zeroclaw-labs/zeroclaw · error

security.nevis: {msg}

Error message

security.nevis: {msg}

What it means

The top-level Config::validate delegates Nevis IAM checks to NevisConfig::validate() and re-wraps any failure as "security.nevis: {msg}". This error is a wrapper: the actionable detail is in the {msg} suffix, which names the specific invalid Nevis field (for example missing issuer/audience or malformed URL when Nevis auth is enabled). Fixing it means reading the suffix and correcting the corresponding [security.nevis] key.

Source

Thrown at crates/zeroclaw-config/src/schema.rs:22100

                "myself",
                "list_transitions",
                "transition_ticket",
                "create_ticket",
            ];
            for action in &self.jira.allowed_actions {
                if !valid_actions.contains(&action.as_str()) {
                    anyhow::bail!(
                        "jira.allowed_actions contains unknown action: '{}'. \
                         Valid: get_ticket, search_tickets, comment_ticket, list_projects, myself, list_transitions, transition_ticket, create_ticket",
                        action
                    );
                }
            }
        }

        // Nevis IAM — delegate to NevisConfig::validate() for field-level checks
        if let Err(msg) = self.security.nevis.validate() {
            anyhow::bail!("security.nevis: {msg}");
        }

        // Delegate tool global defaults
        if self.delegate.timeout_secs == 0 {
            validation_bail!(
                InvalidNumericRange,
                "delegate.timeout_secs",
                "delegate.timeout_secs must be greater than 0"
            );
        }
        if self.delegate.agentic_timeout_secs == 0 {
            validation_bail!(
                InvalidNumericRange,
                "delegate.agentic_timeout_secs",
                "delegate.agentic_timeout_secs must be greater than 0"
            );
        }

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Read the text after 'security.nevis:' — it names the exact field and constraint that failed
2. Fix the indicated [security.nevis] key in config.toml
3. If the message mentions a required-when-enabled field, either supply it or set the Nevis feature flag off
4. Re-run `zeroclaw` config validation (or your app's config load) to confirm the whole section now passes

match cfg.validate() {
    Err(e) => {
        let msg = e.to_string();
        if let Some(detail) = msg.strip_prefix("security.nevis: ") {
            eprintln!("Nevis config invalid: {detail}");
            // surface detail to the operator, not just the wrapper
        }
    }
    Ok(()) => {}
}

When it happens

Trigger: Enabling security.nevis with incomplete or malformed field values; any invalid combination inside the Nevis section surfaces here with the field-level message appended; programmatic config mutation that writes an invalid NevisConfig and then calls validate().

Common situations: Enabling Nevis IAM mid-setup before all required fields are filled; copy-pasting a Nevis config between environments where a URL or audience differs; version upgrades that add new required Nevis fields not present in the old config.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

• Edge TTS binary_path must be a bare command name without pat
• invalid token_validation mode '{other}': expected 'local' or
• Lark/Feishu marker target uses a disallowed scheme
• matrix: `homeserver` is required
• Cannot persist empty Telegram identity

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/9ad27acd5473f21e. Report an issue: GitHub.