Error message
In the message, %s marks a value that the engine fills in when it raises the error.
The story
Your manifest asks for a kind of protection that rush does not have. Let's see what is on the menu. Protection is a dimension of the project, with four levels: none, transport, at rest, and end to end. You pick one by writing config protection, followed by a single bare word from that list, with no quotes and no list. If you write something else, say encrypted or maximum, or you put the word in quotes, or in a list, rush refuses, before it parses any file. The reason is simple. A protection that is silently not applied is a protection that lies to you. You would believe your data was safe, and it might be exposed. So rush stops and names the manifest, the line, and the word it found. The second slot lists the real words. Choose the level that matches what you need, write it as a bare word, and run again. If none of the four fit your need, that is a design question to raise, not something a typo can fix.
Text from the Rush engine's error catalogue.