{"record":{"id":"e0140affe9d30afb","repo":"ruvnet/ruflo","slug":"policy-ledger-verification-failed","errorCode":null,"errorMessage":"policy-ledger-verification-failed","messagePattern":"policy-ledger-verification-failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/services/policy-runtime.ts","lineNumber":235,"sourceCode":"  projectRoot: string,\n  operation: (engine: AgenticPolicyEngine) => T | Promise<T>,\n  options: {\n    approvalIssuerVerifier?: (issuer: string) => boolean;\n  } = {},\n): Promise<T> {\n  const target = paths(projectRoot);\n  mkdirSync(target.dir, { recursive: true, mode: 0o700 });\n  const release = await acquireLock(target.lock);\n  try {\n    const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {\n      signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,\n      keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,\n      evidenceVerifier: verifyPolicyEvidence,\n      approvalIssuerVerifier: options.approvalIssuerVerifier,\n    });\n    const result = await operation(engine);\n    const nextState = engine.exportState();\n    if (!engine.verifyLedger().valid) throw new Error('policy-ledger-verification-failed');\n    writePolicyState(projectRoot, target.state, nextState);\n    return result;\n  } finally {\n    release();\n  }\n}\n\nfunction verifyPolicyEvidence(evidence: PolicyEvidence): boolean {\n  if (!evidence.keyId || !evidence.contentHash || !evidence.signature) return false;\n  let keys: Record<string, string>;\n  try {\n    keys = JSON.parse(process.env.CLAUDE_FLOW_POLICY_EVIDENCE_KEYS ?? '{}') as Record<string, string>;\n  } catch {\n    return false;\n  }\n  const key = keys[evidence.keyId];\n  if (!key || key.length < 16 || !/^sha256:[a-f0-9]{64}$/i.test(evidence.contentHash)) return false;\n  const signedClaims = JSON.stringify({","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/services/policy-runtime.ts#L217-L253","documentation":"Inside withPolicyTransaction, verification of the policy ledger/evidence failed after the state was reloaded under lock — the ledger's integrity check (evidence verifier or anchor chain) did not hold. The transaction aborts before any mutation is written so a broken ledger cannot be extended.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:235 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the policy ledger for tampering or corruption","Restore the ledger from a verified snapshot and retry"],"exampleFix":"Investigate the policy ledger for tampering or corruption; restore from a verified snapshot and re-verify before proceeding.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}