Module code 

Exit code taxonomy. Matches criterion G from the #16 plan.

Constants

AUDIT_DIVERGENCE

cairn audit verify (#41) detected a hash-chain divergence: the chain walked successfully up to row N-1, then row N’s recomputed hash did not match its stored row_hash. Distinct exit code so monitoring/CI can branch on integrity-failure (chain broken — operational alert) vs. generic CLI error.

AUTH

PDS rejected credentials OR Cairn returned 401.

FORBIDDEN

Cairn returned 403.

INTERNAL

Internal error (malformed response body, unexpected state).

LEASE_CONFLICT

cairn serve could not acquire the single-instance lease — another Cairn process holds it with a fresh heartbeat (§F5). Distinct from INTERNAL so systemd-restart-loop logic can branch (“another instance is running, don’t restart”) vs. genuine internal failure.

NETWORK

Transport-level failure: unreachable host, TLS error, timeout.

SERVER_4XX

Cairn returned some other 4xx.

SERVER_5XX

Cairn returned 5xx.

SERVICE_RECORD_ABSENT

Service record verify (§F1, #8): no record published yet. Operator action required: run cairn publish-service-record for the first time.

SERVICE_RECORD_DRIFT

Service record verify (§F1, #8): local [labeler] config differs from the published app.bsky.labeler.service record on the PDS. Operator action required: reconcile via cairn publish-service-record.

SERVICE_RECORD_UNREACHABLE

Service record verify (§F1, #8): PDS unreachable during the verify fetch. Transient infra issue; orchestrators should retry rather than treating as a config drift.

SESSION

Session file absent, permissions wrong, version mismatch.

SUCCESS

Clean exit.

USAGE

Usage / argument parsing. clap exits with 2 directly — this constant exists so hand-written handlers agree.