Passante A Passante publication

En Passante

In Passing
Field Kit

A protective policy can hide a bad default

Test the changed decision independently of a downstream safeguard that can mask its defect.

What happened

A provider resolver silently selected a metered service when local configuration was absent, while a separate cost policy prevented spending; a test of the final route passed with either default until the changed function was tested directly.

2026-09-08 TypeScript · provider routing · cost policy measured: Direct default assertion and independent cost clamp
2 prompts, in order
  1. Separate the default from the safeguard A routing fix appears covered by a passing end-to-end test.
  2. Make the regression test fail honestly The direct assertion and the policy assertion are both present.

1Separate the default from the safeguard

Run it when
A routing fix appears covered by a passing end-to-end test.
It asks you for
The changed default function, final resolver, cost policy and missing-configuration test cases.
You get back
The decision being repaired and the downstream check that can mask it.
It refuses if
Do not claim the old default caused actual spending when the active policy prevented it.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The changed default function, final resolver, cost policy and missing-configuration test cases.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Read the exact default decision with configuration absent. Follow its proposed provider into the later cost policy and record which value reaches the final route.
2. Compare the old and proposed defaults under that same policy. If both finish on the same allowed provider, an assertion only on the final route cannot distinguish the repair.
3. Define a direct assertion on the changed function, with absent and empty configuration handled explicitly. Preserve an intentional provider opt-in where the documented policy allows it.
4. Keep a separate assertion on the cost safeguard. State the historical finding accurately: an unsafe latent default behind an effective clamp is a future risk, while actual unapproved spending would require its own runtime evidence.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not claim the old default caused actual spending when the active policy prevented it.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>

2Make the regression test fail honestly

Run it when
The direct assertion and the policy assertion are both present.
It asks you for
The existing isolated mutation check, old decision line, direct test and independent policy test.
You get back
A failing direct assertion with the old line and passing results after the repair is restored.
It refuses if
Do not weaken the downstream policy to manufacture a regression result.
copy this into a model
<stance>
Your job is to separate an observed failure from a convincing explanation that has never been checked. Keep the reader's actual system in view. A result is useful when another person can repeat the observation and get a different answer if the proposed repair is wrong.
</stance>

<inputs>
Ask for these before drawing a conclusion. Wait for anything essential that is missing.
1. The existing isolated mutation check, old decision line, direct test and independent policy test.
2. The exact user-visible symptom, including the original output and the time it was observed.
3. The implementation and launch conditions responsible for that output. Read the relevant source in full.
4. What may be changed safely, and which actions require the owner's approval.
5. Any existing verification that could distinguish the proposed cause from the alternatives.
</inputs>

<method>
1. Run the existing direct default tests and cost-policy tests unchanged against the repair. Keep their outcomes distinct so each protection has its own observation.
2. In the existing isolated mutation workflow, restore only the original default line. The direct test must fail for the incorrect default while the downstream cost policy may continue protecting the final route.
3. Restore the repair and rerun the same assertions. Preserve explicit opt-in coverage so the fix changes the silent default without accidentally removing authorized provider choice.
4. Read any duplicated default used by an unattended runner and its existing parity checks. Report which paths were verified, and never turn a test of a configured route into a claim about a provider call that was not made.
</method>

<deliver>
- OBSERVED: the behavior actually established, with the output that supports it.
- EXPLANATION: what the observation settles and what remains unknown.
- NEXT ACTION: one bounded action, its owner, and its expected result.
- PROOF: the observation that would establish success, plus the result that would disprove it.
</deliver>

<refuse>
Do not weaken the downstream policy to manufacture a regression result.
Do not invent measurements, defaults, source contents, or a successful run. Keep historical results separate from today's observations. Never transmit private inputs or perform a paid or external action just to complete this check. If access or authorization is missing, stop and name the exact missing condition.
</refuse>
How you know it worked

Test the default directly. The default resolver must choose the intended provider with missing configuration, and the independent cost clamp must still refuse unapproved metered routing. Restore the old default only in the existing isolated mutation check: the direct assertion must fail even if the final route stays protected.

from a real incident, 2026-09-08 · stack TypeScript · provider routing · cost policy · verified by Direct default assertion and independent cost clamp · routingtestingcost-controls

← every Field Kit