On this page
Error handling
What happens when evidence fails: stop, classify, inspect, countermeasure, rerun, escalate, or hand off.
Failure is an interrupt, not a hidden retry loop.
The ordinary rule is stop the line.
The formal rule is Andon:
- classify the abnormality
- inspect cause
- choose a bounded countermeasure
- rerun the relevant evidence
- resume, escalate with new evidence, or hand off when blocked
Failure path
- Evidence fails.
- Stop the line.
- Classify abnormality.
- Inspect cause.
- Choose a bounded countermeasure.
- Rerun the relevant check.
Probe before fix
A visible symptom is not enough permission to patch blindly.
The run must first write an ANDON_PROBE with the:
- abnormality class
- likely cause
- inspected source
- next bounded countermeasure.
Escalation
Escalation requires New evidence: or Changed approach:.
If neither can be truthfully filled, the run evaluates handoff conditions instead of pretending that another retry is meaningful.
A same-class recurrence must cite prior classed Andon rows before claiming recurrence.
Handoff
Handoff happens only when actually blocked.
It names the blocker and the smallest next owner action.
It is not fake completion.
Source surfaces
skills/implementaudit/templates/PROTOCOL.md Andon sections and skills/implementaudit/references/transcript-contract.md.
Andon event fields
Each failure row must name:
- the phase
- abnormality class
- failing criterion/command/artifact
- owner/source
- containment decision
- inspected cause
- selected countermeasure
- rerun evidence required
- rerun outcome
- escalation or handoff reason
- smallest next owner action when blocked
Common marker table
This table highlights common failure, pause, and warning markers; it is not the complete transcript contract.
ANDON_PROBE
Plain event: probe the failure.
Fires when: the first abnormality of any class appears.
Must record:
- class
- failing evidence
- owner/source
- containment decision
- proportional cause/reflection notes (
5 Whys/Hanseiif needed) - selected countermeasure
- rerun evidence
ANDON_ESCALATE
Plain event: escalate with evidence.
Fires when: countermeasure failure, same-class recurrence, unclear root cause, scope expansion, or owner/source dispute blocks progress.
Must record:
- prior probe history
- why the countermeasure failed
- deeper cause analysis
New evidence:orChanged approach:- chosen split, reframe, rollback, owner decision, or fix-spec path
ANDON_HANDOFF
Plain event: hand off honestly.
Fires when: closure is blocked by owner decision, unsafe scope, missing authorization, external dependency, irreproducibility, missing required access/tooling, or no bounded countermeasure.
Must record:
- probe and escalation history
- blocking condition
- remaining blocker
- smallest next concrete action
Do not pair this with run completion.
IMPLEMENTAUDIT_PAUSE
Plain event: pause after a user interruption.
Fires when: a user message interrupts a phase in progress.
Must record:
- active phase
- current state file
- resume point
- next reread action
Resume menu: Resume, Revise spec, Skip phase, or Stop.
Resume from disk and the paused step; do not re-print phase start unless a new phase actually starts.
AUDIT_WARNING
Plain event: name a confidence caveat.
Fires when: the final audit has a warning condition such as heavy trust-prior reliance.
Must record:
- warning condition
- affected evidence
- remaining risk
- whether closure is still valid
Official abnormality classes
The ten abnormality classes are:
failed-criterionregressionhung-commandsubstituted-commandowner-uncleargenerated-artifact-mismatchstale-sidecarpolicy-conflictimpossible-criterionevidence-mismatch
Try-count boundary
There is no arbitrary attempt cap.
Escalation is driven by evidence and same-class recurrence.
Handoff is driven by a real blocker.
A transcript with ANDON_HANDOFF must not also claim IMPLEMENTAUDIT_RUN_COMPLETE.