{"record":{"id":"174029ba7a5a48ca","repo":"ruvnet/ruflo","slug":"invalid-manifest-signature-for-endpoint-endpoin","errorCode":null,"errorMessage":"Invalid manifest signature for endpoint: ${endpoint}","messagePattern":"Invalid manifest signature for endpoint: (.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/domain/services/discovery-service.ts","lineNumber":111,"sourceCode":"          metadata: { discoveryMechanism: 'static' },\n        });\n        this.knownPeers.set(node.nodeId, node);\n        discovered.push(node);\n        this.deps.onPeerDiscovered?.(node);\n      }\n    }\n\n    return discovered;\n  }\n\n  async addStaticPeer(endpoint: string, manifest?: FederationManifest): Promise<FederationNode> {\n    if (manifest) {\n      if (manifest.endpoint !== endpoint) {\n        throw new Error(`Manifest endpoint mismatch: expected ${endpoint}`);\n      }\n      const valid = await this.deps.verifyManifest(manifest);\n      if (!valid) {\n        throw new Error(`Invalid manifest signature for endpoint: ${endpoint}`);\n      }\n    }\n\n    const nodeId = manifest?.nodeId ?? `static-${this.hashEndpoint(endpoint)}`;\n    const existing = this.knownPeers.get(nodeId);\n    if (existing) {\n      existing.markSeen();\n      return existing;\n    }\n\n    const node = FederationNode.create({\n      nodeId,\n      publicKey: manifest?.publicKey ?? '',\n      endpoint,\n      capabilities: manifest?.capabilities ?? {\n        agentTypes: [],\n        maxConcurrentSessions: 1,\n        supportedProtocols: ['websocket', 'http'],","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/domain/services/discovery-service.ts#L93-L129","documentation":"addStaticPeer() ran the manifest through the configured verifyManifest signature check and it came back invalid — the manifest's signature does not match its content or the verifier rejects its key. Untrusted manifests are refused instead of registering an unauthenticated peer.","triggerScenarios":"Signature verification of a discovered peer manifest fails for the given endpoint.","commonSituations":"Tampered manifest, wrong pinned public key, or key rotation not yet propagated.","solutions":["Verify the pinned public key for the endpoint is current.","Refuse the peer and alert; do not proceed with an invalidly signed manifest.","Re-fetch the manifest in case of a transient corruption."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}