Enum RuntimeError 

pub enum RuntimeError {
    ArtifactNotFound {
        name: String,
        version: String,
    },
    ArtifactIntegrityFailed {
        name: String,
        version: String,
    },
    LockMissingEntry {
        name: String,
    },
    LockVersionMismatch {
        name: String,
        requested: String,
        pinned: String,
    },
    RuntimeOriginNotDeclarable {
        name: String,
        version: String,
        session: String,
        declared_as: &'static str,
    },
    ArtifactArchive {
        name: String,
        version: String,
        message: String,
    },
    ToolComponentCompile {
        name: String,
        version: String,
        message: String,
    },
    CapsuleCompile(String),
    CreateWorkdir {
        path: String,
        source: Error,
    },
    WorkdirPathRefused {
        refusal: WorkdirRefusal,
    },
    RuntimeDirUnavailable {
        reason: String,
    },
    RecordsDirUnavailable {
        reason: String,
    },
    HomeUnusable(HomeUnusable),
    WorkdirIdentityMismatch {
        workdir: String,
        expected: String,
        found: String,
    },
    ToolNameNotAComponent {
        name: String,
    },
    WriteToolManifest {
        path: String,
        source: Error,
    },
    SystemPromptFileRead {
        path: String,
        source: Error,
    },
    CompactionSystemPromptFileRead {
        path: String,
        source: Error,
    },
    SystemPromptArtifactRead {
        name: String,
        source: Error,
    },
    SkillSourceNotFound {
        path: String,
    },
    SkillSourceMissingSkillMd {
        path: String,
    },
    SkillSourceRead {
        path: String,
        source: Error,
    },
    SkillSourceRefused {
        message: String,
    },
    InvalidNetworkAllowEntry {
        entry: String,
        message: String,
    },
    InvalidFilesystemScope {
        scope: String,
        message: String,
    },
    InvalidReadOnlyPath {
        path: String,
        message: String,
    },
    InvalidArtifactConfig {
        artifact: String,
        message: String,
    },
    InvalidStateStore {
        store: String,
        message: String,
    },
    InvalidConversationRecord {
        field: String,
        value: String,
        message: String,
    },
    ResumeRecordMissing {
        session: String,
        context_id: String,
        reason: String,
    },
    ResumeCompactionHookMissing,
    ResumeCompactUnsupportedTransport,
    StateStoreUnavailable {
        store: String,
        path: String,
        message: String,
    },
    ContainmentFloorUnmet {
        declared: ContainmentClass,
        achieved: ContainmentClass,
        reason: String,
        cause: ShortfallCause,
        required_by: Vec<ProviderToolUse>,
    },
    ExportRootOutsideWorkdir {
        field: String,
        declared: String,
        resolved: String,
        workdir: String,
    },
    ReservedToolName {
        name: String,
    },
    DuplicateToolName {
        first: String,
        second: String,
        tool: String,
    },
    EnvAllowStrippedByBackstop {
        entries: Vec<StrippedEnvAllowEntry>,
    },
    HostPathRefused(HostPathRefusal),
    RuntimeProvidedToolNotReserved {
        name: String,
    },
    PersistentCapsuleNeedsHandleTtl {
        declared_secs: Option<u64>,
        ceiling_secs: u64,
    },
    StagedRuntimeRequiresSealed {
        binaries: Vec<String>,
        declared: ContainmentClass,
    },
    ProviderToolRequiresSealed {
        tools: Vec<ProviderToolUse>,
        declared: ContainmentClass,
        host_can_back: ContainmentClass,
    },
    ProviderToolNeedsVision {
        tool: String,
        kind: ProviderToolKind,
        model: String,
        choice: String,
        driver: String,
    },
    ProviderToolMalformed {
        artifact: String,
        reason: String,
    },
    ShellBinaryPackageUnreachable {
        entries: Vec<UnreachableEntrypoint>,
    },
    SealedRootConstructionFailed {
        detail: String,
    },
    EgressNamespaceUnavailable {
        blocker: EgressNamespaceBlocker,
        reason: String,
        required_by: Vec<ProviderToolUse>,
    },
    CapsuleExportMissing,
    ToolExportMissing {
        name: String,
    },
    CapsuleTrap(String),
    CapsuleDeadlineExceeded {
        seconds: u64,
    },
    CapsuleResourceLimit {
        message: String,
    },
    ShellResourceLimitExceeded {
        binary: String,
        limit: String,
        detail: String,
    },
    ToolDataPathRefused {
        tool: String,
        path: String,
        code: String,
        detail: String,
    },
    CgroupDelegationUnavailable {
        reason: String,
    },
    WorkdirSizeExceeded {
        max_bytes: u64,
        observed_bytes: u64,
    },
    WasiInit {
        path: String,
        message: String,
    },
    DriverNotConfigured,
    DriverNotInstalled(String),
    GatewayArtifactDeclaresNoUpstreamAuth {
        name: String,
        version: String,
        reason: Option<String>,
    },
    ModelLimits(ModelLimitsError),
    NativeTool {
        artifact: String,
        field: String,
    },
    QueueWithoutRoom,
    GatewayWithoutCredential {
        name: String,
        endpoint: String,
    },
    GatewayCredentialNotFound {
        artifact: String,
        variable: String,
        credentials_file: Option<PathBuf>,
    },
    SpendLedgerUnavailable {
        path: String,
        message: String,
    },
    ControlTokenUnwritable {
        reason: String,
    },
    AgentLoopFailed(String),
    TaskDidNotComplete {
        exit_status: &'static str,
        reason: String,
    },
    PortInUse {
        port: u16,
    },
    SpawnRegistrationFailed {
        roost_url: String,
        reason: String,
    },
    SpawnerHandleUnreadable {
        reason: String,
    },
    FormationIdUnreadable {
        reason: String,
    },
    FormationPeersUnreadable {
        reason: String,
    },
    FormationChannelUnreadable {
        reason: String,
    },
    FormationLifelineUnreadable {
        reason: String,
    },
    SpawnerLifelineUnreadable {
        reason: String,
    },
    SessionDeadlineUnenforceable {
        reason: String,
    },
    ProcessDriverInterfaceMissing {
        name: String,
        version: String,
        expected: String,
    },
    WitLevelMismatch {
        name: String,
        version: String,
        level: u64,
        mismatched: Vec<UnservedInterface>,
    },
    HttpDriverExportsProcessInterface {
        name: String,
        version: String,
        exported: Vec<String>,
    },
    DriverStreamInterfaceNotServed {
        name: String,
        version: String,
        imported: Vec<String>,
        expected: String,
    },
    ProcessDriverRequiredEnvNotAllowed {
        name: String,
        version: String,
        missing: Vec<String>,
    },
    ProcessDriverReportsNoUsage {
        name: String,
        version: String,
        ceilings: Vec<String>,
    },
    ProcessDriverLoad {
        name: String,
        version: String,
        message: String,
    },
    HarnessBinaryNotFound {
        binary: String,
        binary_source: String,
    },
    HarnessTurnFailed {
        kind: String,
        message: String,
        origin: String,
    },
    HarnessSessionGone {
        context_id: String,
        session_id: String,
        harness: String,
        path: Option<PathBuf>,
        detail: String,
    },
    ForgetSessionUnsupportedTransport {
        transport: String,
    },
    ProcessDriverCallFailed {
        name: String,
        version: String,
        call: String,
        message: String,
    },
    ProcessHarnessInactive {
        seconds: u64,
    },
    Runtime(String),
}

Variants

ArtifactNotFound

Fields

name: String

version: String

ArtifactIntegrityFailed

Fields

name: String

version: String

LockMissingEntry

Fields

name: String

LockVersionMismatch

Fields

name: String

requested: String

pinned: String

RuntimeOriginNotDeclarable

A murmur.lock pin written by manage.pull() is declared in a role only an operator-declared pin may carry. declared_as is the offending manifest text: runtime: hook, runtime: driver, gateway: or inference.system_prompt_artifact.

Fields

name: String

version: String

session: String

declared_as: &'static str

ArtifactArchive

Fields

name: String

version: String

message: String

ToolComponentCompile

Fields

name: String

version: String

message: String

CapsuleCompile(String)

CreateWorkdir

Fields

path: String

source: Error

WorkdirPathRefused

A runtime write, append, read, create or removal inside the capsule’s workdir met a symbolic link, a hard-linked or non-regular file, or an invalid path component, and did nothing. mur renders it as E-RUN-050.

Fields

refusal: WorkdirRefusal

RuntimeDirUnavailable

~/.murmur/sessions/<session-id>/, the session’s runtime directory, could not be created or locked. mur renders it as E-IO-003.

Fields

reason: String

RecordsDirUnavailable

~/.murmur/records/<workdir root>/<session-id>/, the session’s records directory, could not be created. mur renders it as E-IO-003.

Fields

reason: String

HomeUnusable(HomeUnusable)

HOME cannot hold ~/.murmur, so there is nowhere to put a session’s runtime and records directories. Checked before anything is created; mur renders it as E-IO-004.

WorkdirIdentityMismatch

A delegated child’s --workdir is not the directory its parent created: its (st_dev, st_ino) differs from --workdir-identity. Nothing was written. mur renders it as E-RUN-051.

Fields

workdir: String

expected: String

found: String

ToolNameNotAComponent

A tool name that is not one normal path component, so its staged manifest would land outside the runtime directory’s tools/.

Fields

name: String

WriteToolManifest

Fields

path: String

source: Error

SystemPromptFileRead

Fields

path: String

source: Error

CompactionSystemPromptFileRead

Fields

path: String

source: Error

SystemPromptArtifactRead

Fields

name: String

source: Error

SkillSourceNotFound

Fields

path: String

SkillSourceMissingSkillMd

Fields

path: String

SkillSourceRead

Fields

path: String

source: Error

SkillSourceRefused

A local skill source directory holds what mur build refuses to pack: a symlink, two spellings of skill.md, or a root murmur-build.json.

Fields

message: String

InvalidNetworkAllowEntry

Fields

entry: String

message: String

InvalidFilesystemScope

Fields

scope: String

message: String

InvalidReadOnlyPath

A capabilities.filesystem.read_only entry is not a usable workdir subpath: it is absolute, or it escapes the workdir via ... The exact parallel of Self::InvalidFilesystemScope, raised from [crate::protected_paths::ProtectedPaths::from_declared] at staging — before any registry pull, workdir creation or component instantiation — so no call is ever checked against a rule the runtime could not build.

Fields

path: String

message: String

InvalidArtifactConfig

An artifact entry’s config: block cannot be delivered as MURMUR_ARTIFACT_CONFIG: it is not a string-keyed mapping, does not serialize to JSON, or exceeds crate::artifact_config::MAX_ARTIFACT_CONFIG_BYTES. Raised at staging (and from mur run --explain-scope), before any registry pull, workdir creation or component instantiation, so a malformed channel is refused once at launch rather than one tool call at a time.

Fields

artifact: String

message: String

InvalidStateStore

A capabilities.state.store name is not a single usable directory segment under ~/.murmur/state/. Raised at staging (and from mur run --explain-scope), before any registry pull, workdir creation or component instantiation, so a bad name never gets as far as creating something on disk.

Fields

store: String

message: String

InvalidConversationRecord

A context.record_store value, or a mur run --context value, is not a single usable directory segment of a conversation record path. Raised at staging, before any registry pull, workdir creation or component instantiation, so a bad name never gets as far as creating something on disk.

Distinct from Self::InvalidStateStore because the remedies point at different keys, and because a record is on by default while a state store is declared: an operator seeing this may not have written a context: block at all, only a --context flag.

Fields

field: String

value: String

message: String

ResumeRecordMissing

mur run --resume named a session whose context kept no conversation record on disk, so there is nothing to continue. Raised at staging, before this launch’s workdir exists: a resume that silently started fresh would be indistinguishable from one that worked.

Fields

session: String

context_id: String

reason: String

ResumeCompactionHookMissing

mur run --resume-mode compact on a capsule with no hook bound to on-compaction. There is nothing to produce the summary, and falling back to full would silently give the operator the mode they did not ask for.

ResumeCompactUnsupportedTransport

mur run --resume-mode compact on a transport: process capsule. The harness holds the conversation and the runtime has no message list to hand a compaction hook, so there is nothing compact could summarize.

StateStoreUnavailable

The state store directory a validated name resolves to could not be resolved or created. Distinct from Self::InvalidStateStore: the declaration is well-formed and the failure is the host’s — an unset HOME, or a path that cannot be made a 0700 directory.

Fields

store: String

path: String

message: String

ContainmentFloorUnmet

The declared containment floor is stronger than what this host’s kernel can back. Raised in the stage/launch seam, before any registry pull, component compile or workdir creation — achieved always comes from a live host probe, never from the manifest.

Fields

declared: ContainmentClass

achieved: ContainmentClass

reason: String

cause: ShortfallCause

Why the floor is unmet, which decides what the operator is told to change.

required_by: Vec<ProviderToolUse>

The declared provider tools that need the floor, each named on a required by: line. Filled only for a declared sealed floor; empty otherwise, and then the message has no required by: line.

ExportRootOutsideWorkdir

A capsule declares an exports.files.root that, once resolved against the session’s accessible workdir, lands somewhere else — the root already exists as a symlink pointing out of it.

Refused at launch rather than per request: an export root outside the workdir is a misconfiguration the operator can fix, and discovering it one served file at a time would mean the first file had already left.

Fields

field: String

The manifest key that declared it — exports.files.root or exports.peer_files.root. Carried rather than hard-coded because the two roots are separate authorisers and an operator fixing one must be told which.

declared: String

resolved: String

workdir: String

ReservedToolName

A capsule declares an artifact whose name collides with a tool the runtime provides itself.

Every name in [crate::runtime::RESERVED_TOOL_NAMES] is answered inside dispatch_agent_tool_unfenced before any allowlist check is reached, and their synthetic manifests are written after the staging loop. An artifact installed under one of them would have its manifest overwritten and every call to it answered by the runtime, so the collision is refused rather than resolved into a tool the capsule can never reach.

Fields

name: String

The declared artifact name whose tool name collides.

DuplicateToolName

Two declared artifacts share a tool name, the bare part a session offers the model and stages under <runtime dir>/tools/.

Fields

first: String

second: String

tool: String

EnvAllowStrippedByBackstop

A capsule’s capabilities.env.allow names variables the credential backstop strips from every guest environment.

The strip in build_declared_env is not negotiable from a manifest, so the entries can only ever deliver nothing; the declaration is refused rather than left silently inert.

Fields

entries: Vec<StrippedEnvAllowEntry>

Every distinct stripped entry, in first-declaration order.

HostPathRefused(HostPathRefusal)

A host_paths entry in ~/.murmur/config.yaml cannot be honoured for this session: at launch (missing, not a directory, a system path, read-write over murmur’s own home, inside the work folder, the same directory twice) or at staging, read-write over a folder the session may run something from. A configured host path is never silently dropped.

RuntimeProvidedToolNotReserved

A synthetic tool manifest was written under a name absent from [crate::runtime::RESERVED_TOOL_NAMES].

The inverse of Self::ReservedToolName, and the reason a further runtime-provided tool cannot be added without reserving its name: an unreserved name is claimable by an artifact, which would then be installed and silently shadowed at dispatch.

Fields

name: String

The name the synthetic write was attempted under.

PersistentCapsuleNeedsHandleTtl

A capsule declares exports.peer_files together with lifecycle.after_task: sleep, and either declared no max_ttl or declared one above the persistent ceiling.

An ephemeral capsule needs no ceiling: teardown destroys the minting key, so every outstanding handle stops verifying at once and the declared lifetime can never outlive the process. sleep withdraws that bound deliberately, which makes the declared lifetime the only one there is — so it has to be declared, and it has to be short.

Fields

declared_secs: Option<u64>

The declared max_ttl in seconds, or None when the manifest declared none.

ceiling_secs: u64

StagedRuntimeRequiresSealed

A capsule declares capabilities.shell.staged_runtime without an effective sealed containment floor.

Deliberately distinct from Self::ContainmentFloorUnmet: that one compares the declared floor against what the host can back, and its remedy is to lower the floor or move hosts. This one is decided against the declared floor alone and never looks at the host at all, so it fires identically on a machine that could deliver sealed — a staged runtime has no composed root to be staged into unless the capsule asked for one, and quietly launching it without the mount would leave the interpreter simply absent. Its remedy is to raise the declared floor (or drop the grant), which is the opposite advice.

binaries names every offending staged_runtime binary so the operator does not have to re-run to find the second one.

Fields

binaries: Vec<String>

declared: ContainmentClass

ProviderToolRequiresSealed

A capsule declares a tool whose artifact declares provider_tool:, under an effective containment floor below sealed.

Decided against the declared floor alone, like Self::StagedRuntimeRequiresSealed: the floor is never raised for the tool, so a weaker declaration is refused rather than upgraded. tools names every such tool and its kind; host_can_back is what this host can back, for the hint.

Fields

tools: Vec<ProviderToolUse>

Each such tool, in staging order.

declared: ContainmentClass

host_can_back: ContainmentClass

ProviderToolNeedsVision

A capsule declares a computer tool and a transport: http driver choice runs a model whose driver marks it vision: false in its models: table. Names the first such tool and the first such choice, primary first.

Fields

tool: String

kind: ProviderToolKind

model: String

choice: String

driver: String

The driver artifact as name@version.

ProviderToolMalformed

An installed artifact’s provider_tool: block does not parse, or sits on an artifact that is not a tool. artifact is name@version; reason names the dotted field.

Fields

artifact: String

reason: String

ShellBinaryPackageUnreachable

A sealed capsule allowlists a script whose interpreter’s package tree nothing declared could make reachable inside the composed root.

Deliberately distinct from Self::StagedRuntimeRequiresSealed, which it sits next to in stage_session: that one fires when a grant was declared at too low a floor, this one fires when no grant was declared at all and the floor is already sealed. Their remedies point in opposite directions — raise the floor there, add a grant here.

entries names every offending allowlist entry so an operator fixing this does not have to re-run to discover the second script, following the same precedent.

Fields

entries: Vec<UnreachableEntrypoint>

SealedRootConstructionFailed

A sealed session’s composed root could not be built in the forked child, after the pre-launch probe reported the mechanism available.

Deliberately distinct from Self::ContainmentFloorUnmet: that one is a refusal decided before anything is staged, on a host that never claimed to offer sealed. This one is a host that claimed it and then failed to deliver — a race, a mount table that changed under the runtime, or an edge case the cheap probe cannot catch. Conflating the two would tell an operator to lower their declared floor when the real answer is that something moved.

detail is the message the child wrote to the pre_exec diagnostic pipe, which names the exact step (unshare, a specific bind mount, pivot_root) and its errno.

Fields

detail: String

EgressNamespaceUnavailable

This host cannot give a capsule’s subprocess tree its own network namespace, so the egress boundary that mediates capabilities.network.allow cannot be built.

Raised before any registry pull, component compile or workdir creation, and raised for every Linux capsule that can spawn a subprocess — including one whose capabilities.network.allow is empty. That breadth is the point: with the namespace missing, an empty allowlist would mean unrestricted egress rather than none, because the seccomp connect/sendto interception that used to back it was deleted as unsound rather than kept as a fallback. There is deliberately no path that continues at reduced enforcement.

Deliberately distinct from Self::ContainmentFloorUnmet, which this would otherwise look like: that one compares a declared containment class against what the host can back, and its remedy is to lower the declared floor. A network namespace is not part of the containment ladder — every class needs it equally — so lowering the floor fixes nothing here, and offering that advice would be actively misleading.

Fields

blocker: EgressNamespaceBlocker

reason: String

required_by: Vec<ProviderToolUse>

The declared provider tools, each named on a required by: line; empty without one, and then the message has no required by: line.

CapsuleExportMissing

ToolExportMissing

Fields

name: String

CapsuleTrap(String)

CapsuleDeadlineExceeded

Fields

seconds: u64

CapsuleResourceLimit

Fields

message: String

ShellResourceLimitExceeded

Fields

binary: String

limit: String

detail: String

ToolDataPathRefused

Fields

tool: String

path: String

code: String

detail: String

CgroupDelegationUnavailable

Fields

reason: String

WorkdirSizeExceeded

Fields

max_bytes: u64

observed_bytes: u64

WasiInit

Fields

path: String

message: String

DriverNotConfigured

DriverNotInstalled(String)

GatewayArtifactDeclaresNoUpstreamAuth

An artifact whose operator entry declares gateway: has a bundled manifest with no usable upstream_auth: block, so the runtime cannot tell how its upstream expects the key. Refused at staging, before any component runs, whether or not gateway.api_key is set. reason is None when the block is absent and says what is wrong when it is malformed.

Fields

name: String

version: String

reason: Option<String>

ModelLimits(ModelLimitsError)

A driver choice under transport: http has no output cap, or its driver ships a malformed models: table. Refused at staging, before any request leaves.

NativeTool

A staged or pulled artifact’s own packed murmur.yaml declares implementation: native or execution: native. Murmur runs tools only as WASM components, so the launch stops before any session starts and a pull stages nothing. artifact is the full <scope>/<name>; field is the manifest key that declared it.

Fields

artifact: String

field: String

QueueWithoutRoom

The launch’s --lifecycle-task-acceptance queue override turns a manifest that declares lifecycle.queue_depth: 0 under another acceptance into a queue with no room for a waiting task. The manifest refuses queue at depth 0 at load; this is the one combination load cannot see. Refused at staging, before any registry pull or workdir creation.

GatewayWithoutCredential

An crate::types::ArtifactRequest’s gateway carries neither a credential nor the operator’s keyless: true. The manifest parser refuses that shape first; staging refuses it again so no caller can build a gateway that sends keyless by omission.

Fields

name: String

endpoint: String

GatewayCredentialNotFound

gateway.api_key: ${variable} on artifact artifact names a credential that neither the global config’s credentials: map nor the launching environment holds. Refused at staging, before the session directory exists.

Fields

artifact: String

variable: String

credentials_file: Option<PathBuf>

SpendLedgerUnavailable

spend.machine_tokens_per_day is in effect and the shared ledger it is kept in cannot be used — an unset HOME, a ~/.murmur/spend that cannot be made a 0700 directory, or a daily file that cannot be opened. Raised at staging, before the session directory exists and before any provider request.

Fields

path: String

message: String

ControlTokenUnwritable

A capsule declaring control: could not mint its control token or write it beside its running record. Raised before the door is announced: a capsule whose declared controllability no controller could reach does not run. reason names the path and the failure, never the token.

Fields

reason: String

AgentLoopFailed(String)

TaskDidNotComplete

The launch ran, and the task it was run for did not complete. The session itself shut down cleanly: everything it records — out/result.txt, the trace, a delegated child’s completion — was written before this was returned.

exit_status is the task_end/session_end vocabulary, never "ok": "failed", "max_turns_reached", "spend_ceiling_reached" or "canceled". reason is never empty; for "failed" it is the reason the run’s task_failed trace line carries.

Fields

exit_status: &'static str

reason: String

PortInUse

Fields

port: u16

SpawnRegistrationFailed

A session whose manifest declares capabilities.spawn.allow could not register with mur-roost, so the daemon does not hold the grants it would referee that session’s delegations against.

Fatal rather than a warning: a capsule that can delegate but is unknown to the daemon is a capsule running outside the only thing that bounds what it may spawn. A capsule that declares no spawn capability never registers and never reaches this.

reason is the transport or daemon-side failure verbatim. Neither this nor anything derived from it carries a credential or an approval: the registration request’s tokens travel in headers, and the HTTP client never puts a request header into an error.

Fields

roost_url: String

reason: String

SpawnerHandleUnreadable

MURMUR_SPAWNER was set to something that is not a spawner handle.

reason names what about the value could not be read, and nothing derived from it carries the value itself: a handle names a parent’s address and session, which is not this process’s to print back out.

Fields

reason: String

FormationIdUnreadable

MURMUR_FORMATION_ID was set to something that is not a formation id.

reason names what about the value is wrong — its prefix, its length, or a character outside lowercase hex — and never carries the value itself.

Fields

reason: String

FormationPeersUnreadable

MURMUR_FORMATION_PEERS is set in mur run’s own process environment, where nothing legitimately puts it, or a list of peers is not one a guest could be handed.

reason says where the variable was found, or names the pair at fault by its position and what is wrong with it. It never carries the value.

Fields

reason: String

FormationChannelUnreadable

The formation channel MURMUR_FORMATION_CHANNEL names could not be read: the descriptor is not open, its first line did not arrive in time or is not a member’s bundle, or it names another formation.

reason names the problem and never quotes the line: the line carries the member’s formation tokens.

Fields

reason: String

FormationLifelineUnreadable

MURMUR_FORMATION_LIFELINE does not name a lifeline this session can hold: the value is not a pipe’s read end, it was read twice, it came without a formation id, or the session cannot honour one (a script capsule, or a caller that does not own its process).

reason names what is wrong, by descriptor number where there is one.

Fields

reason: String

SpawnerLifelineUnreadable

MURMUR_SPAWNER_LIFELINE does not name a lifeline this session can hold: the value is not a pipe’s read end, it was read twice, or the launch cannot honour one (a caller that does not own its process).

reason names what is wrong, by descriptor number where there is one.

Fields

reason: String

SessionDeadlineUnenforceable

A session staged with a mur run --deadline was launched where the deadline cannot be enforced: by a caller that does not own its process, for a script capsule, or on a platform without the termination routine.

Fields

reason: String

ProcessDriverInterfaceMissing

The artifact a transport: process manifest names under inference.driver exports no version of the murmur:driver/process interface at all, so it is not a process driver. One exporting another version is RuntimeError::WitLevelMismatch instead.

Fields

name: String

version: String

expected: String

WitLevelMismatch

An artifact a launch stages names a murmur:* interface at a version other than the one the WIT level this host serves lists for its package. mismatched holds every such interface, in recorded order, and is never empty.

Fields

name: String

version: String

level: u64

mismatched: Vec<UnservedInterface>

HttpDriverExportsProcessInterface

The artifact a transport: http manifest names under inference.driver exports a murmur:driver/process@* instance, so it drives a CLI rather than an HTTP API.

Fields

name: String

version: String

exported: Vec<String>

DriverStreamInterfaceNotServed

A runtime: driver artifact imports a murmur:stream/* instance at the served version of the package under another interface name than expected, so it names an interface that does not exist. imported holds every such import. A stream or murmur:text/* import at another version is RuntimeError::WitLevelMismatch instead.

Fields

name: String

version: String

imported: Vec<String>

expected: String

ProcessDriverRequiredEnvNotAllowed

A process driver’s describe().required-env names variables the manifest’s capabilities.env.allow does not declare. missing is in the driver’s order, each name once.

Fields

name: String

version: String

missing: Vec<String>

ProcessDriverReportsNoUsage

A spend ceiling is in effect against a process driver whose describe().reports-usage is false, so no turn it drives could ever be counted against that ceiling.

ceilings names each ceiling in effect, in the order the operator would read them: the manifest’s inference.max_session_tokens first, then the effective config’s spend.machine_tokens_per_day.

Fields

name: String

version: String

ceilings: Vec<String>

ProcessDriverLoad

A process driver could not be instantiated with no grants, trapped in describe, or described itself with an unusable required-env name. message is wasmtime’s error, which names an unsatisfied import, or names the unusable variable.

Fields

name: String

version: String

message: String

HarnessBinaryNotFound

The executable a process capsule’s harness runs as could not be resolved at staging. binary_source names where the name came from, so the operator knows which field to change: inference.command, or the process driver’s own describe().

Fields

binary: String

binary_source: String

HarnessTurnFailed

The harness ended a turn in failure. Renders as E_RUN_033. kind is the driver’s failure-kind, spelled as it is in the WIT, or max-turns when this runtime stopped the harness at the attempt’s turn budget; origin distinguishes those two (harness / runtime) and is what the trace’s harness_failed.source records.

Fields

kind: String

message: String

origin: String

HarnessSessionGone

A turn launched mode: resume failed without the harness ever reporting the session it was handed: the conversation this context names is gone from the harness’s own store. Renders as E_RUN_036.

path is the map file that still holds the id, or None on a launch that kept none. The entry is deliberately left as it is — the next task in this context fails the same way rather than quietly starting a new conversation, until somebody asks for it to be dropped with mur run --forget-session or a message whose metadata carries forgetSession: true under the door extension’s key.

Fields

context_id: String

session_id: String

harness: String

path: Option<PathBuf>

detail: String

ForgetSessionUnsupportedTransport

A forget was asked of a capsule that keeps no harness session: only inference.transport: process has one, because only there does a harness own the conversation. Raised at staging, so the launch leaves nothing behind.

transport is the transport the capsule declared, or none for a capsule with no inference: block at all.

Fields

transport: String

ProcessDriverCallFailed

A call into the process driver trapped, ran out of time, or refused. Renders as E_RUN_034. call is the WIT function name; message is the driver’s own refusal or the failure’s description.

Fields

name: String

version: String

call: String

message: String

ProcessHarnessInactive

The harness went quiet: no stdout line and no bridge request for the whole inactivity window, so the runtime killed it rather than waiting on a process that had stopped working. Renders as E_RUN_035.

Fields

seconds: u64

Runtime(String)

Implementations

impl RuntimeError

pub fn artifact_not_found( name: impl Into<String>, version: impl Into<String>, ) -> Self

pub fn artifact_integrity_failed( name: impl Into<String>, version: impl Into<String>, ) -> Self

pub fn wasi(path: PathBuf, message: impl Into<String>) -> Self

Trait Implementations

impl Debug for RuntimeError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for RuntimeError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for RuntimeError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<HomeUnusable> for RuntimeError

fn from(source: HomeUnusable) -> Self

Converts to this type from the input type.

impl From<ModelLimitsError> for RuntimeError

fn from(source: ModelLimitsError) -> Self

Converts to this type from the input type.

impl From<WorkdirError> for RuntimeError

A refusal is RuntimeError::WorkdirPathRefused; any I/O failure is RuntimeError::CreateWorkdir. Use RuntimeError::from_workdir where that variant is wrong.

fn from(error: WorkdirError) -> Self

Converts to this type from the input type.