Access troubleshooting

The handful of things that trip up new FDEs during Access. For anything else, see the general Troubleshooting page.

My invite code says it's already used

Invite codes are single-use — the first successful khal fde enroll consumes it. If you’re sure this is your first try, you may already be enrolled: check khal fde status. Otherwise, ask your admin to mint a fresh one — there’s no “unconsume.”

`khal fde ssh` says I'm not approved yet

Expected, not an error. The SSH lease is gated by the Deploy Ledger until a lead approves it — the workstation existing and being reachable are separate steps. Ping whoever’s onboarding you (admin guide). While you wait, khal fde status and khal fde ssh --dry-run both work and mutate nothing.

Which --target do I use?

An environment label, not a URL — dev, hml, or prod. New FDEs use --target dev. hml/prod belong to specific customer engagements and come from your lead. See the environment ladder.

Minting an invite fails or says access denied

khal fde invite create is superadmin-only and only accepts @namastex.ai addresses. Not a superadmin? Ask one to mint it. Non-@namastex.ai email? Also a hard no — no workaround.

I don't know where I am in the process

khal fde status

Run it any time, from mint through connect — it shows your current state and never mutates.

🤖 Agent paste prompt

TASK: Use `fde-start-here/access/troubleshooting.mdx` to unblock an FDE or admin stuck partway through Access, verifying with current command output before assuming a fix.
CONTEXT: Read this page and the specific guide it points back to (admin or engineer) before recommending a fix.
SAFE FIRST COMMANDS: `khal fde status`, `khal fde ssh --dry-run`, `khal --version` (none mutate).
EVIDENCE: command, exit status, sanitized output (redact invite codes and hostnames), what it proves, next safe action. Never re-run a mutating command (enroll, instance, invite create) speculatively.

Mint an invite and approve access