{"record":{"id":"d06eee404c54b91b","repo":"ruvnet/ruflo","slug":"inbox-identity-hash-collision","errorCode":null,"errorMessage":"inbox identity hash collision","messagePattern":"inbox identity hash collision","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/codex/src/harness/in-memory-inbox-reference.ts","lineNumber":94,"sourceCode":"    }\n    if (suppliedDigest !== message.contentDigest) {\n      this.quarantine(message, 'content-digest-mismatch', receivedAt);\n      throw new Error('message contentDigest does not match canonical content');\n    }\n    try {\n      parseCanonicalUnsigned(message.sequence, 'message sequence');\n    } catch {\n      throw new Error('message sequence must be a canonical unsigned decimal integer');\n    }\n    if (message.expiresAt !== undefined && !Number.isFinite(Date.parse(message.expiresAt))) {\n      throw new Error('message expiresAt must be an ISO timestamp');\n    }\n\n    const envelopeDigest = sha256(canonicalJson(message));\n    const prior = this.byIdentity.get(identity);\n    if (prior) {\n      if (prior.issuer !== message.issuer || prior.messageId !== message.messageId) {\n        throw new Error('inbox identity hash collision');\n      }\n      if (prior.envelopeDigest !== envelopeDigest) {\n        this.quarantine(message, 'message-id-content-conflict', receivedAt);\n        throw new Error('message ID was reused with different content');\n      }\n      return { messageId: message.messageId, acceptedAt: prior.record.receivedAt, duplicate: true };\n    }\n\n    const record: InMemoryInboxRecord = {\n      cursor: (this.nextCursor++).toString(),\n      message: clone(message),\n      receivedAt,\n    };\n    this.records.push(record);\n    this.byIdentity.set(identity, {\n      issuer: message.issuer,\n      messageId: message.messageId,\n      envelopeDigest,","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/codex/src/harness/in-memory-inbox-reference.ts#L76-L112","documentation":"Thrown when two inbox identities hash to the same value. Defense: include enough distinguishing fields (issuer, audience, namespace) in the identity input; treat a collision as a hard failure rather than overwriting.","triggerScenarios":"Thrown at v3/@claude-flow/codex/src/harness/in-memory-inbox-reference.ts:94 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a stronger or longer hash for inbox identity so distinct identities cannot collide.","Include issuer and audience in the identity derivation to disambiguate colliding hashes."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}