controller

var ErrApprovalBlocked = errors.New("controller: unresolved approval blocks a new execution")

ErrApprovalBlocked rejects a new turn while this session owns an approval intent without receipt.

var ErrApprovalReceiptReport = errors.New("controller: approval receipts are host owned")

ErrApprovalReceiptReport rejects harness reports and ordinary executor replies carrying host-owned approval receipt fields or unsupported result codes.

var ErrApprovalUnavailable = errors.New("controller: approval requires STATELESS_REPLAY")

ErrApprovalUnavailable is returned by Exec, Resume and Replay for approval on a non-STATELESS_REPLAY harness, or when replay/recovery reproduces a historical pre-intent approval rejection without consuming a different call's evidence.

var ErrHarnessDescribeFailed = errors.New("controller: describe harness failed")

ErrHarnessDescribeFailed identifies failure to Describe the supplied harness before execution. The original cause is retained for callers to distinguish cancellation from endpoint failure.

var ErrHarnessMismatch = errors.New("controller: harness does not match recorded invocation")

ErrHarnessMismatch rejects replay/recovery with a different resolved harness name.

var ErrHarnessVersionMismatch = errors.New("controller: harness version does not match recorded invocation")

ErrHarnessVersionMismatch rejects replay/recovery when a nonempty recorded harness version differs from the supplied harness's advertised version, including an empty advertised version.

var ErrIncompleteInvocation = fmt.Errorf("%w: incomplete invocation", ErrInvalidExecutionLog)

ErrIncompleteInvocation identifies an unfinished trailing turn whose inputs were only partly committed. It wraps ErrInvalidExecutionLog; the caller can retry with Exec and all inputs.

var ErrInheritedToolIntent = fmt.Errorf("%w: inherited tool intent cannot be resumed", ErrInvalidExecutionLog)

ErrInheritedToolIntent rejects recovery of a forked execution whose copied prefix contains an unresolved tool intent. Re-driving it under the child's UID could repeat the parent's effect.

var ErrInvalidApprovalCall = errors.New("controller: invalid approval call identity")

ErrInvalidApprovalCall rejects missing or reused gated call identities before intent is written.

var ErrInvalidApprovalDecision = errors.New("controller: invalid approval decision")

ErrInvalidApprovalDecision identifies a missing, wrong, superseded, inherited, or changed decision tuple. It is distinct from corrupt recorded evidence and operational store failures.

var ErrInvalidExecutionLog = errors.New("controller: invalid execution log")

ErrInvalidExecutionLog is returned when modern execution-scoped events lack execution identity, a legacy-to-modern boundary is ambiguous, or a start marker cannot establish a complete invocation. Replay and resume reject such turns before running the harness.

var ErrMissingIdempotencyKey = errors.New("controller: CONTROLLER_MEDIATED tool call requires an idempotency key")

ErrMissingIdempotencyKey rejects a CONTROLLER_MEDIATED tool call that omits the idempotency key the crash-recovery re-drive needs to dedup its side effect (I3). Without a key, at-most-once silently would not hold, so the host fails loud rather than record an unrecoverable intent. The remaining key contract (generation, TTL) is the §10 spike; this is the minimal guard.

var ErrMissingSessionUID = errors.New("controller: a session UID is required")

ErrMissingSessionUID rejects an unscoped tool executor or a selected legacy harness invocation whose compatibility identity cannot be scoped to a session.

var ErrMissingToolExecutor = errors.New("controller: no tool executor configured")

ErrMissingToolExecutor is a recoverable host precondition, not an executor-failure receipt.

var ErrReplayDiverged = errors.New("controller: replay diverged from the journal")

ErrReplayDiverged is returned when replay or recorded-prefix recovery diverges from the journal: tool request identity or result correlation differs, required tool evidence is missing, or the harness leaves recorded effects unconsumed.

var ErrReplayInvokedModel = errors.New("controller: replay invoked the model (I1 violated)")

ErrReplayInvokedModel is returned when a replay caused a live model call — an I1 violation.

var ErrSinkClosed = errors.New("controller: invocation sink is closed")

ErrSinkClosed rejects effects from a retained sink after its Run has returned.

var ErrUnmediatedToolCall = errors.New("controller: ToolCall requires a host-mediated tier")

ErrUnmediatedToolCall rejects a ToolCall whose mediation tier is not host-executed. ToolCall is only for CONTROLLER_MEDIATED and REQUIRES_APPROVAL; an UNSPECIFIED or IN_HARNESS_REPORTED call must not execute here (the latter uses Report), so it is rejected before anything is recorded — closing the keyless-execute bypass.