Preserve message resource origins and profile credential lookup names

docs/internal/sources.md

@@ -38,6 +38,11 @@ at construction. It stores captured content, compiled templates, declared
 input metadata, and a definition hash. It closes content-file handles before
 returning and retains no source capability for public inspection.
 
+Role and cache-control normalization is applied to execution-owned message
+copies. The retained ConfigKit configuration keeps effective input message
+metadata and its resource origins: recording a sequence-wide normalization in
+ConfigKit v0.5.0 would replace origins of unchanged content-file fields.
+
 The runner selects from this index for preparation and `InspectPrompt`.
 Neither path rescans configuration or reopens message files. `InspectPrompt`
 returns declared metadata without rendering or resolving profile, input, or

docs/roadmap/implementation.md

@@ -199,8 +199,12 @@ Unknown fields are ConfigKit errors, including old `id`, `version`, and
 Literal definition keys remain exact; require nonblank identity but do not
 normalize/rekey maps after ConfigKit has resolved relationships. Update selection
 to use exact nonblank IDs/versions rather than silently trimming them into a
-different identity. Existing value normalization (for example role lowercase or
-endpoint trimming) is recorded through ConfigKit's resolution callbacks. Field
+different identity. Scalar normalization such as endpoint trimming is recorded
+through ConfigKit's resolution callbacks when
+mutating its typed configuration. Message roles and cache control are normalized
+on execution-owned copies instead: ConfigKit v0.5.0 treats sequence mutations as
+whole-value replacements, losing unchanged content_file origins. Inspection
+retains the effective input message metadata and its source context. Field
 references to definition IDs remain exact as well.
 
 Profile field rules after configuration overlay/inheritance:
@@ -217,6 +221,11 @@ Profile field rules after configuration overlay/inheritance:
 | `api_key_required` | False | Explicit boolean, including false overriding true | False |
 | `extra_params` | Backend defaults | ConfigKit-composed profile map, recursively overlaid on backend map | Suppress entire configured provider map |
 
+Profile API-key environment names follow the existing lookup contract, including
+host-supported non-shell-identifier names. Do not extend the backend's naming
+regular expression to profiles. Trimming, explicit clearing, optional lookup,
+and direct request-key precedence remain unchanged.
+
 Backend registry defaults are applied once during snapshot construction, after
 effective profile inheritance. Keep them out of the inheritance input: a parent's
 derived endpoint/key/defaults must not follow a child that changes backend.

docs/roadmap/remediation.md

@@ -13,7 +13,8 @@ resources/templates, and builds execution-owned indexes. Catalog preflight and
 legacy profile resolution are removed. Operator inspection delegates to the
 retained ConfigKit result separately from ordinary execution.
 
-Two findings require remediation. This review changes no implementation code.
+Both findings have been addressed. The original review evidence is retained
+below; the resolution section records the changes and regression coverage.
 
 ## 1. P2 — Message Normalization Loses Content-File Resource Origins
 
@@ -106,3 +107,20 @@ Required outcome:
 The passing suite does not cover the two failing cases above. No provider
 requests were made. Beyond these findings, the reviewed implementation did not
 show another actionable ownership-boundary violation or strengthened guarantee.
+
+## Resolution
+
+1. Message role/cache-control normalization now occurs on execution-owned copies
+   during materialization. ConfigKit's captured message sequence and its origins
+   remain intact. The imported/inherited content regression now includes role
+   and cache-control normalization and asserts the unchanged field's source in
+   inspection metadata. This also removes duplicate cache-control normalization.
+2. Removed the profile environment-name regular expression check, leaving backend
+   validation unchanged. A public engine/HTTP-transport regression covers a
+   non-shell environment name, unset/empty/whitespace values, explicit clearing,
+   trimming, and direct-key precedence. The implementation plan now states this
+   distinction explicitly.
+
+Both regressions failed against the reviewed implementation before the fixes.
+After remediation, the full ordinary and race-enabled suites, affected packages
+on Go 1.25.5, `go vet ./...`, and documentation/whitespace checks passed.