gastownhall/beads · critical

failed to generate id: %w

Error message

failed to generate id: %w

What it means

newID generates a 16-byte random ID with crypto/rand and wraps any rand.Read failure as "failed to generate id". crypto/rand.Read failing indicates the OS entropy source is unavailable — extremely rare on Linux/macOS, but possible on the Windows RNG path or in restricted sandboxes. Since Append calls newID, this error surfaces as a failed audit append before any file I/O.

Source

Thrown at internal/audit/audit.go:194

		"old_value": oldValue,
		"new_value": newValue,
	}
	if reason != "" {
		extra["reason"] = reason
	}
	_, _ = AppendIfEnabled(&Entry{
		Kind:    "field_change",
		IssueID: issueID,
		Actor:   actor,
		Extra:   extra,
	})
}

func newID() (string, error) {
	// 16 bytes (128-bit) of entropy — birthday probability for 8000 IDs is ~9e-32.
	var b [16]byte
	if _, err := rand.Read(b[:]); err != nil {
		return "", fmt.Errorf("failed to generate id: %w", err)
	}
	return idPrefix + hex.EncodeToString(b[:]), nil
}

View on GitHub (pinned to 71377f2769)

Solutions

1. Retry the operation — the failure is usually transient or spurious.
2. Check the sandbox/seccomp profile allows getrandom(2) or /dev/urandom reads.
3. Verify the container image/platform has a working /dev/urandom device.
4. Upgrade Go/runtime platform if on a known-affected platform.
5. Inspect the wrapped %w cause to confirm the exact RNG failure.

Example fix

// before
id, err := auditAppendWithNewID() // "failed to generate id: ..."
// after
for i := 0; i < 3; i++ {
    id, err = auditAppendWithNewID()
    if err == nil { break }
    time.Sleep(10 * time.Millisecond)
}

if err != nil && strings.Contains(err.Error(), "failed to generate id") {
    // transient RNG failure: retry with backoff
    for i := 0; i < 3 && err != nil; i++ {
        time.Sleep(time.Duration(1<<i) * 10 * time.Millisecond)
        _, err = doAppend()
    }
}

When it happens

Trigger: crypto/rand.Read returning an error because /dev/urandom (or getrandom(2)) is unavailable; containers with blocked syscall access; platforms where the RNG fails during early boot or under severe resource exhaustion.

Common situations: Highly restricted container runtimes (some minimal seccomp profiles); unusual or ancient platforms; virtualized environments with entropy-starved kernels (mostly historical).

Related errors

• identity: generate request nonce: %w
• identity: generate proxy secret: %w
• httpapi: request id seed: %w
• failed to generate credential encryption key: %w
• no store is open for this workspace

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/910c13141ec87f73. Report an issue: GitHub.