Troubleshoot — Fraud

Health fails

• Confirm predictions DB path / ./data exist as expected by /health.
• Confirm Cloud Run revision serving and returns HTTP 200.

Batch published but checks never run

• Push subscriptions for process-customer-statistics-<env> must target the current service URL (cloudbuild.yaml recreates orphans).
• Inspect DLTs for poison messages.
• Validate DB_CREDENTIALS JSON (or DB_* fallbacks) from the runtime environment.

Cold-start customers have no profile

Expected when txn count < 10 (COLD_START_MIN_TRANSACTIONS). Confirm rule service path — not necessarily a checks-service bug.

/report rejects payload

• Read fraud output contract.
• AMBIGUOUS_PREDICTION_CONTRACT / mixed identity keys → fix emitter (ml/rule), do not weaken validation casually.
• ML_SCORE_TIER_CONFLICT → score vs predicted_level mismatch.

Dashboard never shows report

• Logs for /report: JWT signing, APP_BACKEND_API / backend_api, x-tenant-id.
• Confirm AI_PRIVATE_KEY / BACKEND_PUBLIC_KEY match the dashboard environment.
• Expect POST …/transaction/create-report with Authorization: ApiKey ….

Stream 401 on predict

• Header must be Authorization: ApiKey <jwt> (not Bearer).
• Claims: iss=software-service, aud=ai-service.
• Or set AUTH_ENFORCEMENT_ENABLED=false only for local debug.

AI summary missing but decision present

Policy/evidence are Python-owned; Gemini failure should fall back to deterministic summary. Inspect report_team logs without pasting secrets.