## consult-not-configured

**What you see.** A `consult` call is denied as invalid-arguments. The tool result names this
entry:

```text
Denied: the arguments are not valid for this tool: consult is not configured; see docs/runbook.md#consult-not-configured.
```

**Why.** `brokerd.toml` has no `[consult]` table. Every `consult` call is denied until the owner
writes one. The audit line still holds the JSON body that would have been sent.

**Confirm.**

```sh
grep -n '\[consult\]' "$BOXMAKER_HOME/../brokerd.toml" /etc/boxmaker/brokerd.toml 2>/dev/null
```

**Fix.** Add a `[consult]` table with `url`, `model` and `secret`, a matching `[secrets.<name>]`
entry, and a grant whose `tool` is `consult`. Restart `brokerd`. M6's URL is loopback only.

**Check.** A `consult` from a session whose taint is at or below the grant's `max_taint` returns
an answer, and the audit line's `body` matches the bytes posted.

## consult-secret-unreadable

**What you see.** `brokerd` does not start. The line names the secret and this entry, and may
also name `secret-unavailable` or `secret-in-a-file`.

**Why.** `[consult]` names a secret that is missing from `[secrets]`, whose spec is not exactly
one of credential/env/file, or that the secret store cannot read (missing, too open, or not
UTF-8).

**Confirm.**

```sh
# the name in [consult] secret = "…"
ls -l <the file or credential path>
```

**Fix.** Put the bearer in the store the spec names, mode `0600` for a file, owned by the
user `brokerd` runs as. Restart `brokerd`.

**Check.** `brokerd serve --config <path>` prints the serving lines and no secret error.