Check Skipped When Field Missing

What goes wrong

A check looks up prior records by a composite key, or runs only when a field is present, so when part of the key or that field is missing from the request the lookup finds nothing or the check never runs — and 'not found' is read as 'allowed'.

Example

Duplicate detection searches by email and phone; a signup arrives without a phone number, the search misses, and the duplicate account is created.

Not to be confused with

The lookup runs with a partial key; not a policy that could not be read and defaulted to allow (Unreadable policy opens the gate), not a checker handed nothing to check (Missing Input Green Gate), and not a rule wholly absent from one entrypoint (Sibling entrypoint skips the policy).

Discovered by

@sks24git GitHub

Field notes · 4

@sks24git2026-11-02beat 1 review round

A merge gate reads a check that CI creates only after its test jobs finish, and one commit gets two CI runs. The faster run turns green first and the gate passes while the slower run is still testing.

Wait on the run, not on the summary check. A summary check that does not exist yet is not a pass.
Test the states the platform makes. A fixture of an impossible state proves nothing.

@sks24git2026-10-23

A parser gained a second input mode, but two old branches still looked up columns that only the first mode has. A blank date in the first row or a totals row crashed with a missing-key error instead of a clean refusal.

When you add a mode, grep every key the old mode reads. Old branches still assume its columns.
Test the odd rows in each mode. Blank first rows and totals take paths nobody runs.

@sks24git2026-09-24beat 1 review round

A schema filter checked that object nodes were closed, and a node with no type counted as not an object. An untyped field then passed the filter, and the upstream rejected a request it used to answer.

Probe the empty case of every rule. A node with no keywords passes an allowlist for free.

@sks24git2026-09-11beat 1 review round

Two doors each refused toward the other: one for diff size, the other with 'go use the first door'. A small commit could never reach the run the user asked for, and no test walked both doors in one go.

Test the round trip a refusal recommends. A remedy that lands on another refusal is a dead end you shipped.