Stop codes – Nextra

Generated by docs/scripts/generate-docs.mjs from operators/INDEX.md. Edit the source, not this page.

Every code an operator may stop with, merged from operators/errors.json (codes several operators share, with a scope list) and each operators/<id>/errors.json. A code has exactly one disposition: terminate ends the branch blocked; fallback performs the named action, records it under ## Fallbacks taken in response.md, and continues. unless names the one Requirements param whose value flips the disposition. domain is the routing.json domain the stop hands to; self is the emitting operator’s own domain, a resume. A runtime meeting an unlisted code terminates with UNKNOWN_STOP.

Code	Scope	Domain	Disposition	Meaning	Fallback	Unless	Resume
`EVIDENCE_MISSING`	`*`	`self`	terminate	A claim about the system has no file, line, or head behind it.	—	—	Add the evidence.
`INVALID_INPUT`	`*`	`caller`	terminate	request.json fails the gate or the operator’s Requirements.	—	—	Correct request.json.
`NO_PROGRESS`	`*`	`caller`	terminate	A resume adds no evidence, constraint, inventory, or approval delta.	—	—	Bring a real delta.
`SOURCE_DRIFT`	`*`	`workspace`	terminate	The observed checkout head differs from the head request.json froze.	—	—	The orchestrator freezes the head again.
`UNKNOWN_STOP`	`*`	`caller`	terminate	The runtime met a code the merged registry does not list.	—	—	Register the code or fix the operator.
`BUSINESS_AUTHORITY_REQUIRED`	`architecture.decide`	`business`	terminate	The published business head the architecture must keep is missing or stale.	—	—	Run business.decide first.
`CHOICE_REQUIRED`	`architecture.decide`	`caller`	fallback	Several alternatives remain material after assessment.	Select the alternative with the highest score across tradeoffAxes; on a tie, the one that changes the fewest stack components; record the score table under ## Decision.	`selectionPolicy` = `approval-required` → terminate	The person supplies approval.
`COMPATIBILITY_UNVERIFIED`	`architecture.decide`	`self`	fallback	A retained stack component has no compatibility evidence on at least one axis.	Mark the component replaced-candidate in the stack delta and list the unverified axes under Handoff as unknown.	—	Add the compatibility evidence.
`CONSTRAINT_CONTRADICTION`	`architecture.decide`	`caller`	terminate	Two fixed-intent constraints cannot both hold.	—	—	A person resolves the constraints.
`CRITIQUE_UNRESOLVED`	`architecture.decide`	`self`	terminate	An attack on the selected alternative has no resolution.	—	—	Resolve the attack or select differently.
`CURRENT_STATE_UNOBSERVED`	`architecture.decide`	`workspace`	terminate	The system today could not be read at the frozen head.	—	—	Fix the route or the checkout.
`DATA_OWNERSHIP_UNASSIGNED`	`architecture.decide`	`self`	terminate	A physical store has no owning boundary.	—	—	Assign the owner.
`NO_VIABLE_ALTERNATIVE`	`architecture.decide`	`caller`	terminate	No alternative survives the frozen constraints, or the only alternative fails an attack.	—	—	Relax a constraint or stop.
`BUSINESS_AUTHORITY_MISSING`	`backend.source.apply`	`business`	terminate	A business question is open and no approved decision settles it.	—	—	Publish the decision and rebind the authority fingerprint.
`CONTRACT_UNFROZEN`	`backend.source.apply`	`contract`	terminate	The mutation contract is not frozen, or its fingerprint is stale.	—	—	Bring the frozen contract.
`CONTRACT_WIDENED`	`backend.source.apply`	`contract`	terminate	The outcome cannot be reached without a boundary the contract does not carry.	—	—	The contract owner reopens and refreezes the contract, then the same outcome is implemented again.
`PATTERN_UNBOUND`	`backend.source.apply`	`backend`	terminate	A touched aspect has no sibling family bound for it.	—	—	Bind the missing pattern; guessing the family from memory is refused.
`PROOF_UNAVAILABLE`	`backend.source.apply`	`platform`	terminate	A declared proof could not be executed in this environment.	—	—	Provide a working proof environment; a proof that could not run never becomes a pass.
`OWNER_CONFLICT`	`backend.source.apply`, `frontend.presentation.resolve`, `frontend.source.apply`	`caller`	terminate	A node that must be mutated lies outside the mutable owner ceiling, or the owner sets overlap.	—	—	Correct the owner authority.
`SESSION_MISSING`	`backend.source.apply`, `frontend.source.apply`, `git.publish`	`caller`	terminate	Source was designed, written or published outside a session: the branch has no step-N/parallel-M under a session folder with state.json and a validated request.json, or the session branch being published carries no done source-application response whose commits contain its head, or a frontend chain with an audit step has no frontend-surface-audit response with its screenshots.	—	—	Create the session first — state.json and step-1/parallel-1/request/request.json, green under validate-request — and run the operators that owe the receipt; a session cannot be reconstructed after the fact.
`AUTHORITY_CONFLICT`	`business.decide`	`workspace`	terminate	The head or the businesses root contradicts published authority.	—	—	Correct the authority binding.
`CONSUMER_UNPROVEN`	`business.decide`	`business`	terminate	A discovered enforcement consumer has no disposition or no proof.	—	—	Dispose the consumer with positive and negative proof, then publish the promise again.
`CONTRADICTION_UNRESOLVED`	`business.decide`	`caller`	terminate	Two claims about the same behaviour disagree and nothing resolves them.	—	—	The owner resolves the contradiction.
`COVERAGE_INCOMPLETE`	`business.decide`	`business`	terminate	A declared coverage dimension carries no disposition.	—	—	Add the missing disposition.
`LIFECYCLE_TRANSITION_INVALID`	`business.decide`	`caller`	terminate	The requested target state is unreachable from the observed head.	—	—	Ask for a legal transition, or publish the intermediate state first.
`RECONCILIATION_DISCREPANCY`	`business.decide`	`backend`	terminate	Delivered source differs from the frozen coverage matrix.	—	—	Correct the source, or revise the matrix.
`APPROVAL_REQUIRED`	`business.decide`, `release.deploy`	`caller`	terminate	The transition or the release needs an approval that no request bound.	—	—	A person supplies the approval.
`<br />IEF_UNBOUND`	`content.generate`	`curriculum`	terminate	The teacher brief cannot be frozen from the bound curriculum and source evidence.	—	—	Supply the missing curriculum or source evidence.
`CODE_BUILD_FAILED`	`content.generate`	`content`	terminate	A declared implementation track does not build.	—	—	Repair the track, then build it again.
`CONTRACT_WEAKENED`	`content.generate`	`content`	terminate	The executable contract moved during the repair loop, so the proof measures nothing.	—	—	Restore the contract and rerun without touching it.
`E2E_FAILED`	`content.generate`	`content`	terminate	A declared executable check still fails when maxE2eIterations is spent.	—	—	Repair the implementation, or approve more iterations.
`IMAGE_UNAVAILABLE`	`content.generate`	`engineering`	terminate	A required image cannot be generated to the brief’s claims.	—	—	Provide a working generator, or turn the image stage off.
`OUTCOME_UNCOVERED`	`content.generate`	`content`	terminate	A declared language edition leaves a published learning outcome uncovered.	—	—	Rewrite the edition, or narrow the brief.
`REVIEW_REVISION_REQUIRED`	`content.generate`	`content`	fallback	The independent review returned a revision.	Repair exactly the artifacts the review’s findings name, by owning stage, record the round under ## Fallbacks taken, and reopen the review exchange for the next round.	—	Nothing is asked of anyone; the branch revises and reviews again until maxReviewRounds is spent.
`REVIEW_ROUNDS_EXHAUSTED`	`content.generate`	`caller`	terminate	maxReviewRounds is spent and the review still returns a revision.	—	—	Approve more rounds, or narrow the unit.
`ARCHITECTURE_REQUIRED`	`frontend.direction.decide`	`architecture`	terminate	The direction changes a system or data boundary nobody decided.	—	—	Run architecture.decide first.
`BACKEND_REQUIRED`	`frontend.direction.decide`	`backend`	terminate	The direction changes a data contract nobody delivered.	—	—	Run backend.source.apply first.
`BUSINESS_REQUIRED`	`frontend.direction.decide`	`business`	terminate	An actor, promise, permission, adverse outcome or recovery truth the change level requires is unresolved.	—	—	Run business.decide first.
`CHANGE_LEVEL_AMBIGUOUS`	`frontend.direction.decide`	`caller`	terminate	The authority for new, reconstruct or refine is unresolved or contradicts the intent.	—	—	State the exact change level.
`DIRECTION_CHOICE_REQUIRED`	`frontend.direction.decide`	`caller`	fallback	Several candidates survive falsification and the scores under ## Scores prove none dominant: the top means are equal, or the top scorer loses a failed criterion to another.	Among the tied top scorers, select the candidate that introduces the fewest new nodes; the scores stay under ## Scores and the pick under ## Decision.	`selectionPolicy` = `approval-required` → terminate	The person supplies approval naming one candidate.
`GRAMMAR_REQUIRED`	`frontend.direction.decide`	`grammar`	terminate	A family component the direction needs is unpublished; a composite is never assembled in its place.	—	—	A person publishes the component, and the same direction runs again.
`NO_VIABLE_DIRECTION`	`frontend.direction.decide`	`caller`	terminate	Every candidate contradicts authority or fails a mandatory attack.	—	—	Change the authority or the constraints; cosmetic variants are not a delta.
`OWNER_CEILING_INVALID`	`frontend.direction.decide`	`caller`	terminate	The direction needs an owner the declared ceiling does not authorize.	—	—	Correct the owner ceiling.
`REFERENCE_EVIDENCE_EXHAUSTED`	`frontend.direction.decide`	`caller`	terminate	Bounded research cannot close the business or interaction question the decision rests on.	—	—	Supply the owning authority or a materially new reference.
`REFERENCE_MISSING`	`frontend.direction.decide`	`self`	terminate	A new or reconstruct direction named no reference standard, so the class the surface is aiming at is unstated and the taste lens cannot judge whether it landed there.	—	—	Name at least one standard by class, with what is borrowed from it, and run the same direction again.
`SCOPE_UNFROZEN`	`frontend.direction.decide`	`caller`	terminate	The target or the boundary of the surface is incomplete, so the UI contract cannot be closed.	—	—	Freeze the scope.
`ROUTE_UNVERIFIED`	`frontend.direction.decide`, `git.publish`	`workspace`	terminate	The project or the routed frontend checkout identity is not verified.	—	—	Bind the route again.
`GRAMMAR_UNPUBLISHED`	`frontend.presentation.resolve`	`grammar`	terminate	The Grammar package is unpublished or the bound fingerprint is stale.	—	—	A person publishes the exact Grammar package.
`KNOWLEDGE_UNBOUND`	`frontend.presentation.resolve`	`knowledge`	terminate	A presentation property is present in the tree and no knowledge topic is bound for it.	—	—	Bind the missing topic.
`RULE_MISSING`	`frontend.presentation.resolve`	`knowledge`	terminate	No published case matches the observed condition on a node.	—	—	The knowledge owner publishes the case, and the tree is resolved again.
`UNKNOWN_RULE`	`frontend.presentation.resolve`, `frontend.surface.audit`	`self`	terminate	An identifier outside the bound rule inventory was reached for.	—	—	Bind the topic that publishes it, or correct the identifier.
`RESOLUTION_STALE`	`frontend.source.apply`	`resolution`	terminate	The resolution actually read differs from the resolution the request bound.	—	—	Bind the current resolution, or resolve the tree again.
`WRITE_REJECTED`	`frontend.source.apply`	`caller`	terminate	A file or a value the write would produce lies outside what was authorized, or the committed tree is not the resolved tree.	—	—	Declare a corrected write set, or publish a resolution that carries the value.
`SURFACE_CLASS_MISSING`	`frontend.surface.audit`	`direction`	terminate	The direction decision declares no surface class, or one outside the vocabulary COVERAGE-1 Case 7 publishes, so every banded proof rule is left without a threshold and no topic can be judged.	—	—	Decide the direction again with a declared surface class, then audit at the same commit.
`IDENTITY_MISSING`	`frontend.surface.audit`, `uat.verify`	`platform`	terminate	The route requires an identity to reach the surface and no account record exists for this flow yet. It is a hand-off and not a verdict: the operator that owns identity provisions the account, and this branch is re-entered with it.	—	—	The identity operator provisions the flow’s account against the registry entry, and this branch runs again with it.
`RUNTIME_UNAVAILABLE`	`frontend.surface.audit`, `uat.verify`	`platform`	terminate	The endpoint does not serve the bound route, or the surface never reaches readiness.	—	—	Whoever runs the service serves the bound route; this operator never starts one.
`APPROVAL_MISSING`	`git.publish`	`caller`	terminate	No approval covers this exact boundary unit; completion proof is not approval.	—	—	Supply an approval issued for this unit.
`DIRTY_OUTSIDE_BOUNDARY`	`git.publish`	`source`	terminate	Something dirty lies outside the declared write roots, so the publish would carry work this boundary does not own.	—	—	Clean the tree, or correct the write roots.
`HOOK_BLOCKED`	`git.publish`	`source`	terminate	A Git hook rejected the publication, and no bypass is representable.	—	—	Fix the boundary and bring a new head.
`NON_FAST_FORWARD`	`git.publish`	`remote`	terminate	The remote carries commits the local ref does not, so the push is not fast-forward.	—	—	The branch owner reconciles the divergence and a new head arrives.
`<br />ANCH_POLICY_VIOLATION`	`git.publish`, `workspace.bind`	`workspace`	terminate	The checkout is on a branch the routed Git policy forbids for this operation.	—	—	Move to a permitted branch or change the routed policy.
`CAPABILITY_MISSING`	`platform.operate`	`caller`	terminate	The capability the service kind requires is absent or names no custody evidence.	—	—	Supply the missing capability handle with its custody.
`EFFECT_UNAUTHORIZED`	`platform.operate`	`caller`	terminate	A required effect lies outside the approved effect set or outside the branch.	—	—	Approve the effect, or bring a narrower plan.
`INTEGRATION_FAILED`	`platform.operate`	`product`	terminate	serve resolved the merge conflict itself and gated the merged head, and a required gate came back red: the merged head does not pass the delivery gates. The receipt names the failing gate and the resolutions that were made.	—	—	A person or the owning session repairs the session branch and asks to serve again; the merge that produced the failing head is never rebased, forced or abandoned to make it apply.
`INVENTORY_DRIFT`	`platform.operate`	`platform`	terminate	A declared resource moved since the inventory was bound, so the plan describes a service that no longer exists.	—	—	Re-observe the inventory; it must arrive with a new fingerprint.
`PORT_CONFLICT`	`platform.operate`	`product`	terminate	A claimed port is already held by another declared process, and holding it is not permission to reclaim it.	—	—	Agree a port, or the holder’s owner releases it.
`PROOF_FAILED`	`platform.operate`	`platform`	terminate	A required check is missing, unreadable, or failed after apply, and an unproved operation is not an operated one.	—	—	Repair the service, then invoke again.
`SERVICE_UNAVAILABLE`	`platform.operate`	`provider`	terminate	The shared service or its provider cannot be reached.	—	—	Restore the provider.
`AUTHORITY_DRIFT`	`platform.operate`, `uat.verify`	`caller`	terminate	The approval — an approval id, or the environment declaration it references, whose content hash has moved — no longer matches what the operation asked for.	—	—	Bring a fresh approval for this exact operation: a new id, or the declaration’s current reference.
`PROVISIONING_UNAVAILABLE`	`platform.operate`, `uat.verify`	`control-panel`	terminate	The identity provider, the sealed credential or the store a UAT identity needs cannot be reached, so the account can be neither created nor used. A record that is merely absent is created; this code is for a dependency that is not there at all.	—	—	Restore the provider, the sealed file or the store; never ask a person to sign in or to paste a credential.
`DEBT_UNAPPROVED`	`quality.verify`	`caller`	terminate	A declared debt has no live owner approval, or it covers a gate that passed or a boundary-drift failure.	—	—	Supply the unexpired owner approval, or drop the debt.
`GATE_UNAVAILABLE`	`quality.verify`	`platform`	terminate	A required gate cannot be executed at all in this environment, and an unmeasurable gate is not a passed one.	—	—	Provide a working gate environment.
`PREDECESSOR_MIXED`	`quality.verify`	`caller`	terminate	Two predecessor receipts describe different source heads, so their union is a delivery nobody built.	—	—	Supply one coherent predecessor set on one head.
`PREDECESSOR_STALE`	`quality.verify`	`caller`	terminate	A predecessor fingerprint no longer matches the frozen source.	—	—	Bring a refreshed upstream receipt.
`ARTIFACT_MISSING`	`release.deploy`	`provider`	terminate	The immutable digest cannot be resolved, and no replacement may be built and called the same release.	—	—	Publish the artifact at that digest.
`AUTHORIZATION_MISSING`	`release.deploy`	`approval`	terminate	No declared grant covers this project, environment, target, or the deploy action, or it had expired when the target was observed.	—	—	Supply the declared authorization, still valid.
`CONCURRENT_DRIFT`	`release.deploy`	`deployment`	terminate	A release that is neither this one nor its predecessor became active during execution.	—	—	Replan against the new observed state.
`CREDENTIAL_UNAVAILABLE`	`release.deploy`	`platform`	terminate	A declared handle cannot be resolved through existing custody.	—	—	Restore the custody; never an inline value.
`DOMAIN_UNRECONCILED`	`release.deploy`	`provider`	terminate	Domain or TLS state cannot be brought to the declaration.	—	—	Fix the provider state, or the provider authority.
`HOST_UNAVAILABLE`	`release.deploy`	`provider`	terminate	The declared host cannot be prepared.	—	—	Provide a reachable, prepared host.
`MANIFEST_INVALID`	`release.deploy`	`caller`	terminate	The validated manifest is pinned to another release, and that substitution is how an unreviewed image reaches a reviewed target.	—	—	Bring a manifest validated against this release.
`MIGRATION_BLOCKED`	`release.deploy`	`backend`	terminate	The declared migration cannot be applied safely.	—	—	Approve a migration boundary the backend owner can apply.
`RECOVERY_EXHAUSTED`	`release.deploy`	`approval`	fallback	The approved reversible actions ran out.	Take the rollback branch: restore rollbackIdentity by its exact digest, never by tag, and record the restored release under ## Fallbacks taken.	—	Grant rollback authority, or approve an unsafe action.
`ROLLBACK_IDENTITY_MISSING`	`release.deploy`	`provider`	terminate	Rollback is required and its exact safe release no longer exists.	—	—	Restore the safe release at its exact digest.
`ROLLOUT_FAILED`	`release.deploy`	`deployment`	fallback	The rollout could not place the release on the target.	Take the recovery branch: apply only the approved reversible actions against the same release identity, one at a time, and record each attempt with its outcome under ## Fallbacks taken.	—	Correct the target or the plan and roll out again.
`STEADY_STATE_UNPROVEN`	`release.deploy`	`deployment`	terminate	The steady window never closed before the bounded deadline, and an assumed rollout is not a deployment.	—	—	Observe a fresh series after the target recovers.
`ADMISSION_MISSING`	`uat.verify`	`quality`	terminate	The surface audit or the quality verification that admits product UAT is absent, or one of them was taken at another commit than the pinned head.	—	—	Re-run the missing admission at the pinned commit.
`CANONICAL_WRITE_DENIED`	`uat.verify`	`backend`	terminate	The flow directory cannot be written and read back under the exclusive lease, or the write would have rewritten an existing run record.	—	—	Restore write authority on the flow directory, or publish under a new runId.
`EVIDENCE_UNAVAILABLE`	`uat.verify`	`runtime`	terminate	A case produced no capture, no screenshot, or no screenshot whose login field could be masked, so a lane has nothing to be judged on.	—	—	Restore the dependency and run the frozen case again under a new runId.
`FIXTURE_VIOLATION`	`uat.verify`	`caller`	terminate	The seed, the run namespace or the cleanup scope could not be satisfied: a seed would have created the outcome under test, or cleanup would have reached outside the namespace.	—	—	Correct the fixture boundary in seed/records.json.
`LEASE_INVALID`	`uat.verify`	`control-panel`	terminate	The exclusive lease on the flow directory is expired, foreign, or bound to another run, generation or origin.	—	—	The orchestrator grants the lease again for this run.
`CHECKOUT_DIRTY`	`workspace.bind`	`source`	terminate	Something is dirty outside the declared write roots, or the checkout carries any dirt at all while sitting on the mutation branch rather than a session/<sessionId> branch: the mutation branch has no in-progress state of its own, so dirt found there is source written with no session to account for it, session-only policy or not.	—	—	Clean the boundary, or declare the write roots that cover it when the checkout is already on a session/<sessionId> branch; on the mutation branch the repair is to open the session and move the change onto its branch, not to declare a write root over it — this operator never stashes.
`ENDPOINT_AUTHORITY_STALE`	`workspace.bind`	`runtime`	terminate	The endpoint binding is not the closed port projection, or its fingerprint is stale.	—	—	Recompute the authority fingerprint at its owner.
`IDENTITY_UNVERIFIED`	`workspace.bind`	`identity`	terminate	The machine identity or its encrypted credential roster is missing or stale.	—	—	Verify the machine identity and seal its roster.
`ROUTE_MISMATCH`	`workspace.bind`	`workspace`	terminate	The hydrated route disagrees with the closed portable route, or belongs to another Source.	—	—	Correct the hydration.
`ROUTE_UNDECLARED`	`workspace.bind`	`workspace`	terminate	No portable declaration names this project and role.	—	—	Declare the route; this operator never repairs one.
`ROUTE_UNHYDRATED`	`workspace.bind`	`workspace`	terminate	The declaration exists but no local route projects it onto this machine.	—	—	Hydrate the route on this machine.
`RUNTIME_BUSY`	`workspace.bind`	`runtime`	terminate	The integration branch of this route is leased by another session while it merges and restarts, so the head this binding needs is not served yet.	—	—	Wait for the holder to release the lease, then bind again: the same endpoint serves the merged head next. The reason names the holding session, the operation it is in and the queue position.
`RUNTIME_NOT_READY`	`workspace.bind`	`runtime`	terminate	The runtime owner registry is missing, stale, or not ready while the caller must consume it.	—	—	Raise one coordination request to the registered owner and wait for a ready generation.

Alias Knowledge