Resilience Audit Command

Audit codebase for resilience patterns and identify gaps in fault tolerance.

Arguments

• [scope]: Path to analyze (default: current directory)

• --detailed: Include code snippets and detailed recommendations

• --dir: Output directory (default: docs/audits/)

Execution

Step 1: Parse Arguments

Extract scope and detailed flag from arguments.

Default scope is current directory.

Step 2: Load Resilience Patterns Skill

Invoke the resilience-patterns skill to access Polly/Brighter patterns, circuit breaker configurations, and retry strategy guidance.

Step 3: Spawn Resilience Analyzer Agent

Launch the resilience-analyzer agent to perform the audit.

The agent will analyze:

External Dependencies

1. HTTP Clients

   • HttpClient, IHttpClientFactory usage
   • RestSharp, Refit, or other HTTP libraries
   • Check for resilience handlers

2. Message Handlers

   • IRequestHandler, RequestHandler implementations
   • [UsePolicy] attribute presence
   • Error handling patterns

3. Database Calls

   • DbContext usage
   • Connection retry patterns
   • Transaction handling

4. External Services

   • gRPC clients
   • Redis connections
   • Queue/message bus clients

Existing Resilience Patterns

Search for patterns already in place:

• AddStandardResilienceHandler
• AddResilienceHandler
• ResiliencePipeline
• PolicyRegistry
• [UsePolicy] attributes
• Try-catch with retry logic
• Timeout configurations

Step 4: Generate Audit Report

# Resilience Pattern Audit

**Project:** [Name]
**Date:** [ISO Date]
**Scope:** [Analyzed Path]

## Executive Summary

| Category | Dependencies Found | With Resilience | Gap |
| -------- | ----------------- | --------------- | --- |
| HTTP Clients | 12 | 8 | 4 |
| Message Handlers | 25 | 20 | 5 |
| Database Calls | 8 | 3 | 5 |
| External Services | 5 | 2 | 3 |

**Overall Resilience Score:** 67% (33 of 50 dependencies protected)

## Critical Gaps (High Priority)

### 1. PaymentGatewayClient
**Location:** `src/Infrastructure/ExternalServices/PaymentGatewayClient.cs:45`
**Issue:** HTTP client without resilience
**Risk:** Payment failures won't retry, cascade failures on gateway issues
**Recommendation:**
```csharp
services.AddHttpClient<IPaymentGatewayClient, PaymentGatewayClient>()
    .AddStandardResilienceHandler();
```

### 2. OrderCreatedHandler

**Location:** `src/Application/Handlers/OrderCreatedHandler.cs`
**Issue:** No retry policy on message handler
**Risk:** Transient failures will send messages to DLQ immediately
**Recommendation:**

```csharp
[UsePolicy("retry-policy", step: 1)]
public override OrderCreated Handle(OrderCreated command)
```

## Medium Priority Gaps

### 3. InventoryService

**Location:** `src/Application/Services/InventoryService.cs`
**Issue:** No circuit breaker on inventory check
**Risk:** Slow inventory service blocks order processing
**Recommendation:** Add circuit breaker with 30s break duration

## Existing Resilience (Good Practices Found)

✓ `CustomerApiClient` - Standard resilience handler configured
✓ `EmailNotificationHandler` - Retry policy with exponential backoff
✓ `CacheService` - Circuit breaker on Redis connection

## Anti-Patterns Detected

### Catch and Swallow

**Location:** `src/Infrastructure/Services/LoggingService.cs:78`

```csharp
catch (Exception ex)
{
    // Silently fails - prevents retry logic
}
```

### Missing Timeout

**Location:** `src/Application/Services/ReportGenerator.cs:120`
Report generation has no timeout, can block indefinitely.

## Recommendations Summary

### Quick Wins (< 1 day)

- [ ] Add `AddStandardResilienceHandler()` to 4 HTTP clients
- [ ] Add `[UsePolicy]` to 5 message handlers
- [ ] Remove catch-and-swallow patterns

### Medium Effort (1-3 days)

- [ ] Implement circuit breaker for Inventory Service
- [ ] Add timeout configuration to Report Generator
- [ ] Set up DLQ monitoring

### Strategic (Requires Planning)

- [ ] Design retry strategy for payment failures
- [ ] Implement saga pattern for order fulfillment
- [ ] Add health checks for all external dependencies

Step 5: Detailed Output (if --detailed)

If --detailed flag is provided, include:

1. Code snippets for each finding
2. Before/after examples for recommendations
3. Configuration templates for suggested patterns
4. Testing guidance for verifying resilience

Step 6: Save Results

If the user wants to save results, write the audit to:

• docs/audits/resilience-audit-[date].md Use --dir for custom location.
• Or ask user for preferred location

Step 7: Next Steps

Suggest follow-up actions:

1. Generate tests: "Run /fitness-check --generate to create architecture tests"
2. Review patterns: "Use the resilience-patterns skill for implementation guidance"
3. Monitor: "Set up alerting for circuit breaker state changes"