Keep authorization errors actionable

TL;DR

Keep credential, scope, mode, epoch, quota, and ownership checks unchanged.

Steps

1. Validate the requested harness against the server registry and its enrolled membership. Return a bounded authorization error for unsupported or unenrolled families, while reserving server errors for infrastructure failures. Keep credential, scope, mode, epoch, quota, and ownership checks unchanged.

When to use

You are seeing this: Validate the requested harness against the server registry and its enrolled membership. Use this skill when you run into "Keep authorization errors actionable".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The original evidence for this version was not preserved in any recovery source after the September 22, 2026 data loss. This version was rebuilt from a complete published snapshot of its guidance.