diff --git a/docs/internal/pipeline.md b/docs/internal/pipeline.md index 94b3382..26ac052 100644 --- a/docs/internal/pipeline.md +++ b/docs/internal/pipeline.md @@ -325,7 +325,7 @@ processing immediately. Structured-completion adapters classify malformed or undecodable provider output with the provider-neutral `contracts.ErrInvalidStructuredOutput` error. A typed normalizer may turn that condition, or another unsafe proposal, into a -normalize retry directive with a deterministic safe candidate, stable +normalize retry directive with a module-supplied safe candidate, stable diagnostic, and fallback warnings. The directive consumes the same configured normalize retry budget: `retries` permits that many additional attempts after the initial attempt. It neither creates a normalizer-local retry loop nor @@ -339,6 +339,10 @@ rewriting either field. It validates only this mechanical contract; normalizers remain responsible for ensuring their otherwise valid diagnostics do not expose source material, credentials, paths, names, or other sensitive content. +The framework treats a module-supplied candidate as opaque. The normalizer owns +its safety determination, and the configured normalizer validator chain remains +the acceptance boundary for the final fallback. + When a later normalize attempt succeeds, its candidate alone proceeds through the usual validation and checkpoint path. When the final attempt still returns a directive, the runner validates its supplied safe fallback through that same diff --git a/docs/operations.md b/docs/operations.md index d50bbe8..03f4076 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -93,9 +93,9 @@ generated-reference barrier, `dnd/npcs` performs one document-level semantic normalization call for each configured normalize attempt when eligible distinct names remain. The normalize binding's `retries` setting controls additional attempts. If an invalid or unsafe identity proposal exhausts that budget, the -run safely accepts the deterministic and any independently safe partial -consolidation, with a bounded warning; ordinary validation still applies before -the artifact can cross the barrier. +run safely accepts the deterministic base result and any independently +validated, model-proposed partial consolidation, with a bounded warning; +ordinary validation still applies before the artifact can cross the barrier. An accepted normalized NPC checkpoint can be reused on `--resume` just like other accepted normalize work. A changed normalization prompt, response schema,