{ "schema_version": "registryctl.operator_error_reference.v1", "entries": [ { "family": "bundle_verification", "code": "rejected_binding", "owner": "registry_platform_ops", "product": "registry_platform_ops", "phase": "bundle_verification", "safe_meaning": "The bundle binding does not match the intended runtime target.", "rule": "registry.platform.bundle_verification.binding_matches_target", "safe_remediation": "Use a bundle issued for the intended runtime binding.", "field_address_pattern": null, "evidence_scope": "signed bundle and configured runtime binding", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose received or configured binding values." }, { "family": "bundle_verification", "code": "rejected_rollback", "owner": "registry_platform_ops", "product": "registry_platform_ops", "phase": "bundle_activation", "safe_meaning": "The bundle or override does not satisfy local anti-rollback requirements.", "rule": "registry.platform.bundle_verification.rollback_constraints_satisfied", "safe_remediation": "Use a monotonic bundle or an authorized break-glass selection.", "field_address_pattern": null, "evidence_scope": "local anti-rollback state and bundle or override metadata", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." }, { "family": "bundle_verification", "code": "rejected_signature", "owner": "registry_platform_ops", "product": "registry_platform_ops", "phase": "bundle_verification", "safe_meaning": "Bundle authenticity or declared content integrity verification failed.", "rule": "registry.platform.bundle_verification.signature_and_integrity_accepted", "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", "field_address_pattern": null, "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." }, { "family": "bundle_verification", "code": "rejected_validation", "owner": "registry_platform_ops", "product": "registry_platform_ops", "phase": "bundle_verification", "safe_meaning": "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported.", "rule": "registry.platform.bundle_verification.input_is_valid", "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", "field_address_pattern": null, "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-validation", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values." }, { "family": "notary_activation", "code": "notary.cel.worker_unavailable", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary CEL worker is unavailable", "rule": "Every configured CEL worker must complete the bounded product protocol probe before listeners serve", "safe_remediation": "verify that the adjacent CEL worker artifact is present and executable, confirm the supported platform and configured resource ceilings, then retry activation", "field_address_pattern": null, "evidence_scope": "CEL worker packaging, protocol responsiveness, supported platform, and bounded startup capacity", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--cel-worker-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.configuration.invalid", "owner": "registry_notary", "product": "registry_notary", "phase": "configuration_activation", "safe_meaning": "Registry Notary runtime configuration is invalid", "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings", "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation", "field_address_pattern": null, "evidence_scope": "Notary configuration, provider bindings, and compiled feature support", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.deployment.gate_failed", "owner": "registry_notary", "product": "registry_notary", "phase": "deployment_activation", "safe_meaning": "Registry Notary deployment gates refused startup", "rule": "Every startup-failing deployment gate must pass before activation", "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings", "field_address_pattern": null, "evidence_scope": "selected deployment profile and startup-failing gate results", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.activation_failed", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay consultation activation failed", "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves", "safe_remediation": "check the Notary configuration and startup environment", "field_address_pattern": null, "evidence_scope": "Notary Relay consultation client activation lifecycle", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.configuration_invalid", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay consultation configuration is invalid", "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration", "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration", "field_address_pattern": null, "evidence_scope": "Relay destination, activation plan, and consultation configuration", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.credential_unavailable", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay workload credential is unavailable", "rule": "A current non-empty workload credential must be available before a live Relay consultation", "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file", "field_address_pattern": null, "evidence_scope": "configured Relay workload credential availability", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.credentials_rejected", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay rejected the configured workload credential", "rule": "Relay must accept the configured Notary workload binding, scope, and validity window", "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", "field_address_pattern": null, "evidence_scope": "Relay workload binding, scope, and validity acceptance", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.profile_mismatch", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay consultation profile does not match the configured contract pin", "rule": "The active Relay profile must match the reviewed Notary consultation contract pin", "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", "field_address_pattern": null, "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.profile_not_found", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay consultation profile was not found", "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile", "safe_remediation": "deploy the configured Relay profile id, then retry the live check", "field_address_pattern": null, "evidence_scope": "configured consultation profile resolution in Relay", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.relay.unavailable", "owner": "registry_notary", "product": "registry_notary", "phase": "relay_activation", "safe_meaning": "Relay consultation service is unavailable", "rule": "The reviewed Relay destination must be reachable through the configured transport policy", "safe_remediation": "check Relay reachability, TLS, destination policy, and service health", "field_address_pattern": null, "evidence_scope": "reviewed Relay destination, transport policy, and service availability", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.runtime.activation_failed", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary runtime activation failed", "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve", "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation", "field_address_pattern": null, "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.runtime.activation_required", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary runtime activation is required before serving", "rule": "Routers may be built only after the governed audit and state activation lifecycle completes", "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", "field_address_pattern": null, "evidence_scope": "router assembly and governed audit and state activation lifecycle", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.database_read_only", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering", "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions", "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation", "field_address_pattern": null, "evidence_scope": "PostgreSQL writeability and recovery posture", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.database_unavailable", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL state database is unavailable", "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain", "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor", "field_address_pattern": null, "evidence_scope": "PostgreSQL transport, TLS trust, and service availability", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.database_unsupported", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL server major is unsupported", "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract", "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation", "field_address_pattern": null, "evidence_scope": "PostgreSQL server-major compatibility", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.durability_unsafe", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe", "rule": "Serving requires the documented PostgreSQL durability settings for correctness state", "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation", "field_address_pattern": null, "evidence_scope": "PostgreSQL durability posture", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.role_incompatible", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible", "rule": "Serving requires the documented restricted runtime role and its attested schema binding", "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation", "field_address_pattern": null, "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "notary_activation", "code": "notary.state.postgresql.schema_incompatible", "owner": "registry_notary", "product": "registry_notary", "phase": "runtime_activation", "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible", "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract", "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation", "field_address_pattern": null, "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." }, { "family": "operator_preflight", "code": "registryctl.preflight.product_validator_not_checked", "owner": "registryctl", "product": "registryctl", "phase": "product_capability", "safe_meaning": "A required linked product validator was not checked locally.", "rule": "registryctl.preflight.product_validator_locally_available", "safe_remediation": "Enable the linked product validator.", "field_address_pattern": null, "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.product_validator_not_checked", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.report_capacity_exceeded", "owner": "registryctl", "product": "registryctl", "phase": "report_boundary", "safe_meaning": "The preflight report reached its deterministic safety cap.", "rule": "registryctl.preflight.report_capacity", "safe_remediation": "Reduce declared preflight inputs.", "field_address_pattern": null, "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.report_capacity_exceeded", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_empty", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "A declared runtime file is empty.", "rule": "registryctl.preflight.runtime_file_bounded_regular", "safe_remediation": "Replace the runtime file.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_empty", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_missing", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "A declared runtime file is missing.", "rule": "registryctl.preflight.runtime_file_bounded_regular", "safe_remediation": "Replace the runtime file.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_not_checked", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "Runtime file posture could not be checked with the required local invariant.", "rule": "registryctl.preflight.runtime_file_posture_supported", "safe_remediation": "Run preflight on a supported Unix platform.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_checked", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_not_regular", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "A declared runtime file is not an acceptable bounded regular file.", "rule": "registryctl.preflight.runtime_file_bounded_regular", "safe_remediation": "Replace the runtime file.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_regular", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_unsafe_mode", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "A declared runtime file has unsafe local access permissions.", "rule": "registryctl.preflight.runtime_file_safe_mode", "safe_remediation": "Tighten runtime file permissions.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_mode", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.runtime_file_unsafe_owner", "owner": "registryctl", "product": "registryctl", "phase": "runtime_file_posture", "safe_meaning": "A declared runtime file has an unsafe owner.", "rule": "registryctl.preflight.runtime_file_safe_owner", "safe_remediation": "Set the runtime file owner.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_owner", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.secret_empty", "owner": "registryctl", "product": "registryctl", "phase": "secret_availability", "safe_meaning": "A required secret reference contains only whitespace.", "rule": "registryctl.preflight.secret_reference_available", "safe_remediation": "Provide a non-empty secret to the process environment.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_empty", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.secret_missing", "owner": "registryctl", "product": "registryctl", "phase": "secret_availability", "safe_meaning": "A required secret reference is unavailable to this process.", "rule": "registryctl.preflight.secret_reference_available", "safe_remediation": "Provide the secret to the process environment.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "operator_preflight", "code": "registryctl.preflight.static_validation_not_checked", "owner": "registryctl", "product": "registryctl", "phase": "static_validation", "safe_meaning": "Required authoritative static validation was not completed.", "rule": "registryctl.preflight.authoritative_static_validation", "safe_remediation": "Complete authoritative static validation.", "field_address_pattern": "", "evidence_scope": "offline local operator preflight", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.static_validation_not_checked", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "Preflight does not contact live sources or prove remote availability." }, { "family": "relay_activation", "code": "relay.consultation.activation.artifact_registry_invalid", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not compile the verified consultation artifact registry.", "rule": "The verified artifact closure must compile into one closed registry without conflicting public profiles.", "safe_remediation": "Rebuild and verify the exact consultation artifact closure before restarting Relay.", "field_address_pattern": null, "evidence_scope": "verified consultation artifact closure and compiled public profiles", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--artifact-registry-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.configuration_missing", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay consultation activation requires configuration that is not present.", "rule": "The closed consultation configuration must exist before Relay compiles serving authority.", "safe_remediation": "Provide a validated Relay consultation configuration and restart Relay.", "field_address_pattern": null, "evidence_scope": "Relay consultation configuration and serving authority", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--configuration-missing", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.protected_metadata_invalid", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not construct bounded protected consultation metadata.", "rule": "Protected metadata must contain one strict bounded public contract and its reviewed binding.", "safe_remediation": "Regenerate and verify the consultation artifact closure, then restart Relay.", "field_address_pattern": null, "evidence_scope": "protected consultation metadata, public contract, and reviewed binding", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--protected-metadata-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.pseudonym_material_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not activate the pseudonym material required for consultation audit evidence.", "rule": "The configured pseudonym material must be valid and bind to the current write authority.", "safe_remediation": "Restore the reviewed pseudonym material and write authority, then restart Relay.", "field_address_pattern": null, "evidence_scope": "consultation pseudonym material and current write authority", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--pseudonym-material-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.quota_limits_invalid", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not activate the bounded consultation quota contract.", "rule": "Public and effective quota limits must remain representable, positive, and non-widening.", "safe_remediation": "Correct the reviewed quota limits and rebuild the consultation artifacts.", "field_address_pattern": null, "evidence_scope": "public and effective consultation quota limits", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--quota-limits-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.source_credentials_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not activate the source-credential capability required by the consultation registry.", "rule": "Every compiled source plan must have exactly the credential capability it declares.", "safe_remediation": "Restore the reviewed source-credential references and restart Relay.", "field_address_pattern": null, "evidence_scope": "compiled consultation source plans and credential capabilities", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--source-credentials-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.state_plane_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "Relay could not activate the consultation state plane and its current authority.", "rule": "The state plane, durable audit boundary, quota state, and current write authority must activate together.", "safe_remediation": "Restore the reviewed Relay state-plane dependencies and restart Relay.", "field_address_pattern": null, "evidence_scope": "consultation state plane, audit boundary, quota state, and write authority", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--state-plane-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.unsupported_plan", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "A compiled consultation plan requires a capability this Relay runtime cannot activate.", "rule": "Every plan, worker, transport, snapshot binding, and dispatch budget must use a compiled supported capability.", "safe_remediation": "Use a Relay release that supports the reviewed plan or rebuild the plan with supported capabilities.", "field_address_pattern": null, "evidence_scope": "compiled consultation plan and Relay runtime capabilities", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--unsupported-plan", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_activation", "code": "relay.consultation.activation.workload_binding_invalid", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "The configured consultation workload binding is incompatible with Relay authentication.", "rule": "Issuer, audience, client binding, principal, and selector must satisfy the closed Relay workload contract.", "safe_remediation": "Align the reviewed consultation workload binding with Relay authentication and restart Relay.", "field_address_pattern": null, "evidence_scope": "consultation workload binding and Relay authentication contract", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--workload-binding-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." }, { "family": "relay_process_startup", "code": "relay.startup.admin_listener_address_in_use", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay could not open the administration listener because its binding is already in use.", "rule": "registry.relay.startup.admin_listener_binding_is_unused", "safe_remediation": "Resolve the listener conflict for server.admin_bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay administration listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-address-in-use", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category names server.admin_bind and address-in-use status but does not disclose its address, port, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.admin_listener_permission_denied", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay lacks permission to open the configured administration listener.", "rule": "registry.relay.startup.admin_listener_binding_is_permitted", "safe_remediation": "Choose a permitted server.admin_bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay administration listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-permission-denied", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category names server.admin_bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.admin_listener_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay could not open the configured administration listener.", "rule": "registry.relay.startup.admin_listener_is_available", "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.admin_bind in its owning input; regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay administration listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The fallback category names server.admin_bind but does not disclose its address, port, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.bundle_binding_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "bundle_verification", "safe_meaning": "The governed bundle does not match this Relay runtime target.", "rule": "registry.relay.startup.bundle_binding_matches_runtime", "safe_remediation": "Use a governed bundle issued for this Relay runtime target.", "field_address_pattern": null, "evidence_scope": "governed bundle and Relay runtime binding", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-binding-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose configured or received binding values." }, { "family": "relay_process_startup", "code": "relay.startup.bundle_rollback_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "bundle_activation", "safe_meaning": "The governed bundle or override failed Relay anti-rollback checks.", "rule": "registry.relay.startup.bundle_antirollback_satisfied", "safe_remediation": "Use a monotonic governed bundle or an authorized break-glass selection.", "field_address_pattern": null, "evidence_scope": "local anti-rollback state and governed bundle or override metadata", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-rollback-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose sequences, hashes, paths, operators, or approval values." }, { "family": "relay_process_startup", "code": "relay.startup.bundle_signature_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "bundle_verification", "safe_meaning": "The governed bundle failed authenticity or content-integrity verification.", "rule": "registry.relay.startup.bundle_authenticity_and_integrity_accepted", "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", "field_address_pattern": null, "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-signature-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose signer identifiers, file names, hashes, or trust-anchor values." }, { "family": "relay_process_startup", "code": "relay.startup.bundle_validation_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "bundle_verification", "safe_meaning": "The governed bundle or local acceptance metadata is invalid.", "rule": "registry.relay.startup.bundle_inputs_are_valid", "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", "field_address_pattern": null, "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-validation-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose parser excerpts, local paths, hashes, identities, or supplied values." }, { "family": "relay_process_startup", "code": "relay.startup.config_deprecated_field_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "config_document_validation", "safe_meaning": "A Relay configuration document uses a field that the current runtime no longer accepts.", "rule": "registry.relay.startup.config_uses_current_fields", "safe_remediation": "Compare the authored input with the current Relay schema and migration guidance, replace deprecated fields, regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "Relay configuration field names and the product-owned deprecated-field registry", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-deprecated-field-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose the configured field path, replacement, source path, or supplied values. Run authored-project validation for field-addressed guidance." }, { "family": "relay_process_startup", "code": "relay.startup.config_document_invalid", "owner": "registry_relay", "product": "registry_relay", "phase": "config_document_validation", "safe_meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", "rule": "registry.relay.startup.config_document_is_typed", "safe_remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "Relay configuration and metadata document encoding, syntax, field grammar, and types", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." }, { "family": "relay_process_startup", "code": "relay.startup.config_environment_binding_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "config_environment_expansion", "safe_meaning": "A required Relay configuration environment binding could not be expanded safely.", "rule": "registry.relay.startup.config_environment_bindings_expand", "safe_remediation": "Check the authored environment expressions and required deployment bindings, then run Relay doctor against the same configuration before retrying.", "field_address_pattern": null, "evidence_scope": "Relay configuration environment expressions and deployment-provided bindings", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-environment-binding-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose environment names, expansion errors, source paths, or supplied values. It does not claim field-level diagnostics were emitted." }, { "family": "relay_process_startup", "code": "relay.startup.config_source_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "config_loading", "safe_meaning": "A required Relay configuration or metadata source could not be read.", "rule": "registry.relay.startup.config_source_is_readable", "safe_remediation": "Check the --config source and any configured metadata.source.path, restore readable input from its owner, regenerate generated Relay input instead of editing it in place, then retry.", "field_address_pattern": null, "evidence_scope": "Relay configuration and metadata sources", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-source-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose local paths, operating-system errors, or source contents." }, { "family": "relay_process_startup", "code": "relay.startup.config_validation_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "config_validation", "safe_meaning": "The parsed Relay configuration failed product validation.", "rule": "registry.relay.startup.config_product_invariants_hold", "safe_remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "parsed Relay configuration and governed runtime bindings", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." }, { "family": "relay_process_startup", "code": "relay.startup.consultation_artifacts_rejected", "owner": "registry_relay", "product": "registry_relay", "phase": "consultation_activation", "safe_meaning": "The governed consultation artifact closure failed startup validation.", "rule": "registry.relay.startup.consultation_artifact_closure_is_valid", "safe_remediation": "Rebuild the complete hash-covered consultation artifact closure and retry.", "field_address_pattern": null, "evidence_scope": "governed consultation artifact closure and runtime bindings", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--consultation-artifacts-rejected", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose artifact paths, hashes, selectors, identities, or parser excerpts." }, { "family": "relay_process_startup", "code": "relay.startup.data_listener_address_in_use", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay could not open the data-plane listener because its binding is already in use.", "rule": "registry.relay.startup.data_listener_binding_is_unused", "safe_remediation": "Resolve the listener conflict for server.bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-address-in-use", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category names server.bind and address-in-use status but does not disclose its address, port, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.data_listener_permission_denied", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay lacks permission to open the configured data-plane listener.", "rule": "registry.relay.startup.data_listener_binding_is_permitted", "safe_remediation": "Choose a permitted server.bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-permission-denied", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category names server.bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.data_listener_unavailable", "owner": "registry_relay", "product": "registry_relay", "phase": "listener_binding", "safe_meaning": "Relay could not open the configured data-plane listener.", "rule": "registry.relay.startup.data_listener_is_available", "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", "field_address_pattern": null, "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." }, { "family": "relay_process_startup", "code": "relay.startup.doctor_failed", "owner": "registry_relay", "product": "registry_relay", "phase": "operator_diagnostics", "safe_meaning": "Relay doctor found one or more blocking diagnostics.", "rule": "registry.relay.startup.doctor_has_no_blocking_diagnostics", "safe_remediation": "Use the static diagnostic codes and actions in the doctor report.", "field_address_pattern": null, "evidence_scope": "offline Relay readiness and deployment diagnostics", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." }, { "family": "relay_process_startup", "code": "relay.startup.runtime_initialization_failed", "owner": "registry_relay", "product": "registry_relay", "phase": "runtime_initialization", "safe_meaning": "Relay runtime initialization failed.", "rule": "registry.relay.startup.runtime_initializes", "safe_remediation": "Review preceding static diagnostic codes, correct the runtime inputs, and retry.", "field_address_pattern": null, "evidence_scope": "Relay runtime dependencies and protected startup capabilities", "secret_sensitive_value_policy": "no_runtime_values", "docs_anchor": "/reference/diagnostics/operator/#registry_relay--runtime-initialization-failed", "lifecycle": "unreleased", "introduced_in": null, "stability": "pre1_stable_code", "evidence_limitation": "The category does not disclose inner errors, paths, URLs, identities, hashes, or supplied values." } ], "omissions": [] }