{"record":{"id":"9ad27acd5473f21e","repo":"zeroclaw-labs/zeroclaw","slug":"security-nevis-msg","errorCode":null,"errorMessage":"security.nevis: {msg}","messagePattern":"security\\.nevis: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-config/src/schema.rs","lineNumber":22100,"sourceCode":"                \"myself\",\n                \"list_transitions\",\n                \"transition_ticket\",\n                \"create_ticket\",\n            ];\n            for action in &self.jira.allowed_actions {\n                if !valid_actions.contains(&action.as_str()) {\n                    anyhow::bail!(\n                        \"jira.allowed_actions contains unknown action: '{}'. \\\n                         Valid: get_ticket, search_tickets, comment_ticket, list_projects, myself, list_transitions, transition_ticket, create_ticket\",\n                        action\n                    );\n                }\n            }\n        }\n\n        // Nevis IAM — delegate to NevisConfig::validate() for field-level checks\n        if let Err(msg) = self.security.nevis.validate() {\n            anyhow::bail!(\"security.nevis: {msg}\");\n        }\n\n        // Delegate tool global defaults\n        if self.delegate.timeout_secs == 0 {\n            validation_bail!(\n                InvalidNumericRange,\n                \"delegate.timeout_secs\",\n                \"delegate.timeout_secs must be greater than 0\"\n            );\n        }\n        if self.delegate.agentic_timeout_secs == 0 {\n            validation_bail!(\n                InvalidNumericRange,\n                \"delegate.agentic_timeout_secs\",\n                \"delegate.agentic_timeout_secs must be greater than 0\"\n            );\n        }\n","sourceCodeStart":22082,"sourceCodeEnd":22118,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-config/src/schema.rs#L22082-L22118","documentation":"The top-level Config::validate delegates Nevis IAM checks to NevisConfig::validate() and re-wraps any failure as \"security.nevis: {msg}\". This error is a wrapper: the actionable detail is in the {msg} suffix, which names the specific invalid Nevis field (for example missing issuer/audience or malformed URL when Nevis auth is enabled). Fixing it means reading the suffix and correcting the corresponding [security.nevis] key.","triggerScenarios":"Enabling security.nevis with incomplete or malformed field values; any invalid combination inside the Nevis section surfaces here with the field-level message appended; programmatic config mutation that writes an invalid NevisConfig and then calls validate().","commonSituations":"Enabling Nevis IAM mid-setup before all required fields are filled; copy-pasting a Nevis config between environments where a URL or audience differs; version upgrades that add new required Nevis fields not present in the old config.","solutions":["Read the text after 'security.nevis:' — it names the exact field and constraint that failed","Fix the indicated [security.nevis] key in config.toml","If the message mentions a required-when-enabled field, either supply it or set the Nevis feature flag off","Re-run `zeroclaw` config validation (or your app's config load) to confirm the whole section now passes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match cfg.validate() {\n    Err(e) => {\n        let msg = e.to_string();\n        if let Some(detail) = msg.strip_prefix(\"security.nevis: \") {\n            eprintln!(\"Nevis config invalid: {detail}\");\n            // surface detail to the operator, not just the wrapper\n        }\n    }\n    Ok(()) => {}\n}","preventionTips":["When enabling Nevis, run `zeroclaw` config validation before restarting the daemon","Keep [security.nevis] blocks templated per-environment and validate all templates in CI","On upgrade, diff the Nevis section against current docs — new required fields surface through this same wrapper"],"tags":["nevis","security","config","validation","iam"],"backgroundTag":"config-validation-failed","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}