{"record":{"id":"a339f6401af58829","repo":"paperclipai/paperclip","slug":"https-exposure-failed-code-provisioned-err","errorCode":null,"errorMessage":"HTTPS exposure failed: ${code} — ${provisioned.errorDetail}","messagePattern":"HTTPS exposure failed: (.+?) — (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/src/services/workspace-runtime.ts","lineNumber":6000,"sourceCode":"    releasePortReservation(reservedPort);\n    releasePortReservation(claimedIdentityPort);\n    if (record.exposureConfig && record.exposureHandle && record.port) {\n      const provisioned = await provisionExposure(workspaceRuntimeExposureDeps, {\n        runtimeId: record.id,\n        config: record.exposureConfig,\n        handle: record.exposureHandle,\n        hostname: exposureHostname!,\n        appPort: record.port,\n      });\n      record.exposure = provisioned.status;\n      record.exposureHandle = provisioned.handle;\n      record.url = provisioned.status.publicUrl;\n      await persistRuntimeServiceRecord(record.db, record);\n      if (provisioned.status.state !== \"ready\" || !record.url) {\n        // Carry the reason, not just the code: a bare `listener_ownership_mismatch`\n        // in the operation log is what made PAP-17254 undiagnosable (PAP-17256).\n        const code = provisioned.status.lastError ?? \"unknown error\";\n        throw new Error(\n          `HTTPS exposure failed: ${code}${provisioned.errorDetail ? ` — ${provisioned.errorDetail}` : \"\"}`,\n        );\n      }\n    }\n    // Transport readiness only proves a listener answered. A managed workspace\n    // must additionally satisfy the protected readiness contract — own database,\n    // cloned rows, login handoff, and matching instance/workspace identity —\n    // before it may be published as running/healthy (PAP-17572).\n    if (managedWorkspaceIdentity) {\n      const publishHealthUrl = resolveRuntimeServiceHealthUrl(\n        record.port ? `http://127.0.0.1:${record.port}` : rewriteUrlHostToLoopback(record.url ?? backendUrl),\n        { serviceName, command },\n      );\n      if (!publishHealthUrl) {\n        throw new Error(\"Managed workspace readiness gate could not resolve a health URL\");\n      }\n      let gate = await waitForManagedWorkspaceReadiness({\n        healthUrl: publishHealthUrl,","sourceCodeStart":5982,"sourceCodeEnd":6018,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/server/src/services/workspace-runtime.ts#L5982-L6018","documentation":"The post-start provisionExposure call failed and returned an error code with detail (e.g. TLS/provisioning backend failure). The runtime service record exists but its HTTPS exposure could not be provisioned, so the start fails with the exposure error code and detail.","triggerScenarios":"Thrown at server/src/services/workspace-runtime.ts:5680 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Read the provisioning error code and errorDetail, fix the exposure configuration accordingly, and retry.","Check exposure provider credentials and network reachability, then retry the HTTPS exposure."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}