review-is-read-only-and-fault-tolerant
OUT derived (depth 1)
The review module operates entirely on in-memory snapshots with no storage dependency, handles missing antecedent references with placeholder text rather than exceptions, and silently skips failed LLM batches — achieving fault-tolerant read-only operation across all failure modes.
Summary
The review system is designed to never crash or corrupt data no matter what goes wrong — it works from a snapshot rather than touching the database, substitutes placeholder text when references are missing, and quietly skips over failed AI calls. This makes it safe to run at any time, but the silent failure handling means you cannot tell whether a clean review result means everything checked out or some checks were silently skipped.
Justifications
SL — Three fault-tolerance properties established; gated on full failure mode audit (issue #122)
Antecedents (all must be IN):
- review-has-no-storage-dependency — The review module operates entirely on an in-memory `nodes` dict (from `export_network()`) and never reads from or writes to the database directly.
- review-format-handles-missing-antecedents — `format_belief_for_review` renders `"(not found in network)"` for antecedent IDs that don't exist in the nodes dict rather than crashing, and returns an empty string for a nonexistent belief ID.
- review-batch-failure-is-silent-skip — When an LLM call fails for a review batch, the error is logged to stderr but the batch is skipped with no indication in the returned results; callers cannot distinguish "skipped due to error" from "no problems found."
Unless (any of these IN defeats this justification):
- issue-122-review-fault-tolerance-audit — Issue #122: Audit review module for unhandled failure modes — three specific handlers do not establish coverage of all failure modes
Dependents
These beliefs depend on this one:
- all-belief-inspection-is-non-mutating-and-fault-tolerant — All belief inspection operations — quality review (read-only with fault-tolerant batch handling), staleness checking (conservative non-mutating CI gate), and negative classification (defensively bounded with graceful degradation) — are uniformly non-mutating and fault-tolerant, ensuring observation never perturbs the observed system.
- dual-quality-enforcement-spans-automated-and-explicit — Belief quality is enforced by two independent mechanisms that cannot interfere: automated self-correction autonomously maintains consistency through contradiction resolution and staleness detection, while explicit quality review independently evaluates derived beliefs with read-only fault tolerance — dual enforcement ensures quality even when one mechanism is insufficient.
- llm-integration-fails-softly-across-modules — All LLM-facing modules apply consistent fail-soft error handling: the ask module always returns a string even when the LLM is unavailable, and the derive pipeline accumulates per-proposal errors rather than raising exceptions — no LLM failure path crashes the system.