Skip to main content

Variable: SETUP_CHECKS

const SETUP_CHECKS: object

Defined in: packages/contracts/src/setup-checks.ts:365

The checks, with the step each belongs to and the causes each can report. This table is the answer to "which cause codes can step n return": read the rows of the step.

A later step applies the steps before it again before its own (each converges, so on a deployment where they are done this changes nothing), which is why applied checks of later steps list the earlier steps' causes too.

Type Declaration​

accounts.applied​

readonly accounts.applied: object

accounts.applied.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_forbidden", "provider_conflict", "provider_rejected", "provider_not_managed", "provider_direct_grants_remain", "provider_unexpected", "provider_delegated", "realm_missing", "machine_client_refused", "audience_missing", "test_recipient_refused", "mail_settings_invalid", "secret_unreadable", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "root_account_not_created", "unexpected"]

accounts.applied.reportsApply​

readonly reportsApply: true = true

accounts.applied.step​

readonly step: "accounts" = 'accounts'

accounts.declared​

readonly accounts.declared: object

accounts.declared.causes​

readonly causes: readonly ["governing_account_missing", "governing_account_is_root", "unexpected"]

accounts.declared.reportsApply​

readonly reportsApply: false = false

accounts.declared.step​

readonly step: "accounts" = 'accounts'

accounts.invitation​

readonly accounts.invitation: object

accounts.invitation.causes​

readonly causes: readonly ["invitation_failed", "invitation_unconfirmed", "unexpected"]

accounts.invitation.reportsApply​

readonly reportsApply: true = true

accounts.invitation.step​

readonly step: "accounts" = 'accounts'

anchor.applied​

readonly anchor.applied: object

anchor.applied.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_forbidden", "provider_conflict", "provider_rejected", "provider_not_managed", "provider_direct_grants_remain", "provider_unexpected", "provider_delegated", "realm_missing", "machine_client_refused", "audience_missing", "test_recipient_refused", "mail_settings_invalid", "secret_unreadable", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

anchor.applied.reportsApply​

readonly reportsApply: true = true

anchor.applied.step​

readonly step: "anchor" = 'anchor'

anchor.declared​

readonly anchor.declared: object

anchor.declared.causes​

readonly causes: readonly ["anchor_facts_missing", "unexpected"]

anchor.declared.reportsApply​

readonly reportsApply: false = false

anchor.declared.step​

readonly step: "anchor" = 'anchor'

anchor.framework​

readonly anchor.framework: object

anchor.framework.causes​

readonly causes: readonly ["framework_missing", "framework_invalid", "unexpected"]

anchor.framework.reportsApply​

readonly reportsApply: false = false

anchor.framework.step​

readonly step: "anchor" = 'anchor'

configuration.applied​

readonly configuration.applied: object

configuration.applied.causes​

readonly causes: readonly ["answers_invalid", "authority_not_file", "audit_not_acknowledged", "store_failed", "unexpected"]

configuration.applied.reportsApply​

readonly reportsApply: true = true

configuration.applied.step​

readonly step: "configuration" = 'configuration'

configuration.authority​

readonly configuration.authority: object

configuration.authority.causes​

readonly causes: readonly ["authority_not_file", "store_failed", "unexpected"]

configuration.authority.reportsApply​

readonly reportsApply: false = false

configuration.authority.step​

readonly step: "configuration" = 'configuration'

configuration.stored​

readonly configuration.stored: object

configuration.stored.causes​

readonly causes: readonly ["configuration_not_stored", "store_failed", "unexpected"]

configuration.stored.reportsApply​

readonly reportsApply: false = false

configuration.stored.step​

readonly step: "configuration" = 'configuration'

identifiers.agent​

readonly identifiers.agent: object

provisioning registered the shared agent instance, or found it registered.

identifiers.agent.causes​

readonly causes: readonly ["service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

identifiers.agent.reportsApply​

readonly reportsApply: true = true

identifiers.agent.step​

readonly step: "identifiers" = 'identifiers'

identifiers.applied​

readonly identifiers.applied: object

issuance stored the permitted methods and published the anchor's identifier. It converges the earlier steps first (the anchor's id comes from identity), which is why it lists their causes.

identifiers.applied.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_forbidden", "provider_conflict", "provider_rejected", "provider_not_managed", "provider_direct_grants_remain", "provider_unexpected", "provider_delegated", "realm_missing", "machine_client_refused", "audience_missing", "test_recipient_refused", "mail_settings_invalid", "secret_unreadable", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

identifiers.applied.reportsApply​

readonly reportsApply: true = true

identifiers.applied.step​

readonly step: "identifiers" = 'identifiers'

identifiers.declared​

readonly identifiers.declared: object

The identifiers section, with its defaults filled in, is coherent.

identifiers.declared.causes​

readonly causes: readonly ["answers_invalid", "unexpected"]

identifiers.declared.reportsApply​

readonly reportsApply: false = false

identifiers.declared.step​

readonly step: "identifiers" = 'identifiers'

identifiers.registry​

readonly identifiers.registry: object

issuance wrote a throwaway object to each enabled registry and read it back.

identifiers.registry.causes​

readonly causes: readonly ["service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

identifiers.registry.reportsApply​

readonly reportsApply: true = true

identifiers.registry.step​

readonly step: "identifiers" = 'identifiers'

module.identification​

readonly module.identification: object

The token's manufacturer, model, firmware and serial, as it reports them.

module.identification.causes​

readonly causes: readonly ["module_identification_missing", "unexpected"]

module.identification.reportsApply​

readonly reportsApply: false = false

module.identification.step​

readonly step: "key-store" = 'key-store'

module.library​

readonly module.library: object

credential answered the probe, naming the PKCS#11 library it loaded at start and how long that took (DW24). Read-only. A failure here is credential not answering: a credential that cannot load its library does not start.

module.library.causes​

readonly causes: readonly ["service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

module.library.reportsApply​

readonly reportsApply: false = false

module.library.step​

readonly step: "key-store" = 'key-store'

module.session​

readonly module.session: object

credential holds its login on the token it started on, the token is still there, and it is the module the operator asserts. Nothing logs in for this check, so it runs under plan and cannot count against the PIN lockout.

module.session.causes​

readonly causes: readonly ["module_token_missing", "module_not_permitted", "module_unavailable", "module_session_lost", "unexpected"]

module.session.reportsApply​

readonly reportsApply: false = false

module.session.step​

readonly step: "key-store" = 'key-store'

module.test_key​

readonly module.test_key: object

credential generated a key on the token, signed with it, verified the signature and destroyed it. It writes to the token, so it runs only when the step is applied, and an apply of a step already done for the same answers is refused.

module.test_key.causes​

readonly causes: readonly ["test_key_failed", "test_key_not_destroyed", "module_token_missing", "module_not_permitted", "module_unavailable", "module_session_lost", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

module.test_key.reportsApply​

readonly reportsApply: true = true

module.test_key.step​

readonly step: "key-store" = 'key-store'

organizations.applied​

readonly organizations.applied: object

organizations.applied.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_forbidden", "provider_conflict", "provider_rejected", "provider_not_managed", "provider_direct_grants_remain", "provider_unexpected", "provider_delegated", "realm_missing", "machine_client_refused", "audience_missing", "test_recipient_refused", "mail_settings_invalid", "secret_unreadable", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

organizations.applied.reportsApply​

readonly reportsApply: true = true

organizations.applied.step​

readonly step: "organizations" = 'organizations'

organizations.request​

readonly organizations.request: object

organizations.request.causes​

readonly causes: readonly ["answers_invalid", "unexpected"]

organizations.request.reportsApply​

readonly reportsApply: false = false

organizations.request.step​

readonly step: "organizations" = 'organizations'

provider.capabilities​

readonly provider.capabilities: object

provider.capabilities.causes​

readonly causes: readonly ["provider_partial", "provider_delegated", "provider_unreachable", "unexpected"]

provider.capabilities.reportsApply​

readonly reportsApply: false = false

provider.capabilities.step​

readonly step: "identity-provider" = 'identity-provider'

provider.converged​

readonly provider.converged: object

provider.converged.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_forbidden", "provider_conflict", "provider_rejected", "provider_not_managed", "provider_direct_grants_remain", "provider_unexpected", "provider_delegated", "realm_missing", "machine_client_refused", "audience_missing", "test_recipient_refused", "mail_settings_invalid", "secret_unreadable", "unexpected"]

provider.converged.reportsApply​

readonly reportsApply: true = true

provider.converged.step​

readonly step: "identity-provider" = 'identity-provider'

provider.reachable​

readonly provider.reachable: object

provider.reachable.causes​

readonly causes: readonly ["provider_unreachable", "provider_credential_refused", "provider_unexpected", "secret_unreadable", "unexpected"]

provider.reachable.reportsApply​

readonly reportsApply: false = false

provider.reachable.step​

readonly step: "identity-provider" = 'identity-provider'

provider.root_account​

readonly provider.root_account: object

provider.root_account.causes​

readonly causes: readonly ["root_account_not_declared", "root_account_not_created", "invitation_failed", "invitation_unconfirmed", "unexpected"]

provider.root_account.reportsApply​

readonly reportsApply: true = true

provider.root_account.step​

readonly step: "identity-provider" = 'identity-provider'

publish.federation​

readonly publish.federation: object

The anchor's entity configuration fetched through its published address and its chain and framework verified by @oktoid/federation-verify, the code pnpm oktoid verify-federation runs. A document that could not be fetched is needs_attention with federation_unchecked, never failed.

publish.federation.causes​

readonly causes: readonly ["federation_not_verified", "federation_unchecked", "unexpected"]

publish.federation.reportsApply​

readonly reportsApply: false = false

publish.federation.step​

readonly step: "configuration" = 'configuration'

publish.identifier​

readonly publish.identifier: object

The anchor's identifier resolved by issuance from the bytes the registry serves: the platform checking itself, never presented as independent. A parallel did:web document that is missing is needs_attention; one that differs is a failure.

publish.identifier.causes​

readonly causes: readonly ["identifier_not_found", "identifier_unverifiable", "identifier_deactivated", "identifier_parallel_differs", "identifier_parallel_absent", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

publish.identifier.reportsApply​

readonly reportsApply: false = false

publish.identifier.step​

readonly step: "configuration" = 'configuration'

root.signed_in​

readonly root.signed_in: object

When the root account first signed in, as identity recorded it. waiting until it has, with the invited address as evidence, and never failed: a cause here is always needs_attention (design 08 section 10 item 6).

root.signed_in.causes​

readonly causes: readonly ["root_account_not_linked", "service_no_reply", "service_denied", "service_refused", "service_failed", "reply_incomplete", "unexpected"]

root.signed_in.reportsApply​

readonly reportsApply: false = false

root.signed_in.step​

readonly step: "configuration" = 'configuration'