---
title: "Troubleshooting"
---

# Troubleshooting

Causes and fixes for common problems in the Editor, by symptom, with the reason codes the Editor shows.

Most messages in the Editor say what happened, what to do, and end with a code in parentheses. When you ask your administrator for help, give them that code.

## Sign-in

| Message or code | Cause | Fix |
|---|---|---|
| `network_dns` | The server name could not be found | Check the address, and that this device can resolve it (VPN, DNS) |
| `network_tls` | The server's certificate was not trusted | With a corporate proxy or TLS inspection, its certificate must be trusted by this device; ask your administrator. Do not continue on a network you do not trust. |
| `network_refused`, `network_offline`, `network_proxy` | The connection was refused, there is no network, or the proxy failed | Check the address, the network and the proxy settings |
| `discovery_timeout`, `discovery_network` | The server did not answer, or could not be reached | Check the address and your connection |
| `discovery_*_untrusted`, `discovery_redirect_refused`, `discovery_openid_issuer_mismatch` | The server described itself with addresses that do not belong to it, or tried to redirect | Do not continue. Check the server address with your administrator. |
| `iss_not_supported` | The server does not identify itself in sign-in responses (RFC 9207) | Upgrade the server, or your administrator allows an older self-hosted server through managed policy (`NeuralInverseKeystoneAllowMissingIss`) |
| `iss_mismatch` | The response came from another server than the one you started with | Do not continue. Start sign-in again from the Editor. |
| `invalid_client` (for example `token_exchange_http_401.invalid_client`) | The server does not know this app's client; it is older than the app | Your administrator upgrades the server or sets `NeuralInverseKeystoneClientId`. The Editor never tries another client by itself. |
| `endpoint_user_setting_invalid` | `neuralInverse.keystone.baseUrl` is not a valid https address (no path, no credentials) | Fix or clear the setting |
| `endpoint_managed_policy_invalid`, `endpoint_locked_endpoint_*` | The address from policy or the build is invalid | Ask your administrator, or install the build your organisation provides |
| `endpoint_changed` | The configured address changed, so the old session ended | Sign in to the new server |
| `timeout` | Sign-in was not finished in the browser in time | Start again. If the browser said the client is not recognised, the server is older than the app. |
| `loopback_start_failed`, `loopback_error` | The local listener for the browser sign-in failed | Try again, or sign in with a device code |
| `device_expired` | The device code expired before approval | Start again |
| `device_blocked`, `device_revoked` | Your organisation blocked or revoked this device | Ask your administrator |
| `device_limit_exceeded` | You reached your organisation's device limit | Remove a device you no longer use, then sign in |
| Session ends after a restart | No usable credential store; the session was kept in memory | On Linux, install and unlock a Secret Service keyring such as GNOME Keyring |

## Policy and approvals

| Symptom | Cause | Fix |
|---|---|---|
| Every bundle is rejected | No key is pinned, or the organisation does not match | Your administrator pins the key (`NeuralInverseGovernancePolicyKeys`) and sets `NeuralInverseGovernanceOrganisation`. `ni-gov policy show` lists trusted keys and each rejection. |
| "rollback" rejection | The device already accepted a higher policy version | Your administrator signs a version above it |
| Agent features locked | The policy expired beyond its offline grace, a required policy cannot be verified, or the stored policy was deleted | Your administrator distributes a current policy. Editing and committing keep working. |
| An engine is blocked | A mandatory rule cannot be enforced by that engine version, or the version is unknown | The Governance view names the rule |
| "The policy names no approval rule for this, so nobody can approve it." | The action needs approval but no rule says who | Ask your administrator to add an approval rule |
| A setting you changed has no effect | The setting is governed | The Governance view lists ignored values under Governed Settings; change it through your administrator |
| Your signature does not count | Your device key is not enrolled, you are the author or requester, or the content changed after you signed | Enrol with **Copy Key for Enrolment**; ask another approver; sign again after the change |
| Signing fails in the Agents app or Editor | The app that holds the device key is quitting or not responding | Try again in a moment |
| Agent sessions refused in a repository | The policy requires an intent | Run **Set Intent...** |

## Audit

| Symptom | Cause | Fix |
|---|---|---|
| **Audit Unavailable** in the status bar | The ledger cannot record (keychain locked, disk full, integrity failure) | Open the Activity Log for the reason. In block mode, AI tool calls, agent commands and extension installs wait until it can record. |
| **Audit Locked**, "Waiting for the key file passphrase" | No keychain; the keys are in a passphrase-protected file | Run **Enter Audit Key File Passphrase** |
| Erasure refused | A legal hold is in force, or your organisation does not allow erasure | Ask your administrator |
| Export refused for an evidence builder | The audience is not on your organisation's allowed builders list | Ask your administrator |

## Models

| Symptom | Cause | Fix |
|---|---|---|
| "Saved, but it could not be reached" | The provider's address or key is wrong, or the network blocks it | Choose **Test** to see the error; check the endpoint and key |
| Keys are lost when the app closes | No system credential store | On Linux, install and unlock a Secret Service keyring |
| A local server is not under **Found on this computer** | It is not running on its default address, or a provider of that type is already connected | Enter its address in the provider's block |
| Organisation models fail | You are signed out, or Govern refused the model | Sign in; ask your administrator which models are assigned to you |
| A model cannot be picked | Your organisation's policy denies or requires approval for it | Choose another model, or request approval |

## Organisation context

| Message | Cause | Fix |
|---|---|---|
| Context withheld | Your organisation's policy denied it | Nothing to fix on the device; the prompt goes without context |
| Context unavailable | Govern cannot serve it now, or its address could not be verified | It is tried again automatically |
| Repository registered to several projects | The Directory binds none of them | An administrator registers the repository to one project, or choose a space on the Spaces page |
| No project for a folder | No remote is registered to a project you can read | Check **Show Workspace Bindings** |

## Checks

| Symptom | Cause | Fix |
|---|---|---|
| The status bar shield shows an error and evaluation stopped | The provenance ledger does not verify | Note the entry and reason in the tooltip and tell your administrator |
| A finding does not block | It comes from an unsigned pack (baseline or workspace) | Only packs in your organisation's signed policy block |
| A file shows no findings | It could not be checked; findings are unavailable, not clean | Check the Checks view for coverage problems |

## Evidence packs

| Code | Meaning |
|---|---|
| `signature-invalid`, `unexpected-key` | The pack was not signed by the key you expected |
| `unexpected-device-key` | The evidence names a device you did not list |
| `answers-do-not-follow`, `output-does-not-follow` | The pack's answers or outputs differ from what its evidence gives: it was changed after signing |
| `unsupported-version` | The pack was built with another version; verify with the tool version its manifest names |

## Collecting information for support

- The code in parentheses at the end of the message.
- **Show Neural Inverse Server** and **Show Neural Inverse Account**.
- The Governance view's Policy in Force and Rejected Policy Sources.
- The Activity Log's Ledger and Policy section.

Never send tokens, keys or passphrases. The Editor never shows them.