Enum DispatchError 

pub enum DispatchError {
    UnsupportedScheme(String),
    MalformedUrl(String),
    RepositoryNotFound {
        identity: String,
        origin: String,
    },
    NoHead,
    Interrupted,
    UploadInterrupted(String),
    Transport(TransportError),
    Refs(RefError),
    RepoLock(LockError),
    Discover(DiscoverError),
    Io(Error),
    Store(StoreError),
    Pack(PackError),
    PackList(PackListError),
    SshInit(SshInitError),
    DetachedHead,
    RemoteBranchMissing(String),
    NonFastForwardPull {
        branch: String,
    },
    RestoreSafety(String),
    NotCommit,
    Restore(RestoreError),
    UntrustedRemote(String),
    NonFastForwardPush {
        branch: String,
    },
    PackmapContended {
        branch: String,
    },
    PackChainInvalid {
        branch: String,
    },
    PackmapMissing(String),
    AdvertisedPackMissing {
        branch: String,
        pack: String,
    },
    RemoteMissingObject(String),
    ClosureTooLarge(usize),
    UnsignedOrInvalidObject {
        hash: String,
        reason: String,
    },
    InvalidRemoteName(String),
    PushTooLarge {
        packs: usize,
        limit: usize,
        commit: Option<String>,
        holds_remote_head: bool,
    },
    RetryTooLarge {
        reason: RetryReason,
        packs: usize,
        limit: usize,
    },
    PushSplitLimit(String),
    PushNotAuthorized(String),
    SplitInterrupted {
        branch: String,
        head: String,
        published: usize,
        total: usize,
        cause: Box<DispatchError>,
    },
    TicketRejected,
    DeltaBaseUnavailable,
    PacklistNotInRepository,
}

Errors returned by the push / pull helpers. Mapped to exit codes by the commands themselves.

Variants

UnsupportedScheme(String)

MalformedUrl(String)

RepositoryNotFound

Fields

identity: String

origin: String

NoHead

Interrupted

A poll-loop checkpoint observed signal::is_shutdown() == true and aborted partway through. Callers should map this to exit::TEMPFAIL (75) so retries are safe — the transfer is half-finished but the remote is unmodified for any ref we hadn’t reached yet.

UploadInterrupted(String)

Transport(TransportError)

Refs(RefError)

RepoLock(LockError)

Discover(DiscoverError)

Io(Error)

Store(StoreError)

Pack(PackError)

PackList(PackListError)

SshInit(SshInitError)

DetachedHead

RemoteBranchMissing(String)

NonFastForwardPull

Fields

branch: String

RestoreSafety(String)

NotCommit

Restore(RestoreError)

UntrustedRemote(String)

The per-endpoint credential-trust gate (#97) refused to build a credential-bearing transport for a repo-chosen endpoint the user has not explicitly trusted. The wrapped string is the actionable message produced by crate::config::endpoint_credential_trust.

NonFastForwardPush

A CAS ref write was rejected because the remote moved under us (non-fast-forward). Callers map this to an actionable fetch-then-retry / --force-with-lease hint.

Fields

branch: String

PackmapContended

The branch’s packmap pointer could not be durably advanced under sustained concurrent pushes. The branch ref was NOT moved, so the remote stays consistent; the push is safe to retry.

Fields

branch: String

PackChainInvalid

A packmap chain was malformed — it exceeded the depth cap, contained a cycle, or a node could not be downloaded/decoded. Indicates a corrupt or hostile remote.

Fields

branch: String

PackmapMissing(String)

The remote advertised a branch ref but no packmap (refs/mkit/packmap/<branch>) for it. mkit speaks a single, packmap-only transfer dialect: the push path ALWAYS advertises a packmap before moving the branch ref, so a branch with a tip but no packmap is a corrupt/incomplete remote, not a format we degrade to. We refuse to fetch rather than silently materialise a partial ref.

AdvertisedPackMissing

The packmap advertised a pack the remote does not hold. The branch’s closure cannot be reconstructed, so the fetch is aborted rather than publishing a ref to an incomplete history.

Fields

branch: String

pack: String

RemoteMissingObject(String)

After unpacking the branch’s whole packmap chain, an object reachable from the fetched tip is still absent from the local store — the chain did not deliver the full closure. This is a pure integrity assertion (no recovery download is attempted): the remote’s packmap is incomplete, so fetch aborts before publishing the ref.

ClosureTooLarge(usize)

The fetched tip’s object closure exceeds the mkit_core::ops::graph::MAX_REACHABLE verification cap, so completeness could not be confirmed. On the applied-pack skip path (#409) this closure walk is the sole guarantee the local store is whole; a truncated walk could silently pass over missing objects, so we fail closed rather than publish a ref we can’t fully verify. This is NOT a self-heal trigger.

UnsignedOrInvalidObject

A commit/remix/tag newly introduced by this fetch failed Ed25519 signature verification via mkit_core::sign::verify_commit / verify_remix / verify_tag — the exact check mkit verify <rev> runs manually (issue #692). A hostile remote (THREAT-MODEL §3.1) can otherwise push an unsigned or forged history that clone/pull/ fetch would silently materialise. Deliberately distinct from RemoteMissingObject so it does NOT feed the applied-pack self-heal retry (#409): an invalid signature is not evidence of local staleness, and clearing the applied-packs record would not make a hostile remote’s history valid. Fails closed by default; opt out with --no-verify-signatures or the user-scoped pull.require_signed = false config (never settable from repo-scoped config — see crate::config::REPO_FORBIDDEN_KEYS).

Fields

hash: String

reason: String

InvalidRemoteName(String)

A remote name passed to the applied-packs record (#409) is not a legal ref name (per mkit_core::refs::validate_ref_name). A remote name is a ref name, so this should never occur for a config-registered remote; it is defence-in-depth against a malformed name being used as a raw path component under .mkit/applied-packs/.

PushTooLarge

One advance would need more data packs than the server permits per advance. commit names the single commit or merge that cannot be split further when the refusal came from the pre-flight dry seal, before anything was published; without it the seal-time backstop fired.

Fields

packs: usize

limit: usize

commit: Option<String>

holds_remote_head: bool

The unsplittable commit is the first that contains the remote head, so the split could not cut before it.

RetryTooLarge

A retry of one advance (a rejected ticket, a lost delta base) re-planned the push and the new plan no longer fits one advance. Found by a dry seal, so nothing was uploaded for the retry.

Fields

reason: RetryReason

packs: usize

limit: usize

PushSplitLimit(String)

A split push would exceed a bound (steps or chain length). Nothing was published.

PushNotAuthorized(String)

The stored grants do not authorize every advance of a split push. Nothing was published.

SplitInterrupted

A split push failed after publishing some advances. head is the last advance this push published, a first-parent ancestor of the local tip (another pusher may have moved the branch since); re-running the push resumes from the remote branch unless a concurrent push caused the failure.

Fields

branch: String

head: String

published: usize

total: usize

cause: Box<DispatchError>

TicketRejected

DeltaBaseUnavailable

PacklistNotInRepository

Implementations

impl DispatchError

pub fn into_published_prefix(self) -> (Self, Option<PublishedPrefix>)

The error a split push failed with, without its published-prefix wrapper, and that prefix (None when no advance of this branch was published).

Trait Implementations

impl Debug for DispatchError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for DispatchError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for DispatchError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<DiscoverError> for DispatchError

fn from(source: DiscoverError) -> Self

Converts to this type from the input type.

impl From<Error> for DispatchError

fn from(source: Error) -> Self

Converts to this type from the input type.

impl From<LockError> for DispatchError

fn from(source: LockError) -> Self

Converts to this type from the input type.

impl From<PackError> for DispatchError

fn from(source: PackError) -> Self

Converts to this type from the input type.

impl From<PackListError> for DispatchError

fn from(source: PackListError) -> Self

Converts to this type from the input type.

impl From<RefError> for DispatchError

fn from(source: RefError) -> Self

Converts to this type from the input type.

impl From<RestoreError> for DispatchError

fn from(source: RestoreError) -> Self

Converts to this type from the input type.

impl From<SshInitError> for DispatchError

fn from(source: SshInitError) -> Self

Converts to this type from the input type.

impl From<StoreError> for DispatchError

fn from(source: StoreError) -> Self

Converts to this type from the input type.

impl From<TransportError> for DispatchError

fn from(source: TransportError) -> Self

Converts to this type from the input type.