Message & error reference
What Covenant's messages mean and what to do. Grouped by feature.
Vendors & import
| Message | Meaning / fix |
|---|
| "Vendor name is required." | Enter a name before adding. |
| "Import error: missing required 'name' column" | Your CSV header lacks name. Add a header row. |
| "Import error: row N: missing name" | That row has no name; it's skipped. |
| "Imported N vendor(s), skipped M duplicate(s)." | Success; M rows matched an existing domain and were deduped. |
| "Delete this vendor and its assessment/BAA/findings?" | Confirms a destructive delete. Export first if unsure. |
Questionnaire & portal
| Message | Meaning / fix |
|---|
| "Questionnaire request sent to v***@…" | Live send (cloud) succeeded; recipient masked. |
| "Send simulated locally (no account / offline)." | Offline stub; nothing emailed. Deliver the link yourself. |
| "…N reminder(s) queued in the local outbox on the 3/7/12-day cadence." | Reminder cadence recorded locally (live mode "scheduled" instead). |
| "link expired …" / "link signature mismatch …" | The portal token is no longer valid. Re-send. See Vendor portal. |
| "That doesn't look like a valid response code." | The pasted code is corrupt/truncated. Re-copy the full code. |
| "This response code is for a different/expired questionnaire link." | Code is from an older link. Use the latest, or re-send. |
| "This response is for a different questionnaire template." | Template changed after send. Re-send the intended template. |
| "Cannot import: this questionnaire link is no longer valid (…). Re-send a fresh link." | Token expired/tampered. Re-send. |
| Portal: "This questionnaire link can't be opened" | Expired or malformed link shown to the vendor. Send a fresh one. |
| Portal: "Could not load the questionnaire content. Please open this link over HTTP." | The portal couldn't fetch its data; serve over HTTP, not file://. |
Posture scan
| Message | Meaning / fix |
|---|
| "Add a primary domain for this vendor to scan it." | Set a Primary domain. |
| "Refusing to scan: …" | SSRF guard rejected the target (IP, private range, port, credentials, or reserved TLD). Use a public domain. |
| "Live scan complete for … Probed now: … Deferred to the hosted runner: tls, headers, ports, breach." | Success. Email-auth ran; the rest is the deferred runner's job. |
| "Live scan could not run: …" | DNS/network error. Retry. |
| "Simulated scan complete — no new findings for this domain." | The deterministic simulation produced nothing new for this domain. |
| "Scan runner unavailable." | The scan module didn't load. Reload the app. |
Attachments
| Message | Meaning / fix |
|---|
| "Could not attach: file type .xxx is not allowed" | Use an allowed type (pdf/png/jpg/jpeg/csv/xlsx/docx). |
| "Could not attach: file exceeds 25 MB limit" | Reduce file size below 25 MB. |
| "Could not attach: empty file" | The file is 0 bytes. |
| "This stub attachment's bytes were dropped on reload…" | Local-stub bytes don't persist a reload. Re-attach or sign in to store in R2. |
| "Upload failed: …" | The R2 upload errored (backend reachability). Retry or use the local stub. |
Cloud & evidence
| Message | Meaning / fix |
|---|
| "Sign-in unavailable: …" | The cloud module/backend isn't reachable. The app stays local-first. |
| "Sign in to the Cloud tier first." | Publishing evidence needs a signed-in session. |
| "Published vendor-risk evidence to the shared graph." | Success; the canonical PHI-safe object was published. |
| "Publish failed: … (The evidence seam is wired; the Keystone API must be reachable.)" | The backend wasn't reachable. Try again when online/enabled. |
| "Synced." / "covenant cloud: sync failed" | Background sync result. A failure is logged but doesn't break local mode. |
Notifications
| Message | Meaning / fix |
|---|
| "refusing to send: payload appears to contain a secret or personal identifier" | A safety guard blocked a send because the data looked like it held a key or SSN. This shouldn't happen with normal use; remove any such value. |
| "// Live email/Slack delivery … runs on the deferred send runner…" | Informational note on the BAA reminders panel: cadence is computed now, delivery is deferred. |