Add configuration path explanations

docs/cli.md

@@ -28,6 +28,7 @@ go run ./cmd/scriptorium render \
 - `scriptorium config validate`: validate application configuration without building an engine.
 - `scriptorium config show`: show the resolved application configuration.
 - `scriptorium config sources`: show the ordered configuration sources.
+- `scriptorium config explain`: explain one effective or historical configuration path.
 
 All commands accept `--config <path>` and `--config-overlay <name>` and reject
 positional arguments. `--config-overlay` selects one application configuration
@@ -226,6 +227,7 @@ controls are shown as zero values when Promptkit leaves them unspecified.
 scriptorium config validate [flags]
 scriptorium config show [flags]
 scriptorium config sources [flags]
+scriptorium config explain --path JSON_POINTER [flags]
 ```
 
 Each accepts `--config`, `--config-overlay`, `--prompt-dir`, `--profile-dir`,
@@ -244,10 +246,21 @@ record has `id`, `label`, and `layer`, plus `path` when available; explicit CLI
 overrides appear as synthetic sources. Defaults-only input without overrides
 produces `[]` for `sources`.
 
+`explain` requires an explicitly supplied `--path` in JSON Pointer syntax.
+The empty string selects the root; `/server/addr` selects a field; `~1` and
+`~0` escape `/` and `~` inside mapping keys. Numeric tokens are interpreted
+according to the containing mapping or sequence. Dotted paths, file paths,
+and URL fragments are not accepted. ConfigKit writes a human-readable account
+of the effective value and its chronological default, base, overlay, CLI,
+and normalization history, including removed historical values. This is not a
+JSON schema or a byte-for-byte stable prose format. Unknown and malformed paths
+exit 1 without successful explanation output.
+
 Diagnostics and warnings go to stderr, never into successful stdout. Parse,
 load, output, and diagnostic-write failures exit 1. Ordinary output writes may
 leave partial data on failure. The inspection output can contain paths,
-identifiers, `api_key_env` reference names, and ordinary `extra_params` values;
+identifiers, `api_key_env` reference names, and ordinary `extra_params` values,
+including displaced historical values in explanations;
 protect it accordingly. Raw API-key values are not read or emitted by these
 commands.
 

docs/config.md

@@ -95,7 +95,8 @@ The size fields must be zero or greater. The [HTTP API](api.md) defines how
 each limit is enforced and reported. `server.artifact_root` configures an HTTP
 deployment boundary; see [operations](operations.md) for deployment handling.
 
-The `config validate`, `config show`, and `config sources` commands inspect this
+The `config validate`, `config show`, `config sources`, and `config explain`
+commands inspect this
 application configuration without creating a Promptkit engine. `show` is a
 resolved inspection snapshot, not necessarily a reloadable file. Application
 validation does not check framework sources, backend connectivity, or credential
@@ -103,6 +104,12 @@ availability. `api_key_env` is an environment-variable *name* and remains
 visible in inspection; its environment value is never read by ConfigKit.
 Ordinary backend `extra_params` values also remain visible, so keep secrets out
 of those fields and protect inspection output as potentially sensitive.
+`config explain --path /server/addr` uses JSON Pointer syntax to show the
+selected field's current value and history from defaults, files, overlays,
+explicit CLI overrides, and normalization. `--path ''` selects the root.
+History includes replaced and removed values; `show` presents the final
+resolved snapshot. Neither renderer looks up credential bytes, and neither
+claims to identify arbitrary secrets in unclassified parameter values.
 
 ## Custom Backends
 

docs/operations.md

@@ -99,6 +99,10 @@ Before changing production inputs, profiles, or schemas:
    policy.
 
 Inspection output can include configuration paths, names, and ordinary backend
+parameters. `config explain --path` uses JSON Pointer paths and can show
+displaced historical values as well as the final value. Protect both the
+selected paths and the output, especially when backend parameters contain
+sensitive identifiers; ConfigKit does not infer arbitrary secrets in those
 parameters. Apply
 access and retention controls; the application stores only API-key environment
 reference names, not the resolved credential bytes.

docs/roadmap/implementation.md

@@ -390,7 +390,11 @@ selected API-key boundary without masking or changing backend parameter data.
 
 ## Stage 6: Add Per-Path Explanation And Verify Credential Boundaries
 
-**Status: Not started.**
+**Status: Complete.** `config explain` uses required JSON Pointer paths and
+ConfigKit's snapshot renderer, including historical and normalized values.
+Tests cover root, escaped/numeric keys, unknown paths, writer failures, and
+synthetic credential-reference boundaries. Full test, race, vet, build, and
+diff checks passed.
 
 Primary files: configuration command implementation/tests and CLI/config docs.