{"record":{"id":"4a378e1a82fdade8","repo":"ruvnet/ruflo","slug":"inbound-rejected-non-canonical-payload-from-sou","errorCode":null,"errorMessage":"Inbound rejected: non-canonical payload from ${sourceNodeId} (addr=${address})","messagePattern":"Inbound rejected: non-canonical payload from (.+?) \\(addr=(.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts","lineNumber":328,"sourceCode":"    });\n    return { accepted: false, reason: 'PEER_EVICTED' };\n  }\n\n  let signatureVersion: EnvelopeSignatureVersion;\n  let canonicalEnvelope: string;\n  try {\n    signatureVersion = envelopeSignatureVersion(message);\n    const accepted = deps.acceptedSignatureVersions ?? ['legacy-v1', 'jcs-v1'];\n    if (!accepted.includes(signatureVersion)) {\n      throw new TypeError(`Signature version ${signatureVersion} is disabled`);\n    }\n    canonicalEnvelope = canonicalizeEnvelopeForVerify(message, signatureVersion);\n  } catch {\n    await deps.audit.log('message_rejected', {\n      sourceNodeId,\n      metadata: { address, reason: 'INVALID_PAYLOAD' },\n    });\n    deps.logger.warn(`Inbound rejected: non-canonical payload from ${sourceNodeId} (addr=${address})`);\n    return { accepted: false, reason: 'INVALID_PAYLOAD' };\n  }\n\n  // Cryptographic signature verification (closes the trust gate that\n  // peer-state checks alone don't provide — without this, a malicious\n  // sender could just claim sourceNodeId='known-peer' in metadata and\n  // pass the previous gates).\n  if (deps.verifyEnvelope) {\n    const sig = typeof meta.signature === 'string' ? meta.signature : null;\n    let ok = false;\n    try {\n      ok = deps.verifyEnvelope(canonicalEnvelope, sig, peer.publicKey);\n    } catch {\n      await deps.audit.log('message_rejected', {\n        sourceNodeId,\n        metadata: { address, reason: 'INVALID_PAYLOAD' },\n      });\n      deps.logger.warn(`Inbound rejected: non-canonical payload from ${sourceNodeId} (addr=${address})`);","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts#L310-L346","documentation":"Log warning in dispatchInbound: canonicalizing the envelope for verification failed (disabled/unknown signature version or malformed payload), so signature verification is impossible; the message is rejected as INVALID_PAYLOAD.","triggerScenarios":"Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:328 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the sending peer to produce canonical payloads (field order/encoding); non-canonical payloads are rejected."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}