{"record":{"id":"b8dc4dbda3ce6f79","repo":"nautechsystems/nautilus_trader","slug":"payload-deployment-id-does-not-match-the-configure","errorCode":null,"errorMessage":"Payload deployment ID does not match the configured key set","messagePattern":"Payload deployment ID does not match the configured key set","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/sealing.rs","lineNumber":431,"sourceCode":"        envelope[0] == ENVELOPE_VERSION,\n        \"Unsupported signed transaction payload envelope version {}\",\n        envelope[0]\n    );\n\n    let key_id = envelope[1..1 + KEY_ID_LEN]\n        .try_into()\n        .expect(\"fixed key ID slice length\");\n    let nonce_start = 1 + KEY_ID_LEN;\n    let ciphertext_start = nonce_start + NONCE_LEN;\n    Ok(ParsedEnvelope {\n        key_id,\n        nonce: &envelope[nonce_start..ciphertext_start],\n        ciphertext_and_tag: &envelope[ciphertext_start..],\n    })\n}\n\nfn validate_context(context: &PayloadContext, deployment_id: &str) -> anyhow::Result<()> {\n    anyhow::ensure!(\n        context.deployment_id == deployment_id,\n        \"Payload deployment ID does not match the configured key set\"\n    );\n    anyhow::ensure!(\n        context.intent_id > 0,\n        \"Payload intent ID {} is not positive\",\n        context.intent_id\n    );\n    Ok(())\n}\n\nfn encode_aad(key_id: &[u8; KEY_ID_LEN], context: &PayloadContext) -> anyhow::Result<Vec<u8>> {\n    let mut aad = Vec::with_capacity(\n        AAD_DOMAIN.len()\n            + context.deployment_id.len()\n            + 20\n            + 32\n            + KEY_ID_LEN","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/sealing.rs#L413-L449","documentation":"validate_context ensures the PayloadContext's deployment_id matches the deployment id the key set was configured for. Sealed payloads bind to a specific key deployment; a mismatch means the payload was sealed with keys from a different environment/deployment and must not be sealed or unsealed here.","triggerScenarios":"Calling seal() or unseal() with a PayloadContext whose deployment_id differs from the configured deployment_id — e.g. staging-sealed payload opened with production keys, or an environment variable holding the wrong deployment id.","commonSituations":"Copy-pasting a sealed payload between staging and production; DEPLOYMENT_ID env var set inconsistently across services; reusing key material from another cluster after an environment rebuild.","solutions":["Compare context.deployment_id with the configured deployment_id string to see which side is wrong","Correct the deployment_id configuration (env var/config file) of the service performing seal/unseal","Re-seal the payload in the correct deployment if it was genuinely produced elsewhere","Confirm payload provenance before re-persisting — mismatched deployment binding is a security signal"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"fn ensure_deployment_matches(context: &PayloadContext, configured: &str) -> anyhow::Result<()> {\n    anyhow::ensure!(\n        context.deployment_id == configured,\n        \"context deployment '{}' != configured '{}'\",\n        context.deployment_id,\n        configured\n    );\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"match unseal(&blob, deployment_id) {\n    Ok(tx) => tx,\n    Err(e) if e.to_string().contains(\"deployment ID does not match\") => {\n        // surface a config/environment alert; refuse processing the payload\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Inject deployment_id from a single validated source (env/config) and log it at startup","Refuse to boot if deployment_id is empty or differs from the key set's recorded deployment","Never copy sealed payloads between environments"],"tags":["blockchain","cryptography","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}