 @@ func writeInspectionSourceHeader(out io.Writer, resolved *inspectionConfig) erro
 			return err
 		}
 	}
-	if profile, ok := config.SelectedPipelineProfile(resolved.Pipeline); ok {
-		if _, err := fmt.Fprintf(out, "profile: name=%s selection=%s overlay=%s\n", profile.Name, profile.Source, config.NormalizedConfigurationPath(profile.OverlayPath)); err != nil {
+	if overlay, ok := config.SelectedPipelineOverlay(resolved.Pipeline); ok {
+		if _, err := fmt.Fprintf(out, "overlay: name=%s selection=%s path=%s\n", overlay.Name, overlay.Source, config.NormalizedConfigurationPath(overlay.OverlayPath)); err != nil {
 			return err
 		}
-	} else if _, err := fmt.Fprintln(out, "profile: none"); err != nil {
+	} else if _, err := fmt.Fprintln(out, "overlay: none"); err != nil {
 		return err
 	}
 	if resolved.Campaign == nil {

internal/app/config_commands_test.go

@@ -34,6 +34,7 @@ func TestConfigCommandHelpAndDispatch(t *testing.T) {
 		{name: "stage flag", args: []string{"config", "show", "--from", "prepare"}, want: "flag provided but not defined", code: 1},
 		{name: "force flag", args: []string{"config", "show", "--force"}, want: "flag provided but not defined", code: 1},
 		{name: "artifact flag", args: []string{"config", "show", "--artifacts", "recap"}, want: "flag provided but not defined", code: 1},
+		{name: "retired selector", args: []string{"config", "validate", "--profile", "testing"}, want: "flag provided but not defined", code: 1},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			var stdout, stderr bytes.Buffer
@@ -102,7 +103,7 @@ whisperx:
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath}, &validateOut); err != nil {
 		t.Fatalf("ConfigValidate() error = %v", err)
 	}
-	if !strings.Contains(validateOut.String(), "Configuration valid: root=") || !strings.Contains(validateOut.String(), "; profile=none; digest=") {
+	if !strings.Contains(validateOut.String(), "Configuration valid: root=") || !strings.Contains(validateOut.String(), "; overlay=none; digest=") {
 		t.Fatalf("validate output = %q", validateOut.String())
 	}
 
@@ -127,7 +128,7 @@ whisperx:
 	if strings.Contains(sourcesOut.String(), secret) {
 		t.Fatalf("sources output leaked a raw secret: %q", sourcesOut.String())
 	}
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
 	var diffOut bytes.Buffer
 	if err := ConfigDiff(context.Background(), []string{"production", "testing", "--config", pipelinePath}, &diffOut); err != nil {
 		t.Fatalf("ConfigDiff() error = %v", err)
@@ -143,10 +144,10 @@ whisperx:
 	}
 }
 
-func TestConfigDiffReportsSemanticProfileChanges(t *testing.T) {
+func TestConfigDiffReportsSemanticOverlayChanges(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, _, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, `workspace:
+	writeInspectionOverlays(t, pipelinePath, `workspace:
   cleanup_after_publish: true
 publish:
   upload_run: true
@@ -203,7 +204,7 @@ scriptorium:
 		t.Fatalf("reversed ConfigDiff() error = %v", err)
 	}
 	if !strings.Contains(reversed.String(), "changed\twhisperx.language\t\"fr\"\t\"en\"\n") {
-		t.Fatalf("reversed diff did not independently resolve profiles:\n%s", reversed.String())
+		t.Fatalf("reversed diff did not independently resolve overlays:\n%s", reversed.String())
 	}
 }
 
@@ -219,7 +220,7 @@ audita:
 scriptorium:
   artifacts: null
 `)
-	mustWriteTestFile(t, filepath.Join(dir, "profiles", "empty.yml"), `audita:
+	mustWriteTestFile(t, filepath.Join(dir, "overlays", "empty.yml"), `audita:
   modules: []
 scriptorium:
   artifacts: {}
@@ -229,7 +230,7 @@ scriptorium:
 	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath}, &base); err != nil {
 		t.Fatal(err)
 	}
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "empty"}, &empty); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "empty"}, &empty); err != nil {
 		t.Fatal(err)
 	}
 	for _, want := range []string{"modules: null\n", "artifacts: null\n"} {
@@ -239,7 +240,7 @@ scriptorium:
 	}
 	for _, want := range []string{"modules: []\n", "artifacts: {}\n"} {
 		if !strings.Contains(empty.String(), want) {
-			t.Fatalf("empty-profile show output missing %q:\n%s", want, empty.String())
+			t.Fatalf("empty-overlay show output missing %q:\n%s", want, empty.String())
 		}
 	}
 
@@ -259,7 +260,7 @@ scriptorium:
 
 func TestConfigDiffComparesExpandedFamiliesAndPublishRules(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	writeInspectionProfiles(t, pipelinePath, `scriptorium:
+	writeInspectionOverlays(t, pipelinePath, `scriptorium:
   artifact_families:
     character_note:
       enabled: false
@@ -301,11 +302,11 @@ func TestConfigDiffComparesExpandedFamiliesAndPublishRules(t *testing.T) {
 func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: en\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: en\n")
 
 	var equal bytes.Buffer
 	if err := ConfigDiff(context.Background(), []string{"production", "testing", "--config", pipelinePath}, &equal); err != nil {
-		t.Fatalf("ConfigDiff() equal profiles error = %v", err)
+		t.Fatalf("ConfigDiff() equal overlays error = %v", err)
 	}
 	if got := equal.String(); got != "no differences\n" {
 		t.Fatalf("equal diff output = %q", got)
@@ -316,7 +317,7 @@ func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 		{"production", "--config", pipelinePath},
 		{"production", "production", "--config", pipelinePath},
 		{"unknown", "testing", "--config", pipelinePath},
-		{"production", "testing", "--config", pipelinePath, "--profile", "production"},
+		{"production", "testing", "--config", pipelinePath, "--overlay", "production"},
 		{"production", "testing", "--config", pipelinePath, "--config", pipelinePath},
 		{"production", "testing", "--config", pipelinePath, "--campaign", "sample-campaign", "--campaign-file", campaignPath},
 	} {
@@ -326,10 +327,10 @@ func TestConfigDiffReportsEqualityAndRejectsInvalidInput(t *testing.T) {
 	}
 }
 
-func TestConfigDiffBootstrapsSecretsOnceForBothProfiles(t *testing.T) {
+func TestConfigDiffBootstrapsSecretsOnceForBothOverlays(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, _, _ := writeValidConfigFiles(t, workspaceRoot)
-	writeInspectionProfiles(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
+	writeInspectionOverlays(t, pipelinePath, "whisperx:\n  language: en\n", "whisperx:\n  language: fr\n")
 	secretsDir := t.TempDir()
 	const secretName = "NARRATIO_DIFF_BOOTSTRAP_REPORT"
 	restoreEnvAfterTest(t, secretName)
@@ -388,32 +389,32 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 `, 1)
 	pipelineYAML += `notarius:
   enabled: false
-  llm_api_key: NARRATIO_INSPECT_NOTARIUS_ONE
+  credentials: [NARRATIO_INSPECT_NOTARIUS_ONE]
 `
 	if err := os.WriteFile(pipelinePath, []byte(pipelineYAML), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	writeInspectionProfiles(t, pipelinePath,
-		"audita:\n  model: production\n  llm_api_key: NARRATIO_INSPECT_LLM_ONE\n",
-		"audita:\n  model: testing\n  llm_api_key: NARRATIO_INSPECT_LLM_TWO\nnotarius:\n  llm_api_key: NARRATIO_INSPECT_NOTARIUS_TWO\n",
+	writeInspectionOverlays(t, pipelinePath,
+		"audita:\n  proposal_profile: production\n  credentials: [NARRATIO_INSPECT_LLM_ONE]\n",
+		"audita:\n  proposal_profile: testing\n  credentials: [NARRATIO_INSPECT_LLM_TWO]\nnotarius:\n  credentials: [NARRATIO_INSPECT_NOTARIUS_TWO]\n",
 	)
-	mustWriteTestFile(t, filepath.Join(filepath.Dir(pipelinePath), "profiles", "without-notarius-key.yml"), "notarius:\n  llm_api_key: null\n")
+	mustWriteTestFile(t, filepath.Join(filepath.Dir(pipelinePath), "overlays", "without-notarius-key.yml"), "notarius:\n  credentials: []\n")
 
 	var validate bytes.Buffer
-	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &validate); err != nil {
+	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &validate); err != nil {
 		t.Fatalf("config validate: %v", err)
 	}
 
 	var show bytes.Buffer
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &show); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &show); err != nil {
 		t.Fatalf("config show: %v", err)
 	}
 	var sources bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &sources); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &sources); err != nil {
 		t.Fatalf("config sources: %v", err)
 	}
 	var catalog bytes.Buffer
-	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--profile", "production"}, &catalog); err != nil {
+	if err := ConfigArtifacts(context.Background(), []string{"--config", pipelinePath, "--overlay", "production"}, &catalog); err != nil {
 		t.Fatalf("config artifacts: %v", err)
 	}
 	var diff bytes.Buffer
@@ -421,7 +422,7 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 		t.Fatalf("config diff: %v", err)
 	}
 	var removed bytes.Buffer
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "without-notarius-key"}, &removed); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "without-notarius-key"}, &removed); err != nil {
 		t.Fatalf("config show with removed Notarius credential: %v", err)
 	}
 	for label, output := range map[string]string{"show": show.String(), "sources": sources.String(), "artifacts": catalog.String(), "diff": diff.String()} {
@@ -438,11 +439,11 @@ func TestConfigInspectionOutputsNeverExposeResolvedCredentialValues(t *testing.T
 		!strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") || !strings.Contains(diff.String(), "NARRATIO_INSPECT_NOTARIUS_TWO") {
 		t.Fatalf("diff omitted safe credential references: %q", diff.String())
 	}
-	if !strings.Contains(sources.String(), "notarius.llm_api_key") {
+	if !strings.Contains(sources.String(), "notarius.credentials") {
 		t.Fatalf("sources omitted Notarius credential ownership: %q", sources.String())
 	}
-	if strings.Contains(removed.String(), "llm_api_key") || strings.Contains(removed.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") {
-		t.Fatalf("profile null did not remove Notarius credential: %q", removed.String())
+	if strings.Contains(removed.String(), "NARRATIO_INSPECT_NOTARIUS_ONE") {
+		t.Fatalf("empty overlay did not remove Notarius credential: %q", removed.String())
 	}
 }
 
@@ -450,7 +451,7 @@ func TestConfigValidateRejectsUnavailableNotariusCredential(t *testing.T) {
 	const envName = "NARRATIO_INSPECT_NOTARIUS_MISSING"
 	restoreEnvAfterTest(t, envName)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	mustWriteTestFile(t, path, "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n")
+	mustWriteTestFile(t, path, "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n")
 	err := ConfigValidate(context.Background(), []string{"--config", path}, io.Discard)
 	if err == nil || !strings.Contains(err.Error(), "secret.unset") {
 		t.Fatalf("ConfigValidate() error = %v, want unavailable credential failure", err)
@@ -475,36 +476,36 @@ func TestConfigCommandsInspectMaintainedSplitBundleWithoutRuntimeState(t *testin
 	if err := ConfigDiff(context.Background(), []string{"default", "testing", "--config", pipelinePath, "--campaign-file", campaignPath}, &diff); err != nil {
 		t.Fatalf("ConfigDiff() error = %v", err)
 	}
-	if !strings.Contains(diff.String(), "audita.model") {
-		t.Fatalf("split bundle profile diff = %q, want model change", diff.String())
+	if !strings.Contains(diff.String(), "audita.proposal_profile") {
+		t.Fatalf("split bundle overlay diff = %q, want proposal profile change", diff.String())
 	}
 	if _, err := os.Stat(workspacePath); !os.IsNotExist(err) {
 		t.Fatalf("inspection created example workspace: %v", err)
 	}
 }
 
-func writeInspectionProfiles(t *testing.T, pipelinePath, production, testing string) {
+func writeInspectionOverlays(t *testing.T, pipelinePath, production, testing string) {
 	t.Helper()
-	profilesDir := filepath.Join(filepath.Dir(pipelinePath), "profiles")
-	mustWriteTestFile(t, filepath.Join(profilesDir, "production.yml"), production)
-	mustWriteTestFile(t, filepath.Join(profilesDir, "testing.yml"), testing)
+	overlaysDir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
+	mustWriteTestFile(t, filepath.Join(overlaysDir, "production.yml"), production)
+	mustWriteTestFile(t, filepath.Join(overlaysDir, "testing.yml"), testing)
 }
 
-func TestConfigCommandsSelectProfilesAndCampaigns(t *testing.T) {
+func TestConfigCommandsSelectOverlaysAndCampaigns(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
 	var defaultOut bytes.Buffer
 	if err := ConfigValidate(context.Background(), []string{"--config", pipelinePath}, &defaultOut); err != nil {
 		t.Fatalf("default ConfigValidate() error = %v", err)
 	}
-	if !strings.Contains(defaultOut.String(), "profile=none") {
+	if !strings.Contains(defaultOut.String(), "overlay=none") {
 		t.Fatalf("default output = %q", defaultOut.String())
 	}
 
 	var explicitOut bytes.Buffer
-	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &explicitOut); err != nil {
+	if err := ConfigShow(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &explicitOut); err != nil {
 		t.Fatalf("explicit ConfigShow() error = %v", err)
 	}
 	if !strings.Contains(explicitOut.String(), "language: fr") {
@@ -589,9 +590,9 @@ whisperx:
 func TestConfigSourcesReportsStableOwnership(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, _ := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
-	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}
+	args := []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}
 	var first, second bytes.Buffer
 	if err := ConfigSources(context.Background(), args, &first); err != nil {
 		t.Fatalf("first ConfigSources() error = %v", err)
@@ -606,13 +607,13 @@ func TestConfigSourcesReportsStableOwnership(t *testing.T) {
 	for _, want := range []string{
 		"root: ",
 		"imports: none",
-		"profile: name=testing selection=explicit overlay=",
+		"overlay: name=testing selection=explicit path=",
 		"campaign: id=sample-campaign source=",
 		"party: source=",
 		"digest: ",
 		"path\trole\tsource\n",
 		"workspace.root\troot\t",
-		"whisperx.language\tprofile\t",
+		"whisperx.language\toverlay\t",
 		"derived.players\tparty\t",
 		"trim.enabled\tdefault\tdefault",
 	} {
@@ -647,10 +648,10 @@ func TestConfigSourcesReportsCanonicalFamilyAndPublishOrigins(t *testing.T) {
 	}
 }
 
-func TestConfigSourcesPreservesProfileOwnershipThroughFamilyExpansion(t *testing.T) {
+func TestConfigSourcesPreservesOverlayOwnershipThroughFamilyExpansion(t *testing.T) {
 	pipelinePath, campaignPath := writeInspectionFamilyConfig(t)
-	profilePath := filepath.Join(filepath.Dir(pipelinePath), "profiles", "testing.yml")
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	overlayPath := filepath.Join(filepath.Dir(pipelinePath), "overlays", "testing.yml")
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifact_families:
     character_note:
       enabled: true
@@ -658,12 +659,12 @@ func TestConfigSourcesPreservesProfileOwnershipThroughFamilyExpansion(t *testing
 `)
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--campaign-file", campaignPath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatalf("ConfigSources() error = %v", err)
 	}
-	want := "scriptorium.artifacts.character_note_arannis.enabled\tfamily\t" + profilePath
+	want := "scriptorium.artifacts.character_note_arannis.enabled\tfamily\t" + overlayPath
 	if !strings.Contains(out.String(), want) {
-		t.Fatalf("sources output missing profile-generated ownership %q:\n%s", want, out.String())
+		t.Fatalf("sources output missing overlay-generated ownership %q:\n%s", want, out.String())
 	}
 }
 
@@ -671,7 +672,7 @@ func TestConfigSourcesAttributesInferredArtifactDependencies(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "pipeline.yml")
 	inputPath := filepath.Join(dir, "input-only.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, pipelinePath, `configkit:
   imports:
     - path: input-only.yml
@@ -701,7 +702,7 @@ scriptorium:
         prior:
           source: narratio.artifact.first
 `)
-	mustWriteTestFile(t, profilePath, `scriptorium:
+	mustWriteTestFile(t, overlayPath, `scriptorium:
   artifacts:
     mixed:
       inputs:
@@ -710,13 +711,13 @@ scriptorium:
 `)
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", pipelinePath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatal(err)
 	}
 	for _, want := range []string{
 		"scriptorium.artifacts.input_only.depends_on\timport\t" + inputPath,
 		"scriptorium.artifacts.mixed.depends_on\troot\t" + pipelinePath,
-		"scriptorium.artifacts.mixed.depends_on\tprofile\t" + profilePath,
+		"scriptorium.artifacts.mixed.depends_on\toverlay\t" + overlayPath,
 	} {
 		if !strings.Contains(out.String(), want) {
 			t.Fatalf("sources output missing dependency contributor %q:\n%s", want, out.String())
@@ -727,11 +728,11 @@ scriptorium:
 	}
 }
 
-func TestConfigSourcesReportsRootImportProfileAndDefaultOwnership(t *testing.T) {
+func TestConfigSourcesReportsRootImportOverlayAndDefaultOwnership(t *testing.T) {
 	dir := t.TempDir()
 	rootPath := filepath.Join(dir, "pipeline.yml")
 	importPath := filepath.Join(dir, "base.yml")
-	profilePath := filepath.Join(dir, "profiles", "testing.yml")
+	overlayPath := filepath.Join(dir, "overlays", "testing.yml")
 	mustWriteTestFile(t, rootPath, `configkit:
   imports:
     - path: base.yml
@@ -741,19 +742,19 @@ whisperx:
   transcribe_url: https://transcription.example.com/transcribe
 `)
 	mustWriteTestFile(t, importPath, "storage:\n  backend: local\n")
-	mustWriteTestFile(t, profilePath, "whisperx:\n  language: fr\n")
+	mustWriteTestFile(t, overlayPath, "whisperx:\n  language: fr\n")
 
 	var out bytes.Buffer
-	if err := ConfigSources(context.Background(), []string{"--config", rootPath, "--profile", "testing"}, &out); err != nil {
+	if err := ConfigSources(context.Background(), []string{"--config", rootPath, "--overlay", "testing"}, &out); err != nil {
 		t.Fatalf("ConfigSources() error = %v", err)
 	}
 	output := out.String()
 	for _, want := range []string{
 		"import: " + importPath,
-		"profile: name=testing selection=explicit overlay=" + profilePath,
+		"overlay: name=testing selection=explicit path=" + overlayPath,
 		"workspace.root\troot\t" + rootPath,
 		"storage.backend\timport\t" + importPath,
-		"whisperx.language\tprofile\t" + profilePath,
+		"whisperx.language\toverlay\t" + overlayPath,
 		"trim.enabled\tdefault\tdefault",
 	} {
 		if !strings.Contains(output, want) {

internal/app/config_diff.go

@@ -20,8 +20,8 @@ type configDiffFlags struct {
 }
 
 type configDiffRequest struct {
-	leftProfile  string
-	rightProfile string
+	leftOverlay  string
+	rightOverlay string
 	flags        configDiffFlags
 }
 
@@ -37,7 +37,7 @@ type configDiffRecord struct {
 	Right string
 }
 
-// ConfigDiff compares two explicitly selected profiles through the same
+// ConfigDiff compares two explicitly selected overlays through the same
 // read-only configuration resolution boundary used by config validate, show,
 // and sources. Differences describe normalized effective values rather than
 // the layout of root, import, or overlay files.
@@ -100,7 +100,7 @@ func configDiffWithDependencies(_ context.Context, args []string, out io.Writer,
 }
 
 func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, error) {
-	profiles, flagArgs := splitConfigDiffArguments(args)
+	overlays, flagArgs := splitConfigDiffArguments(args)
 	fs := flag.NewFlagSet("config diff", flag.ContinueOnError)
 	fs.SetOutput(out)
 	var request configDiffRequest
@@ -113,9 +113,9 @@ func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, er
 	fs.Var(&request.flags.campaignFilePath, "campaign-file", "path to campaign.yml")
 	fs.Var(&request.flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.Usage = func() {
-		fmt.Fprintln(out, "Usage: narratio config diff <left-profile> <right-profile> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <path>]")
+		fmt.Fprintln(out, "Usage: narratio config diff <left-overlay> <right-overlay> [--config <pipeline.yml>] [--campaign <id> | --campaign-file <campaign.yml>] [--secrets-dir <path>]")
 		fmt.Fprintln(out)
-		fmt.Fprintln(out, "Compares fully resolved profiles without a session, workspace, manifest, adapters, or external services.")
+		fmt.Fprintln(out, "Compares fully resolved overlays without a session, workspace, manifest, adapters, or external services.")
 		fmt.Fprintln(out)
 		fmt.Fprintln(out, "Flags:")
 		fs.PrintDefaults()
@@ -123,30 +123,30 @@ func parseConfigDiffRequest(args []string, out io.Writer) (configDiffRequest, er
 	if err := fs.Parse(flagArgs); err != nil {
 		return configDiffRequest{}, fmt.Errorf("config diff: invalid flags: %w", err)
 	}
-	profiles = append(profiles, fs.Args()...)
-	if len(profiles) != 2 || strings.TrimSpace(profiles[0]) == "" || strings.TrimSpace(profiles[1]) == "" {
-		return configDiffRequest{}, fmt.Errorf("config diff: exactly two non-empty profile names are required")
+	overlays = append(overlays, fs.Args()...)
+	if len(overlays) != 2 || strings.TrimSpace(overlays[0]) == "" || strings.TrimSpace(overlays[1]) == "" {
+		return configDiffRequest{}, fmt.Errorf("config diff: exactly two non-empty overlay names are required")
 	}
-	if profiles[0] == profiles[1] {
-		return configDiffRequest{}, fmt.Errorf("config diff: profile names must differ")
+	if overlays[0] == overlays[1] {
+		return configDiffRequest{}, fmt.Errorf("config diff: overlay names must differ")
 	}
 	if request.flags.campaignPath.set && request.flags.campaignFilePath.set {
 		return configDiffRequest{}, fmt.Errorf("config diff: --campaign and --campaign-file are mutually exclusive")
 	}
-	request.leftProfile = profiles[0]
-	request.rightProfile = profiles[1]
+	request.leftOverlay = overlays[0]
+	request.rightOverlay = overlays[1]
 	return request, nil
 }
 
 // splitConfigDiffArguments accepts the documented positional-first syntax and
-// also permits flags before or between profile names. Values belonging to the
+// also permits flags before or between overlay names. Values belonging to the
 // supported string flags stay with their flag so they are not mistaken for
-// profile names.
-func splitConfigDiffArguments(args []string) (profiles, flagArgs []string) {
+// overlay names.
+func splitConfigDiffArguments(args []string) (overlays, flagArgs []string) {
 	for index := 0; index < len(args); index++ {
 		argument := args[index]
 		if !strings.HasPrefix(argument, "-") || argument == "-" {
-			profiles = append(profiles, argument)
+			overlays = append(overlays, argument)
 			continue
 		}
 		flagArgs = append(flagArgs, argument)
@@ -161,12 +161,12 @@ func splitConfigDiffArguments(args []string) (profiles, flagArgs []string) {
 		index++
 		flagArgs = append(flagArgs, args[index])
 	}
-	return profiles, flagArgs
+	return overlays, flagArgs
 }
 
 func configDiffStringFlag(name string) bool {
 	switch name {
-	case "config", "campaign", "campaign-file", "profile", "secrets-dir":
+	case "config", "campaign", "campaign-file", "secrets-dir":
 		return true
 	default:
 		return false
@@ -175,13 +175,13 @@ func configDiffStringFlag(name string) bool {
 
 func resolveConfigDiff(request configDiffRequest, deps commandDependencies) (*configDiffResolved, error) {
 	deps = normalizeCommandDependencies(deps)
-	pipelinePath, leftPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Profile: &request.leftProfile}, request.flags.secretsDir.pointer(), deps)
+	pipelinePath, leftPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Overlay: &request.leftOverlay}, request.flags.secretsDir.pointer(), deps)
 	if err != nil {
-		return nil, fmt.Errorf("load left pipeline profile: %w", err)
+		return nil, fmt.Errorf("load left pipeline overlay: %w", err)
 	}
-	_, rightPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Profile: &request.rightProfile}, request.flags.secretsDir.pointer(), deps)
+	_, rightPipeline, err := loadPipelineConfigWithDependencies(request.flags.pipelinePath.value, config.PipelineLoadOptions{Overlay: &request.rightOverlay}, request.flags.secretsDir.pointer(), deps)
 	if err != nil {
-		return nil, fmt.Errorf("load right pipeline profile: %w", err)
+		return nil, fmt.Errorf("load right pipeline overlay: %w", err)
 	}
 	needsCampaign := pipelineHasArtifactFamilies(leftPipeline) || pipelineHasArtifactFamilies(rightPipeline)
 	hasCampaignSelection := request.flags.campaignPath.set || request.flags.campaignFilePath.set
@@ -259,7 +259,7 @@ func resolveSharedDiffCampaignPath(left, right *config.PipelineConfig, flags con
 		return "", rightErr
 	}
 	if leftPath != rightPath {
-		return "", fmt.Errorf("profile selections resolve different campaign files; specify --campaign-file to compare one campaign")
+		return "", fmt.Errorf("overlay selections resolve different campaign files; specify --campaign-file to compare one campaign")
 	}
 	return leftPath, nil
 }

internal/app/config_loader.go

@@ -46,7 +46,7 @@ func loadCommandConfigWithDependencies(ctx context.Context, pipelineFlag, campai
 		}
 	}()
 
-	base, err := loadPipelineCampaignConfigWithDependencies(pipelineFlag, campaignFlag, campaignFileFlag, config.PipelineLoadOptions{Profile: sessionOpts.Profile}, secretsDir, deps)
+	base, err := loadPipelineCampaignConfigWithDependencies(pipelineFlag, campaignFlag, campaignFileFlag, config.PipelineLoadOptions{Overlay: sessionOpts.Overlay}, secretsDir, deps)
 	if err != nil {
 		return nil, err
 	}

internal/app/config_provenance.go

@@ -14,13 +14,13 @@ func effectiveConfigProvenance(cfg *config.Config) *manifest.EffectiveConfigProv
 	provenance := &manifest.EffectiveConfigProvenance{
 		EffectiveConfigDigest: config.EffectivePipelineDigest(cfg.Pipeline),
 	}
-	if selected, ok := config.SelectedPipelineProfile(cfg.Pipeline); ok {
-		provenance.SelectedProfile = &manifest.SelectedProfileProvenance{
+	if selected, ok := config.SelectedPipelineOverlay(cfg.Pipeline); ok {
+		provenance.SelectedOverlay = &manifest.SelectedOverlayProvenance{
 			Name:   selected.Name,
 			Source: selected.Source,
 		}
 	}
-	if provenance.SelectedProfile == nil && provenance.EffectiveConfigDigest == "" {
+	if provenance.SelectedOverlay == nil && provenance.EffectiveConfigDigest == "" {
 		return nil
 	}
 	return provenance
@@ -35,30 +35,30 @@ func applyEffectiveConfigProvenance(m *manifest.Manifest, cfg *config.Config) {
 func effectiveConfigSummary(cfg *config.Config) string {
 	provenance := effectiveConfigProvenance(cfg)
 	if provenance == nil {
-		return "profile=none digest=unavailable"
+		return "overlay=none digest=unavailable"
 	}
-	profile := "none"
-	if provenance.SelectedProfile != nil {
-		profile = provenance.SelectedProfile.Name + " (" + provenance.SelectedProfile.Source + ")"
+	overlay := "none"
+	if provenance.SelectedOverlay != nil {
+		overlay = provenance.SelectedOverlay.Name + " (" + provenance.SelectedOverlay.Source + ")"
 	}
 	digest := provenance.EffectiveConfigDigest
 	if digest == "" {
 		digest = "unavailable"
 	}
-	return fmt.Sprintf("profile=%s digest=%s", profile, digest)
+	return fmt.Sprintf("overlay=%s digest=%s", overlay, digest)
 }
 
 func persistedEffectiveConfigSummary(provenance *manifest.EffectiveConfigProvenance) string {
 	if provenance == nil {
-		return "profile=none digest=unavailable"
+		return "overlay=none digest=unavailable"
 	}
-	profile := "none"
-	if provenance.SelectedProfile != nil {
-		profile = provenance.SelectedProfile.Name + " (" + provenance.SelectedProfile.Source + ")"
+	overlay := "none"
+	if provenance.SelectedOverlay != nil {
+		overlay = provenance.SelectedOverlay.Name + " (" + provenance.SelectedOverlay.Source + ")"
 	}
 	digest := provenance.EffectiveConfigDigest
 	if digest == "" {
 		digest = "unavailable"
 	}
-	return fmt.Sprintf("profile=%s digest=%s", profile, digest)
+	return fmt.Sprintf("overlay=%s digest=%s", overlay, digest)
 }

internal/app/extract_lifecycle_test.go

@@ -665,16 +665,16 @@ func TestExtractLifecycleCredentialChangesRemainResumable(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			cfg, env, runner := extractionLifecycleFixture(t, true)
 			if test.before != nil {
-				cfg.Pipeline.Notarius.LLMAPIKey = test.before(t)
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.before(t)}
 			}
 			analyzeRuns := 0
 			plan := extractionLifecyclePlan(t, &analyzeRuns)
 			if _, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env}); err != nil {
 				t.Fatalf("initial executeStages() error = %v", err)
 			}
-			cfg.Pipeline.Notarius.LLMAPIKey = nil
+			cfg.Pipeline.Notarius.Credentials = nil
 			if test.after != nil {
-				cfg.Pipeline.Notarius.LLMAPIKey = test.after(t)
+				cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*test.after(t)}
 			}
 			resumed, err := executeStages(context.Background(), cfg, plan, RunOptions{Env: env})
 			if err != nil {
@@ -817,7 +817,7 @@ func TestExtractLifecycleRealConfigProfilesSelectNotariusExplicitly(t *testing.T
 	if err := os.WriteFile(filepath.Join(filepath.Dir(pipelinePath), "notarius.yml"), []byte("pipelines: {}\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	profilesDir := filepath.Join(filepath.Dir(pipelinePath), "profiles")
+	profilesDir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
 	if err := os.MkdirAll(profilesDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
@@ -832,7 +832,7 @@ func TestExtractLifecycleRealConfigProfilesSelectNotariusExplicitly(t *testing.T
 	}
 	load := func(profile string) *config.Config {
 		t.Helper()
-		loaded, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{Profile: &profile})
+		loaded, err := config.LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath, config.SessionLoadOptions{Overlay: &profile})
 		if err != nil {
 			t.Fatalf("load profile %q: %v", profile, err)
 		}
@@ -876,7 +876,7 @@ func TestPreparedPipelineAndManifestExcludeNotariusCredentialValue(t *testing.T)
 	const name = "NARRATIO_LIFECYCLE_PERSISTED_KEY"
 	const canary = "notarius-persisted-credential-canary"
 	cfg, env, _ := extractionLifecycleFixture(t, true)
-	cfg.Pipeline.Notarius.LLMAPIKey = loadLifecycleNotariusCredential(t, name, canary)
+	cfg.Pipeline.Notarius.Credentials = []configkit.Secret{*loadLifecycleNotariusCredential(t, name, canary)}
 	if _, err := executeStages(context.Background(), cfg, prepareExtractLifecyclePlan(t), RunOptions{Env: env}); err != nil {
 		t.Fatalf("executeStages() error = %v", err)
 	}
@@ -1181,12 +1181,12 @@ func loadLifecycleNotariusCredential(t *testing.T, name, value string) *configki
 	t.Helper()
 	t.Setenv(name, value)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+name+"\n"), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+name+"]\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	pipeline, err := config.LoadPipeline(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return pipeline.Notarius.LLMAPIKey
+	return &pipeline.Notarius.Credentials[0]
 }

internal/app/operator_helpers.go

@@ -23,7 +23,7 @@ type commonConfigFlags struct {
 	sessionPath       string
 	sessionID         string
 	previousSessionID string
-	profile           singletonStringFlag
+	overlay           singletonStringFlag
 	secretsDir        singletonStringFlag
 }
 
@@ -34,8 +34,8 @@ func addCommonConfigFlags(fs *flag.FlagSet, flags *commonConfigFlags) {
 	fs.StringVar(&flags.sessionPath, "session", "", "path to session.yml")
 	fs.StringVar(&flags.sessionID, "session-id", "", "session identifier")
 	fs.StringVar(&flags.previousSessionID, "previous-session-id", "", "expected previous session identifier")
-	flags.profile.name = "profile"
-	fs.Var(&flags.profile, "profile", "named pipeline profile")
+	flags.overlay.name = "overlay"
+	fs.Var(&flags.overlay, "overlay", "named pipeline overlay")
 	flags.secretsDir.name = "secrets-dir"
 	fs.Var(&flags.secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 }
@@ -44,7 +44,7 @@ func (f commonConfigFlags) sessionOptions() config.SessionLoadOptions {
 	return config.SessionLoadOptions{
 		SessionID:         f.sessionID,
 		PreviousSessionID: f.previousSessionID,
-		Profile:           f.profile.pointer(),
+		Overlay:           f.overlay.pointer(),
 	}
 }
 

internal/app/operator_session_init.go

@@ -27,7 +27,7 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 	fs := flag.NewFlagSet("session init", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	var pipelinePath, campaignPath, campaignFilePath, sessionID, previousSessionID, date, title, output, audioS3Prefix, audioDir string
-	var profile singletonStringFlag
+	var overlay singletonStringFlag
 	var secretsDir singletonStringFlag
 	var remote, force bool
 	fs.StringVar(&pipelinePath, "config", "", "path to pipeline.yml (optional; defaults searched)")
@@ -40,8 +40,8 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 	fs.StringVar(&output, "output", "", "local output session.yml path")
 	fs.StringVar(&audioS3Prefix, "audio-s3-prefix", "", "session audio S3 prefix")
 	fs.StringVar(&audioDir, "audio-dir", "", "local audio directory")
-	profile.name = "profile"
-	fs.Var(&profile, "profile", "named pipeline profile")
+	overlay.name = "overlay"
+	fs.Var(&overlay, "overlay", "named pipeline overlay")
 	secretsDir.name = "secrets-dir"
 	fs.Var(&secretsDir, "secrets-dir", "secrets directory (optional; defaults beside pipeline.yml)")
 	fs.BoolVar(&remote, "remote", false, "write session.yml to S3 session prefix")
@@ -59,7 +59,7 @@ func sessionInitWithDependencies(ctx context.Context, args []string, out io.Writ
 		return fmt.Errorf("session init: --audio-dir and --audio-s3-prefix are mutually exclusive")
 	}
 
-	base, err := loadPipelineCampaignConfigWithDependencies(pipelinePath, campaignPath, campaignFilePath, config.PipelineLoadOptions{Profile: profile.pointer()}, secretsDir.pointer(), deps)
+	base, err := loadPipelineCampaignConfigWithDependencies(pipelinePath, campaignPath, campaignFilePath, config.PipelineLoadOptions{Overlay: overlay.pointer()}, secretsDir.pointer(), deps)
 	if err != nil {
 		return fmt.Errorf("session init: %w", err)
 	}

internal/app/overlay_commands_test.go

@@ -11,10 +11,10 @@ import (
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 
-func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
+func TestRunOverlaySelectionFlowsThroughSharedLoader(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFiles(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 
 	var language string
 	executor := func(_ context.Context, cfg *config.Config, _ BoundedPlan, _ RunOptions) (*RunSummary, error) {
@@ -23,12 +23,17 @@ func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
-		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "testing",
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", "testing",
 	}, io.Discard, executor); err != nil {
 		t.Fatal(err)
 	}
 	if language != "fr" {
-		t.Fatalf("explicit profile language = %q, want fr", language)
+		t.Fatalf("explicit overlay language = %q, want fr", language)
+	}
+	if err := runWithPipelineExecutor(context.Background(), []string{
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "testing",
+	}, io.Discard, executor); err == nil {
+		t.Fatal("retired pipeline selector was accepted")
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
@@ -40,25 +45,25 @@ func TestRunProfileSelectionFlowsThroughSharedLoader(t *testing.T) {
 		t.Fatalf("base configuration language = %q, want en", language)
 	}
 
-	for _, profile := range []string{"unknown"} {
+	for _, overlay := range []string{"unknown"} {
 		err := runWithPipelineExecutor(context.Background(), []string{
-			"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", profile,
+			"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", overlay,
 		}, io.Discard, executor)
-		if err == nil || !strings.Contains(err.Error(), "profile") {
-			t.Fatalf("profile %q error = %v, want selection rejection", profile, err)
+		if err == nil || !strings.Contains(err.Error(), "overlay") {
+			t.Fatalf("overlay %q error = %v, want selection rejection", overlay, err)
 		}
 	}
 
 	if err := runWithPipelineExecutor(context.Background(), []string{
-		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--profile", "",
+		"2026-05-03", "--config", pipelinePath, "--campaign-file", campaignPath, "--session", sessionPath, "--overlay", "",
 	}, io.Discard, executor); err != nil {
-		t.Fatalf("explicit empty profile should select base: %v", err)
+		t.Fatalf("explicit empty overlay should select base: %v", err)
 	}
 }
 
-func enableCommandTestProfiles(t *testing.T, pipelinePath string) {
+func enableCommandTestOverlays(t *testing.T, pipelinePath string) {
 	t.Helper()
-	dir := filepath.Join(filepath.Dir(pipelinePath), "profiles")
+	dir := filepath.Join(filepath.Dir(pipelinePath), "overlays")
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}

internal/app/provider_credentials_integration_test.go

@@ -0,0 +1,244 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
+	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
+)
+
+const (
+	sharedProviderName = "NARRATIO_SHARED_PROVIDER_KEY"
+	auditaOnlyName     = "NARRATIO_AUDITA_ONLY_KEY"
+	sharedProviderKey  = "synthetic-shared-provider-value"
+	auditaOnlyKey      = "synthetic-audita-only-value"
+)
+
+func TestCommandsShareProviderCredentialAcrossAdapters(t *testing.T) {
+	configDir := t.TempDir()
+	workspace := t.TempDir()
+	secretsDir := filepath.Join(configDir, "secrets")
+	for name, value := range map[string]string{
+		sharedProviderName: sharedProviderKey,
+		auditaOnlyName:     auditaOnlyKey,
+	} {
+		restoreEnvAfterTest(t, name)
+		if err := os.Unsetenv(name); err != nil {
+			t.Fatal(err)
+		}
+		mustWriteSecretFile(t, filepath.Join(secretsDir, name), value+"\n")
+	}
+	fixture := writeProviderProcessWrapper(t)
+	seriatim := writeSeriatimAppTestWrapper(t)
+	configPath := filepath.Join(configDir, "pipeline.yml")
+	campaignPath := writeAppTestCampaignConfig(t, configDir)
+	sessionPath := filepath.Join(configDir, "session.yml")
+	notariusConfig := filepath.Join(configDir, "notarius.yml")
+	mustWriteTestFile(t, notariusConfig, "pipelines: {}\n")
+	mustWriteTestFile(t, configPath, `workspace:
+  root: `+workspace+`
+storage:
+  backend: local
+whisperx:
+  transcribe_url: https://example.com/transcribe
+seriatim:
+  binary: `+seriatim+`
+audita:
+  binary: `+fixture+`
+  credentials: [`+sharedProviderName+`, `+auditaOnlyName+`]
+notarius:
+  enabled: true
+  binary: `+fixture+`
+  config_path: `+notariusConfig+`
+  pipeline_id: dnd-session
+  credentials: [`+sharedProviderName+`]
+  outputs:
+    npc_registry:
+      lane_id: npc-registry
+      media_type: application/json
+      schema_id: notarius.dnd.npc_registry
+      schema_version: v1
+      module_key: dnd/npc-registry
+notification:
+  mode: noop
+`)
+	mustWriteTestFile(t, sessionPath, `session_id: 2026-05-03
+campaign: sample-campaign
+inputs:
+  audio_dir: ./audio
+  speakers_file: ./speakers.yml
+  autocorrect_file: ./autocorrect.yml
+  glossary_file: ./glossary.yml
+`)
+
+	var stdout, stderr bytes.Buffer
+	if code := Execute([]string{"config", "show", "--config", configPath}, &stdout, &stderr); code != 0 {
+		t.Fatalf("config show exit = %d; stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), sharedProviderName) || !strings.Contains(stdout.String(), auditaOnlyName) {
+		t.Fatalf("config show omitted reference names: %q", stdout.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+
+	workRoot := filepath.Join(workspace, "work", "sample-campaign", "2026-05-03")
+	manifestPath := filepath.Join(workRoot, "manifest.json")
+	basePath := filepath.Join(workRoot, "transcripts", "base.json")
+	mustWriteTestFile(t, basePath, `{"schema":"seriatim-intermediate","segments":[]}`)
+	seedCurrentBuiltInEvidence(t, manifestPath, "2026-05-03", "sample-campaign", "merge", artifacts.TranscriptOutputKindBase, artifacts.ArtifactTranscriptBase, basePath)
+	mustWriteTestFile(t, filepath.Join(workRoot, "inputs", "glossary.yml"), "[]\n")
+	args := []string{"--config", configPath, "--campaign-file", campaignPath, "--session", sessionPath}
+	stdout.Reset()
+	stderr.Reset()
+	if code := Execute(append([]string{"run-stage", "polish", "2026-05-03", "--force"}, args...), &stdout, &stderr); code != 0 {
+		t.Fatalf("polish exit = %d; stderr=%q", code, stderr.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+	m, err := (&manifest.LocalStore{}).Load(context.Background(), manifestPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if polish := m.Stages["polish"]; polish == nil || len(polish.Outputs) != 1 || len(polish.Logs) != 5 {
+		t.Fatalf("polish did not retain canonical transcript and ordinary reports: %#v", polish)
+	}
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		found := false
+		for _, path := range m.Stages["polish"].Logs {
+			found = found || filepath.Base(path) == name
+		}
+		if !found {
+			t.Fatalf("missing polish report %q", name)
+		}
+	}
+
+	trimmedPath := filepath.Join(workRoot, "transcripts", "final.trimmed.json")
+	mustWriteTestFile(t, trimmedPath, `{"segments":[]}`)
+	setCurrentBuiltInEvidence(t, m, "trim", artifacts.TranscriptOutputKindFinalTrimmed, artifacts.ArtifactTranscriptFinalTrimmed, trimmedPath)
+	if err := (&manifest.LocalStore{}).Save(context.Background(), manifestPath, m); err != nil {
+		t.Fatal(err)
+	}
+	stdout.Reset()
+	stderr.Reset()
+	if code := Execute(append([]string{"run-stage", "extract", "2026-05-03", "--force"}, args...), &stdout, &stderr); code != 0 {
+		t.Fatalf("extract exit = %d; stderr=%q", code, stderr.String())
+	}
+	assertNoProviderValues(t, stdout.Bytes(), stderr.Bytes())
+	if !strings.Contains(stdout.String(), "stage=extract executed=1") {
+		t.Fatalf("extract did not execute: %q", stdout.String())
+	}
+	redactedLogs := 0
+	if err := filepath.WalkDir(workRoot, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil || entry.IsDir() {
+			return walkErr
+		}
+		data, err := os.ReadFile(path)
+		if err == nil {
+			assertNoProviderValues(t, data)
+			if strings.HasSuffix(path, ".stderr.log") && bytes.Contains(data, []byte("<redacted>")) {
+				redactedLogs++
+			}
+		}
+		return err
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if redactedLogs < 2 {
+		t.Fatalf("redacted subprocess logs = %d, want Audita and Notarius", redactedLogs)
+	}
+}
+
+func assertNoProviderValues(t *testing.T, content ...[]byte) {
+	t.Helper()
+	for _, data := range content {
+		if bytes.Contains(data, []byte(sharedProviderKey)) || bytes.Contains(data, []byte(auditaOnlyKey)) {
+			t.Fatal("credential value appeared in inspection or workspace output")
+		}
+	}
+}
+
+func writeProviderProcessWrapper(t *testing.T) string {
+	t.Helper()
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "provider-process.sh")
+	if err := os.WriteFile(path, []byte("#!/bin/sh\nexec \""+exe+"\" -test.run=TestProviderCredentialProcessFixture -- \"$@\"\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestProviderCredentialProcessFixture(t *testing.T) {
+	if !appHelperInvocation() {
+		return
+	}
+	start := -1
+	for i, arg := range os.Args {
+		if arg == "--" {
+			start = i + 1
+			break
+		}
+	}
+	if start < 0 || start >= len(os.Args) {
+		os.Exit(2)
+	}
+	args := os.Args[start:]
+	if os.Getenv(sharedProviderName) != sharedProviderKey {
+		_, _ = os.Stderr.WriteString("shared credential not forwarded\n")
+		os.Exit(2)
+	}
+	switch args[0] {
+	case "process":
+		if os.Getenv(auditaOnlyName) != auditaOnlyKey {
+			_, _ = os.Stderr.WriteString("Audita-only credential not forwarded\n")
+			os.Exit(2)
+		}
+		output := appSeriatimFlagValue(args, "--output")
+		if output == "" {
+			os.Exit(2)
+		}
+		if err := os.MkdirAll(filepath.Dir(output), 0o755); err != nil {
+			os.Exit(2)
+		}
+		if err := os.WriteFile(output, []byte(`{"schema":"audita.processed.v1","segments":[]}`), 0o644); err != nil {
+			os.Exit(2)
+		}
+		for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+			if err := os.WriteFile(filepath.Join(filepath.Dir(output), name), []byte("status: completed\n"), 0o644); err != nil {
+				os.Exit(2)
+			}
+		}
+	case "run":
+		if _, present := os.LookupEnv(auditaOnlyName); present {
+			_, _ = os.Stderr.WriteString("Audita-only credential reached Notarius\n")
+			os.Exit(2)
+		}
+		root := appSeriatimFlagValue(args, "--output-dir")
+		bundle := filepath.Join(root, "fixture-run")
+		if err := os.MkdirAll(filepath.Join(bundle, "lanes"), 0o755); err != nil {
+			os.Exit(2)
+		}
+		for name, value := range map[string]string{
+			"manifest.json": "{}", "rejected.json": `{"rejected":[]}`,
+			"warnings.json":    `{"schema_version":"notarius.warnings.v2","group_count":0,"occurrence_count":0,"groups":[]}`,
+			"diagnostics.json": `{"schema_version":"notarius.diagnostics.v1","group_count":0,"occurrence_count":0,"truncated":false,"unrepresented_occurrence_count":0,"groups":[]}`,
+			"lanes/npc.json":   `{"records":[]}`,
+			"index.json":       `{"manifest_file":"manifest.json","output_files":[{"lane_id":"npc-registry","file":"lanes/npc.json","media_type":"application/json","module_key":"dnd/npc-registry","schema_id":"notarius.dnd.npc_registry","schema_version":"v1"}],"rejected_file":"rejected.json","warnings_file":"warnings.json","diagnostics_file":"diagnostics.json"}`,
+		} {
+			if err := os.WriteFile(filepath.Join(bundle, filepath.FromSlash(name)), []byte(value), 0o644); err != nil {
+				os.Exit(2)
+			}
+		}
+		_, _ = os.Stdout.WriteString(fmt.Sprintf(`{"schema_version":"notarius.run-result.v2","run_id":"fixture-run","pipeline_id":"dnd-session","output_directory":%q,"index_file":"index.json","normalized_output_count":1,"rejected_output_count":0,"warning_group_count":0,"warning_occurrence_count":0,"diagnostic_group_count":0,"diagnostic_occurrence_count":0,"diagnostics_truncated":false,"validation_status":"approved"}`, bundle))
+	default:
+		os.Exit(2)
+	}
+	_, _ = os.Stderr.WriteString(sharedProviderKey + "\n")
+	os.Exit(0)
+}

internal/app/regenerate_artifacts_test.go

@@ -14,7 +14,7 @@ import (
 func TestRegenerateArtifactsForwardsCanonicalPipelineRequest(t *testing.T) {
 	workspaceRoot := t.TempDir()
 	pipelinePath, campaignPath, sessionPath := writeValidConfigFilesWithScriptoriumArtifacts(t, workspaceRoot)
-	enableCommandTestProfiles(t, pipelinePath)
+	enableCommandTestOverlays(t, pipelinePath)
 	var capturedPlan BoundedPlan
 	var capturedOptions RunOptions
 	executor := func(_ context.Context, cfg *config.Config, plan BoundedPlan, options RunOptions) (*RunSummary, error) {
@@ -30,7 +30,7 @@ func TestRegenerateArtifactsForwardsCanonicalPipelineRequest(t *testing.T) {
 		"--config", pipelinePath,
 		"--campaign-file", campaignPath,
 		"--session", sessionPath,
-		"--profile", "testing",
+		"--overlay", "testing",
 	}, io.Discard, io.Discard, executor)
 	if code != 0 {
 		t.Fatalf("executeWithPipelineExecutor() code = %d, want 0", code)

internal/app/restore_commit_test.go

@@ -44,6 +44,28 @@ func TestCommittedRestorePlanUsesOnlyDeclaredObjects(t *testing.T) {
 	}
 }
 
+func TestCommittedRestoreDoesNotRequirePolishRunDiagnostics(t *testing.T) {
+	cfg := restorePlanConfig(t)
+	fake := &storage.FakeBackend{}
+	current := seedCommittedRestoreSnapshot(t, cfg, fake, "20260519T010203Z-a1b2c3d4", map[string][]byte{
+		"transcripts/full.json": []byte(`{"segments":[]}`),
+	})
+	diagnostic := filepath.Join(cfg.Pipeline.Workspace.Root, "runs", current.RunID, "polish", "outputs", "transcripts", "errors.yml")
+	current.Manifest.Stages["polish"] = &manifest.StageRecord{
+		Name: "polish", Status: manifest.StatusSucceeded,
+		Logs: []string{diagnostic},
+	}
+	plan, err := buildRestorePlan(context.Background(), cfg, current, fake, RestorePlanOptions{})
+	if err != nil {
+		t.Fatalf("buildRestorePlan() error = %v", err)
+	}
+	for _, action := range plan.Actions {
+		if strings.Contains(action.LocalRelativePath, "errors.yml") {
+			t.Fatalf("diagnostic became a required restore target: %#v", action)
+		}
+	}
+}
+
 func TestCommittedRestoreDownloadsCarriedOutputFromDeclaredRun(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	fake := &storage.FakeBackend{}

internal/app/run_stage.go

@@ -80,7 +80,7 @@ func runStageWithDependencies(ctx context.Context, args []string, out io.Writer,
 		SessionPath:       flags.sessionPath,
 		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
-		Profile:           flags.profile.pointer(),
+		Overlay:           flags.overlay.pointer(),
 		SecretsDir:        flags.secretsDir.pointer(),
 		Force:             force,
 		SelectedArtifacts: normalizedArtifacts,
@@ -139,7 +139,7 @@ func analyzeWithDependencies(ctx context.Context, args []string, out io.Writer,
 		SessionPath:       flags.sessionPath,
 		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
-		Profile:           flags.profile.pointer(),
+		Overlay:           flags.overlay.pointer(),
 		SecretsDir:        flags.secretsDir.pointer(),
 		Force:             true,
 		SelectedArtifacts: normalizedArtifacts,
@@ -196,7 +196,7 @@ func publishWithDependencies(ctx context.Context, args []string, out io.Writer,
 		SessionPath:       flags.sessionPath,
 		SessionID:         flags.sessionID,
 		PreviousSessionID: flags.previousSessionID,
-		Profile:           flags.profile.pointer(),
+		Overlay:           flags.overlay.pointer(),
 		SecretsDir:        flags.secretsDir.pointer(),
 		Force:             true,
 		SelectedArtifacts: normalizedArtifacts,
@@ -224,7 +224,7 @@ type singleStageCommand struct {
 	SessionPath       string
 	SessionID         string
 	PreviousSessionID string
-	Profile           *string
+	Overlay           *string
 	SecretsDir        *string
 	Force             bool
 	SelectedArtifacts []string
@@ -240,7 +240,7 @@ func runSingleStageCommand(ctx context.Context, req singleStageCommand, executor
 	loaded, err := loadCommandConfigWithDependencies(ctx, req.PipelinePath, req.CampaignPath, req.CampaignFilePath, req.SessionPath, config.SessionLoadOptions{
 		SessionID:         req.SessionID,
 		PreviousSessionID: req.PreviousSessionID,
-		Profile:           req.Profile,
+		Overlay:           req.Overlay,
 	}, req.SecretsDir, deps)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", req.CommandName, err)

internal/app/runner.go

@@ -207,35 +207,18 @@ func buildDefaultAuditaRunner(cfg *config.Config) (audita.Runner, error) {
 		return &audita.NoopRunner{}, nil
 	}
 
-	report := false
-	if a.Report != nil {
-		report = *a.Report
+	timeout, err := time.ParseDuration(a.Timeout)
+	if err != nil {
+		return nil, fmt.Errorf("parse pipeline.audita.timeout %q: %w", a.Timeout, err)
 	}
-	llmAPIKey := ""
-	llmAPIKeyReference := ""
-	if a.LLMAPIKey != nil {
-		llmAPIKey = a.LLMAPIKey.Value()
-		llmAPIKeyReference = a.LLMAPIKey.EnvName()
-	}
-
-	runner, err := audita.NewSubprocessRunnerFromConfigValues(
-		a.Binary,
-		a.Timeout,
-		llmAPIKey,
-		llmAPIKeyReference,
-		append([]string(nil), a.Modules...),
-		a.BaseURL,
-		a.Model,
-		a.TranscriptDescription,
-		a.ConfigPath,
-		a.OutputSchema,
-		a.WorkDirRetention,
-		a.TotalLLMConcurrency,
-		a.ProposalLLMConcurrency,
-		a.ValidationModel,
-		a.ValidationLLMConcurrency,
-		report,
-	)
+	runner, err := audita.NewSubprocessRunner(audita.SubprocessRunnerConfig{
+		Binary: a.Binary, Timeout: timeout, Credentials: a.Credentials,
+		Modules: append(a.Modules[:0:0], a.Modules...),
+		Overlay: a.Overlay, ProposalProfile: a.ProposalProfile,
+		ValidationProfile:     a.ValidationProfile,
+		TranscriptDescription: a.TranscriptDescription, ConfigPath: a.ConfigPath,
+		OutputSchema: a.OutputSchema,
+	})
 	if err != nil {
 		return nil, fmt.Errorf("from pipeline.audita: %w", err)
 	}

internal/app/secrets_bootstrap_test.go

@@ -138,7 +138,7 @@ func TestNotariusCredentialLoadsFromCommandSecretBootstrap(t *testing.T) {
 			restoreEnvAfterTest(t, envName)
 			root := t.TempDir()
 			pipelinePath := filepath.Join(root, "pipeline.yml")
-			if err := os.WriteFile(pipelinePath, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n"), 0o644); err != nil {
+			if err := os.WriteFile(pipelinePath, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n"), 0o644); err != nil {
 				t.Fatal(err)
 			}
 			secretsDir := filepath.Join(root, "secrets")
@@ -158,8 +158,8 @@ func TestNotariusCredentialLoadsFromCommandSecretBootstrap(t *testing.T) {
 			if err != nil {
 				t.Fatalf("load pipeline: %v", err)
 			}
-			if pipeline.Notarius == nil || pipeline.Notarius.LLMAPIKey == nil || !pipeline.Notarius.LLMAPIKey.IsResolved() ||
-				pipeline.Notarius.LLMAPIKey.EnvName() != envName || pipeline.Notarius.LLMAPIKey.Value() != test.wantValue {
+			if pipeline.Notarius == nil || len(pipeline.Notarius.Credentials) != 1 || !pipeline.Notarius.Credentials[0].IsResolved() ||
+				pipeline.Notarius.Credentials[0].EnvName() != envName || pipeline.Notarius.Credentials[0].Value() != test.wantValue {
 				t.Fatal("Notarius credential did not resolve from the selected command bootstrap source")
 			}
 		})
@@ -220,7 +220,7 @@ func TestExecuteConfigValidateReportsSkippedEmptyBeforeTypedLoadFailure(t *testi
 	if err != nil {
 		t.Fatal(err)
 	}
-	pipelineYAML = append(pipelineYAML, []byte("notarius:\n  enabled: false\n  llm_api_key: "+name+"\n")...)
+	pipelineYAML = append(pipelineYAML, []byte("notarius:\n  enabled: false\n  credentials: ["+name+"]\n")...)
 	if err := os.WriteFile(pipelinePath, pipelineYAML, 0o644); err != nil {
 		t.Fatal(err)
 	}

internal/app/semantic_resume_test.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -364,8 +365,8 @@ func TestRefinementSemanticChangesRespectDependencyBranches(t *testing.T) {
 		wantRuns          [7]int
 		wantExtractStatus manifest.StageStatus
 	}{
-		{name: "polish model", mutate: func(cfg *config.Config) {
-			cfg.Pipeline.Audita.Model = "production"
+		{name: "polish description", mutate: func(cfg *config.Config) {
+			cfg.Pipeline.Audita.TranscriptDescription = "production"
 		}, wantRuns: [7]int{0, 0, 0, 1, 1, 1, 1}, wantExtractStatus: manifest.StatusStale},
 		{name: "normalize schema", mutate: func(cfg *config.Config) {
 			cfg.Pipeline.Normalize = &config.NormalizeConfig{OutputSchema: "seriatim.transcript.v2"}
@@ -424,6 +425,69 @@ func TestRefinementSemanticChangesRespectDependencyBranches(t *testing.T) {
 	}
 }
 
+func TestOldPolishSemanticEvidenceIsReconsideredOnlyWhenSelected(t *testing.T) {
+	cfg := testConfig(t)
+	names := []string{"prepare", "transcribe", "merge", "polish", "normalize", "trim", "render"}
+	seed := manifest.New(cfg.Session.SessionID, time.Now().UTC())
+	for _, candidate := range stage.All() {
+		seed.MarkStageSucceeded(candidate.Name(), time.Now().UTC(), nil)
+	}
+	providers := make([]stage.SemanticConfigFingerprinter, len(names))
+	runs := make([]int, len(names))
+	selected := make([]stage.Stage, 0, len(names))
+	for index, name := range names {
+		providers[index] = canonicalSemanticProvider(t, name)
+		fingerprint, err := providers[index].SemanticConfigFingerprint(&stage.Env{Config: cfg})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if name == "polish" {
+			fingerprint.Version--
+		}
+		seed.Stages[name].SemanticConfig = &fingerprint
+		selected = append(selected, semanticContractRunStub{name: name, provider: providers[index], runs: &runs[index]})
+	}
+	store := &manifest.LocalStore{}
+	if err := store.Save(context.Background(), manifestPathFor(cfg), seed); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := executeStages(context.Background(), cfg, selected[len(selected)-1:], RunOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if runs[3] != 0 {
+		t.Fatal("downstream-only execution invoked polish")
+	}
+	loaded, err := store.Load(context.Background(), manifestPathFor(cfg))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Stages["polish"].SemanticConfig.Version != seed.Stages["polish"].SemanticConfig.Version {
+		t.Fatal("downstream-only execution rewrote unselected polish evidence")
+	}
+	if _, err := executeStages(context.Background(), cfg, selected, RunOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if want := []int{0, 0, 0, 1, 1, 1, 1}; !reflect.DeepEqual(runs, want) {
+		t.Fatalf("runs = %v, want %v", runs, want)
+	}
+	loaded, err = store.Load(context.Background(), manifestPathFor(cfg))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.Stages["polish"].SemanticConfig.Version != 2 || loaded.Stages["extract"].Status != manifest.StatusStale {
+		t.Fatalf("old evidence was not replaced with normal dependent invalidation: polish=%#v extract=%#v", loaded.Stages["polish"], loaded.Stages["extract"])
+	}
+	for index := range runs {
+		runs[index] = 0
+	}
+	if _, err := executeStages(context.Background(), cfg, selected, RunOptions{}); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(runs, make([]int, len(names))) {
+		t.Fatalf("unchanged new evidence reran stages: %v", runs)
+	}
+}
+
 func TestDeliverySemanticChangesInvalidateOnlyTheirFixedDependents(t *testing.T) {
 	t.Run("extract contract", func(t *testing.T) {
 		cfg := testConfig(t)

internal/config/artifact_catalog.go

@@ -93,7 +93,7 @@ func declarationDefinitionSources(cfg *PipelineConfig, declaration configkit.Pat
 
 	seen := map[string]struct{}{}
 	for _, change := range cfg.resolution.configkitMetadata.History(declaration) {
-		if change.Origin.Layer != configkit.LayerBase && change.Origin.Layer != configkit.LayerProfile {
+		if change.Origin.Layer != configkit.LayerBase && change.Origin.Layer != configkit.LayerOverlay {
 			continue
 		}
 		for _, location := range change.Origin.Locations {

internal/config/config.go

@@ -165,21 +165,16 @@ type SeriatimEnvConfig struct {
 
 // AuditaConfig configures audita adapter settings.
 type AuditaConfig struct {
-	Binary                   string            `yaml:"binary" json:"binary"`
-	Timeout                  string            `yaml:"timeout" json:"timeout"`
-	LLMAPIKey                *configkit.Secret `yaml:"llm_api_key,omitempty" json:"llm_api_key,omitempty"`
-	Modules                  []string          `yaml:"modules" json:"modules"`
-	BaseURL                  string            `yaml:"base_url" json:"base_url"`
-	Model                    string            `yaml:"model" json:"model"`
-	TotalLLMConcurrency      *int              `yaml:"total_llm_concurrency" json:"total_llm_concurrency"`
-	ProposalLLMConcurrency   *int              `yaml:"proposal_llm_concurrency" json:"proposal_llm_concurrency"`
-	ValidationModel          string            `yaml:"validation_model" json:"validation_model"`
-	ValidationLLMConcurrency *int              `yaml:"validation_llm_concurrency" json:"validation_llm_concurrency"`
-	TranscriptDescription    string            `yaml:"transcript_description" json:"transcript_description"`
-	ConfigPath               string            `yaml:"config_path" json:"config_path"`
-	OutputSchema             string            `yaml:"output_schema" json:"output_schema"`
-	WorkDirRetention         string            `yaml:"work_dir_retention" json:"work_dir_retention"`
-	Report                   *bool             `yaml:"report" json:"report"`
+	Binary                string             `yaml:"binary" json:"binary"`
+	Timeout               string             `yaml:"timeout" json:"timeout"`
+	Credentials           []configkit.Secret `yaml:"credentials,omitempty" json:"credentials,omitempty"`
+	Modules               []string           `yaml:"modules" json:"modules"`
+	Overlay               string             `yaml:"overlay" json:"overlay"`
+	ProposalProfile       string             `yaml:"proposal_profile" json:"proposal_profile"`
+	ValidationProfile     string             `yaml:"validation_profile" json:"validation_profile"`
+	TranscriptDescription string             `yaml:"transcript_description" json:"transcript_description"`
+	ConfigPath            string             `yaml:"config_path" json:"config_path"`
+	OutputSchema          string             `yaml:"output_schema" json:"output_schema"`
 }
 
 // NormalizeConfig configures normalize-stage transcript schema/output behavior.
@@ -309,7 +304,7 @@ type ScriptoriumInputConfig struct {
 type NotariusConfig struct {
 	Enabled          bool                            `yaml:"enabled" json:"enabled"`
 	Binary           string                          `yaml:"binary" json:"binary"`
-	LLMAPIKey        *configkit.Secret               `yaml:"llm_api_key,omitempty" json:"llm_api_key,omitempty"`
+	Credentials      []configkit.Secret              `yaml:"credentials,omitempty" json:"credentials,omitempty"`
 	ConfigProfile    *string                         `yaml:"config_profile,omitempty" json:"config_profile,omitempty"`
 	Resume           bool                            `yaml:"resume,omitempty" json:"resume,omitempty"`
 	ChunkCache       string                          `yaml:"chunk_cache,omitempty" json:"chunk_cache,omitempty"`

internal/config/credential_projection.go

@@ -21,41 +21,39 @@ func (cfg StorageS3Config) MarshalYAML() (any, error) {
 	}, nil
 }
 
-// MarshalYAML exposes only the public Audita credential reference name.
+// MarshalYAML exposes only public Audita credential reference names.
 func (cfg AuditaConfig) MarshalYAML() (any, error) {
 	type safeAudita struct {
-		Binary                   string   `yaml:"binary"`
-		Timeout                  string   `yaml:"timeout"`
-		LLMAPIKey                *string  `yaml:"llm_api_key,omitempty"`
-		Modules                  []string `yaml:"modules"`
-		BaseURL                  string   `yaml:"base_url"`
-		Model                    string   `yaml:"model"`
-		TotalLLMConcurrency      *int     `yaml:"total_llm_concurrency"`
-		ProposalLLMConcurrency   *int     `yaml:"proposal_llm_concurrency"`
-		ValidationModel          string   `yaml:"validation_model"`
-		ValidationLLMConcurrency *int     `yaml:"validation_llm_concurrency"`
-		TranscriptDescription    string   `yaml:"transcript_description"`
-		ConfigPath               string   `yaml:"config_path"`
-		OutputSchema             string   `yaml:"output_schema"`
-		WorkDirRetention         string   `yaml:"work_dir_retention"`
-		Report                   *bool    `yaml:"report"`
+		Binary                string    `yaml:"binary"`
+		Timeout               string    `yaml:"timeout"`
+		Credentials           []string  `yaml:"credentials,omitempty"`
+		Modules               *[]string `yaml:"modules,omitempty"`
+		Overlay               string    `yaml:"overlay"`
+		ProposalProfile       string    `yaml:"proposal_profile"`
+		ValidationProfile     string    `yaml:"validation_profile"`
+		TranscriptDescription string    `yaml:"transcript_description"`
+		ConfigPath            string    `yaml:"config_path"`
+		OutputSchema          string    `yaml:"output_schema"`
+	}
+	// A nil pointer omits the override; a pointer to an empty slice disables modules.
+	var modules *[]string
+	if cfg.Modules != nil {
+		modules = &cfg.Modules
 	}
 	return safeAudita{
-		Binary: cfg.Binary, Timeout: cfg.Timeout, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
-		Modules: cfg.Modules, BaseURL: cfg.BaseURL, Model: cfg.Model,
-		TotalLLMConcurrency: cfg.TotalLLMConcurrency, ProposalLLMConcurrency: cfg.ProposalLLMConcurrency,
-		ValidationModel: cfg.ValidationModel, ValidationLLMConcurrency: cfg.ValidationLLMConcurrency,
-		TranscriptDescription: cfg.TranscriptDescription, ConfigPath: cfg.ConfigPath,
-		OutputSchema: cfg.OutputSchema, WorkDirRetention: cfg.WorkDirRetention, Report: cfg.Report,
+		Binary: cfg.Binary, Timeout: cfg.Timeout, Credentials: secretReferenceNames(cfg.Credentials),
+		Modules: modules, Overlay: cfg.Overlay, ProposalProfile: cfg.ProposalProfile,
+		ValidationProfile: cfg.ValidationProfile, TranscriptDescription: cfg.TranscriptDescription,
+		ConfigPath: cfg.ConfigPath, OutputSchema: cfg.OutputSchema,
 	}, nil
 }
 
-// MarshalYAML exposes only the public Notarius credential reference name.
+// MarshalYAML exposes only public Notarius credential reference names.
 func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	type safeNotarius struct {
 		Enabled          bool                            `yaml:"enabled"`
 		Binary           string                          `yaml:"binary"`
-		LLMAPIKey        *string                         `yaml:"llm_api_key,omitempty"`
+		Credentials      []string                        `yaml:"credentials,omitempty"`
 		ConfigProfile    *string                         `yaml:"config_profile,omitempty"`
 		Resume           bool                            `yaml:"resume,omitempty"`
 		ChunkCache       string                          `yaml:"chunk_cache,omitempty"`
@@ -67,7 +65,7 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 		Outputs          map[string]NotariusOutputConfig `yaml:"outputs"`
 	}
 	return safeNotarius{
-		Enabled: cfg.Enabled, Binary: cfg.Binary, LLMAPIKey: secretReferenceName(cfg.LLMAPIKey),
+		Enabled: cfg.Enabled, Binary: cfg.Binary, Credentials: secretReferenceNames(cfg.Credentials),
 		ConfigProfile: cfg.ConfigProfile,
 		Resume:        cfg.Resume, ChunkCache: cfg.ChunkCache,
 		ConfigPath: cfg.ConfigPath, PipelineID: cfg.PipelineID, Timeout: cfg.Timeout,
@@ -75,6 +73,17 @@ func (cfg NotariusConfig) MarshalYAML() (any, error) {
 	}, nil
 }
 
+func secretReferenceNames(secrets []configkit.Secret) []string {
+	if secrets == nil {
+		return nil
+	}
+	names := make([]string, len(secrets))
+	for index, secret := range secrets {
+		names[index] = secret.EnvName()
+	}
+	return names
+}
+
 func secretReferenceName(secret *configkit.Secret) *string {
 	if secret == nil {
 		return nil

internal/config/credential_projection_test.go

@@ -0,0 +1,33 @@
+package config
+
+import (
+	"reflect"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestAuditaYAMLPreservesModuleSelection(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		modules []string
+	}{
+		{name: "omitted"},
+		{name: "explicit empty", modules: []string{}},
+		{name: "ordered repetitions", modules: []string{"grammar", "names", "grammar"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			data, err := yaml.Marshal(AuditaConfig{Modules: tc.modules})
+			if err != nil {
+				t.Fatal(err)
+			}
+			var decoded AuditaConfig
+			if err := yaml.Unmarshal(data, &decoded); err != nil {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(decoded.Modules, tc.modules) {
+				t.Fatalf("modules = %#v, want %#v; YAML:\n%s", decoded.Modules, tc.modules, data)
+			}
+		})
+	}
+}

internal/config/defaults.go

@@ -30,7 +30,6 @@ const (
 
 	DefaultAuditaBinary    = "audita"
 	DefaultAuditaTimeout   = "3h"
-	DefaultAuditaReport    = true
 	DefaultNotariusBinary  = "notarius"
 	DefaultNotariusTimeout = "3h"
 	// MaxNotariusReferenceBindings is the maximum number of CLI reference

internal/config/effective_digest.go

@@ -14,21 +14,21 @@ const (
 	effectivePipelineDigestVersion = "narratio-effective-pipeline-v3\n"
 )
 
-// PipelineProfileProvenance identifies the profile selected while resolving a
+// PipelineOverlayProvenance identifies the overlay selected while resolving a
 // pipeline. It contains only non-secret selection metadata.
-type PipelineProfileProvenance struct {
+type PipelineOverlayProvenance struct {
 	Name        string
 	Source      string
 	OverlayPath string
 }
 
-// SelectedPipelineProfile reports the profile used to resolve cfg, if any.
-func SelectedPipelineProfile(cfg *PipelineConfig) (*PipelineProfileProvenance, bool) {
-	if cfg == nil || cfg.resolution == nil || cfg.resolution.selectedProfile == nil {
+// SelectedPipelineOverlay reports the overlay used to resolve cfg, if any.
+func SelectedPipelineOverlay(cfg *PipelineConfig) (*PipelineOverlayProvenance, bool) {
+	if cfg == nil || cfg.resolution == nil || cfg.resolution.selectedOverlay == nil {
 		return nil, false
 	}
-	selection := cfg.resolution.selectedProfile
-	return &PipelineProfileProvenance{Name: selection.name, Source: selection.source, OverlayPath: selection.overlayPath}, true
+	selection := cfg.resolution.selectedOverlay
+	return &PipelineOverlayProvenance{Name: selection.name, Source: selection.source, OverlayPath: selection.overlayPath}, true
 }
 
 // EffectivePipelineDigest reports the deterministic secret-free digest for a

internal/config/effective_pipeline.go

@@ -401,8 +401,8 @@ func pipelineSourceRole(cfg *PipelineConfig, source string) string {
 	if source == cfg.resolution.rootPath {
 		return "root"
 	}
-	if cfg.resolution.selectedProfile != nil && source == cfg.resolution.selectedProfile.overlayPath {
-		return "profile"
+	if cfg.resolution.selectedOverlay != nil && source == cfg.resolution.selectedOverlay.overlayPath {
+		return "overlay"
 	}
 	for _, imported := range cfg.resolution.imports {
 		if source == imported {

internal/config/load.go

@@ -15,14 +15,14 @@ func LoadPipeline(path string) (*PipelineConfig, error) {
 	return LoadPipelineWithOptions(path, PipelineLoadOptions{})
 }
 
-// PipelineLoadOptions carries an optional explicit profile selection. Nil,
+// PipelineLoadOptions carries an optional explicit overlay selection. Nil,
 // empty, and the exact name "default" select the base configuration.
 type PipelineLoadOptions struct {
-	Profile *string
+	Overlay *string
 }
 
 // LoadPipelineWithOptions loads pipeline configuration with strict field
-// checking and optional named-profile selection.
+// checking and optional named-overlay selection.
 func LoadPipelineWithOptions(path string, opts PipelineLoadOptions) (*PipelineConfig, error) {
 	cfg, err := loadPipelineWithConfigKit(path, opts)
 	if err != nil {
@@ -31,20 +31,20 @@ func LoadPipelineWithOptions(path string, opts PipelineLoadOptions) (*PipelineCo
 	return finalizeLoadedPipeline(path, cfg)
 }
 
-// LoadPipelineProfilePair resolves two profiles as independent ConfigKit loads.
-func LoadPipelineProfilePair(path, leftProfile, rightProfile string) (*PipelineConfig, *PipelineConfig, error) {
-	if leftProfile == rightProfile {
-		return nil, nil, fmt.Errorf("load pipeline profiles: left and right profile selections must differ")
+// LoadPipelineOverlayPair resolves two overlays as independent ConfigKit loads.
+func LoadPipelineOverlayPair(path, leftOverlay, rightOverlay string) (*PipelineConfig, *PipelineConfig, error) {
+	if leftOverlay == rightOverlay {
+		return nil, nil, fmt.Errorf("load pipeline overlays: left and right overlay selections must differ")
 	}
-	leftOptions := PipelineLoadOptions{Profile: &leftProfile}
-	rightOptions := PipelineLoadOptions{Profile: &rightProfile}
+	leftOptions := PipelineLoadOptions{Overlay: &leftOverlay}
+	rightOptions := PipelineLoadOptions{Overlay: &rightOverlay}
 	left, err := LoadPipelineWithOptions(path, leftOptions)
 	if err != nil {
-		return nil, nil, fmt.Errorf("load left pipeline profile: %w", err)
+		return nil, nil, fmt.Errorf("load left pipeline overlay: %w", err)
 	}
 	right, err := LoadPipelineWithOptions(path, rightOptions)
 	if err != nil {
-		return nil, nil, fmt.Errorf("load right pipeline profile: %w", err)
+		return nil, nil, fmt.Errorf("load right pipeline overlay: %w", err)
 	}
 	return left, right, nil
 }
@@ -76,7 +76,7 @@ func LoadSession(path string) (*SessionConfig, error) {
 type SessionLoadOptions struct {
 	SessionID         string
 	PreviousSessionID string
-	Profile           *string
+	Overlay           *string
 }
 
 // LoadSessionWithOptions loads session configuration from a YAML file with
@@ -143,7 +143,7 @@ func Load(pipelinePath string, paths ...string) (*Config, error) {
 // LoadWithSessionOptions loads and resolves combined pipeline, campaign, and
 // session configuration with expected session identity checks.
 func LoadWithSessionOptions(pipelinePath, campaignPath, sessionPath string, sessionOpts SessionLoadOptions) (*Config, error) {
-	pipelineCfg, err := LoadPipelineWithOptions(pipelinePath, PipelineLoadOptions{Profile: sessionOpts.Profile})
+	pipelineCfg, err := LoadPipelineWithOptions(pipelinePath, PipelineLoadOptions{Overlay: sessionOpts.Overlay})
 	if err != nil {
 		return nil, err
 	}

internal/config/load_validate_test.go

@@ -93,7 +93,7 @@ func TestCredentialValuesNeverEnterEffectiveProjectionOrDigest(t *testing.T) {
 	t.Setenv("NARRATIO_TEST_SECRET_KEY", firstCanary)
 	t.Setenv("NARRATIO_TEST_AUDITA_KEY", firstCanary)
 	t.Setenv("NARRATIO_TEST_NOTARIUS_KEY", firstCanary)
-	pipelineYAML := strings.Replace(testPipelineBaseYAML, "audita:\n  binary: audita\n", "audita:\n  binary: audita\n  llm_api_key: NARRATIO_TEST_AUDITA_KEY\n", 1) + `
+	pipelineYAML := strings.Replace(testPipelineBaseYAML, "audita:\n  binary: audita\n", "audita:\n  binary: audita\n  credentials: [NARRATIO_TEST_AUDITA_KEY]\n", 1) + `
 storage:
   backend: s3
   s3:
@@ -102,7 +102,7 @@ storage:
     secret_access_key: NARRATIO_TEST_SECRET_KEY
 notarius:
   enabled: false
-  llm_api_key: NARRATIO_TEST_NOTARIUS_KEY
+  credentials: [NARRATIO_TEST_NOTARIUS_KEY]
   config_profile: ""
 `
 	pipelinePath, _ := writeConfigFiles(t, pipelineYAML, testSessionBaseYAML)
@@ -146,8 +146,8 @@ notarius:
 	}
 	var roundTrip struct {
 		Notarius *struct {
-			LLMAPIKey     *string `yaml:"llm_api_key"`
-			ConfigProfile *string `yaml:"config_profile"`
+			Credentials   []string `yaml:"credentials"`
+			ConfigProfile *string  `yaml:"config_profile"`
 		} `yaml:"notarius"`
 	}
 	if err := yaml.Unmarshal(firstYAML, &roundTrip); err != nil {
@@ -156,8 +156,8 @@ notarius:
 	if roundTrip.Notarius == nil || roundTrip.Notarius.ConfigProfile == nil || *roundTrip.Notarius.ConfigProfile != "" {
 		t.Fatalf("round-trip config profile = %#v, want explicit empty", roundTrip.Notarius)
 	}
-	if roundTrip.Notarius.LLMAPIKey == nil || *roundTrip.Notarius.LLMAPIKey != "NARRATIO_TEST_NOTARIUS_KEY" {
-		t.Fatalf("round-trip credential reference = %#v, want safe public name", roundTrip.Notarius.LLMAPIKey)
+	if len(roundTrip.Notarius.Credentials) != 1 || roundTrip.Notarius.Credentials[0] != "NARRATIO_TEST_NOTARIUS_KEY" {
+		t.Fatalf("round-trip credential reference = %#v, want safe public name", roundTrip.Notarius.Credentials)
 	}
 
 	t.Setenv("NARRATIO_TEST_ACCESS_KEY", secondCanary)
@@ -358,7 +358,7 @@ func TestExamplesLoadAndValidate(t *testing.T) {
 			t.Run(profile.name, func(t *testing.T) {
 				options := PipelineLoadOptions{}
 				if profile.selection != "" {
-					options.Profile = &profile.selection
+					options.Overlay = &profile.selection
 				}
 				pipeline, err := LoadPipelineWithOptions(pipelinePath, options)
 				if err != nil {
@@ -375,18 +375,18 @@ func TestExamplesLoadAndValidate(t *testing.T) {
 				if err := Validate(cfg); err != nil {
 					t.Fatalf("validate split bundle: %v", err)
 				}
-				if cfg.Pipeline.Audita.Model != profile.model {
-					t.Fatalf("audita model = %q, want %q", cfg.Pipeline.Audita.Model, profile.model)
+				if cfg.Pipeline.Audita.ProposalProfile != profile.model {
+					t.Fatalf("audita proposal profile = %q, want %q", cfg.Pipeline.Audita.ProposalProfile, profile.model)
 				}
-				if cfg.Pipeline.Audita.LLMAPIKey != nil || cfg.Pipeline.Storage.Backend != StorageBackendLocal || cfg.Pipeline.Storage.S3 != nil {
+				if len(cfg.Pipeline.Audita.Credentials) != 0 || cfg.Pipeline.Storage.Backend != StorageBackendLocal || cfg.Pipeline.Storage.S3 != nil {
 					t.Fatalf("split bundle must remain offline and secret-free: audita=%#v storage=%#v", cfg.Pipeline.Audita, cfg.Pipeline.Storage)
 				}
-				selectedProfile, selected := SelectedPipelineProfile(cfg.Pipeline)
+				selectedOverlay, selected := SelectedPipelineOverlay(cfg.Pipeline)
 				if profile.selection == "" && selected {
-					t.Fatalf("production base unexpectedly selected profile %#v", selectedProfile)
+					t.Fatalf("production base unexpectedly selected overlay %#v", selectedOverlay)
 				}
-				if profile.selection != "" && (!selected || selectedProfile.Name != profile.selection) {
-					t.Fatalf("selected profile = %#v, want %q", selectedProfile, profile.selection)
+				if profile.selection != "" && (!selected || selectedOverlay.Name != profile.selection) {
+					t.Fatalf("selected overlay = %#v, want %q", selectedOverlay, profile.selection)
 				}
 				for _, key := range []string{
 					"session_recap",

internal/config/notarius_test.go

@@ -58,8 +58,10 @@ notarius:
 
 func TestNotariusCredentialReferenceLoading(t *testing.T) {
 	const envName = "NARRATIO_TEST_NOTARIUS_KEY"
+	const secondName = "NARRATIO_TEST_NOTARIUS_SECOND_KEY"
 	const canary = "notarius-credential-canary"
 	t.Setenv(envName, canary)
+	t.Setenv(secondName, "second-canary")
 
 	tests := []struct {
 		name       string
@@ -67,8 +69,9 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
 		wantNil    bool
 	}{
 		{name: "omitted", wantNil: true},
-		{name: "null", credential: "  llm_api_key: null\n", wantNil: true},
-		{name: "custom reference", credential: "  llm_api_key: " + envName + "\n"},
+		{name: "null", credential: "  credentials: null\n", wantNil: true},
+		{name: "empty", credential: "  credentials: []\n"},
+		{name: "custom references", credential: "  credentials: [" + envName + ", " + secondName + "]\n"},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
@@ -81,15 +84,19 @@ func TestNotariusCredentialReferenceLoading(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			if test.wantNil {
-				if cfg.Notarius.LLMAPIKey != nil {
-					t.Fatal("credential reference should be nil")
-				}
+			if test.wantNil && cfg.Notarius.Credentials != nil {
+				t.Fatal("credential list should be nil")
+			}
+			if test.name == "empty" && len(cfg.Notarius.Credentials) == 0 {
 				return
 			}
-			if cfg.Notarius.LLMAPIKey == nil || cfg.Notarius.LLMAPIKey.EnvName() != envName ||
-				!cfg.Notarius.LLMAPIKey.IsResolved() || cfg.Notarius.LLMAPIKey.Value() != canary {
-				t.Fatal("credential reference was not loaded and resolved")
+			if test.wantNil {
+				return
+			}
+			if len(cfg.Notarius.Credentials) != 2 ||
+				cfg.Notarius.Credentials[0].EnvName() != envName || cfg.Notarius.Credentials[0].Value() != canary ||
+				cfg.Notarius.Credentials[1].EnvName() != secondName || cfg.Notarius.Credentials[1].Value() != "second-canary" {
+				t.Fatal("credential references were not loaded and resolved")
 			}
 		})
 	}
@@ -110,7 +117,7 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
 			path := filepath.Join(t.TempDir(), "pipeline.yml")
-			pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  enabled: false\n  llm_api_key: " + test.reference + "\n"
+			pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  enabled: false\n  credentials: [" + test.reference + "]\n"
 			if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
 				t.Fatal(err)
 			}
@@ -122,6 +129,17 @@ func TestNotariusCredentialReferenceFailures(t *testing.T) {
 	}
 }
 
+func TestNotariusRejectsRetiredCredentialField(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pipeline.yml")
+	pipelineYAML := testPipelineBaseYAML + "\nnotarius:\n  llm_api_key: NARRATIO_TEST_NOTARIUS_KEY\n"
+	if err := os.WriteFile(path, []byte(pipelineYAML), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadPipeline(path); err == nil || !strings.Contains(err.Error(), "decode.unknown_field") {
+		t.Fatalf("LoadPipeline() error = %v, want unknown field", err)
+	}
+}
+
 func TestNotariusEnabledDefaultsAndPathResolution(t *testing.T) {
 	dir := t.TempDir()
 	pipelinePath := filepath.Join(dir, "deployment", "pipeline.yml")

internal/config/pipeline_configkit.go

@@ -16,7 +16,7 @@ type pipelineResolutionMetadata struct {
 	rootPath                 string
 	imports                  []string
 	sources                  []string
-	selectedProfile          *pipelineProfileSelection
+	selectedOverlay          *pipelineOverlaySelection
 	effectiveDigest          string
 	logicalNotariusConfig    string
 	logicalNotariusWorking   string
@@ -29,7 +29,7 @@ type pipelineResolutionMetadata struct {
 	configkitSources         []configkit.SourceInfo
 }
 
-type pipelineProfileSelection struct {
+type pipelineOverlaySelection struct {
 	name        string
 	source      string
 	overlayPath string
@@ -41,8 +41,8 @@ type pipelineFieldOwnership struct {
 }
 
 func loadPipelineWithConfigKit(path string, opts PipelineLoadOptions) (*PipelineConfig, error) {
-	profile := selectedPipelineProfileName(opts)
-	result, err := loadPipelineConfigKitResult(path, profile)
+	overlay := selectedPipelineOverlayName(opts)
+	result, err := loadPipelineConfigKitResult(path, overlay)
 	if err != nil {
 		return nil, describePipelineLoadError(err)
 	}
@@ -55,10 +55,10 @@ func loadPipelineWithConfigKit(path string, opts PipelineLoadOptions) (*Pipeline
 	return &cfg, nil
 }
 
-func loadPipelineConfigKitResult(path, profile string) (*configkit.Result[PipelineConfig], error) {
+func loadPipelineConfigKitResult(path, overlay string) (*configkit.Result[PipelineConfig], error) {
 	return configkit.Load(configkit.File(path), configkit.Options[PipelineConfig]{
 		Imports: true,
-		Profile: profile,
+		Overlay: overlay,
 		Definition: configkit.Definition[PipelineConfig]{
 			Defaults: pipelineConfigDefaults,
 			Resolve:  resolvePipelineConfig,
@@ -104,11 +104,11 @@ func describeConfigKitLoadError(kind string, err error) error {
 	return fmt.Errorf("load %s config: strict decode failed or validation failed: %w: %s", kind, err, strings.TrimSpace(diagnostics.String()))
 }
 
-func selectedPipelineProfileName(opts PipelineLoadOptions) string {
-	if opts.Profile == nil || *opts.Profile == "" || *opts.Profile == "default" {
+func selectedPipelineOverlayName(opts PipelineLoadOptions) string {
+	if opts.Overlay == nil || *opts.Overlay == "" || *opts.Overlay == "default" {
 		return ""
 	}
-	return *opts.Profile
+	return *opts.Overlay
 }
 
 func pipelineConfigDefaults() PipelineConfig {
@@ -132,7 +132,7 @@ func pipelineConfigDefaults() PipelineConfig {
 			OutputSchema: DefaultSeriatimOutputSchema, CoalesceGap: float64Ptr(DefaultSeriatimCoalesceGap),
 			Report: boolPtr(DefaultSeriatimReport),
 		},
-		Audita:    AuditaConfig{Binary: DefaultAuditaBinary, Timeout: DefaultAuditaTimeout, Report: boolPtr(DefaultAuditaReport)},
+		Audita:    AuditaConfig{Binary: DefaultAuditaBinary, Timeout: DefaultAuditaTimeout},
 		Normalize: &NormalizeConfig{OutputPath: DefaultNormalizeOutputPath, OutputSchema: DefaultNormalizeOutputSchema, Report: boolPtr(DefaultNormalizeReport)},
 		Trim: &TrimConfig{
 			Enabled: boolPtr(DefaultTrimEnabled), OutputPath: DefaultTrimOutputPath,
@@ -282,8 +282,8 @@ func pipelineMetadataFromConfigKit(cfg *PipelineConfig, result *configkit.Result
 		} else if source.Layer == configkit.LayerBase {
 			resolved.imports = append(resolved.imports, path)
 		}
-		if source.Layer == configkit.LayerProfile {
-			resolved.selectedProfile = &pipelineProfileSelection{name: selectedPipelineProfileName(opts), source: "explicit", overlayPath: path}
+		if source.Layer == configkit.LayerOverlay {
+			resolved.selectedOverlay = &pipelineOverlaySelection{name: selectedPipelineOverlayName(opts), source: "explicit", overlayPath: path}
 		}
 	}
 	detailed, err := pipelineMetadataPaths(cfg)
@@ -347,7 +347,7 @@ func rejectDuplicateBaseDefinitions(metadata configkit.Metadata, sources []confi
 		pathsByID[source.ID] = source.Path
 	}
 	// Enumerate retained declarations, not just surviving effective keys. Loading
-	// the base separately would also resolve credentials removed by the profile.
+	// the base separately would also resolve credentials removed by the overlay.
 	// ConfigKit returns canonical JSON Pointers in deterministic order.
 	for _, path := range metadata.HistoricalPaths() {
 		parts := strings.Split(path.String(), "/")

internal/config/pipeline_configkit_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 )
 
-func TestPipelineConfigKitImportsProfileAndBaseSelection(t *testing.T) {
+func TestPipelineConfigKitImportsOverlayAndBaseSelection(t *testing.T) {
 	dir := t.TempDir()
 	writePipelineFixture(t, dir, "pipeline.yml", `configkit:
   imports:
@@ -24,33 +24,62 @@ whisperx:
       enabled: false
       output_path: artifacts/recap.md
 `)
-	writePipelineFixture(t, dir, "profiles/testing.yml", "workspace:\n  root: /srv/testing\n")
-	writePipelineFixture(t, dir, "profiles/unselected.yml", "unknown: [\n")
+	writePipelineFixture(t, dir, "overlays/testing.yml", "workspace:\n  root: /srv/testing\n")
+	writePipelineFixture(t, dir, "overlays/identical.yml", "workspace:\n  root: /srv/base\n")
+	writePipelineFixture(t, dir, "overlays/unselected.yml", "unknown: [\n")
 
 	root := filepath.Join(dir, "pipeline.yml")
+	var baseDigest string
 	for _, profile := range []*string{nil, stringPointer(""), stringPointer("default")} {
-		cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: profile})
+		cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: profile})
 		if err != nil {
 			t.Fatalf("load base selection %#v: %v", profile, err)
 		}
 		if cfg.Workspace.Root != "/srv/base" {
 			t.Fatalf("base workspace = %q", cfg.Workspace.Root)
 		}
+		if baseDigest == "" {
+			baseDigest = EffectivePipelineDigest(cfg)
+		} else if EffectivePipelineDigest(cfg) != baseDigest {
+			t.Fatal("equivalent base selections changed effective digest")
+		}
+	}
+	identical := "identical"
+	unchanged, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &identical})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if EffectivePipelineDigest(unchanged) != baseDigest {
+		t.Fatal("equivalent overlay changed effective digest")
 	}
 	selected := "testing"
-	cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: &selected})
+	cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &selected})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if cfg.Workspace.Root != "/srv/testing" || len(EffectivePipelineImports(cfg)) != 2 {
 		t.Fatalf("profiled pipeline = %#v, imports=%#v", cfg.Workspace, EffectivePipelineImports(cfg))
 	}
-	profile, ok := SelectedPipelineProfile(cfg)
-	if !ok || profile.Name != "testing" || profile.OverlayPath != filepath.Join(dir, "profiles", "testing.yml") {
+	profile, ok := SelectedPipelineOverlay(cfg)
+	if !ok || profile.Name != "testing" || profile.OverlayPath != filepath.Join(dir, "overlays", "testing.yml") {
 		t.Fatalf("selected profile = %#v, %v", profile, ok)
 	}
 }
 
+func TestPipelineOverlayDoesNotDiscoverLegacyDirectory(t *testing.T) {
+	dir := t.TempDir()
+	writePipelineFixture(t, dir, "pipeline.yml", "configkit:\n  imports:\n    - path: profiles/shared.yml\n")
+	writePipelineFixture(t, dir, "profiles/shared.yml", "workspace:\n  root: /srv/base\n")
+	writePipelineFixture(t, dir, "profiles/testing.yml", "workspace:\n  root: /srv/old\n")
+	if base, err := LoadPipeline(filepath.Join(dir, "pipeline.yml")); err != nil || base.Workspace.Root != "/srv/base" {
+		t.Fatalf("explicit import from profiles directory = %#v, %v", base, err)
+	}
+	selected := "testing"
+	if _, err := LoadPipelineWithOptions(filepath.Join(dir, "pipeline.yml"), PipelineLoadOptions{Overlay: &selected}); err == nil || !strings.Contains(err.Error(), "overlay.missing") {
+		t.Fatalf("legacy selected file result = %v, want missing overlay", err)
+	}
+}
+
 func TestPipelineConfigKitRejectsDuplicateBaseDeclarations(t *testing.T) {
 	for _, test := range []struct {
 		name, first, second, clearedContainer string
@@ -69,14 +98,14 @@ whisperx:
 `)
 			writePipelineFixture(t, dir, "first.yml", test.first)
 			writePipelineFixture(t, dir, "second.yml", test.second)
-			writePipelineFixture(t, dir, "profiles/clear-container.yml", test.clearedContainer)
-			writePipelineFixture(t, dir, "profiles/clear-scriptorium.yml", "scriptorium: null\n")
+			writePipelineFixture(t, dir, "overlays/clear-container.yml", test.clearedContainer)
+			writePipelineFixture(t, dir, "overlays/clear-scriptorium.yml", "scriptorium: null\n")
 
 			for _, profile := range []string{"", "clear-container", "clear-scriptorium"} {
 				t.Run(profile, func(t *testing.T) {
 					options := PipelineLoadOptions{}
 					if profile != "" {
-						options.Profile = &profile
+						options.Overlay = &profile
 					}
 					_, err := LoadPipelineWithOptions(filepath.Join(dir, "pipeline.yml"), options)
 					if err == nil || !strings.Contains(err.Error(), "declared by multiple base files") ||
@@ -89,7 +118,7 @@ whisperx:
 	}
 }
 
-func TestPipelineProfileDoesNotRequireUnusedBaseCredentials(t *testing.T) {
+func TestPipelineOverlayDoesNotRequireUnusedBaseCredentials(t *testing.T) {
 	const production = "NARRATIO_PROFILE_UNUSED_PROD_KEY"
 	const testingKey = "NARRATIO_PROFILE_TEST_KEY"
 	t.Setenv(production, "")
@@ -100,25 +129,72 @@ func TestPipelineProfileDoesNotRequireUnusedBaseCredentials(t *testing.T) {
 	for _, credential := range []string{testingKey, "null"} {
 		t.Run(credential, func(t *testing.T) {
 			dir := t.TempDir()
-			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\naudita:\n  llm_api_key: "+production+"\n")
-			writePipelineFixture(t, dir, "profiles/testing.yml", "audita:\n  llm_api_key: "+credential+"\n")
+			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\naudita:\n  credentials: ["+production+"]\n")
+			selected := "[" + credential + "]"
+			if credential == "null" {
+				selected = credential
+			}
+			writePipelineFixture(t, dir, "overlays/testing.yml", "audita:\n  credentials: "+selected+"\n")
 			profile := "testing"
-			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: &profile})
+			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &profile})
 			if err != nil {
 				t.Fatal(err)
 			}
 			if credential == "null" {
-				if cfg.Audita.LLMAPIKey != nil {
+				if len(cfg.Audita.Credentials) != 0 {
 					t.Fatal("profile did not remove the base credential")
 				}
-			} else if cfg.Audita.LLMAPIKey == nil || cfg.Audita.LLMAPIKey.EnvName() != testingKey || !cfg.Audita.LLMAPIKey.IsResolved() {
+			} else if len(cfg.Audita.Credentials) != 1 || cfg.Audita.Credentials[0].EnvName() != testingKey || !cfg.Audita.Credentials[0].IsResolved() {
 				t.Fatal("profile credential was not resolved")
 			}
 		})
 	}
 }
 
-func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
+func TestAuditaModulesPreserveOmittedEmptyAndReplacementSelections(t *testing.T) {
+	for _, test := range []struct {
+		name, base, overlay string
+		wantNil             bool
+		want                []string
+	}{
+		{name: "omitted", wantNil: true},
+		{name: "null", base: "  modules: null\n", wantNil: true},
+		{name: "empty", base: "  modules: []\n", want: []string{}},
+		{name: "overlay empty", base: "  modules: [glossary]\n", overlay: "audita:\n  modules: []\n", want: []string{}},
+		{name: "overlay order", base: "  modules: []\n", overlay: "audita:\n  modules: [grammar, glossary, grammar]\n", want: []string{"grammar", "glossary", "grammar"}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			dir := t.TempDir()
+			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\naudita:\n  binary: audita\n"+test.base)
+			options := PipelineLoadOptions{}
+			if test.overlay != "" {
+				writePipelineFixture(t, dir, "overlays/testing.yml", test.overlay)
+				selection := "testing"
+				options.Overlay = &selection
+			}
+			cfg, err := LoadPipelineWithOptions(root, options)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if (cfg.Audita.Modules == nil) != test.wantNil || !reflect.DeepEqual(cfg.Audita.Modules, test.want) {
+				t.Fatalf("modules = %#v, want %#v (nil=%v)", cfg.Audita.Modules, test.want, test.wantNil)
+			}
+		})
+	}
+}
+
+func TestAuditaRejectsRetiredConfigurationFields(t *testing.T) {
+	for _, field := range []string{"llm_api_key", "base_url", "model", "validation_model", "total_llm_concurrency", "proposal_llm_concurrency", "validation_llm_concurrency", "work_dir_retention", "report"} {
+		t.Run(field, func(t *testing.T) {
+			root := writePipelineFixture(t, t.TempDir(), "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\naudita:\n  "+field+": retired\n")
+			if _, err := LoadPipeline(root); err == nil || !strings.Contains(err.Error(), "decode.unknown_field") {
+				t.Fatalf("error = %v, want unknown field", err)
+			}
+		})
+	}
+}
+
+func TestNotariusCredentialOverlayReplacementAndProvenance(t *testing.T) {
 	const baseKey = "NARRATIO_NOTARIUS_UNUSED_BASE_KEY"
 	const profileKey = "NARRATIO_NOTARIUS_PROFILE_KEY"
 	if err := os.Unsetenv(baseKey); err != nil {
@@ -126,24 +202,24 @@ func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
 	}
 	t.Setenv(profileKey, "synthetic-notarius-profile-key")
 
-	for _, credential := range []string{profileKey, "null"} {
+	for _, credential := range []string{"[" + profileKey + "]", "null", "[]"} {
 		t.Run(credential, func(t *testing.T) {
 			dir := t.TempDir()
-			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+baseKey+"\n")
-			overlay := writePipelineFixture(t, dir, "profiles/testing.yml", "notarius:\n  llm_api_key: "+credential+"\n")
+			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+baseKey+"]\n")
+			overlay := writePipelineFixture(t, dir, "overlays/testing.yml", "notarius:\n  credentials: "+credential+"\n")
 			profile := "testing"
-			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: &profile})
+			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &profile})
 			if err != nil {
 				t.Fatal(err)
 			}
-			if credential == "null" {
-				if cfg.Notarius.LLMAPIKey != nil {
-					t.Fatal("profile did not remove the base credential")
+			if credential == "null" || credential == "[]" {
+				if len(cfg.Notarius.Credentials) != 0 {
+					t.Fatal("overlay did not clear base credentials")
 				}
 				return
 			}
-			if cfg.Notarius.LLMAPIKey == nil || cfg.Notarius.LLMAPIKey.EnvName() != profileKey || !cfg.Notarius.LLMAPIKey.IsResolved() {
-				t.Fatal("profile credential was not resolved")
+			if len(cfg.Notarius.Credentials) != 1 || cfg.Notarius.Credentials[0].EnvName() != profileKey || !cfg.Notarius.Credentials[0].IsResolved() {
+				t.Fatal("overlay credential was not resolved")
 			}
 			sources, err := EffectivePipelineSources(cfg, ResolvedParty{})
 			if err != nil {
@@ -151,12 +227,12 @@ func TestNotariusCredentialProfileReplacementAndProvenance(t *testing.T) {
 			}
 			found := false
 			for _, source := range sources {
-				if source.Path == "notarius.llm_api_key" {
+				if source.Path == "notarius.credentials" {
 					found = source.Source == overlay
 				}
 			}
 			if !found {
-				t.Fatal("Notarius credential provenance did not identify the selected profile")
+				t.Fatal("Notarius credential provenance did not identify the selected overlay")
 			}
 		})
 	}
@@ -187,8 +263,8 @@ func TestNotariusConfigProfileComposition(t *testing.T) {
 			root := writePipelineFixture(t, dir, "pipeline.yml", rootYAML)
 			options := PipelineLoadOptions{}
 			if test.overlayName != "" {
-				writePipelineFixture(t, dir, "profiles/"+test.overlayName+".yml", test.overlay)
-				options.Profile = &test.overlayName
+				writePipelineFixture(t, dir, "overlays/"+test.overlayName+".yml", test.overlay)
+				options.Overlay = &test.overlayName
 			}
 			cfg, err := LoadPipelineWithOptions(root, options)
 			if err != nil {
@@ -205,7 +281,7 @@ func TestNotariusCredentialRootProvenance(t *testing.T) {
 	const envName = "NARRATIO_NOTARIUS_ROOT_KEY"
 	t.Setenv(envName, "synthetic-notarius-root-key")
 	dir := t.TempDir()
-	root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+envName+"\n")
+	root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+envName+"]\n")
 	cfg, err := LoadPipeline(root)
 	if err != nil {
 		t.Fatal(err)
@@ -215,7 +291,7 @@ func TestNotariusCredentialRootProvenance(t *testing.T) {
 		t.Fatal(err)
 	}
 	for _, source := range sources {
-		if source.Path == "notarius.llm_api_key" && source.Source == root {
+		if source.Path == "notarius.credentials" && source.Source == root {
 			return
 		}
 	}
@@ -238,9 +314,9 @@ func TestNotariusCacheControlProfileReplacementAndNullReset(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			dir := t.TempDir()
 			root := writePipelineFixture(t, dir, "pipeline.yml", "whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  resume: false\n  chunk_cache: bypass\n")
-			overlay := writePipelineFixture(t, dir, "profiles/testing.yml", test.overlay)
+			overlay := writePipelineFixture(t, dir, "overlays/testing.yml", test.overlay)
 			profile := "testing"
-			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Profile: &profile})
+			cfg, err := LoadPipelineWithOptions(root, PipelineLoadOptions{Overlay: &profile})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -282,9 +358,9 @@ whisperx:
   transcribe_url: https://transcription.example.test/transcribe
 `)
 	writePipelineFixture(t, dir, "artifact.yml", "scriptorium:\n  artifacts:\n    recap:\n      prompt_id: base\n      output_path: artifacts/recap.md\n")
-	writePipelineFixture(t, dir, "profiles/testing.yml", "scriptorium:\n  artifacts:\n    recap:\n      prompt_id: testing\n")
+	writePipelineFixture(t, dir, "overlays/testing.yml", "scriptorium:\n  artifacts:\n    recap:\n      prompt_id: testing\n")
 	profile := "testing"
-	cfg, err := LoadPipelineWithOptions(filepath.Join(dir, "pipeline.yml"), PipelineLoadOptions{Profile: &profile})
+	cfg, err := LoadPipelineWithOptions(filepath.Join(dir, "pipeline.yml"), PipelineLoadOptions{Overlay: &profile})
 	if err != nil {
 		t.Fatal(err)
 	}

internal/config/validate_adapters.go

@@ -176,24 +176,6 @@ func validateAudita(cfg AuditaConfig) error {
 			return fmt.Errorf("pipeline.audita.modules[%d] must be one of: glossary, homophones, spoken_word, grammar", i)
 		}
 	}
-	if strings.TrimSpace(cfg.BaseURL) != "" {
-		u, err := url.Parse(cfg.BaseURL)
-		if err != nil || u.Scheme == "" || u.Host == "" {
-			if err != nil {
-				return fmt.Errorf("pipeline.audita.base_url must be a valid URL: %w", err)
-			}
-			return fmt.Errorf("pipeline.audita.base_url must be a valid URL")
-		}
-	}
-	if cfg.TotalLLMConcurrency != nil && *cfg.TotalLLMConcurrency <= 0 {
-		return fmt.Errorf("pipeline.audita.total_llm_concurrency must be > 0")
-	}
-	if cfg.ProposalLLMConcurrency != nil && *cfg.ProposalLLMConcurrency <= 0 {
-		return fmt.Errorf("pipeline.audita.proposal_llm_concurrency must be > 0")
-	}
-	if cfg.ValidationLLMConcurrency != nil && *cfg.ValidationLLMConcurrency <= 0 {
-		return fmt.Errorf("pipeline.audita.validation_llm_concurrency must be > 0")
-	}
 	if strings.TrimSpace(cfg.TranscriptDescription) == "" && cfg.TranscriptDescription != "" {
 		return fmt.Errorf("pipeline.audita.transcript_description must be non-empty when provided")
 	}
@@ -205,10 +187,5 @@ func validateAudita(cfg AuditaConfig) error {
 	default:
 		return fmt.Errorf("pipeline.audita.output_schema must be one of: bare-segments, audita-v1")
 	}
-	switch strings.TrimSpace(cfg.WorkDirRetention) {
-	case "", "always", "auto", "never":
-	default:
-		return fmt.Errorf("pipeline.audita.work_dir_retention must be one of: always, auto, never")
-	}
 	return nil
 }

internal/manifest/manifest.go

@@ -71,13 +71,13 @@ type StageRecord struct {
 // EffectiveConfigProvenance records bounded non-secret configuration identity
 // for one resolved invocation.
 type EffectiveConfigProvenance struct {
-	SelectedProfile       *SelectedProfileProvenance `json:"selected_profile,omitempty"`
+	SelectedOverlay       *SelectedOverlayProvenance `json:"selected_overlay,omitempty"`
 	EffectiveConfigDigest string                     `json:"effective_config_digest,omitempty"`
 }
 
-// SelectedProfileProvenance identifies an explicitly or default-selected
-// pipeline profile without recording profile content.
-type SelectedProfileProvenance struct {
+// SelectedOverlayProvenance identifies an explicitly or default-selected
+// pipeline overlay without recording overlay content.
+type SelectedOverlayProvenance struct {
 	Name   string `json:"name"`
 	Source string `json:"source"`
 }

internal/manifest/store_test.go

@@ -34,7 +34,7 @@ func TestLocalStoreCreateSaveLoadRoundTrip(t *testing.T) {
 	m.S3SessionPrefix = "dnd/campaigns/forsaken/sessions/2026-05-03/"
 	m.S3RunPrefix = "dnd/campaigns/forsaken/sessions/2026-05-03/runs/20260515T031522Z-a1b2c3d4/"
 	m.EffectiveConfig = &EffectiveConfigProvenance{
-		SelectedProfile:       &SelectedProfileProvenance{Name: "production", Source: "default"},
+		SelectedOverlay:       &SelectedOverlayProvenance{Name: "production", Source: "default"},
 		EffectiveConfigDigest: "001122",
 	}
 
@@ -57,7 +57,7 @@ func TestLocalStoreCreateSaveLoadRoundTrip(t *testing.T) {
 	if loaded.RunID != "20260515T031522Z-a1b2c3d4" {
 		t.Fatalf("RunID = %q, want run id", loaded.RunID)
 	}
-	if loaded.EffectiveConfig == nil || loaded.EffectiveConfig.SelectedProfile == nil || loaded.EffectiveConfig.SelectedProfile.Name != "production" || loaded.EffectiveConfig.EffectiveConfigDigest != "001122" {
+	if loaded.EffectiveConfig == nil || loaded.EffectiveConfig.SelectedOverlay == nil || loaded.EffectiveConfig.SelectedOverlay.Name != "production" || loaded.EffectiveConfig.EffectiveConfigDigest != "001122" {
 		t.Fatalf("effective config provenance = %#v", loaded.EffectiveConfig)
 	}
 	stage, ok := loaded.Stages["prepare"]
@@ -75,6 +75,22 @@ func TestLocalStoreCreateSaveLoadRoundTrip(t *testing.T) {
 	}
 }
 
+func TestLocalStoreRejectsUnknownProvenanceFields(t *testing.T) {
+	for _, tc := range []struct{ name, provenance, field string }{
+		{"retired selection", `{"selected_profile":{"name":"testing","source":"explicit"}}`, "selected_profile"},
+		{"unknown provenance", `{"unexpected":true}`, "unexpected"},
+		{"unknown selection field", `{"selected_overlay":{"name":"testing","source":"explicit","unexpected":true}}`, "unexpected"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			data := `{"schema_version":"narratio.session-manifest.v1","session_id":"2026-05-03","created_at":"2026-05-03T10:00:00Z","updated_at":"2026-05-03T10:00:00Z","effective_config":` + tc.provenance + `,"stages":{}}`
+			_, err := (&LocalStore{}).LoadReader(context.Background(), strings.NewReader(data))
+			if err == nil || !strings.Contains(err.Error(), tc.field) {
+				t.Fatalf("expected rejection identifying %q, got %v", tc.field, err)
+			}
+		})
+	}
+}
+
 func TestLocalStorePreservesOptionalArtifactMetadata(t *testing.T) {
 	store := &LocalStore{}
 	ctx := context.Background()

internal/stage/analyze_execution_state.go

@@ -136,28 +136,26 @@ func (state *analyzeExecutionState) checkpointCollection(
 		return fmt.Errorf("validate analyze artifact collection: %w", err)
 	}
 
-	candidate := *m
-	candidate.Stages = make(map[string]*manifest.StageRecord, len(m.Stages))
-	for name, record := range m.Stages {
-		candidate.Stages[name] = record
-	}
-	analyzeRecord := *m.Stages["analyze"]
-	analyzeRecord.AnalyzeStateVersion = manifest.AnalyzeStateContractVersion
-	analyzeRecord.AnalyzeArtifacts = manifest.CloneAnalyzeArtifactCollection(records)
-	candidate.Stages["analyze"] = &analyzeRecord
-
 	manifestPath := artifacts.SessionManifestPathForCampaign(
 		state.execution.Paths.WorkspaceRoot,
 		m.Campaign,
 		m.SessionID,
 	)
-	if err := state.execution.Env.ManifestStore.Save(ctx, manifestPath, &candidate); err != nil {
-		return fmt.Errorf("save session manifest %q: %w", manifestPath, err)
+	if err := checkpointStageCollection(
+		ctx,
+		state.execution.Env.ManifestStore,
+		manifestPath,
+		m,
+		"analyze",
+		func(record *manifest.StageRecord) error {
+			record.AnalyzeStateVersion = manifest.AnalyzeStateContractVersion
+			record.AnalyzeArtifacts = manifest.CloneAnalyzeArtifactCollection(records)
+			return nil
+		},
+	); err != nil {
+		return err
 	}
 	liveRecord := m.Stages["analyze"]
-	liveRecord.AnalyzeStateVersion = candidate.Stages["analyze"].AnalyzeStateVersion
-	liveRecord.AnalyzeArtifacts = manifest.CloneAnalyzeArtifactCollection(candidate.Stages["analyze"].AnalyzeArtifacts)
-	m.UpdatedAt = candidate.UpdatedAt
 	state.records = manifest.CloneAnalyzeArtifactCollection(liveRecord.AnalyzeArtifacts)
 	state.committedRecords = manifest.CloneAnalyzeArtifactCollection(liveRecord.AnalyzeArtifacts)
 	return nil

internal/stage/checkpoint.go

@@ -0,0 +1,99 @@
+package stage
+
+import (
+	"context"
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
+)
+
+// checkpointStageCollection isolates one stage-owned collection update from
+// live authority until the existing manifest store reports a successful save.
+// Callers own serialization and all stage-specific validation and policy.
+func checkpointStageCollection(
+	ctx context.Context,
+	store manifest.Store,
+	path string,
+	live *manifest.Manifest,
+	stageName string,
+	update func(*manifest.StageRecord) error,
+) error {
+	if live == nil {
+		return fmt.Errorf("session manifest is required")
+	}
+	if store == nil {
+		return fmt.Errorf("manifest store is required")
+	}
+	if update == nil {
+		return fmt.Errorf("checkpoint update is required")
+	}
+
+	candidate := cloneManifestForCheckpoint(live)
+	if candidate.Stages == nil {
+		candidate.Stages = make(map[string]*manifest.StageRecord)
+	}
+	target, exists := candidate.Stages[stageName]
+	if !exists {
+		target = &manifest.StageRecord{}
+		candidate.Stages[stageName] = target
+	} else if target == nil {
+		// Retain the invalid nil entry for Store.Save to reject rather than
+		// silently repairing manifest state. The detached record only gives the
+		// typed update a safe value to operate on before that validation.
+		target = &manifest.StageRecord{}
+	}
+	if err := update(target); err != nil {
+		return fmt.Errorf("update stage %q checkpoint: %w", stageName, err)
+	}
+	if err := store.Save(ctx, path, candidate); err != nil {
+		return fmt.Errorf("save session manifest %q: %w", path, err)
+	}
+
+	savedRecord := cloneStageRecordForCheckpoint(candidate.Stages[stageName])
+	if savedRecord == nil {
+		return fmt.Errorf("saved stage %q checkpoint record is nil", stageName)
+	}
+	if live.Stages != nil {
+		if current := live.Stages[stageName]; current != nil {
+			*current = *savedRecord
+		} else {
+			live.Stages[stageName] = savedRecord
+		}
+	} else {
+		live.Stages = map[string]*manifest.StageRecord{stageName: savedRecord}
+	}
+	live.UpdatedAt = candidate.UpdatedAt
+	return nil
+}
+
+// cloneManifestForCheckpoint copies the bounded mutable state touched by the
+// two checkpoint callbacks or by manifest.LocalStore.Save. Metadata maps and
+// other pointer fields remain shared read-only because neither boundary mutates
+// them.
+func cloneManifestForCheckpoint(source *manifest.Manifest) *manifest.Manifest {
+	clone := *source
+	clone.Inputs = append([]manifest.InputRecord(nil), source.Inputs...)
+	clone.Artifacts = append([]manifest.ArtifactRecord(nil), source.Artifacts...)
+	if source.Stages == nil {
+		clone.Stages = nil
+		return &clone
+	}
+	clone.Stages = make(map[string]*manifest.StageRecord, len(source.Stages))
+	for name, sourceRecord := range source.Stages {
+		clone.Stages[name] = cloneStageRecordForCheckpoint(sourceRecord)
+	}
+	return &clone
+}
+
+func cloneStageRecordForCheckpoint(source *manifest.StageRecord) *manifest.StageRecord {
+	if source == nil {
+		return nil
+	}
+	clone := *source
+	clone.Outputs = append([]manifest.ArtifactRecord(nil), source.Outputs...)
+	clone.Logs = append([]string(nil), source.Logs...)
+	clone.GeneratedConfigs = append([]string(nil), source.GeneratedConfigs...)
+	clone.TranscribeSpeakers = manifest.CloneTranscribeSpeakerCollection(source.TranscribeSpeakers)
+	clone.AnalyzeArtifacts = manifest.CloneAnalyzeArtifactCollection(source.AnalyzeArtifacts)
+	return &clone
+}

internal/stage/checkpoint_test.go

@@ -0,0 +1,327 @@
+package stage
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"path/filepath"
+	"reflect"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
+)
+
+func TestCheckpointStageCollectionSavesThenPromotesTarget(t *testing.T) {
+	now := time.Date(2026, 9, 22, 12, 0, 0, 0, time.UTC)
+	live := checkpointTestManifest(now)
+	originalAnalyze := live.Stages["analyze"]
+	originalTranscribe := live.Stages["transcribe"]
+	originalMerge := live.Stages["merge"]
+	replacement := map[string]manifest.AnalyzeArtifactRecord{
+		"result": checkpointAnalyzeRecord(now.Add(time.Minute), []string{"zeta", "alpha"}),
+	}
+	path := filepath.Join(t.TempDir(), "manifest.json")
+	base := &manifest.LocalStore{}
+	store := &checkpointBoundaryStore{
+		Store: base,
+		BeforeSave: func(candidate *manifest.Manifest) {
+			if live.Stages["analyze"] != originalAnalyze || len(originalAnalyze.AnalyzeArtifacts) != 1 {
+				t.Fatal("live analyze authority changed before save")
+			}
+			if candidate.Stages["analyze"] == originalAnalyze || candidate.Stages["transcribe"] == originalTranscribe {
+				t.Fatal("checkpoint candidate shares stage records with live manifest")
+			}
+		},
+	}
+
+	err := checkpointStageCollection(context.Background(), store, path, live, "analyze", func(record *manifest.StageRecord) error {
+		record.AnalyzeStateVersion = manifest.AnalyzeStateContractVersion
+		record.AnalyzeArtifacts = replacement
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("checkpointStageCollection() error = %v", err)
+	}
+	if store.Calls != 1 {
+		t.Fatalf("Save calls = %d, want 1", store.Calls)
+	}
+	if live.Stages["analyze"] != originalAnalyze {
+		t.Fatal("existing target record pointer identity changed")
+	}
+	if live.Stages["transcribe"] != originalTranscribe || live.Stages["merge"] != originalMerge {
+		t.Fatal("unrelated stage record identity changed")
+	}
+	if originalAnalyze.Status != manifest.StatusRunning || originalAnalyze.Outputs[0].LocalPath != "artifacts/aggregate.md" {
+		t.Fatalf("aggregate analyze data changed = %#v", originalAnalyze)
+	}
+	if got := originalAnalyze.AnalyzeArtifacts["result"].Dependencies; !slices.Equal(got, []string{"alpha", "zeta"}) {
+		t.Fatalf("promoted dependencies = %#v, want normalized saved state", got)
+	}
+	if !live.UpdatedAt.After(now) {
+		t.Fatalf("live UpdatedAt = %v, want save timestamp after %v", live.UpdatedAt, now)
+	}
+
+	durable, err := base.Load(context.Background(), path)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if !reflect.DeepEqual(durable.Stages["analyze"], live.Stages["analyze"]) {
+		t.Fatalf("durable analyze = %#v, live = %#v", durable.Stages["analyze"], live.Stages["analyze"])
+	}
+	if !reflect.DeepEqual(durable.Stages["transcribe"], originalTranscribe) || !reflect.DeepEqual(durable.Stages["merge"], originalMerge) {
+		t.Fatal("unrelated durable stage data changed")
+	}
+
+	changed := replacement["result"]
+	changed.Status = manifest.AnalyzeArtifactFailed
+	changed.Dependencies[0] = "changed"
+	replacement["result"] = changed
+	if got := live.Stages["analyze"].AnalyzeArtifacts["result"]; got.Status != manifest.AnalyzeArtifactMissing || got.Dependencies[0] != "alpha" {
+		t.Fatalf("caller edits mutated committed record = %#v", got)
+	}
+}
+
+func TestCheckpointStageCollectionFailureLeavesLiveAuthorityUnchanged(t *testing.T) {
+	t.Run("update", func(t *testing.T) {
+		live := checkpointTestManifest(time.Now().UTC())
+		before := checkpointManifestJSON(t, live)
+		cause := errors.New("update failed")
+		store := &checkpointBoundaryStore{Store: &manifest.LocalStore{}}
+		err := checkpointStageCollection(context.Background(), store, filepath.Join(t.TempDir(), "manifest.json"), live, "analyze", func(record *manifest.StageRecord) error {
+			record.AnalyzeArtifacts = map[string]manifest.AnalyzeArtifactRecord{}
+			return cause
+		})
+		if !errors.Is(err, cause) {
+			t.Fatalf("error = %v, want update cause", err)
+		}
+		if store.Calls != 0 {
+			t.Fatalf("Save calls = %d, want 0", store.Calls)
+		}
+		assertCheckpointManifestJSON(t, live, before)
+	})
+
+	t.Run("validation", func(t *testing.T) {
+		live := checkpointTestManifest(time.Now().UTC())
+		before := checkpointManifestJSON(t, live)
+		store := &checkpointBoundaryStore{Store: &manifest.LocalStore{}}
+		path := filepath.Join(t.TempDir(), "manifest.json")
+		err := checkpointStageCollection(context.Background(), store, path, live, "analyze", func(record *manifest.StageRecord) error {
+			record.Name = "wrong-stage"
+			return nil
+		})
+		if err == nil {
+			t.Fatal("error = nil, want manifest validation failure")
+		}
+		if store.Calls != 1 {
+			t.Fatalf("Save calls = %d, want 1", store.Calls)
+		}
+		assertCheckpointManifestJSON(t, live, before)
+	})
+
+	t.Run("save after candidate mutation", func(t *testing.T) {
+		now := time.Date(2026, 9, 22, 12, 0, 0, 0, time.UTC)
+		live := checkpointTestManifest(now)
+		analyze := live.Stages["analyze"].AnalyzeArtifacts["result"]
+		analyze.Dependencies = []string{"zeta", "alpha"}
+		live.Stages["analyze"].AnalyzeArtifacts["result"] = analyze
+		before := checkpointManifestJSON(t, live)
+		cause := errors.New("save failed after mutation")
+		store := &checkpointBoundaryStore{Store: &manifest.LocalStore{}, ReturnErr: cause}
+		path := filepath.Join(t.TempDir(), "manifest.json")
+		replacement := checkpointTranscribeCollection("bob", "run-2")
+		err := checkpointStageCollection(context.Background(), store, path, live, "transcribe", func(record *manifest.StageRecord) error {
+			record.TranscribeStateVersion = manifest.TranscribeStateContractVersion
+			record.TranscribeSpeakers = replacement
+			return nil
+		})
+		if !errors.Is(err, cause) {
+			t.Fatalf("error = %v, want save cause", err)
+		}
+		if !strings.Contains(err.Error(), path) {
+			t.Fatalf("error = %q, want manifest path context", err)
+		}
+		if store.Calls != 1 || store.SavedCandidate == nil {
+			t.Fatalf("Save calls/candidate = %d/%p, want one observed candidate", store.Calls, store.SavedCandidate)
+		}
+		if !store.SavedCandidate.UpdatedAt.After(now) {
+			t.Fatalf("candidate UpdatedAt = %v, want Store.Save mutation", store.SavedCandidate.UpdatedAt)
+		}
+		if got := store.SavedCandidate.Stages["analyze"].AnalyzeArtifacts["result"].Dependencies; !slices.Equal(got, []string{"alpha", "zeta"}) {
+			t.Fatalf("candidate dependencies = %#v, want save-time normalization", got)
+		}
+		if got := live.Stages["analyze"].AnalyzeArtifacts["result"].Dependencies; !slices.Equal(got, []string{"zeta", "alpha"}) {
+			t.Fatalf("live dependencies = %#v, save-time normalization leaked", got)
+		}
+		assertCheckpointManifestJSON(t, live, before)
+
+		changed := replacement["bob"]
+		changed.AudioPath = "audio/changed.flac"
+		replacement["bob"] = changed
+		if got := live.Stages["transcribe"].TranscribeSpeakers; len(got) != 1 || got["alice"].AudioPath != "audio/alice.flac" {
+			t.Fatalf("failed save changed live transcribe collection = %#v", got)
+		}
+	})
+}
+
+func TestCheckpointStageCollectionMissingTargetAppearsOnlyAfterSuccess(t *testing.T) {
+	now := time.Date(2026, 9, 22, 12, 0, 0, 0, time.UTC)
+	live := checkpointTestManifest(now)
+	delete(live.Stages, "transcribe")
+	path := filepath.Join(t.TempDir(), "manifest.json")
+	cause := errors.New("save failed")
+	failing := &checkpointBoundaryStore{Store: &manifest.LocalStore{}, ReturnErr: cause}
+	update := func(record *manifest.StageRecord) error {
+		record.Name = "transcribe"
+		record.Status = manifest.StatusRunning
+		record.CreatedAt = now
+		record.UpdatedAt = now
+		record.TranscribeStateVersion = manifest.TranscribeStateContractVersion
+		record.TranscribeSpeakers = checkpointTranscribeCollection("alice", "run-1")
+		return nil
+	}
+
+	if err := checkpointStageCollection(context.Background(), failing, path, live, "transcribe", update); !errors.Is(err, cause) {
+		t.Fatalf("failed checkpoint error = %v, want %v", err, cause)
+	}
+	if _, exists := live.Stages["transcribe"]; exists {
+		t.Fatal("missing live target was allocated after failed save")
+	}
+
+	successPath := filepath.Join(t.TempDir(), "manifest.json")
+	if err := checkpointStageCollection(context.Background(), &manifest.LocalStore{}, successPath, live, "transcribe", update); err != nil {
+		t.Fatalf("successful checkpoint error = %v", err)
+	}
+	created := live.Stages["transcribe"]
+	if created == nil || created.Name != "transcribe" || created.Status != manifest.StatusRunning {
+		t.Fatalf("promoted missing target = %#v", created)
+	}
+	durable, err := (&manifest.LocalStore{}).Load(context.Background(), successPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if !reflect.DeepEqual(durable.Stages["transcribe"], created) {
+		t.Fatalf("durable target = %#v, live = %#v", durable.Stages["transcribe"], created)
+	}
+}
+
+func TestCheckpointStageCollectionPreservesContextAndRequiredInputs(t *testing.T) {
+	now := time.Now().UTC()
+	live := checkpointTestManifest(now)
+	path := filepath.Join(t.TempDir(), "manifest.json")
+	update := func(*manifest.StageRecord) error { return nil }
+	store := &checkpointBoundaryStore{Store: &manifest.LocalStore{}}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	before := checkpointManifestJSON(t, live)
+	err := checkpointStageCollection(ctx, store, path, live, "analyze", update)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("canceled error = %v, want context.Canceled", err)
+	}
+	if !strings.Contains(err.Error(), path) {
+		t.Fatalf("canceled error = %q, want manifest path context", err)
+	}
+	assertCheckpointManifestJSON(t, live, before)
+
+	if err := checkpointStageCollection(context.Background(), store, path, nil, "analyze", update); err == nil {
+		t.Fatal("nil live manifest error = nil")
+	}
+	if err := checkpointStageCollection(context.Background(), nil, path, live, "analyze", update); err == nil {
+		t.Fatal("nil store error = nil")
+	}
+	if err := checkpointStageCollection(context.Background(), store, path, live, "analyze", nil); err == nil {
+		t.Fatal("nil update error = nil")
+	}
+}
+
+type checkpointBoundaryStore struct {
+	manifest.Store
+	Calls          int
+	BeforeSave     func(*manifest.Manifest)
+	ReturnErr      error
+	SavedCandidate *manifest.Manifest
+}
+
+func (store *checkpointBoundaryStore) Save(ctx context.Context, path string, candidate *manifest.Manifest) error {
+	store.Calls++
+	if store.BeforeSave != nil {
+		store.BeforeSave(candidate)
+	}
+	if err := store.Store.Save(ctx, path, candidate); err != nil {
+		return err
+	}
+	store.SavedCandidate = candidate
+	return store.ReturnErr
+}
+
+func checkpointTestManifest(now time.Time) *manifest.Manifest {
+	live := manifest.New("session-1", now)
+	live.Campaign = "campaign-1"
+	live.RunID = "run-1"
+	live.Inputs = []manifest.InputRecord{{Kind: "audio", Path: "audio/alice.flac"}}
+	live.Artifacts = []manifest.ArtifactRecord{{Kind: "existing", LocalPath: "artifacts/existing.json"}}
+	live.Stages["analyze"] = &manifest.StageRecord{
+		Name: "analyze", Status: manifest.StatusRunning, CreatedAt: now, UpdatedAt: now,
+		Outputs:             []manifest.ArtifactRecord{{Kind: "analysis", LocalPath: "artifacts/aggregate.md"}},
+		Logs:                []string{"runs/run-1/analyze.log"},
+		GeneratedConfigs:    []string{"runs/run-1/analyze.yml"},
+		Metadata:            map[string]any{"shared_read_only": true},
+		AnalyzeStateVersion: manifest.AnalyzeStateContractVersion,
+		AnalyzeArtifacts: map[string]manifest.AnalyzeArtifactRecord{
+			"result": checkpointAnalyzeRecord(now, []string{"old_dependency"}),
+		},
+	}
+	live.Stages["transcribe"] = &manifest.StageRecord{
+		Name: "transcribe", Status: manifest.StatusFailed, CreatedAt: now, UpdatedAt: now,
+		TranscribeStateVersion: manifest.TranscribeStateContractVersion,
+		TranscribeSpeakers:     checkpointTranscribeCollection("alice", "run-1"),
+	}
+	live.Stages["merge"] = &manifest.StageRecord{
+		Name: "merge", Status: manifest.StatusSucceeded, CreatedAt: now, UpdatedAt: now,
+		Outputs: []manifest.ArtifactRecord{{Kind: "transcript_base", LocalPath: "transcripts/base.json"}},
+	}
+	return live
+}
+
+func checkpointAnalyzeRecord(now time.Time, dependencies []string) manifest.AnalyzeArtifactRecord {
+	return manifest.AnalyzeArtifactRecord{
+		Key: "result", Status: manifest.AnalyzeArtifactMissing,
+		Dependencies: dependencies, ProducerRunID: "run-1", UpdatedAt: now,
+	}
+}
+
+func checkpointTranscribeCollection(speaker, runID string) map[string]manifest.TranscribeSpeakerRecord {
+	return map[string]manifest.TranscribeSpeakerRecord{
+		speaker: {
+			FingerprintVersion: manifest.TranscribeFingerprintContractVersion,
+			Fingerprint:        strings.Repeat("b", 64),
+			AudioPath:          "audio/" + speaker + ".flac",
+			AudioSHA256:        strings.Repeat("a", 64),
+			AudioSize:          0,
+			Output: manifest.ArtifactRecord{
+				Kind: "transcript_raw", LocalPath: "transcripts/raw/" + speaker + ".json",
+				Checksum: strings.Repeat("c", 64), ProducerRunID: runID,
+			},
+			OutputSize: 1, ProducerRunID: runID,
+		},
+	}
+}
+
+func checkpointManifestJSON(t *testing.T, value *manifest.Manifest) []byte {
+	t.Helper()
+	data, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("Marshal() error = %v", err)
+	}
+	return data
+}
+
+func assertCheckpointManifestJSON(t *testing.T, value *manifest.Manifest, want []byte) {
+	t.Helper()
+	if got := checkpointManifestJSON(t, value); !slices.Equal(got, want) {
+		t.Fatalf("live manifest changed on failure\ngot:  %s\nwant: %s", got, want)
+	}
+}

internal/stage/extract.go

@@ -146,7 +146,7 @@ func (extractStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (re
 		chunkCache = "refresh"
 	}
 	request := notarius.RunRequest{
-		Binary: resolvedBinary, LLMAPIKey: notariusConfig.LLMAPIKey, ConfigProfile: notariusConfig.ConfigProfile,
+		Binary: resolvedBinary, Credentials: notariusConfig.Credentials, ConfigProfile: notariusConfig.ConfigProfile,
 		ConfigPath: configPath, PipelineID: notariusConfig.PipelineID,
 		InputPath: inputPath, OutputRoot: outputRoot, WorkingDirectory: workingDirectory,
 		ReceiptPath: receiptPath, LogPath: logPath, Timeout: timeout, Resume: resume, ChunkCache: chunkCache, References: referenceBindings,

internal/stage/extract_test.go

@@ -61,7 +61,7 @@ func TestExtractStageResolvesManifestInputAndBuildsExactRequest(t *testing.T) {
   transcribe_url: https://transcription.example.test/transcribe
 notarius:
   enabled: false
-  llm_api_key: NARRATIO_EXTRACT_NOTARIUS_KEY
+  credentials: [NARRATIO_EXTRACT_NOTARIUS_KEY]
 `), 0o644); err != nil {
 		t.Fatal(err)
 	}
@@ -71,7 +71,7 @@ notarius:
 	}
 
 	env, m, fake := setupExtractEnv(t)
-	env.Config.Pipeline.Notarius.LLMAPIKey = loadedPipeline.Notarius.LLMAPIKey
+	env.Config.Pipeline.Notarius.Credentials = loadedPipeline.Notarius.Credentials
 	configProfile := "inexpensive"
 	env.Config.Pipeline.Notarius.ConfigProfile = &configProfile
 	result, err := (extractStage{}).Run(context.Background(), env, m)
@@ -103,7 +103,7 @@ notarius:
 	if req.Resume || req.ChunkCache != "" {
 		t.Fatalf("default cache controls = resume %v, mode %q", req.Resume, req.ChunkCache)
 	}
-	if req.LLMAPIKey != loadedPipeline.Notarius.LLMAPIKey || req.LLMAPIKey.EnvName() != credentialName || !req.LLMAPIKey.IsResolved() {
+	if len(req.Credentials) != 1 || req.Credentials[0].EnvName() != credentialName || !req.Credentials[0].IsResolved() {
 		t.Fatal("request did not retain the loaded Notarius credential reference")
 	}
 	if req.ConfigProfile == nil || *req.ConfigProfile != configProfile {

internal/stage/polish.go

@@ -67,43 +67,28 @@ func (polishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*St
 	if err != nil {
 		return nil, fmt.Errorf("polish: resolve run-local processed transcript path: %w", err)
 	}
-	canonicalReportPath := filepath.Join(paths.ArtifactsDir, "audita.report.json")
-	reportPath := canonicalReportPath
-	if runLayout.Enabled {
-		reportPath, err = runLocalPathForCanonical(runLayout, paths, canonicalReportPath)
-		if err != nil {
-			return nil, fmt.Errorf("polish: resolve run-local report path: %w", err)
-		}
-	}
-	workDir := filepath.Join(paths.ArtifactsDir, "audita-work")
 	stdoutPath := filepath.Join(paths.LogsDir, "audita.stdout.log")
 	stderrPath := filepath.Join(paths.LogsDir, "audita.stderr.log")
 	generatedConfigPath := filepath.Join(paths.ConfigDir, "audita.generated.yml")
 	if runLayout.Enabled {
-		workDir = filepath.Join(runLayout.ScratchDir, "audita-work")
 		stdoutPath = filepath.Join(runLayout.LogsDir, "audita.stdout.log")
 		stderrPath = filepath.Join(runLayout.LogsDir, "audita.stderr.log")
 		generatedConfigPath = filepath.Join(runLayout.ConfigDir, "audita.generated.yml")
 	}
 
-	reportEnabled := env.Config.Pipeline.Audita.Report != nil && *env.Config.Pipeline.Audita.Report
 	req := audita.PolishRequest{
 		GeneratedConfigPath:  generatedConfigPath,
 		MergedTranscriptPath: mergedPath,
 		OutputProcessedPath:  processedPath,
 		GlossaryPath:         glossaryPath,
-		ReportPath:           "",
-		WorkDir:              workDir,
 		StdoutLogPath:        stdoutPath,
 		StderrLogPath:        stderrPath,
 	}
-	if reportEnabled {
-		req.ReportPath = reportPath
-	}
 
 	res, err := env.Audita.Run(ctx, req)
 	if err != nil {
-		return nil, fmt.Errorf("polish: audita polish failed: %w", err)
+		return nil, fmt.Errorf("polish: audita polish failed (output_dir=%q, stdout_log=%q, stderr_log=%q): %w",
+			filepath.Dir(processedPath), stdoutPath, stderrPath, err)
 	}
 
 	finalProcessedPath, err := authoritativeOutputPath(processedPath, res.ProcessedTranscriptPath)
@@ -113,15 +98,26 @@ func (polishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*St
 	if err := validateProcessedTranscriptOutput(finalProcessedPath); err != nil {
 		return nil, fmt.Errorf("polish: processed transcript %q invalid: %w", finalProcessedPath, err)
 	}
-
-	finalReportPath, err := authoritativeOutputPath(req.ReportPath, res.ReportPath)
-	if err != nil {
-		return nil, fmt.Errorf("polish: %w", err)
-	}
-	if reportEnabled {
-		if err := validateTranscriptJSONFile(finalReportPath); err != nil {
-			return nil, fmt.Errorf("polish: report %q invalid: %w", finalReportPath, err)
+	reportPaths := make([]string, 0, 3)
+	reportMetadata := map[string]string{}
+	for _, report := range []struct{ name, returned string }{
+		{"errors.yml", res.Reports.ErrorsPath},
+		{"recoveries.yml", res.Reports.RecoveriesPath},
+		{"report.md", res.Reports.OverviewPath},
+	} {
+		if report.returned == "" {
+			continue
 		}
+		expected := filepath.Join(filepath.Dir(processedPath), report.name)
+		path, err := authoritativeOutputPath(expected, report.returned)
+		if err != nil {
+			return nil, fmt.Errorf("polish: report %s: %w", report.name, err)
+		}
+		if err := requireRegularReadableFile(path, "audita report"); err != nil {
+			return nil, fmt.Errorf("polish: %w", err)
+		}
+		reportPaths = append(reportPaths, path)
+		reportMetadata[report.name] = path
 	}
 
 	materializedProcessed, err := materializeRunLocalOutput(env.ArtifactStore, finalProcessedPath, canonicalProcessedPath, artifacts.Ref{
@@ -133,39 +129,6 @@ func (polishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*St
 		return nil, fmt.Errorf("polish: materialize canonical polished transcript: %w", err)
 	}
 	outputs := []artifacts.Ref{materializedProcessed}
-	if reportEnabled {
-		materializedReport, err := materializeRunLocalOutput(env.ArtifactStore, finalReportPath, canonicalReportPath, artifacts.Ref{
-			Kind:      "audita_report",
-			Category:  "artifacts",
-			SessionID: sessionID,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("polish: materialize canonical report: %w", err)
-		}
-		outputs = append(outputs, materializedReport)
-	}
-
-	var validationConcurrency any
-	if env.Config.Pipeline.Audita.ValidationLLMConcurrency != nil {
-		validationConcurrency = *env.Config.Pipeline.Audita.ValidationLLMConcurrency
-	}
-	var totalLLMConcurrency any
-	if env.Config.Pipeline.Audita.TotalLLMConcurrency != nil {
-		totalLLMConcurrency = *env.Config.Pipeline.Audita.TotalLLMConcurrency
-	}
-	var proposalLLMConcurrency any
-	if env.Config.Pipeline.Audita.ProposalLLMConcurrency != nil {
-		proposalLLMConcurrency = *env.Config.Pipeline.Audita.ProposalLLMConcurrency
-	}
-	reportCanonicalPath := ""
-	if reportEnabled {
-		reportCanonicalPath = canonicalReportPath
-	}
-	credentialReference := ""
-	if env.Config.Pipeline.Audita.LLMAPIKey != nil {
-		credentialReference = env.Config.Pipeline.Audita.LLMAPIKey.EnvName()
-	}
-
 	meta := map[string]any{
 		"stage":                         "polish",
 		"merged_transcript_path":        mergedPath,
@@ -173,22 +136,13 @@ func (polishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*St
 		"glossary_path":                 glossaryPath,
 		"run_output_path":               finalProcessedPath,
 		"output_path":                   canonicalProcessedPath,
-		"run_report_path":               finalReportPath,
-		"report_path":                   reportCanonicalPath,
-		"audita_work_dir":               workDir,
-		"report_enabled":                reportEnabled,
-		"modules":                       append([]string(nil), env.Config.Pipeline.Audita.Modules...),
-		"base_url":                      env.Config.Pipeline.Audita.BaseURL,
-		"model":                         env.Config.Pipeline.Audita.Model,
+		"modules":                       append(env.Config.Pipeline.Audita.Modules[:0:0], env.Config.Pipeline.Audita.Modules...),
+		"overlay":                       env.Config.Pipeline.Audita.Overlay,
+		"proposal_profile":              env.Config.Pipeline.Audita.ProposalProfile,
+		"validation_profile":            env.Config.Pipeline.Audita.ValidationProfile,
 		"transcript_description":        env.Config.Pipeline.Audita.TranscriptDescription,
 		"config_path":                   env.Config.Pipeline.Audita.ConfigPath,
 		"output_schema":                 env.Config.Pipeline.Audita.OutputSchema,
-		"work_dir_retention":            env.Config.Pipeline.Audita.WorkDirRetention,
-		"validation_model":              env.Config.Pipeline.Audita.ValidationModel,
-		"total_llm_concurrency":         totalLLMConcurrency,
-		"proposal_llm_concurrency":      proposalLLMConcurrency,
-		"validation_llm_concurrency":    validationConcurrency,
-		"llm_api_key":                   credentialReference,
 		"timeout":                       env.Config.Pipeline.Audita.Timeout,
 		"binary":                        env.Config.Pipeline.Audita.Binary,
 		"generated_config_path":         generatedConfigPath,
@@ -198,27 +152,18 @@ func (polishStage) Run(ctx context.Context, env *Env, m *manifest.Manifest) (*St
 		"adapter_exit_code":             res.ExitCode,
 		"adapter_invoked_binary":        res.InvokedBinary,
 		"adapter_processed_output_path": res.ProcessedTranscriptPath,
-		"adapter_report_path":           res.ReportPath,
 		"adapter_generated_config_path": res.GeneratedConfigPath,
-		"adapter_work_dir":              res.WorkDir,
 		"adapter_stdout_log_path":       res.StdoutLogPath,
 		"adapter_stderr_log_path":       res.StderrLogPath,
-		"credential_env_var":            credentialReference,
-		"credential_present":            false,
+		"report_paths":                  reportMetadata,
 	}
 	if res.Metadata != nil {
 		meta["adapter_metadata"] = res.Metadata
-		if value, ok := res.Metadata["credential_present"]; ok {
-			meta["credential_present"] = value
-		}
-		if value, ok := res.Metadata["credential_env_var"]; ok {
-			meta["credential_env_var"] = value
-		}
 	}
 
 	return &StageResult{
 		Outputs:          outputs,
-		Logs:             []string{stdoutPath, stderrPath},
+		Logs:             append([]string{stdoutPath, stderrPath}, reportPaths...),
 		GeneratedConfigs: []string{generatedConfigPath},
 		Metadata:         meta,
 	}, nil

internal/stage/polish_test.go

@@ -3,17 +3,26 @@ package stage
 import (
 	"context"
 	"errors"
+	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/adapters/audita"
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 	"gitea.maximumdirect.net/eric/narratio/internal/manifest"
 )
 
+type polishRunnerFunc func(context.Context, audita.PolishRequest) (audita.PolishResult, error)
+
+func (run polishRunnerFunc) Run(ctx context.Context, req audita.PolishRequest) (audita.PolishResult, error) {
+	return run(ctx, req)
+}
+
 func TestPolishStagePolishesMergedTranscriptAndRecordsMetadata(t *testing.T) {
 	env, m := setupPolishEnv(t)
 	paths := sessionPathsForEnv(env, m.SessionID)
@@ -43,20 +52,20 @@ func TestPolishStagePolishesMergedTranscriptAndRecordsMetadata(t *testing.T) {
 	if req.GlossaryPath != filepath.Join(paths.InputsDir, "glossary.yml") {
 		t.Fatalf("glossary path = %q", req.GlossaryPath)
 	}
-	if req.WorkDir != filepath.Join(paths.ArtifactsDir, "audita-work") {
-		t.Fatalf("work dir = %q", req.WorkDir)
-	}
-	if len(result.Outputs) != 2 {
-		t.Fatalf("outputs len = %d, want 2", len(result.Outputs))
+	if len(result.Outputs) != 1 {
+		t.Fatalf("outputs len = %d, want 1", len(result.Outputs))
 	}
 	if result.Outputs[0].Kind != "transcript_polished" {
 		t.Fatalf("output[0] kind = %q, want transcript_polished", result.Outputs[0].Kind)
 	}
-	if result.Outputs[1].Kind != "audita_report" {
-		t.Fatalf("output[1] kind = %q, want audita_report", result.Outputs[1].Kind)
+	if len(result.Logs) != 5 {
+		t.Fatalf("logs = %#v, want stdout, stderr, and three reports", result.Logs)
 	}
-	if len(result.Logs) != 2 {
-		t.Fatalf("logs = %#v, want 2", result.Logs)
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		path := filepath.Join(filepath.Dir(req.OutputProcessedPath), name)
+		if !slices.Contains(result.Logs, path) {
+			t.Fatalf("report %q missing from diagnostics: %#v", path, result.Logs)
+		}
 	}
 	if len(result.GeneratedConfigs) != 1 {
 		t.Fatalf("generated configs = %#v, want 1", result.GeneratedConfigs)
@@ -65,21 +74,12 @@ func TestPolishStagePolishesMergedTranscriptAndRecordsMetadata(t *testing.T) {
 	if result.Metadata["stage"] != "polish" {
 		t.Fatalf("metadata stage = %#v, want polish", result.Metadata["stage"])
 	}
-	if result.Metadata["report_enabled"] != true {
-		t.Fatalf("metadata report_enabled = %#v, want true", result.Metadata["report_enabled"])
-	}
-	if result.Metadata["audita_work_dir"] != filepath.Join(paths.ArtifactsDir, "audita-work") {
-		t.Fatalf("metadata audita_work_dir = %#v", result.Metadata["audita_work_dir"])
-	}
-	if result.Metadata["total_llm_concurrency"] != 3 {
-		t.Fatalf("metadata total_llm_concurrency = %#v, want 3", result.Metadata["total_llm_concurrency"])
-	}
-	if result.Metadata["proposal_llm_concurrency"] != 2 {
-		t.Fatalf("metadata proposal_llm_concurrency = %#v, want 2", result.Metadata["proposal_llm_concurrency"])
-	}
 	if result.Metadata["output_schema"] != "audita-v1" {
 		t.Fatalf("metadata output_schema = %#v, want audita-v1", result.Metadata["output_schema"])
 	}
+	if _, err := os.Stat(filepath.Join(paths.ArtifactsDir, "audita.report.json")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("legacy report destination exists: %v", err)
+	}
 }
 
 func TestPolishStageRejectsIncidentalMergedTranscriptPath(t *testing.T) {
@@ -166,6 +166,58 @@ func TestPolishStageFailsWhenAdapterFails(t *testing.T) {
 	}
 }
 
+func TestPolishStageDoesNotPromoteTranscriptAfterAdapterFailure(t *testing.T) {
+	env, m := setupPolishEnv(t)
+	env.Config.Session.Campaign = "sample-campaign"
+	m.Campaign = "sample-campaign"
+	m.RunID = "20260518T010203Z-abcdef12"
+	paths := sessionPathsForEnv(env, m.SessionID)
+	mergedPath := filepath.Join(paths.TranscriptsDir, "base.json")
+	writeFile(t, mergedPath, `{"segments":[]}`)
+	setCurrentBuiltInEvidence(t, m, "merge", artifacts.TranscriptOutputKindBase, artifacts.ArtifactTranscriptBase, mergedPath)
+	writeFile(t, filepath.Join(paths.InputsDir, "glossary.yml"), "terms: []\n")
+	failure := errors.New("audita exited after output")
+	var runOutput string
+	env.Audita = polishRunnerFunc(func(_ context.Context, req audita.PolishRequest) (audita.PolishResult, error) {
+		runOutput = req.OutputProcessedPath
+		writeFile(t, runOutput, `{"segments":[]}`)
+		writeFile(t, filepath.Join(filepath.Dir(runOutput), "errors.yml"), "status: failed\n")
+		return audita.PolishResult{ProcessedTranscriptPath: runOutput}, failure
+	})
+	_, err := (polishStage{}).Run(context.Background(), env, m)
+	if !errors.Is(err, failure) || !strings.Contains(err.Error(), filepath.Dir(runOutput)) {
+		t.Fatalf("error = %v, want original failure with output directory", err)
+	}
+	if _, err := os.Stat(filepath.Join(paths.TranscriptsDir, "polished.json")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("failed output was promoted: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(filepath.Dir(runOutput), "errors.yml")); err != nil {
+		t.Fatalf("run-local diagnostic missing: %v", err)
+	}
+}
+
+func TestPolishStageRejectsRedirectedReportPath(t *testing.T) {
+	env, m := setupPolishEnv(t)
+	env.Config.Session.Campaign = "sample-campaign"
+	m.Campaign = "sample-campaign"
+	m.RunID = "20260518T010203Z-abcdef12"
+	paths := sessionPathsForEnv(env, m.SessionID)
+	mergedPath := filepath.Join(paths.TranscriptsDir, "base.json")
+	writeFile(t, mergedPath, `{"segments":[]}`)
+	setCurrentBuiltInEvidence(t, m, "merge", artifacts.TranscriptOutputKindBase, artifacts.ArtifactTranscriptBase, mergedPath)
+	writeFile(t, filepath.Join(paths.InputsDir, "glossary.yml"), "terms: []\n")
+	redirected := filepath.Join(t.TempDir(), "errors.yml")
+	writeFile(t, redirected, "status: completed\n")
+	env.Audita = &audita.FakeRunner{Result: audita.PolishResult{Reports: audita.ReportBundle{ErrorsPath: redirected}}}
+	_, err := (polishStage{}).Run(context.Background(), env, m)
+	if err == nil || !strings.Contains(err.Error(), "did not match requested path") {
+		t.Fatalf("error = %v, want authoritative report path rejection", err)
+	}
+	if _, err := os.Stat(filepath.Join(paths.TranscriptsDir, "polished.json")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("report-path failure promoted output: %v", err)
+	}
+}
+
 func TestPolishStageFailsWhenProcessedOutputInvalid(t *testing.T) {
 	env, m := setupPolishEnv(t)
 	paths := sessionPathsForEnv(env, m.SessionID)
@@ -185,25 +237,6 @@ func TestPolishStageFailsWhenProcessedOutputInvalid(t *testing.T) {
 	}
 }
 
-func TestPolishStageFailsWhenReportInvalid(t *testing.T) {
-	env, m := setupPolishEnv(t)
-	paths := sessionPathsForEnv(env, m.SessionID)
-	writeFile(t, filepath.Join(paths.TranscriptsDir, "base.json"), `{"segments":[]}`)
-	setCurrentBuiltInEvidence(t, m, "merge", artifacts.TranscriptOutputKindBase, artifacts.ArtifactTranscriptBase, filepath.Join(paths.TranscriptsDir, "base.json"))
-	writeFile(t, filepath.Join(paths.InputsDir, "glossary.yml"), "terms: []\n")
-	badReport := filepath.Join(paths.ArtifactsDir, "bad.report.json")
-	writeFile(t, badReport, "not-json")
-	env.Audita = &audita.FakeRunner{Result: audita.PolishResult{ReportPath: badReport}}
-
-	_, err := (polishStage{}).Run(context.Background(), env, m)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
-	if !strings.Contains(err.Error(), "report") {
-		t.Fatalf("error = %q", err.Error())
-	}
-}
-
 func TestPolishStageUsesRunLocalPathsAndMaterializesCanonical(t *testing.T) {
 	env, m := setupPolishEnv(t)
 	env.Config.Session.Campaign = "sample-campaign"
@@ -244,32 +277,19 @@ func setupPolishEnv(t *testing.T) (*Env, *manifest.Manifest) {
 	writeFile(t, sessionPath, "session_id: 2026-05-03\n")
 	writeFile(t, pipelinePath, "workspace:\n  root: "+workspace+"\n")
 
-	report := true
-	totalLLMConcurrency := 3
-	proposalLLMConcurrency := 2
-	validationLLMConcurrency := 2
-
 	cfg := &config.Config{
 		PipelinePath: pipelinePath,
 		SessionPath:  sessionPath,
 		Pipeline: &config.PipelineConfig{
 			Workspace: config.WorkspaceConfig{Root: workspace},
 			Audita: config.AuditaConfig{
-				Binary:                   "audita",
-				Timeout:                  "3h",
-				LLMAPIKey:                testSecretReference("AUDITA_LLM_API_KEY"),
-				Modules:                  []string{"glossary", "homophones", "grammar"},
-				BaseURL:                  "https://openrouter.ai/api/v1",
-				Model:                    "openrouter/google/gemma-4-31b-it",
-				TranscriptDescription:    "Campaign Session 42",
-				ConfigPath:               "/etc/audita/config.yml",
-				OutputSchema:             "audita-v1",
-				WorkDirRetention:         "auto",
-				ValidationModel:          "openrouter/google/gemma-4-31b-it",
-				TotalLLMConcurrency:      &totalLLMConcurrency,
-				ProposalLLMConcurrency:   &proposalLLMConcurrency,
-				ValidationLLMConcurrency: &validationLLMConcurrency,
-				Report:                   &report,
+				Binary:                "audita",
+				Timeout:               "3h",
+				Credentials:           []configkit.Secret{*testSecretReference("AUDITA_LLM_API_KEY")},
+				Modules:               []string{"glossary", "homophones", "grammar"},
+				TranscriptDescription: "Campaign Session 42",
+				ConfigPath:            "/etc/audita/config.yml",
+				OutputSchema:          "audita-v1",
 			},
 		},
 		Session: &config.SessionConfig{

internal/stage/publish_test.go

@@ -1131,6 +1131,32 @@ func TestPublishFailsWithoutObjectStore(t *testing.T) {
 	}
 }
 
+func TestPublishArchivesCurrentPolishReportsOnlyAsDiagnostics(t *testing.T) {
+	env, m, runRoot := publishFixture(t)
+	polish := m.Stages["polish"]
+	polish.Outputs = nil
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		path := filepath.Join(runRoot, "polish", "outputs", "transcripts", name)
+		writeStageTestFile(t, path, "diagnostic\n")
+		polish.Logs = append(polish.Logs, path)
+	}
+	if _, err := (publishStage{}).Run(context.Background(), env, m); err != nil {
+		t.Fatalf("publish reports: %v", err)
+	}
+	fake := env.ObjectStore.(*storage.FakeBackend)
+	for _, name := range []string{"errors.yml", "recoveries.yml", "report.md"} {
+		relative := "polish/outputs/transcripts/" + name
+		if _, ok := fake.Objects[m.S3RunPrefix+relative]; !ok {
+			t.Fatalf("missing run-archive diagnostic %q", relative)
+		}
+		for key := range fake.Objects {
+			if strings.Contains(key, "published/"+name) {
+				t.Fatalf("report was published as canonical output: %q", key)
+			}
+		}
+	}
+}
+
 func publishFixture(t *testing.T) (*Env, *manifest.Manifest, string) {
 	t.Helper()
 

internal/stage/semantic_contracts_delivery_test.go

@@ -192,9 +192,10 @@ func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
 	first := loadNotariusCredentialForSemanticTest(t, firstName, "first-value")
 	rotated := loadNotariusCredentialForSemanticTest(t, firstName, "rotated-value")
 	renamed := loadNotariusCredentialForSemanticTest(t, secondName, "second-value")
+	third := loadNotariusCredentialForSemanticTest(t, "NARRATIO_SEMANTIC_NOTARIUS_KEY_THREE", "third-value")
 
 	baseline := downstreamSemanticEnv()
-	baseline.Config.Pipeline.Notarius.LLMAPIKey = first
+	baseline.Config.Pipeline.Notarius.Credentials = []configkit.Secret{*first}
 	want, err := (extractStage{}).SemanticConfigFingerprint(baseline)
 	if err != nil {
 		t.Fatal(err)
@@ -209,7 +210,9 @@ func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			env := downstreamSemanticEnv()
-			env.Config.Pipeline.Notarius.LLMAPIKey = test.credential
+			if test.credential != nil {
+				env.Config.Pipeline.Notarius.Credentials = []configkit.Secret{*test.credential}
+			}
 			got, err := (extractStage{}).SemanticConfigFingerprint(env)
 			if err != nil {
 				t.Fatal(err)
@@ -219,20 +222,28 @@ func TestExtractSemanticConfigExcludesLoadedCredentialChanges(t *testing.T) {
 			}
 		})
 	}
+	baseline.Config.Pipeline.Notarius.Credentials = []configkit.Secret{*renamed, *third}
+	multiple, err := (extractStage{}).SemanticConfigFingerprint(baseline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !want.Equal(multiple) {
+		t.Fatal("multiple credential references altered extract semantic fingerprint")
+	}
 }
 
 func loadNotariusCredentialForSemanticTest(t *testing.T, name, value string) *configkit.Secret {
 	t.Helper()
 	t.Setenv(name, value)
 	path := filepath.Join(t.TempDir(), "pipeline.yml")
-	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  llm_api_key: "+name+"\n"), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte("whisperx:\n  transcribe_url: https://transcription.example.test/transcribe\nnotarius:\n  enabled: false\n  credentials: ["+name+"]\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	pipeline, err := config.LoadPipeline(path)
 	if err != nil {
 		t.Fatal(err)
 	}
-	return pipeline.Notarius.LLMAPIKey
+	return &pipeline.Notarius.Credentials[0]
 }
 
 func TestPublishSemanticConfigSensitivityAndOperationalExclusions(t *testing.T) {

internal/stage/semantic_contracts_refinement.go

@@ -2,7 +2,6 @@ package stage
 
 import (
 	"fmt"
-	"sort"
 	"strings"
 
 	"gitea.maximumdirect.net/eric/narratio/internal/artifacts"
@@ -11,20 +10,20 @@ import (
 )
 
 const (
-	polishSemanticConfigVersion    = 1
+	polishSemanticConfigVersion    = 2
 	normalizeSemanticConfigVersion = 1
 	trimSemanticConfigVersion      = 1
 	renderSemanticConfigVersion    = 1
 )
 
 type polishSemanticConfig struct {
-	ServiceURL            string   `json:"service_url"`
-	Model                 string   `json:"model"`
-	ValidationModel       string   `json:"validation_model"`
 	Modules               []string `json:"modules"`
+	Overlay               string   `json:"overlay"`
+	ProposalProfile       string   `json:"proposal_profile"`
+	ValidationProfile     string   `json:"validation_profile"`
 	TranscriptDescription string   `json:"transcript_description"`
 	OutputSchema          string   `json:"output_schema"`
-	ExternalConfig        string   `json:"external_config"`
+	ConfigPath            string   `json:"config_path"`
 	OutputIdentity        string   `json:"output_identity"`
 }
 
@@ -68,19 +67,21 @@ func (polishStage) SemanticConfigFingerprint(env *Env) (manifest.SemanticConfigF
 		return manifest.SemanticConfigFingerprint{}, fmt.Errorf("polish semantic configuration requires resolved pipeline config")
 	}
 	audita := env.Config.Pipeline.Audita
-	modules := append([]string(nil), audita.Modules...)
+	var modules []string
+	if audita.Modules != nil {
+		modules = append([]string{}, audita.Modules...)
+	}
 	for index := range modules {
 		modules[index] = strings.TrimSpace(modules[index])
 	}
-	sort.Strings(modules)
 	return FingerprintSemanticConfig(polishSemanticConfigVersion, polishSemanticConfig{
-		ServiceURL:            strings.TrimSpace(audita.BaseURL),
-		Model:                 strings.TrimSpace(audita.Model),
-		ValidationModel:       strings.TrimSpace(audita.ValidationModel),
 		Modules:               modules,
-		TranscriptDescription: strings.TrimSpace(audita.TranscriptDescription),
-		OutputSchema:          strings.TrimSpace(audita.OutputSchema),
-		ExternalConfig:        strings.TrimSpace(audita.ConfigPath),
+		Overlay:               audita.Overlay,
+		ProposalProfile:       audita.ProposalProfile,
+		ValidationProfile:     audita.ValidationProfile,
+		TranscriptDescription: audita.TranscriptDescription,
+		OutputSchema:          audita.OutputSchema,
+		ConfigPath:            audita.ConfigPath,
 		OutputIdentity:        artifacts.ArtifactTranscriptPolished,
 	})
 }

internal/stage/semantic_contracts_refinement_test.go

@@ -3,6 +3,7 @@ package stage
 import (
 	"testing"
 
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 	"gitea.maximumdirect.net/eric/narratio/internal/config"
 )
 
@@ -11,33 +12,48 @@ func TestPolishSemanticConfigSensitivity(t *testing.T) {
 		name   string
 		mutate func(*Env)
 	}{
-		{name: "model", mutate: func(env *Env) { env.Config.Pipeline.Audita.Model = "production" }},
-		{name: "validation model", mutate: func(env *Env) { env.Config.Pipeline.Audita.ValidationModel = "validator-v2" }},
 		{name: "modules", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = []string{"terms", "speakers", "style"} }},
+		{name: "module order", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = []string{"terms", "speakers"} }},
+		{name: "module repetition", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = []string{"speakers", "terms", "terms"} }},
+		{name: "modules omitted", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = nil }},
+		{name: "modules empty", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = []string{} }},
+		{name: "overlay", mutate: func(env *Env) { env.Config.Pipeline.Audita.Overlay = "testing" }},
+		{name: "proposal profile", mutate: func(env *Env) { env.Config.Pipeline.Audita.ProposalProfile = "draft" }},
+		{name: "validation profile", mutate: func(env *Env) { env.Config.Pipeline.Audita.ValidationProfile = "review" }},
 		{name: "description", mutate: func(env *Env) { env.Config.Pipeline.Audita.TranscriptDescription = "live campaign" }},
 		{name: "schema", mutate: func(env *Env) { env.Config.Pipeline.Audita.OutputSchema = "audita.transcript.v2" }},
 		{name: "external config", mutate: func(env *Env) { env.Config.Pipeline.Audita.ConfigPath = "configs/other.yml" }},
-		{name: "service", mutate: func(env *Env) { env.Config.Pipeline.Audita.BaseURL = "https://other.example" }},
 	}
 	assertRefinementChanges(t, polishStage{}, semantic)
 	assertRefinementUnchanged(t, polishStage{}, []struct {
 		name   string
 		mutate func(*Env)
 	}{
-		{name: "module order", mutate: func(env *Env) { env.Config.Pipeline.Audita.Modules = []string{"terms", "speakers"} }},
 		{name: "runner settings", mutate: func(env *Env) {
 			env.Config.Pipeline.Audita.Binary = "/opt/audita"
 			env.Config.Pipeline.Audita.Timeout = "1h"
-			env.Config.Pipeline.Audita.TotalLLMConcurrency = intPointer(20)
-			env.Config.Pipeline.Audita.ProposalLLMConcurrency = intPointer(10)
-			env.Config.Pipeline.Audita.ValidationLLMConcurrency = intPointer(10)
-			env.Config.Pipeline.Audita.LLMAPIKey = testSecretReference("OTHER_KEY")
-			env.Config.Pipeline.Audita.WorkDirRetention = "always"
-			env.Config.Pipeline.Audita.Report = boolPointer(false)
+			env.Config.Pipeline.Audita.Credentials = []configkit.Secret{*testSecretReference("OTHER_KEY")}
 		}},
 	})
 }
 
+func TestPolishSemanticConfigDistinguishesOmittedAndExplicitlyEmptyModules(t *testing.T) {
+	env := refinementSemanticEnv()
+	env.Config.Pipeline.Audita.Modules = nil
+	omitted, err := (polishStage{}).SemanticConfigFingerprint(env)
+	if err != nil {
+		t.Fatal(err)
+	}
+	env.Config.Pipeline.Audita.Modules = []string{}
+	empty, err := (polishStage{}).SemanticConfigFingerprint(env)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if omitted.Equal(empty) {
+		t.Fatal("omitted and explicitly empty module selections have equal semantic evidence")
+	}
+}
+
 func TestNormalizeSemanticConfigSensitivity(t *testing.T) {
 	assertRefinementChanges(t, normalizeStage{}, []struct {
 		name   string
@@ -119,12 +135,9 @@ func refinementSemanticEnv() *Env {
 	env := initialSemanticEnv()
 	env.Config.Session.Title = "Session title"
 	env.Config.Pipeline.Audita = config.AuditaConfig{
-		Binary: "audita", Timeout: "10m", LLMAPIKey: testSecretReference("AUDITA_KEY"),
-		Modules: []string{"speakers", "terms"}, BaseURL: "https://audita.example",
-		Model: "testing", ValidationModel: "validator", TranscriptDescription: "tabletop session",
+		Binary: "audita", Timeout: "10m", Credentials: []configkit.Secret{*testSecretReference("AUDITA_KEY")},
+		Modules: []string{"speakers", "terms"}, TranscriptDescription: "tabletop session",
 		ConfigPath: "configs/audita.yml", OutputSchema: "audita.transcript.v1",
-		TotalLLMConcurrency: intPointer(4), ProposalLLMConcurrency: intPointer(2),
-		ValidationLLMConcurrency: intPointer(2), WorkDirRetention: "failure", Report: boolPointer(true),
 	}
 	env.Config.Pipeline.Normalize = &config.NormalizeConfig{
 		OutputPath: "transcripts/final.json", OutputSchema: "seriatim.transcript.v1", Report: boolPointer(true),

internal/stage/transcribe_execution_state.go

@@ -156,39 +156,30 @@ func (state *transcribeExecutionState) checkpointCollectionLocked(
 		return fmt.Errorf("validate transcribe speaker collection: %w", err)
 	}
 
-	candidate := cloneManifestForTranscribeCheckpoint(state.manifest)
-	if candidate.Stages == nil {
-		candidate.Stages = make(map[string]*manifest.StageRecord)
-	}
-	record := candidate.Stages["transcribe"]
-	if record == nil {
-		now := time.Now().UTC()
-		record = &manifest.StageRecord{
-			Name: "transcribe", Status: manifest.StatusRunning, CreatedAt: now, UpdatedAt: now,
-		}
-		candidate.Stages["transcribe"] = record
-	}
-	record.TranscribeStateVersion = manifest.TranscribeStateContractVersion
-	record.TranscribeSpeakers = manifest.CloneTranscribeSpeakerCollection(records)
-	record.UpdatedAt = time.Now().UTC()
-	if err := state.env.ManifestStore.Save(ctx, state.paths.ManifestPath, candidate); err != nil {
-		return fmt.Errorf("save session manifest %q: %w", state.paths.ManifestPath, err)
+	missingRecord := transcribeStageRecord(state.manifest) == nil
+	if err := checkpointStageCollection(
+		ctx,
+		state.env.ManifestStore,
+		state.paths.ManifestPath,
+		state.manifest,
+		"transcribe",
+		func(record *manifest.StageRecord) error {
+			if missingRecord {
+				now := time.Now().UTC()
+				*record = manifest.StageRecord{
+					Name: "transcribe", Status: manifest.StatusRunning, CreatedAt: now, UpdatedAt: now,
+				}
+			}
+			record.TranscribeStateVersion = manifest.TranscribeStateContractVersion
+			record.TranscribeSpeakers = manifest.CloneTranscribeSpeakerCollection(records)
+			record.UpdatedAt = time.Now().UTC()
+			return nil
+		},
+	); err != nil {
+		return err
 	}
 
 	live := transcribeStageRecord(state.manifest)
-	if live == nil {
-		live = &manifest.StageRecord{}
-		if state.manifest.Stages == nil {
-			state.manifest.Stages = make(map[string]*manifest.StageRecord)
-		}
-		state.manifest.Stages["transcribe"] = live
-	}
-	live.TranscribeStateVersion = candidate.Stages["transcribe"].TranscribeStateVersion
-	live.TranscribeSpeakers = manifest.CloneTranscribeSpeakerCollection(
-		candidate.Stages["transcribe"].TranscribeSpeakers,
-	)
-	live.UpdatedAt = candidate.Stages["transcribe"].UpdatedAt
-	state.manifest.UpdatedAt = candidate.UpdatedAt
 	state.records = manifest.CloneTranscribeSpeakerCollection(live.TranscribeSpeakers)
 	return nil
 }
@@ -259,27 +250,6 @@ func transcribeStageRecord(m *manifest.Manifest) *manifest.StageRecord {
 	return m.Stages["transcribe"]
 }
 
-func cloneManifestForTranscribeCheckpoint(source *manifest.Manifest) *manifest.Manifest {
-	clone := *source
-	clone.Inputs = append([]manifest.InputRecord(nil), source.Inputs...)
-	clone.Artifacts = append([]manifest.ArtifactRecord(nil), source.Artifacts...)
-	clone.Stages = make(map[string]*manifest.StageRecord, len(source.Stages))
-	for name, sourceRecord := range source.Stages {
-		if sourceRecord == nil {
-			clone.Stages[name] = nil
-			continue
-		}
-		record := *sourceRecord
-		record.Outputs = append([]manifest.ArtifactRecord(nil), sourceRecord.Outputs...)
-		record.Logs = append([]string(nil), sourceRecord.Logs...)
-		record.GeneratedConfigs = append([]string(nil), sourceRecord.GeneratedConfigs...)
-		record.TranscribeSpeakers = manifest.CloneTranscribeSpeakerCollection(sourceRecord.TranscribeSpeakers)
-		record.AnalyzeArtifacts = manifest.CloneAnalyzeArtifactCollection(sourceRecord.AnalyzeArtifacts)
-		clone.Stages[name] = &record
-	}
-	return &clone
-}
-
 func cloneStringAnyMap(source map[string]any) map[string]any {
 	if source == nil {
 		return nil

internal/stage/transcribe_reconciliation_test.go

@@ -58,7 +58,7 @@ func TestTranscribeResumeAcceptsEquivalentOutputsAndInspectsRemovalReadOnly(t *t
 		t.Fatalf("equivalent aggregate: %#v, %v", validation, err)
 	}
 	m.Inputs = slices.DeleteFunc(m.Inputs, func(in manifest.InputRecord) bool { return filepath.Base(in.Path) == "bob.flac" })
-	before := cloneManifestForTranscribeCheckpoint(m)
+	before := cloneManifestForCheckpoint(m)
 	validation, err = (transcribeStage{}).ValidateResume(context.Background(), env, m)
 	if err != nil || validation.Resumable {
 		t.Fatalf("removed speaker: %#v, %v", validation, err)