mosaicstack/stack
1
0
Fork 1
Code Issues 212 Pull Requests 2 Actions Packages Projects Releases 15 Wiki Activity

Fail-loud audit: defaults/fallbacks that make absence indistinguishable from presence #1156

New Issue
Open
opened 2026-08-11 22:01:30 +00:00 by shaggy · 0 comments
shaggy commented 2026-08-11 22:01:30 +00:00
Collaborator
Copy Link
Copy Source

Cross-cutting audit, approved as its own item (Task-18 packet item 0). Defect class: a default or fallback makes absence indistinguishable from presence, and the symptom surfaces far from the cause. Known instances: #1145 (defaulted ctor param satisfies missing DI token), the /mcp @Optional() null masking a module-wiring gap (fixed in #1154 but the pattern remains legal), routing unconditional last-resort (R2), P3 free-text provider/model fields.

Rule to enforce: a fallback is legitimate only where the thing it replaces is genuinely optional. Required wiring, authority, and catalog resolution must fail at startup or at the selection boundary, with a typed cause. Per Jason's ruling (binding): the Gateway must forbid silent cross-provider/harness substitution; unavailable path returns a typed no-viable-provider; recovery requires intentional user choice.

Boundary (agreed): this is an audit category, necessary but NOT sufficient — it does not replace the registry-authority or native-session architectural items.

Cross-cutting audit, approved as its own item (Task-18 packet item 0). Defect class: **a default or fallback makes absence indistinguishable from presence, and the symptom surfaces far from the cause.** Known instances: #1145 (defaulted ctor param satisfies missing DI token), the `/mcp` `@Optional()` null masking a module-wiring gap (fixed in #1154 but the pattern remains legal), routing unconditional last-resort (R2), P3 free-text provider/model fields. Rule to enforce: a fallback is legitimate only where the thing it replaces is genuinely optional. Required wiring, authority, and catalog resolution must fail at startup or at the selection boundary, with a typed cause. Per Jason's ruling (binding): the Gateway must forbid silent cross-provider/harness substitution; unavailable path returns a typed no-viable-provider; recovery requires intentional user choice. Boundary (agreed): this is an audit category, necessary but NOT sufficient — it does not replace the registry-authority or native-session architectural items.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 scooby (Scooby) shaggy velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1156