{"record":{"id":"eda95c9f5d674060","repo":"ruvnet/ruflo","slug":"invalid-policy-trust-key","errorCode":null,"errorMessage":"invalid-policy-trust-key","messagePattern":"invalid-policy-trust-key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/services/policy-runtime.ts","lineNumber":88,"sourceCode":"  renameSync(temporary, file);\n}\n\nfunction trustPaths(projectRoot: string): { key: string; anchor: string } {\n  const trustRoot = join(userInfo().homedir, '.config', 'ruflo', 'policy-trust');\n  const projectId = createHash('sha256').update(realpathSync(projectRoot)).digest('hex');\n  const dir = join(trustRoot, projectId);\n  return { key: join(dir, 'anchor.key'), anchor: join(dir, 'state.anchor.json') };\n}\n\nfunction trustKey(projectRoot: string, create: boolean): Buffer | undefined {\n  const { key } = trustPaths(projectRoot);\n  if (!existsSync(key)) {\n    if (!create) return undefined;\n    mkdirSync(dirname(key), { recursive: true, mode: 0o700 });\n    writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });\n  }\n  const material = readFileSync(key);\n  if (material.length !== 32) throw new Error('invalid-policy-trust-key');\n  return material;\n}\n\nfunction stateAuthentication(state: PolicyState, key: Buffer): string {\n  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');\n}\n\nfunction verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {\n  const { anchor } = trustPaths(projectRoot);\n  if (!existsSync(anchor)) return;\n  if (!state) throw new Error('policy-state-missing-for-anchored-project');\n  const key = trustKey(projectRoot, false);\n  if (!key) throw new Error('policy-trust-key-missing');\n  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };\n  const expected = stateAuthentication(state, key);\n  const actual = record.authentication ?? '';\n  if (!/^[a-f0-9]{64}$/.test(actual)\n    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/cli/src/services/policy-runtime.ts#L70-L106","documentation":"The per-project policy trust key file exists but its contents are not the expected 32 bytes — the key material is corrupted or was written by something other than the 32-byte randomBytes generator. HMAC authentication of the policy state is impossible with it, so trustKey() refuses to use it.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply the correct policy trust key","Regenerate and re-register the trust key if it has rotated"],"exampleFix":"Configure a valid policy trust key (correct format and provenance) before performing trust-sensitive policy operations.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}