{"record":{"id":"a6e83e4f67cc214e","repo":"ruvnet/ruflo","slug":"rvfp-header-magic-mismatch","errorCode":null,"errorMessage":"RVFP header magic mismatch","messagePattern":"RVFP header magic mismatch","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/appliance/rvfa-distribution.ts","lineNumber":199,"sourceCode":"      header.signedBy = opts.signedBy;\n    }\n    const hJson = Buffer.from(JSON.stringify(header), 'utf-8');\n    const magic = Buffer.from('RVFP');\n    const ver = Buffer.alloc(4); ver.writeUInt32LE(RVFP_VERSION, 0);\n    const hLen = Buffer.alloc(4); hLen.writeUInt32LE(hJson.length, 0);\n    return Buffer.concat([magic, ver, hLen, hJson, payload, sha256B(payload)]);\n  }\n\n  static parsePatchHeader(buf: Buffer): RvfpHeader {\n    if (buf.length < PRE) throw new Error('Buffer too small for RVFP preamble');\n    const magic = buf.subarray(0, 4).toString('ascii');\n    if (magic !== 'RVFP') throw new Error(`Invalid RVFP magic: \"${magic}\"`);\n    const ver = buf.readUInt32LE(4);\n    if (ver !== RVFP_VERSION) throw new Error(`Unsupported RVFP version: ${ver}`);\n    const hLen = buf.readUInt32LE(8);\n    if (PRE + hLen > buf.length) throw new Error('Buffer too small for declared header');\n    const h = JSON.parse(buf.subarray(PRE, PRE + hLen).toString('utf-8')) as RvfpHeader;\n    if (h.magic !== 'RVFP') throw new Error('RVFP header magic mismatch');\n    return h;\n  }\n\n  static async verifyPatch(buf: Buffer): Promise<PatchVerifyResult> {\n    const errors: string[] = [];\n    let header: RvfpHeader;\n    try { header = RvfaPatcher.parsePatchHeader(buf); } catch (e) {\n      const empty: RvfpHeader = {\n        magic: 'RVFP', version: 0, targetApplianceName: '', targetApplianceVersion: '',\n        targetSection: '', patchVersion: '', created: '', newSectionSize: 0,\n        newSectionSha256: '', compression: 'none',\n      };\n      return { valid: false, header: empty, errors: [(e as Error).message] };\n    }\n    const { start, end, section } = patchData(buf);\n    if (end < start) {\n      errors.push('Patch too small: no room for section data and footer');\n      return { valid: false, header, errors };","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/appliance/rvfa-distribution.ts#L181-L217","documentation":"Thrown by parsePatchHeader() after the header JSON parsed successfully, but the parsed object's magic field is not the literal 'RVFP'. This is a defence-in-depth check: the binary preamble magic passed, yet the embedded JSON header disagrees about the format identity. It catches tampered, hand-assembled, or format-confused headers where the binary framing was correct but the JSON payload was swapped.","triggerScenarios":"A buffer whose first 12 bytes and header-length are valid and the JSON region parses, but the JSON object's magic field is missing, misspelled, or set to a different value (e.g. 'RVFA'). Usually indicates manual construction or cross-contamination between RVFA and RVFP serialization code.","commonSituations":"A tool that serializes both RVFA appliances and RVFP patches accidentally writes an RVFA-style header object into a patch buffer; an adversary or fuzzer mutates the header JSON without fixing the magic; a test fixture copied from the wrong format.","solutions":["Regenerate the patch with RvfaPatcher.createPatch() which always sets header.magic = 'RVFP'.","Audit any code that constructs RvfpHeader objects by hand to ensure magic is set.","Discard the patch — a mismatched header magic indicates the producer was buggy or the file was tampered with.","If interoperating with another producer, require they emit magic='RVFP' in the JSON header."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isRvfpHeaderObject(h: unknown): h is RvfpHeader {\n  return typeof h === 'object' && h !== null && (h as any).magic === 'RVFP';\n}","tryCatchPattern":"try {\n  const header = RvfaPatcher.parsePatchHeader(buf);\n} catch (e) {\n  if (/RVFP header magic mismatch/.test((e as Error).message)) {\n    throw new Error('Patch header JSON is inconsistent (magic != RVFP); regenerate with createPatch()');\n  }\n  throw e;\n}","preventionTips":["Only build patches via RvfaPatcher.createPatch() which sets header.magic='RVFP'.","Do not hand-construct RvfpHeader objects.","Audit any code that serializes both RVFA and RVFP to avoid header cross-contamination.","Treat a magic mismatch as evidence of tampering and discard the patch."],"tags":["rvfp","header","integrity","binary-format"],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}