feat(rewrite): add conditional combined workflow

[andreatnvidia]

Related Issue

Closes #237

Plan Document

plans/237/combined-rewrite-graph.md

Summary

Add an opt-in rewrite workflow that executes replacement-map generation, the initial rewrite, evaluation, and a bounded number of conditional repair iterations in one Data Designer graph.

The graph statically unrolls max_repair_iterations and uses SkipConfig.when to skip repair and downstream re-evaluation after each row passes. It supports zero or multiple repair rounds, preserves no-entity passthrough, row order, final metrics, repair counts, and review flags, and continues to execute through NddAdapter.run_workflow().

The legacy workflow remains the default in this PR. Data Designer 0.8 does not expose terminal failed-column and seed-row provenance through its public result API, so a dropped row in the combined graph can only be attributed to rewrite-combined. Draft Data Designer #861 implements the required lightweight provenance API. Keeping this path opt-in avoids reducing default failure observability before that API is merged, released, and integrated.

For entity-bearing rewrite runs, the combined graph reduces the full pipeline's base Data Designer workflow count from five to three. The two detection workflows and the separate non-critical judge path are unchanged.

Experiment evidence

We ran a controlled self-hosted comparison on a single GB300 using GPT-OSS 120B across 12 diverse synthetic PII records. Detection, replacement maps, domain classification, sensitivity decisions, meaning units, and QA plans were generated once and reused by both paths. Both paths received the same initial evaluated rewrite state, execution order was counterbalanced across two six-record groups, and both allowed up to three repair iterations.

Ten records were selected for repair and two were clean skip controls. Both paths made the same repair decision for all 12 records: ten stopped after one repair, two stopped at iteration zero, and none still required repair. The successful run had zero workload failures and zero measured leakage for every output.

Both paths made 80 LLM requests. Across the two groups, legacy used four DD workflows for repair and re-evaluation while combined used two. Combined took 10.56 seconds versus 10.80 seconds for legacy, a 2.2% reduction. This establishes latency parity, not a speedup claim.

Ten of twelve paired outputs were byte-identical and 11/12 final human-review decisions agreed. The paired mean utility delta was -0.0867, the median was zero, and the approximate 95% interval was [-0.2496, 0.0763]. The interval includes zero; separate real-model generations and judge calls remain nondeterministic even with fixed sampling settings.

The experiment also exposed structured-payload checkpoint problems in both paths. The PR now normalizes public QA payloads at combined finalization and at legacy evaluate-to-repair boundaries. Regression tests cover mixed list and NumPy representations across real repair iterations.

Retained GB300 DCGM telemetry showed flat HBM use within both successful controlled runs, with no detectable combined-path GPU-memory regression. Combined Data Designer artifacts were larger: +187% with no repairs and +60% with one repair, although the absolute totals remained below 230 KB for two six-row groups. Retained dataframe memory increased by 6% and 22%, respectively. The five-second telemetry cadence and group-level timings do not support a reliable tail-latency comparison.

An earlier 30-pair Slurm suite remains useful only as scale and stability evidence. Its latency comparison was confounded by different repair behavior and fixed ordering, so it is not used for the performance conclusion above.

Follow-up after Data Designer #861

This PR intentionally stops at an opt-in combined workflow. After Data Designer #861 is merged and available in a supported release, a small Anonymizer follow-up will:

• capture terminal failure locations through NddAdapter;
• map seed-row positions to _anonymizer_record_id and failed columns to the existing rewrite stage names;
• make the combined graph the default;
• retain the legacy workflow as an explicit fallback during rollout.

Legacy removal can follow production rollout evidence and is not part of this PR.

The branch is synchronized with current Anonymizer main. The combined-runner routing is integrated with main's privacy-goal validation and evaluation refactor.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• CI, release, or contributor workflow update

Contributor Checklist

• PR title follows Conventional Commits, for example fix: handle empty entity list
• Related issue is linked, or a maintainer-owned no-issue reason is documented above
• For non-trivial changes, a plan document is linked above, or the no-plan reason is documented above
• Public API impact checked; skills/anonymizer/SKILL.md updated if needed
• No real PII added to tests, docs, notebooks, fixtures, or artifacts
• No API keys, service tokens, private keys, credentials, or real endpoint secrets added

The bundled skill remains on the unchanged legacy default and does not need an update for this opt-in path.

Validation

• Commands and experiments run:
  • .venv/bin/ruff check --fix .
  • .venv/bin/ruff format .
  • env -u VIRTUAL_ENV .venv/bin/ty check --error-on-warning
  • TMPDIR=<short-temp-path> .venv/bin/pytest --basetemp=<short-temp-path>/pytest - 1,209 passed
  • focused merged interface and rewrite tests - 96 passed
  • focused real Data Designer conditional scheduling with zero, one, two, and exhausted repairs
  • controlled 12-record GB300 repair comparison - 24 paired path executions, 10 repaired and 2 skipped per path, zero workload failures
  • retained GB300 DCGM and artifact analysis - flat HBM, artifact and dataframe overhead quantified
  • earlier paired Slurm scale suite - 60 executions, zero failures
• Remaining gaps:
  • Default rollout is intentionally deferred until Data Designer #861 is merged, released, and integrated.
  • The real-model comparison supports correctness and latency parity, not a statistically meaningful speedup.

Documentation and Artifacts

• Docs updated, or not needed
• If docs changed: make docs-build passes locally
• If tutorial sources changed: notebooks regenerated with make convert-notebooks
• If e2e, benchmark, or model-provider behavior changed: relevant validation is listed above

The internal plan documents the rollout decision, benchmark interpretation, completed compatibility coverage, and deferred default integration. No user-facing documentation or tutorial changed.

[greptile-apps]

Greptile Summary

The PR adds an opt-in combined Data Designer rewrite graph that generates replacements, rewrites, evaluates, and conditionally repairs rows in one statically unrolled workflow.

• Adds conditional repair/evaluation states and final-state coalescing.
• Routes rewrite execution through the combined runner when enabled.
• Normalizes structured evaluation payloads at workflow boundaries.
• Adds coverage for conditional scheduling, passthrough rows, failures, ordering, and runner selection.

Confidence Score: 4/5

The PR appears safe to merge, with the non-blocking limitation that CLI users cannot enable the new combined workflow.

The combined workflow is opt-in and has focused scheduling and integration coverage; the remaining issue is an inconsistent configuration surface rather than a runtime correctness failure.

Files Needing Attention: src/anonymizer/config/anonymizer_config.py and src/anonymizer/interface/cli/main.py

Important Files Changed

Filename	Overview
src/anonymizer/engine/rewrite/combined_workflow.py	Introduces the combined replacement, rewrite, conditional repair, evaluation, and finalization graph with passthrough and ordering support.
src/anonymizer/engine/rewrite/rewrite_workflow.py	Normalizes structured evaluation payloads before they cross legacy repair boundaries.
src/anonymizer/interface/anonymizer.py	Constructs the combined runner and selects it when the new rewrite configuration flag is enabled.
src/anonymizer/config/anonymizer_config.py	Adds the opt-in use_combined_graph field, but the corresponding CLI configuration surface is missing.
tests/engine/test_combined_rewrite_workflow.py	Covers graph construction, real conditional scheduling, finalization, row failures, passthrough behavior, and parity with the legacy workflow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Detected rows] --> B{Entities present?}
    B -->|No| P[Apply passthrough defaults]
    B -->|Yes| R[Generate replacement map]
    R --> W[Initial rewrite]
    W --> E0[Evaluate iteration 0]
    E0 --> C0{Needs repair?}
    C0 -->|No| F[Finalize last executed state]
    C0 -->|Yes| RP[Repair iteration]
    RP --> EN[Evaluate next iteration]
    EN --> CN{Needs repair and rounds remain?}
    CN -->|Yes| RP
    CN -->|No| F
    P --> M[Merge in original row order]
    F --> M

Loading

_{Reviews (1): Last reviewed commit: "docs: finalize combined rewrite rollout ..." | Re-trigger Greptile}

[greptile-apps]

Combined mode missing from CLI

The public use_combined_graph rewrite setting has no corresponding CLI option or mapping, so CLI users cannot enable the new opt-in workflow without switching to the Python SDK.

Knowledge Base Used:

• Anonymizer Configuration (anonymizer.config)
• Interface & CLI Flow