Most messages in the Editor say what happened, what to do, and end with a code in parentheses. When you ask your administrator for help, give them that code.
Sign-in
| Message or code | Cause | Fix |
|---|---|---|
network_dns | The server name could not be found | Check the address, and that this device can resolve it (VPN, DNS) |
network_tls | The server's certificate was not trusted | With a corporate proxy or TLS inspection, its certificate must be trusted by this device; ask your administrator. Do not continue on a network you do not trust. |
network_refused, network_offline, network_proxy | The connection was refused, there is no network, or the proxy failed | Check the address, the network and the proxy settings |
discovery_timeout, discovery_network | The server did not answer, or could not be reached | Check the address and your connection |
discovery_*_untrusted, discovery_redirect_refused, discovery_openid_issuer_mismatch | The server described itself with addresses that do not belong to it, or tried to redirect | Do not continue. Check the server address with your administrator. |
iss_not_supported | The server does not identify itself in sign-in responses (RFC 9207) | Upgrade the server, or your administrator allows an older self-hosted server through managed policy (NeuralInverseKeystoneAllowMissingIss) |
iss_mismatch | The response came from another server than the one you started with | Do not continue. Start sign-in again from the Editor. |
invalid_client (for example token_exchange_http_401.invalid_client) | The server does not know this app's client; it is older than the app | Your administrator upgrades the server or sets NeuralInverseKeystoneClientId. The Editor never tries another client by itself. |
endpoint_user_setting_invalid | neuralInverse.keystone.baseUrl is not a valid https address (no path, no credentials) | Fix or clear the setting |
endpoint_managed_policy_invalid, endpoint_locked_endpoint_* | The address from policy or the build is invalid | Ask your administrator, or install the build your organisation provides |
endpoint_changed | The configured address changed, so the old session ended | Sign in to the new server |
timeout | Sign-in was not finished in the browser in time | Start again. If the browser said the client is not recognised, the server is older than the app. |
loopback_start_failed, loopback_error | The local listener for the browser sign-in failed | Try again, or sign in with a device code |
device_expired | The device code expired before approval | Start again |
device_blocked, device_revoked | Your organisation blocked or revoked this device | Ask your administrator |
device_limit_exceeded | You reached your organisation's device limit | Remove a device you no longer use, then sign in |
| Session ends after a restart | No usable credential store; the session was kept in memory | On Linux, install and unlock a Secret Service keyring such as GNOME Keyring |
Policy and approvals
| Symptom | Cause | Fix |
|---|---|---|
| Every bundle is rejected | No key is pinned, or the organisation does not match | Your administrator pins the key (NeuralInverseGovernancePolicyKeys) and sets NeuralInverseGovernanceOrganisation. ni-gov policy show lists trusted keys and each rejection. |
| "rollback" rejection | The device already accepted a higher policy version | Your administrator signs a version above it |
| Agent features locked | The policy expired beyond its offline grace, a required policy cannot be verified, or the stored policy was deleted | Your administrator distributes a current policy. Editing and committing keep working. |
| An engine is blocked | A mandatory rule cannot be enforced by that engine version, or the version is unknown | The Governance view names the rule |
| "The policy names no approval rule for this, so nobody can approve it." | The action needs approval but no rule says who | Ask your administrator to add an approval rule |
| A setting you changed has no effect | The setting is governed | The Governance view lists ignored values under Governed Settings; change it through your administrator |
| Your signature does not count | Your device key is not enrolled, you are the author or requester, or the content changed after you signed | Enrol with Copy Key for Enrolment; ask another approver; sign again after the change |
| Signing fails in the Agents app or Editor | The app that holds the device key is quitting or not responding | Try again in a moment |
| Agent sessions refused in a repository | The policy requires an intent | Run Set Intent... |
Audit
| Symptom | Cause | Fix |
|---|---|---|
| Audit Unavailable in the status bar | The ledger cannot record (keychain locked, disk full, integrity failure) | Open the Activity Log for the reason. In block mode, AI tool calls, agent commands and extension installs wait until it can record. |
| Audit Locked, "Waiting for the key file passphrase" | No keychain; the keys are in a passphrase-protected file | Run Enter Audit Key File Passphrase |
| Erasure refused | A legal hold is in force, or your organisation does not allow erasure | Ask your administrator |
| Export refused for an evidence builder | The audience is not on your organisation's allowed builders list | Ask your administrator |
Models
| Symptom | Cause | Fix |
|---|---|---|
| "Saved, but it could not be reached" | The provider's address or key is wrong, or the network blocks it | Choose Test to see the error; check the endpoint and key |
| Keys are lost when the app closes | No system credential store | On Linux, install and unlock a Secret Service keyring |
| A local server is not under Found on this computer | It is not running on its default address, or a provider of that type is already connected | Enter its address in the provider's block |
| Organisation models fail | You are signed out, or Govern refused the model | Sign in; ask your administrator which models are assigned to you |
| A model cannot be picked | Your organisation's policy denies or requires approval for it | Choose another model, or request approval |
Organisation context
| Message | Cause | Fix |
|---|---|---|
| Context withheld | Your organisation's policy denied it | Nothing to fix on the device; the prompt goes without context |
| Context unavailable | Govern cannot serve it now, or its address could not be verified | It is tried again automatically |
| Repository registered to several projects | The Directory binds none of them | An administrator registers the repository to one project, or choose a space on the Spaces page |
| No project for a folder | No remote is registered to a project you can read | Check Show Workspace Bindings |
Checks
| Symptom | Cause | Fix |
|---|---|---|
| The status bar shield shows an error and evaluation stopped | The provenance ledger does not verify | Note the entry and reason in the tooltip and tell your administrator |
| A finding does not block | It comes from an unsigned pack (baseline or workspace) | Only packs in your organisation's signed policy block |
| A file shows no findings | It could not be checked; findings are unavailable, not clean | Check the Checks view for coverage problems |
Evidence packs
| Code | Meaning |
|---|---|
signature-invalid, unexpected-key | The pack was not signed by the key you expected |
unexpected-device-key | The evidence names a device you did not list |
answers-do-not-follow, output-does-not-follow | The pack's answers or outputs differ from what its evidence gives: it was changed after signing |
unsupported-version | The pack was built with another version; verify with the tool version its manifest names |
Collecting information for support
- The code in parentheses at the end of the message.
- Show Neural Inverse Server and Show Neural Inverse Account.
- The Governance view's Policy in Force and Rejected Policy Sources.
- The Activity Log's Ledger and Policy section.
Never send tokens, keys or passphrases. The Editor never shows them.