resilience-review

name	resilience-review
description	Murphy-law hat panel for unhappy paths -- input, timing, system, state, UX-recovery hats probe a change in parallel. Use when forms, validation, async/data, mutations, cache, state machines, destructive actions, or loading/empty/error states change.

Resilience Review

Murphy pass: find every plausible unhappy path, then block, guard, recover, observe.

Use when

Diffs touching forms, validation, submit, async/data, mutations, cache, retries, state machines, mode/union switches, config/resource choice, destructive actions, or loading/empty/error/success UI. Skip docs/test/style/trivial pure logic only; record reason.

Hat panel (parallel)

Map the risk surface first (user action, path, state change, side effects, deps). Claude-hosted sessions may spawn the hats in parallel. Native Codex runs every axis inline unless the user explicitly requests agents or invokes /swarm; skill activation alone is not consent. Each hat owns one failure class with non-goals, so findings do not converge. Small diffs stay inline everywhere.

Hat	Owns (and probes)	Non-goals
input	empty, null, duplicate, malformed, stale, huge, out-of-order payloads; validation format-vs-presence	timing, infra
timing	double submit, tab race, retry storms, slow network, timeout, cancel, out-of-order responses	payload validity
system	partial outage, 500s, stale cache, deleted resource, permission drift, dependency failure	UI polish
state	invalid/impossible states, mode-switch residue, oneof cleanup, stale derived state, recovery to a good state	network causes
ux-recovery	unclear disabled states, lost errors, fake success, dead ends without retry/undo, missing loading/empty states	root causes owned by other hats

Each hat emits findings with: scenario, trigger, expected behavior, guard (Precondition -> Postcondition -> Fallback -> Observability), test to write, evidence (file/route/form/API cited). For external/browser/platform behavior, the hat runs /read-the-damn-docs; complex planned state flows sketch /visual-plan first.

Merge: dedupe by root cause, keep the highest-severity framing, then drive the finding loop: /diagnosing-bugs feedback loop -> /tdd RED test/snapshot -> /visual-review for UI validation.

Output

## Resilience review
Risk surface:
- ...
Hats: input <status> | timing <status> | system <status> | state <status> | ux-recovery <status>
Failure matrix:
| Scenario | Trigger | Expected behavior | Guard | Test | Observability |
Finding queue:
| Finding | Repro/diagnosing-bugs loop | RED test or snapshot | Owner | Visual review needed |
Required tests:
- ...
Polish gaps:
- ...
Verdict: PASS | NEEDS_GUARDS | BLOCKED

Rules: cite files/routes/forms/API. Docs/help text not enough when code can prevent bad state. Real gap unfixed -> PR evidence with owner/deferral. No silent hat skips -- one-line evidence per skipped hat.

See REFERENCE.md.