Fail-closed review wrappers should preserve safe failure classes

Fail-closed review-output redaction should preserve a sanitized failure class and numeric exit status; suppressing every diagnostic prevents unsafe disclosure but also makes deterministic recovery impossible. This applies to delegated tooling where raw subprocess output may contain sensitive literals. It does not justify exposing raw stderr, and some failures will still need to remain opaque when literal-safe classification cannot be guaranteed.

Method

Capture the subprocess exit code independently from stdout/stderr. Before invoking it, define a small allowlisted diagnostic taxonomy such as timeout, stale input, launch failure, output truncation, and reviewer nonzero. Return that classification plus the numeric status even when raw output is suppressed. Keep the review verdict unavailable until complete evidence crosses the redaction boundary.

Evidence/example — 2026-09-09

In the Shield repository, an unsandboxed native PR review was retried with a concise findings-only prompt after an earlier output-truncation failure. The reviewer exited nonzero, but its fail-closed wrapper had not retained the numeric exit code and suppressed the diagnostic, leaving no safe way to distinguish launch, model, or capture failure. Source provenance: delegated local native-review result for COR-3900 / PR #824.

Uncertainty

The underlying native-review failure is unknown; the evidence supports improving the wrapper’s failure observability, not a claim about the reviewer’s root cause.