{"record":{"id":"1c9c67410a2d5e80","repo":"zeroclaw-labs/zeroclaw","slug":"config-contains-malformed-security-critical-sectio","errorCode":null,"errorMessage":"Config contains malformed security-critical sections ({sections}); they were reset to defaults, so the running posture may be weaker than intended. Refusing to serve with a degraded security posture. Repair these sections in {} and restart — run `zeroclaw config migrate` to see the precise error. To boot anyway (e.g. to reach the gateway config editor and repair from there), re-run with `--allow-degraded-security`.","messagePattern":"Config contains malformed security-critical sections \\((.+?)\\); they were reset to defaults, so the running posture may be weaker than intended\\. Refusing to serve with a degraded security posture\\. Repair these sections in (.+?) and restart — run `zeroclaw config migrate` to see the precise error\\. To boot anyway \\(e\\.g\\. to reach the gateway config editor and repair from there\\), re-run with `--allow-degraded-security`\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"src/main.rs","lineNumber":7777,"sourceCode":"    }\n    ::zeroclaw_log::record!(\n        WARN,\n        ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Note)\n            .with_outcome(::zeroclaw_log::EventOutcome::Unknown),\n        \"verifiable_intent: vi_verify is not registered as a model-callable tool because no credential chain verifier exists yet (see #9328)\"\n    );\n}\n\nfn gate_security_posture(\n    config: &zeroclaw::config::Config,\n    allow_degraded: bool,\n) -> anyhow::Result<Option<tokio::task::JoinHandle<()>>> {\n    if config.degraded_security.is_empty() {\n        return Ok(None);\n    }\n    let sections = config.degraded_security.join(\", \");\n    if !allow_degraded {\n        anyhow::bail!(\n            \"Config contains malformed security-critical sections ({sections}); \\\n             they were reset to defaults, so the running posture may be weaker \\\n             than intended. Refusing to serve with a degraded security posture. \\\n             Repair these sections in {} and restart — run `zeroclaw config \\\n             migrate` to see the precise error. To boot anyway (e.g. to reach \\\n             the gateway config editor and repair from there), re-run with \\\n             `--allow-degraded-security`.\",\n            config.config_path.display()\n        );\n    }\n    let config_path = config.config_path.display().to_string();\n    let handle = ::zeroclaw_spawn::spawn!(async move {\n        let mut ticker = tokio::time::interval(std::time::Duration::from_secs(30));\n        loop {\n            ticker.tick().await;\n            ::zeroclaw_log::record!(\n                WARN,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Note)","sourceCodeStart":7759,"sourceCodeEnd":7795,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/src/main.rs#L7759-L7795","documentation":"ZeroClaw refuses to start serving when one or more security-critical config sections failed to parse and were silently reset to their defaults (tracked in the config.degraded_security list). The guard (see the is_empty() early-return in the SOURCE) only fires when that list is non-empty and the caller did not pass allow_degraded. Refusing to serve prevents an accidentally weakened posture (e.g. permissive defaults) from being mistaken for the operator's intended policy.","triggerScenarios":"Starting the gateway/serving path with a config file where a security-critical section (auth, permissions, sandbox, allowlists, etc.) has a syntax error, unknown keys, or invalid values. The config loader resets those sections to defaults, records their names in degraded_security, and this bail fires on boot unless the process was started with --allow-degraded-security.","commonSituations":"Hand-editing the TOML config and introducing a typo; upgrading ZeroClaw to a version that changed a security section's schema so the old file no longer parses; merging config changes from another machine; CI environments regenerating configs from stale templates.","solutions":["Run `zeroclaw config migrate` to see the precise parse error and which sections are affected","Fix the reported sections in the config file shown in the error message and restart","If the config was hand-edited, validate the section syntax against the current schema (config migrate reports exact positions)","As a last resort to reach the gateway config editor and repair from there, re-run with `--allow-degraded-security`, then fix and restart without the flag"],"exampleFix":"# before (config.toml with a malformed security section)\n[security]\nallow = \"not-a-valid-list   # unterminated / wrong type\n\n# after\n[security]\nallow = [\"127.0.0.1\"]\n\n# then verify\nzeroclaw config migrate   # reports the exact error and fixed shape","handlingStrategy":"validation","validationCode":"// Before starting the gateway, inspect the parsed config the same way the guard does:\nif !config.degraded_security.is_empty() {\n    eprintln!(\"degraded security sections: {}\", config.degraded_security.join(\", \"));\n    // refuse to proceed, or run `zeroclaw config migrate` programmatically for details\n    return Ok(());\n}","typeGuard":null,"tryCatchPattern":"// When orchestrating zeroclaw as a child process, match the distinctive prefix:\nlet msg = err.to_string();\nif msg.starts_with(\"Config contains malformed security-critical sections\") {\n    // surface to the operator; do NOT auto-pass --allow-degraded-security without consent\n}","preventionTips":["Validate configs with `zeroclaw config migrate` in CI before deploying","Treat any degraded_security entry as a deploy blocker in health checks","Never leave --allow-degraded-security in long-lived service definitions","After schema-changing upgrades, run config migrate before restart"],"tags":["config","security","startup","boot-gate"],"backgroundTag":"config-validation-failed","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}