config-fails-open-verify-artifact
When the config fails open, only the artifact is evidence
Many config formats accept keys they do not understand: HOCON and JSON without a schema, most YAML
consumers, .desktop files, property lists, manifest dialects. A misspelled key, a key at the wrong
nesting level, or a key that moved between tool versions produces no error, no warning, no note.
That turns a whole class of bugs invisible. The failure state and the working state look identical from inside the repository: same file, same green build, same silence. The only place they differ is the generated artifact.
Traps
Re-reading your config proves nothing. The config is what you typed; that was never in doubt. Reviewers checking "is the key spelled right / is it in the file" cannot catch a level error, because the level looks plausible in both placements. Neither can a diff of the config across versions.