Safe failures

Error reference

Public errors are stable codes. Detailed causes belong in redacted server logs keyed by requestId.

Wallet and policy

WALLET_NOT_FOUND, WRONG_NETWORK, USER_REJECTED, and NOT_ELIGIBLE are safe client-facing outcomes.

Challenge and binding

CHALLENGE_EXPIRED, CHALLENGE_SPENT, ORIGIN_MISMATCH, GATE_MISMATCH, and STALE_EPOCH are not proof details and can be shown safely.

Credential and verifier

CREDENTIAL_EXPIRED, CREDENTIAL_REVOKED, PROOF_INVALID, and SERVICE_UNAVAILABLE are the remaining public outcomes. Retry is safe only for SERVICE_UNAVAILABLE with backoff and a fresh challenge.