The project or run is missing
- Confirm you are signed in to the intended organization.
- Ask an organization Admin or project Admin to confirm you have access to the project. Organization membership alone does not grant access to every project.
- For OAuth MCP, reconnect with the correct organization selected. For a static MCP key, confirm in Kiwi that it is active and belongs to the requested project.
The agent cannot connect to MCP
- 401: complete OAuth sign-in in the agent client and select the organization that contains the project. Confirm the client uses the exact endpoint copied from the signed-in app.
- 421 invalid_host: copy the canonical endpoint again from the Kiwi setup helper. Do not guess a hostname or change the URL path.
- 403 invalid_origin: confirm the agent client is using the copied endpoint and a supported connection method. If the error remains, ask your workspace Admin for help.
- Missing tool or disabled action: refresh tool discovery and check that client’s installed-version approval settings. Kiwi still checks project role and workflow gates.
A workflow report is rejected
- For invalid output, read the run graph for exact required outputs and field names. Root output names may be snake_case while nested check-definition fields are camelCase.
- For stale state, read the current run version and currentAttemptId; submit with a new command ID and the current identifiers.
- For a blocked predecessor, inspect the graph and complete its gate before starting the next step.
- For independent-review rejection, verify that the actual review performer and actual session both differ from Implement.
- A receipt means a command was recorded. Inspect the returned run and nextActions to see whether the gate accepted it.
CI cannot report a check
ReadGET /v1/runs/{runId}/checks with the checker credential and compare its check list to the current Plan. The key must be active in Kiwi, bound to the project, and allowed to report that check ID. The accepted Plan must allow checker_reported and list the key’s nonsecret reporterId; the credential record id is not interchangeable.
Also verify that POST fields match the latest context: expected_run_version, plan_revision, candidate_ref, implementation_attempt_id, and attempt_id. A stale candidate or Plan requires refreshing context. Only pass can satisfy a check; not-applicable blocks Verify.
If the credential appears unresolved, inspect its nonsecret record in Kiwi before issuing another. A replay does not reveal a lost secret or create a replacement. See CI reporting and Retries and recovery.