{"record":{"id":"4dc623cfb464391b","repo":"ruvnet/ruflo","slug":"policy-trust-key-missing","errorCode":null,"errorMessage":"policy-trust-key-missing","messagePattern":"policy-trust-key-missing","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/services/policy-runtime.ts","lineNumber":101,"sourceCode":"    if (!create) return undefined;\n    mkdirSync(dirname(key), { recursive: true, mode: 0o700 });\n    writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });\n  }\n  const material = readFileSync(key);\n  if (material.length !== 32) throw new Error('invalid-policy-trust-key');\n  return material;\n}\n\nfunction stateAuthentication(state: PolicyState, key: Buffer): string {\n  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');\n}\n\nfunction verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {\n  const { anchor } = trustPaths(projectRoot);\n  if (!existsSync(anchor)) return;\n  if (!state) throw new Error('policy-state-missing-for-anchored-project');\n  const key = trustKey(projectRoot, false);\n  if (!key) throw new Error('policy-trust-key-missing');\n  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };\n  const expected = stateAuthentication(state, key);\n  const actual = record.authentication ?? '';\n  if (!/^[a-f0-9]{64}$/.test(actual)\n    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {\n    throw new Error('policy-state-authentication-failed');\n  }\n}\n\nfunction writePolicyState(projectRoot: string, statePath: string, state: PolicyState): void {\n  const anchorPath = trustPaths(projectRoot).anchor;\n  if (state.mode === 'enforce' || existsSync(anchorPath)) {\n    const key = trustKey(projectRoot, true)!;\n    const anchor = {\n      version: 1,\n      projectRoot: realpathSync(projectRoot),\n      mode: state.mode,\n      authentication: stateAuthentication(state, key),","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/services/policy-runtime.ts#L83-L119","documentation":"An anchor exists for the project but the 32-byte trust key needed to recompute the state HMAC is missing from the policy-trust directory (and create=false, so it will not be regenerated). Without the key the recorded authentication cannot be verified, so anchoring verification fails.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:101 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provision the policy trust key before anchoring policy state"],"exampleFix":"Provision the policy trust key for this project and retry the operation.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}