| Symptom | Check first | Verification after the fix |
|---|---|---|
| Runner health fails | Process, service URL, and deployment logs | Health response reports compatible versions and capabilities |
| Runner is healthy but commands fail | Service token and command metadata | runner.ping succeeds with the intended tenant context |
| Application route returns an error | Server route configuration and correlation id | Direct runner check and application route both succeed |
| Stream closes unexpectedly | Client disconnect, forwarded abort signal, and terminal event | Disconnect produces run.cancelled; normal request completes |
| Wrong user or organization context | Server-side authentication resolver | Allowed account succeeds and denied account receives no protected data |
| Model cannot be selected | Gateway visibility, approval, deployment readiness, and lease | Short request completes through the requested model |
Runner checks
curl -sS "$KESTREL_RUNNER_SERVICE_URL/health"
curl -sS "$KESTREL_RUNNER_SERVICE_URL/commands" \
-H "Authorization: Bearer $KESTREL_RUNNER_SERVICE_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"id": "cmd-operator-check",
"type": "runner.ping",
"metadata": {
"actor": {
"actorId": "operator-check",
"actorType": "operator",
"tenantId": "test"
},
"tenantId": "test"
},
"payload": { "nonce": "operator-check" }
}'Preserve the request, correlation, session, and run identifiers before changing the deployment. Use Reliability and recovery to confirm that the original user path works afterward.