Typed failures, explicit stops.

Error catalog

• AUTH_REQUIRED

  {
    "http": 401,
    "retryable": false,
    "message": "A valid developer credential is required."
  }

• ACCESS_DENIED

  {
    "http": 403,
    "retryable": false,
    "message": "This credential or grant does not permit the operation."
  }

• GRANT_REQUIRED

  {
    "http": 403,
    "retryable": false,
    "message": "An active grant from the Passport owner is required."
  }

• GRANT_EXPIRED

  {
    "http": 403,
    "retryable": false,
    "message": "The grant has expired."
  }

• GRANT_REVOKED

  {
    "http": 403,
    "retryable": false,
    "message": "The grant has been revoked."
  }

• CREDENTIAL_REVOKED

  {
    "http": 403,
    "retryable": false,
    "message": "The credential has been revoked."
  }

• CREDENTIAL_EXPIRED

  {
    "http": 403,
    "retryable": false,
    "message": "The credential has expired."
  }

• RECENT_AUTH_REQUIRED

  {
    "http": 403,
    "retryable": false,
    "message": "A fresh browser sign-in is required."
  }

• INTEGRITY_ERROR

  {
    "http": 403,
    "retryable": false,
    "message": "Recorded evidence failed an integrity check."
  }

• PASSPORT_NOT_FOUND

  {
    "http": 404,
    "retryable": false,
    "message": "No such Passport or evaluation is available to this caller."
  }

• LEASE_NOT_FOUND

  {
    "http": 404,
    "retryable": false,
    "message": "No such lease is available to this caller."
  }

• LEASE_NOT_PERMITTED

  {
    "http": 403,
    "retryable": false,
    "message": "This decision cannot be leased."
  }

• LEGACY_AUTHORITY_NOT_PORTABLE

  {
    "http": 409,
    "retryable": false,
    "message": "Legacy authority without candidate and context commitments cannot be issued as a portable proof. Evaluate the current choice again."
  }

• CLARIFICATION_REQUIRED

  {
    "http": 409,
    "retryable": false,
    "message": "A fact is missing. Capture it and evaluate again; approving cannot supply it."
  }

• COMMITMENT_REQUIRED

  {
    "http": 428,
    "retryable": false,
    "message": "This lease is bound to a candidate and a situation. Present both as they are now (or their commitments) to rely on it."
  }

• COMMITMENT_MISMATCH

  {
    "http": 409,
    "retryable": false,
    "message": "The candidate or context you presented is not the one this authority was evaluated for. Evaluate the current choice again."
  }

• LEASE_STATE_CONFLICT

  {
    "http": 409,
    "retryable": false,
    "message": "The lease changed or is not in a state that allows this."
  }

• INVALID_INPUT

  {
    "http": 400,
    "retryable": false,
    "message": "The request does not match the contract."
  }

• STATE_VERSION_CONFLICT

  {
    "http": 409,
    "retryable": false,
    "message": "The Passport state version has changed; read it again."
  }

• IDEMPOTENCY_KEY_CONFLICT

  {
    "http": 409,
    "retryable": false,
    "message": "The idempotency key was used with a different payload."
  }

• BODY_TOO_LARGE

  {
    "http": 413,
    "retryable": false,
    "message": "The request body is too large."
  }

• BODY_READ_TIMEOUT

  {
    "http": 408,
    "retryable": true,
    "message": "The request body was not received in time."
  }

• RATE_LIMITED

  {
    "http": 429,
    "retryable": true,
    "message": "Rate limit reached; retry later."
  }

• NOT_CONFIGURED

  {
    "http": 503,
    "retryable": true,
    "message": "The service is not configured."
  }

• PROVIDER_UNAVAILABLE

  {
    "http": 503,
    "retryable": true,
    "message": "A required provider is unavailable."
  }

• INTERNAL_ERROR

  {
    "http": 500,
    "retryable": true,
    "message": "An internal error occurred."
  }