{"record":{"id":"d8df07d5a31028be","repo":"ruvnet/ruflo","slug":"inbound-rejected-legacy-v1-is-not-permitted-for-m","errorCode":null,"errorMessage":"Inbound rejected: legacy-v1 is not permitted for message type ${message.type} from ${sourceNodeId}","messagePattern":"Inbound rejected: legacy-v1 is not permitted for message type (.+?) from (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts","lineNumber":374,"sourceCode":"    }\n  }\n\n  // The legacy serializer omits nested fields. No policy grant can make those\n  // unauthenticated bytes safe for a consequential operation, so this gate is\n  // independent of authorization compatibility mode.\n  if (\n    signatureVersion === 'legacy-v1' &&\n    !isLegacyEnvelopeTypeAllowed(message.type)\n  ) {\n    await deps.audit.log('message_rejected', {\n      sourceNodeId,\n      metadata: {\n        address,\n        reason: 'LEGACY_SIGNATURE_TYPE_REJECTED',\n        messageType: message.type,\n      },\n    });\n    deps.logger.warn(\n      `Inbound rejected: legacy-v1 is not permitted for message type ${message.type} ` +\n        `from ${sourceNodeId}`,\n    );\n    return { accepted: false, reason: 'LEGACY_SIGNATURE_TYPE_REJECTED' };\n  }\n\n  const authorizationMode = deps.authorizationMode ?? 'legacy';\n  if (\n    authorizationMode !== 'legacy' &&\n    authorizationMode !== 'observe' &&\n    authorizationMode !== 'enforce'\n  ) {\n    await deps.audit.log('message_rejected', {\n      sourceNodeId,\n      metadata: { address, reason: 'AUTHORIZATION_ERROR' },\n    });\n    return { accepted: false, reason: 'AUTHORIZATION_ERROR' };\n  }","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts#L356-L392","documentation":"Log warning in dispatchInbound: the message uses the legacy-v1 signature scheme, which omits nested fields, for a message type where unauthenticated bytes cannot be permitted; the gate is policy-independent and the message is rejected with LEGACY_SIGNATURE_TYPE_REJECTED.","triggerScenarios":"Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:374 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Upgrade the sending peer off legacy-v1 for this message type, or permit the type in policy if the legacy peer is trusted."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}