kyleandGrok 4.6
50e9cc2037
Six closed tasks for consult: registry, CONSULT_WAIT, [consult]/[secrets], ToolName and grants, Decision body, loopback HTTP. Reference is the git bundle ~/boxmaker-refs/m6b-ref.bundle at 5fb05f0. Gate after task 06 is 1611. Co-Authored-By: Grok 4.6 <noreply@x.ai>
45 lines
1.6 KiB
Markdown
45 lines
1.6 KiB
Markdown
## consult-not-configured
|
|
|
|
**What you see.** A `consult` call is denied as invalid-arguments. The tool result names this
|
|
entry:
|
|
|
|
```text
|
|
Denied: the arguments are not valid for this tool: consult is not configured; see docs/runbook.md#consult-not-configured.
|
|
```
|
|
|
|
**Why.** `brokerd.toml` has no `[consult]` table. Every `consult` call is denied until the owner
|
|
writes one. The audit line still holds the JSON body that would have been sent.
|
|
|
|
**Confirm.**
|
|
|
|
```sh
|
|
grep -n '\[consult\]' "$BOXMAKER_HOME/../brokerd.toml" /etc/boxmaker/brokerd.toml 2>/dev/null
|
|
```
|
|
|
|
**Fix.** Add a `[consult]` table with `url`, `model` and `secret`, a matching `[secrets.<name>]`
|
|
entry, and a grant whose `tool` is `consult`. Restart `brokerd`. M6's URL is loopback only.
|
|
|
|
**Check.** A `consult` from a session whose taint is at or below the grant's `max_taint` returns
|
|
an answer, and the audit line's `body` matches the bytes posted.
|
|
|
|
## consult-secret-unreadable
|
|
|
|
**What you see.** `brokerd` does not start. The line names the secret and this entry, and may
|
|
also name `secret-unavailable` or `secret-in-a-file`.
|
|
|
|
**Why.** `[consult]` names a secret that is missing from `[secrets]`, whose spec is not exactly
|
|
one of credential/env/file, or that the secret store cannot read (missing, too open, or not
|
|
UTF-8).
|
|
|
|
**Confirm.**
|
|
|
|
```sh
|
|
# the name in [consult] secret = "…"
|
|
ls -l <the file or credential path>
|
|
```
|
|
|
|
**Fix.** Put the bearer in the store the spec names, mode `0600` for a file, owned by the
|
|
user `brokerd` runs as. Restart `brokerd`.
|
|
|
|
**Check.** `brokerd serve --config <path>` prints the serving lines and no secret error.
|