errcode/src/lib.rs
//! # `holger-errcode` — holger's FROZEN, append-only application error codes
//!
//! Every non-UI error holger emits carries **two channels**:
//!
//! 1. a **visible human string** (what went wrong, in words), and
//! 2. a **stable machine code** `holger-<subsystem>-<n>`.
//!
//! Both ride in the SAME message, so a code survives every transport holger has —
//! an HTTP error body, a log line, a CLI stderr line, an audit row — without
//! needing a side channel.
//!
//! ## Why its own crate, with zero dependencies
//!
//! The Secure Update Gateway core (`update-bundle`) is deliberately network-free
//! and self-contained. The registry has to be reachable from there *and* from
//! `server/lib` while remaining the ONE place codes are allocated — otherwise
//! "unique globally within the app" cannot be enforced by a single test. So this
//! is a leaf crate with **no dependencies at all**. Keep it that way.
//!
//! ## The law
//!
//! - **FROZEN.** A code, once published, never changes meaning. Fix the wording of
//! a [`ErrCode::summary`] freely; never re-point a code at a different failure.
//! - **APPEND-ONLY.** Retire a code by leaving it in [`ALL`] and ceasing to emit
//! it. NEVER reuse the number — a retired code in an old audit row must stay
//! unambiguous.
//! - **UNIQUE** within its subsystem *and* globally across the app. Enforced by
//! [`tests::codes_are_unique`], which FAILS on a repeat.
//! - Consumers may **prepend a mount prefix**; [`parse`] finds the bracketed code
//! anywhere in the string.
//! - Every row declares whether it is [`Wiring::Wired`] (raised at a real error site
//! in [`ErrCode::src_file`] TODAY) or [`Wiring::Reserved`] (the number is claimed
//! and frozen, the site is not coded yet). **That claim is guarded** by
//! `errcode/tests/wiring_guard.rs`, which reads the real holger source tree: a
//! `wired` row nothing raises FAILS, and a `reserved` row that IS raised FAILS.
//!
//! ## Why the Wired/Reserved split exists
//!
//! A registry that merely LISTS codes will happily claim coverage it does not have.
//! holger shipped exactly that: for four sessions the registry declared 65 codes
//! while **zero** of the 38 `tonic::Status` construction sites — the only surface a
//! remote client ever sees — carried one. The declaration was green; the wire raised
//! nothing. Marking a row `wired` is now a claim a guard can falsify, so the honest
//! answer to "how much of holger is coded?" is a number, not a hope.
//!
//! ## Suite context
//!
//! Sibling namespaces: `nornir-<subsystem>-<n>`, `korp-<subsystem>-<n>`,
//! `dwarves-<subsystem>-<n>`, `facet-<component>-<n>` (facett UI). This crate owns
//! `holger-<subsystem>-<n>` only. The registry doc is
//! `.nornir/holger-error-codes.md`.
use core::fmt::Display;
/// One frozen entry in holger's error-code registry.
///
/// `code` is the wire identity (`holger-<subsystem>-<n>`); `summary` is the human
/// half of the dual channel — a short description of the failure CLASS (the
/// operand goes in the per-site detail passed to [`ErrCode::tag`]).
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ErrCode {
/// The frozen wire code, e.g. `"holger-update-4"`.
pub code: &'static str,
/// The subsystem half of the code, e.g. `"update"`.
pub subsystem: &'static str,
/// The ordinal within the subsystem. Unique per subsystem, never reused.
pub n: u16,
/// The human channel: what this failure MEANS, without the operand.
pub summary: &'static str,
/// The repo-relative source file that RAISES this code ([`Wiring::Wired`]), or the
/// one it is EARMARKED for ([`Wiring::Reserved`]). Checked against the real tree by
/// `errcode/tests/wiring_guard.rs` — a typo here is a build failure, not a comment.
pub src_file: &'static str,
/// Whether this code is raised in holger TODAY, or reserved for a site not yet coded.
pub wiring: Wiring,
}
impl ErrCode {
/// The registry's name for this code, the `const` a raise site names, e.g.
/// `"UPDATE_LIMIT_EXCEEDED"` (`.nornir/holger-error-codes.md` is generated with it);
/// `None` for a code that is not in [`ALL`].
pub fn name(&self) -> Option<&'static str> {
ALL.iter()
.position(|c| c.code == self.code)
.and_then(|i| NAMES.get(i).copied())
}
}
/// Whether a registered code is actually RAISED in holger today, or merely reserved.
///
/// **The distinction is guarded** (`errcode/tests/wiring_guard.rs`): a `Wired` row whose
/// [`ErrCode::src_file`] does not reference it FAILS, and a `Reserved` row that IS
/// referenced from production code FAILS too. Without that second direction the split
/// would be decoration — a registry can always claim to be wired.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Wiring {
/// Raised at a real error site in [`ErrCode::src_file`] today.
Wired,
/// Declared, frozen and unique, but NOT raised anywhere yet. The number is claimed so
/// it can never be handed to a different failure later; the site is still to be coded.
Reserved,
}
impl Wiring {
/// The label the registry doc uses (`wired` / `reserved`).
pub fn label(&self) -> &'static str {
match self {
Wiring::Wired => "wired",
Wiring::Reserved => "reserved",
}
}
}
impl ErrCode {
/// Render both channels into one message: `[code] detail`.
///
/// The detail is normally the typed error's own `Display` (holger's error enums
/// already carry carefully-worded, path-free human strings — this prepends the
/// machine channel without disturbing them).
pub fn tag(&self, detail: impl Display) -> String {
format!("[{}] {}", self.code, detail)
}
/// Just the machine channel, `[holger-sub-n]`, for a site that builds its own
/// human half and wants the code EMBEDDED in it rather than prefixed.
///
/// The bracketed form is the one [`parse`] matches, so a message carrying this
/// is recoverable wherever it lands — a log line, an audit detail, a gate
/// refusal reason that is later joined with others.
pub fn bracketed(&self) -> String {
format!("[{}]", self.code)
}
/// The dual-channel message using the registry's own summary as the human half.
pub fn bare(&self) -> String {
format!("[{}] {}", self.code, self.summary)
}
}
impl Display for ErrCode {
fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
f.write_str(self.code)
}
}
/// `wired` / `reserved` as the leading keyword of a [`codes!`] row → a [`Wiring`].
/// Separate macro so the keyword is a plain token in the registry table and a typo
/// (`wried`) is a compile error naming the row.
macro_rules! wiring_kind {
(wired) => {
Wiring::Wired
};
(reserved) => {
Wiring::Reserved
};
}
/// Declare a frozen code AND enrol it in [`ALL`] in one place, so a code can never
/// be added to the app without also being added to the uniqueness gate.
///
/// Each row reads `<wired|reserved> IDENT = (subsystem, n, summary, src_file);`. The
/// leading keyword is the WIRING CLAIM and `src_file` is where that claim is checked —
/// both are data the wiring guard reads, not prose.
macro_rules! codes {
// `$kind:ident`, not `$kind:tt` — a `tt` here is locally ambiguous with the doc-comment
// `#[$m:meta]` repetition in front of it ("built-in NTs tt ('kind') or 1 other option").
($( $(#[$m:meta])* $kind:ident $ident:ident = ($sub:literal, $n:literal, $summary:literal, $src:literal); )*) => {
$(
$(#[$m])*
pub const $ident: ErrCode = ErrCode {
code: concat!("holger-", $sub, "-", stringify!($n)),
subsystem: $sub,
n: $n,
summary: $summary,
src_file: $src,
wiring: wiring_kind!($kind),
};
)*
/// EVERY code holger can emit. Append-only: add at the end of a subsystem's
/// block, never renumber, never delete.
pub const ALL: &[ErrCode] = &[ $($ident),* ];
/// The registry's name of each code in [`ALL`], in the same order: the `const` a raise
/// site names, e.g. `"UPDATE_LIMIT_EXCEEDED"` ([`ErrCode::name`]). A table beside
/// [`ALL`], not a field, so the struct keeps its 3.0 shape (cargo-semver-checks).
pub const NAMES: &[&str] = &[ $(stringify!($ident)),* ];
};
}
codes! {
// ── update — the Secure Update Gateway (update-bundle + `holger bundle`) ──
// These mirror `BundleError` 1:1 (see `BundleError::code`); the mapping is an
// EXHAUSTIVE match, so adding a variant without allocating a code will not
// compile. Trust-model verdicts — an operator must be able to tell "your
// signature is invalid" from "this bundle is a replay" from "the disk is full".
/// The bundle declares a schema version this build cannot read.
wired UPDATE_SCHEMA_UNSUPPORTED = ("update", 1, "bundle schema version is not supported", "update-bundle/src/error.rs");
/// The trust policy declares a schema version this build cannot read.
wired UPDATE_POLICY_SCHEMA_UNSUPPORTED = ("update", 2, "trust-policy schema version is not supported", "update-bundle/src/error.rs");
/// A member path escapes the bundle root (traversal attempt).
wired UPDATE_UNSAFE_PATH = ("update", 3, "unsafe member path rejected", "update-bundle/src/error.rs");
/// The bundle exceeds a declared resource limit (size/count/depth).
wired UPDATE_LIMIT_EXCEEDED = ("update", 4, "bundle exceeds a resource limit", "update-bundle/src/error.rs");
/// A member named in the manifest is absent from the container.
wired UPDATE_MEMBER_MISSING = ("update", 5, "a manifested bundle member is missing", "update-bundle/src/error.rs");
/// The container holds a member the manifest does not reference.
wired UPDATE_MEMBER_UNREFERENCED = ("update", 6, "bundle contains an unreferenced member", "update-bundle/src/error.rs");
/// A member's content digest does not match the manifest.
wired UPDATE_DIGEST_MISMATCH = ("update", 7, "member digest mismatch", "update-bundle/src/error.rs");
/// `core.json` does not match the approved candidate digest.
wired UPDATE_CANDIDATE_DIGEST_MISMATCH = ("update", 8, "candidate digest mismatch — core.json is not what was approved", "update-bundle/src/error.rs");
/// The signed envelope disagrees with `core.json`.
wired UPDATE_ENVELOPE_MISMATCH = ("update", 9, "envelope is inconsistent with core.json", "update-bundle/src/error.rs");
/// The bundle carries no release signature at all.
wired UPDATE_RELEASE_SIGNATURE_MISSING = ("update", 10, "bundle carries no release signature", "update-bundle/src/error.rs");
/// The release signature does not verify over the stored bytes.
wired UPDATE_RELEASE_SIGNATURE_INVALID = ("update", 11, "release signature is invalid", "update-bundle/src/error.rs");
/// An approval signature does not verify.
wired UPDATE_APPROVAL_SIGNATURE_INVALID = ("update", 12, "an approval signature is invalid", "update-bundle/src/error.rs");
/// An approval came from a signer outside the trust policy.
wired UPDATE_UNTRUSTED_SIGNER = ("update", 13, "approval from an untrusted signer", "update-bundle/src/error.rs");
/// The release was signed by a key outside the trust policy.
wired UPDATE_UNTRUSTED_RELEASE_SIGNER = ("update", 14, "release signed by an untrusted signer", "update-bundle/src/error.rs");
/// The two-person rule is unsatisfied (same signer twice, or too few).
wired UPDATE_TWO_PERSON_RULE = ("update", 15, "two-person rule unsatisfied", "update-bundle/src/error.rs");
/// A role the policy requires produced no approval.
wired UPDATE_ROLE_MISSING = ("update", 16, "a required approval role is missing", "update-bundle/src/error.rs");
/// The bundle's validity window has passed.
wired UPDATE_EXPIRED = ("update", 17, "bundle has expired", "update-bundle/src/error.rs");
/// The bundle is older than the freshness floor.
wired UPDATE_TOO_OLD = ("update", 18, "bundle is older than the freshness floor", "update-bundle/src/error.rs");
/// The bundle declares no expiry, which the policy forbids.
wired UPDATE_EXPIRY_MISSING = ("update", 19, "bundle declares no expiry", "update-bundle/src/error.rs");
/// Evidence the policy requires is absent.
wired UPDATE_EVIDENCE_MISSING = ("update", 20, "required evidence is missing", "update-bundle/src/error.rs");
/// The bundle targets a different site/product than this installation.
wired UPDATE_TARGET_MISMATCH = ("update", 21, "bundle targets a different installation", "update-bundle/src/error.rs");
/// The sequence number went BACKWARDS — a rollback attempt.
wired UPDATE_SEQUENCE_ROLLBACK = ("update", 22, "sequence rollback — bundle is older than what is installed", "update-bundle/src/error.rs");
/// This exact sequence number was already accepted — a replay.
wired UPDATE_SEQUENCE_REPLAY = ("update", 23, "sequence replay — this bundle was already accepted", "update-bundle/src/error.rs");
/// A bundle id previously accepted was presented again.
wired UPDATE_BUNDLE_ID_REUSE = ("update", 24, "bundle id reuse", "update-bundle/src/error.rs");
/// The signer certificate chain failed to validate.
wired UPDATE_CERTIFICATE = ("update", 25, "signer certificate is not valid", "update-bundle/src/error.rs");
/// The trust policy itself is unusable (malformed/contradictory).
wired UPDATE_POLICY = ("update", 26, "trust policy is unusable", "update-bundle/src/error.rs");
/// The bundle is structurally malformed.
wired UPDATE_MALFORMED = ("update", 27, "bundle is malformed", "update-bundle/src/error.rs");
/// The bundle container (archive) could not be read.
wired UPDATE_CONTAINER = ("update", 28, "bundle container could not be read", "update-bundle/src/error.rs");
/// An IO failure while reading/writing the bundle.
wired UPDATE_IO = ("update", 29, "bundle IO failed", "update-bundle/src/error.rs");
/// A serialisation/deserialisation failure inside the bundle.
wired UPDATE_SERDE = ("update", 30, "bundle (de)serialisation failed", "update-bundle/src/error.rs");
/// Importing a verified bundle into the protected store failed. RESERVED — `BundleError`
/// has no `Import` variant yet, so nothing can raise it; `finalize.rs` is where it lands.
reserved UPDATE_IMPORT = ("update", 31, "import into the protected store failed", "update-bundle/src/finalize.rs");
/// Scrubbing/quarantining a rejected bundle failed. RESERVED — no scrub failure branch
/// exists yet.
reserved UPDATE_SCRUB = ("update", 32, "scrub of a rejected bundle failed", "update-bundle/src/finalize.rs");
/// Taking or restoring a backup failed. RESERVED — `rollback.rs` reports through
/// `BundleError::Io` today; this number is claimed for the specific backup verdict.
reserved UPDATE_BACKUP = ("update", 33, "backup or restore failed", "update-bundle/src/rollback.rs");
/// The trust policy never states a `trust_mode`. An unanswered trust question is
/// not a permissive answer: anchoring used to be INFERRED from `trusted_roots`
/// being empty, so a policy that lost its roots silently stopped checking chains.
wired UPDATE_TRUST_MODE_UNSET = ("update", 34, "trust policy states no trust mode", "update-bundle/src/error.rs");
/// `trust_mode: RootedChain` with an empty `trusted_roots` — the exact shape that
/// used to mean "accept any issuer". Nothing can be anchored, so nothing is.
wired UPDATE_TRUST_ROOTS_EMPTY = ("update", 35, "rooted-chain trust policy lists no trusted root", "update-bundle/src/error.rs");
/// A signer certificate is past its `notAfter`. Behind an airgap this is the only
/// revocation there is — there is no CRL or OCSP on the far side of the gap.
wired UPDATE_CERTIFICATE_EXPIRED = ("update", 36, "signer certificate has expired", "update-bundle/src/error.rs");
/// A signer certificate has not reached its `notBefore`. Distinct from expiry
/// because the usual cause is the VERIFIER's clock, not the signer's key.
wired UPDATE_CERTIFICATE_NOT_YET_VALID = ("update", 37, "signer certificate is not yet valid", "update-bundle/src/error.rs");
/// There is NO anti-rollback floor for this `(supplier, product)` — no bundle has
/// ever been accepted here, or the state was erased. An empty floor makes EVERY
/// sequence look new, including an old vulnerable one, so an import against it is
/// refused unless the operator says `--first-import` by name.
///
/// `src_file` is `error.rs`, like every other `update` row, and NOT `rollback.rs`
/// where the refusal is decided. The two are different questions and the guard
/// asks the second one: `update-bundle/src/rollback.rs` constructs the VARIANT
/// (`BundleError::RollbackFloorAbsent`), and `update-bundle/src/error.rs` is the
/// one place in the tree that names THIS CONST, in the `BundleError -> &ErrorCode`
/// map. The wiring guard matches the IDENTIFIER, so a row pointing at the decision
/// site reads as a lie about a refusal that is in fact alive and covered
/// (`update-bundle/src/tests/targeting.rs`, three RED-when-broken tests).
wired UPDATE_ROLLBACK_FLOOR_ABSENT = ("update", 38, "no anti-rollback floor — refusing without --first-import", "update-bundle/src/error.rs");
/// The trust policy's `on_expired_metadata` is neither `ReadOnly` nor
/// `Refuse`. Unstated is ReadOnly (the owner's ruling, 2026-09-28); Refuse is
/// an explicit per-estate choice.
wired UPDATE_EXPIRED_POSTURE_UNSET = ("update", 39, "trust policy's expired-metadata posture is not ReadOnly or Refuse", "update-bundle/src/error.rs");
/// The bundle's signed policy verdict is not `pass`: its reviewers did not
/// clear it. Refused at verify, at import and at finalize, whatever the
/// signatures say (B1, 2026-10-19).
wired UPDATE_VERDICT_NOT_PASS = ("update", 40, "the bundle's recorded policy verdict is not pass", "update-bundle/src/error.rs");
// ── promote — the promotion ladder (server/lib/src/promote/) ─────────────
/// The artifact is already at (or past) the requested stage.
wired PROMOTE_ALREADY_PROMOTED = ("promote", 1, "artifact is already promoted", "server/lib/src/promote/mod.rs");
/// Promotion policy refused, naming the unmet gates.
wired PROMOTE_POLICY_BLOCKED = ("promote", 2, "promotion blocked by policy", "server/lib/src/promote/mod.rs");
/// An IO failure while recording the promotion.
wired PROMOTE_IO = ("promote", 3, "promotion IO failed", "server/lib/src/promote/mod.rs");
/// The named stage is not in the configured ladder.
wired PROMOTE_UNKNOWN_STAGE = ("promote", 4, "no such stage in the ladder", "server/lib/src/promote/stages.rs");
/// The move goes backwards down the ladder.
wired PROMOTE_NOT_FORWARD = ("promote", 5, "promotion does not move forward", "server/lib/src/promote/stages.rs");
/// The move skips one or more mandatory stages.
wired PROMOTE_SKIPS_STAGES = ("promote", 6, "promotion skips mandatory stages", "server/lib/src/promote/stages.rs");
/// The artifact is not in the SOURCE repository, so there is nothing to seal.
/// Raised on BOTH surfaces from one registry row: the local `holger-server promote`
/// verb (declared file) and `PromotionService.PromoteArtifact`'s gRPC `not_found`.
wired PROMOTE_SOURCE_NOT_FOUND = ("promote", 7, "artifact not found in the source repository", "server/cli/src/lib.rs");
/// The source coordinate lacks a property the promotion policy requires (e.g.
/// `signed=true`). Fail-closed: no property store configured ⇒ cannot verify ⇒ refuse.
wired PROMOTE_PROPERTY_REQUIRED = ("promote", 8, "promotion requires a property the source artifact does not carry", "server/lib/src/grpc/services.rs");
/// The promotion TARGET names a repository this server does not serve. `to_repo`
/// used to be sanitized into a directory segment and never resolved, so a
/// promotion to a repository that does not exist SUCCEEDED and sealed bytes into
/// a `refs/<made-up-name>/` nobody serves. Refused BY NAME instead, before
/// anything touches disk.
wired PROMOTE_UNKNOWN_REPOSITORY = ("promote", 9, "promotion names a repository this server does not serve", "server/lib/src/promote/mod.rs");
/// ★ The PROVENANCE gate refused: an artifact in the promoted set carries no
/// accepted provenance statement about ITS OWN digest in the evidence plane —
/// which means nothing filed on this server chains those bytes to the
/// operator-declared trust root (`attestation.trust_roots`).
///
/// Distinct from `holger-attest-11`: there the server declares no root at all,
/// so verification was never possible; here a root IS declared and these bytes
/// simply have no evidence under it. The two want different fixes — declare a
/// root, versus sign and file the build.
wired PROMOTE_PROVENANCE_UNVERIFIED = ("promote", 10, "an artifact's evidence does not chain to the declared attestation trust root", "server/lib/src/promote/gate.rs");
// ── intake — the artifact intake chain (server/lib/src/promote/intake.rs) ──
// UNTRUSTED → INGESTED → SCANNED → POLICY_CHECKED → APPROVED → SEALED →
// PROMOTED → AVAILABLE, plus the holding states QUARANTINED and BLOCKED.
/// The transition jumps past one or more intake states. Every artifact passes
/// every state in order; the refusal names the states that were skipped.
wired INTAKE_SKIPS_STATE = ("intake", 1, "the transition skips an intake state", "server/lib/src/promote/intake.rs");
/// The transition goes backwards, or to the state the artifact is already in.
wired INTAKE_NOT_FORWARD = ("intake", 2, "the intake transition does not move forward", "server/lib/src/promote/intake.rs");
/// The artifact is in a terminal state (BLOCKED, or AVAILABLE for anything but
/// a block) and the transition asked for cannot leave it.
wired INTAKE_TERMINAL = ("intake", 3, "the artifact's intake state cannot be left that way", "server/lib/src/promote/intake.rs");
/// The state name is not one of the intake states.
wired INTAKE_UNKNOWN_STATE = ("intake", 4, "no such intake state", "server/lib/src/promote/intake.rs");
/// The coordinate has no intake record: it was never ingested through a door.
wired INTAKE_NOT_INGESTED = ("intake", 5, "the artifact has no intake record", "server/lib/src/promote/intake.rs");
/// The transition's policy refused (a gate, or a failing evidence verdict).
wired INTAKE_POLICY_REFUSED = ("intake", 6, "the intake transition's policy refused", "server/lib/src/promote/intake.rs");
/// The transition's policy requires an evidence slot the request did not fill.
wired INTAKE_EVIDENCE_MISSING = ("intake", 7, "the intake transition lacks required evidence", "server/lib/src/promote/intake.rs");
/// The audit record for the transition could not be written, so the
/// transition did not happen (fail closed).
wired INTAKE_AUDIT_FAILED = ("intake", 8, "the intake transition's audit record could not be written", "server/lib/src/promote/intake.rs");
/// The stored bytes no longer match the digest recorded at ingest.
wired INTAKE_INTEGRITY = ("intake", 9, "the artifact's bytes do not match the ingested digest", "server/lib/src/promote/intake.rs");
/// The coordinate is already sealed; its bytes cannot be ingested again.
wired INTAKE_IMMUTABLE = ("intake", 10, "a sealed coordinate cannot be ingested again", "server/lib/src/promote/intake.rs");
/// A write or a promotion named a repository that only the intake chain feeds.
wired INTAKE_DOOR_REFUSED = ("intake", 11, "this repository is fed only by the intake chain", "server/lib/src/promote/intake.rs");
/// An upload into the incoming repository whose path names no artifact
/// coordinate, so the intake chain cannot track it.
wired INTAKE_NO_COORDINATE = ("intake", 12, "the upload names no artifact coordinate", "server/lib/src/promote/intake.rs");
/// The intake record or the sealed store could not be read or written.
wired INTAKE_STORE = ("intake", 13, "the intake chain's storage failed", "server/lib/src/promote/intake.rs");
/// W6: the retired serve-time quarantine property (`HOLGER_QUARANTINE_PROPERTY`)
/// is still set. There is ONE quarantine, the intake chain's QUARANTINED hold,
/// so the boot is refused by name and told the replacement.
wired INTAKE_QUARANTINE_PROPERTY_RETIRED = ("intake", 14, "the retired quarantine property is still set; the intake QUARANTINED hold replaces it", "server/lib/src/lib.rs");
/// HOL-FIELD-2 P19: a write into a repository outside the intake chain (a writable crates
/// registry, a raw repository, any other writable archive) where the policy requires a
/// scan: it would be served unscanned, so it is refused by name.
wired INTAKE_SIDE_DOOR = ("intake", 15, "this repository is outside the intake chain and the policy requires a scan: a write here would be served unscanned", "server/lib/src/promote/intake.rs");
/// HOL-FIELD-2 P19: `promotion.intake.unscanned` opts a repository out of the chain where
/// the policy requires a scan, or names no repository of this Holger.
wired INTAKE_UNSCANNED_REFUSED = ("intake", 16, "an unscanned repository is declared where the policy requires a scan", "server/lib/src/lib.rs");
/// SEC-REVIEW 2026-11-01 P5: an upstream proxy (`*-remote`, `ron_upstreams`) would serve bytes
/// no scan saw where the policy requires a scan, or an upstream names a repository of the
/// intake chain (its raw store, past the chain's view).
wired INTAKE_UNSCANNED_UPSTREAM = ("intake", 17, "an upstream proxy would serve bytes the intake chain never scanned", "server/lib/src/lib.rs");
/// SEC-REVIEW 2026-11-01 P6: `security_profile: Critical` with a writable or proxy repository
/// and no intake chain (`promotion.intake`): nothing would scan what such a repository serves.
wired INTAKE_CHAIN_REQUIRED = ("intake", 18, "a Critical Holger with a writable or proxy repository declares no intake chain", "server/lib/src/lib.rs");
/// SEC-REVIEW 2026-11-01 P8: a `group` repository names a member it would serve raw, past
/// that member's gate: a repository of the intake chain, a scanned registry, a door of the
/// chain, or an Admin-only repository in a group others read.
wired INTAKE_GROUP_MEMBER_REFUSED = ("intake", 19, "a group would serve a member raw, past the chain or the member's own gate", "server/lib/src/lib.rs");
/// SEC-REVIEW 2026-11-01 (the guard): a bulk import that lands bytes raw (`MigrationService.Start`
/// from Nexus or Artifactory) on a Holger with an intake chain.
wired INTAKE_RAW_IMPORT_REFUSED = ("intake", 20, "a bulk import would land bytes raw, past the intake chain", "server/lib/src/grpc/migration.rs");
// ── npm — the npm door of the intake chain (server/lib/src/promote/npm.rs, lane P5) ──
/// The body `npm publish` PUT is not one publish of one version with its tarball.
wired NPM_PUBLISH_INVALID = ("npm", 1, "not an npm publish of one version with its tarball", "server/lib/src/promote/npm.rs");
/// The attached tarball does not match its document: integrity, length, or its own package.json.
wired NPM_TARBALL_MISMATCH = ("npm", 2, "the published tarball is not what its document says", "server/lib/src/promote/npm.rs");
/// Unpublish, deprecate, or another rewrite of a published package: refused by policy.
wired NPM_REWRITE_REFUSED = ("npm", 3, "published npm versions are never unpublished or rewritten", "server/lib/src/promote/npm.rs");
/// A dist-tag change the door does not make: a version not AVAILABLE, removing `latest`, a bad name.
wired NPM_TAG_REFUSED = ("npm", 4, "this npm dist-tag change is refused", "server/lib/src/promote/npm.rs");
/// `promotion.intake.npm` names no archive-less npm repository, or an npm repository has neither
/// an archive nor the chain naming it.
wired NPM_DOOR_CONFIG = ("npm", 5, "the npm door of the intake chain is not declared consistently", "server/lib/src/lib.rs");
// ── cargo — the cargo door of the intake chain (server/lib/src/promote/cargo.rs, lane HOL-CARGO-PUBLISH-DOOR) ──
/// The body `cargo publish` PUT is not one publish of one crate.
wired CARGO_PUBLISH_INVALID = ("cargo", 1, "not a cargo publish of one crate", "server/lib/src/promote/cargo.rs");
/// The published crate's own Cargo.toml names another crate or version than the publish.
wired CARGO_CRATE_MISMATCH = ("cargo", 2, "the published crate is not what its publish says", "server/lib/src/promote/cargo.rs");
/// A yank or unyank of a version that is not AVAILABLE, or one the door does not make.
wired CARGO_YANK_REFUSED = ("cargo", 3, "this yank or unyank is refused", "server/lib/src/promote/cargo.rs");
/// `promotion.intake.cargo` names no `rust` repository without storage, or names one a
/// pull-through source or a chain view shares its name with.
wired CARGO_DOOR_CONFIG = ("cargo", 4, "the cargo door of the intake chain is not declared consistently", "server/lib/src/lib.rs");
// ── bundles — the bundles door of the intake chain (server/lib/src/import_door.rs, lane HOL-BUNDLES-DOOR) ──
/// A PUT into the bundles door is not a Holger bundle that verifies against the door's
/// trust policy (unsigned, tampered, not a bundle, or no policy to verify it under).
wired BUNDLES_REFUSED = ("bundles", 1, "this is not a signed Holger bundle that verifies against the bundles door's trust policy", "server/lib/src/import_door.rs");
/// `promotion.intake.bundles` names no `raw` repository of this Holger, or one the chain owns.
wired BUNDLES_DOOR_CONFIG = ("bundles", 2, "the bundles door of the intake chain is not declared consistently", "server/lib/src/lib.rs");
// ── oci — scanned pushes into a writable `oci` registry (server/lib/src/promote/oci_push.rs, lane HOL-OCI-EVIDENCE) ──
/// `promotion.intake.oci_push` opts a registry out of the scan where the policy requires one
/// (`security_profile: Critical`, or `scan.required` naming a kind).
wired OCI_PUSH_SCAN_REQUIRED = ("oci", 1, "this registry's pushes must be scanned: the policy requires a scan", "server/lib/src/promote/oci_push.rs");
/// An `oci_push` row names no `oci` repository (or twice), or a scanned registry shares a pull-through source's name.
wired OCI_PUSH_RULE_UNKNOWN = ("oci", 2, "the scanned registries are not declared consistently", "server/lib/src/promote/oci_push.rs");
/// A DELETE on a scanned registry: what was pushed is held by the intake chain.
wired OCI_PUSH_DELETE_REFUSED = ("oci", 3, "a scanned registry never deletes or rewrites what was pushed", "server/lib/src/promote/oci_push.rs");
// ── duty — separation of duties on the intake chain (server/lib/src/promote/duties.rs) ──
// Developer / Importer / SecurityApprover / RepositoryAdmin / Auditor, the
// importer never approves, N distinct approvers, attested approvals.
/// The principal that imported the artifact asked to approve or release it.
/// Holds even when that principal also holds the SecurityApprover duty.
wired DUTY_IMPORTER_CANNOT_APPROVE = ("duty", 1, "the importer of an artifact cannot approve or release it", "server/lib/src/promote/duties.rs");
/// The caller's duties do not permit the verb (an Auditor or a Developer
/// moving an artifact, a RepositoryAdmin approving).
wired DUTY_NOT_PERMITTED = ("duty", 2, "the caller's duties do not permit this intake verb", "server/lib/src/promote/duties.rs");
/// The same principal approved the same artifact twice; it counts once.
wired DUTY_DUPLICATE_APPROVER = ("duty", 3, "this principal already approved this artifact", "server/lib/src/promote/duties.rs");
/// An in-process APPROVED move whose vote fell short of the configured
/// two-person (N-person) quorum. The vote is recorded.
wired DUTY_QUORUM_PENDING = ("duty", 4, "the approval quorum is not reached yet", "server/lib/src/promote/duties.rs");
/// An approval without an authenticated principal.
wired DUTY_ANONYMOUS_APPROVER = ("duty", 5, "an approval needs an authenticated principal", "server/lib/src/promote/duties.rs");
/// A Developer asked about an artifact that is not AVAILABLE.
wired DUTY_NOT_AVAILABLE = ("duty", 6, "a Developer reads only AVAILABLE artifacts", "server/lib/src/promote/duties.rs");
/// The request carried an approval evidence slot; only the server mints one.
wired DUTY_FORGED_APPROVAL = ("duty", 7, "approval evidence is minted by the server, never supplied", "server/lib/src/promote/duties.rs");
// ── model — AI model files on the intake chain (server/lib/src/scanner/model.rs) ──
// GGUF, Safetensors and ONNX are first-class; the pickle family (pkl, pickle,
// pt, pth, joblib, and PyTorch zip checkpoints holding data.pkl) runs code when
// it is loaded and is blocked by default. Every format is told by its content.
/// The file is a pickle (by its opcodes) or carries a pickle-family name.
/// Loading a pickle can run any code, so it is blocked unless
/// `models.allow_pickle` names the repository.
wired MODEL_PICKLE_BLOCKED = ("model", 1, "a pickle-family model file runs code when it is loaded, so it is blocked", "server/lib/src/scanner/model.rs");
/// The file is a zip in the PyTorch checkpoint layout: it holds `data.pkl`.
wired MODEL_TORCH_ZIP_BLOCKED = ("model", 2, "a PyTorch zip checkpoint holds a pickle (data.pkl), so it is blocked", "server/lib/src/scanner/model.rs");
/// The GGUF, Safetensors or ONNX header does not parse, breaks a limit, or
/// describes tensors that disagree with their sizes.
wired MODEL_HEADER_MALFORMED = ("model", 3, "the model file's header is malformed", "server/lib/src/scanner/model.rs");
/// A tensor's data range ends past the end of the file.
wired MODEL_TENSOR_OUT_OF_BOUNDS = ("model", 4, "a tensor's data lies outside the file", "server/lib/src/scanner/model.rs");
/// Two tensors claim the same bytes.
wired MODEL_TENSOR_OVERLAP = ("model", 5, "two tensors overlap in the file", "server/lib/src/scanner/model.rs");
/// The name claims `.gguf`, `.safetensors` or `.onnx`, and the content is not that format.
wired MODEL_FORMAT_MISMATCH = ("model", 6, "the file's name claims a model format its content is not", "server/lib/src/scanner/model.rs");
/// A pickle-family file in a repository `models.allow_pickle` names: a warning, not a block.
wired MODEL_PICKLE_ALLOWED = ("model", 7, "a pickle-family model file is allowed in this repository, with a warning", "server/lib/src/scanner/model.rs");
/// `models.allow_pickle` names a repository the config does not declare.
wired MODEL_ALLOW_UNKNOWN_REPO = ("model", 8, "models.allow_pickle names a repository the config does not declare", "server/lib/src/scanner/model.rs");
// ── audit — the append-only audit log (server/lib/src/audit/) ────────────
/// The audit log could not be written — an append FAILED.
wired AUDIT_IO = ("audit", 1, "audit log write failed", "server/lib/src/audit/mod.rs");
/// The audit log's Arrow index (`server/lib/src/audit/arrow_ipc.rs`) could not
/// be written or read. The chain is untouched; the index is rebuilt from it.
wired AUDIT_ARROW = ("audit", 2, "audit log Arrow encoding failed", "server/lib/src/audit/mod.rs");
/// An audit failure that is neither IO nor Arrow.
wired AUDIT_OTHER = ("audit", 3, "audit log failed", "server/lib/src/audit/mod.rs");
// The tamper-evidence verdicts. Until the blake3 record chain existed, holger's
// audit log was append-only BY CONVENTION: `audit verify` read each segment and
// proved only that it PARSED, so anyone with write access to the audit directory
// could re-emit a valid Arrow stream with an `ident` or a `status` changed and
// pass cleanly. These two separate what an operator must do about it — a broken
// link is a rewritten row, a missing link is a deleted FILE — from the crash
// damage `audit-2`/`audit-3` already covered.
/// A record's stored link digest is not the digest of its contents: a row was
/// altered, or a row before it was inserted or removed.
wired AUDIT_CHAIN_BROKEN = ("audit", 4, "audit chain broken — a record was altered, inserted or removed", "server/lib/src/audit/mod.rs");
/// A segment's chain seed matches no earlier segment's tail — a whole segment is
/// missing from the directory, or a seed header was rewritten.
reserved AUDIT_SEGMENT_UNLINKED = ("audit", 5, "audit segment links to nothing — a segment is missing", "server/lib/src/audit/mod.rs");
/// The verified chain tail is not the one the operator pinned with
/// `holger-server audit verify --expect-tail`. The ONLY check that survives an
/// attacker who rewrites the whole directory, because the pinned value lives
/// somewhere he does not control.
reserved AUDIT_TAIL_MISMATCH = ("audit", 6, "audit chain tail is not the pinned value", "server/cli/src/secure_update.rs");
/// `--require-chain` was demanded and a segment carries no chain at all (it
/// predates the feature). Readable, but its integrity is UNPROVABLE — never a
/// pass, and never silently one.
reserved AUDIT_UNCHAINED_SEGMENT = ("audit", 7, "audit segment carries no chain — integrity unprovable", "server/cli/src/secure_update.rs");
/// `AuditService.Query` / `AuditService.SentTo` was called on a server whose
/// configured audit sink keeps nothing readable — `NoopAuditLog`, or no audit
/// directory configured at all.
///
/// A distinct code rather than an empty page, because "no record matches your
/// filter" and "this server records nothing" are different facts. An operator
/// asking what a downstream site was sent, and handed an empty list when the
/// truth is that nothing was ever written down, would read a configuration
/// hole as a clean answer.
wired AUDIT_QUERY_UNAVAILABLE = ("audit", 8, "audit query unavailable — this server's audit sink keeps no readable records", "server/lib/src/grpc/services.rs");
/// A SIEM export sink in `audit.siem` cannot mean what it says (a format to a
/// target it cannot go to, an https endpoint with no CA), or it sends off the
/// site where this side exports to local sinks only (the airgap side).
wired AUDIT_SIEM_REFUSED = ("audit", 9, "a SIEM export sink is misconfigured or not allowed on this side", "server/lib/src/audit/siem.rs");
/// An artifact trail was asked for by a caller who is neither an Auditor nor
/// an Admin.
wired AUDIT_TRAIL_FORBIDDEN = ("audit", 10, "the artifact trail is read by an Auditor or an Admin only", "server/lib/src/audit/trail.rs");
/// A checkpoint the configured signer could not sign: refused, never written
/// unsigned, and retried after the next record (lane HOL-AUDIT, NCSC).
wired AUDIT_CHECKPOINT_REFUSED = ("audit", 11, "a checkpoint that cannot be signed is refused, never written unsigned", "server/lib/src/audit/chain.rs");
/// The configured audit directory cannot be opened: the server refuses to start
/// in every profile rather than run a logger that records nothing (NCSC).
wired AUDIT_DIR_REFUSED = ("audit", 12, "the audit directory cannot be opened, so the server does not start", "server/lib/src/lib.rs");
/// The config turns the audit log off (lane HOL-NCSC): no profile runs without one.
wired AUDIT_OFF_REFUSED = ("audit", 13, "the config turns the audit log off, and no Holger runs without its audit log", "server/lib/src/lib.rs");
// ── auth — authentication + RBAC, raised at the gRPC doors ───────────────
// The POLICY layer itself moved to edda's `nornir-auth-policy` leaf (holger is the
// reference CONSUMER now — see `server/lib/src/auth.rs`), so holger's own raise
// sites for these are the three `authorize_*` gates in `grpc.rs`.
/// The request carried no usable credential.
wired AUTH_UNAUTHENTICATED = ("auth", 1, "request carried no usable credential", "server/lib/src/grpc.rs");
/// Authenticated, but not permitted this resource.
wired AUTH_PERMISSION_DENIED = ("auth", 2, "identity is not permitted this resource", "server/lib/src/grpc.rs");
/// The auth configuration is broken — the server fails CLOSED. RESERVED: the boot-time
/// `warn_*` checks log and continue; there is no fail-closed refusal branch yet.
reserved AUTH_CONFIG_BROKEN = ("auth", 3, "auth configuration is unusable — failing closed", "server/lib/src/auth.rs");
/// The presented token is expired or malformed. RESERVED: `validate_request` collapses
/// every credential failure into one `AuthError`, so holger cannot yet tell an expired
/// token from an absent one. Distinguishing it is an edda (`nornir-auth-policy`) change.
reserved AUTH_TOKEN_INVALID = ("auth", 4, "token is expired or malformed", "server/lib/src/auth.rs");
/// The first-key door (`holger.doors.v1.FirstKeyService`) once an admin key exists.
wired AUTH_FIRST_KEY_ENROLLED = ("auth", 5, "the first admin key is already enrolled; the first-key door is shut", "server/lib/src/grpc/doors.rs");
/// An approver invite minted by a machine credential, or by a person who is not stepped up
/// (lane HOL-NCSC, NCSC P1).
wired AUTH_INVITE_NEEDS_PERSON = ("auth", 6, "an invite that makes an approver needs a person's stepped-up session, never a machine token", "server/lib/src/passkey.rs");
// ── server — the request surface (server/lib) ────────────────────────────
/// The addressed repository is not configured.
wired SERVER_REPO_UNKNOWN = ("server", 1, "no such repository", "server/lib/src/grpc.rs");
/// The addressed artifact does not exist in the repository. Also the DELIBERATE mask a
/// quarantined artifact is refused with — the client must not learn quarantine state.
wired SERVER_ARTIFACT_UNKNOWN = ("server", 2, "no such artifact", "server/lib/src/grpc/services.rs");
/// The request was malformed.
wired SERVER_BAD_REQUEST = ("server", 3, "malformed request", "server/lib/src/grpc/services.rs");
/// The handler failed for an internal reason.
wired SERVER_INTERNAL = ("server", 4, "request failed internally", "server/lib/src/grpc.rs");
/// A backing resource (storage, index, upstream) is unavailable. Raised by
/// `AdminService.Capacity` when the data root cannot be measured (an admin-read
/// RPC whose answer names that path anyway). A read path still launders every
/// backend failure through `internal_err` into `holger-server-4`, because it must
/// not leak archive paths.
wired SERVER_UNAVAILABLE = ("server", 5, "a backing resource is unavailable", "server/lib/src/grpc/services.rs");
/// The whole SERVER refused because it runs in `operation_mode: ReadOnly`.
wired SERVER_READ_ONLY = ("server", 6, "server is read-only in this build", "server/lib/src/grpc.rs");
/// The addressed REPOSITORY is not writable, on an otherwise read-write server —
/// distinct from `holger-server-6`, which is the whole server refusing.
wired SERVER_REPO_READ_ONLY = ("server", 7, "repository is not writable", "server/lib/src/grpc/services.rs");
/// The upload body exceeds `ron_max_body_bytes` and was refused before being stored.
wired SERVER_PAYLOAD_TOO_LARGE = ("server", 8, "payload exceeds the ingest body cap", "server/lib/src/grpc/services.rs");
/// The RPC needs an optional capability (promotion / SBOM hosting / custom properties)
/// that this server was not configured with. Not a client error and not a bug — the
/// operator did not wire that store.
wired SERVER_CAPABILITY_NOT_CONFIGURED = ("server", 9, "that capability is not configured on this server", "server/lib/src/grpc/services.rs");
/// No SBOM is hosted for the addressed coordinate (the store exists; this artifact has
/// none) — distinct from `holger-server-9`, where SBOM hosting is off entirely.
wired SERVER_SBOM_UNKNOWN = ("server", 10, "no SBOM hosted for that coordinate", "server/lib/src/grpc/services.rs");
/// The server is already holding as many read bytes as its budget allows, so
/// this fetch is refused rather than allocated. An EGRESS refusal — distinct
/// from `SERVER_PAYLOAD_TOO_LARGE`, which refuses an oversized INGEST — because
/// the two tell an operator to do opposite things: raise the body cap, or add
/// memory and lower concurrency.
wired SERVER_READ_BUDGET_EXHAUSTED = ("server", 11, "server is already serving as many artifact bytes as its read budget allows", "server/lib/src/grpc.rs");
wired SERVER_TOO_MANY_CONCURRENT_READS = ("server", 12, "server is already serving as many concurrent reads as it allows", "server/lib/src/grpc.rs");
/// A security policy named by the ENVIRONMENT (stinky SB #22): the promotion
/// gate keys, the property requirement and the plugin trust root moved into
/// the RON config; a set variable refuses the boot by name, never read and
/// never ignored.
wired SERVER_ENV_POLICY_REFUSED = ("server", 13, "a security policy was named by the environment; it lives in the RON config", "server/lib/src/lib.rs");
/// SEC-REVIEW 2026-11-01 P1: a request path with an empty (`//`), `.` or `..` segment, also
/// percent-encoded. The router and the doors split paths differently, so such a path is
/// refused with 400 before any door sees it.
wired SERVER_PATH_NOT_CANONICAL = ("server", 14, "the request path is not canonical (an empty, `.` or `..` segment)", "server/lib/src/exposed/http.rs");
// ── metered — the paid state (server/lib/src/metered.rs) ─────────────────
// ALL WIRED, and all raised by the metered build ALONE: the open build does not
// contain the module, the proto package or the dependency. The codes are declared
// unconditionally on purpose — the registry is the one place numbers are
// allocated, and a number that exists only under a feature could be handed out
// twice by someone building without it.
/// The fact is not even well formed (missing repository/plan/source, or a
/// signature that is not 64 bytes) — told apart from a forged one.
wired METERED_FACT_MALFORMED = ("metered", 1, "entitlement fact is malformed", "server/lib/src/metered.rs");
/// The fact caps a meter holger measures only SERVER-WIDE. Refused at the sale
/// rather than stored and quietly ignored for the life of the plan.
wired METERED_CAP_UNPOLICEABLE = ("metered", 2, "a cap names a meter holger cannot police per repository", "server/lib/src/metered.rs");
/// The signature was not made by this server's configured monetize key.
wired METERED_SIGNATURE_INVALID = ("metered", 3, "entitlement signature does not verify", "server/lib/src/metered.rs");
/// A metered build with no monetize public key configured: it cannot check a
/// signature, so it refuses to keep a fact it cannot vouch for.
wired METERED_NOT_CONFIGURED = ("metered", 4, "no monetize public key is configured", "server/lib/src/metered.rs");
/// The fact names a repository this server does not serve.
wired METERED_UNKNOWN_REPOSITORY = ("metered", 5, "entitlement names a repository this server does not serve", "server/lib/src/metered.rs");
/// An upload that would take a repository past its PAID `disk_bytes` limit, or
/// any upload to a repository whose plan is suspended or in retention. The
/// message carries the numbers and where the bytes are.
wired METERED_OVER_CAP = ("metered", 6, "upload refused: the repository is over its paid disk_bytes limit or its plan is suspended", "server/lib/src/grpc/services.rs");
/// `EntitlementService.Purge` of a repository whose stored fact is not
/// `Suspended` or `Retention`: a free or paying repository is never purged,
/// whoever asks.
wired METERED_PURGE_REFUSED = ("metered", 7, "purge refused: the repository is not suspended or in retention", "server/lib/src/metered.rs");
// ── storage — repositories + object storage (server/repository/*) ────────
// ALL RESERVED. The backends report `anyhow::Error` and the gRPC door launders every
// one into `holger-server-4` so a read path cannot leak an archive path. Wiring these
// means giving `RepositoryBackendTrait` a typed error first — a real refactor, not a
// one-line tag. The numbers are claimed now so they can never be reassigned.
/// The storage root could not be opened.
reserved STORAGE_OPEN = ("storage", 1, "cannot open the storage root", "server/lib/src/repository.rs");
/// A read from storage failed.
reserved STORAGE_READ = ("storage", 2, "storage read failed", "server/lib/src/repository.rs");
/// A write to storage failed.
reserved STORAGE_WRITE = ("storage", 3, "storage write failed", "server/lib/src/repository.rs");
/// A stored object's digest did not match what was recorded.
reserved STORAGE_DIGEST_MISMATCH = ("storage", 4, "stored object digest mismatch", "server/lib/src/repository.rs");
/// Storage is out of space.
reserved STORAGE_NO_SPACE = ("storage", 5, "storage is out of space", "server/lib/src/repository.rs");
// ── cli — the thin client `holger-cli` (holger-cli/, lane B3) ────────────
// The client's own four: what happens before or instead of a server's answer. A
// refusal the server sent keeps the server's code. (`holger-server`, the server's own
// command line, exits through `anyhow`/clap and raises none of these.)
/// A CLI argument was absent or malformed.
wired CLI_INVALID_ARGS = ("cli", 1, "invalid command arguments", "holger-cli/src/error.rs");
/// A path argument does not exist.
wired CLI_PATH_MISSING = ("cli", 2, "path argument does not exist", "holger-cli/src/error.rs");
/// The verb is not available in this build (feature-gated out).
wired CLI_VERB_UNAVAILABLE = ("cli", 3, "verb is not available in this build", "holger-cli/src/error.rs");
/// The CLI could not reach the server.
wired CLI_SERVER_UNREACHABLE = ("cli", 4, "cannot reach the server", "holger-cli/src/error.rs");
// ── jobs — the background job runner ────────────────────────────────────
// ALL RESERVED, and the crate that would raise them DOES NOT EXIST on `main`: there is
// no `holger-jobs` workspace member. These three numbers are a claim on a subsystem
// that is still a plan. `errcode/tests/wiring_guard.rs` lists these earmarks in its
// PLANNED_FILES allowlist, so the absence is declared rather than silently tolerated.
/// A job failed while running.
reserved JOBS_FAILED = ("jobs", 1, "job failed", "holger-jobs/src/lib.rs");
/// The job store could not be read or written.
reserved JOBS_STORE = ("jobs", 2, "job store failed", "holger-jobs/src/lib.rs");
/// A job exceeded its deadline.
reserved JOBS_TIMEOUT = ("jobs", 3, "job exceeded its deadline", "holger-jobs/src/lib.rs");
// ── marketplace — cloud-marketplace fulfilment (server/lib/src/marketplace/) ──
// The landing-page seam: a purchase token is exchanged server-side for a
// subscription, the buyer is provisioned as ONE tenant (= one rendered RON
// graph + storage roots), and lifecycle webhooks move the tenant's status.
// These are trust verdicts on an UNAUTHENTICATED, MUTATING door, so every
// refusal must be distinguishable in the audit log: "the marketplace rejected
// your token" is not "you are rate-limited" is not "we never sold that plan".
// The marketplace doors were cut in 9521bf0; the codes stay frozen.
/// The marketplace refused the purchase token (unknown, expired, or REPLAYED —
/// a token is single-use). Nothing is provisioned.
reserved MARKETPLACE_TOKEN_REJECTED = ("marketplace", 1, "purchase token was not accepted by the marketplace", "server/lib/src/lib.rs");
/// The resolved subscription names a plan this server has no manifest for.
reserved MARKETPLACE_PLAN_UNKNOWN = ("marketplace", 2, "subscription names a plan this server does not offer", "server/lib/src/lib.rs");
/// The subscription id is not a safe tenant directory name (traversal guard).
reserved MARKETPLACE_SUBSCRIPTION_ID_UNSAFE = ("marketplace", 3, "subscription id is not a safe tenant name", "server/lib/src/lib.rs");
/// Writing the tenant (ledger row, rendered RON, storage roots) failed on disk.
reserved MARKETPLACE_PROVISION_IO = ("marketplace", 4, "tenant provisioning failed on disk", "server/lib/src/lib.rs");
/// A lifecycle webhook named an operation the marketplace does not confirm.
/// The payload is NEVER trusted on its own — it is a hint, verified by fetching
/// the operation from the fulfilment API.
reserved MARKETPLACE_OPERATION_UNVERIFIED = ("marketplace", 5, "webhook operation could not be verified against the marketplace", "server/lib/src/lib.rs");
/// Too many fulfilment attempts from one source address.
reserved MARKETPLACE_RATE_LIMITED = ("marketplace", 6, "too many fulfilment attempts from this source", "server/lib/src/lib.rs");
/// A `marketplace` block is configured but cannot be served: the client secret
/// is not in the environment, the publisher's credentials are REFUSED by the
/// marketplace (401/403), a plan is unprovisionable, or this build lacks
/// outbound HTTP / the OIDC provider. Boot fails CLOSED; at runtime it is the
/// publisher's fault, never the buyer's.
reserved MARKETPLACE_NOT_CONFIGURED = ("marketplace", 7, "marketplace is configured but cannot be served — missing or refused publisher credentials, an unprovisionable plan, or a build without outbound HTTP / OIDC", "server/lib/src/lib.rs");
/// The fulfilment API itself failed (transport error, 5xx, token endpoint down).
reserved MARKETPLACE_UPSTREAM = ("marketplace", 8, "marketplace fulfilment API call failed", "server/lib/src/lib.rs");
/// The request to the door was malformed (no token, unparseable form/JSON).
reserved MARKETPLACE_BAD_REQUEST = ("marketplace", 9, "malformed fulfilment request", "server/lib/src/lib.rs");
/// A webhook arrived for a subscription this server never provisioned.
reserved MARKETPLACE_TENANT_UNKNOWN = ("marketplace", 10, "no provisioned tenant for this subscription", "server/lib/src/lib.rs");
/// The resolved subscription names no buyer directory (no beneficiary
/// `tenantId`), so the tenant could not be closed to one issuer. Refused —
/// an OPEN registry is never provisioned by accident.
reserved MARKETPLACE_BENEFICIARY_UNKNOWN = ("marketplace", 11, "subscription names no buyer directory — refusing to provision an open tenant", "server/lib/src/lib.rs");
/// The subscription is `Suspended`/`Unsubscribed` at the marketplace, or the
/// marketplace refused `activate`; nothing to provision or activate.
reserved MARKETPLACE_SUBSCRIPTION_NOT_ACTIVATABLE = ("marketplace", 12, "subscription is not in an activatable state", "server/lib/src/lib.rs");
/// The buyer did not sign in with Entra before activation, the sign-in did
/// not verify, or it came from a directory other than the one that bought
/// the subscription. The marketplace contract requires SSO BEFORE activation.
reserved MARKETPLACE_SIGN_IN_REQUIRED = ("marketplace", 13, "buyer sign-in missing, unverifiable, or from a different directory than the purchase", "server/lib/src/lib.rs");
/// The webhook carried no bearer token this server could verify as the
/// marketplace's (Entra JWT for the publisher's app). Nothing was applied.
reserved MARKETPLACE_WEBHOOK_UNAUTHENTICATED = ("marketplace", 14, "webhook carried no valid marketplace bearer token", "server/lib/src/lib.rs");
// ── front — holger.rs's public front page (holger-front/) ───────────────
// The one page served to somebody who is not anybody yet, and the ONLY
// surface in holger where a refusal is read by a human in a browser rather
// than by a client library. Every way that page can come up blank has its
// own number, because they need different sentences and a blank page looks
// identical from a chair: the door is absent on an older server, reads are
// gated behind a credential, or there simply is no browser login to offer.
//
// Two of the four are printed by the page's own JavaScript, which no Rust
// compiler can check — `holger-front/src/lib.rs` asserts the page carries
// them, spelled exactly as they are allocated here.
/// A write arrived at the front door, which answers GET and HEAD only.
wired FRONT_METHOD_NOT_ALLOWED = ("front", 1, "the front door answers GET and HEAD only", "holger-front/src/lib.rs");
/// This server has no browser session to offer — its doors are mTLS, OIDC
/// and bearer. The page says so instead of drawing a button that is not
/// connected to anything.
wired FRONT_NO_BROWSER_LOGIN = ("front", 2, "this server offers no browser login", "holger-front/src/lib.rs");
/// `require_auth_for_reads` is on, so the front page cannot even read who
/// this server is. A front page behind a credential is not a front page.
wired FRONT_READS_GATED = ("front", 3, "reads are gated, so the front page cannot name itself", "holger-front/src/lib.rs");
/// The page is newer than the server behind it: `/-/front` answered 404.
wired FRONT_DOOR_ABSENT = ("front", 4, "this build of holger-server has no front door", "holger-front/src/lib.rs");
/// The estate front's report to main (its doors and routes, HOL-FLOW-FRONT) is not kept:
/// not a report, no key fed to open it under, a proof that does not hold, too old, or a
/// front the pairing does not name.
wired FRONT_REPORT_REFUSED = ("front", 5, "the estate front's report is not kept: its proof, its age or its front is refused", "server/lib/src/front_report.rs");
// ── attest — the ATTESTATION EVIDENCE PLANE (server/lib/src/attest.rs) ──────
// An attestation is a signed statement ABOUT SPECIFIC BYTES. Every refusal in
// this family answers one question an operator asks when a promotion is
// blocked: *why is this evidence not evidence?* They are deliberately NOT one
// "attestation rejected" code, because the five answers demand five different
// actions — re-sign, re-run the gate against the right artifact, enrol the
// gate's key, teach the server the predicate, or fix the producer's JSON.
//
// ★ `attest-3` is the load-bearing one. A DSSE envelope that verifies
// perfectly but whose in-toto `subject[].digest` names DIFFERENT bytes is a
// GENUINE signature over SOMEBODY ELSE'S artifact. Accepting it is how a
// clean scan of `serde-1.0.0` gets promoted as the evidence for a backdoored
// `serde-1.0.1`. Every other code here is hygiene; this one is the attack.
/// The DSSE envelope itself is not readable: not JSON, missing `payload` /
/// `payloadType` / `signatures`, or a `payload`/`sig` that is not base64.
/// Nothing was verified and nothing was stored.
wired ATTEST_ENVELOPE_MALFORMED = ("attest", 1, "DSSE envelope is malformed", "server/lib/src/attest.rs");
/// The envelope's payload is not an in-toto Statement v1: wrong `_type`, no
/// `predicateType`, an empty `subject`, or a subject carrying no digest. A
/// statement with no subject is a signature over an opinion, not over bytes.
wired ATTEST_STATEMENT_MALFORMED = ("attest", 2, "payload is not an in-toto Statement v1 with a digested subject", "server/lib/src/attest.rs");
/// ★ The statement is well-formed and may even be validly signed, but NONE of
/// its subjects names the artifact digest being attested. The signature is
/// real; the bytes are somebody else's.
wired ATTEST_SUBJECT_MISMATCH = ("attest", 3, "statement's subject digests do not name the artifact being attested", "server/lib/src/attest.rs");
/// No certificate was offered for an envelope signature's `keyid`, or the
/// signer is not one of this server's ENROLLED gates. Distinct from
/// `attest-5`: the key may chain to a trusted root perfectly well and still
/// not be a gate this server accepts verdicts from.
wired ATTEST_SIGNER_UNTRUSTED = ("attest", 4, "no enrolled gate certificate for this envelope signature", "server/lib/src/attest.rs");
/// A signature did not verify over `PAE(payloadType, payload)`, or the signer
/// certificate does not chain to a configured trusted root. The cryptography
/// failed — as opposed to `attest-4`, where it was never attempted.
wired ATTEST_ENVELOPE_UNVERIFIED = ("attest", 5, "DSSE signature did not verify or the signer does not chain to a trusted root", "server/lib/src/attest.rs");
/// The statement's `predicateType` is not one this server accepts. Storing an
/// unknown predicate would let a later gate read a claim nothing in this
/// build knows how to evaluate, which is a fail-open with extra steps.
wired ATTEST_PREDICATE_UNSUPPORTED = ("attest", 6, "statement declares a predicateType this server does not accept", "server/lib/src/attest.rs");
/// The artifact digest is not a lowercase-hex digest of the declared length.
/// The digest IS the storage key, so a digest that is not path-safe by
/// construction is refused rather than sanitized onto a neighbouring one —
/// the same rule, and the same reason, as the SBOM store's coordinate refusal.
wired ATTEST_DIGEST_UNSAFE = ("attest", 7, "artifact digest is not a lowercase-hex digest of the declared algorithm", "server/lib/src/attest.rs");
/// The attestation store could not be read or written (disk full, permissions,
/// a vanished directory). An infrastructure failure, never a trust verdict —
/// kept separate so an operator does not go hunting for a bad signature when
/// the real answer is a full disk.
wired ATTEST_STORE_IO = ("attest", 8, "attestation store I/O failed", "server/lib/src/attest.rs");
/// This server was built WITHOUT the `sign` feature, so a DSSE envelope cannot
/// be verified at all. Fail-closed: an unverifiable attestation is refused, not
/// stored unverified. (Every shipped tier pins `sign` through
/// `server/cli/Cargo.toml`; this is the `--no-default-features` library build.)
wired ATTEST_VERIFICATION_UNAVAILABLE = ("attest", 9, "this build cannot verify DSSE envelopes (built without the `sign` feature)", "server/lib/src/attest.rs");
/// ★ A path NAMED in `attestation.trust_roots` could not be read, is EMPTY, or
/// does not begin as a DER certificate. It is a refusal and never a skip.
///
/// Kept apart from `attest-8` (`StoreIo`), which it used to hide inside. A full
/// disk and a trust anchor that is not a trust anchor are not the same event,
/// and only one of them silently shrinks the set of roots the operator
/// declared. The plugin host has refused this since `holger-plugin-8`
/// (`plugin/host/src/verify.rs`: *"refusing rather than verifying against fewer
/// roots than the operator declared"*); this is that same rule on the evidence
/// plane, which had it in prose and not in code.
wired ATTEST_TRUST_ROOT_UNREADABLE = ("attest", 10, "a declared attestation trust root could not be read, is empty, or is not a DER certificate", "server/lib/src/attest.rs");
/// ★ A promotion asked the provenance gate to decide and this server declares
/// NO attestation trust root, so there is nothing for evidence to chain TO.
///
/// Raised under `provenance: Require`. Under `provenance: Warn` the same
/// sentence is LOGGED and the hop proceeds — the estate is told it is verifying
/// nothing rather than being told nothing. An absent `attestation:` block must
/// never read as `provenance: Off`: `Off` is an operator's declaration, an
/// absent root is an operator's omission, and the two must not print the same.
wired ATTEST_NO_TRUST_ROOT_DECLARED = ("attest", 11, "promotion provenance was demanded and this server declares no attestation trust root to chain evidence to", "server/lib/src/promote/gate.rs");
// ── plugin — the WASM package-handler host (plugin/host/) ────────────────
// A loaded `.wasm` is UNTRUSTED CODE running inside the server process. Until
// these codes existed the host had `Engine::default()` and no resource bounds
// at all: a module could spin forever and hang the request thread, or grow its
// linear memory until the host OOM'd, and neither had a name. It also loaded
// any file in the plugin directory with no provenance check whatsoever.
//
// Every bound below is a NAMED refusal, never a silent kill: an operator must
// be able to tell "this handler is a runaway" from "this handler is too big for
// its ceiling" from "this module is not the one we signed" — three different
// responses that an opaque "plugin failed" collapses into one. And the limits
// FAIL SAFE: `PluginLimits::default()` is bounded, so a missing config is the
// strict answer rather than the unbounded one.
//
// WHERE 1..9 ARE RAISED (2026-09-27): the checks moved to edda `guest_host`
// (limits + verify) on 2026-09-22 and refuse with TYPED errors; holger's code
// goes on at ONE seam, `plugin/host/src/named.rs` (`bound_code`,
// `limit_refusal`, `trust_code`), which `wasm.rs`, `meter_wasm.rs`,
// `registry.rs` (via `verify::verify_named`) and `limits::validate` call on
// every load and call. So the rows point there, not at limits.rs/verify.rs.
/// The module burned its whole CPU fuel allowance in a single call. The
/// DETERMINISTIC bound — the same input refuses at the same instruction on
/// every machine, so a runaway is reproducible rather than a flaky timeout.
wired PLUGIN_FUEL_EXHAUSTED = ("plugin", 1, "wasm package handler exhausted its CPU fuel allowance", "plugin/host/src/named.rs");
/// The call passed its wall-clock deadline (epoch interruption). The BACKSTOP
/// beside the fuel bound, and the only one of the two that also covers time
/// spent inside a host import — fuel measures wasm instructions, not a slow disk.
wired PLUGIN_DEADLINE_EXCEEDED = ("plugin", 2, "wasm package handler exceeded its wall-clock call deadline", "plugin/host/src/named.rs");
/// The module asked to grow its linear memory past the store's ceiling. Raised
/// by name rather than left as the `-1` the guest sees from `memory.grow`:
/// a module that turns a refused allocation into "no such artifact" would make
/// a memory ceiling look like a 404.
wired PLUGIN_MEMORY_LIMIT = ("plugin", 3, "wasm package handler exceeded its linear-memory ceiling", "plugin/host/src/named.rs");
/// The module asked to grow a table past the store's ceiling. Separate from
/// `plugin-3` because the operator's fix is a different number.
wired PLUGIN_TABLE_LIMIT = ("plugin", 4, "wasm package handler exceeded its table-element ceiling", "plugin/host/src/named.rs");
/// A limit was configured as zero. Zero is refused rather than read as
/// "unlimited": the one mistake that would silently reinstate the unbounded
/// host this subsystem exists to close.
wired PLUGIN_LIMIT_MISCONFIGURED = ("plugin", 5, "a wasm package-handler limit is zero, which is a misconfiguration and never means unlimited", "plugin/host/src/named.rs");
/// Module trust is required for this plugin directory and the module carries no
/// signature beside it. A boot error, NEVER a module quietly left out of the
/// catalog — a smaller catalog surfaces in production as a 404, not as a stop.
wired PLUGIN_MODULE_UNSIGNED = ("plugin", 6, "wasm package handler carries no signature and trust roots are configured", "plugin/host/src/named.rs");
/// The signature beside the module did not verify over the module's bytes, or
/// its signer does not chain to a configured trusted root. The cryptography
/// failed — as opposed to `plugin-6`, where it was never attempted.
wired PLUGIN_SIGNATURE_INVALID = ("plugin", 7, "wasm package handler signature did not verify or the signer is not trusted", "plugin/host/src/named.rs");
/// A trusted root could not be read or parsed, so nothing can be verified
/// against it. Fails closed: an unreadable root is not an empty root.
wired PLUGIN_TRUST_ROOTS_UNREADABLE = ("plugin", 8, "a wasm package-handler trusted root could not be read or parsed", "plugin/host/src/named.rs");
/// Trust roots are configured but this build has no verifier (built without the
/// `verify-modules` feature). The same fail-closed shape as
/// `attest-9` and `wire_verified_znippy`: a policy that cannot be enforced is a
/// refusal, not a silently skipped check.
wired PLUGIN_VERIFICATION_UNAVAILABLE = ("plugin", 9, "this build cannot verify wasm package handlers (built without the `verify-modules` feature)", "plugin/host/src/named.rs");
/// W14, the anti-rollback floor. The module offers a version BELOW the highest
/// version ever activated on this box for its `(supplier, product)`. A
/// correctly signed OLD module verifies forever — the signature says nothing
/// about age — so this is the ONLY downgrade stop there is. Refused BY NAME:
/// supplier, product, offered version and floor version are all in the message.
wired PLUGIN_BELOW_FLOOR = ("plugin", 10, "wasm module version is below the anti-rollback floor activated on this box", "plugin/host/src/floor.rs");
/// The floor file for this `(supplier, product)` exists but could not be read
/// or parsed. FAIL CLOSED: an unreadable floor is a REFUSAL, never `Absent` —
/// otherwise corrupting one file would be a quieter erase than deleting it.
wired PLUGIN_FLOOR_UNREADABLE = ("plugin", 11, "the anti-rollback floor file for this module could not be read or parsed", "plugin/host/src/floor.rs");
/// A floor is kept on this box and the module declares no `(supplier,
/// product, version)` — or a version that cannot be ordered. A module the
/// floor cannot place is refused, never loaded on a lane of its own.
wired PLUGIN_IDENTITY_MISSING = ("plugin", 12, "wasm module declares no orderable (supplier, product, version), so the anti-rollback floor cannot place it", "plugin/host/src/floor.rs");
/// Lane E4 (2026-10-19): this build loads METER guests and its plugin directory
/// holds modules, but no plugin trust root is configured (`ron_plugin_trust_roots`;
/// the `HOLGER_PLUGIN_TRUST_ROOT` fallback is refused, SB #22). A meter counts what a customer pays for, so
/// it is never loaded unverified: the boot stops by name before one module is
/// compiled, rather than reading "no root" as "trust everything".
wired PLUGIN_TRUST_ROOT_UNCONFIGURED = ("plugin", 13, "this build loads meter guests and no plugin trust root is configured, so no module in the plugin directory loads", "server/lib/src/lib.rs");
// ── mvp — the MVP line's OWN refusals (stinky 1.4, 2026-09-21) ───────────
// The slim tiers compile only the formats their row NAMES (`fmt-raw`,
// `fmt-rust` on the MVP rows; `fmt-all` on ORIGINAL). A config that declares
// a repository of a format the build did not include is refused at BOOT, by
// name, before any repository is wired — never a "DISABLED" log line and an
// estate that quietly serves one repository fewer than the RON says.
/// A repository's `ron_repo_type` names a format this build did not compile
/// (its `fmt-*` feature is off). The text names the repo, the format, the
/// feature and the set this binary DOES serve.
wired MVP_FORMAT_NOT_COMPILED = ("mvp", 1, "repository declares a format this build did not compile (its fmt-* feature is off)", "server/lib/src/repository.rs");
// ── twin — the FOLLOWER role (plan §3 W9, stinky 02 §4.1/§6 S2-3) ────────
// A twin is the SAME BINARY and the SAME CONFIG as its primary — that is
// deliberate and `private-holger-ops/estate.toml` refuses any drift. What
// was missing until 2026-09-21 is the ROLE: nothing made a twin refuse
// writes, nothing kept its doors off the public interface, and nothing made
// it follow. Installed, it was a second EMPTY primary with public-shaped
// doors closed only by a firewall rule.
//
// gunnar's scar is why these are refusals and not log lines: its metered
// appliance had an un-metered twin, and a promotion would have stopped
// enforcing entitlements with nothing said out loud.
/// A write or admin mutation reached a box whose declared `role` is `Twin`.
/// The refusal NAMES the primary, so the operator is told where to write
/// rather than being told "no".
wired TWIN_REFUSES_WRITES = ("twin", 1, "this server is a twin and accepts no writes — write to the primary it follows", "server/lib/src/grpc.rs");
/// The twin's SERVABLE free space is below what the primary has already
/// used, so a promotion could not hold the data. **A warning, never a
/// refusal** — reported on the health surface by name so the shortfall is
/// visible before the promotion, not discovered during it.
wired TWIN_STORE_TOO_SMALL = ("twin", 2, "the twin has less available space than the primary has used — a promotion could not hold the data", "server/lib/src/twin.rs");
/// The primary's data root holds something the estate replication does not
/// name, so the twin will not hold it. **A warning, never a refusal**: an
/// incomplete twin is still a restore source, and the alternative to saying
/// this out loud is a report that says `complete` while the artifact store
/// stays on the machine that died.
wired TWIN_ESTATE_INCOMPLETE = ("twin", 3, "the primary's data root holds items the twin's replication does not cover", "server/lib/src/replication.rs");
/// A second election. The role is a BOOTSTRAP fact, recorded once and never
/// re-evaluated (owner ruling 2026-09-21: *"IT must not CHANGE role later!
/// so its a bootstrap thing from xtask"*), so a box that already holds a
/// role record refuses to be told a different one. A REFUSAL, not a warning:
/// a primary silently demoted to a twin stops accepting the writes its
/// clients are making.
wired TWIN_ROLE_ALREADY_ELECTED = ("twin", 4, "this box has already been elected a role and a role is never re-evaluated", "server/lib/src/twin.rs");
/// `BecomeTwin` reached a box that is not FRESH. Electing a twin is only
/// safe on a box that holds nothing: a box with artifacts, evidence or
/// audit of its own would have that history disappear behind a follower's
/// refusals, and its clients' writes would start being refused by name.
wired TWIN_BOX_NOT_FRESH = ("twin", 5, "only a FRESH box may be elected a twin — this one already holds state", "server/lib/src/twin.rs");
/// The recorded role and a role parameter in the environment disagree. Both
/// are declarations of what this box IS, and guessing between them is how a
/// box comes up in the role nobody intended. RETIRED (stinky SB #36): no
/// role parameter is read any more — every one is refused by `holger-twin-21`.
reserved TWIN_ROLE_CONFLICT = ("twin", 6, "the recorded role and the environment's role parameter disagree", "server/lib/src/twin.rs");
// ── twin over mutual TLS (stinky 14 §P3, 2026-09-27) ────────────────────
// The twin follows over the primary's OWN issuer (nordisk-twin), certified
// once by the front and pinned — never the installer CA, never a bearer.
// Every refusal of that lane is one of these, raised in `twin_tls.rs` and, since H2's
// estate cut, its `estate` half `twin_tls/mtls.rs` (the off half raises 7 and 14 too).
/// `IssueTwinCertificate` reached a box that serves no replication door: a
/// certificate for a door that does not exist is a pairing that looks
/// complete and follows nothing.
wired TWIN_NO_REPLICATION_DOOR = ("twin", 7, "this box serves no replication door, so it certifies no reader for one", "server/lib/src/twin_tls/mtls.rs");
/// A certificate asked for a principal this box does not certify: `holger-twin`
/// only from a PRIMARY (a twin certifies no twin), `holger-recharge` from any
/// box with a door, nothing else; or a request whose own CN is another name.
wired TWIN_PRINCIPAL_REFUSED = ("twin", 8, "this box does not certify that principal for its replication door", "server/lib/src/twin_tls/mtls.rs");
/// `InstallTwinCertificate`: no key was minted here, or the certificate is for
/// ANOTHER key — it could never complete a handshake on this box.
wired TWIN_CERT_WRONG_KEY = ("twin", 9, "the replication certificate is not for the key this box minted", "server/lib/src/twin_tls/mtls.rs");
/// `InstallTwinCertificate`: the CA handed with the certificate did not sign it
/// for client authentication now (another CA, expired, not clientAuth).
wired TWIN_CERT_NOT_FROM_CA = ("twin", 10, "the replication certificate does not chain to the CA handed with it", "server/lib/src/twin_tls/mtls.rs");
/// `InstallTwinCertificate` with a DIFFERENT CA than the one this box pins. A
/// twin is never re-pointed; a renewal comes from the same issuer.
wired TWIN_CA_REPOINTED = ("twin", 11, "this box already pins a different replication issuer and is never re-pointed", "server/lib/src/twin_tls/mtls.rs");
/// The replication door refused a handshake: no client certificate, or one
/// its issuer did not sign (another CA, a pairing medium's bootstrap
/// certificate). Named on the door's log and on `GET /-/twin`.
wired TWIN_DOOR_REFUSED = ("twin", 12, "the replication door refused a peer: no client certificate, or not one its issuer signed", "server/lib/src/twin_tls/mtls.rs");
/// A twin with no replication credential whose primary is NOT on loopback:
/// it will not follow in the clear. Plain http + bearer is the loopback
/// (test) road only.
wired TWIN_NOT_CERTIFIED = ("twin", 13, "this box holds no replication credential and will not follow a non-loopback source in the clear", "server/lib/src/twin_tls.rs");
/// A pairing step's input that is not usable: a request that does not verify,
/// a door record that is not IP addresses and a port, a purpose that is not
/// `twin` or `recharge`, a step asked of a box in the wrong role.
wired TWIN_PAIRING_REFUSED = ("twin", 14, "a twin pairing step was refused: its input or this box's role does not fit", "server/lib/src/twin_tls.rs");
/// A box being recharged from its twin (a `recharge_from` not yet whole, or a
/// recharge begun and not finished) serves NOTHING — no read, no write, not
/// on its replication door — until the recharge is whole. Half a box served
/// as whole is the worse fault. Health probes and `/-/twin` still answer.
wired TWIN_AWAITING_RECHARGE = ("twin", 15, "this box is being recharged from its twin and serves nothing until the recharge is whole", "server/lib/src/twin.rs");
/// The recharge lane refused BEFORE a byte moved, one of five ways (gunnar's
/// restore lane, word for word): no twin named; the main is not fresh (a
/// re-image makes it so); the twin holds nothing; the twin cannot give
/// everything back and nobody accepted the loss; `not_fenced` — the twin's old
/// primary may still write and no fence or cloud proof says it cannot (A7 row 4).
wired TWIN_RECHARGE_REFUSED = ("twin", 16, "the recharge was refused before a byte moved: no twin, a main that is not fresh, an empty twin, a twin that cannot give everything back, or a twin whose old primary may still write (not_fenced)", "server/lib/src/recharge_lane.rs");
/// An estate box is WireGuard-only (lane E1): an estate door bound, an estate link
/// dialled, or CA and credential material asked for off the estate's tunnel (`wg0`'s
/// overlay) is refused. The ONE box's door is the one link that leaves the tunnel.
wired TWIN_ESTATE_NOT_WG = ("twin", 17, "an estate link, door or CA material off the estate's WireGuard tunnel was refused", "server/lib/src/tunnel_addr.rs");
/// A replication link whose certificate has ENDED (lane E2): the front renews the
/// twin's certificate at two thirds of its life and the door renews its own, so an
/// ended one means the renewal failed for a third of the lifetime. The dial is refused
/// by name before a byte moves, and the box's health words say `expired`.
wired TWIN_CERT_EXPIRED = ("twin", 18, "the replication certificate has ended and was not renewed in time", "server/lib/src/twin_tls/mtls.rs");
/// `EstateService.Fetch` named an estate path this box does not hold, or one it
/// could not read. The IO detail stays in the server log.
wired TWIN_ESTATE_FILE_UNKNOWN = ("twin", 19, "the estate file is not held here, or it could not be read", "server/lib/src/grpc/estate.rs");
/// A TWIN runs no job and admits none (stinky SB #34): it only follows its
/// primary. Its job queue starts no worker, a job asked of it is refused by
/// name, and a primary elected a twin live stands its workers down.
wired TWIN_RUNS_NO_JOBS = ("twin", 20, "this box is a twin: it runs no job and admits none, it only follows its primary", "server/lib/src/jobs.rs");
/// A role named by the ENVIRONMENT (`HOLGER_ROLE`, `HOLGER_PRIMARY`,
/// `HOLGER_TWIN_POLL_SECONDS`) or the CONFIG (`role:`) — refused at boot by
/// name (stinky SB #36): a box's role comes only from the pairing's election,
/// recorded once in `holger-role.ron`.
wired TWIN_ROLE_NOT_FROM_PAIRING = ("twin", 21, "a role was named by the environment or the config; a role comes only from the pairing's election", "server/lib/src/twin.rs");
/// A retention reclaim WAITS for the twin (stinky SB #35): an artifact the
/// twin has not yet followed is not dropped on the primary, because the twin
/// is the copy a dead main is rebuilt from. Said on every skipped row.
wired TWIN_NOT_FOLLOWED = ("twin", 22, "the reclaim waits: the twin has not yet followed what it would drop", "server/lib/src/lib.rs");
// ── peer: a downstream holger paired with an upstream holger ─────────────
//
// A pairing is a record made ONCE, like the twin's role: the upstream names
// the downstream and pins its client certificate, the downstream names the
// upstream and pins its server certificate. See `server/lib/src/peers.rs`.
/// A second pairing under a name that is already paired. A pairing is made
/// once and never overwritten; un-pairing is removing the record by hand.
wired PEER_ALREADY_PAIRED = ("peer", 1, "this peer is already paired — a pairing is made once and never overwritten", "server/lib/src/peers.rs");
/// A paired downstream asked for a repository its pairing does not list.
/// The pairing says what it may pull; the rest is refused by name.
wired PEER_REPO_NOT_PAIRED = ("peer", 2, "this paired downstream is not paired for that repository", "server/lib/src/grpc.rs");
/// The paired upstream presented a DIFFERENT certificate than the one pinned
/// at pairing. The mirror refuses the cycle: pulling from a box that is not
/// the one it paired with is the thing the pin exists to stop.
wired PEER_KEY_MISMATCH = ("peer", 3, "the paired upstream presented a different key than the one pinned at pairing", "server/lib/src/mirror_cycle.rs");
/// A sync report (`holger.grow.v1.DownstreamReport`) from a caller whose
/// client certificate matches no paired downstream. Only a paired key may
/// say how far it has synced; anybody else is refused by name.
wired PEER_NOT_PAIRED = ("peer", 4, "this caller presented no paired downstream certificate, so it may not report a sync point", "server/lib/src/peers.rs");
/// A RE-PAIR (lane E2: a peer that lost its key pins its new certificate) under a
/// name that was never paired. A re-pair replaces a known peer's pin; a first pairing
/// is `pair`, so an unknown name is refused by name, never paired by the back door.
wired PEER_NOT_KNOWN = ("peer", 5, "a re-pair names a peer that was never paired", "server/lib/src/peers.rs");
// ── grow — the data set grows WITHOUT a restart (server/lib/src/grow.rs) ──
//
// edda `appliance-grow`'s phase machine (gunnar's, moved AS IS) behind
// `holger.grow.v1.GrowService`. While it drains, holger's ONE write hold
// refuses every upload by name — every door and every slow path, because
// every backend is wrapped once at wiring — and while the set is off the
// repositories refuse reads too. Refusals, never queues: the caller
// retries after the growth (D7).
/// An upload (or any mutation) arrived while the data set is being grown.
/// UNAVAILABLE / 503 + Retry-After: the growth takes minutes, not a restart.
wired GROW_WRITES_HELD = ("grow", 1, "uploads are held while holger grows its storage — try again in a few minutes", "server/lib/src/grow.rs");
/// A read reached a repository while `/data` is unmounted for the growth:
/// its archive is closed and its volume may be detached right now.
wired GROW_STORES_CLOSED = ("grow", 2, "the data set is unmounted for a growth — the repository is back when it is", "server/lib/src/grow.rs");
/// `GrowService.Start` / `Resume` / `Flush` / `TwinReport` refused — the
/// machine names why (no engine, no hot-plug, no journal, a growth already
/// running, a go-ahead that does not verify or was spent, not waiting).
wired GROW_REFUSED = ("grow", 3, "the growth request was refused — the reason is named", "server/lib/src/grow.rs");
// ── scan — the scanner framework and its evidence store (server/lib/src/scanner/) ──
// Every artifact's scan evidence is kept by its SHA-256, append-only and
// audited. A record that could not be stored, audited or signed is a refusal:
// an artifact must never move on as if it had been scanned.
/// The evidence names no lowercase-hex SHA-256 for its artifact.
wired SCAN_DIGEST_UNSAFE = ("scan", 1, "scan evidence names no lowercase-hex SHA-256 for its artifact", "server/lib/src/scanner/store.rs");
/// The evidence store could not be read or written.
wired SCAN_STORE_IO = ("scan", 2, "the scan evidence store failed", "server/lib/src/scanner/store.rs");
/// The audit event for a scan could not be written, so the scan is refused.
wired SCAN_AUDIT_FAILED = ("scan", 3, "the scan could not be audited, so it is refused", "server/lib/src/scanner/store.rs");
/// A stored evidence record's bytes no longer match the hash in its name.
wired SCAN_EVIDENCE_TAMPERED = ("scan", 4, "a stored scan evidence record was changed", "server/lib/src/scanner/store.rs");
/// The evidence could not be signed into an attestation.
wired SCAN_ATTEST_FAILED = ("scan", 5, "the scan evidence could not be signed", "server/lib/src/scanner/store.rs");
// ── airgap — the signed export of the approved set and its verified import
// (server/lib/src/promote/airgap.rs). The export's verdict is COMPUTED from
// the stored evidence; the import re-verifies every hash and attestation.
/// A selected artifact is not AVAILABLE in the production repository.
wired AIRGAP_NOT_AVAILABLE = ("airgap", 1, "the artifact is not AVAILABLE in production, so it is not exported", "server/lib/src/promote/airgap.rs");
/// The artifact has no stored scan evidence.
wired AIRGAP_NO_EVIDENCE = ("airgap", 2, "the artifact has no stored scan evidence, so it is refused from the export", "server/lib/src/promote/airgap.rs");
/// The artifact's stored evidence blocks, or a required scanner reported an error.
wired AIRGAP_EVIDENCE_FAILED = ("airgap", 3, "the artifact's stored evidence does not pass, so it is refused from the export", "server/lib/src/promote/airgap.rs");
/// The artifact's evidence carries no signed attestation.
wired AIRGAP_NOT_ATTESTED = ("airgap", 4, "the artifact's evidence is not signed, so it is refused from the export", "server/lib/src/promote/airgap.rs");
/// The artifact's intake record holds no approval.
wired AIRGAP_NOT_APPROVED = ("airgap", 5, "the artifact's intake record holds no approval, so it is refused from the export", "server/lib/src/promote/airgap.rs");
/// The export would carry nothing.
wired AIRGAP_NOTHING_TO_EXPORT = ("airgap", 6, "there is no AVAILABLE artifact to export", "server/lib/src/promote/airgap.rs");
/// The bundle's export index is missing or does not parse.
wired AIRGAP_INDEX_INVALID = ("airgap", 7, "the bundle's export index is missing or malformed", "server/lib/src/promote/airgap.rs");
/// An exported payload's bytes do not match the hashes the export recorded.
wired AIRGAP_PAYLOAD_MISMATCH = ("airgap", 8, "an imported payload does not match its recorded hash", "server/lib/src/promote/airgap.rs");
/// An evidence attestation in the bundle does not verify against this side's trust.
wired AIRGAP_ATTESTATION_INVALID = ("airgap", 9, "an evidence attestation in the bundle does not verify", "server/lib/src/promote/airgap.rs");
/// The export or the import could not write its audit record, so it is refused.
wired AIRGAP_AUDIT_FAILED = ("airgap", 10, "the airgap export or import could not be audited, so it is refused", "server/lib/src/promote/airgap.rs");
// ── offline — `network: Offline`, the holger that makes no network call
// (server/lib/src/egress.rs).
/// An outbound dial was refused because this holger is offline.
wired OFFLINE_EGRESS_REFUSED = ("offline", 1, "the network call is refused: this holger is offline", "server/lib/src/egress.rs");
/// The config names something that needs the network while declaring offline.
wired OFFLINE_CONFIG_REFUSED = ("offline", 2, "the config needs the network and declares `network: Offline`", "server/lib/src/egress.rs");
/// A remote upstream names no address: holger falls back to no public registry (B2).
wired OFFLINE_NO_UPSTREAM = ("offline", 3, "a remote repository names no upstream address, and holger falls back to none", "server/lib/src/repository.rs");
// ── import — the box's import doors (lane W4, server/lib/src/import_door.rs):
// `AdminService.ImportIntelBundle` / `ImportBundle`, `POST /-/intel/import` /
// `/-/bundle/import`, the `intel.inbox` / `bundle.inbox` jobs, and the CLI
// verbs, which all run the same code.
/// The old `bundle import --repo` wrote a bundle straight into a raw
/// repository's data directory, past the intake chain. It is removed.
wired IMPORT_RAW_BYPASS_REMOVED = ("import", 1, "a bundle import into a raw repository's data directory bypasses intake, so it is refused", "server/lib/src/import_door.rs");
/// A bundle import needs an intake chain to land its artifacts in.
wired IMPORT_NO_INTAKE = ("import", 2, "this server declares no intake chain (`promotion.intake`) to land an imported bundle in", "server/lib/src/import_door.rs");
/// An intel import needs an `intel:` block naming the database.
wired IMPORT_NO_INTEL = ("import", 3, "this server declares no `intel:` block to import an intel bundle into", "server/lib/src/import_door.rs");
/// The import has no trust policy to verify the bundle against.
wired IMPORT_NO_POLICY = ("import", 4, "no trust policy is configured for this import", "server/lib/src/import_door.rs");
/// Verification, the anti-rollback floor or the audit record refused the
/// bundle, and nothing landed.
wired IMPORT_REFUSED = ("import", 5, "the bundle was refused (verification, anti-rollback floor or audit) and nothing landed", "server/lib/src/import_door.rs");
/// The import door could not stage or read the bundle it was handed.
wired IMPORT_STAGING_FAILED = ("import", 6, "the bundle could not be staged for import", "server/lib/src/import_door.rs");
/// `intel.refresh` was asked on a box that may not fetch: `intel.offline: true`,
/// `network: Offline`, or a build without `intel-refresh`. Nothing was dialled.
wired IMPORT_REFRESH_OFF = ("import", 7, "this box does not fetch intel (offline, or a build without the fetcher); nothing was dialled", "server/lib/src/import_door.rs");
/// A feed of the refresh could not be fetched or did not parse; nothing changed.
wired IMPORT_REFRESH_FAILED = ("import", 8, "the intel refresh could not fetch or read its feeds, and the advisory database is unchanged", "server/lib/src/import_door.rs");
/// NCSC gap 2 (lane HOL-CDS, owner 2026-10-30): an absent anti-rollback floor is
/// established only by a first import an admin authorized on the secure side for exactly
/// this vendor, product and sequence (`holger bundle allow-first-import`,
/// `POST /-/bundle/first-import`). None stands, or it names another bundle.
wired IMPORT_FIRST_NOT_AUTHORIZED = ("import", 9, "no admin authorized a first import of this vendor, product and sequence, so an absent floor is not established", "server/lib/src/import_door.rs");
/// The caller's `first_import` flag (`?first_import=true`, a chunk's `first_import`) and the
/// inbox's `FIRST-IMPORT` marker are removed: the first import is an admin's action.
wired IMPORT_FIRST_FLAG_REMOVED = ("import", 10, "a caller's first_import flag or an inbox FIRST-IMPORT marker is refused; the first import is an admin action", "server/lib/src/import_door.rs");
/// The admin's first-import authorization itself is refused: not an admin, a blank vendor
/// or product, sequence 0, a floor that already stands, or its audit record failed.
wired IMPORT_FIRST_GRANT_REFUSED = ("import", 11, "the first-import authorization is refused (not an admin, incomplete, a floor already stands, or unaudited)", "server/lib/src/import_door.rs");
// ── admission — the door's fair-share gate (server/lib/src/admission*.rs) ──
/// The gRPC admission layer refused the call (over this consumer's share, or the
/// door is full). The status carries `retry-after`.
wired ADMISSION_REFUSED = ("admission", 1, "the door admits no more of this work right now; retry after the named seconds", "server/lib/src/admission_grpc.rs");
/// A pull-through fetch is queued: the artifact is being fetched from its upstream.
/// The status carries `retry-after` and the job id.
wired ADMISSION_PULL_QUEUED = ("admission", 2, "the artifact is being fetched from its upstream; retry after the named seconds", "server/lib/src/grpc/services.rs");
// ── migration — MigrationService (server/lib/src/grpc/migration.rs) ──────
/// A progress watcher fell behind the broadcast and lost rows; the stream goes on
/// from the current state.
wired MIGRATION_WATCHER_LAGGED = ("migration", 1, "the progress watcher fell behind and lost rows; it follows from the current state", "server/lib/src/grpc/migration.rs");
// ── account — AccountService, the repositories a person has (server/lib/src/account.rs) ──
/// The name asked for is no repository name.
wired ACCOUNT_NAME_REFUSED = ("account", 1, "the name is no repository name: nothing was made", "server/lib/src/account.rs");
/// The name asked for is taken: served here, or made here before.
wired ACCOUNT_NAME_TAKEN = ("account", 2, "the repository name is taken", "server/lib/src/account.rs");
/// This server makes no repository of the format asked for.
wired ACCOUNT_FORMAT_REFUSED = ("account", 3, "this server makes no repository of that format", "server/lib/src/account.rs");
/// This server makes no repository at run time at all (no data root, no live routes).
wired ACCOUNT_MAKES_NONE = ("account", 4, "this server makes no repository at run time", "server/lib/src/account.rs");
/// A grant was asked by somebody who is neither the repository's owner nor an admin.
wired ACCOUNT_GRANT_NOT_OWNER = ("account", 5, "only the repository's owner or an admin grants on it", "server/lib/src/account.rs");
/// A grant names a repository that is not owner-only here, or a person this server does not know.
wired ACCOUNT_GRANT_UNKNOWN = ("account", 6, "no such owner-only repository or person here", "server/lib/src/account.rs");
/// A grant asks for an access that is not `read`, `write` or `none`.
wired ACCOUNT_GRANT_ACCESS = ("account", 7, "the access is not read, write or none", "server/lib/src/account.rs");
// ── token — repository tokens for package clients (server/lib/src/repo_token.rs, lane P3) ──
/// A repository token that was revoked was presented.
wired TOKEN_REVOKED = ("token", 1, "this repository token was revoked", "server/lib/src/repo_token.rs");
/// A repository token past its expiry was presented.
wired TOKEN_EXPIRED = ("token", 2, "this repository token has expired", "server/lib/src/repo_token.rs");
/// The token's owner holds no enabled passkey any more, so the token is worth nothing.
wired TOKEN_OWNER_GONE = ("token", 3, "the owner of this repository token holds no enabled passkey", "server/lib/src/repo_token.rs");
/// The token was used on a repository it was not minted for.
wired TOKEN_OUT_OF_SCOPE = ("token", 4, "this repository token is not for this repository", "server/lib/src/repo_token.rs");
/// A read-only token was used to write.
wired TOKEN_READ_ONLY = ("token", 5, "this repository token may only read", "server/lib/src/repo_token.rs");
/// Only a person signed in with a passkey mints a repository token.
wired TOKEN_MINT_PERSON = ("token", 6, "a repository token is minted by a person signed in with a passkey", "server/lib/src/repo_token.rs");
/// Minting needs a user-verified login in the last ten minutes.
wired TOKEN_MINT_STEP_UP = ("token", 7, "minting a repository token needs a fresh user-verified login", "server/lib/src/repo_token.rs");
/// The token would grant more than its owner holds on a repository.
wired TOKEN_MINT_BEYOND_OWNER = ("token", 8, "a repository token cannot grant more than its owner holds", "server/lib/src/repo_token.rs");
/// The mint request is not valid (no repository, too long a life or label, too many tokens).
wired TOKEN_MINT_INVALID = ("token", 9, "the repository token request is not valid", "server/lib/src/repo_token.rs");
/// No such token, or not one the caller may touch.
wired TOKEN_NOT_FOUND = ("token", 10, "no such repository token", "server/lib/src/repo_token.rs");
/// The token store could not be written.
wired TOKEN_STORE = ("token", 11, "the repository token store could not be written", "server/lib/src/repo_token.rs");
// ── provenance (lane G3a, 2026-10-23): the intake provenance scanner ──────
/// No attestation or signature about these bytes was offered, and the effective
/// policy requires provenance.
wired PROVENANCE_MISSING = ("provenance", 1, "no provenance about these bytes was offered, and the policy requires it", "provenance/src/error.rs");
/// The statement or signature is about other bytes.
wired PROVENANCE_SUBJECT_MISMATCH = ("provenance", 2, "the attestation names other bytes than the artifact's sha256 or sha512", "provenance/src/error.rs");
/// The DSSE or message signature does not verify (a changed byte, a wrong key).
wired PROVENANCE_SIGNATURE_INVALID = ("provenance", 3, "the signature does not verify over the exact signed bytes", "provenance/src/error.rs");
/// The signing key or certificate is not one the trust policy allows.
wired PROVENANCE_SIGNER_UNTRUSTED = ("provenance", 4, "the signer is not an allowed key and does not chain to the pinned Fulcio root", "provenance/src/error.rs");
/// A keyless signer whose OIDC issuer and subject are not an allowed identity.
wired PROVENANCE_IDENTITY_MISMATCH = ("provenance", 5, "the signing certificate's issuer and subject are not an allowed identity", "provenance/src/error.rs");
/// The SLSA builder id is not an allowed builder.
wired PROVENANCE_BUILDER_NOT_ALLOWED = ("provenance", 6, "the SLSA builder is not an allowed builder", "provenance/src/error.rs");
/// The provenance is below the policy's minimum SLSA build level.
wired PROVENANCE_SLSA_LEVEL_TOO_LOW = ("provenance", 7, "the provenance is below the minimum SLSA build level", "provenance/src/error.rs");
/// The transparency-log entry does not verify against the pinned log key.
wired PROVENANCE_TLOG_UNVERIFIED = ("provenance", 8, "the transparency-log entry does not verify against the pinned log", "provenance/src/error.rs");
/// The attestation material cannot be read.
wired PROVENANCE_MALFORMED = ("provenance", 9, "the attestation material cannot be read", "provenance/src/error.rs");
/// The pinned trust root is missing, unreadable or its bundle does not verify.
wired PROVENANCE_TRUST_ROOT = ("provenance", 10, "the pinned Sigstore trust root is missing or does not verify", "provenance/src/error.rs");
/// The provenance policy in the RON cannot mean what it says (a source loosens the floor).
wired PROVENANCE_POLICY_INVALID = ("provenance", 11, "the provenance policy is not valid", "provenance/src/error.rs");
/// The certificate was not valid at the logged signing time.
wired PROVENANCE_CERT_EXPIRED = ("provenance", 12, "the signing certificate was not valid at the logged signing time", "provenance/src/error.rs");
/// `require_signed: true`, and nothing about these bytes is signed.
wired PROVENANCE_UNSIGNED = ("provenance", 13, "nothing signed about these bytes was offered, and the policy requires a signature", "provenance/src/error.rs");
// ── sandbox (lane SANDBOX-SCAN, 2026-10-23): scanning runs in a container ──
/// No container engine answers, so holger refuses to scan (fail closed).
wired SANDBOX_NO_ENGINE = ("sandbox", 1, "no container engine to scan in; holger refuses to scan", "server/sandbox/src/lib.rs");
/// The scan worker ran past its wall clock and was killed.
wired SANDBOX_TIMEOUT = ("sandbox", 2, "the scan worker ran past its wall clock and was killed", "server/sandbox/src/lib.rs");
/// The scan worker was killed by a limit (memory, pids) or crashed.
wired SANDBOX_KILLED = ("sandbox", 3, "the scan worker was killed by its limits", "server/sandbox/src/lib.rs");
/// The scan worker wrote more than the report cap.
wired SANDBOX_REPORT_TOO_LARGE = ("sandbox", 4, "the scan worker's report is larger than its cap", "server/sandbox/src/lib.rs");
/// The scan worker's report does not validate.
wired SANDBOX_REPORT_INVALID = ("sandbox", 5, "the scan worker's report is not valid", "server/sandbox/src/lib.rs");
/// `sandbox: off` in a release build.
wired SANDBOX_OFF_IN_RELEASE = ("sandbox", 6, "`sandbox: off` is allowed only in a test build", "server/sandbox/src/lib.rs");
/// The container engine runs as root.
wired SANDBOX_NOT_ROOTLESS = ("sandbox", 7, "the container engine is not rootless", "server/sandbox/src/lib.rs");
/// The scan worker image is not on this host; it is never pulled.
wired SANDBOX_IMAGE_MISSING = ("sandbox", 8, "the scan worker image is not on this host", "server/sandbox/src/lib.rs");
/// The scan worker exited non-zero without a report.
wired SANDBOX_WORKER_FAILED = ("sandbox", 9, "the scan worker failed without a report", "server/sandbox/src/lib.rs");
/// The sandbox config cannot mean what it says.
wired SANDBOX_CONFIG = ("sandbox", 10, "the sandbox config is not valid", "server/sandbox/src/lib.rs");
/// The scan job could not be written.
wired SANDBOX_IO = ("sandbox", 11, "the scan job could not be prepared", "server/sandbox/src/lib.rs");
/// clamd in its own sandbox did not come up or stopped answering (lane HOLGER-MEDIA): the scans stay refused.
wired SANDBOX_CLAMD_DOWN = ("sandbox", 12, "clamd in its sandbox is not answering; holger refuses to scan", "server/sandbox/src/lib.rs");
/// The scan sidecar has no pids limit and no delegated cgroup, in a release build (RA5-27): the scans stay refused.
wired SANDBOX_NO_PIDS_LIMIT = ("sandbox", 13, "nothing bounds a scan job's processes; holger refuses to scan", "server/sandbox/src/lib.rs");
/// The laid sandbox differs from the medium's manifest (re-hashed at every start, lane HOL-NCSC): laid again, or the scans stay refused.
wired SANDBOX_ROOTFS_DRIFT = ("sandbox", 14, "the laid sandbox differs from the medium; holger refuses to scan", "server/sandbox/src/lib.rs");
/// A real build's `clamav:` names a TCP clamd, a host clamd, `clamscan` or no socket (lane HOL-NCSC): only the sandboxed clamd's unix socket.
wired SANDBOX_CLAMD_NOT_SANDBOXED = ("sandbox", 15, "a real build talks to ClamAV only over the sandboxed clamd's unix socket", "server/sandbox/src/lib.rs");
// The job runner behind the Heimdall job API (lane HOL-SANDBOX-TRAIT, jobs/runner).
/// The job wrote an output it did not declare, or one that is not a regular file.
wired SANDBOX_JOB_UNDECLARED = ("sandbox", 16, "the job wrote an output it did not declare, or one that is not a regular file", "jobs/runner/src/collect.rs");
/// The job's answer is missing or not valid, or it names an output the job did not write.
wired SANDBOX_JOB_ANSWER_INVALID = ("sandbox", 17, "the job's answer is missing or not valid", "jobs/runner/src/collect.rs");
/// The job's signed result is not believed: another key, a changed result, or a result for another job.
wired SANDBOX_JOB_RESULT_REFUSED = ("sandbox", 18, "the job's signed result is not believed (another key, a changed result, or a result for another job)", "jobs/runner/src/accept.rs");
/// The job's outputs are not the ones its signed result lists.
wired SANDBOX_JOB_OUTPUTS_INVALID = ("sandbox", 19, "the job's outputs are not the ones its signed result lists", "jobs/runner/src/accept.rs");
/// The job runner could not run the job at all (no engine, a job it does not run, its files).
wired SANDBOX_JOB_RUN_FAILED = ("sandbox", 20, "the job runner could not run the job", "server/lib/src/job_runner/mod.rs");
// ── sync — the sync protocol between an upstream and its downstreams (Holger v2.0 H4) ──
// `holger_sync::SyncError::number` is the n of codes 1..7; the server adds 8..10.
/// The sync document is not one, or contradicts itself.
wired SYNC_MALFORMED = ("sync", 1, "the sync document is malformed", "server/lib/src/sync.rs");
/// The signer is not in this side's trust list with that key.
wired SYNC_UNTRUSTED_SIGNER = ("sync", 2, "the sync document's signer is not trusted here", "server/lib/src/sync.rs");
/// The signature does not verify over the document.
wired SYNC_BAD_SIGNATURE = ("sync", 3, "the sync document's signature does not verify", "server/lib/src/sync.rs");
/// A manifest older than the generation already applied.
wired SYNC_ROLLBACK = ("sync", 4, "the sync manifest is older than the generation applied here (a rollback)", "server/lib/src/sync.rs");
/// An ack from a downstream this upstream has not enrolled.
wired SYNC_UNKNOWN_DOWNSTREAM = ("sync", 5, "the ack comes from a downstream this upstream has not enrolled", "server/lib/src/sync.rs");
/// An ack for a generation this upstream never issued.
wired SYNC_FUTURE_GENERATION = ("sync", 6, "the ack names a generation this upstream never issued", "server/lib/src/sync.rs");
/// The sync state or key could not be read or written.
wired SYNC_STATE = ("sync", 7, "the sync state could not be kept", "server/lib/src/sync.rs");
/// This server declares no `sync` block, or not the role the request needs.
wired SYNC_NOT_CONFIGURED = ("sync", 8, "this server does not take part in sync in that role", "server/lib/src/sync.rs");
/// The audit record could not be written, so nothing was applied or recorded.
wired SYNC_AUDIT_FAILED = ("sync", 9, "the sync's audit record could not be written, so nothing changed", "server/lib/src/sync.rs");
/// The upstream could not be reached or answered with a refusal.
wired SYNC_LINK = ("sync", 10, "the upstream could not be reached for the sync", "server/lib/src/sync.rs");
/// A downstream verb refused (lane HOL-WGDS): not a live downstream, enrolled twice, an
/// invite for a `via: Front` one, a bad `via`, a record that cannot be read.
wired SYNC_DOWNSTREAM_REFUSED = ("sync", 11, "the downstream verb is refused: not a live downstream, enrolled twice, or not a WireGuard downstream", "server/lib/src/sync/downstreams.rs");
// ── downstream (Holger v2.0 H3, 2026-10-25): the on-prem gateway, `--features downstream` ──
/// The config asks a downstream for more than its one upstream Holger (an internet
/// source, a second upstream, a twin, an online intel feed, a scanner).
wired DOWNSTREAM_CONFIG_REFUSED = ("downstream", 1, "the config asks a downstream for more than its one upstream Holger", "server/downstream/src/lib.rs");
/// An outbound dial to anything but the downstream's upstream.
wired DOWNSTREAM_EGRESS_REFUSED = ("downstream", 2, "the network call is refused: a downstream dials only its upstream Holger", "server/lib/src/egress.rs");
/// An upload into a downstream: it runs no scanner, so it takes packages only from its upstream.
wired DOWNSTREAM_NO_UPLOAD = ("downstream", 3, "a downstream takes no upload; its packages arrive from its upstream, verified", "server/lib/src/promote/intake.rs");
/// A package the upstream has not sent: a downstream never fetches one itself.
wired DOWNSTREAM_NOT_SENT = ("downstream", 4, "the package is not on this downstream; its upstream has not sent it", "server/lib/src/pull_intake/mod.rs");
/// A `downstreams:` entry that is not one (lane HOL-WGDS): a bad name, a name twice, a
/// `via: Wireguard(key: ..)` that is not a WireGuard public key, one key for two downstreams.
wired DOWNSTREAM_VIA_REFUSED = ("downstream", 5, "a `downstreams:` entry is refused: a bad name, a name twice, or a WireGuard key that is not one", "server/downstream/src/via.rs");
// ── depset — a pull's dependency closure, approved as one set (lane HOL-DEPSET-APPROVE) ──
/// No dependency set has that id.
wired DEPSET_UNKNOWN = ("depset", 1, "no dependency set has that id", "server/lib/src/pull_intake/depset.rs");
/// A member of the set carries a refusal reason (a CVE, malware, a licence, provenance):
/// the set is refused as a whole and the member is named.
wired DEPSET_REFUSED = ("depset", 2, "a member of the dependency set is refused, so the set is", "server/lib/src/pull_intake/depset.rs");
/// A member could not be resolved or scanned yet, or the set is still resolving: the set
/// is held (fail closed) and nothing in it is approved.
wired DEPSET_HELD = ("depset", 3, "the dependency set is held: a member is not resolved or not scanned", "server/lib/src/pull_intake/depset.rs");
/// SEC-REVIEW 2026-11-01 D4: a set vote names no revision, or another than the set has now
/// (a re-pull changed its members since the approver read it): nothing is cast.
wired DEPSET_STALE = ("depset", 4, "the dependency set changed since it was read: the vote names another revision", "server/lib/src/pull_intake/depset.rs");
// ── boundary — a downstream's one-way boundary (lane HOL-CDS, owner 2026-10-30) ──
/// `boundary: OneWay` (the default): packages come in only through the inbox, so a
/// `mirror:` block, an `export:` door, a sync receipt or any outbound target refuses the
/// start, each by its line.
wired BOUNDARY_ONE_WAY_REFUSED = ("boundary", 1, "this Holger is one-way: the config names a way out (mirror, export door, sync receipt or outbound target)", "server/lib/src/boundary.rs");
/// `boundary: Fetch` in a build without the `fetch` feature.
wired BOUNDARY_FETCH_NOT_BUILT = ("boundary", 2, "`boundary: Fetch` needs a build with the `fetch` feature", "server/lib/src/boundary.rs");
/// `domain:` is not a label: blank, longer than 64, or a character a header cannot carry.
wired BOUNDARY_DOMAIN_INVALID = ("boundary", 3, "the `domain:` label is not one (1 to 64 printable characters, no control characters)", "server/lib/src/boundary.rs");
// ── export — the upstream's push into the diode folder (lane HOL-CDS) ──
/// `export: (push_to: .., every: ..)` is not one: no folder, an interval that does not
/// read, or no intake chain to export from.
wired EXPORT_PUSH_CONFIG_REFUSED = ("export", 1, "the `export:` block is refused: no push_to folder, an unreadable interval, or no intake chain", "server/lib/src/export_push.rs");
/// One push could not build, sign or write its bundle; nothing was written to push_to.
wired EXPORT_PUSH_FAILED = ("export", 2, "the push could not build, sign or write its bundle, and push_to is unchanged", "server/lib/src/export_push.rs");
// ── listen — the listeners' safe defaults (lane HOL-NCSC, NCSC P1, owner 2026-10-30) ──
/// A listener off loopback on a config with no authentication method.
wired LISTEN_NO_AUTH = ("listen", 1, "a listener that is not loopback needs an authentication method", "server/lib/src/lib.rs");
/// A listener off loopback without TLS and without the endpoint's `insecure: true`.
wired LISTEN_CLEARTEXT = ("listen", 2, "a listener that is not loopback needs TLS, or the endpoint's explicit `insecure: true`", "server/lib/src/lib.rs");
/// A door asked on the listener of the other plane (lane HOL-NCSC, the admin listener).
wired LISTEN_WRONG_PLANE = ("listen", 3, "this door is served on the endpoint's other listener (the data or the admin plane)", "server/lib/src/listen.rs");
/// A peer outside the admin listener's allow-list.
wired LISTEN_PEER_REFUSED = ("listen", 4, "the peer is not in the admin listener's allow-list, so the connection was dropped", "server/lib/src/listen.rs");
/// An admin listener with no allow-list, or a bad one.
wired LISTEN_ADMIN_REFUSED = ("listen", 5, "an admin listener needs a good `ron_admin_allow` (CIDRs)", "server/lib/src/lib.rs");
/// An endpoint's `ron_trusted_proxies` entry that is not a CIDR (HOL-DOCFIND a): the
/// peers whose `X-Forwarded-Proto`/`X-Forwarded-Host` name the public face of a link.
wired LISTEN_TRUSTED_PROXIES_REFUSED = ("listen", 6, "an endpoint's `ron_trusted_proxies` is not a list of CIDRs", "server/lib/src/lib.rs");
// ── tls — the doors' TLS material (lane HOL-NCSC, NCSC P3) ──
/// A client-certificate CRL (`ron_tls.crl`) that cannot be read, is not a CRL, is not issued
/// and signed by the client CA, or has expired (its nextUpdate passed).
wired TLS_CRL_REFUSED = ("tls", 1, "the client certificates' CRL is refused: unreadable, not a CRL, not signed by the client CA, or expired", "server/lib/src/exposed/tls.rs");
// ── sigs — scanner signatures as a signed bundle (lane HOL-NCSC, NCSC P2/P3) ──
/// A `holger.scanner-sigs/v1` member that is no signature file (not under `clamav/` or
/// `yara/`, a path, or an extension the engine does not read): the whole bundle is refused.
wired SIGS_MEMBER_REFUSED = ("sigs", 1, "the signature bundle carries a member that is no signature file", "server/lib/src/import_door.rs");
/// The verified signature files could not be written into the database.
wired SIGS_INSTALL_FAILED = ("sigs", 2, "the signature files could not be installed", "server/lib/src/import_door.rs");
/// A signature bundle on a build that carries no scanners.
wired SIGS_NOT_BUILT = ("sigs", 3, "this build carries no scanners, so it takes no signature bundle", "server/lib/src/import_door.rs");
// ── trust — the estate's Sigstore trust root (server/lib/src/sigstore_trust.rs, lane HOL-OCI-EVIDENCE) ──
/// The fetched `trusted_root.json` is not the pinned public-good root, or no trust root.
wired TRUST_ROOT_NOT_PINNED = ("trust", 1, "the Sigstore trusted root is not the pinned one", "server/lib/src/sigstore_trust.rs");
/// The medium's trust root (or an imported refresh) could not be seeded or installed.
wired TRUST_ROOT_SEED_REFUSED = ("trust", 2, "the Sigstore trust root could not be seeded or installed", "server/lib/src/sigstore_trust.rs");
/// An imported trust root is installed, and the provenance scanner could not read it.
wired TRUST_ROOT_RELOAD_FAILED = ("trust", 3, "the imported Sigstore trust root could not be read by the scanners", "server/lib/src/import_door.rs");
// ── time — the monotone time floor and the signed time token (lane HOL-NCSC, NCSC P3) ──
/// The clock reads behind the time floor by more than the tolerance (a rollback): judged
/// at the floor, said and audited. A warning, not a refusal.
wired TIME_BEHIND_FLOOR = ("time", 1, "the clock reads behind the time floor; the box judges at the floor", "server/lib/src/time_floor.rs");
/// A `holger.time-token/v1` bundle that verified but says no time it can stand behind.
wired TIME_TOKEN_REFUSED = ("time", 2, "the time token is refused: not a token, no time, or a time that is not its signed created_at", "server/lib/src/time_floor.rs");
/// The floor file is there and cannot be read or written.
wired TIME_FLOOR_UNREADABLE = ("time", 3, "the time floor cannot be read or kept, and a floor that cannot be read is not zero", "server/lib/src/time_floor.rs");
// ── key — a private key file is the process's alone (lane HOL-NCSC, NCSC P3) ──
/// A key or secret file whose mode grants its group or others any bit, or that another
/// user owns (a Kubernetes secret volume, root:fsGroup 0440, is the one other shape).
wired KEY_FILE_EXPOSED = ("key", 1, "a private key file is readable by its group or others, or owned by another user", "server/lib/src/keyfile.rs");
/// The hardware-token signer is refused: no `pkcs11` build, a module that does not load,
/// no token or key by that label, a PIN the token refuses, or both a file key and a token.
wired KEY_HSM_REFUSED = ("key", 2, "the hardware-token (PKCS#11) signer is refused", "server/lib/src/lib.rs");
// ── fetch — a chain Holger's way out to a source, as Heimdall jobs (lane cds4, HOL-CDS-4) ──
/// A URL on a host the source's RON does not declare: refused before any job, nothing dialled.
wired FETCH_UNDECLARED_HOST = ("fetch", 1, "the host is not declared by the source; nothing is fetched or dialled", "server/lib/src/job_runner/fetch.rs");
/// A redirect to a host the source does not declare: never followed, never dialled.
wired FETCH_REDIRECT_UNDECLARED = ("fetch", 2, "a redirect to a host the source does not declare is not followed", "server/lib/src/job_runner/fetch.rs");
/// A declared host does not resolve.
wired FETCH_RESOLVE_FAILED = ("fetch", 3, "a declared host of the source does not resolve", "server/lib/src/job_runner/fetch.rs");
/// More redirects than one fetch follows.
wired FETCH_TOO_MANY_REDIRECTS = ("fetch", 4, "the fetch was redirected too many times", "server/lib/src/job_runner/fetch.rs");
/// The fetch job refused the exchange (TLS, the certificate's name, the answer).
wired FETCH_JOB_REFUSED = ("fetch", 5, "the fetch job refused the exchange (TLS, the certificate, the answer)", "server/fetch-worker/src/lib.rs");
/// An http:// URL on a TLS source, or a redirect from https to http: no plaintext job starts.
wired FETCH_SCHEME_REFUSED = ("fetch", 6, "plain HTTP is refused: the source is fetched over https only, and https never redirects to http", "server/lib/src/job_runner/fetch.rs");
/// A declared name resolved only to internal addresses, and the source declares no internal upstream.
wired FETCH_ADDRESS_REFUSED = ("fetch", 7, "a declared host resolved to an internal address, and the source declares no internal upstream", "server/lib/src/job_runner/fetch.rs");
/// A `plaintext` or `internal` fetch source on a box whose policy requires a scan, without
/// `signed_provenance: true`; or a fetch source that does not read.
wired FETCH_SOURCE_REFUSED = ("fetch", 8, "the fetch source is refused: plaintext or internal where a scan is required needs signed provenance", "server/lib/src/lib.rs");
}
/// Recover the [`ErrCode`] from any message [`ErrCode::tag`] produced — a log line,
/// an HTTP body, an audit row, or one of those with a mount prefix prepended.
///
/// Matching is on the **bracketed** form `[holger-sub-n]`, so `holger-update-1` can
/// never be mistaken for `holger-update-10`.
///
/// This is what tests assert on — never a substring of the human prose.
pub fn parse(msg: &str) -> Option<&'static ErrCode> {
ALL.iter().find(|c| msg.contains(&format!("[{}]", c.code)))
}
/// Look a code up by its exact wire string (`"holger-update-22"`).
pub fn by_code(code: &str) -> Option<&'static ErrCode> {
ALL.iter().find(|c| c.code == code)
}
/// The HTTP header / gRPC metadata key the code rides in, in ADDITION to being
/// inside the message.
pub const WIRE_CODE_KEY: &str = "x-holger-code";
/// How many rows claim [`Wiring::Wired`] — codes holger raises TODAY.
///
/// This is the honest coverage numerator. It is a CLAIM until
/// `errcode/tests/wiring_guard.rs` checks each row against the real source tree; read the
/// two numbers together, never this one alone.
pub fn wired_count() -> usize {
ALL.iter().filter(|c| c.wiring == Wiring::Wired).count()
}
/// How many rows are [`Wiring::Reserved`] — numbers claimed and frozen, sites not coded.
pub fn reserved_count() -> usize {
ALL.iter().filter(|c| c.wiring == Wiring::Reserved).count()
}
#[cfg(test)]
mod tests {
use super::*;
extern crate std;
use std::collections::HashSet;
use std::format;
/// THE gate. Every code must be unique GLOBALLY, and `(subsystem, n)` unique
/// within its subsystem. A copy-pasted duplicate — the one mistake that breaks
/// a frozen registry — FAILS here, naming the offender.
#[test]
fn codes_are_unique() {
let mut seen_code: HashSet<&str> = HashSet::new();
let mut seen_pair: HashSet<(&str, u16)> = HashSet::new();
for c in ALL {
assert!(
seen_code.insert(c.code),
"DUPLICATE error code `{}` — codes are FROZEN and append-only; \
pick the next free n in subsystem `{}`",
c.code,
c.subsystem,
);
assert!(
seen_pair.insert((c.subsystem, c.n)),
"DUPLICATE (subsystem, n) = ({}, {}) for code `{}`",
c.subsystem,
c.n,
c.code,
);
}
assert!(!ALL.is_empty(), "the registry must not be empty");
}
/// The code string must be exactly `holger-<subsystem>-<n>` — the shape every
/// suite consumer parses. Guards a hand-edited const.
#[test]
fn code_strings_match_their_parts() {
for c in ALL {
assert_eq!(
c.code,
format!("holger-{}-{}", c.subsystem, c.n),
"code string drifted from its (subsystem, n)"
);
assert!(!c.summary.is_empty(), "{} has no human summary", c.code);
assert!(c.n > 0, "{} — ordinals start at 1", c.code);
}
}
/// The DUAL CHANNEL contract: the rendered message carries the human string AND
/// the code, and the code survives a round-trip through [`parse`].
#[test]
fn tag_carries_both_channels_and_round_trips() {
let msg = UPDATE_SEQUENCE_ROLLBACK.tag("sequence rollback 7 < 9");
assert!(msg.contains("7 < 9"), "{msg}"); // human channel + operand
assert_eq!(parse(&msg), Some(&UPDATE_SEQUENCE_ROLLBACK)); // machine channel
assert_eq!(
parse(&UPDATE_SEQUENCE_ROLLBACK.bare()),
Some(&UPDATE_SEQUENCE_ROLLBACK)
);
}
/// A consumer may PREPEND a mount prefix; the code must still parse out.
#[test]
fn parse_survives_a_consumer_mount_prefix() {
let msg = format!(
"holger-server-ui/update-pane: {}",
UPDATE_EXPIRED.tag("expired 2026-01-01")
);
assert_eq!(parse(&msg), Some(&UPDATE_EXPIRED));
}
/// `holger-update-1` must never be recovered from a `holger-update-10` message —
/// the bracketed form is what makes the registry safely extensible past 9.
#[test]
fn parse_does_not_confuse_prefix_codes() {
let msg = UPDATE_RELEASE_SIGNATURE_MISSING.tag("no release signature"); // -10
assert_eq!(parse(&msg), Some(&UPDATE_RELEASE_SIGNATURE_MISSING));
assert_ne!(parse(&msg), Some(&UPDATE_SCHEMA_UNSUPPORTED)); // -1
}
/// An uncoded message yields None — so a test asserting "this path is coded"
/// genuinely fails when the code is dropped.
#[test]
fn uncoded_messages_do_not_parse() {
assert_eq!(parse("signature invalid"), None);
assert_eq!(by_code("holger-update-999"), None);
}
/// Every row declares a NON-EMPTY `src_file`, and the wired/reserved split is
/// EXHAUSTIVE — no row escapes the wiring claim. (Whether the claim is TRUE is
/// `errcode/tests/wiring_guard.rs`'s job; this only proves the claim exists.)
#[test]
fn every_row_makes_a_wiring_claim_against_a_named_file() {
for c in ALL {
assert!(
!c.src_file.is_empty(),
"{} declares no src_file — the wiring guard has nothing to check it against",
c.code,
);
assert!(
c.src_file.ends_with(".rs"),
"{} src_file {:?} is not a Rust source path",
c.code,
c.src_file,
);
}
assert_eq!(
wired_count() + reserved_count(),
ALL.len(),
"every code is either wired or reserved — {} wired + {} reserved != {} rows",
wired_count(),
reserved_count(),
ALL.len(),
);
assert!(
wired_count() > 0,
"a registry that wires nothing is decoration"
);
}
}