{"record":{"id":"cb02a49e200b5303","repo":"paperclipai/paperclip","slug":"signed-arguments-mismatch","errorCode":"signed_arguments_mismatch","errorMessage":"Approved tool action arguments do not match reviewed hash","messagePattern":"Approved tool action arguments do not match reviewed hash","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":409,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":10066,"sourceCode":"          sensitiveMode: \"redact\",\n          promptInjectionMode: \"ignore\",\n        });\n        const storedCanonical = canonicalToolArguments(storedParameters);\n        if (\n          actionRequest.canonicalArgumentsHash !==\n            summarizeToolValue(storedParameters).sha256 ||\n          !verifyToolArgumentsSignature({\n            signedArguments: actionRequest.signedArguments,\n            invocationId: storedInvocation.id,\n            toolName: storedInvocation.toolName,\n            canonicalArguments: storedCanonical,\n            approvalSnapshot: signedPayload.approvalSnapshot,\n            executionOnApprove: signedPayload.executionOnApprove,\n            identityContextId: signedPayload.identityContextId,\n            signingSecret: options.toolActionSigningSecret,\n          })\n        ) {\n          throw new ToolGatewayHttpError(\n            409,\n            \"Approved tool action arguments do not match reviewed hash\",\n            \"signed_arguments_mismatch\",\n          );\n        }\n        if (\n          !(await approvedManagedArgumentsRemainCurrent(\n            session,\n            tool,\n            storedParameters,\n          ))\n        ) {\n          throw await expireApprovedActionForManagedArgumentDrift({\n            actionRequestId: actionRequest.id,\n            invocationId: storedInvocation.id,\n            toolName: storedInvocation.toolName,\n          });\n        }","sourceCodeStart":10048,"sourceCodeEnd":10084,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-gateway.ts#L10048-L10084","documentation":"Post-approval arguments integrity check: the canonical hash of the stored parameters does not match actionRequest.canonicalArgumentsHash, or the signature over the canonical arguments fails verification. The 409 blocks execution because the arguments drifted from what was actually reviewed and signed.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:5706 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Arguments differ from the reviewed hash. Execute with exactly the approved arguments or request a new approval."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}