Failing Closed

This chapter assembles the pipeline: one function that takes a question through every stage to what the learner is shown and what the log records, and a command that runs it from your terminal. It also states the rule the earlier chapters have been meeting one at a time.

A system is built to fail closed when a missing or broken part makes it do less, rather than something wrong. A door that locks when the power fails is failing closed; a door that opens is failing open. For this pipeline, doing less means answering from fewer stages, or refusing with its own line, and doing something wrong means showing a sentence nobody checked.

Degradation is the shape of doing less: each optional stage, when absent or failing, leaves the pipeline exactly as it was before that stage existed. Without the index it retrieves by words; without the rephraser it retrieves on the question alone; without the reranker the model reads retrieval’s eight; without the schedule the model reads the section without its fine. Each of those is an earlier chapter’s pipeline, measured and known, not a new one.

A dependency, in this chapter’s code, is a function handed to the pipeline from outside: the asker, the index, the rephraser, the reranker. A function that is absent is a stage that does not exist, and the deployed pipeline builds each one from a credential or a service binding and returns undefined when the credential is missing. That one convention is the whole degradation story: the box with no index binding is the box as it was before the index was built.