failshut
Pressurized copper refrigerant manifold A workshop copper pipe run with brass stamped nameplate. After pressure rises and soap is wiped on, soap bubbles nucleate only on the fail-open joint; sealed joints stay dry. SEAL OPEN SEAL FAILSHUT — LEAK CHECK PRESSURIZE · WIPE SOAP · WATCH JOINTS PSI 0 Config says DENY. Runtime says ALLOW? One command pressurizes Claude Code / Codex / OpenCode — and reports every joint that bubbles. SOAP Bubbles = FAIL OPEN Dry joint = FAIL SHUT … WORKSHOP FLOOR · STATIC AUDIT STATION Exit 1 on FAIL OPEN · Exit 0 if sealed · Claude Code / Codex / OpenCode

FAILSHUT — LEAK CHECK

BAY 01 · SERVICE TAG

Hang this on your toolbox

curl -sL …/v0.1.1/failshut_0.1.1_linux_amd64.tar.gz
  | tar xz && ./failshut audit

or

go install github.com/Blackman99/failshut/​cmd/failshut@latest

Exit 1 on any FAIL OPEN · 0 if sealed or nothing configured.

BAY 02 · SIX LEAK POINTS

Each finding is a joint on the manifold

Tap a fitting. Bubbles mark shapes the harness is known to ignore — dry means the static check is sealed.

v0.1 is a static auditor — it does not intercept live tool calls. See docs.

BAY 03 · WORK ORDER
JOB #FS-001 TECH · failshut audit FAIL OPEN 
FAIL OPEN — 1 finding(s)
where policy may not hold:

[1] hook-missing (claude-code)
  file: ~/app/.claude/settings.json
  evidence:
    PreToolUse command
    "$CLAUDE_PROJECT_DIR"/.claude/
      hooks/block-src-writes.sh
    — missing
  fix: Restore the hook script.
       A hook that cannot start
       lets the tool call through.

Summary: 1 FAIL OPEN
  · 5 FAIL SHUT checks
  · 1 config(s)
Terminal recording of failshut audit finding FAIL OPEN on hook-missing
BAY 04 · OPEN TICKETS

Why the soap test exists

Fresh reports keep landing where policy says one thing and runtime does another. Not every ticket is config-detectable — the coverage table says which ones v0.1 catches.