{"record":{"id":"f003c0fe432b379b","repo":"paperclipai/paperclip","slug":"signed-arguments-invalid","errorCode":"signed_arguments_invalid","errorMessage":"Approved tool action arguments signature is invalid","messagePattern":"Approved tool action arguments signature is invalid","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":409,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":9975,"sourceCode":"            )\n            .limit(1);\n          if (!formalApproval || formalApproval.status !== \"approved\") {\n            throw new ToolGatewayHttpError(\n              409,\n              \"Tool action request requires formal board approval before execution\",\n              \"formal_approval_required\",\n              { approvalId: actionRequest.approvalId },\n            );\n          }\n        }\n        const signedPayload = readSignedToolArgumentsPayload({\n          signedArguments: actionRequest.signedArguments,\n          invocationId: storedInvocation.id,\n          toolName: storedInvocation.toolName,\n          signingSecret: options.toolActionSigningSecret,\n        });\n        if (!signedPayload) {\n          throw new ToolGatewayHttpError(\n            409,\n            \"Approved tool action arguments signature is invalid\",\n            \"signed_arguments_invalid\",\n          );\n        }\n        if (signedPayload.executionOnApprove !== true) {\n          const error = new ToolGatewayHttpError(\n            409,\n            \"This approval predates execute-on-approve and must remain inert\",\n            \"legacy_approved_action_inert\",\n          );\n          await options.beforeLegacyApprovedActionClaim?.();\n          const claimedAt = new Date();\n          const [claimed] = await db\n            .update(toolActionRequests)\n            .set({\n              status: \"executing\",\n              resolvedByAgentId: session.agentId,","sourceCodeStart":9957,"sourceCodeEnd":9993,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-gateway.ts#L9957-L9993","documentation":"Integrity failure replaying an approved action: readSignedToolArgumentsPayload could not verify the signed arguments against the stored invocation (bad signature, wrong secret, or corrupt payload). The 409 blocks execution because the reviewed arguments cannot be proven authentic since the approval was signed.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:5671 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The signed arguments blob is invalid or tampered. Do not modify approved payloads; request a new signed approval."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}