{"record":{"id":"53a7a5fc3787d66d","repo":"ruvnet/ruflo","slug":"policy-state-authentication-failed","errorCode":null,"errorMessage":"policy-state-authentication-failed","messagePattern":"policy-state-authentication-failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/services/policy-runtime.ts","lineNumber":107,"sourceCode":"  return material;\n}\n\nfunction stateAuthentication(state: PolicyState, key: Buffer): string {\n  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');\n}\n\nfunction verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {\n  const { anchor } = trustPaths(projectRoot);\n  if (!existsSync(anchor)) return;\n  if (!state) throw new Error('policy-state-missing-for-anchored-project');\n  const key = trustKey(projectRoot, false);\n  if (!key) throw new Error('policy-trust-key-missing');\n  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };\n  const expected = stateAuthentication(state, key);\n  const actual = record.authentication ?? '';\n  if (!/^[a-f0-9]{64}$/.test(actual)\n    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {\n    throw new Error('policy-state-authentication-failed');\n  }\n}\n\nfunction writePolicyState(projectRoot: string, statePath: string, state: PolicyState): void {\n  const anchorPath = trustPaths(projectRoot).anchor;\n  if (state.mode === 'enforce' || existsSync(anchorPath)) {\n    const key = trustKey(projectRoot, true)!;\n    const anchor = {\n      version: 1,\n      projectRoot: realpathSync(projectRoot),\n      mode: state.mode,\n      authentication: stateAuthentication(state, key),\n      updatedAt: Date.now(),\n    };\n    // On first enforcement, establish the external trust record first. A\n    // crash then leaves either a valid pair or an anchored mismatch that\n    // fails closed; it can never leave enforce state silently unanchored.\n    if (!existsSync(anchorPath)) {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/services/policy-runtime.ts#L89-L125","documentation":"The HMAC recomputed over the supplied PolicyState does not match the authentication recorded in the project's state.anchor.json — the state has been modified, rolled back, or forged since it was anchored. The tamper check fails and the state is not trusted.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:107 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Authenticate with the credentials bound to the policy state","Re-run the authentication flow and retry"],"exampleFix":"Re-authenticate the policy state with the correct trust key; verify the key matches the one used to seal the state.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}