Validate explicit configuration branches before conversion

internal/core/config/pipeline_document.go

@@ -406,7 +406,7 @@ func validateDocumentBinding(binding BindingDocument, path configkit.Path, slot
 	if referencesAllowed {
 		validateDocumentReferences(binding.References, path.Key("references"), true, validation)
 	}
-	if len(binding.Validators) > 0 && !validatorsAllowed {
+	if binding.Validators != nil && !validatorsAllowed {
 		validation.Error(path.Key("validators"), "are not supported for this binding")
 	}
 	for index, validator := range binding.Validators {
@@ -429,13 +429,16 @@ func validateDocumentReferences(references map[string]ReferenceDocument, path co
 	for _, name := range sortedReferenceDocumentKeys(references) {
 		source := references[name]
 		sourcePath := path.Key(name)
-		hasPath := source.Path != nil && strings.TrimSpace(*source.Path) != ""
+		hasPath := source.Path != nil
 		hasArtifact := source.Artifact != nil
 		if hasPath == hasArtifact {
 			validation.Error(sourcePath, "must select exactly one reference source")
 			continue
 		}
 		if hasPath {
+			if strings.TrimSpace(*source.Path) == "" {
+				validation.Error(sourcePath.Key("path"), "must not be empty")
+			}
 			continue
 		}
 		if !generatedAllowed {