affaan-m/ECC · error · Error

${command} ${args.join(' ')} failed${errorOutput ? `: ${erro

Error message

${command} ${args.join(' ')} failed${errorOutput ? `: ${errorOutput}` : ''}

What it means

before_settle() (alias require_trust) is a policy gate that raises AuraUntrusted when the AURA verdict for the counterparty DID is not in the allowed set. By default only 'trusted' and 'caution' pass; 'high_risk', 'new', and 'unknown' are rejected. fail_open=True only excuses a transport failure (unreachable AURA) — a reachable AURA that returns 'unknown' is still rejected, because absence of evidence is not evidence of trust. The raised exception carries the full AuraVerdict for inspection.

Source

Thrown at scripts/auto-update.js:170

  return normalized;
}

function runExternalCommand(command, args, options = {}) {
  const result = spawnSync(command, args, {
    cwd: options.cwd,
    env: options.env || process.env,
    encoding: 'utf8',
    maxBuffer: 10 * 1024 * 1024
  });

  if (result.error) {
    throw result.error;
  }

  if (typeof result.status === 'number' && result.status !== 0) {
    const errorOutput = (result.stderr || result.stdout || '').trim();
    throw new Error(`${command} ${args.join(' ')} failed${errorOutput ? `: ${errorOutput}` : ''}`);
  }

  return result;
}

function runAutoUpdate(options = {}, dependencies = {}) {
  const discover = dependencies.discoverInstalledStates || discoverInstalledStates;
  const execute = dependencies.runExternalCommand || runExternalCommand;
  const homeDir = options.homeDir || process.env.HOME || os.homedir();
  const projectRoot = options.projectRoot || process.cwd();
  const requestedRepoRoot = options.repoRoot ? validateRepoRoot(options.repoRoot) : null;
  const records = discover({
    homeDir,
    projectRoot,
    targets: options.targets
  }).filter(record => record.exists);

  const results = [];

View on GitHub (pinned to 01e15490f0)

Solutions

Inspect e.verdict (the AuraUntrusted exception carries it) to see the verdict, reason, and score before deciding.
For legitimate onboarding, widen the allow set explicitly: before_settle(did, allow=('trusted','caution','new')).
If you intentionally want transport failures to pass, set fail_open=True — but understand this only excuses unreachable AURA, never a reachable 'unknown'.
If the verdict is 'high_risk', abort the settlement; do not widen allow to include it.

Example fix

# before
before_settle(counterparty_did)  # raises AuraUntrusted for 'new'

# after
try:
    before_settle(counterparty_did)
except AuraUntrusted as e:
    if e.verdict.verdict == 'new' and is_onboarding:
        before_settle(counterparty_did, allow=('trusted','caution','new'))
    else:
        abort(str(e))

Defensive patterns

Strategy: try-catch

Validate before calling

# Inspect the verdict first to decide whether to widen `allow` before gating.
v = aura_verdict(did)
if v.verdict not in ('trusted', 'caution') and is_onboarding_flow and v.verdict == 'new':
    allow = ('trusted', 'caution', 'new')
else:
    allow = ('trusted', 'caution')
before_settle(did, allow=allow, fail_open=fail_open)

Type guard

from integrations.aura.adapter import AuraUntrusted

def is_aura_untrusted(e) -> bool:
    return isinstance(e, AuraUntrusted)

Try / catch

from integrations.aura.adapter import before_settle, AuraUntrusted

try:
    before_settle(counterparty_did)
    settle(counterparty_did)
except AuraUntrusted as e:
    v = e.verdict  # full AuraVerdict: .verdict, .reason, .score, .reachable
    log.warning('trust gate blocked %s (%s): %s', v.did, v.verdict, v.reason)
    abort_settlement(v)

Prevention

Never widen `allow` to include 'high_risk' — that defeats the gate.
Use fail_open=True only for non-critical paths where an AURA outage should not block business.
Log e.verdict.reason on every rejection so you can audit trust decisions later.
Remember fail_open excuses only transport failures, never a reachable 'unknown'.

When it happens

Trigger: Counterparty has verdict 'high_risk'; counterparty is brand new (verdict 'new') under the default allow=('trusted','caution'); AURA is reachable but returns 'unknown' (no history); fail_open=False and AURA is unreachable (network down).

Common situations: Onboarding a new counterparty agent without widening `allow`; attempting to settle with an agent that AURA has flagged; AURA service is down and fail_open was left at its default False.

Related errors

AI-assisted analysis of affaan-m/ECC@01e15490f0 (2026-08-13). Data as JSON: /api/errors/e8a4ae1fab0613bb. Report an issue: GitHub.