Check accepts forms the rule rejects

What goes wrong

A check stands in for a stated rule but tests only some of the forms that rule covers. Inputs the rule forbids match nothing in the check and pass. Everyone downstream treats the verdict as if it carried the whole rule, so the gap is never visible where the damage lands.

Example

The rule says a worker count must be whole and within a range, but the setting only checks the range, so a fraction is saved and every run is handed a count it cannot use.

Not to be confused with

Not Guard matches one spelling of many, where a single form is written several ways and the guard knows one spelling; here the forms are genuinely different and the check simply covers fewer of them than the rule names.

Discovered by

@sks24git GitHub

Field notes · 6

@sks24git2026-11-04beat 2 review rounds

A strict readiness check dropped server errors but still took any other non-auth refusal as a yes. A rate limit or a wrong route in front of the service, three times in a row, ends a safety wait nothing passed.

List the answers that prove success; refuse the rest. A deny-list lets each new failure through.
Ask who answered. A front door can reply before the service reads the request.

@sks24git2026-11-03beat 1 review round

A check refused a list of known-bad triggers, so every trigger it forgot passed. A forgotten one reaches a protected job with nobody watching, and the test stays green.

Allow-list, don't deny-list. A list of bad cases is open; each one you forget passes.
Run a rule over everything it is about. A filter borrowed from another rule hides cases.

@sks24git2026-10-30

A count of parallel workers comes from an admin setting that checks the range but not that the number is whole. An operator types a fraction, it passes every check, and each run hands its workers a count they cannot use.

Mark every count setting as whole, not just bounded. A range check lets a fraction through.

@sks24git2026-10-10

An extra-models list skipped entries already in the menu by exact id, but built-in entries used a short id while the list used a vendor-prefixed one. Put the prefixed id in the list and the picker shows one model twice.

Normalise ids before you dedupe. Two spellings of one id walk past an exact-match filter.
Test the merged list, not each source. Duplicates live where two lists meet.

@sks24git2026-09-28

A rewrite turned a nullable type list into a scalar type plus a nullable flag, ignoring the enum beside it that listed no null. A schema that rejected null now told the model null is fine.

Two spellings with different meaning must not rewrite to one node. If they collide, one of them lies.
Guard every rule the same way. The union rule checked enum; the type rule forgot to.

@sks24git2026-09-24beat 2 review rounds

A guard for a strict schema dialect banned two shapes, while the dialect rejects six. Numeric enums and tuple items slipped through, so requests that used to succeed started failing.

Build a dialect gate as an allowlist, not a denylist. A denylist misses every shape nobody wrote down.