Skip to content

dbt self-service error catalog

This catalog is for dbt authors, CI owners, and Airflow operators responding to stable dbt publishing and ClickHouse staging failures. JSON output uses dpone.error.v1; remediation must follow the stable code, not raw exception text.

Author and compile errors

Code Meaning Next action Retry
DPONE_DBT_WORKSPACE_ADMISSION_UNAVAILABLE A workspace candidate is readable but physical-target admission is not yet available for activation, recovery or audit restoration. Keep the current deployment; the platform must implement and certify admission and runtime reservation/finalization. Do not change the wire, generated pointers or validation gates. A sealed inactive snapshot is not an active deployment. Only after platform certification; repeated retries do not grant admission
DPONE_DBT_WORKSPACE_ACTIVATION_COMMIT_UNKNOWN The local pointer may have changed, but the protected activation authority did not return exact durable ACTIVE readback for the same occurrence. Freeze workspace execution, retain the pointer and PREPARED reservation, and run exact cache/authority recovery. Never infer rollback, release guards, or repeat writes from the missing acknowledgement. Only through explicit occurrence reconciliation
DPONE_DBT_WORKSPACE_PHYSICAL_OBSERVATION_UNAVAILABLE SQL Server could not prove the complete bounded physical target, catalog, principal, or dependency observation for the exact release and runtime binding context. Keep activation denied. Restore the pinned database, metadata permissions, exact resolved binding, supported identifiers, and bounded catalog availability; then repeat observation from the unchanged immutable release. Never treat a partial or unavailable observation as an empty target set. After the physical catalog and verified runtime context are observable
DPONE_DBT_WORKSPACE_PARSE_PROFILE_INVALID A compile-time dbt profile is missing, unsafe, malformed, over 1 MiB, or lacks a policy-selected profile/target. Provide a regular project-root profiles.yml or --dbt-profiles-dir containing the existing runtime profile/target names. Use non-secret parse-only credentials; ambient secret variables are not forwarded. This is separate from publishing policy. After profile correction
DPONE_DBT_WORKSPACE_PROFILE_OVERRIDE Workspace discovery inherited a global publishing-policy override, including an empty value. Unset DPONE_DBT_PUBLISH_PROFILES; keep one standard policy file per publishing project. After environment correction
DPONE_DBT_WORKSPACE_DISCOVERY_INVALID Project metadata, a generated-directory path, or a traversed filesystem entry is unsafe or ambiguous. Use literal project names/relative paths, regular files and exactly one standard policy location; remove non-ignored symlink aliases. After source/path correction
DPONE_DBT_WORKSPACE_DISCOVERY_LIMIT Traversal exceeded its entry, project-count or depth bound. Select the smallest complete workspace root; keep dependencies and generated outputs in standard configured directories. Do not compile a partial inventory. After layout correction
DPONE_DBT_WORKSPACE_IDENTITY_COLLISION Project names/roots or generated workflow/DAG/workload identities have multiple owners. Resolve the reported conflicting declarations. Never automatically rename deployed DAG IDs or treat aliases as proof of distinct physical targets. After reviewed identity correction
DPONE_DBT_WORKSPACE_TARGET_COLLISION Selected materialized models or generated transfers have duplicate literal destination coordinates. Review both reported project/workflow/resource owners and assign one writer per relation. Renaming a connection alias does not establish physical separation. After source/policy correction
DPONE_DBT_WORKSPACE_TARGET_INVALID A selected model or generated transfer has incomplete or unsupported write coordinates. Regenerate the canonical manifest and correct project-local publishing policy. Never edit generated packs or selection locks. After source/policy correction
DPONE_DBT_NO_PUBLISH_MODELS No model has resolved publish.enabled: true. Check inherited +meta; use --allow-empty only in an explicit report-only monorepo job. After source change
DPONE_DBT_MANIFEST_MISSING The selected target/manifest.json does not exist. Run dbt parse in the selected project, then retry without moving the generated artifact. Safe
DPONE_DBT_MANIFEST_STALE dbt source is newer than target/manifest.json. Run dbt parse, then retry dpone dbt check. Safe
DPONE_DBT_MANIFEST_INVALID_JSON The manifest is not strict JSON or contains duplicate/non-finite values. Re-run the pinned dbt parse; do not repair manifest.json by hand. After clean parse
DPONE_DBT_MANIFEST_INVALID The manifest does not satisfy the supported dbt artifact contract. Check the pinned dbt version and regenerate the artifact from source. After clean parse
DPONE_DBT_MANIFEST_VERSION_UNSUPPORTED The manifest schema is outside the declared matrix. Use an exact supported dbt toolchain or upgrade dpone through its migration guide. After toolchain change
DPONE_DBT_INTENT_INVALID Resolved meta.dpone.publish violates the strict schema. Fix JSON types and unknown or forbidden fields; run dpone dbt explain MODEL. Safe
DPONE_DBT_MODEL_REQUIRED explain was called without a model selector. Run dpone dbt explain MODEL. Safe
DPONE_DBT_MODEL_NOT_FOUND The selector does not identify a publish-enabled model. Use the exact dbt unique_id, FQN, alias, or listed model name. Safe
DPONE_DBT_MODEL_AMBIGUOUS A short selector matches more than one model. Retry with the exact dbt unique_id or FQN. Safe
DPONE_DBT_WORKFLOW_ID_INVALID A workflow ID is not a lowercase path-safe identifier matching [a-z][a-z0-9_]{0,63}. Rename the workflow in dbt metadata and platform policy; no artifact was written. After source/policy change
DPONE_DBT_PROJECT_ARGUMENT_CONFLICT Positional project and --project-dir identify conflicting roots. Keep exactly one project-root form. Safe
DPONE_DBT_PROJECT_INVALID The selected dbt project root is missing, unsafe, or has no regular dbt_project.yml. Select an existing project directory; do not use a symlinked root or project file. Safe after path correction
DPONE_DBT_SQLSERVER_PROJECT_POLICY_INVALID dbt_project.yml is unsafe, malformed, ambiguous, lacks the four required literal SQL Server adapter booleans, or redirects adapter macro dispatch. Restore a regular non-symlinked unique-key YAML file; set safe type expansion false and transactions, schema concat, and native string types true; remove top-level dispatch; run dbt parse and check again. After source correction
DPONE_DBT_SQLSERVER_GRAPH_CAPABILITY_UNSUPPORTED The exact selected closure contains a seed, snapshot, ephemeral/Python/custom model, unknown or unsafe config, hooks/grants/operations, storing test failures, or another unlisted SQL Server behavior. Follow the node/field remediation and documented policy boundary; never edit the manifest or lock. After source correction; never patch the lock
DPONE_DBT_SQLSERVER_PHYSICAL_CONSTRAINT_UNSUPPORTED A model-level constraint or column constraint other than not_null could change physical SQL Server behavior outside the certified v1 boundary. Remove the physical constraint and express unique, primary-key, foreign-key, check, or custom assertions as admitted data/unit tests; regenerate the manifest and release. After source correction; never patch the lock
DPONE_DBT_SQLSERVER_MACRO_AUTHORITY_INVALID The exact generated framework or invocation macro record, dependency, selected-node call, dispatch candidate, or metadata helper differs from the pinned authority. Restore dbt Core 1.12.3 and dbt-sqlserver 1.11.1, restore reviewed package/source macros, run dbt deps when declarations changed, then dbt parse; never edit the manifest or baseline. After source/toolchain correction
DPONE_DBT_UNIQUE_KEY_MISSING An incremental merge has no effective key. Declare one identifier or an ordered identifier list in dbt config and regenerate the manifest. After source correction
DPONE_DBT_UNIQUE_KEY_INVALID The key has an invalid shape, exact/case-fold duplicate, or publishing metadata disagrees with dbt config. Keep one ordered identifier tuple and remove or exactly align the metadata override. After source correction
DPONE_DBT_UNIQUE_KEY_EXPRESSION_UNSUPPORTED A key value is SQL syntax rather than one identifier. Replace the expression with exact contract column names; materialize any derived value as a contracted column first. After model/contract correction
DPONE_DBT_UNIQUE_KEY_NOT_IN_CONTRACT The model contract is not enforced or a key does not exactly name a declared column. Enforce the model contract and add or correct the exact key column declaration. After contract correction
DPONE_DBT_UNIQUE_KEY_NULLABLE A merge-key column lacks an admitted structural not_null constraint. Add a column-level constraints: [{type: not_null}]; retain an ERROR not_null data test for row assurance, then parse again. After contract correction
DPONE_DBT_TEST_DEPENDENCY_OUTSIDE_WORKFLOW An eager-selected data test reads a model outside the current workflow closure, has no model dependency, or has a foreign attachment. Move every tested model into one workflow or rewrite the test across a separately governed source boundary. After graph/ownership correction
DPONE_DBT_CROSS_WORKFLOW_DEPENDENCY_UNSUPPORTED One workflow's selected model closure contains a publish-enabled model owned by another workflow. Move the dependent publish models into one workflow, or replace the cross-workflow ref() with a separately governed source boundary; parse and compile a new release. After graph/ownership correction
DPONE_DBT_WORKFLOW_GRAPH_OVERLAP Two workflow closures share a non-publish materialized upstream model, so mutation ownership is ambiguous. Make materialized model closures disjoint or merge the workflows; do not use an ephemeral model as a workaround; compile into a new empty output directory. After graph/ownership correction
DPONE_DBT_COMPILE_FAILED Compilation stopped on a handled compiler, policy, selection, or filesystem failure. Inspect the structured nested error and next action; do not treat an absent release as publishable. After the reported cause is corrected
DPONE_DBT_PROFILES_MISSING No trusted platform publish-policy catalog was found. Create dpone/dbt-publish-profiles.yml or pass the reviewed catalog with --profiles. After configuration change
DPONE_DBT_PROFILES_AMBIGUOUS More than one implicit publish-policy catalog is visible for the selected project. Pass exactly one reviewed catalog with --profiles; do not rely on filesystem ordering. Safe after explicit selection
DPONE_DBT_PROFILES_INVALID The publish-policy catalog is malformed or violates its closed schema. Validate the catalog against dpone.dbt-publish-policy.v1 and correct the reported field. After configuration change
DPONE_DBT_PROFILES_KIND_INVALID The policy catalog has an unsupported schema discriminator. Migrate it to dpone.dbt-publish-policy.v1; do not relabel incompatible bytes. After migration
DPONE_DBT_PROFILE_UNKNOWN The named platform profile does not exist. Select a published profile or ask its platform owner to add one. After policy change
DPONE_DBT_WORKFLOW_UNKNOWN The model references a workflow absent from platform policy. Select a published workflow or ask its platform owner to add one. After policy change
DPONE_DBT_ROUTE_NOT_SUPPORTED Capability discovery cannot build the requested route. Choose a supported profile/strategy; do not force a connector pair. After policy/capability change
DPONE_DBT_ROUTE_NOT_CERTIFIED Production compile cannot prove current authorized PASS evidence at production-certified or enterprise-certified level. Repair the consuming project's dpone.yaml evidence authority or run the exact route certifier; never treat check or the demo as evidence. After current evidence exists
DPONE_DBT_ROUTE_CERTIFICATION_AMBIGUOUS More than one certification variant claims the same route, transport, schema-evolution, and Airflow/runtime coordinates. Remove the duplicate platform evidence entry; never choose one by ordering. After evidence catalog correction
DPONE_DBT_STRATEGY_UNRESOLVED No replay-safe strategy can be proven. Supply the required unique/partition key or obtain an approved full-refresh budget. After source/policy change
DPONE_DBT_PARTITION_KEY_MISSING Partition replacement has no partition key. Select a contracted partition column through approved metadata/policy. After model or policy change
DPONE_DBT_PARTITION_KEY_NOT_IN_CONTRACT The requested partition key is absent from the enforced dbt contract. Add the column to the contract or choose a contracted key. After model change
DPONE_DBT_STATE_POLICY_REQUIRED A stateful strategy has no platform-owned checkpoint/state contract. Add the profile state block with a logical connection_ref and checkpoint table; do not place credentials in model metadata. After policy change
DPONE_DBT_SECRET_FORBIDDEN Model metadata contains a secret-like key or value. Remove credential material and use only a logical connection_ref. Rotate any exposed value. After security correction
DPONE_DBT_CONTRACT_REQUIRED Production publishing is enabled without an enforced dbt contract. Set contract.enforced: true and declare the published columns. After model change
DPONE_DBT_CONTRACT_COLUMNS_MISSING The enforced contract contains no publishable columns. Add the complete source relation columns to the model contract. After model change
DPONE_DBT_CONTRACT_TYPE_UNSUPPORTED A dbt column type has no safe automatic MSSQL logical mapping. Use a supported MSSQL contract type or obtain an approved explicit type-fidelity policy. After contract/policy change
DPONE_DBT_EPHEMERAL_UNSUPPORTED An ephemeral model has no independently publishable relation. Materialize the model as a supported relation before publishing. After model change
DPONE_DBT_V2_ADAPTER_OPTION_UNSUPPORTED A dbt-sqlserver model or project option would activate behavior outside the frozen V2 adapter lifecycle. Restore the certified V2 option set; do not override hooks, grants, docs, indexes, query options, predicates, schema change, or full refresh. After source/policy correction and a new compile
DPONE_DBT_V2_CALLER_VAR_UNSUPPORTED Caller-controlled dbt vars could change the platform-owned scope or strategy input. Remove the caller var and use only the signed platform scope map. After invocation correction
DPONE_DBT_V2_COMPILE_UNVERIFIED The exact pinned compile result or its immutable evidence could not be proven. Restore the certified toolchain and project bundle, then compile again; unavailable evidence is not a pass. After fresh proof exists
DPONE_DBT_V2_DYNAMIC_MODEL_SOURCE_UNSUPPORTED Model source selection depends on a dynamic Jinja, environment, or runtime branch outside the closed proof. Replace it with a statically resolvable governed source dependency. After model correction and a new compile
DPONE_DBT_V2_EPHEMERAL_UNSUPPORTED A selected or transitive V2 node is ephemeral. Materialize the dependency outside this workflow as a governed read boundary; V2 does not inline ephemeral nodes. After graph correction
DPONE_DBT_V2_GRAPH_UNVERIFIED The selected dbt graph or its exact mutating/read-only closure could not be proven. Regenerate the pinned manifest and resolve every selected or transitive node; do not execute an incomplete closure. After fresh graph proof exists
DPONE_DBT_V2_LIFECYCLE_LOCK_INVALID The lifecycle lock is malformed, incomplete, or inconsistent with its digest. Recreate it from the certified dbt Core, adapter, driver, macro, project, profile, and invocation tuple. After a reviewed release rebuild
DPONE_DBT_V2_LIFECYCLE_NONCONFORMANT The observed adapter lifecycle contains a forbidden branch or side effect. Remove the nonconforming option or runtime and certify a new exact tuple; do not continue with the current release. Never against the nonconforming release
DPONE_DBT_V2_LIFECYCLE_UNVERIFIED Runtime evidence cannot prove the complete adapter statement envelope. Repair trace/catalog visibility and rerun certification against the exact tuple. After fresh lifecycle evidence exists
DPONE_DBT_V2_MACRO_CLOSURE_UNCLASSIFIED A selected macro or dispatch dependency is absent from the closed authority inventory. Remove it or add it through reviewed platform macro authority and recertification. After a new certified release
DPONE_DBT_V2_MACRO_CLOSURE_UNVERIFIED Exact macro bodies, dependencies, or dispatch winners could not be verified. Restore the pinned packages and generated authority, then recompile. After fresh proof exists
DPONE_DBT_V2_MODEL_UNSUPPORTED The model is outside the scope_stable_event_fact capability cell. Use an existing-table contracted incremental model with dpone_scope_merge, or choose a different governed path. After model/policy correction
DPONE_DBT_V2_MUTATION_UNCLASSIFIED A selected node or macro may mutate SQL Server but has no managed operation plan and recovery disposition. Remove the mutation or bring the exact node into the V2 managed closure. After graph correction and a new plan
DPONE_DBT_V2_OVERLAY_INVALID The protected V2 project overlay is malformed, collides with author configuration, or differs from the activated topology. Rebuild the activated pack from the exact compiled release; do not edit dbt_project.yml or overlay bytes in the worker. After a new protected activation
DPONE_DBT_V2_PACKAGE_INVALID The platform-owned dbt-dpone package path, closed file inventory, size, or digest differs from runtime authority. Restore the exact package bytes from the certified runtime image and activate a pack bound to their digest. Never against mismatched package bytes
DPONE_DBT_V2_PROFILE_STRATEGY_MISMATCH Platform semantic-refresh profile and model strategy do not select the same V2 lifecycle. Bind the platform profile to a model compiled with the exact dpone_scope_merge strategy. After platform/model correction
DPONE_DBT_V2_READ_ONLY_QUERY_REQUIRED Author SQL is not one read-only SELECT/CTE/set expression. Remove DML, DDL, execution, dynamic SQL, and side-effect statements from author SQL. After model correction
DPONE_DBT_V2_ROUTE_UNSUPPORTED The semantic-refresh profile resolves outside the certified MSSQL-to-ClickHouse cell. Select the platform-owned V2 MSSQL-to-ClickHouse profile. After platform policy correction
DPONE_DBT_V2_RUNTIME_AUTHORITY_INVALID Airflow dbt arguments, logical run, profile, topology, or package authority differ from the protected activated pack. Stop the task, restore the exact activated pack/runtime image and create a new governed run if identity changed. Never by altering the current task arguments
DPONE_DBT_V2_SOURCE_BUDGET_EXCEEDED The full logical dbt temp result or dependency proof exceeds a mandatory V2 source budget. Reduce the bounded workload or obtain a reviewed resource-policy revision; source-side pruning is not claimed. After source/policy correction
DPONE_DBT_V2_SOURCE_UNVERIFIED The governed source relation or module closure lacks current authoritative evidence. Restore catalog, definition, ACL, and writer-assurance evidence before execution. After fresh source evidence exists
DPONE_DBT_V2_SQL_PARSE_UNVERIFIED The pinned SQL parser cannot classify the compiled T-SQL inside the admitted read-only subset. Simplify the query or certify a new parser/runtime policy; do not execute unclassified SQL. After model or certified-parser change
DPONE_DBT_V2_TARGET_DEPENDENT_SQL Model results depend on the current publication target, making failed-operation replacement unsound. Rewrite the model to depend only on governed upstream sources. After model correction and a new compile
DPONE_DBT_V2_TARGET_READ_UNSUPPORTED Raw or compiled SQL directly reads the resolved mutation target. Remove this, incremental target branches, direct names, and target-returning macros. After model correction
DPONE_DBT_V2_TEST_MUTATION_UNSUPPORTED A selected data/unit test can persist failures or otherwise mutate state. Make the test read-only and set store_failures: false. After test correction
DPONE_DBT_ADAPTER_LIFECYCLE_DRIFT dbt Core, adapter, driver, macros, flags, engine compatibility, or emitted lifecycle differs from the certified tuple. Restore the exact runtime tuple or produce and certify a new release. Never against the drifted release
DPONE_DBT_ADAPTER_SCRATCH_CONFLICT A pre-existing adapter intermediate or backup relation makes the existing-table branch ambiguous. Quarantine the operation, reconcile the exact object owner, and remove it only through evidence-bound cleanup. After operator reconciliation
DPONE_SEMANTIC_REFRESH_LEGACY_BASELINE_REQUIRES_EXPLICIT_MIGRATION The required complete existing relation uses an unversioned legacy baseline. Run the certified initial-load/adoption migration; V2 cannot infer or create a greenfield baseline. After certified baseline migration
DPONE_DBT_MSSQL_OUTCOME_UNVERIFIED Durable SQL Server evidence is mixed, missing, or ambiguous after invocation. Reconcile the exact session, transaction, receipt and images. Do not retry, transfer, or replace until resolved. Manual after reconciliation
DPONE_DBT_RELATION_INVALID dbt did not resolve a complete database/schema/relation identity. Correct dbt relation configuration and run dbt parse again. After model/profile change
DPONE_DBT_WORKFLOW_PROFILE_CONFLICT Models in one workflow resolve different publish profiles. Split the workflow or use one platform profile. After metadata/policy change
DPONE_DBT_WORKFLOW_PARALLELISM_CONFLICT Models in one workflow request conflicting parallelism. Move concurrency to one platform workflow policy. After metadata/policy change
DPONE_DBT_WORKFLOW_TARGET_COLLISION Two workflow models resolve to the same target relation. Assign unique target relations or remove the duplicate publication. After metadata change
DPONE_DBT_SELECTION_INVALID dbt did not return the exact bounded workflow selection required by the compiler. Fix the selector/project graph and rerun with the pinned dbt toolchain. After source/toolchain change
DPONE_DBT_PUBLISH_OUTPUT_CONFLICT A different immutable tree already owns the output path. Use a clean staging destination; never merge generated trees manually. Safe after cleanup
DPONE_DBT_OUTPUT_WRITE_FAILED The complete immutable output tree could not be installed atomically. Check destination-parent permissions and free space, remove only abandoned staging files, then rerun. Safe after filesystem repair
DPONE_DBT_RAW_PHYSICAL_OVERRIDE_FORBIDDEN A certified build contains raw engine or partition_by. Move physical design into a platform-owned named profile. After source/policy change
DPONE_DBT_RAW_PHYSICAL_OVERRIDE_DEPRECATED Local preview consumed a legacy raw physical-design override. Migrate to a platform-owned named profile before production compile. Warning; migrate before release
DPONE_DBT_NON_REPLICATED_ENGINE Preview physical design resolves a non-replicated engine. Select an approved replicated physical-design profile for production. Warning; after policy change

Release and promotion errors

Code Meaning Next action Retry
DPONE_DBT_PROJECT_BUNDLE_INVALID Project capture, archive limits, release descriptors, or content identity are invalid. Rebuild from a clean dev checkout; inspect symlinks, excluded secrets, package locks, and size limits. After corrected build
DPONE_DBT_PACKAGE_LOCK_REQUIRED packages.yml or dependencies.yml exists, but the pinned package-lock.yml is absent. Run dbt deps && dbt parse, review the lock, and rebuild; dpone never downloads packages implicitly. After package resolution
DPONE_DBT_PACKAGES_NOT_RESOLVED package-lock.yml is stale for the current declaration, or the configured packages-install-path is absent, incomplete, or differs from the exact locked package names, so the runtime bundle would not be self-contained. Run dbt deps && dbt parse with the pinned toolchain, review and commit package-lock.yml, then retry from the unchanged source commit. After package resolution
DPONE_DBT_BUNDLE_INVALID A project archive member or extraction boundary is unsafe or malformed. Rebuild the immutable project bundle; never patch archive bytes. After corrected build
DPONE_DBT_BUNDLE_LIMIT_EXCEEDED File-count, per-file, compressed, or extracted-size budget was exceeded. Reduce the project payload or request a reviewed policy change. After source/policy change
DPONE_DBT_BUNDLE_TREE_MISMATCH Extracted files, modes, sizes, or hashes differ from the inventory. Discard the extraction and fetch the pinned bundle again. After clean fetch
DPONE_DBT_SOURCE_CHANGED Source files changed while the snapshot was being built. Retry from a stable checkout of one exact commit. Safe after checkout stabilizes
DPONE_DBT_PRODUCTION_RELEASE_SCHEMA_REQUIRED A compact release-set.v1 carries dbt runtime payload bytes but cannot prove the v2 selection, provenance, promotion, and certification authority required by a production projection or runtime receipt. Run dbt parse --project-dir path/to/dbt-project, then dpone dbt compile path/to/dbt-project --cache-root .dpone-cache --output-dir .dpone/gitops/airflow-v2. Record the new v2 release_id and rerun the full dpone airflow build command with a pinned Airflow bundle ref; never relabel or hand-edit the v1 release. After a new v2 release exists
DPONE_DBT_RELEASE_CACHE_LOCK_FAILED The local release-cache writer lease could not be created or acquired safely, so no immutable release was published. Check ownership, write permission, free space, and regular-file safety for the configured cache root; repair the platform-owned cache directory and retry without editing generated release bytes. Safe after cache-root repair
DPONE_DBT_RELEASE_INTEGRITY_INVALID A release file is missing, added, or changed relative to the signed checksum subject. Download the exact dev artifact again and verify the trusted signer workflow. Never repair immutable bytes. After clean download
DPONE_DBT_PROMOTION_SOURCE_DRIFT The prod audit mirror or promotion metadata differs from the pinned project bundle. Recreate the bot PR from the approved dev release; block manual mirror edits. After regenerated PR
DPONE_DBT_SELECTION_DRIFT Runtime or promotion selection differs from the dbt-authored lock. Stop and publish a new release from the editable dev source. Not against old release
DPONE_DBT_INVOCATION_CONTEXT_INVALID The frozen hermetic dbt invocation contract is malformed or differs from its fingerprint. Rebuild and publish from the editable dev source; never patch a generated pack. Not against old release
DPONE_DBT_DEV_EVIDENCE_REQUEST_INVALID The campaign request, release/deployment inventory, producer identity, or workflow count is missing, malformed, or ambiguous. Regenerate it from the exact compiled release with dpone dbt prepare-dev-evidence-request; never edit or choose the evidence-set ID manually. After local input correction
DPONE_DBT_DEV_EVIDENCE_LIMIT_INVALID A campaign, polling, or HTTP timeout is outside its bounded CLI range, or polling exceeds the campaign timeout. Use --timeout-seconds 30..7200, --poll-interval-seconds 1..60, and --request-timeout-seconds 1..60; keep polling at or below the campaign timeout. Safe after local argument correction
DPONE_DBT_DEV_EVIDENCE_CAMPAIGN_CONFIG_INVALID The Airflow origin/version/token or protected campaign journal root is unsafe. Restore the protected development-environment variables, short-lived token, and confined evidence root; do not pass an alternate origin from the caller. After platform correction
DPONE_DBT_DEV_EVIDENCE_CAMPAIGN_FAILED The bounded Airflow campaign timed out, returned a failed/unknown state, conflicted with an existing run, or could not persist terminal closure. Inspect the exact campaign request/receipt and Airflow run IDs, repair the live dependency, then replay the same workflow attempt. Manual after cause correction
DPONE_DBT_DEV_EVIDENCE_DELIVERY_INVALID The dev deployment lacks a valid platform-owned shared PVC/worker-queue evidence delivery contract. Rebuild the non-production deployment with the reviewed evidence PVC claim and dedicated Airflow worker queue. After deployment correction
DPONE_DBT_DEV_EVIDENCE_UNVERIFIED Exact dev deployment evidence is missing or does not cover every workload. Run the dev DAG, collect final dbt/transfer/workflow evidence, and retry promotion. After evidence exists
DPONE_DBT_DEV_EVIDENCE_INTEGRITY_INVALID The finalized dev evidence tree, provenance, checksum subject, or release/deployment binding is invalid. Re-export raw evidence from the exact dev run and let the protected dev evidence workflow finalize and attest it again; never repair the bundle. After a new trusted finalization
DPONE_ARTIFACT_ATTESTATION_REQUIRED Production publication or runtime verification has no exact portable attestation bundle or approved verifier policy. Re-run the trusted dev release workflow, publish its detached bundle, and promote a deployment pinned to dpone.runtime-artifact-trust-policy.v2; never bypass the gate. After trusted material exists

Runtime artifact attestation errors

These security failures use exit code 4. They are shared by the production workflow preflight and runtime init_fetch; neither surface falls back to checksum-only success.

Code Meaning Next action Retry
DPONE_ARTIFACT_TRUST_POLICY_INVALID The pinned trust-policy JSON, trusted root, signer constraints, or GitHub CLI range violates the closed v2 contract. Replace the policy through the platform-owned deployment process; do not edit a mounted snapshot in place. After a reviewed policy update
DPONE_ARTIFACT_TRUST_POLICY_MISMATCH The mounted policy bytes do not match the deployment-pinned digest or trust tier. Restore the exact ConfigMap snapshot or create a new deployment identity. After deployment correction
DPONE_ARTIFACT_TRUST_POLICY_EXPIRED The reviewed trusted-root refresh deadline has passed. Obtain and review a fresh offline root, publish a new policy snapshot, and deploy its digest. After policy rotation
DPONE_ARTIFACT_ATTESTATION_INPUT_INVALID CI preflight received a missing, unsafe, or unreadable subject, bundle, or policy path. Re-download the exact immutable workflow artifact into the confined job workspace. Safe after input repair
DPONE_ARTIFACT_ATTESTATION_SUBJECT_INVALID Runtime could not identify exactly one bounded release-set subject or its digest was malformed. Rebuild the deployment projection from the immutable release; do not substitute another file. After projection repair
DPONE_ARTIFACT_ATTESTATION_SUBJECT_MISMATCH The verified attestation does not bind the exact staged release-set.json bytes. Quarantine the release prefix and investigate producer or storage drift. Never against the same bytes
DPONE_ARTIFACT_ATTESTATION_BUNDLE_NOT_FOUND The detached bundle is absent at the digest-derived immutable registry key. Re-publish the same trusted bundle before the release completion marker and retry the pinned deployment. After immutable publication
DPONE_ARTIFACT_ATTESTATION_BUNDLE_INVALID The bundle is empty, unsafe, or malformed. Re-download or re-publish it from the trusted release workflow; never repair it manually. After trusted replacement under a new valid identity
DPONE_ARTIFACT_ATTESTATION_BUNDLE_TOO_LARGE The detached bundle exceeds the 8 MiB runtime ceiling. Investigate the producer and reduce the attestation set; do not increase limits ad hoc. After reviewed producer correction
DPONE_ARTIFACT_ATTESTATION_VERIFIER_UNAVAILABLE The pinned GitHub CLI verifier cannot start or the policy does not define a concrete backend. Use the certified runtime image and a v2 policy; verify gh version before promotion. After runtime correction
DPONE_ARTIFACT_ATTESTATION_VERIFIER_VERSION_UNSUPPORTED The installed GitHub CLI is outside the policy and dpone security window. Rebuild from the official runtime image or approve a new exact version range after certification. After image/policy update
DPONE_ARTIFACT_ATTESTATION_VERIFICATION_FAILED Offline signature, signer workflow, signer digest, issuer, predicate, or runner policy verification failed. Stop promotion, retain the bundle and release digests, and investigate the trust chain. Never as an automatic retry
DPONE_ARTIFACT_ATTESTATION_RESULT_INVALID The verifier returned empty, malformed, oversized, or semantically incomplete JSON. Treat the verifier as failed; inspect the certified CLI/image and captured non-secret diagnostics. After verifier repair

Runtime errors

Semantic refresh V2 compile and activation

These errors are fail-closed. They never authorize a generic transfer pack or allow a template pack to execute while exact lifecycle, catalog, topology, or live-route evidence is missing.

Code Meaning Next action Retry
DPONE_DBT_V2_BASELINE_AUTHORITY_INVALID The baseline subject or typed plan is not authorized by the exact promoted release/deployment authority. Reload the protected deployment authority and create a new typed plan; never edit or reconstruct the plan mapping. After authority repair
DPONE_DBT_V2_BASELINE_EVIDENCE_UNVERIFIED A required source, MSSQL, ClickHouse, route, writer, DDL, UTC, coverage, generation, UUID, schema, key, physical, or multiset observation is unavailable or differs from the plan. Restore the certified cross-engine observers and assurance verifiers, then re-run apply() against the same authorized plan. After current evidence is verifiable
DPONE_DBT_V2_BASELINE_STORE_CONFLICT The create-only MSSQL baseline record is absent from the acknowledgement, byte-different, or cannot be persisted/replayed exactly. Preserve the existing row and receipt, reconcile the protected baseline authority, and issue a new plan when the physical baseline truly changed. Never by overwriting the existing receipt
DPONE_DBT_V2_CATALOG_DRIFT The SQL Server object/module dependency observation changed after the content-addressed compile proof. Stop before dbt execution, reconcile the DDL/ACL change, then compile and certify a new immutable plan. Only with a new matching proof
DPONE_DBT_V2_CATALOG_EDGE_BUDGET_EXCEEDED The bounded SQL Server dependency frontier contains more catalog edges than the protected observation policy permits. Review the model/module dependency closure and reduce it, or approve a new bounded policy through the platform change process; never treat the partial frontier as complete. After a new bounded proof can be observed
DPONE_DBT_V2_CATALOG_NODE_BUDGET_EXCEEDED The bounded SQL Server dependency frontier contains more catalog objects than the protected observation policy permits. Review and reduce the selected dependency closure, or approve a new bounded policy through the platform change process; never certify a truncated catalog observation. After a new bounded proof can be observed
DPONE_DBT_V2_CATALOG_UNVERIFIED SQL Server catalog metadata, VIEW DEFINITION, or the protected DDL observation could not prove the complete read closure. Restore the certified catalog permissions and protected observer; do not interpret missing metadata as an empty closure. After authority is verifiable
DPONE_DBT_V2_CERTIFICATION_INVALID A lifecycle or live-route certification coordinate/digest is missing, malformed, foreign, or not current. Persist a current typed certification receipt for the exact release, deployment, runtime tuple, and route. After trusted certification
DPONE_DBT_CERTIFICATION_COORDINATE_SHA256 A certification coordinate cannot be represented by one canonical lowercase SHA-256 digest. Recreate the typed certification coordinate from the immutable release and deployment authority; never copy a digest from another route. After trusted certification is rebuilt
DPONE_DBT_V2_FUNCTION_UNSUPPORTED Compiled author SQL invokes a scalar, multi-statement, CLR, unresolved, or otherwise unsupported SQL function/module. Rewrite the model to the supported base-table, schema-bound view, or schema-bound inline-TVF closure. After a new compile proof
DPONE_DBT_V2_GENERIC_PACK_FORBIDDEN A semantic-refresh V2 model reached the generic transfer/replace pack projection. Use the protected semantic-refresh template, post-deployment plan, activation receipt, and dedicated runtime composition. Never through the generic pack
DPONE_DBT_V2_GRAPH_POLICY_UNAVAILABLE The compiler cannot load the exact governed dbt graph/mutation policy required by the V2 profile. Restore the pinned platform policy artifact and compile the exact selector again. After policy restoration
DPONE_DBT_JINJA_GLOBAL Model or macro source reaches an unapproved Jinja global, namespace, import, alias, or indirect callable gateway. Rewrite the source to the closed V2 allowlist of direct config, ref, source, literal var, and exact reviewed macro calls; then compile a new release. After source correction
DPONE_DBT_V2_LIFECYCLE_POLICY_MISMATCH The selected model or adapter lifecycle differs from the frozen dbt Core/dbt-sqlserver policy. Remove hooks, schema/index/grant/doc mutations or other unsupported config and compile with the certified runtime tuple. After a new lifecycle proof
DPONE_DBT_V2_LIFECYCLE_REPORT_INVALID The lifecycle report is malformed, non-PROVEN, or does not bind the exact policy and certification coordinate. Regenerate it with the pinned compiler; never repair report JSON by hand. After trusted regeneration
DPONE_DBT_V2_LIVE_UNVERIFIED Exact-environment live certification is absent, stale, skipped, or does not authorize this route coordinate. Run the required MSSQL, ClickHouse, Airflow, Kubernetes, Vault, and artifact-store campaign in the approved environment and persist its signed receipt. After current live evidence
DPONE_DBT_V2_OBJECT_TYPE_UNSUPPORTED The dependency closure contains an unsupported SQL Server object type. Restrict the closure to allowed base tables, schema-bound views, and schema-bound inline TVFs. After model/dependency correction
DPONE_DBT_V2_PROOF_DRIFT Current source, compiled SQL, catalog, or lifecycle observations differ from the immutable proof bound to the activated plan. Stop before mutation, reconcile the changed input, then compile, certify, and activate a new immutable release. Never against the drifted proof
DPONE_DBT_V2_PROOF_INVALID The projected immutable-proof record is malformed, incomplete, or inconsistent with its canonical digest closure. Rebuild the template and deployment projection from the exact pre-release proof; do not repair projected JSON by hand. After deterministic reprojection
DPONE_DBT_V2_PROOF_UNVERIFIED A required source, SQL, catalog, or lifecycle observation is unavailable or cannot be proven current. Restore the protected proof authority and live observers before allowing dbt execution. After current proof becomes verifiable
DPONE_DBT_V2_RESERVED_RELATION_NAMESPACE A governed source or module uses a dbt scratch or dpone semantic-refresh relation namespace reserved for transactional runtime state. Rename the author relation outside __dbt_tmp, dpone_sr_before_*, and dpone_sr_after_*, then compile a new immutable plan. After the catalog and model are corrected
DPONE_DBT_V2_RUN_AUTHORITY_INVALID Actual-DagRun admission, static projection coordinates, model closure, or protected deployment/run receipt differs from the authenticated plan. Stop before dbt; reload the exact indexed sidecar and deployment authority, then admit the same actual DagRun through the atomic worker boundary. After protected authority repair
DPONE_DBT_V2_RUN_GUARD_INVALID The workflow/resource guard closure is malformed or differs from the plan-bound run guard digest. Re-admit the actual DagRun from the authenticated plan bundle and exact guard inventory; never accept caller-supplied guard IDs. After protected admission repair
DPONE_DBT_V2_TEMPLATE_NOT_EXECUTABLE A deployment-neutral semantic-refresh template was submitted as an executable pack. Persist deployment authorities and publish its verified run-neutral DAG sidecar; the first actual-DagRun worker performs run admission. After protected deployment activation
DPONE_DBT_V2_TOPOLOGY_INVALID The run-neutral task graph, DAG policy, operation inventory, dependency edges, or terminal summary topology differs from the authenticated plan. Rebuild the indexed projection from the exact template/deployment plan; do not add, remove, or reorder tasks at runtime. After deterministic reprojection
DPONE_AIRFLOW_SEMANTIC_REFRESH_RUNTIME_REQUIRED A verified Airflow index contains semantic-refresh sidecars, but the provider was not given the cohesive protected worker capability. Install/configure the semantic-refresh worker authority before strict init-fetch; never omit the indexed DAGs or replace admission/binding resolution with unrelated callbacks. After runtime composition repair
DPONE_SEMANTIC_REFRESH_DAG_PROJECTION_INVALID The deployment projection or indexed semantic-refresh sidecar is missing, duplicated, malformed, or differs from its authenticated plan/topology identity. Rebuild the deployment projection from the exact promoted release and plan; publish and activate a new immutable index. After deterministic reprojection
DPONE_REFRESH_CLICKHOUSE_MATERIALIZED_WRITER_UNSUPPORTED The protected ClickHouse target has an incoming materialized view whose TO destination writes into it, so exclusive mutation ownership cannot be proven. Detach or redesign the external writer through a reviewed deployment change, recertify the physical topology, and activate a new plan. Never while the incoming writer exists
DPONE_SEMANTIC_REFRESH_TERMINAL_SUMMARY_REQUIRES_EXPLICIT_MIGRATION Existing control state predates the durable canonical terminal-summary contract and cannot be upgraded implicitly. Stop activation and run the reviewed control-schema migration with an explicit legacy-summary decision; never synthesize terminal success. After explicit migration
Code Meaning Next action Retry
DPONE_DBT_RUN_RESULTS_INVALID A non-mutating validator rejected a run_results.json contract. After dbt build starts, missing, malformed, incomplete, stale, or selection-drifted results are surfaced as COMMIT_UNKNOWN because target mutation cannot be disproved. Inspect the dbt task, unit/data tests and pinned target path; transfers must remain blocked. Only when no mutation started
DPONE_DBT_TARGET_IDENTITY_MISMATCH The deployment-resolved adapter, database, or schema differs from the logical target frozen in the release. dbt build did not start and the target was not mutated. Correct the binding/registry or promote a deployment matching the release; do not rebuild only to hide an environment error. After deployment correction
DPONE_DBT_RESULTS_INVALID A low-level run-results parser rejected the artifact; public CLI/runtime handling normalizes this to DPONE_DBT_RUN_RESULTS_INVALID. Follow the normalized run-results recovery action. Only after a new dbt task attempt
DPONE_DBT_SCHEMA_DRIFT The live MSSQL relation differs from the compiled contract. Reconcile column order, type, precision/scale, and nullability before staging; publish a new immutable release whenever source semantics changed. After schema/source correction and release publication
DPONE_CLICKHOUSE_STAGING_UNIQUE_KEY_NULL The exact post-lineage ClickHouse finalization table contains at least one NULL key component. The finalizer did not query or mutate the target and attempt-table cleanup was attempted. Read operation_tables and cleanup_status from the failed load step, follow the runbook verification, correct the source/transform nulls, then run a new pinned attempt. Safe only with failed-before-target and cleanup proof
DPONE_CLICKHOUSE_STAGING_UNIQUE_KEY_DUPLICATE The exact post-lineage ClickHouse finalization table contains a duplicate key group. The finalizer did not query or mutate the target and attempt-table cleanup was attempted. Read operation_tables and cleanup_status from the failed load step, follow the runbook verification, correct the key/transform or duplicate rows, then run a new pinned attempt. Safe only with failed-before-target and cleanup proof
nested_package_partial_finalize A nested member target was invoked, or an earlier member committed, before the package could finish. The failure evidence retains current and pending member staging and exposes finalized_tables, retained_members, and exact operation_tables. Freeze automatic retries. Reconcile every finalized/retained member and its target using the retained-staging procedure; clean only exact evidence identities after the outcome is recorded. Never automatic; safe_to_retry: false
staged_cleanup_failed Target finalization is confirmed committed, but attempt-table cleanup failed. Evidence reports target_outcome: committed, exact operation_tables, and cleanup_status: failed. Do not replay the transfer. Preserve committed evidence and complete reviewed single-node or all-replica cleanup for only the named attempt tables. Never; target already committed
DPONE_DBT_EXECUTION_FAILED dbt returned a non-zero result with complete outcome evidence, a selected node did not pass the platform warning policy, or setup/preflight failed. A timeout or crash after build start is COMMIT_UNKNOWN. Fix the model, unit/data test, warning, profile, or toolchain issue and publish a new release when source changes. Manual; default retries are zero
DPONE_DBT_PROFILE_INVALID Runtime profile policy or resolved credential material is incomplete or unsafe. Fix the logical binding/registry and rerun; never pass credentials in model metadata. After platform correction
DPONE_DBT_PACK_INVALID The verified launcher could not validate the execution pack shape or path. Re-fetch the pinned release and inspect pack/release integrity. After clean fetch
DPONE_DBT_SQLSERVER_RUNTIME_POLICY_INVALID Backend, retry count, timeout hierarchy, adapter metadata, or an adapter policy fingerprint differs from the immutable SQL Server execution contract. Do not edit the pack. Recompile from the pinned source/toolchain and verify 600 <= dbt_timeout_seconds <= 86400; investigate any digest mismatch as immutable-byte drift. Not against the old pack
DPONE_DBT_EVIDENCE_WRITE_FAILED Durable dbt evidence could not be written before any mutating build. After build start the same loss of proof is surfaced as COMMIT_UNKNOWN. Keep transfers blocked and repair the evidence volume. Only when no mutation started
DPONE_DBT_DEV_EVIDENCE_EXPORT_FAILED A requested provider attempt could not validate or install exact Airflow/dbt/outcome evidence under campaign authority. Keep the terminal task failed, repair the protected evidence volume or identity mismatch, and replay the same deterministic campaign. Manual after cause correction
DPONE_DBT_WORKFLOW_EVIDENCE_EXPORT_FAILED Workloads passed, but requested terminal evidence export failed before a passed workflow XCom was published. Follow the provider export failure, retain the failed diagnostic outcome, and rerun only after evidence storage/identity is healthy. Manual; never reinterpret as passed
DPONE_DBT_WORKFLOW_OUTCOME_INVALID The terminal-task set or workflow outcome is incomplete or inconsistent. Reconcile every expected terminal task and regenerate outcome evidence. After complete evidence
DPONE_DBT_WORKFLOW_FAILED At least one required dbt or transfer workload failed. Inspect the referenced workload evidence; do not reinterpret the workflow as passed. After cause correction
DPONE_DBT_WORKFLOW_IDENTITY_MISSING The terminal evaluator did not receive canonical pinned release and deployment identities. Rebuild the deployment projection and never execute an unpinned dbt workflow. After deployment correction
DPONE_DBT_INTERNAL An unexpected internal failure was redacted. Escalate with the trace_id, version, and non-secret context. Manual
COMMIT_UNKNOWN A mutating dbt build or target finalization may have committed before a timeout, crash, or missing/invalid durable result artifact. ClickHouse staged-finalizer evidence includes exact operation_tables, cleanup_attempted: false, cleanup_status: retained_for_reconciliation, and safe_to_retry: false. Freeze automatic retries, reconcile MSSQL or ClickHouse target state and evidence, and escalate to the route owner. For ClickHouse, retain staging until the documented target-outcome procedure is complete. Never automatic

Semantic refresh SQL Server protocol errors

These codes come from the fenced SQL Server strategy, control-schema migration, image/receipt verification, and replacement protocol. They always fail closed; absence of a receipt is never interpreted as rollback. The Retry column never means an automatic V2 mutation retry.

Code Meaning Next action Retry
DPONE_SEMANTIC_REFRESH_ATTEMPT_REQUIRED The strategy was invoked without an exact attempt binding. Restore the activated run/attempt authority; never construct an attempt in model SQL. After protected admission
DPONE_SEMANTIC_REFRESH_ATTEMPT_INVALID Attempt, operation, execution, owner, or fencing identity differs from the protected journal. Stop the writer and reconcile the canonical authority plus guard epoch. Never with the mismatched attempt
DPONE_SEMANTIC_REFRESH_FENCE_LOCK_FAILED The transaction could not acquire the exact engine-local writer fence. Preserve the attempt, inspect the competing holder, and retry only after authority reconciliation. Manual after holder reconciliation
DPONE_SEMANTIC_REFRESH_FENCE_REJECTED The locked guard row is absent, stale, released, or owned by another attempt. Terminate the stale writer through trusted evidence or create a governed successor. Never by bypassing the fence
DPONE_SEMANTIC_REFRESH_SESSION_QUIESCENCE_UNVERIFIED A later Airflow try cannot prove that the original MSSQL session is gone, its transaction lock is released, and its ClickHouse operation query IDs are inactive. Preserve the original attempt, restore the protected server/session observer permissions, terminate the original pod through trusted evidence, and retry reconciliation. Only after exact engine quiescence is observed
DPONE_SEMANTIC_REFRESH_CONTINUATION_CHAIN_UNSUPPORTED Continuation receipt v1 was requested for anything other than the immediate same-DagRun successor try. Stop clearing the task, preserve v1 evidence, and use manual recovery. A broader holder chain requires a separately approved receipt v2. Never through receipt v1
DPONE_SEMANTIC_REFRESH_WORKER_ADMISSION_COMMIT_UNKNOWN SQL Server worker admission may have committed, but the client did not observe the commit acknowledgement. Keep scheduling frozen; on a new provider-owned non-pooled session, use MssqlSemanticRefreshWorkerRunAuthority.locate(...) to require exact ADMITTED or clean REGISTERED. Any mixed/unavailable result remains blocked. Do not infer rollback or enter build-receipt continuation. Never automatic in 0.74
DPONE_SEMANTIC_REFRESH_PRODUCTION_ACTIVATION_UNAVAILABLE dpone 0.74 exposes Semantic Refresh V2 only as a local diagnostic preview because the exact-UUID predecessor-retention controller is not shipped. Do not bypass the application or canonical MSSQL activation guard. Keep production on V1 and evaluate V2 only with disposable local fixtures. No; a future certified release is required
DPONE_SEMANTIC_REFRESH_TRANSACTION_REQUIRED The trusted strategy is not running inside the pinned adapter transaction. Restore the certified materialization lifecycle and runtime tuple. After a new certified invocation
DPONE_SEMANTIC_REFRESH_SCOPE_MAP_REQUIRED No signed platform scope map was available for the selected model. Rebuild activation from the canonical workflow plan and scope authority. After protected activation
DPONE_SEMANTIC_REFRESH_SCOPE_MAP_MODEL_MISSING The scope map does not contain the exact selected model identity. Regenerate the complete workflow scope map; do not add a caller default. After deterministic reprojection
DPONE_SEMANTIC_REFRESH_SCOPE_MAP_INVALID Scope-map shape, schema, digest, or closed field set is invalid. Discard the map and rebuild it from the protected plan. After trusted regeneration
DPONE_SEMANTIC_REFRESH_SCOPE_MAP_UNVERIFIED The map cannot be tied to current canonical plan/run/fence authority. Repair the protected authority loader before dbt starts. After authority is verifiable
DPONE_SEMANTIC_REFRESH_SCOPE_INVALID The requested UTC half-open scope is malformed or differs from the operation. Use the exact platform-owned day scope; never pass an arbitrary predicate. After a new valid plan
DPONE_SEMANTIC_REFRESH_EVENT_TIME_KEY_REQUIRED The effective key does not contain the immutable governed event-time column. Correct the enforced model contract and compile a new operation. After model/contract correction
DPONE_SEMANTIC_REFRESH_KEY_REQUIRED The canonical effective-key inventory is empty or incomplete. Restore the ordered non-null key contract and recompile. After contract correction
DPONE_SEMANTIC_REFRESH_KEY_INVALID A key type, mapping, domain, precision, or ordering violates the supported cell. Use only the exact certified key mapping and domain. After model/contract correction
DPONE_SEMANTIC_REFRESH_KEY_OUTSIDE_SCOPE An incoming key matches a target row outside the authorized UTC scope. Quarantine the operation and investigate immutable event-time/key drift. Never as automatic retry
DPONE_SEMANTIC_REFRESH_SOURCE_KEY_INVALID The scoped source workset contains NULL, out-of-domain, or unmappable key values. Correct source data/normalization and create a new governed attempt. After source correction
DPONE_SEMANTIC_REFRESH_SOURCE_KEY_DUPLICATE The scoped source workset contains duplicate effective keys. Deduplicate upstream using the declared business semantics. After source correction
DPONE_SEMANTIC_REFRESH_CURRENT_TARGET_KEY_INVALID The pre-mutation target scope contains invalid key values. Freeze publication and repair through an approved migration/baseline process. Never through ordinary upsert
DPONE_SEMANTIC_REFRESH_CURRENT_TARGET_KEY_DUPLICATE The pre-mutation target scope contains duplicate effective keys. Quarantine the target and perform governed repair before any replacement. Never through ordinary upsert
DPONE_SEMANTIC_REFRESH_TARGET_KEY_INVALID Post-mutation target key/domain gates failed. Roll back the transaction, retain evidence, and correct source or target drift. After cause correction
DPONE_SEMANTIC_REFRESH_TARGET_KEY_DUPLICATE Post-mutation target uniqueness proof failed. Roll back and correct the deterministic source/key logic. After cause correction
DPONE_SEMANTIC_REFRESH_PAYLOAD_REQUIRED The ordered writable payload/schema authority is absent. Restore the compiled contract and canonical target projection. After a new valid plan
DPONE_SEMANTIC_REFRESH_CONTRACT_INVALID Writable columns, schema, strategy template, or policy digest differs. Recompile and activate a compatible plan; do not reinterpret old receipts. Never against conflicting bytes
DPONE_SEMANTIC_REFRESH_BEFORE_IMAGE_CONFLICT A create-once before-image already exists with different identity or bytes. Stop and investigate operation reuse or image corruption. Never with the same operation ID
DPONE_SEMANTIC_REFRESH_AFTER_IMAGE_CONFLICT A create-once after-image already exists with different identity or bytes. Stop and investigate operation reuse or image corruption. Never with the same operation ID
DPONE_SEMANTIC_REFRESH_RECEIPT_CONFLICT The immutable build receipt differs from the requested operation/attempt/fence. Reconcile the committed transaction; do not overwrite the receipt. Never with conflicting receipt
DPONE_SEMANTIC_REFRESH_RECEIPT_IMAGE_CONFLICT Receipt and committed before/after image digests or counts disagree. Classify the outcome COMMIT_UNKNOWN and investigate durable database state. Only after exact reconciliation
DPONE_DBT_MSSQL_RECEIPT_TARGET_DRIFT A replayed build receipt is exact, but the current scoped MSSQL target no longer equals its durable after-image. Freeze replay and reconcile the current target against the receipt and protected images; never treat the stale receipt as current state. Never automatic
DPONE_SEMANTIC_REFRESH_RESOURCE_BUDGET_EXCEEDED Source/target/image/temp rows or bytes, transaction-log growth/free space, version store, scope lock time, or statement time exceeded the protected resource policy. Let the transaction roll back, retain the failed evidence, reduce the bounded scope or activate a separately reviewed policy. Only with a new authorized attempt/policy
DPONE_SEMANTIC_REFRESH_RESOURCE_BUDGET_UNVERIFIED SQL Server could not observe a required resource metric exactly. Restore the required SQL Server permissions/DMV visibility; do not interpret an unavailable metric as zero. After observability is restored
DPONE_SEMANTIC_REFRESH_DDL_FREEZE_LOCK_FAILED The dbt transaction could not acquire the shared machine DDL-freeze lock. Keep mutation blocked, inspect the concurrent DDL/migration holder and retry only after it is reconciled. Manual after holder reconciliation
DPONE_SEMANTIC_REFRESH_DDL_EPOCH_DRIFT The machine-observed SQL Server DDL epoch differs from the protected plan/assurance epoch. Re-run catalog proof and activate a new plan against the new epoch; never reuse the stale proof. Only with a new proven plan
DPONE_SEMANTIC_REFRESH_DDL_FREEZE_ACTIVE Database DDL was attempted while a semantic-refresh execution held the shared freeze lock. Wait for the governed execution to finish, then issue the reviewed DDL so it advances the epoch. Safe only after execution completion
DPONE_SEMANTIC_REFRESH_DDL_EPOCH_UNAVAILABLE The DDL trigger could not advance the protected singleton epoch. Roll back the DDL, keep semantic-refresh admission stopped, and repair the v22 control schema. After schema repair
DPONE_SEMANTIC_REFRESH_RESTORE_INVALID Replacement restore authority/action is missing or incompatible. Rebuild the workflow replacement plan from the durable failed summary. After a new valid replacement plan
DPONE_SEMANTIC_REFRESH_PREDECESSOR_RECEIPT_CONFLICT Replacement predecessor receipt identity differs from the failed operation. Stop and load the exact canonical predecessor workflow/operation evidence. Never with a substituted predecessor
DPONE_SEMANTIC_REFRESH_PREDECESSOR_AFTER_IMAGE_DRIFT Current target scope no longer equals the failed predecessor after-image. Block automatic replacement and perform manual migration/recovery analysis. Never automatic
DPONE_SEMANTIC_REFRESH_PREDECESSOR_BEFORE_IMAGE_RESTORE_FAILED Restored scope does not exactly equal the predecessor before-image. Roll back the replacement transaction and investigate target/image integrity. After root-cause correction
DPONE_SEMANTIC_REFRESH_SCHEMA_BUSY Another migration owns the semantic-refresh control-schema lock. Wait for that exact migration to finish and inspect its durable outcome. Safe after migration reconciliation
DPONE_SEMANTIC_REFRESH_SCHEMA_VERSION_CONFLICT Installed control schema is newer, incompatible, or changed during migration. Use the matching dpone release or perform the reviewed schema migration. After version alignment
DPONE_SEMANTIC_REFRESH_ACTIVATION_AUTHORITY_KEY_MIGRATION_FAILED The v21 migration could not prove the composite (deployment_id, plan_bundle_sha256) primary key after preserving existing activation receipts. Keep scheduling and worker admission stopped, verify the transaction preserved the exact pre-migration version, PK shape and rows, capture current PK metadata and the schema-version row, then escalate; never rewrite receipt rows or constraints manually. Only after the reviewed migration succeeds
DPONE_SEMANTIC_REFRESH_LEGACY_BUILD_RECEIPT_REQUIRES_EXPLICIT_MIGRATION A legacy build receipt lacks required V2 identity/evidence. Preserve it and run the explicit migration/new-baseline procedure. Never by implicit upgrade
DPONE_SEMANTIC_REFRESH_LEGACY_CHECKPOINT_REQUIRES_EXPLICIT_MIGRATION A legacy checkpoint lacks the V2 predecessor/version contract. Migrate or establish a certified new baseline. Never by implicit upgrade
DPONE_SEMANTIC_REFRESH_LEGACY_EXECUTION_STATE_REQUIRES_EXPLICIT_MIGRATION Legacy workflow execution state cannot satisfy the V2 binding contract. Close the old execution and create a governed new operation. Never as resume
DPONE_SEMANTIC_REFRESH_LEGACY_JOURNAL_BASELINE_REQUIRES_EXPLICIT_MIGRATION A journal refers to an unversioned baseline. Run the certified initial-load/adoption migration. After explicit migration
DPONE_SEMANTIC_REFRESH_LEGACY_JOURNAL_STATE_REQUIRES_EXPLICIT_MIGRATION A journal contains an unsupported legacy state. Preserve evidence and migrate through the reviewed state procedure. Never by relabeling
DPONE_SEMANTIC_REFRESH_LEGACY_JOURNAL_VERSION_REQUIRES_EXPLICIT_MIGRATION A journal row lacks the required monotonic V2 version. Run the control-schema/journal migration. After explicit migration
DPONE_SEMANTIC_REFRESH_LEGACY_PREDECESSOR_STATE_REQUIRES_EXPLICIT_MIGRATION Predecessor heads/checkpoint lineage is incomplete. Establish a certified baseline or migrate the lineage explicitly. Never by inference
DPONE_SEMANTIC_REFRESH_LEGACY_STRATEGY_AUTHORITY_REQUIRES_EXPLICIT_MIGRATION Existing strategy authority is not the canonical closed V2 document. Recompile and migrate before execution. After explicit migration
DPONE_SEMANTIC_REFRESH_LEGACY_TARGET_HEAD_REQUIRES_EXPLICIT_MIGRATION Target head lacks generation/UUID/owner lineage required by V2. Certify/adopt the relation and install a new baseline head. After explicit migration
DPONE_SEMANTIC_REFRESH_LEGACY_TERMINATION_STATE_REQUIRES_EXPLICIT_MIGRATION Legacy attempt termination evidence cannot authorize takeover. Keep takeover blocked and create trusted V2 termination evidence. Never from legacy state alone

Exit codes and escalation

Exit Meaning
0 Requested operation completed and its pass condition was proven.
1 Validation, evidence, or governed verification failed.
2 CLI arguments or local configuration are invalid.
3 A required live dependency is unavailable.
4 Security or safety policy blocked the action.
5 An internal error occurred; provide the redacted trace_id.

Handled text/JSON failures are written to stdout and leave stderr empty. Parser usage errors use stderr and exit 2. See the command output and atomicity contract before redirecting command output to a file.

Escalation evidence includes release/deployment IDs, workflow/model IDs, stable codes, redacted logs, checksum/attestation receipts, and target reconciliation. Never attach profiles.yml, Vault responses, tokens, passwords, or signed download URLs.

Semantic-refresh compile and proof failures use the stable namespace prefix DPONE_DBT_V2_; the complete code, not the prefix alone, determines remediation.

Return to the dbt integration hub, continue with the operations runbook, or review promotion and rollback.

Selection drift after compact delivery

DPONE_DBT_SELECTION_DRIFT at the verified launcher can indicate a transport identity mismatch, not just a changed dbt selection. Check the verified producer wire, release/execution schemas and ordered workload-owned trio. Regenerate the complete workspace and derived deployment with compatible components; never edit generated JSON or sort v2 references.

DPONE_COMPACT_PACK_RELEASE_WORKSPACE_INVALID means the complete native input failed validation or a partial DAG selection was requested. Keep the full compile tree and omit partial filtering. Follow compact delivery recovery.