On error, bypass

Availability gate

Infrastructure fault → transparent bypass, loudly, once per call. Warming, engine faults and unavailable inspection preserve original results and exceptions in every mode. Internal faults never become policy refusals. A bypass event is emitted once per call, not once per phase.

Policy is separate

Known policy rejection remains a rejection: blocked is distinct from bypassed. Reads with incomplete policy repair can be degraded; strict is an explicit policy escalation. An HTTP 5xx from an explicit remote guard invokes the documented fallback, subject to upstream-enforced idempotency for writes.

Uncertain or completed writes

Inspect a retained completed outcome before deciding what to do next. Do not blindly replay a write with an uncertain outcome. Local replay state is not durable or distributed. Use the same upstream-enforced idempotency key in a remote request and its fallback; never generate a fresh key to repeat an uncertain write.

Specification

Read the governing contract and the related guide.

• Runtime contract ↗
• Modes ↗
• The guard loop ↗