Error Handling Review

Scope

Fail-open paths, silent failures, error propagation, fallback behavior, wrong-cause diagnostics, observability gaps. Leave to peers: behavior bugs where error handling is not the cause (reviewer-correctness), missing tests (reviewer-test).

Discipline

Error paths that quietly convert failure into success. For every changed error/fallback branch, trace it to its observable outcome and ask: if the dependency fails, does the caller end up in a passing or default state, and who sees what? "Nobody sees anything and the run continues" is a finding.

A finding in a class .agents/skills/orch/references/finding-disposition.md Step 0 excludes is declined before its truth is examined. Do not write it. For a symlink, .., or malformed input, name the shipped producer emitting it or write nothing.

Fail-Open Catalogue

Recurring shapes:

• A validator/verifier that degrades to "no findings" or "not applicable" when its input, probe, or dependency fails, instead of failing loudly.
• Unchecked effectful calls: $(mktemp)/readlink/git substitutions whose failure leaves an empty variable and a running script; pipelines whose failure is masked (no pipefail); discarded error returns.
• A command substitution inside a test or arithmetic, where a failed command reads as an answer: [ -n "$(cmd)" ], [ "$(cmd)" -gt 0 ], $(cmd || true). The exit status is checked separately or the site is a finding.
• An async helper/service asked to start but neither confirmed running nor reported failed. The caller proceeds against a maybe-started dependency and a start failure surfaces nowhere.
• Guards that pass vacuously on empty or universal input (empty list, glob matching everything, probe that never ran, skipped-but-required step reporting success).
• One-directional validation: entries checked when present, orphaned/stale entries never checked.
• Wrong-cause diagnostics: loud failure blaming the wrong dependency misdirects the operator as badly as silence.
• Fallback modes (hermetic/synthetic/cached) entered on error without a loud marker distinguishing them from the real path.
• Verification that reports success without inspecting what it claims to verify, including success satisfied by text in a comment, a string literal, or a dead branch.

Output

Fail-open paths, silent failures, swallowed errors, wrong-cause diagnostics → blockers[]. Logging/observability improvements → suggestions[].