Document workload-oriented LLM profile deployment

docs/internal/cli.md

@@ -38,8 +38,9 @@ in [Configuration Internals](configuration.md).
 
 Configuration validation without a selected pipeline checks structural
 configuration only. Validation with a selected pipeline also builds the
-effective catalog, resolves the pipeline, and verifies explicitly selected
-PromptKit profiles. Each explicit binding or validator profile is inspected
+effective catalog, resolves the pipeline, and verifies every explicit effective
+PromptKit profile. Selected LLM-backed input, chunk, lane, output, and validator
+profiles are inspected
 against the configured PromptKit source and backend registrations without
 loading a prompt or performing generation, so an unknown or invalid profile
 fails before pipeline preparation. Credential availability remains an
@@ -61,7 +62,8 @@ profile-provenance recorder, creates one scheduler from the effective global
 LLM limit, and wraps the client before it reaches modules. Registration and LLM
 construction errors are returned before a pipeline is prepared. Configuration
 field definitions remain in [Configuration](../config.md#promptkit-profiles);
-the adapter mechanics remain in [LLM Runtime](llm.md).
+the D&D registrar's fallback profile assets and the adapter mechanics remain in
+[LLM Runtime](llm.md).
 
 The factory also accepts `LLMRuntimeOverrides`, whose reasoning pointer
 preserves inherit, replace, and clear states across the composition boundary.
@@ -83,7 +85,8 @@ handoff:
 2. create and validate a safe run identity, then allocate a debug bundle only
    when requested;
 3. build the effective catalog, resolve requested reference changes, resolve
-   the effective pipeline, and verify explicit PromptKit profiles;
+   the effective pipeline, and inspect its explicit effective PromptKit
+   profiles;
 4. materialize external or generated references and record redacted invocation
    and resolution provenance when debug capture is enabled;
 5. construct registries, the scheduled LLM client, prepared modules, and the

docs/internal/configuration.md

@@ -42,7 +42,9 @@ or collide after whitespace normalization. The file application also makes the
 effective extraction-worker default follow the effective LLM limit. A present
 PromptKit local-backend object requires and trims its endpoint, defaults its
 omitted concurrency limit to zero, and is copied so the parsed file model
-cannot alias the populated **Config**.
+cannot alias the populated **Config**. A pipeline `llm_profile` is
+presence-aware: omission remains empty, while a present blank value is
+rejected and a non-empty file value is trimmed before it reaches **Config**.
 
 **Config.Validate** checks configuration-only invariants before resolution. It
 rejects incompatible profile sources, invalid state-surface values, unsupported
@@ -62,13 +64,15 @@ environment override, its validation, and that reference in the same change.
 
 **Config.Resolve** first recomputes derived concurrency defaults and validates
 the configuration. It normalizes the requested pipeline ID, copies the selected
-profile, applies a non-empty command-level LLM profile override to the
-LLM-capable stage bindings, and calls the framework resolver with the requested
-lane selection and reference changes.
+profile, and passes the non-empty command-level LLM profile override, requested
+lane selection, and reference changes to the framework resolver.
 
-The command-level override does not replace an explicitly selected validator
-profile. Validator bindings remain part of the resolved validator chain and
-are resolved under their own declared configuration.
+After module and validator selection, the resolver applies the effective
+profile policy to LLM-backed bindings only: command override, binding profile,
+pipeline profile, then the prompt default. Deterministic bindings remain
+profile-free, and no second inheritance decision occurs during execution. The
+public field definitions and precedence are owned by
+[Configuration](../config.md#pipelines).
 
 The framework resolver supplies defaults, selects lanes, resolves validator
 chains, checks registered module and artifact compatibility, validates module
@@ -90,7 +94,8 @@ runtime error class described in the [CLI reference](../cli.md#output-streams-an
 
 The framework assigns the resolved pipeline a deterministic SHA-256 digest
 after defaults, lane selection, module bindings, reference bindings, validator
-chains, and artifact schema identity have been resolved. The digest excludes
+chains, effective LLM profiles, and artifact schema identity have been
+resolved. The digest excludes
 its own stored value. It identifies resolved composition rather than raw YAML
 bytes, a debug payload, or all runtime state. The CLI records it as invocation
 provenance before execution; cache and checkpoint identity have additional

docs/internal/dnd.md

@@ -28,9 +28,9 @@ a stable module spec, explicit execution class, strict option decoding, and a
 typed builder. Scene chunking, every extractor, and NPC normalization are
 registered as `llm_backed`; the remaining current D&D mergers and normalizers
 are `deterministic`. The metadata is available to catalog inspection and
-resolved-pipeline debug data; it does not yet change profile inheritance.
-Configuration remains the canonical owner of the exact keys and validator
-order.
+resolved-pipeline debug data and determines which selected bindings inherit the
+pipeline profile. Configuration remains the canonical owner of the exact keys,
+profile precedence, and validator order.
 
 Private structured-LLM response schemas are deliberately minimal. They reject
 invalid JSON structure, missing required fields, incompatible types, and
@@ -51,7 +51,9 @@ profile. The D&D registrar embeds that fallback profile with the maintained
 OpenRouter model, timeout, and service-tier policy. An operator may provide a
 complete profile with the same ID through the configured PromptKit source; that
 definition replaces the fallback rather than merging with it. The fallback
-leaves reasoning and optional sampling controls unspecified.
+leaves reasoning and optional sampling controls unspecified. Deployment profile
+selection and the maintained operator example are documented in
+[Configuration](../config.md#promptkit-profiles).
 
 All extraction prompts share this four-message rendered prefix: the system
 message without cache control, the identity message without cache control, the

docs/internal/llm.md

@@ -30,7 +30,8 @@ maps the trimmed request session to PromptKit's direct per-run session field,
 retains the same value as the `session_id` prompt variable for maintained
 prompt compatibility, and forwards profile selection. It then creates one
 frozen prepared execution, captures its caller-owned credential-redacted
-details for debug material, and executes that exact snapshot. The direct field
+details for debug material, and executes that exact snapshot through
+PromptKit's prepared-execution boundary. The direct field
 is authoritative for provider session behavior. A session ID is a stable,
 non-secret correlation identifier and may be exposed to providers and provider
 observability. The adapter returns PromptKit’s validated raw bytes rather than
@@ -48,8 +49,9 @@ production constructs one shared client, the selected state applies uniformly
 to module calls, retries, and LLM-backed validators for the whole run.
 
 An empty request profile lets the prompt select its configured default. Before a
-run begins, the CLI asks the adapter to inspect every explicitly selected
-binding profile. Inspection resolves the profile and its selected backend and
+run begins, the CLI asks the adapter to inspect every explicit profile on the
+resolved selected LLM-backed bindings and validators, including inherited
+pipeline profiles. Inspection resolves the profile and its selected backend and
 target without loading a prompt, reading credentials, admitting capacity, or
 contacting a provider, so a missing or invalid explicit profile fails before
 stage execution while a valid `api_key_env` may remain unset. Calls record the
@@ -80,8 +82,9 @@ identity of PromptKit's compiled-in profile catalog with a deterministic digest
 of every YAML profile in the configured profile directory, or of the configured
 profile file, and a deterministic digest of the flattened fallback profile
 assets. The fingerprint contains neither profile content nor source paths. It
-covers both explicit binding profiles and prompt-selected defaults, so changing
-a model or other profile setting cannot reuse checkpoints created under the
+covers inherited pipeline profiles, explicit binding profiles, and
+prompt-selected defaults, so changing a model or other profile setting cannot
+reuse checkpoints created under the
 prior profile source. This cache identity is independent of durable
 profile provenance: run manifests continue to list only profiles actually
 observed during LLM calls. When the local backend is registered, a second

docs/internal/modules.md

@@ -17,8 +17,10 @@ accepted reference slots. The execution class states whether a module is
 `deterministic` or `llm_backed`; registries retain it for catalog inspection and
 resolved-pipeline debug data without constructing the module. The framework
 uses the declaration to resolve a configured binding before it builds the
-implementation. Profile inheritance and deterministic-profile validation are
-not implemented at this boundary yet.
+implementation. After selection, the resolver applies profile inheritance only
+to bindings whose declared execution class is `llm_backed` and rejects a
+binding-specific profile on a deterministic module. The user-facing precedence
+contract belongs in [Configuration](../config.md#pipelines).
 
 Implementations that accept options must provide both an option validator and
 a builder. The validator is used while resolving configuration; the builder
@@ -51,7 +53,7 @@ Production composition is intentionally split by family:
 - The Seriatim registrar provides the transcript input adapter. Its external
   input behavior is defined by the [Seriatim contract](../integrations/seriatim.md).
 - The D&D registrar provides its codecs, extractors, mergers, normalizers,
-  validators, prompt assets, and default chains. Its behavioral conventions
+  validators, prompt assets, fallback profile asset, and default chains. Its behavioral conventions
   are documented in [D&D Module Internals](dnd.md).
 
 The CLI owns the composition that invokes these registrars. A module package

docs/internal/pipeline.md

@@ -34,6 +34,11 @@ requested lanes where that is supported, resolves validator chains, checks
 module capabilities and typed artifact compatibility, validates options, and
 assigns a deterministic resolved-composition digest. The resolved pipeline
 contains bindings and declared reference targets, not external reference bytes.
+After selection, the resolver applies command, binding, and pipeline profile
+precedence to LLM-backed bindings and validators only; prompt defaults remain
+an empty resolved binding profile. Deterministic bindings remain profile-free.
+These effective values are part of the digest, so execution and checkpoint
+consumers do not repeat profile inheritance.
 Configuration resolution supplies the selected profile and catalog; see
 [Configuration Internals](configuration.md).