Add configuration inspection commands

docs/cli.md

@@ -181,6 +181,28 @@ OPENROUTER_API_KEY=validation-placeholder \
 The placeholder in the second command is sufficient only for offline
 validation; it cannot run a provider-backed pipeline.
 
+## config effective
+
+~~~
+notarius config effective [--config path/to/config.yml] [--config-profile name]
+~~~
+
+This command writes the selected composed configuration as deterministic,
+redacted YAML. Standard output contains only that YAML: it does not validate a
+pipeline, prepare modules, materialize references, or contact a provider.
+
+## config explain
+
+~~~
+notarius config explain [--config path/to/config.yml] [--config-profile name] <json-pointer>
+~~~
+
+This command writes ConfigKit's redacted, human-readable explanation for one
+canonical JSON Pointer. Supply `""` explicitly to explain the root. A malformed
+pointer is a syntax error; a well-formed unknown path is a command failure.
+The explanation can describe a value displaced by a selected profile. Standard
+output contains only the explanation.
+
 ## pipelines list
 
 ~~~
@@ -212,6 +234,6 @@ standard error. Parse the result only after the process exits with status 0.
 | 2 | The command or flag syntax was invalid, including unknown commands, missing required arguments, invalid flag values, or invalid flag combinations. |
 
 The root help spellings are the supported help path. Invoking **--help** on
-**run**, **config validate**, or **pipelines list** is handled by the flag
+**run**, a **config** subcommand, or **pipelines list** is handled by the flag
 parser as a usage error: it writes an error to standard error and exits with
 status 2.

docs/config.md

@@ -593,3 +593,12 @@ defaults or explicit CLI overrides, incompatible module keys, unknown options,
 invalid reference bindings, missing required reference slots, invalid validator
 overrides, and incompatible generated artifact handoffs. Use
 [pipelines list](cli.md#pipelines-list) to inspect configured IDs.
+
+## Inspection
+
+Use [config effective](cli.md#config-effective) to write the selected composed
+configuration as deterministic, redacted YAML. Use
+[config explain](cli.md#config-explain) with a canonical JSON Pointer to inspect
+the effective or historical provenance for one path, including a value displaced
+by a selected profile. Neither command resolves a pipeline, prepares modules,
+materializes references, or requires provider credentials.

docs/roadmap/implementation.md

@@ -532,6 +532,8 @@ helpers, and debug writer must already be complete in earlier stages.
 
 ## Stage 11 — Add Effective And Explanation Commands
 
+**Status:** Completed 2026-09-13.
+
 **Goal:** Expose the accepted operator inspection workflow.
 
 **Work:**