Add ConfigKit application definition and attribution

docs/internal/sources.md

@@ -24,6 +24,20 @@ The [configuration reference](../config.md) owns Scriptorium's source-location
 fields and precedence. Maintained files under `examples/` are application
 inputs that use Promptkit's tagged formats.
 
+## Native Application Definition In Preparation
+
+`internal/config` also contains a ConfigKit-native `Document` definition. Its
+fresh defaults come from Scriptorium's existing default constants; its resolver
+records only actual trimming, path cleaning, and render-format normalization.
+The validator reports application retry, size-limit, and format errors without
+mutating the document or exposing rejected values. Application path values keep
+working-directory-relative meaning. ConfigKit owns strict YAML decoding and
+presence semantics, including dynamic integer values in backend parameters.
+
+The executable commands still use the existing loader. The new definition is
+internal preparation and is not yet an alternative user-selectable configuration
+mode or a change to the current [configuration contract](../config.md).
+
 ## Restricted HTTP Artifact Reader
 
 `internal/adapter/http` implements `promptkit.ArtifactReader` for HTTP

docs/oss/attribution.md

@@ -17,6 +17,20 @@ License and notices: [LGPL v3](licenses/LGPL-3.0.txt) |
 
 Source: [Promptkit v0.11.0](https://gitea.maximumdirect.net/eric/promptkit/src/commit/db05b56166ca2d8650dfaf660e1cf0eed3932e1d)
 
+## ConfigKit
+
+Upstream copyright statement: no project-specific statement is present in the
+selected module; the FSF copyright in its license text belongs to that license
+document and is not substituted for a project notice.
+
+SPDX-License-Identifier: LGPL-3.0-only
+
+License and notices: [LGPL v3](licenses/LGPL-3.0.txt) |
+[GPL v3 companion](licenses/GPL-3.0.txt) |
+[upstream LICENSE](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/e6ced0d3d1194b58e0b3dc8970089471ba175258/LICENSE)
+
+Source: [ConfigKit v0.4.0](https://gitea.maximumdirect.net/eric/ConfigKit/src/commit/e6ced0d3d1194b58e0b3dc8970089471ba175258)
+
 ## Promptkit OpenRouter Catalog
 
 Upstream copyright statement: no project-specific statement is present in the
@@ -91,3 +105,23 @@ License and notices: [MIT](licenses/MIT.txt) |
 [upstream NOTICE](https://github.com/go-yaml/yaml/blob/f6f7691b1fdeb513f56608cd2c32c51f8194bf51/NOTICE)
 
 Source: [gopkg.in/yaml.v3 v3.0.1](https://github.com/go-yaml/yaml/tree/f6f7691b1fdeb513f56608cd2c32c51f8194bf51)
+
+## go.yaml.in/yaml/v4
+
+Copyright 2006-2010 Kirill Simonov
+
+Copyright 2011-2019 Canonical Ltd
+
+Copyright 2025 The go-yaml Project Contributors
+
+SPDX-License-Identifier: MIT AND Apache-2.0
+
+The upstream NOTICE assigns MIT to files ported from libyaml and Apache 2.0
+to the remaining files; these are file-specific terms, not alternatives.
+
+License and notices: [MIT](licenses/MIT.txt) |
+[Apache 2.0](licenses/Apache-2.0.txt) |
+[upstream LICENSE](https://github.com/yaml/go-yaml/blob/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125/LICENSE) |
+[upstream NOTICE](https://github.com/yaml/go-yaml/blob/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125/NOTICE)
+
+Source: [go.yaml.in/yaml/v4 v4.0.0-rc.6](https://github.com/yaml/go-yaml/tree/1c17b9cee72bf81ae73a8be50fbd7dd3a9985125)

docs/roadmap/implementation.md

@@ -109,7 +109,9 @@ command-specific validation retains those responsibilities where applicable.
 
 ## Stage 1: Add The Dependency And Native Application Definition
 
-**Status: Not started.**
+**Status: Complete.** The pinned dependency, native definition, focused
+presence/normalization/validation tests, and commit-specific attribution are in
+place. The existing executable loader remains active pending the command cutover.
 
 Primary files: `go.mod`, `go.sum`, new focused files under `internal/config`,
 and `docs/oss/attribution.md`.