config-fails-open-verify-artifact

Installation
SKILL.md

When the config fails open, only the artifact is evidence

Many config formats accept keys they do not understand: HOCON and JSON without a schema, most YAML consumers, .desktop files, property lists, manifest dialects. A misspelled key, a key at the wrong nesting level, or a key that moved between tool versions produces no error, no warning, no note.

That turns a whole class of bugs invisible. The failure state and the working state look identical from inside the repository: same file, same green build, same silence. The only place they differ is the generated artifact.

Traps

Re-reading your config proves nothing. The config is what you typed; that was never in doubt. Reviewers checking "is the key spelled right / is it in the file" cannot catch a level error, because the level looks plausible in both placements. Neither can a diff of the config across versions.

Installs
2
GitHub Stars
35
First Seen
6 days ago
config-fails-open-verify-artifact — maxrave-dev/kotlin-footguns