WorldScript Studio confines every AI failure to a single tested provider seam

The post opens with a test anyone can run: revoke the API key, switch off the network, open the app again ^[1]. Its author wrote that "a surprising number of products fail this test" ^[2]. The failures listed belong to the product, not the AI features: spinners that never resolve, a settings page that errors out, a startup sequence blocked on a model ping ^[2].

The author's rule for WorldScript Studio is that "the AI layer may fail in every way it wants, as long as the failure is typed, explained, and contained" ^[17]. Containment starts with routing. No feature talks to a provider directly, so none can grow its own retry loop, its own key handling or its own definition of offline ^[5]. In the factory excerpt, a local server such as Ollama is one config variant, `openaiCompatible`, with a `baseURL` field ^[6]. Keys sit behind the same service. The browser build encrypts them under a random non-extractable AES-256-GCM key in IndexedDB, and no provider SDK touches storage ^[8].

Routing has four user-visible modes, with hybrid as the default ^[9]. Enforcement is one function. `assertCloudAiAllowedSync` returns early for local inference providers, then hits this line ^[10]:

`if (mode === 'local' || mode === 'eco') { throw new Error(...) }`

It throws again if `privacy.localStorageOnly` is set ^[10]. I think this is the right call for any app that makes a local-only promise, because a convention spread across components can only be verified by reading every component. The author wrote that a gate which throws can be tested in a way that a gate which merely ought to be checked cannot ^[11]. The policy test suite exercises the mode matrix directly ^[12].

The error taxonomy is the part I would copy first. A rate limit, a wrong key and a dead network need different responses. The seam puts each failure in its own class with a stable message key ^[15]. The interface can then say "check your key" or "you are offline", and the retry layer fails fast on a call that will never succeed instead of backing off politely ^[15]. The alternative, familiar to anyone who has shipped it, is a toast saying "something went wrong" above a dead feature, the author wrote ^[19].

The privacy claim is scoped with care. Training data is manuscript data, so the LoRA path is allowlisted to local providers ^[13]. I would rather read the next sentence than a blanket guarantee, and the author wrote it: the rule covers the training path only, and a cloud provider the user calls receives the context sent to it ^[14].

Whether the pattern transfers depends on what is left when the model is gone. In WorldScript the AI assists with outlines, character work and prose feedback, and the app is built to work with no model at all ^[3]. A product whose main output is model output has less to fall back to. The design allows for that case, because its fallback layer is permitted to say "no fallback exists" ^[16]. The evidence is one author's account of their own code at commit 2d9157c0, release v1.28.8 ^[4]. The post includes no outage or failure-rate data, and it describes the fallback layer only in outline.