JuliusBrussee/caveman · error · Error

caveman build: dataResidency is not enforced yet; refusing t

Error message

caveman build: dataResidency is not enforced yet; refusing to ignore residency policy

What it means

Thrown by defineBuild when the build config sets dataResidency. The build system does not yet enforce data-residency policy, and silently accepting a residency constraint it cannot honor would be a false security guarantee — so it refuses the config outright. This is a deliberate fail-closed: the option exists in the type so callers can see it is recognized, but setting it is rejected until enforcement ships.

Source

Thrown at packages/agent/src/build.ts:28

export interface BuildConfig {
  entry: string;
  evals: string;
  efficiency: "max";
  requiredFixturePassRate: number;
  qualityRetention: number;
  maxSearchCostUsd: number;
  lock: "strict";
  sandbox: "required";
  allowedModels?: string[];
  deniedModels?: string[];
  maxP95LatencyMs?: number;
  forbiddenSafetyClasses?: string[];
  dataResidency?: string;
}

export function defineBuild(options: Partial<BuildConfig> & Pick<BuildConfig, "entry" | "evals">): BuildConfig {
  if (options.dataResidency !== undefined) {
    throw new Error(
      "caveman build: dataResidency is not enforced yet; refusing to ignore residency policy",
    );
  }
  const config: BuildConfig = {
    entry: options.entry,
    evals: options.evals,
    efficiency: options.efficiency ?? "max",
    requiredFixturePassRate: options.requiredFixturePassRate ?? 1,
    qualityRetention: options.qualityRetention ?? 0.98,
    maxSearchCostUsd: options.maxSearchCostUsd ?? 2,
    lock: options.lock ?? "strict",
    sandbox: options.sandbox ?? "required",
    ...(options.allowedModels === undefined ? {} : { allowedModels: [...options.allowedModels] }),
    ...(options.deniedModels === undefined ? {} : { deniedModels: [...options.deniedModels] }),
    ...(options.maxP95LatencyMs === undefined ? {} : { maxP95LatencyMs: options.maxP95LatencyMs }),
    ...(options.forbiddenSafetyClasses === undefined ? {} : { forbiddenSafetyClasses: [...options.forbiddenSafetyClasses] }),
  };
  if (!(config.requiredFixturePassRate > 0 && config.requiredFixturePassRate <= 1)) {

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Remove dataResidency from the options until the library enforces it; track the library changelog for the enforcing release.
2. If residency is a hard requirement, enforce it at your own layer: restrict provider/model selection via allowedModels to providers whose regions you have verified.
3. Guard with a version check or feature detection so the config can enable the field automatically once supported.

Example fix

// before
defineBuild({ entry, evals, dataResidency: "eu" });

// after
defineBuild({ entry, evals, allowedModels: ["eu-hosted-model-a"] }); // enforce residency via model allowlist

const supported = (() => { try { defineBuild({ entry: "x", evals: [], dataResidency: "probe" }); return true; } catch { return false; } })();
// wait — this always throws today; instead gate on a feature constant or semver check:
import { version } from "@caveman/agent";
const residencySupported = false; // flip when the enforcing release ships

function buildOptionsWithoutResidency<T extends { dataResidency?: string }>(o: T): Omit<T, "dataResidency"> {
  const { dataResidency: _ignored, ...rest } = o;
  return rest;
}

try {
  defineBuild(options);
} catch (e) {
  if (e instanceof Error && e.message.includes("dataResidency")) {
    throw new Error("dataResidency is not enforced by this version; restrict allowedModels to compliant providers instead");
  }
  throw e;
}

When it happens

Trigger: Passing dataResidency: "eu" (or any value) in the defineBuild options object; merging a shared org config that includes dataResidency into build options; upgrading to a version whose BuildConfig type exposes the field and enabling it speculatively.

Common situations: Compliance-driven teams adding residency constraints preemptively; config templates that enumerate every typed field with placeholder values; porting a config from a tool that does support residency.

Related errors

• caveman build: requiredFixturePassRate must be in (0,1]
• caveman build: qualityRetention must be in (0,1]
• caveman build: config must use strict lock and required sand
• caveman build: invalid .caveman/provider.json
• caveman agent: entry must export default agent()

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/6b0d88d257aef20c. Report an issue: GitHub.