{"record":{"id":"852371b5533e6a00","repo":"astrid-runtime/astrid","slug":"kernel-rejected-request-msg-852371","errorCode":null,"errorMessage":"kernel rejected request: {msg}","messagePattern":"kernel rejected request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-uplink/src/admin_client.rs","lineNumber":288,"sourceCode":"            request_id: Some(request_id.clone()),\n            request,\n        })\n        .context(\"Failed to serialize AgentDeriveKernelRequest\")?;\n        self.send_and_wait(topic, want_response, request_id, payload)\n            .await\n    }\n}\n\n/// Convert an [`AdminResponseBody`] into a `Result`, lifting `Error`\n/// variants into `Err` so the caller can use `?` for cross-tenant\n/// permission denials and validation failures.\n///\n/// # Errors\n/// Returns an error wrapping the kernel's error message when the\n/// response body is [`AdminResponseBody::Error`].\npub fn into_result(body: AdminResponseBody) -> Result<AdminResponseBody> {\n    match body {\n        AdminResponseBody::Error(msg) => Err(anyhow!(\"kernel rejected request: {msg}\")),\n        other => Ok(other),\n    }\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use astrid_core::PrincipalId;\n\n    #[test]\n    fn topic_suffixes_match_kernel_constants() {\n        assert_eq!(\n            topic_suffix(&AdminRequestKind::AgentCreate {\n                name: \"x\".into(),\n                groups: vec![],\n                grants: vec![],\n                inherit_from: None,\n                clone_from: None,","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-uplink/src/admin_client.rs#L270-L306","documentation":"Raised by the public helper `into_result` in `astrid-uplink/src/admin_client.rs:288`, which normalizes admin-plane IPC responses: when the kernel answers an admin request with `AdminResponseBody::Error(msg)`, the message is wrapped into an `anyhow` error. This is the standard conversion point at which a server-side rejection becomes a Rust `Result::Err` for the caller.","triggerScenarios":"Specifically: calling `into_result(body)` where `body` is `AdminResponseBody::Error(msg)`. The kernel processed an admin request over the IPC channel but rejected it, returning an error body instead of a success payload (e.g. unknown admin command, invalid arguments, unauthorized operation).","commonSituations":"Administrative commands issued against a kernel that disagrees on the request schema (version skew between client and daemon); an admin action the current session token is not permitted to perform; a typo'd or unsupported admin verb; the kernel rejecting a request whose parameters violate kernel-side validation.","solutions":["Read the embedded `{msg}` from the kernel — it states the concrete rejection reason; fix the admin request accordingly.","Verify client and kernel versions match; re-run after upgrading the astrid daemon/client to the same release.","Check the session token/permissions for the requested admin operation.","Confirm the admin command name and payload shape against the current AdminResponseBody schema.","Match on the message text or retry with corrected arguments rather than blind retries — this error is deterministic, not transient."],"exampleFix":"// before\nlet resp = kernel_round_trip(message).await?;\nlet value = admin_client::into_result(resp)?;\n// after\nlet resp = kernel_round_trip(message).await?;\nlet value = admin_client::into_result(resp).map_err(|e| {\n    eprintln!(\"admin request rejected by kernel: {e:#}\");\n    e\n})?;","handlingStrategy":"try-catch","validationCode":"// Validate the admin request before sending\nensure!(!command.is_empty(), \"admin command must not be empty\");\n// confirm the kernel advertises support for the admin command, if such a capability call exists","typeGuard":"fn is_error_body(body: &AdminResponseBody) -> Option<&str> {\n    match body {\n        AdminResponseBody::Error(msg) => Some(msg),\n        _ => None,\n    }\n}","tryCatchPattern":"let body = admin_client::into_result(resp).map_err(|e| {\n    eprintln!(\"kernel rejected admin request: {e:#}\");\n    e\n})?;","preventionTips":["Keep the admin client and kernel daemon on matching versions.","Validate admin command names and payload shapes against the current schema before sending.","Handle the error body explicitly instead of assuming success responses.","Check session permissions for privileged admin operations up front."],"tags":["kernel","ipc","admin","rpc"],"backgroundTag":"http-error-response","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}