Data Contracts Between Pipeline Stages: Why Errors Stop at the Seam

Most pipelines fail quietly in the middle. A stage produces something slightly off (a field with the wrong shape, a value that overflowed, a match that’s ambiguous) and the next stage does its best with it anyway, because refusing to proceed feels worse than continuing with a guess. By the time anything looks wrong, three more stages have built on top of the bad input, and nobody can say exactly where it went sideways. Rexfin’s pipeline runs on a different assumption: every handoff between stages is a contract, and the receiving stage is allowed, expected, to refuse anything that doesn’t meet it.

The bundle is the contract, not a hope

Ingestion doesn’t hand its output to the next stage as a loose pile of extracted numbers. It assembles everything a filing produced (the fact ledger, the cited chunks, the canonical pages, the edge graph connecting figures to each other, a report on how the extraction quality gate scored the filing, and a manifest describing what’s in the package) into a single content-addressed bundle. Before that bundle goes anywhere, ingestion validates it against a schema it doesn’t own itself. If the bundle doesn’t conform, ingestion refuses to emit it. It doesn’t quietly reshape the data to fit, and it doesn’t pass along a bundle that’s close enough and let the next stage sort it out. A refusal at this point means a filing that needs another look, not a bad number three stages downstream with no way to trace it back.

The other side checks too

The stage that receives the bundle doesn’t take conformance on faith just because the sender said it validated. It runs its own declarative data-quality gate against the same shape of contract at the boundary, before anything in the bundle is treated as new data. Two independent checks of one handoff, one on each side of the seam, is what an enforced contract looks like rather than an assumed one: if a bug in ingestion’s own validator ever let something through, the receiving side is the second line, not a formality.

Some of what crosses that seam is refused for shape (a numeric field that isn’t actually a finite number, or a value that overflowed past anything a real filing would report) and some is refused for ambiguity: a citation anchor that could plausibly point to more than one figure gets rejected rather than resolved by picking one and hoping. Recursive structures that reference each other are walked to a bounded depth rather than followed indefinitely, so a malformed or adversarial structure can’t turn a validation step into a hang.

Contracts aren’t only about shape

A record can be perfectly well-formed and still not earn trust. Before an extracted figure is allowed to become citable (before anyone can point to it as a fact), multiple independent extraction backends have to agree on what it says. A single backend’s read, however clean, isn’t enough on its own; agreement across backends is part of the contract a figure must satisfy before it moves from extracted to usable, the same standard verification builds on when checking whether totals actually tie out.

The same logic separates provisional numbers from actual ones. A forecast or a plan submitted into Rexfin travels its own lane (its own storage, its own write path), kept structurally apart from the atoms that verification and citation draw on. Anything in that submission that tries to claim it’s already an actual, already cited, or already audited gets rejected outright, and the assurance level attached to a plan is stamped by the system itself rather than accepted from whatever the sender claims. A projection can’t dress itself up as a filed number just by asking to be treated as one.

Why refusal beats repair

A stage that refuses malformed input rather than patching it also fails in a way you can recover from: the same discipline behind how the platform handles reliability and disaster recovery, know exactly what broke, isolate it, and let everything else keep running. Contracts between stages make that possible at the seam level, not only at the level of the whole system.

Who this is for

Anyone who has had a downstream report break and spent an afternoon tracing a bad number back through three systems before finding where it went wrong. Rexfin’s pipeline is built so a malformed record gets rejected at the first boundary it crosses, with a reason attached, instead of propagating quietly until it surfaces as a wrong figure on a page you were trusting. See how the seams fit together at the pillar overview, or book a demo to see a contract violation caught live.