{"record":{"id":"3003fd531fa34670","repo":"ruvnet/ruflo","slug":"inbound-rejected-bad-signature-from-sourcenodei","errorCode":null,"errorMessage":"Inbound rejected: bad signature from ${sourceNodeId} (addr=${address})","messagePattern":"Inbound rejected: bad signature from (.+?) \\(addr=(.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts","lineNumber":354,"sourceCode":"  if (deps.verifyEnvelope) {\n    const sig = typeof meta.signature === 'string' ? meta.signature : null;\n    let ok = false;\n    try {\n      ok = deps.verifyEnvelope(canonicalEnvelope, sig, peer.publicKey);\n    } catch {\n      await deps.audit.log('message_rejected', {\n        sourceNodeId,\n        metadata: { address, reason: 'INVALID_PAYLOAD' },\n      });\n      deps.logger.warn(`Inbound rejected: non-canonical payload from ${sourceNodeId} (addr=${address})`);\n      return { accepted: false, reason: 'INVALID_PAYLOAD' };\n    }\n    if (!ok) {\n      await deps.audit.log('message_rejected', {\n        sourceNodeId,\n        metadata: { address, reason: 'INVALID_SIGNATURE' },\n      });\n      deps.logger.warn(`Inbound rejected: bad signature from ${sourceNodeId} (addr=${address})`);\n      return { accepted: false, reason: 'INVALID_SIGNATURE' };\n    }\n  }\n\n  // The legacy serializer omits nested fields. No policy grant can make those\n  // unauthenticated bytes safe for a consequential operation, so this gate is\n  // independent of authorization compatibility mode.\n  if (\n    signatureVersion === 'legacy-v1' &&\n    !isLegacyEnvelopeTypeAllowed(message.type)\n  ) {\n    await deps.audit.log('message_rejected', {\n      sourceNodeId,\n      metadata: {\n        address,\n        reason: 'LEGACY_SIGNATURE_TYPE_REJECTED',\n        messageType: message.type,\n      },","sourceCodeStart":336,"sourceCodeEnd":372,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts#L336-L372","documentation":"Log warning in dispatchInbound: Ed25519 verification of the envelope's signature against the peer's public key returned false (or threw); the message is audited and rejected for a bad signature.","triggerScenarios":"Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:354 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the signing key on the sending node matches the registered key in discovery; bad signatures are rejected."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}