Enum RunnerError 

pub enum RunnerError {
    IrHashMismatch {
        declared: Hash,
        computed: Hash,
    },
    StepHashMismatch {
        step_id: StepId,
        domain: &'static str,
        declared: Hash,
        computed: Hash,
    },
    NotInM0Subset {
        step_id: Option<StepId>,
        construct: String,
    },
    InvalidHumanStep {
        step_id: StepId,
        reason: String,
    },
    CallDepthExceeded {
        depth: usize,
        max: usize,
    },
    SubflowRegistry {
        detail: String,
    },
    CapabilityDrift {
        expected: Hash,
        attested: Hash,
    },
    InvalidParams {
        reason: String,
    },
    OldIrMismatch {
        expected: Hash,
        computed: Hash,
    },
    RequiresConfirmation {
        report: Box<AlignmentReport>,
    },
    M0Unsupported {
        detail: String,
    },
    EvidenceIntegrity {
        asset_id: String,
        expected: String,
        actual: String,
    },
    Store(StoreError),
    Provider(ProviderError),
}

Runner-level typed error (thiserror). Step-level failures are not errors — they fold into verdicts and the run finishes; this enum covers refusals (load checks, capability drift, M0 subset, resume gates) and infrastructure failures (store, provider).

Variants

IrHashMismatch

The FlowIR’s stored irHash does not match recomputation (load check, spine §1.2: the runner recomputes and compares).

Fields

declared: Hash

The hash stored on the FlowIR.

computed: Hash

The hash recomputed from the FlowIR content.

StepHashMismatch

A step’s stored effectHash/judgeHash does not match recomputation (the artifact is self-checkable, 02 §12.2).

Fields

step_id: StepId

The offending step.

domain: &'static str

"effect" or "judge".

declared: Hash

The hash stored on the step.

computed: Hash

The hash recomputed from the step content.

NotInM0Subset

The IR uses a construct outside the current execution subset — fail-closed, never silently skipped. The vocabulary that remains outside: the re-invocation dispositions on call/human hosts (07 §1’s attempt-framed re-call and the fresh-request re-ask), which the load gate keeps as typed refusals.

Fields

step_id: Option<StepId>

The offending step, when the construct is step-scoped.

construct: String

The refused construct, human-readable.

InvalidHumanStep

A human step’s declared shape is inconsistent (runtime defense line against hand-built IR; the compiler check phase refuses these first): confirm without exactly two decision labels, judge decisions outside the three-valued vocabulary, or provideInput without an outputSchema (06 §2.2).

Fields

step_id: StepId

The offending step.

reason: String

What exactly is wrong.

CallDepthExceeded

The static call closure exceeds maxCallDepth (07 §1.3: 8 frames including the root; the compiler already refuses this — the load check is the runtime defense against hand-built IR).

Fields

depth: usize

The offending static depth (frames, root included).

max: usize

The pinned maximum.

SubflowRegistry

The subflow registry handed to the runner does not close over the IR’s subflows pins (a call target is missing, a hash key does not self-verify, or a pin disagrees with the flow’s own table).

Fields

detail: String

What exactly is wrong, human-readable.

CapabilityDrift

The session attestation does not match the IR’s lockfileDigest (spine §4.1/§5 capability_drift): refuse to run or resume, never silently degrade.

Fields

expected: Hash

The digest the IR was bound against.

attested: Hash

The digest the live session attested.

InvalidParams

The run params are not usable (not an object, or a required param without default is missing).

Fields

reason: String

What is wrong with the params.

OldIrMismatch

The supplied old FlowIR is not the IR the run executed.

Fields

expected: Hash

The irHash recorded in the checkpoint.

computed: Hash

The irHash recomputed from the supplied old IR.

RequiresConfirmation

Re-execution of already-effective mutating steps requires explicit human authorization (07 §5.4 unified gate). Fails closed; the author releases entries by naming them in ResumeOptions::allow_mutating_reexec (the CLI’s repeatable --allow-mutating-reexec <stepId>). The report carries whatever remains gated.

Fields

report: Box<AlignmentReport>

The alignment report whose requiresConfirmation entries name the gated steps.

M0Unsupported

A combination that is valid in the design but deliberately not implemented in M0 (each site documents the pending incorporation).

Fields

detail: String

What exactly is unsupported.

EvidenceIntegrity

Localized evidence bytes do not match the provider-declared sha256 (04 §4.3: evidence integrity is non-negotiable).

Fields

asset_id: String

The provider asset id.

expected: String

The sha256 the provider declared.

actual: String

The sha256 of the bytes actually fetched.

Store(StoreError)

Store-layer failure (SQLite / fold / IO).

Provider(ProviderError)

Provider-layer failure outside an action terminal (e.g. reconcile or verdict write-back failed).

Trait Implementations

impl Debug for RunnerError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for RunnerError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for RunnerError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<ProviderError> for RunnerError

fn from(source: ProviderError) -> Self

Converts to this type from the input type.

impl From<StoreError> for RunnerError

fn from(source: StoreError) -> Self

Converts to this type from the input type.