Kernel capabilities implemented. End-to-end platform integration and qualification are progressing.Interactive demonstrationPlatform status
DocumentationContactRequest a demo
HomePlatformCapabilitiesGoverned safe degradation

Capabilities · Governed safe degradation

When conditions fail, system invariants must not.

Systems should not have to choose between continuing to operate and preserving their safety boundaries. NiGeNje governs how systems respond to capacity loss, dependency failures and changing operating conditions without permitting unauthorised or invariant-violating transitions.

Cross-platform capabilityNot a standalone productSimulation-labelled demonstrationNot production-qualified
Run the three demonstrationsRead the λ-Safe modelRequest a technical briefing

NiGeNje governs how autonomous and distributed systems transition when normal operating conditions deteriorate. It establishes admissible degraded modes, preserves mandatory invariants, enforces authorised transitions, independently verifies resulting behaviour and maintains evidence of conformance.

More than graceful degradation

Graceful degradation keeps serving. Governed safe degradation asks whether serving is permitted.

Traditional graceful degradation focuses on retaining some level of service when conditions deteriorate. NiGeNje’s governance places additional questions around that decision.

Question askedHow do we keep some service running?Which reduced modes are permitted, and which invariants must hold?
AuthorityOften implicit in application fallback logic.Explicit authority for the specific degraded transition.
InvariantsMay not be re-evaluated in the reduced mode.Mandatory invariants are checked for the degraded mode and transition.
Execution boundaryFallback code paths invoked directly.Registered mediation and supported execution adapters.
OutcomeAssumed from the fallback response.Independently observed and reconciled.
ConformanceRarely evaluated after the fact.Chinje assesses evidence sufficiency, drift and conformance.

Responsibility separation

Three roles, deliberately not collapsed.

Safe degradation is a cross-platform capability, not a feature of one component. Verification, decision-making, enforcement and conformance assessment remain distinct.

Chinje

Integrated

Intent continuity and conformance

  • Maintains declared intent, identity and authority context.
  • Preserves provenance and evidence requirements.
  • Evaluates observed behaviour against declared intent and contractual expectations.
  • Classifies drift and determines conformance.
  • Supports authorised reconciliation and recovery.

Chinje is the sole evidence-sufficiency and conformance authority in the platform architecture. Those responsibilities are not delegated to λ-Safe, the Control Plane or the runtime enforcement layer.

λ-Safe

Integrated

Safety boundaries and admissibility

  • Defines and formalizes mandatory invariants.
  • Specifies admissible operating and degraded modes.
  • Defines minimum service floors and fallback constraints where the contract specifies them.
  • Establishes permitted transition conditions.
  • Verifies whether proposed transitions satisfy applicable formal constraints.

λ-Safe does not execute or enforce runtime transitions. A verification verdict is not a permit, a decision or an execution.

Control Plane and runtime

Integrated

Governed execution

  • IDM evaluates feasible actions within applicable constraints.
  • Gatekeeper performs admission and authorization.
  • NARG mediates applicable agent and tool-originated runtime actions.
  • Substrate adapters execute authorised actions.
  • Independent Observer establishes actual external outcomes.
  • Reconciliation compares expected and observed effects.
  • Certification and Audit Ledger preserves evidence.

Governed execution applies through supported adapters and runtime boundaries. NiGeNje does not claim universal interception of arbitrary shell, socket or SDK activity.

Architecture

Governance wraps the degradation transition.

Intent and the operating contract feed both Chinje and λ-Safe. The resulting constraints inform the control path; enforcement happens at the runtime boundary; the outcome returns to Chinje for conformance.

System intent and operating contract

Declared objective, obligations, operating assumptions and minimum service floors.

Chinje

Intent, identity, authority, evidence sufficiency and conformance.

λ-Safe

Invariants, admissibility, degraded modes and transition constraints.

NiGeNje control path
IDM · decision
Gatekeeper · admission
NARG · mediation
Substrate · execution adapter
Real target system
Independent Observer

Observed mode and external state.

Reconciliation

Expected versus observed effects.

Certification and Audit Ledger
Chinje conformance

Evidence sufficiency, drift classification and the conformance verdict.

Colour and labels distinguish formal verification, authorisation, decision-making, runtime enforcement, independent observation and conformance assessment. This is a logical architecture, not a claim that every path is integrated in one production execution chain.
VerificationDecisionAuthorisationEnforcementObservationConformance

The complete workflow

Ten governed steps from deterioration to recovery.

  1. 01

    Telemetry / Control Plane

    Detect deterioration

    Capacity, dependencies, operating conditions or invariant pressure move outside the declared envelope.

  2. 02

    λ-Safe

    Evaluate available modes

    Candidate operating and degraded modes are tested against the compiled invariant and contract constraints.

  3. 03

    λ-Safe

    Determine admissibility

    The system establishes whether a degraded transition is admissible at all. Inadmissible modes are refused.

  4. 04

    Chinje

    Verify intent and authority

    Intent continuity, actor identity, delegated authority and policy are established for the transition.

  5. 05

    Gatekeeper

    Authorise the transition

    An independent admission decision issues a scoped permit bound to the specific degraded transition.

  6. 06

    NARG / Substrate

    Enforce the action

    NARG mediates registered actions and Substrate applies the authorised transition through a supported adapter.

  7. 07

    Independent Observer

    Observe actual behaviour

    The observed mode and external state are recorded independently of the executor's claim.

  8. 08

    Reconciliation

    Reconcile outcomes

    Expected and observed results are compared; divergence is preserved, not overwritten.

  9. 09

    Chinje

    Assess conformance

    Chinje evaluates evidence sufficiency, drift and conformance against the declared intent and contractual expectations.

  10. 10

    Chinje

    Permit recovery

    Recovery is a new transition. It requires the stated conditions and a fresh admissibility verification.

Critical failure path

If no admissible degraded mode exists, the system must deny, isolate or contain.

It must not invent an unsafe fallback. Degraded operation is not automatically preferable to denial or isolation, and continued availability is not an acceptable outcome if a mandatory invariant would be violated.

Interactive capability demonstration

Three governed responses to changing conditions.

Normal operation, an admissible degraded transition, and a case where every available mode violates a mandatory invariant. The model evaluates λ-Safe admissibility, authorisation, enforcement, observation, reconciliation and Chinje conformance.

Local simulation

Interactive product simulation. Every condition, admissibility verdict, authorisation, observation and conformance result below is generated by a local deterministic model. It is not live enforcement and it is not evidence that end-to-end governed safe degradation has been qualified.

run 01

Operating conditions

Capacity58% / floor 70%
Dependency latency168 ms / budget 120 ms
Cache integrity verificationverified

Candidate modes and λ-Safe admissibility

Full operation

inadmissible

Normal read and write path with the complete dependency set.

  • INV-WRITE-PROVENANCEEvery write carries provenance and an admitted permit.Writes require an admitted permit; provenance path is intact.
  • INV-CACHE-INTEGRITYServed state must pass an integrity check verified within the operating window.Cache integrity check available and current.
  • INV-TENANT-ISOLATIONTenant boundaries hold in every operating mode.Tenant scope enforced on the normal path.
  • INV-OPERATING-FLOORCapacity must remain at or above the declared operating floor for full operation.Capacity 58% is below the declared operating floor of 70%; the write transition is not admissible.

Capacity is below the declared operating floor, so the full-write transition is inadmissible.

Read-only degraded mode

admissible

Serve verified reads only; writes are refused; tenant scope remains enforced.

  • INV-WRITE-PROVENANCEEvery write carries provenance and an admitted permit.No writes are permitted in this mode.
  • INV-CACHE-INTEGRITYServed state must pass an integrity check verified within the operating window.Cached reads passed the integrity check within the operating window.
  • INV-TENANT-ISOLATIONTenant boundaries hold in every operating mode.Tenant scope is still enforced for reads.

Reduced mode preserves every mandatory invariant.

Selected transition

Isolate and contain

admissible

Stop serving the affected path; preserve state; require fresh verification before recovery.

  • INV-WRITE-PROVENANCEEvery write carries provenance and an admitted permit.No writes occur while isolated.
  • INV-CACHE-INTEGRITYServed state must pass an integrity check verified within the operating window.The path is isolated unnecessarily, but no unsafe state is served.
  • INV-TENANT-ISOLATIONTenant boundaries hold in every operating mode.Isolation is scoped to the affected target; tenant boundaries hold.

Isolation preserves safety by removing the affected path; it is not a degraded service mode.

Governed transition path

  1. Telemetrypass
    Deterioration detected

    Capacity 58% is below the 70% floor; dependency latency 168 ms exceeds the 120 ms budget.

  2. λ-Safepass
    Admissible modes evaluated

    Full operation is refused; read-only degraded mode preserves all mandatory invariants and is admissible.

  3. Chinjepass
    Intent and authority

    Intent is unchanged; the operator holds delegated degraded-mode authority with evidence sufficient for this transition.

  4. Gatekeeperpass
    Admission

    Degraded transition admitted and a scoped permit issued for the read-only mode.

  5. NARGpass
    Runtime mediation

    Registered mode-change action mediated; permit bound to the transition.

  6. Substratepass
    Execution

    Read-only adapter applied; writes are now refused at the execution boundary.

  7. Independent Observerpass
    Observation

    Observed mode is read-only; writes refused; tenant scope enforced.

  8. Reconciliationpass
    Reconciliation

    Expected degraded mode matches observed mode; no unverified write occurred.

  9. Chinjepass
    Conformance

    Evidence is sufficient: degraded state is authorised and within the declared contract. Recovery remains pending.

  10. Chinjepending
    Recovery

    Recovery does not happen automatically: capacity must recover and a fresh admissibility verification is required.

Outcome

DEGRADED_CONFORMANTCONFORMANT_WITH_DEGRADATION

Full operation is inadmissible, but a defined read-only mode preserves every mandatory invariant. The transition is authorised, mediated, observed and reconciled before Chinje assesses conformance.

Recovery

Not recovered. Recovery requires the stated conditions plus a fresh admissibility verification.

Recovery to full operation requires capacity at or above 85% and a fresh λ-Safe verification of the transition.

Evidence references (stable IDs)

  • sd-deg-conditions
  • sd-deg-admissibility
  • sd-deg-authority
  • sd-deg-admission
  • sd-deg-mediation
  • sd-deg-execution
  • sd-deg-observation
  • sd-deg-reconciliation
  • sd-deg-conformance
  • sd-deg-recovery

These identifiers are generated by the local model so a replay can be compared. They are not audit-ledger records from a running NiGeNje deployment.

Evidence and maturity

What is established, what is only demonstrated, and what is not claimed.

The architecture and component foundations exist. Full end-to-end safe-degradation qualification has not been established, and this page does not claim it.

Safe-degradation maturity boundary
Capability layerStatusWhat that means here
Component foundations (λ-Safe compiler, Chinje, Gatekeeper, NARG, Substrate, observer, reconciliation, ledger)Implemented / Demonstrable / IntegratedVerified in the bounded local, non-production chain described in the maturity register.
Governed safe-degradation modelDemonstrableDesign and simulation grounded in the published λ-Safe research; demonstrated on this page as a labelled local model.
End-to-end safe-degradation integrationIn progressCross-component integration and real-environment rehearsal are not established.
Engineering qualificationPlannedNo engineering qualification tests, benchmarks or independent validation for safe degradation are claimed.
Production qualificationNot claimedNo production deployment, certification, SLA or availability guarantee is claimed.

Claims that would require evidence before being presented as achieved: end-to-end invariant preservation during real degradation; independent verification of degraded execution; successful reconciliation and conformance assessment; verified recovery to normal operation; and generalised support across distributed-system substrates.

These are the qualification targets, not current claims. The published λ-Safe research describes a type-theoretic framework for invariant-preserving degradation; it does not constitute production evidence for this platform.

λ-Safe product pageChinje product pageArchitecture and lifecycleFull governance demonstrationPlatform status

Evaluate the capability

Bring an operating assumption that must not be violated.

A bounded evaluation starts with the invariant, the failure conditions and the evidence a reviewer would need to accept a degraded transition.

Request a technical briefingBecome a design partner