Recommended action: Log in via a pam_systemd path (ssh user@localhost, machinectl shell user@, graphical console) instead of sudo -iu; enable lingering with 'sudo loginctl enable-linger <user>' for auto-start; on non-systemd hosts create and export XDG_RUNTIME_DIR manually. Optio
Recommended action: Set timeout within plan limits at create; periodically call set_timeout to extend during long agent loops; use lifecycle={'on_timeout':'pause'} and reconnect to resume; check is_running() before reuse. Option: Extend or pause instead of kill [evidence: officia
Recommended action: Set XAI_MANAGEMENT_KEY or pass management_api_key= when constructing Client. Option: Provide management key [evidence: official_recommended_action] Steps: 1. export XAI_MANAGEMENT_KEY=... 2. or Client(management_api_key=...) Expected: Collections calls work Ev
Recommended action: Pass the raw body (request.get_data(as_text=True) / await request.body()) and headers; set OPENAI_WEBHOOK_SECRET; verify immediately on receipt or raise tolerance deliberately; keep clocks synced. Option: Verify the raw body promptly [evidence: official_recomm
Recommended action: Use an unprivileged host port (e.g. 8080:80); or, if required, lower net.ipv4.ip_unprivileged_port_start or grant CAP_NET_BIND_SERVICE to rootlesskit per Docker's tips. Option: Publish on a high port [evidence: official_recommended_action] Applies when: Rootle
Recommended action: Check response.respect_moderation before reading url/base64 and handle moderation failures (rephrase prompt); match the accessor to image_format. Option: Check respect_moderation first [evidence: documented_workaround] Steps: 1. if not resp.respect_moderation:
Recommended action: Install newuidmap/newgidmap (uidmap package), ensure /etc/subuid and /etc/subgid each have >=65,536 entries for the user, and enable unprivileged user namespaces (kernel.unprivileged_userns_clone=1, user.max_user_namespaces>0) via sysctl. Option: Configure sub
Recommended action: Reinstall Docker from official Docker instructions; then incrementally add --network host, -e SANDBOX_USE_HOST_NETWORK=true, -e DOCKER_HOST_ADDR=127.0.0.1. Option: Use upstream Docker and host networking [evidence: official_recommended_action] Applies when: se
Recommended action: Parse the context phrase and fix that layer: SCPs require an org admin (agents cannot fix from the member account), permissions boundaries/session policies need adjustment by whoever sets them, identity policies need an Allow. Don't keep broadening the
Recommended action: Use an HTTPS absolute base_url on the mTLS origin (default https://mtls.api.openai.com/v1), remove API-key/proxy auth headers, use a supported data_residency region, and build a new client to change identity or certificates. Option: Dedicated mTLS client [evid
Recommended action: Use client.aio.models.generate_content / client.aio.chats with the MCP session inside an async context. Option: Switch to the async client [evidence: official_recommended_action] Applies when: Google Gen AI SDK (python-genai) / MCP tool integration Steps: 1. a
Recommended action: Upgrade wrangler (which bundles a newer workerd) so it supports your compatibility_date, or set compatibility_date no later than the supported date; treat the fallback warning as a dev/prod parity risk. Option: Upgrade wrangler to match the compatibility date
Recommended action: Downgrade base to Alpine 3.19 (docs) or use a Debian-based image; pick the Puppeteer release whose supported Chrome matches the apk chromium version; set PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser and skip download. Option: Pin Alpine 3.19 or switch t
Recommended action: Remove backend-specific fields, or construct the client for the right backend (genai.Client(vertexai=True, project=..., location=...)). Option: Match fields to backend [evidence: official_recommended_action] Applies when: Google Gen AI SDK (python-genai) / req
Recommended action: Check active Copilot license; ask org admin to enable Copilot CLI policy; if multiple accounts, verify active account (/user switch) and env-var token owner. Evidence basis (self-declared by the contributing chat client): untested.
Recommended action: Either fully lock with hashes (all transitive deps pinned ==), or on pip >=26.2 pass --no-require-hashes so hashes are verified only where provided. Option: Complete the lock or use --no-require-hashes (pip >=26.2) [evidence: official_recommended_action] Appli
Recommended action: Review and clean training data for the listed categories and resubmit; request modified thresholds if applicable. Option: Retrain with cleaned data [evidence: official_recommended_action] Steps: 1. Audit examples related to the listed categories 2. Resubmit jo