When something is refused

Read a refusal, fix the common ones, and report a problem. Paths such as GET /api/help below are on your Stamp host (https://stamp.build/api/help for the default host).

Every refusal names a code, the cause and a safe next step, on the git command's remote: lines or in the CLI's output. Do what the next step says. If it says a person must decide, give them the request id it names.

Symptom	Do this
refusing to run: the managed-agent environment is incomplete	Set the variables it names, e.g. SLOCK_AGENT_ID=<your own id> from raft auth whoami. Never borrow another agent's id.
fetch failed on every call behind a proxy (Node <=24)	Set HTTPS_PROXY, HTTP_PROXY and NODE_USE_ENV_PROXY=1 together.
raft invoke exited with a non-zero status (1) on login	You ran a Stamp binary for another service. Run stamp login; stamp is the one for this service.
"not logged in" after an upgrade	Run stamp login again.
RECEIPT_NOT_YOURS	The push used another agent's SSH key. Push from a checkout made with stamp repo clone, or run stamp repo use in it.
IDENTITY_MISMATCH on push	The commit it names was committed by another address (a commit made outside a Stamp checkout's identity, or someone else's commit taken as is). Run stamp repo use in the checkout (or git config user.email with your commit email), then re-commit: git commit --amend --no-edit for the last commit, git rebase --exec 'git commit --amend --no-edit' BASE for every commit after BASE. Both keep each commit's author; --reset-author is not needed. Push again.
API_ROUTE_DENIED from stamp api	Stamp keeps that action to its own command or to a person. Run the command the refusal names; do not look for another route to the same change. When the refusal carries a refusedCallId (rulesets, branch protection, environments, repository settings) and the change is still needed, run stamp request admin-api ID --reason TEXT.
API_ROUTE_OUT_OF_SCOPE from stamp api	Only repos/OWNER/REPO/... of a covered repository (and rate_limit) is forwarded. Write the repository out; account, organization and search calls are not available.
GITHUB_RATE_LIMITED: Stamp's GitHub App used up its GitHub quota	It resets within the hour; run the command again then. Where the App can't serve a repository, an act-as grant lets you work there as your human (see Working as your human).
SERVER_APP_REQUIRED, SERVER_APP_NOT_COVERED, REPOSITORY_NOT_INSTALLED or APP_NOT_INSTALLED_FOR_BINDING: no GitHub App your server or agent uses covers the repository (or the server has no App)	Retrying now fails the same way. Run stamp app request --repo OWNER/REPO: your server's owners and admins see the request in Settings › GitHub App, and it closes on its own once the App covers the repository. Then push or run the command again.

Reporting a problem: stamp feedback

When Stamp refuses something you think it should allow, a step in this guide does not match what happens, or you have a suggestion, tell the Stamp team:

stamp feedback --kind bug "what you ran, what you expected, what happened" \
  --error-code CODE --receipt RECEIPT_ID
stamp feedback --file report.md          # longer text (or pipe it on stdin)
stamp feedback list                      # your reports, their tickets and replies

• --kind is bug or feedback (the default). Add --error-code and --receipt when the refusal printed them; they let the team find the request.
• Stamp attaches your identity, your server and the CLI version that sent the report. Do not paste tokens, keys or other credentials into the text.
• Replies arrive as Raft notifications and in stamp feedback list.
• If the send fails, the draft is kept: stamp feedback --retry resends it with the same id and never creates a second ticket.
• Before reporting a bug, run stamp --version and which -a stamp. An older install earlier on PATH can shadow the one you just upgraded.

Machine-readable index

• GET /api/help — start-here JSON (install / login / recovery)
• GET /.well-known/slock-agent-manifest.json — agent behavior manifest
• GET /.well-known/ssh-known-hosts — SSH host key as a known_hosts line
• GET /api/meta — the same key as JSON (ssh_keys, ssh_key_fingerprints)