Skip to main content

Troubleshoot SABLE

Fathom Webhook Returns 503​

Possible cause: FATHOM_WEBHOOK_SECRET is absent or unavailable to the deployed function. Confirm the target project and inspect the secret name and presence through the approved operator path. If configuration must change, have the responsible operator use the checked release procedure in deployment and record the provider change separately from a code commit. Do not place a secret value in a workstation command, ticket, chat, or log. The current provider value or presence cannot be inferred from this page.

Fathom Webhook Returns 401​

Cause: Missing, stale, or invalid Fathom signature.

Unsigned curl smoke tests should return 401. That means the public route is deployed and the HMAC gate is active.

Asana Execution Returns 412​

Likely causes:

  • Approval is not approved.
  • Approval was already claimed/executed.
  • ASANA_ACT_WRITES_ENABLED is not true.

This is expected when writes are intentionally dark.

Cockpit Shows No Hours​

Check:

  • TOGGL_API_KEY exists.
  • toggl-sync is deployed.
  • Run { "dryRun": true, "hours": true } first.
  • Confirm matched project counts.
  • Run { "hours": true } only after preview looks right.

Ask SABLE Has No Document Citations​

Check:

  • VOYAGE_API_KEY is configured.
  • Documents have embeddings.
  • match_knowledge_chunks_scoped RPC exists.
  • knowledge_chunks has rows for the relevant project and source.
  • The viewer has access to the document's project.

If embeddings are absent, chat should still answer from structured spine data.

Fix the linked path or remove the link. onBrokenLinks: "throw" is intentional.

Portal invitation reports failed​

Check the selected invitation’s last_error, Supabase Auth Simple Mail Transfer Protocol configuration, Site URL, and redirect allowlist. A failed invitation is not successful membership onboarding, even when the membership row exists. Resend the durable invitation after correcting Auth delivery.

For an already-confirmed SABLE identity, access email uses the portal notification outbox. Check portal_notification_outbox, the materialized inbox row, and the delivery state instead of sending another Auth signup.

Portal email stays pending or retrying​

Call portal-notifications with { "mode": "health" } through cron authentication. Confirm the gate, RESEND_API_KEY, RESEND_FROM, provider reachability, and sender-domain status.

Then inspect these records in order:

  1. portal_notification_outbox.state, attempt_count, locked_at, and last_error
  2. portal_notifications for the intended verified person
  3. portal_notification_deliveries.state, next_attempt_at, lock_token, batch_key, and last_error
  4. The matching Trigger task run

An expired processing lease should become claimable. Do not update lease tokens or mark rows delivered by hand.

Portal email is suppressed​

Check current membership or project assignment, verified recipient email, category choices, activity-email preference, digest cadence, and quiet hours. The worker revalidates authorization and preferences before each send. Revocation and preference changes can suppress a delivery that was valid when the outbox event was created.

Portal attachment cleanup is stuck​

Inspect unpublished client_request_attachments rows in pending, ready, quarantined, deleting, or cleanup_failed. The cleanup task claims drafts older than 24 hours, and an expired deleting lease is reclaimable.

Check cleanup_locked_at, cleanup_locked_by, cleanup_attempt_count, cleanup_next_attempt_at, and cleanup_last_error, then inspect sable.portal.attachments.cleanup in Trigger. Do not delete the database row first because the private Storage object may remain orphaned.

Portal publication inventory is empty​

Confirm the client has active or current projects and the staff member has the required organization or project_members scope. The inventory does not include archived projects or source bodies.

Check document library_state, project ownership, and the selected kind, project_id, and search filters. An empty inventory does not prove that the source systems contain no documents or meetings.

A published resource does not appear for the customer​

Reload the publication detail and check its published state, publication revision, blockers, and customer-facing snapshot. Confirm the customer has a membership and the resource belongs to an allowed active project.

For explicit withdrawal, confirm no active immutable released deliverable still links the document. Deliverable-linked visibility remains active until that release relationship changes.

Deliverable release returns 409​

Open the exact draft from the Workbench deep link and confirm its project matches the authorized project. Then check that the deliverable links to that source draft, the draft quality gate is ready, qa_report.issues is empty, and missing_inputs is empty.

A blocked legacy deliverable_release approval remains pending. Resolve the source-draft blockers and approve that release individually; batch approval intentionally returns 422 with individual_release_required. Reuse the saved idempotency key only for an exact retry. A changed reason, deliverable, or content with the same key is a semantic conflict.