ScheduleUnreadablesurface.arm.unreadable-scheduleA schedule string the grammar cannot read, including L, W, ?, # and @ macros, raises ScheduleUnreadable for that entry alone, naming the diagnostic; every other entry of the document arms. | A schedule string the grammar or cron dialect cannot read. | surface.arm.unreadable-schedulesurface.arm.unreadable-scheduleA schedule string the grammar cannot read, including L, W, ?, # and @ macros, raises ScheduleUnreadable for that entry alone, naming the diagnostic; every other entry of the document arms. |
TriggerAdapterUnknownsurface.arm.unknown-triggerAn unrecognized trigger value raises TriggerAdapterUnknown at startup and downgrades onto no adapter. | A trigger value naming no adapter. | surface.arm.unknown-triggersurface.arm.unknown-triggerAn unrecognized trigger value raises TriggerAdapterUnknown at startup and downgrades onto no adapter. |
TriggerFaceMissingsurface.arm.trigger-face-missingexternal selected on a deployment serving no HTTP face raises TriggerFaceMissing at startup. | The external trigger on a deployment serving no route for the wake. | surface.arm.trigger-face-missingsurface.arm.trigger-face-missingexternal selected on a deployment serving no HTTP face raises TriggerFaceMissing at startup. |
ControlPointerMalformedsurface.reconcile.pointer-malformedA pointer body that is not wholly a version raises ControlPointerMalformed. | A snapshot pointer body that is not wholly a version. | surface.reconcile.pointer-malformedsurface.reconcile.pointer-malformedA pointer body that is not wholly a version raises ControlPointerMalformed. |
ControlSnapshotUnreadablesurface.reconcile.fail-staticAn unreadable pointer, an unparseable snapshot or a control plane answering 5xx raises ControlSnapshotUnreadable, logs a diagnostic, and leaves the armed set in place running. | A poll that could not read its pointer or parse the named document. | surface.reconcile.fail-staticsurface.reconcile.fail-staticAn unreadable pointer, an unparseable snapshot or a control plane answering 5xx raises ControlSnapshotUnreadable, logs a diagnostic, and leaves the armed set in place running. |
ControlSourceNotLoopbacksurface.reconcile.loopback-onlyA control URL whose host is not a loopback address raises ControlSourceNotLoopback and arms nothing; a poll follows no redirect and routes through no proxy. | A control URL whose host is not a loopback address. | surface.reconcile.loopback-onlysurface.reconcile.loopback-onlyA control URL whose host is not a loopback address raises ControlSourceNotLoopback and arms nothing; a poll follows no redirect and routes through no proxy. |
ControlSnapshotUntrustedsurface.reconcile.pulled-control-untrustedA pulled control head with an invalid signature, project, digest, predecessor chain or local validation raises ControlSnapshotUntrusted, names the reason and arms none of that version. | A pulled control head fails attestation, ancestry or local validation. | surface.reconcile.pulled-control-untrustedsurface.reconcile.pulled-control-untrustedA pulled control head with an invalid signature, project, digest, predecessor chain or local validation raises ControlSnapshotUntrusted, names the reason and arms none of that version. |
JobKindUnknownsurface.fire.job-kind-unknownA block naming a kind outside the union, an argument vector or a host command raises JobKindUnknown at validation. | A job block naming a kind outside the union, or carrying a command. | surface.fire.job-kind-unknownsurface.fire.job-kind-unknownA block naming a kind outside the union, an argument vector or a host command raises JobKindUnknown at validation. |
JobTargetUnboundsurface.fire.target-unboundA fold target naming no produced table, or a build target naming no declared [[model]], raises JobTargetUnbound at validation. | A job target binding to no produced table or declared model. | surface.fire.target-unboundsurface.fire.target-unboundA fold target naming no produced table, or a build target naming no declared [[model]], raises JobTargetUnbound at validation. |
CycleControlSourceUnresolvedsurface.fire.cycle-control-sourceA configured control source that does not resolve under cycle raises CycleControlSourceUnresolved. | A control source that does not resolve under one-shot evaluation. | surface.fire.cycle-control-sourcesurface.fire.cycle-control-sourceA configured control source that does not resolve under cycle raises CycleControlSourceUnresolved. |
JobConcurrencyUnsetsurface.fire.store-driven-concurrencyA store-driven block declaring no positive integer max_in_flight raises JobConcurrencyUnset at validation; no default applies. | A store-driven job block declaring no positive max_in_flight. | surface.fire.store-driven-concurrencysurface.fire.store-driven-concurrencyA store-driven block declaring no positive integer max_in_flight raises JobConcurrencyUnset at validation; no default applies. |
JobBodyUnregisteredsurface.fire.store-driven-bodyA store-driven block whose body names no body the embedding binary registers and no delegate under binding raises JobBodyUnregistered at validation. | A store-driven job block naming a body the binary does not register. | surface.fire.store-driven-bodysurface.fire.store-driven-bodyA store-driven block whose body names no body the embedding binary registers and no delegate under binding raises JobBodyUnregistered at validation. |
JobKindUndispatchedsurface.fire.kind-undispatchedA [[job]] of kind sweep, rebuild-catalog or validate raises JobKindUndispatched at pipeline validate, job validate, import and full apply, naming the command doing its work; serve arms none an applied snapshot holds. | A job block naming a maintenance kind no fire runs. | surface.fire.kind-undispatchedsurface.fire.kind-undispatchedA [[job]] of kind sweep, rebuild-catalog or validate raises JobKindUndispatched at pipeline validate, job validate, import and full apply, naming the command doing its work; serve arms none an applied snapshot holds. |
DispatchUnitNotAHeadsurface.dispatch.not-a-headA [[pipeline]] block naming after = "<id>" is a landing step of that entry's dependent run; the run is the unit and cadence rides its head entry. A due id that is a step raises DispatchUnitNotAHead and starts nothing. | A due id that is a step of a dependent run rather than its head. | surface.dispatch.not-a-headsurface.dispatch.not-a-headA [[pipeline]] block naming after = "<id>" is a landing step of that entry's dependent run; the run is the unit and cadence rides its head entry. A due id that is a step raises DispatchUnitNotAHead and starts nothing. |
StepResultRefusedsurface.dispatch.step-resultA completion callback carries a pointer, an object-store key or a catalog row id, or the failed step's last error line, as JSON of at most 1 MiB; any other callback body raises StepResultRefused and records nothing. | A step callback body that is no pointer, object-store key, catalog row id or failure line, or passes the cap. | surface.dispatch.step-resultsurface.dispatch.step-resultA completion callback carries a pointer, an object-store key or a catalog row id, or the failed step's last error line, as JSON of at most 1 MiB; any other callback body raises StepResultRefused and records nothing. |
DispatchCallbackRejectedsurface.dispatch.callback-rejectedA heartbeat or callback whose signature fails, whose attempt is not the step's current attempt, whose timestamp falls outside callback-skew, or whose step has closed, raises DispatchCallbackRejected and changes no step. | A heartbeat or callback carrying a bad signature, a superseded attempt, a skewed timestamp or a closed step. | surface.dispatch.callback-rejectedsurface.dispatch.callback-rejectedA heartbeat or callback whose signature fails, whose attempt is not the step's current attempt, whose timestamp falls outside callback-skew, or whose step has closed, raises DispatchCallbackRejected and changes no step. |
DispatchSubmitRejectedsurface.dispatch.submit-signedA worker admits a POST /submit only when it carries an HMAC under the worker key over its timestamp and body, within callback-skew, naming a callback under its own [control] relay; any other submission raises DispatchSubmitRejected and starts nothing. | A worker submission unsigned, skewed, or naming a callback off the worker’s relay. | surface.dispatch.submit-signedsurface.dispatch.submit-signedA worker admits a POST /submit only when it carries an HMAC under the worker key over its timestamp and body, within callback-skew, naming a callback under its own [control] relay; any other submission raises DispatchSubmitRejected and starts nothing. |
FireCredentialMissingsurface.dispatch.fire-credential-missingA serve dispatching to child processes, whose applied snapshot schedules a store-driven or synthesize job, holding neither --issuer-key nor CONTEXTFUL_TOKEN, raises FireCredentialMissing at start and fires nothing. | A serve scheduling a store-driven or synthesize job with neither an issuer key nor an inherited credential. | surface.dispatch.fire-credential-missingsurface.dispatch.fire-credential-missingA serve dispatching to child processes, whose applied snapshot schedules a store-driven or synthesize job, holding neither --issuer-key nor CONTEXTFUL_TOKEN, raises FireCredentialMissing at start and fires nothing. |
FireCredentialZoneUnsetsurface.dispatch.fire-credential-zoneA serve under --issuer-key, whose applied snapshot schedules a store-driven or synthesize job, under a root whose [project.zone] declares no default, raises FireCredentialZoneUnset at start and fires nothing. | A serve minting fire credentials under a root whose project declares no default zone. | surface.dispatch.fire-credential-zonesurface.dispatch.fire-credential-zoneA serve under --issuer-key, whose applied snapshot schedules a store-driven or synthesize job, under a root whose [project.zone] declares no default, raises FireCredentialZoneUnset at start and fires nothing. |
JobDelegateUnboundsurface.delegate.binding[control.delegates.<name>] binds a delegate by url, a mode of call or submit, and under call a timeout; a store-driven body = { delegate = "<name>" } naming no bound delegate raises JobDelegateUnbound at arm or fire. | A store-driven body naming a delegate the daemon’s configuration does not bind. | surface.delegate.bindingsurface.delegate.binding[control.delegates.<name>] binds a delegate by url, a mode of call or submit, and under call a timeout; a store-driven body = { delegate = "<name>" } naming no bound delegate raises JobDelegateUnbound at arm or fire. |
DelegateHostRefusedsurface.delegate.hostA delegate url is http to a loopback host or the contextful.delegate virtual host, carrying no credential; any other spelling raises DelegateHostRefused at startup and arms nothing. | A delegate URL that is not plain HTTP to a loopback host or the delegate virtual host, or carries a credential. | surface.delegate.hostsurface.delegate.hostA delegate url is http to a loopback host or the contextful.delegate virtual host, carrying no credential; any other spelling raises DelegateHostRefused at startup and arms nothing. |
DelegateAnswerRejectedsurface.delegate.rejectedAn answer unsigned or skewed past callback-skew raises DelegateAnswerRejected and closes the attempt Transient; one outside outcome or over step-result raises it and closes the attempt Permanent. | A delegate answer unsigned, skewed, outside the outcome vocabulary, naming an undeclared table or over the step-result cap. | surface.delegate.rejectedsurface.delegate.rejectedAn answer unsigned or skewed past callback-skew raises DelegateAnswerRejected and closes the attempt Transient; one outside outcome or over step-result raises it and closes the attempt Permanent. |
DelegateSubmitUnfilledsurface.delegate.submit-unfilledA store-driven fire whose delegate binds mode = "submit" raises DelegateSubmitUnfilled, naming call as the mode that dispatches, before any execution opens, so no item receives a receipt. | A store-driven fire whose delegate binds the submit mode, which no fire dispatches. | surface.delegate.submit-unfilledsurface.delegate.submit-unfilledA store-driven fire whose delegate binds mode = "submit" raises DelegateSubmitUnfilled, naming call as the mode that dispatches, before any execution opens, so no item receives a receipt. |
DelegateTimeoutRefusedsurface.delegate.call-timeout-ceilingA call timeout above 3600 s raises DelegateTimeoutRefused at validation. | A call delegate’s timeout declared above the ceiling. | surface.delegate.call-timeout-ceilingsurface.delegate.call-timeout-ceilingA call timeout above 3600 s raises DelegateTimeoutRefused at validation. |
SecretMaterialInDocumentsurface.edit.secret-in-documentA credential value typed into a configuration field raises SecretMaterialInDocument; the document holds references and the backend holds material. | A credential value written into the configuration document. | surface.edit.secret-in-documentsurface.edit.secret-in-documentA credential value typed into a configuration field raises SecretMaterialInDocument; the document holds references and the backend holds material. |
ConnectorUploadRefusedsurface.edit.connector-uploadAn artifact uploaded through the operator surface raises ConnectorUploadRefused; the surface references registered connectors by id and version. | A connector artifact offered through the operator surface. | surface.edit.connector-uploadsurface.edit.connector-uploadAn artifact uploaded through the operator surface raises ConnectorUploadRefused; the surface references registered connectors by id and version. |
ManifestVersionConflictsurface.apply.version-raceAn apply whose compare-and-swap loses raises ManifestVersionConflict, reloads the winning version and reapplies its pending edits onto it, overwriting no applied version. | An apply whose pointer compare-and-swap lost to a concurrent apply. | surface.apply.version-racesurface.apply.version-raceAn apply whose compare-and-swap loses raises ManifestVersionConflict, reloads the winning version and reapplies its pending edits onto it, overwriting no applied version. |
ApplyValidationRefusedsurface.apply.validationA document failing engine validation raises ApplyValidationRefused and claims no version. | A document engine validation refused; no version was claimed. | surface.apply.validationsurface.apply.validationA document failing engine validation raises ApplyValidationRefused and claims no version. |
ConfigOwnerUnconfiguredsurface.apply.owner-unconfiguredAn owner with no storage configured or no credential raises ConfigOwnerUnconfigured, answered 503; no local writer substitutes for the store-scoped API. | A configuration owner with no storage or no credential behind it. | surface.apply.owner-unconfiguredsurface.apply.owner-unconfiguredAn owner with no storage configured or no credential raises ConfigOwnerUnconfigured, answered 503; no local writer substitutes for the store-scoped API. |
ConditionalWriteUnsupportedsurface.apply.weak-conditional-backendA configuration owner or catalog backend whose conditional replacement is not linearizable raises ConditionalWriteUnsupported at startup or open. | A configuration owner or catalog backend lacking linearizable conditional replacement. | surface.apply.weak-conditional-backendsurface.apply.weak-conditional-backendA configuration owner or catalog backend whose conditional replacement is not linearizable raises ConditionalWriteUnsupported at startup or open. |
StoreNotInitializedsurface.apply.uninitialized-storeAn edit or apply against a store that has taken no explicit guarded import, an empty store included, raises StoreNotInitialized, answered 409. | An edit or apply against a store that has taken no guarded import. | surface.apply.uninitialized-storesurface.apply.uninitialized-storeAn edit or apply against a store that has taken no explicit guarded import, an empty store included, raises StoreNotInitialized, answered 409. |
ControlAttestationUnavailablesurface.apply.attestation-unavailableA synced import or apply lacking an admitted admin capability or issuer signing port raises ControlAttestationUnavailable and claims no version. | A synced control claim lacks an admitted admin capability or signing port. | surface.apply.attestation-unavailablesurface.apply.attestation-unavailableA synced import or apply lacking an admitted admin capability or issuer signing port raises ControlAttestationUnavailable and claims no version. |
ControlOperatorAttestationInvalidsurface.apply.operator-attestationAn Admin mutation lacking a fresh console signature over its verified operator, route and body, or reusing a nonce held in store control state across restarts, raises ControlOperatorAttestationInvalid before changing the document. | An Admin mutation without a fresh single-use console signature for its verified operator and request. | surface.apply.operator-attestationsurface.apply.operator-attestationAn Admin mutation lacking a fresh console signature over its verified operator, route and body, or reusing a nonce held in store control state across restarts, raises ControlOperatorAttestationInvalid before changing the document. |
ControlDraftAbsentsurface.apply.draft-absentAn Admin apply finding no validated store draft raises ControlDraftAbsent and changes no applied version. | An Admin apply with no validated store draft. | surface.apply.draft-absentsurface.apply.draft-absentAn Admin apply finding no validated store draft raises ControlDraftAbsent and changes no applied version. |
ControlAdminGrantMissingsurface.apply.served-admin-grantA served /control/ request whose admitted credential holds no Admin grant over without a tenant scope raises ControlAdminGrantMissing, answered 403, before its handler runs. | A served control request lacking an untenanted Admin grant over every table. | surface.apply.served-admin-grantsurface.apply.served-admin-grantA served /control/ request whose admitted credential holds no Admin grant over without a tenant scope raises ControlAdminGrantMissing, answered 403, before its handler runs. |
ControlRequestMalformedsurface.apply.served-malformedA served Admin edit or apply whose body is not a JSON object holding exactly its route's fields raises ControlRequestMalformed, answered 400, and changes nothing. | A served control edit or apply body outside its route’s exact fields. | surface.apply.served-malformedsurface.apply.served-malformedA served Admin edit or apply whose body is not a JSON object holding exactly its route's fields raises ControlRequestMalformed, answered 400, and changes nothing. |
ControlUnavailablesurface.apply.served-unavailableA served control request failing with no authority or surface refusal raises ControlUnavailable, answered 503, and returns no internal error text. | A served control request failing without an authority or surface refusal. | surface.apply.served-unavailablesurface.apply.served-unavailableA served control request failing with no authority or surface refusal raises ControlUnavailable, answered 503, and returns no internal error text. |
EnforceRegionMismatchsurface.reside.region-mismatchA configured resource resolving to a region the policy omits raises EnforceRegionMismatch at startup, and the runtime serves nothing. | A configured resource resolving outside the residency allow-set. | surface.reside.region-mismatchsurface.reside.region-mismatchA configured resource resolving to a region the policy omits raises EnforceRegionMismatch at startup, and the runtime serves nothing. |
ResidencySitesDivergesurface.reside.site-regionsA push records the pushing site's residency allow-set in the bucket manifest; a push finding a differing set another site recorded, an absent one included, raises ResidencySitesDiverge and commits nothing. | A push whose residency allow-set differs from the one another site recorded in the bucket manifest. | surface.reside.site-regionssurface.reside.site-regionsA push records the pushing site's residency allow-set in the bucket manifest; a push finding a differing set another site recorded, an absent one included, raises ResidencySitesDiverge and commits nothing. |
ConnectionScopeDeniedsurface.connection.authorityA connection mutation requires an admitted write credential for its tenant and principal, checked on the request before reading and on the standing record before changing it; a mismatch raises ConnectionScopeDenied. | A connection mutation names a tenant or principal outside the admitted credential. | surface.connection.authoritysurface.connection.authorityA connection mutation requires an admitted write credential for its tenant and principal, checked on the request before reading and on the standing record before changing it; a mismatch raises ConnectionScopeDenied. |
ConnectionIdConflictsurface.connection.idempotent-createRepeating create with the same connection id and declaration returns the standing version; a differing declaration raises ConnectionIdConflict without replacing it. | A connection id already binds a different declaration. | surface.connection.idempotent-createsurface.connection.idempotent-createRepeating create with the same connection id and declaration returns the standing version; a differing declaration raises ConnectionIdConflict without replacing it. |
ConnectionRequestMalformedsurface.connection.malformedA create body outside Declaration, an unreadable schedule, or a pause or delete body other than {} raises ConnectionRequestMalformed and claims nothing. | A connection request body outside its route’s exact fields. | surface.connection.malformedsurface.connection.malformedA create body outside Declaration, an unreadable schedule, or a pause or delete body other than {} raises ConnectionRequestMalformed and claims nothing. |
ConnectionUnknownsurface.connection.unknownA pause or delete naming no standing connection raises ConnectionUnknown; a deleted id stays bound to its retired record, and create refuses its reuse as idempotent-create. | A pause or delete naming no standing connection. | surface.connection.unknownsurface.connection.unknownA pause or delete naming no standing connection raises ConnectionUnknown; a deleted id stays bound to its retired record, and create refuses its reuse as idempotent-create. |
ConsolePageForbiddensurface.open-console.wrong-pageA Query or Admin page or API request without a verified Access assertion or Cognito session granting that page raises ConsolePageForbidden and dispatches nothing. | A page or API call lacking verified identity and its page grant. | surface.open-console.wrong-pagesurface.open-console.wrong-pageA Query or Admin page or API request without a verified Access assertion or Cognito session granting that page raises ConsolePageForbidden and dispatches nothing. |
ConsoleAdminGrantMissingsurface.open-console.admin-grantAn Admin edit or apply without a server-held admin capability raises ConsoleAdminGrantMissing and reaches no control call. | An Admin edit or apply lacking a server-held admin capability. | surface.open-console.admin-grantsurface.open-console.admin-grantAn Admin edit or apply without a server-held admin capability raises ConsoleAdminGrantMissing and reaches no control call. |
StoreRegistryUnreadablesurface.register-store.registry-unreadableA CONTEXTFUL_STORES_JSON value that does not parse raises StoreRegistryUnreadable at startup, and no built-in store stands in for the configured set. | A store registry payload that does not parse. | surface.register-store.registry-unreadablesurface.register-store.registry-unreadableA CONTEXTFUL_STORES_JSON value that does not parse raises StoreRegistryUnreadable at startup, and no built-in store stands in for the configured set. |
StoreEntryMalformedsurface.register-store.malformed-entryOne entry that does not decode raises StoreEntryMalformed naming it, and is dropped while its siblings are served. | One registry entry that does not decode. | surface.register-store.malformed-entrysurface.register-store.malformed-entryOne entry that does not decode raises StoreEntryMalformed naming it, and is dropped while its siblings are served. |
StoreIdReservedsurface.register-store.reserved-idA configured entry claiming either built-in id raises StoreIdReserved. | A configured store claiming a built-in id. | surface.register-store.reserved-idsurface.register-store.reserved-idA configured entry claiming either built-in id raises StoreIdReserved. |
StoreNameAuthoredsurface.register-store.authored-nameAn entry carrying its own credential or binding name raises StoreNameAuthored. | A store entry carrying its own credential or binding name. | surface.register-store.authored-namesurface.register-store.authored-nameAn entry carrying its own credential or binding name raises StoreNameAuthored. |
ExternalStepUnboundsurface.visualize.external-unboundAn [[external]] input or output lacking a table:, pipeline: or job: prefix, or naming no declared table, model, pipeline or job, raises ExternalStepUnbound at validation. | An external step input or output naming no declared table, model, pipeline or job. | surface.visualize.external-unboundsurface.visualize.external-unboundAn [[external]] input or output lacking a table:, pipeline: or job: prefix, or naming no declared table, model, pipeline or job, raises ExternalStepUnbound at validation. |
ExternalStepCollisionsurface.visualize.external-collisionAn [[external]] whose name repeats another external's name, a job's name or a pipeline's id raises ExternalStepCollision at validation. | An external step name repeating another external, a job or a pipeline. | surface.visualize.external-collisionsurface.visualize.external-collisionAn [[external]] whose name repeats another external's name, a job's name or a pipeline's id raises ExternalStepCollision at validation. |
StdioCredentialMissingsurface.package.stdio-credentialThe process transport requires a verified capability token; --owner selects its signed owner claim. An absent token raises StdioCredentialMissing before protocol framing and never resolves to owner context. | A process-transport client with no credential. | surface.package.stdio-credentialsurface.package.stdio-credentialThe process transport requires a verified capability token; --owner selects its signed owner claim. An absent token raises StdioCredentialMissing before protocol framing and never resolves to owner context. |
StoreSelectorAbsentsurface.package.store-selectorThe child's working directory selects the store by walking up to the project manifest; finding none raises StoreSelectorAbsent and exits before writing any protocol framing. | A spawned engine finding no project manifest above its working directory. | surface.package.store-selectorsurface.package.store-selectorThe child's working directory selects the store by walking up to the project manifest; finding none raises StoreSelectorAbsent and exits before writing any protocol framing. |
OwnerCredentialInvalidsurface.package.owner-flagA process --owner admits the local owner context only with a verified signed claim bound to the selected store and an unrestricted read grant; any other credential raises OwnerCredentialInvalid before protocol framing. | A process owner flag with no signed claim for the selected local store. | surface.package.owner-flagsurface.package.owner-flagA process --owner admits the local owner context only with a verified signed claim bound to the selected store and an unrestricted read grant; any other credential raises OwnerCredentialInvalid before protocol framing. |
ConsoleSuggestionUnanswerablesurface.speak.unanswerable-suggestionA suggested prompt whose answer under these rules is a decline raises ConsoleSuggestionUnanswerable when the suggestion set is built. | A suggested prompt whose answer is a decline. | surface.speak.unanswerable-suggestionsurface.speak.unanswerable-suggestionA suggested prompt whose answer under these rules is a decline raises ConsoleSuggestionUnanswerable when the suggestion set is built. |
ConsoleUngroundedAnswersurface.ground.ungrounded-answerA path composing answer prose in a turn holding no tool result raises ConsoleUngroundedAnswer. | Answer prose composed in a turn holding no tool result. | surface.ground.ungrounded-answersurface.ground.ungrounded-answerA path composing answer prose in a turn holding no tool result raises ConsoleUngroundedAnswer. |
ConsoleToolNotAdmittedsurface.ground.unadmitted-toolA call naming a tool the turn's packs do not admit raises ConsoleToolNotAdmitted and dispatches nothing. | A tool call outside the turn’s admitted packs. | surface.ground.unadmitted-toolsurface.ground.unadmitted-toolA call naming a tool the turn's packs do not admit raises ConsoleToolNotAdmitted and dispatches nothing. |
ConsoleMutatingToolRequestedsurface.ground.mutating-toolThe console's query endpoint admits a read subset: a client-reachable path naming a write raises ConsoleMutatingToolRequested. The one write a turn performs is authored on the server. | A client-reachable path naming a write. | surface.ground.mutating-toolsurface.ground.mutating-toolThe console's query endpoint admits a read subset: a client-reachable path naming a write raises ConsoleMutatingToolRequested. The one write a turn performs is authored on the server. |
ConsoleWriteToolOnOrgFacesurface.ground.org-face-read-onlyA pack registering a write tool on an organization-wide face raises ConsoleWriteToolOnOrgFace at startup, naming the pack and the tool, and the face serves nothing. | A write tool registered on an organization-wide face. | surface.ground.org-face-read-onlysurface.ground.org-face-read-onlyA pack registering a write tool on an organization-wide face raises ConsoleWriteToolOnOrgFace at startup, naming the pack and the tool, and the face serves nothing. |
ConsoleFileAccessDirectsurface.ground.direct-file-readA table function resolving a path straight against stored bytes raises ConsoleFileAccessDirect on this surface. | A table function reading stored bytes by path on the caller surface. | surface.ground.direct-file-readsurface.ground.direct-file-readA table function resolving a path straight against stored bytes raises ConsoleFileAccessDirect on this surface. |
ConsoleTokenExchangeRefusedsurface.ground.mint-refusedA refused mint raises ConsoleTokenExchangeRefused. A store carrying a shared credential falls back to it; one carrying none surfaces the refusal to the reader. | A per-reader mint the store’s exchange route refused. | surface.ground.mint-refusedsurface.ground.mint-refusedA refused mint raises ConsoleTokenExchangeRefused. A store carrying a shared credential falls back to it; one carrying none surfaces the refusal to the reader. |
ConsoleAnswerModelUnlistedsurface.ground.answer-modelA verified Admin operator sets Query's answer model to one the deployment lists, or to off, and the choice persists across restarts; a model outside the list refuses with ConsoleAnswerModelUnlisted. | An Admin request named an answer model the deployment does not list. | surface.ground.answer-modelsurface.ground.answer-modelA verified Admin operator sets Query's answer model to one the deployment lists, or to off, and the choice persists across restarts; a model outside the list refuses with ConsoleAnswerModelUnlisted. |
ConsolePlannerReachedMemorysurface.plan-turn.planner-reached-memoryScaffolding and every deterministic fallback cover data tables; scaffolding naming a memory relation raises ConsolePlannerReachedMemory. | Planner scaffolding naming a memory relation. | surface.plan-turn.planner-reached-memorysurface.plan-turn.planner-reached-memoryScaffolding and every deterministic fallback cover data tables; scaffolding naming a memory relation raises ConsolePlannerReachedMemory. |
ConsoleVantageUnparseablesurface.set-vantage.unparseableA vantage that is neither a calendar day nor an instant raises ConsoleVantageUnparseable, answered 400. | A vantage that is neither a calendar day nor an instant. | surface.set-vantage.unparseablesurface.set-vantage.unparseableA vantage that is neither a calendar day nor an instant raises ConsoleVantageUnparseable, answered 400. |
ConsoleWebBoundUnparseablesurface.set-vantage.web-bound-unparseableA web leg whose bound fails to parse fails that leg and raises ConsoleWebBoundUnparseable. | A web leg whose publication bound does not parse. | surface.set-vantage.web-bound-unparseablesurface.set-vantage.web-bound-unparseableA web leg whose bound fails to parse fails that leg and raises ConsoleWebBoundUnparseable. |
ConsoleGalleryPathUnlistedsurface.browse.gallery-path-unlistedA gallery preview naming a path absent from the governed file listing under the request's as_of raises ConsoleGalleryPathUnlisted before preview dispatch. | A gallery preview path absent from the reader’s governed file listing. | surface.browse.gallery-path-unlistedsurface.browse.gallery-path-unlistedA gallery preview naming a path absent from the governed file listing under the request's as_of raises ConsoleGalleryPathUnlisted before preview dispatch. |
ConsoleLearningUnscopedsurface.learn.unscopedA distilled conclusion landing without the reading-session scope raises ConsoleLearningUnscoped. | A distilled conclusion landing without the reading-session scope. | surface.learn.unscopedsurface.learn.unscopedA distilled conclusion landing without the reading-session scope raises ConsoleLearningUnscoped. |
ConsoleLearningWriteRefusedsurface.learn.write-refusedA served claim write that refuses or returns no scope-bound receipt raises ConsoleLearningWriteRefused to Query before answer publication. | A served claim write that refuses or returns no scope-bound receipt. | surface.learn.write-refusedsurface.learn.write-refusedA served claim write that refuses or returns no scope-bound receipt raises ConsoleLearningWriteRefused to Query before answer publication. |
ConsoleViewNotServerBuiltsurface.render.client-authored-viewA view specification arriving from a client, or composed by the model, raises ConsoleViewNotServerBuilt. | A view from a client or the model rather than inferred from a result. | surface.render.client-authored-viewsurface.render.client-authored-viewA view specification arriving from a client, or composed by the model, raises ConsoleViewNotServerBuilt. |
ConsoleBriefUnavailablesurface.brief.absence-is-earnedThe card needs a session with no turns, at present time, a live conclusion, an arrived row matching an interest, and a derivation inside its budget. An error or timeout raises ConsoleBriefUnavailable, and no card renders. | A greeting derivation that errored or overran its budget. | surface.brief.absence-is-earnedsurface.brief.absence-is-earnedThe card needs a session with no turns, at present time, a live conclusion, an arrived row matching an interest, and a derivation inside its budget. An error or timeout raises ConsoleBriefUnavailable, and no card renders. |
VisibilityShareAffordancesurface.publish-answer.share-affordanceA surface offering a share control on access-explanation output raises VisibilityShareAffordance. | A share control offered on access-explanation output. | surface.publish-answer.share-affordancesurface.publish-answer.share-affordanceA surface offering a share control on access-explanation output raises VisibilityShareAffordance. |
VisibilityAskerlessAudiencesurface.publish-answer.askerless-audienceA scheduled job posting to an audience under a service identity raises VisibilityAskerlessAudience, naming the destination; a scheduled post's corpus is narrowed in the reviewed manifest to what the destination reaches. | A scheduled post to an audience under a service identity. | surface.publish-answer.askerless-audiencesurface.publish-answer.askerless-audienceA scheduled job posting to an audience under a service identity raises VisibilityAskerlessAudience, naming the destination; a scheduled post's corpus is narrowed in the reviewed manifest to what the destination reaches. |