checks-that-fail-open

Restates absence-based verification checks as presence-based assertions that fail closed.

96|11|Updated Feb 8, 2026
One-click install
npx skills add https://github.com/thefrederiksen/devthrottle --skill checks-that-fail-open-thefrederiksen
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: checks-that-fail-open
Source: https://github.com/thefrederiksen/devthrottle/tree/main/plugins/agent-discipline/skills/checks-that-fail-open
Command: npx skills add https://github.com/thefrederiksen/devthrottle --skill checks-that-fail-open-thefrederiksen

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Verification checks whose pass condition is an absence (zero grep hits, no defects posted, empty output) certify runs that never happened, letting broken sweeps, truncated output, and skipped tests report clean passes. ## Core Features & Use Cases - Fail-open detection: Identifies checks where doing nothing satisfies the pass condition, such as greps that searched nothing or reviews that never ran. - Presence-based repair patterns: Provides concrete rewrites that derive enumerations from the artifact under test and assert a property of each item, with fail-open versus fail-closed comparison tables. - Use Case: A CI step greps pytest output for the word 'failed' and finds nothing, so it reports green — but a renamed test filter meant zero tests ran. This Skill rewrites the check to assert exit code 0 plus a collected-test count reconciled against the expected inventory. ## Quick Start Review my verification script and restate any check whose pass condition is an absence as a specific presence that fails closed.

Frequently Asked Questions about checks-that-fail-open

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a test that fails closed instead of failing open?▼

Restate the pass condition as a specific presence rather than an absence. Derive an enumeration from the artifact under test and assert a property of each item, so an empty result indicates a broken instrument rather than a clean run.

Why does my grep-based check report success when it searched nothing?▼

A grep that errors or matches nothing prints zero lines, and zero lines contain no bad string, so the check passes vacuously. Reconcile the sweep against an expected inventory first, and treat an empty result as a repair job on the instrument.

Should I parse pytest output or use exit codes in CI?▼

Read the exit code. Pytest uses 0 for success, 2 for collection errors, and 5 for no tests collected, while grepping output for 'passed' or 'failed' misfires on test names and summary wording. Also reconcile the collected count against what you expected to run.

What is wrong with asserting two counts are equal in a test?▼

If both sides of the comparison filter on the property the defect would fail, the failing case sits outside both sides and the test cannot fail. Enumerate every item and assert the property of each one instead of comparing numbers about the thing.

When is an absence-based check acceptable?▼

Rarely; the Skill argues absence checks should be restated as presences. If you must keep one, run it against a known-bad input to prove it fires, quote the actual output in the record, and state explicitly what was checked and what could not be reached.