ask-is-fault-tolerant-and-bounded
IN derived (depth 1)
The ask module is fault-tolerant (always returns a string, catches LLM failures, falls back to raw FTS5 search) and execution-bounded (tool loop capped at 3 iterations), ensuring reliable bounded knowledge retrieval regardless of LLM availability.
Summary
The ask module is designed to never fail and never hang. It guarantees a string result no matter what happens — if the LLM times out or crashes, it falls back to raw search results instead of raising an error, and if the LLM gets stuck in a loop requesting more searches, it gets cut off after 3 iterations. This means any code calling ask can treat it as a reliable, predictable function without needing its own error handling for LLM flakiness.
Justifications
SL — Three independent safety properties (guaranteed return type, exception handling, iteration bound) form a complete reliability contract for the ask module
Antecedents (all must be IN):
- ask-always-returns-string — `ask()` returns a string on every code path — LLM response, raw search results, or fallback; it never raises an exception to the caller.
- ask-never-raises-on-llm-failure — `ask()` catches `TimeoutExpired` and `RuntimeError` from `_invoke_claude()` and returns raw FTS5 search results instead of propagating the exception — the function guarantees a string return.
- ask-agentic-loop-is-bounded — The tool-call loop in `ask()` has a maximum iteration count; an LLM that perpetually requests more searches is terminated and the raw response is returned.
Dependents
These beliefs depend on this one:
- all-information-retrieval-is-fault-tolerant — Every information retrieval path — structured reads (FTS search with index self-healing, staleness checking with deterministic output, compact with pure bounded distillation) and LLM-synthesized queries (ask with bounded tool loops and raw search fallback) — degrades gracefully rather than failing, ensuring the system always returns useful results
- all-llm-interactions-are-bounded-and-fail-soft — All LLM-facing operations apply consistent defensive patterns across both interactive (ask) and batch (derive) paths: bounded execution (iteration caps, timeout handling), fail-soft error recovery (fallback to raw results or skipped proposals), and environment isolation (stripping recursive invocation variables).
- all-llm-operations-achieve-coverage-and-fault-tolerance — All LLM-driven knowledge operations achieve both complete coverage and fault tolerance: the derive pipeline provides safe, complete, production-ready derivation with exhaustive exploration and accurate budget allocation, while interactive queries via ask are fault-tolerant, execution-bounded, and gracefully degrading — no LLM-facing operation can crash, hang, produce unbounded output, or corrupt the network.
- ask-degrades-across-all-external-dependencies — The ask module degrades gracefully across all three external dependencies: LLM binary (catches TimeoutExpired/RuntimeError, falls back to raw search), FTS5 index (self-healing derived index with substring fallback), and source chunks database (catches OperationalError/DatabaseError and returns empty results) — no single external system failure prevents useful query responses.