Document and validate Notarius extraction workflows

docs/policy/architecture.md

@@ -17,7 +17,8 @@ their domains:
 
 - WhisperX performs transcription;
 - Seriatim performs deterministic transcript processing and rendering;
-- Audita performs transcript correction and polishing; and
+- Audita performs transcript correction and polishing;
+- Notarius extracts validated structured artifact bundles; and
 - Scriptorium executes prompts and produces configured artifacts.
 
 Narratio owns orchestration, configuration resolution, session and run state,
@@ -51,9 +52,9 @@ HTTP, subprocess, notification, and object-storage mechanics, including command
 construction, transport behavior, provider response handling, and external
 error adaptation. External dependency types must remain inside the adapter that
 owns them unless that dependency is the adapter's explicit public contract.
-WhisperX HTTP behavior, Seriatim, Audita, and Scriptorium command construction,
-notification transport, and object-storage SDK details remain behind these
-boundaries.
+WhisperX HTTP behavior, Seriatim, Audita, Notarius, and Scriptorium command
+construction, notification transport, and object-storage SDK details remain
+behind these boundaries.
 
 State and path services must not infer stage policy. Storage implementations
 receive explicit bucket-relative keys and do not infer campaign, session, run,
@@ -89,6 +90,13 @@ should preserve enough local state and diagnostics for inspection, recovery,
 and resume. Forcing an upstream stage invalidates succeeded downstream work
 according to the canonical stage order.
 
+A stage may explicitly self-skip with a stable reason and no outputs. That
+outcome is persisted, clears older outputs owned by the stage, and is
+reconsidered on a later invocation. A stage may also validate whether an
+otherwise successful recorded result is still resumable; an obsolete result
+is staled and rerun, while an unsafe condition that prevents a sound decision
+stops execution.
+
 Shared behavior should live behind a narrow service or helper with one clear
 owner. Stages must not reach across boundaries or reproduce adapter, manifest,
 artifact, or path policy ad hoc.
@@ -141,6 +149,9 @@ not reconstruct canonical paths through scattered string concatenation.
 Artifact resolution is deterministic and manifest-aware. Producers materialize
 canonical outputs before reporting success, and consumers resolve declared
 artifact identities rather than infer files from unrelated directory contents.
+External artifact bundles become current only through validated immutable
+promotion and manifest records; directory presence alone never establishes
+availability.
 
 Writes, moves, replacements, and deletions must use narrow, explicit,
 root-confined destinations. Symlinks, traversal, broad roots, and ambiguous