Engineering note
Availability is not invariant preservation
A system can stay up while violating the property it was built to protect. Governed safe degradation asks which reduced states are actually permitted.
Most degradation mechanisms are designed around one question: how do we keep serving? Retries, failover, cached reads and graceful shutdown all answer that question. None of them, by themselves, answer a different one: is the reduced state still permitted?
A system can therefore be available and non-conformant at the same time. Cached reads can serve stale data, a fallback can skip a reconciliation check, and a retry can double-apply an effect. The dashboard stays green while the invariant that mattered has already been broken.
The governed question
Governed safe degradation adds authority, admissibility and evidence to the degradation decision. λ-Safe defines and verifies admissible operating and degraded modes; Gatekeeper authorises the specific transition; NARG mediates the registered action; Substrate applies it through a supported adapter; the observer records what actually happened; reconciliation compares expected and observed state; Chinje assesses conformance.
When no admissible mode exists, the governed answer is denial, isolation or containment — not an invented fallback. Availability is not automatically preferable to stopping safely.
What is implemented, and what is simulated
The component foundations exist in the local, non-production chain. The safe-degradation model itself is grounded in the published λ-Safe research and demonstrated on this site as a labelled local simulation. End-to-end safe-degradation qualification across real infrastructure has not been established.
That distinction is not a marketing caveat. It changes what the demonstration can be used for: it is useful for reasoning about decision order, refusal paths and evidence requirements; it is not evidence that a production system preserved an invariant during a real dependency failure.
A practical checklist
- Which invariant must hold in every operating mode?
- Which reduced modes are permitted, and who authorises the transition?
- What evidence is required before recovery to normal operation?
- What does the system do when no admissible mode exists?