Complete configuration diagnostics workstream

docs/internal/configuration.md

@@ -11,10 +11,11 @@ pipeline-loading boundary implemented by `internal/config`.
 1. Parse the root YAML into a presence-aware composition tree. The tree retains
    source names, full field paths, node kinds, declaration order, and explicit
    zero, false, empty-map, and empty-list values.
-2. Remove the root-only `composition` envelope and validate its explicit
-   `imports`, `default_profile`, and named `profiles` declarations. A load
-   option retains the difference between omitted and explicitly empty profile
-   selection.
+2. Decode the root-only `composition` envelope, validate its declaration shapes
+   and cross-field profile semantics, then clone the root without that envelope
+   as the ordinary pipeline body. The parsed source document is not mutated. A
+   load option retains the difference between omitted and explicitly empty
+   profile selection.
 3. Open each import relative to the root pipeline directory through the
    confined regular-file boundary. Imports must use a `.yml` or `.yaml`
    extension and cannot traverse, use symlinks, repeat a file, import the root,
@@ -108,6 +109,27 @@ projection.
 An unversioned source is rejected before resolution, family expansion, or
 prepare-stage materialization.
 
+## Validation Ownership
+
+Configuration validation remains within `internal/config`, with the public
+entry points and pipeline-domain sequencing separated from the private owners
+for core pipeline/session rules, external adapters, publish/storage, Notarius,
+Scriptorium, and shared scalar/path checks. These are package-local ownership
+boundaries rather than extension points or a general validation framework.
+
+Validation fails fast and does not define which of several independent invalid
+fields is reported first. Map-backed declarations are nevertheless traversed
+deterministically. Notarius validates scalar policy, builds normalized reference
+bindings and output lanes independently, and installs all candidate values only
+after every check succeeds. Scriptorium validates artifact declarations and
+outputs, dependencies and inputs, variables, referenced outputs, and the final
+dependency graph in deterministic artifact order.
+
+Diagnostics identify the relevant semantic field. Composition conflicts also
+retain every claiming source needed to correct an additive ownership conflict.
+Complete prose, punctuation, formatting, and private validation choreography are
+not compatibility contracts.
+
 ## Diagnostics And Runtime Metadata
 
 Syntax, duplicate-key, composition, conflict, and schema failures include the