Separate the stages
The executable may run, the MCP host may list tools, and the seat may sign in while roster admission still fails.
roster failed: refused: Needed: cambium.workspace readAn authorised grant holder must give the enrolled agent the workspace read action in Lys. Replacing the key, creating another identity or changing launcher syntax does not provide that grant.
Read the cause
-
Needed: cambium.workspace read - The seat signed in but the roster requires a workspace read grant. Have an authorised grant holder supply it in Lys.
-
door_not_open - The seat transport is available but its door walk has not completed. Read the named step and door address.
-
input_locked - The field is owned by workflow output. Change the source input or its binding through the served contract.
-
base_moved_since_approval - The approved base is no longer current. Read the new base and obtain the required approval again.
-
seat_file_exists - Provisioning refuses to replace an existing seat file. Use the existing identity or choose a new seat deliberately.
An uncertain write
Keep its submission or operation identifier and read the automation wall or record before retrying. A lost response does not prove that no change occurred. Use the reconciliation or take-back act the current schema provides for that operation.
A refusal to configure
An unknown key, missing required value or invalid private file is an operator configuration problem. Read Configuration before touching the store or the running service.