Governed Execution Errors and Troubleshooting
Expected results for valid and adversarial governed graphs, how reason codes differ from issue codes and HTTP status, and why a private record returns not found.
Positive and negative test matrix
Each row was reproduced with @nexart/governed-execution@0.4.2.
| Condition | Expected result |
|---|---|
| Valid cyclic static topology and acyclic concrete execution | Accepted |
| Static self-edge without concrete self-parent | Accepted |
| Legal actual-parent subset | Accepted |
| Omitted topology | Accepted with topologyValidation: not-supplied |
| Forbidden concrete edge | TOPOLOGY_ERROR / ILLEGAL_EXECUTED_EDGE |
| Unresolvable contraction cycle | TOPOLOGY_ERROR / UNRESOLVABLE_CONTRACTION_CYCLE |
| Concrete cycle | CAUSAL_ERROR |
| Concrete self-parent | CAUSAL_ERROR |
| Dangling or forward parent | CAUSAL_ERROR |
| Malformed stateHash | SCHEMA_ERROR |
| Unknown concrete node with supplied topology | TOPOLOGY_ERROR / UNKNOWN_NODE (sealing throws) |
A tampered CER also reports certificateHash mismatch because the protected projection changed.
Codes, issues, HTTP status and verdict
- Top-level reason code: one of
OK,SCHEMA_ERROR,CAUSAL_ERROR,TOPOLOGY_ERROR,CERTIFICATE_HASH_MISMATCH,CANONICALIZATION_ERROR,RESOURCE_ERROR. - Detailed SDK issue codes: strings in
errors[], such asILLEGAL_EXECUTED_EDGE. - HTTP transport status: 200 means the call completed; 401 means a missing or invalid key on
/api/attest. - Verification verdict:
statusandclassificationin the response body.
Attestation failures
POST /api/attest returns HTTP 400 with the body below for SDK rejections, 409 EXECUTION_MUTATION_DETECTED when the same bundleId arrives with a different hash, and 400 READABLE_FIELDS_UNSUPPORTED if X-NexArt-Readable-Fields is sent. Full table: failure responses.
{
"error": "INVALID_BUNDLE",
"reasonCode": "<SDK_CODE>",
"details": ["<SDK_ERROR>"]
}"My attestation succeeded, but the public URL says Record Not Found"
- Attestation does not publish. Governed records default to
hidden; hidden, private, deleted and missing records all return the same 404. verificationUrlis formatted by the Node, not checked. Theverify.nexart.iobackend is outside the audited Node source.- Verify the complete CER locally or through
POST /v1/cer/verify. - There is no governed public-reseal workflow. Node 0.30.1 supports an authenticated visibility transition that does not change the protected certificate hash. This source audit does not establish the external verifier's storage or lookup implementation.
- Do not make a record public merely to remove the 404.