This page covers Container Controller (CTR) and capability authority/gateway (CAP) diagnostics.
Controller ranges
| Range | Meaning |
|---|---|
CTR1000-1999 | configuration/environment/profile discovery |
CTR2000-2999 | process/IPC/environment ownership |
CTR3000-3999 | execution scheduling/storage/runtime preparation |
CTR4000-4999 | worker execution/cancellation/quarantine |
CTR5000-5999 | package/protocol/bootstrap compatibility |
CTR9000-9099 | Controller/Environment invariant failures |
Capability ranges
| Range | Meaning |
|---|---|
CAP1000-1999 | manifest/identity shape |
CAP2000-2999 | authorization/authority binding |
CAP3000-3999 | broker/gateway transport |
CAP4000-4999 | Service/Network/Storage/Video capability execution |
CAP9000-9099 | capability-policy invariants / probable RBE bugs |
The current runtime still has several symbolic fail-closed strings such as capability-manifest conflicts/mismatches. Those should migrate to this numeric contract without weakening the existing checks.
Reserved migration codes
CAP1001 — malformed capability manifest
Status: Reserved.
A Runtime Image capability manifest violates structural bounds, contains an invalid target/operation, duplicates conflicting authority, or exceeds manifest limits.
Action: if generated by RELC, preserve the Runtime Image ID and report the compiler output; application code should not hand-author Controller manifests.
CAP2001 — execution has no registered capability manifest
Status: Reserved.
The Controller received an execution identity that is not represented by an exact registered manifest.
An explicitly empty manifest is allowed to mean “this execution has no host capabilities”; no manifest means unknown authority and fails closed.
CAP2002 — capability execution provenance mismatch
Status: Reserved.
A capability call does not match the active execution's Runtime Image, SourceId, Environment generation or capability ABI.
Action: do not retry by widening the grant. Check for stale execution IDs, stale Environment generations or a broken guest/Controller binding.
CAP2003 — requested operation is not granted
Status: Reserved.
The exact target exists, but the caller did not receive authority for the requested operation. This is expected fail-closed behavior.
CAP3001 — capability relay transport failed
Status: Reserved.
The guest/Environment/Controller capability relay failed before a trusted host operation could complete.
Action: inspect the active Environment generation and IPC state. Do not bypass the Controller by exposing the underlying Service socket/network handle/storage path directly.
CAP4001 — Storage capability execution failed
Status: Reserved.
An authorized storage:<namespace> operation failed inside the owning Environment process.
Environment storage is intentionally Environment-owned. Backend must not independently reopen the Environment's transactional state as a fallback.
CTR4001 — artifact quarantined after repeated crashes
Status: Reserved migration code for the existing crash-circuit behavior.
The Controller stopped blindly restarting an artifact that repeatedly crashes workers or destabilizes execution.
Action: inspect the artifact/runtime failure history and deploy a new artifact generation after fixing the fault rather than repeatedly retrying the same broken generation.
CTR9001 — Controller ownership invariant violated
Status: Reserved.
Two runtime layers appear to own a resource that must have a single authority owner, for example Environment storage or an Environment generation lifecycle.
This is likely an RBE bug.
Action: capture Controller/Environment generation IDs, execution ID, Runtime Image ID and the full error context and report it.
CAP9001 — capability broker invariant violated
Status: Reserved.
The broker reached an impossible state after validated manifest registration/authorization.
Treat this as a security/correctness bug. Preserve the exact manifest identity and do not work around it by granting broader authority.