{
  "v": 1,
  "type": "mirror.signal-taxonomy",
  "version": "1.4.0",
  "published": "2026-10-09",
  "stability": "Within a major version a code is never removed, reused for another meaning or moved to a different HTTP status class. Adding a code is a minor version. Integrate on `code`, never on the prose `error` message, which may change.",
  "wire_errors": [
    {
      "code": "raw_leaked",
      "http": 400,
      "retry": "never",
      "meaning": "The request carried a raw trade figure or identifier (value, quantity, band, table, salt, secret, mass, receipt secret, container number) at some depth. Commit locally; send only commitments."
    },
    {
      "code": "sar_wall",
      "http": 400,
      "retry": "never",
      "meaning": "The request carried a suspicious-activity filing decision, including disguised spellings of the key. The rail cannot hold one."
    },
    {
      "code": "unscannable",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The payload nests too deep for the walls to read to the end, so it is refused rather than passed."
    },
    {
      "code": "bad_request",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The body is not valid JSON or lacks a required field, or a cargo locator is not an opaque cl: locator."
    },
    {
      "code": "plaintext_join_key",
      "http": 400,
      "retry": "after_fix",
      "meaning": "shipment_ref was a plaintext document number after the cutover. Send an opaque locator commitment."
    },
    {
      "code": "table_not_in_force",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The named corridor table is ratified but its effective time has not arrived."
    },
    {
      "code": "private_key_leaked",
      "http": 400,
      "retry": "never",
      "meaning": "A JWK carrying the private scalar d was sent. Only public keys ever cross the wire."
    },
    {
      "code": "bad_member",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A member or demo witness entry lacks a kid, org, class or public jwk, or names an unknown class."
    },
    {
      "code": "bad_commitment",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A commitment is not in the opaque format the route requires."
    },
    {
      "code": "bad_type",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A trigger or event names no type, or an unknown one."
    },
    {
      "code": "bad_as_of",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A time (as_of, week_of) does not parse."
    },
    {
      "code": "bad_window",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A matching or coverage window is malformed (from must precede to)."
    },
    {
      "code": "bad_confirmation",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A ceremony confirmation does not prove possession of the corridor key."
    },
    {
      "code": "bad_charter",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A charter could not be built from the supplied parameters."
    },
    {
      "code": "not_opaque",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A value that must be an opaque commitment was sent in a readable form."
    },
    {
      "code": "leak_guard",
      "http": 500,
      "retry": "never",
      "meaning": "The operator refused to publish a registry that failed its own leak check. Report it: this is the operator protecting you from itself."
    },
    {
      "code": "disclosure_refused",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A disclosure request does not meet the grant's scope or legal basis."
    },
    {
      "code": "volume_fee_refused",
      "http": 400,
      "retry": "never",
      "meaning": "A rate card priced traffic (per verdict or on value). Mirror prices the corridor, never the flow."
    },
    {
      "code": "pricing_refused",
      "http": 400,
      "retry": "never",
      "meaning": "A rate card carried a fee Mirror refuses (seat, settlement, filing, conversion discount, score, volume band). The refusal code names which."
    },
    {
      "code": "event.unsigned",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A governance event's signature does not verify against a known member key."
    },
    {
      "code": "attribution.unverified",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A trigger claimed a member's name without a signature proving it."
    },
    {
      "code": "auth",
      "http": 401,
      "retry": "after_fix",
      "meaning": "No valid credential: the pilot token or a member session is required on this route."
    },
    {
      "code": "not_a_member",
      "http": 401,
      "retry": "after_fix",
      "meaning": "The key is not an active ratified member."
    },
    {
      "code": "not_demo",
      "http": 404,
      "retry": "never",
      "meaning": "The operator is not in demo mode: membership and witnesses are ratified by quorum, never self-declared."
    },
    {
      "code": "not_found",
      "http": 404,
      "retry": "never",
      "meaning": "No such route, or no object with that identifier on this operator."
    },
    {
      "code": "no_such_corridor",
      "http": 404,
      "retry": "after_fix",
      "meaning": "No corridor with that product and version is on the book."
    },
    {
      "code": "no_key",
      "http": 503,
      "retry": "backoff",
      "meaning": "The operator's signing key is unavailable; nothing unsigned is ever returned in its place."
    },
    {
      "code": "ledger_unreadable",
      "http": 503,
      "retry": "backoff",
      "meaning": "The verdict ledger or governance state could not be read. The route refuses rather than answering from partial state."
    },
    {
      "code": "archive_failed",
      "http": 503,
      "retry": "backoff",
      "meaning": "An archive could not be written."
    },
    {
      "code": "scope",
      "http": 403,
      "retry": "after_fix",
      "meaning": "A delegated desk key signed in, but it does not hold the scope this route needs (reconcile, governance, webhooks or read); `needs` names it. Ask the member's key custodian for a delegation with that scope."
    },
    {
      "code": "delegation_refused",
      "http": 401,
      "retry": "after_fix",
      "meaning": "A desk key's delegation certificate was refused; reason_code says why: bad_signature, not_by_member, not_a_root, expired, not_yet_valid, revoked, malformed, or a field the certificate rules refuse (bad_label, bad_scopes, too_long, private_key)."
    },
    {
      "code": "delegation_mismatch",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The delegation certificate delegates to a different key than the one signing in."
    },
    {
      "code": "store_unwritable",
      "http": 503,
      "retry": "backoff",
      "meaning": "The operator's store would not record the write, and nothing changed. Resend; a governance event or subscription is safe to resend."
    },
    {
      "code": "webhooks_unavailable",
      "http": 501,
      "retry": "never",
      "meaning": "This operator's store keeps no webhook outbox, so it cannot deliver pushes. Use the SIEM export or poll the ledger."
    },
    {
      "code": "not_redeliverable",
      "http": 409,
      "retry": "never",
      "meaning": "Only a dead or gone delivery can be requeued; this one is pending or delivered."
    },
    {
      "code": "subscription_inactive",
      "http": 409,
      "retry": "after_fix",
      "meaning": "The subscription is paused (the endpoint answered 410) or removed. Subscribe the endpoint again, then requeue."
    },
    {
      "code": "table_expired",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The named corridor table was ratified with an end (valid_until) and the end has passed; it judges nothing after it. Renew it by ratifying a new version."
    },
    {
      "code": "corridor_not_closed",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A new corridor must be closed (closed: true): on an open table two legs in an outer band agree at any ratio, so no ceiling could ever be met."
    },
    {
      "code": "ceiling_required",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A new corridor must ratify a match ceiling: max_ratio, a number above 1 and at most 1.5."
    },
    {
      "code": "ceiling_too_wide",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The proposed max_ratio is wider than the rail admits (1.5x)."
    },
    {
      "code": "corridor_no_interior",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A closed table needs at least two edges, so that at least one band lies inside it."
    },
    {
      "code": "ceiling_below_table",
      "http": 400,
      "retry": "after_fix",
      "meaning": "The table's widest band at tolerance 0 is wider than its own ceiling, so same-band legs there could never clear. Narrow the band or raise the ceiling (up to 1.5x)."
    },
    {
      "code": "corridor_shape",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A citation corridor cannot be closed yet. Derive the table party-side and propose its edges, closed, with a ceiling."
    },
    {
      "code": "corridor_reference",
      "http": 400,
      "retry": "after_fix",
      "meaning": "A ratio corridor's reference set does not read, or its edges are not exactly the published ratio table it names."
    }
  ],
  "host_errors": [
    {
      "code": "unavailable",
      "http": 503,
      "retry": "backoff",
      "hosts": [
        "worker"
      ],
      "meaning": "The operator object in the EU jurisdiction could not be reached. The request was refused, and it was not processed anywhere else. Resend with backoff; idempotency makes the retry safe."
    },
    {
      "code": "rate_limited",
      "http": 429,
      "retry": "backoff",
      "hosts": [
        "worker"
      ],
      "meaning": "Too many requests to an append or compute route from one caller in the window. Back off and resend; reads are not limited."
    },
    {
      "code": "body_too_large",
      "http": 413,
      "retry": "after_fix",
      "hosts": [
        "worker",
        "node"
      ],
      "meaning": "The request body exceeds the host's size cap, so none of it was processed. Split the batch or send commitments in smaller requests."
    },
    {
      "code": "internal",
      "http": 500,
      "retry": "backoff",
      "hosts": [
        "worker",
        "node",
        "edge"
      ],
      "meaning": "An unexpected failure in the host; nothing unsigned was returned in place of an answer. Resend with backoff, and report it if it persists."
    }
  ],
  "propagated": [
    {
      "source": "kernel/mirror-basis.js",
      "codes": [
        "basis_absent",
        "basis_does_not_cover",
        "basis_unrecognized"
      ],
      "http": 400,
      "retry": "after_fix",
      "meaning": "A cross-institution trigger's legal basis is missing, unrecognised, or does not cover this sharing."
    },
    {
      "source": "kernel/mirror-escrow.js",
      "codes": [
        "no_ciphertext",
        "no_member",
        "no_scope",
        "not_ciphertext",
        "plaintext_refused",
        "too_short"
      ],
      "http": 400,
      "retry": "after_fix",
      "meaning": "An escrow envelope is malformed or looks like plaintext; the operator stores ciphertext only."
    },
    {
      "source": "kernel/mirror-sign.js",
      "codes": [
        "no_record",
        "no_signing_key",
        "sign_failed"
      ],
      "http": 503,
      "retry": "backoff",
      "meaning": "The operator could not sign; it returns nothing unsigned instead."
    },
    {
      "source": "kernel/mirror-webhook.js",
      "codes": [
        "bad_endpoint",
        "insecure_endpoint",
        "credentials_in_url",
        "ip_literal",
        "private_name",
        "bad_events",
        "too_many"
      ],
      "http": 400,
      "retry": "after_fix",
      "meaning": "A webhook subscription was refused: https on a public DNS name, no credentials in the URL, no address literal or private name, known events only, at most five per member."
    },
    {
      "source": "kernel/mirror-clock.js",
      "codes": [
        "bad_nonce"
      ],
      "http": 400,
      "retry": "after_fix",
      "meaning": "POST /time needs a fresh random nonce of 16 to 64 hex characters."
    },
    {
      "source": "kernel/mirror-disclosure.js",
      "codes": [
        "incomplete",
        "no_basis",
        "no_parties",
        "no_reason",
        "no_shipment",
        "self_request"
      ],
      "http": 400,
      "retry": "after_fix",
      "meaning": "A disclosure request lacks what the protocol requires, or asks a member to disclose to itself."
    }
  ],
  "record": {
    "verdict": [
      {
        "value": "reconciled",
        "meaning": "The committed band labels agree - and at least one party with no stake in the price confirmed a competent axis (the independence gate). Not a proof that any label is the band of its true value."
      },
      {
        "value": "divergent",
        "meaning": "The committed labels disagree on some axis. A reason to look, never a finding of laundering."
      },
      {
        "value": "undetermined",
        "meaning": "The reading could not be judged; undetermined_reason says why. Routes to review, never to a clear."
      }
    ],
    "undetermined_reason": [
      {
        "value": "insufficient_independence",
        "meaning": "The labels agree, but only parties with a stake in the price confirmed them. Add a witness: a terminal or weighbridge on mass, customs on value."
      },
      {
        "value": "insufficient_anchor_diversity",
        "meaning": "The corridor ratified a minimum number of witness classes, or named classes (gold: terminal AND assayer), and the anchors that agreed do not meet it."
      },
      {
        "value": "label_integrity",
        "meaning": "A pricing-basis mismatch, an origin binding that did not verify or is required and missing, or a leg from an implementation the corridor did not ratify."
      },
      {
        "value": "match_ceiling",
        "meaning": "The labels agree, but within a wider window than the corridor's ratified match ceiling (max_ratio), or on a table whose window cannot be bounded. Band at the tolerance the ceiling allows, or ratify the table closed."
      }
    ],
    "divergent_axes": [
      {
        "value": "quantity",
        "meaning": "A physical witness weighed a mass the stakeholders' declared mass does not match within tolerance (short or phantom indicator)."
      },
      {
        "value": "resolution",
        "meaning": "The labels agree at coarse resolution and disagree at fine - in-band mispricing."
      },
      {
        "value": "corridor",
        "meaning": "The labels disagree at coarse resolution (nested corridors only)."
      },
      {
        "value": "quality",
        "meaning": "An assayer (or another quality-competent witness) measured a grade the stakeholders' declared grade does not match - right weight, wrong metal."
      }
    ],
    "anchor_state": [
      {
        "value": "met",
        "meaning": "An independent anchor agreed on a competent axis."
      },
      {
        "value": "not_met",
        "meaning": "No independent anchor agreed; the clear was withheld."
      },
      {
        "value": "not_required",
        "meaning": "The reading was divergent; a divergence needs no anchor."
      },
      {
        "value": "not_reached",
        "meaning": "The reading was undetermined before the gate."
      }
    ],
    "leg_state": [
      {
        "value": "authentic",
        "meaning": "Signed by an active ratified member or witness key."
      },
      {
        "value": "unauthenticated",
        "meaning": "No attestation; blocks under strict signing."
      },
      {
        "value": "forged",
        "meaning": "The signature does not cover the leg as received - including any block it carries."
      },
      {
        "value": "unknown_key",
        "meaning": "Signed by a key the operator does not hold."
      },
      {
        "value": "not_a_member",
        "meaning": "Signed by a key that is not active."
      }
    ],
    "price_basis": [
      "agreed",
      "missing",
      "disagreed"
    ],
    "origin_binding": [
      "bound",
      "unbound",
      "unverified"
    ],
    "origin_opening": [
      "consistent",
      "misstated",
      "not_this_document",
      "other_table",
      "unreadable"
    ],
    "path_state": [
      {
        "value": "counted",
        "meaning": "Counts released above the k gate."
      },
      {
        "value": "undetermined",
        "meaning": "Withheld; reason_code bad_locator, no_hops or below_k. Never a partial count."
      }
    ],
    "verifier": [
      {
        "value": "AUTHENTIC",
        "meaning": "Operator signature, every input attestation and the recomputed join all hold."
      },
      {
        "value": "TAMPERED",
        "meaning": "Something does not hold; `join` names what: disagrees, gate_not_met, anchor_unsigned, basis_disagrees, assertion_disagrees."
      },
      {
        "value": "UNAUTHENTICATED_INPUTS",
        "meaning": "The operator signature holds, but the record names no signed inputs."
      }
    ],
    "signature_form": [
      {
        "value": "low_s",
        "meaning": "The canonical form every signature takes since the malleability fix."
      },
      {
        "value": "high_s",
        "meaning": "A legacy record, or a malleated copy of one - the same record, never a second verdict."
      }
    ]
  },
  "note": "Integrate on these codes. The refusal registry (/cannot.json) names the tests that pin each behaviour.",
  "disclaimer": "A registry of meanings under change control, not a behavioural guarantee: behaviour is pinned by tests, which /cannot.json names. Prose messages may change; codes do not, within a major version."
}