Enum RuntimeError 

pub enum RuntimeError {
    ArtifactNotFound {
        name: String,
        version: String,
    },
    ArtifactIntegrityFailed {
        name: String,
        version: String,
    },
    LockMissingEntry {
        name: String,
    },
    LockVersionMismatch {
        name: String,
        requested: String,
        pinned: String,
    },
    ArtifactArchive {
        name: String,
        version: String,
        message: String,
    },
    ToolComponentCompile {
        name: String,
        version: String,
        message: String,
    },
    CapsuleCompile(String),
    CreateWorkdir {
        path: String,
        source: Error,
    },
    WriteToolManifest {
        path: String,
        source: Error,
    },
    SystemPromptFileRead {
        path: String,
        source: Error,
    },
    CompactionSystemPromptFileRead {
        path: String,
        source: Error,
    },
    SystemPromptArtifactRead {
        name: String,
        source: Error,
    },
    SkillSourceNotFound {
        path: String,
    },
    SkillSourceMissingSkillMd {
        path: String,
    },
    SkillSourceRead {
        path: String,
        source: Error,
    },
    InvalidNetworkAllowEntry {
        entry: String,
        message: String,
    },
    InvalidFilesystemScope {
        scope: String,
        message: String,
    },
    ContainmentFloorUnmet {
        declared: ContainmentClass,
        achieved: ContainmentClass,
        reason: String,
    },
    StagedRuntimeRequiresSealed {
        binaries: Vec<String>,
        declared: ContainmentClass,
    },
    ShellBinaryPackageUnreachable {
        entries: Vec<UnreachableEntrypoint>,
    },
    SealedRootConstructionFailed {
        detail: String,
    },
    EgressNamespaceUnavailable {
        blocker: EgressNamespaceBlocker,
        reason: String,
    },
    CapsuleExportMissing,
    ToolExportMissing {
        name: String,
    },
    CapsuleTrap(String),
    CapsuleDeadlineExceeded {
        seconds: u64,
    },
    CapsuleResourceLimit {
        message: String,
    },
    ShellResourceLimitExceeded {
        binary: String,
        limit: String,
        detail: String,
    },
    CgroupDelegationUnavailable {
        reason: String,
    },
    WorkdirSizeExceeded {
        max_bytes: u64,
        observed_bytes: u64,
    },
    WasiInit {
        path: String,
        message: String,
    },
    DriverNotConfigured,
    DriverNotInstalled(String),
    AgentLoopFailed(String),
    PortInUse {
        port: u16,
    },
    Runtime(String),
}

Variants

ArtifactNotFound

Fields

name: String

version: String

ArtifactIntegrityFailed

Fields

name: String

version: String

LockMissingEntry

Fields

name: String

LockVersionMismatch

Fields

name: String

requested: String

pinned: String

ArtifactArchive

Fields

name: String

version: String

message: String

ToolComponentCompile

Fields

name: String

version: String

message: String

CapsuleCompile(String)

CreateWorkdir

Fields

path: String

source: Error

WriteToolManifest

Fields

path: String

source: Error

SystemPromptFileRead

Fields

path: String

source: Error

CompactionSystemPromptFileRead

Fields

path: String

source: Error

SystemPromptArtifactRead

Fields

name: String

source: Error

SkillSourceNotFound

Fields

path: String

SkillSourceMissingSkillMd

Fields

path: String

SkillSourceRead

Fields

path: String

source: Error

InvalidNetworkAllowEntry

Fields

entry: String

message: String

InvalidFilesystemScope

Fields

scope: String

message: String

ContainmentFloorUnmet

The declared containment floor is stronger than what this host’s kernel can back. Raised in the stage/launch seam, before any registry pull, component compile or workdir creation — achieved always comes from a live host probe, never from the manifest.

Fields

declared: ContainmentClass

achieved: ContainmentClass

reason: String

StagedRuntimeRequiresSealed

A capsule declares capabilities.shell.staged_runtime without an effective sealed containment floor.

Deliberately distinct from Self::ContainmentFloorUnmet: that one compares the declared floor against what the host can back, and its remedy is to lower the floor or move hosts. This one is decided against the declared floor alone and never looks at the host at all, so it fires identically on a machine that could deliver sealed — a staged runtime has no composed root to be staged into unless the capsule asked for one, and quietly launching it without the mount would leave the interpreter simply absent. Its remedy is to raise the declared floor (or drop the grant), which is the opposite advice.

binaries names every offending staged_runtime binary so the operator does not have to re-run to find the second one.

Fields

binaries: Vec<String>

declared: ContainmentClass

ShellBinaryPackageUnreachable

A sealed capsule allowlists a script whose interpreter’s package tree nothing declared could make reachable inside the composed root.

Deliberately distinct from Self::StagedRuntimeRequiresSealed, which it sits next to in stage_session: that one fires when a grant was declared at too low a floor, this one fires when no grant was declared at all and the floor is already sealed. Their remedies point in opposite directions — raise the floor there, add a grant here.

entries names every offending allowlist entry so an operator fixing this does not have to re-run to discover the second script, following the same precedent.

Fields

entries: Vec<UnreachableEntrypoint>

SealedRootConstructionFailed

A sealed session’s composed root could not be built in the forked child, after the pre-launch probe reported the mechanism available.

Deliberately distinct from Self::ContainmentFloorUnmet: that one is a refusal decided before anything is staged, on a host that never claimed to offer sealed. This one is a host that claimed it and then failed to deliver — a race, a mount table that changed under the runtime, or an edge case the cheap probe cannot catch. Conflating the two would tell an operator to lower their declared floor when the real answer is that something moved.

detail is the message the child wrote to the pre_exec diagnostic pipe, which names the exact step (unshare, a specific bind mount, pivot_root) and its errno.

Fields

detail: String

EgressNamespaceUnavailable

This host cannot give a capsule’s native subprocess tree its own network namespace, so the egress boundary that mediates capabilities.network.allow cannot be built.

Raised before any registry pull, component compile or workdir creation, and raised for every Linux capsule that can spawn a subprocess — including one whose capabilities.network.allow is empty. That breadth is the point: with the namespace missing, an empty allowlist would mean unrestricted egress rather than none, because the seccomp connect/sendto interception that used to back it was deleted as unsound rather than kept as a fallback. There is deliberately no path that continues at reduced enforcement.

Deliberately distinct from Self::ContainmentFloorUnmet, which this would otherwise look like: that one compares a declared containment class against what the host can back, and its remedy is to lower the declared floor. A network namespace is not part of the containment ladder — every class needs it equally — so lowering the floor fixes nothing here, and offering that advice would be actively misleading.

Fields

blocker: EgressNamespaceBlocker

reason: String

CapsuleExportMissing

ToolExportMissing

Fields

name: String

CapsuleTrap(String)

CapsuleDeadlineExceeded

Fields

seconds: u64

CapsuleResourceLimit

Fields

message: String

ShellResourceLimitExceeded

Fields

binary: String

limit: String

detail: String

CgroupDelegationUnavailable

Fields

reason: String

WorkdirSizeExceeded

Fields

max_bytes: u64

observed_bytes: u64

WasiInit

Fields

path: String

message: String

DriverNotConfigured

DriverNotInstalled(String)

AgentLoopFailed(String)

PortInUse

Fields

port: u16

Runtime(String)

Implementations

impl RuntimeError

pub fn artifact_not_found( name: impl Into<String>, version: impl Into<String>, ) -> Self

pub fn artifact_integrity_failed( name: impl Into<String>, version: impl Into<String>, ) -> Self

pub fn wasi(path: PathBuf, message: impl Into<String>) -> Self

Trait Implementations

impl Debug for RuntimeError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for RuntimeError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for RuntimeError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.