{"record":{"id":"0183326433185158","repo":"nautechsystems/nautilus_trader","slug":"payload-deployment-or-retired-keys-require-an-acti","errorCode":null,"errorMessage":"Payload deployment or retired keys require an active payload sealing key","messagePattern":"Payload deployment or retired keys require an active payload sealing key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":86,"sourceCode":"\nimpl Debug for PayloadKeySet {\n    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {\n        f.debug_struct(stringify!(PayloadKeySet))\n            .field(\"active_id\", &hex::encode(self.active_id))\n            .field(\"key_count\", &self.keys.len())\n            .field(\"deployment_id\", &self.deployment_id)\n            .finish()\n    }\n}\n\nimpl PayloadKeySet {\n    pub(crate) fn load(\n        active_env: Option<&str>,\n        retired_envs: &[String],\n        deployment_id: Option<&str>,\n    ) -> anyhow::Result<Option<Self>> {\n        let Some(active_env) = active_env else {\n            anyhow::ensure!(\n                retired_envs.is_empty() && deployment_id.is_none(),\n                \"Payload deployment or retired keys require an active payload sealing key\"\n            );\n            return Ok(None);\n        };\n        anyhow::ensure!(\n            !active_env.trim().is_empty(),\n            \"Payload key environment name is empty\"\n        );\n        let deployment_id = deployment_id\n            .map(str::trim)\n            .filter(|value| !value.is_empty())\n            .ok_or_else(|| {\n                anyhow::anyhow!(\n                    \"Payload deployment ID is required when payload sealing is configured\"\n                )\n            })?;\n","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L68-L104","documentation":"PayloadSealingKeys::load returns Ok(None) (no sealing) only when there is no active key env AND no retired keys AND no deployment ID. If an active key env name is absent but retired key envs or a deployment_id are supplied, the configuration is inconsistent and this error is thrown — sealing features are configured without the required active key.","triggerScenarios":"Calling load with active_env = None while retired_envs is non-empty or deployment_id is Some — e.g. config lists retired payload key env vars or a payload deployment ID but omits the active payload sealing key env.","commonSituations":"Rotating keys: operator set the retired-key list/deployment ID but forgot to define the new active key env var; config template with commented-out active key line while keeping the rest; partially removed sealing config.","solutions":["Set the active payload sealing key env var name in config so active_env is Some.","Or, if sealing is intentionally disabled, remove the retired key env list and payload deployment ID from config.","During key rotation, keep the new active key configured before moving old keys into retired_envs.","Validate sealing config completeness at startup before calling load."],"exampleFix":"// before\nretired_envs = [\"PAYLOAD_KEY_OLD\"]\ndeployment_id = \"dep-123\"\n# active key env missing\n\n// after\nactive_env = \"PAYLOAD_KEY_NEW\"\nretired_envs = [\"PAYLOAD_KEY_OLD\"]\ndeployment_id = \"dep-123\"","handlingStrategy":"validation","validationCode":"if active_env.is_none() && (!retired_envs.is_empty() || deployment_id.is_some()) {\n    panic!(\"sealing extras configured without an active payload sealing key env\");\n}","typeGuard":"fn sealing_config_consistent(active: Option<&str>, retired: &[String], dep: Option<&str>) -> bool { active.is_some() || (retired.is_empty() && dep.is_none()) }","tryCatchPattern":"match PayloadSealingKeys::load(active, &retired, dep) {\n    Err(e) if e.to_string().contains(\"require an active payload sealing key\") => eprintln!(\"set the active key env or drop retired/deployment settings\"),\n    other => other,\n}","preventionTips":["During rotation, set the new active key env before marking old keys retired","Keep the whole sealing config block enabled/disabled together","Validate config completeness in CI before deploy","Never comment out only the active-key line of a sealing config"],"tags":["configuration","sealing","payload","validation"],"backgroundTag":"conflicting-config-options","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}