> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jaasskills.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Corner cases

> Every deterministic edge case the registry is designed to hit — and exactly what happens

| Corner case                                                   | Outcome                                                                                                                                         |
| ------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Publishing an `id + version` that already exists              | **409 Conflict** — rejected; versions are immutable                                                                                             |
| A declared dependency can't be resolved                       | Rejected at publish, before any write                                                                                                           |
| A dependency graph contains a cycle                           | Rejected at graph validation (strongly-connected-component detection)                                                                           |
| Package payload fails digest verification                     | Rejected as `CORRUPT_PAYLOAD`                                                                                                                   |
| Signature doesn't match the trust policy                      | Rejected as `INVALID_SIGNATURE`                                                                                                                 |
| A skill's runtime doesn't match the caller's constraint       | Silently excluded from search results — not an error                                                                                            |
| Caller lacks the scope/ownership a write requires             | **403 Unauthorized**                                                                                                                            |
| Anonymous or unauthorized caller requests a private skill     | **404 SKILL\_NOT\_FOUND** — identical to a nonexistent id; existence is never revealed                                                          |
| Guardrails service is unreachable during validate/publish     | **503 GUARDRAILS\_SERVICE\_UNAVAILABLE** — only the routes that need it fail; search/auth/sharing stay up                                       |
| A publish trips a mandatory (Level 1) guardrail rule          | Publish blocked with `GUARDRAIL_VIOLATION`, raised before any archive/store write                                                               |
| A publish trips a WARN-level rule only                        | Publish proceeds; warnings are recorded on the audit event and surfaced to the caller (CLI stdout, or the validate response's `warnings` field) |
| A custom rule's regex uses lookaround or a backreference      | **400** from `/validate-rule` or `/scan` — RE2 can't compile it; never silently falls back to backtracking `re`                                 |
| A custom rule tries to introduce a new executor kind          | Rejected — only existing catalog `kind`s are runnable; a custom rule can never execute arbitrary code                                           |
| A share grant is revoked mid-session                          | Takes effect on the very next request — no index rebuild or cache to invalidate, since grants are checked per-request                           |
| Registry instance crashes                                     | Restarts and rebuilds its index from storage metadata                                                                                           |
| An index-updating event is delayed or dropped                 | Periodic reconciliation scan repairs the drift                                                                                                  |
| Storage layer returns a transient error                       | Retried with exponential backoff and jitter                                                                                                     |
| Dev login attempted without the dev-login password configured | Rejected outright by the backend — the path doesn't exist unless explicitly configured                                                          |