{"record":{"id":"fe47f2c264089110","repo":"ruvnet/ruflo","slug":"conformancerunner-requires-an-explicit-signingkey","errorCode":null,"errorMessage":"ConformanceRunner requires an explicit signingKey","messagePattern":"ConformanceRunner requires an explicit signingKey","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/guidance/src/conformance-kit.ts","lineNumber":701,"sourceCode":"    replayDecision: string;\n  }>;\n}\n\n// ============================================================================\n// Conformance Runner\n// ============================================================================\n\n/**\n * Orchestrates conformance tests by creating all control plane components,\n * running the MemoryClerkCell, and verifying every invariant.\n */\nexport class ConformanceRunner {\n  private readonly authority: MemoryAuthority;\n  private readonly signingKey: string;\n\n  constructor(authority?: MemoryAuthority, signingKey?: string) {\n    if (!signingKey) {\n      throw new Error('ConformanceRunner requires an explicit signingKey');\n    }\n    this.signingKey = signingKey;\n    this.authority = authority ?? {\n      agentId: 'memory-clerk-agent',\n      role: 'worker',\n      namespaces: ['clerk-workspace'],\n      maxWritesPerMinute: 100,\n      canDelete: false,\n      canOverwrite: true,\n      trustLevel: 0.8,\n    };\n  }\n\n  /**\n   * Run the full conformance test suite and return a structured result\n   * with individual pass/fail checks.\n   */\n  runConformanceTest(): ConformanceTestResult {","sourceCodeStart":683,"sourceCodeEnd":719,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/guidance/src/conformance-kit.ts#L683-L719","documentation":"ConformanceRunner orchestrates the memory-clerk conformance kit, signing artifacts with a key passed as the second positional constructor argument. Like ArtifactLedger and EvolutionPipeline, it hard-fails without an explicit signingKey — no insecure default. Note the argument order: `new ConformanceRunner(authority?, signingKey?)`, so passing only an authority (or only a key, shifting positions) trips the guard.","triggerScenarios":"`new ConformanceRunner()`; `new ConformanceRunner(myAuthority)` with no second argument; passing the key as the first argument (positional mix-up) so signingKey stays undefined; env var for the key unset in CI.","commonSituations":"Running the conformance kit in CI where the secret env var is not injected; refactor swapping argument order; secrets fetched async after construction.","solutions":["Construct with both args: `new ConformanceRunner(authority, process.env.CONFORMANCE_SIGNING_KEY!)`","Check the env var at startup and fail fast with a clear message before constructing the runner","Load secrets from the secret manager before any conformance component is built"],"exampleFix":"// before\nconst runner = new ConformanceRunner(authority); // throws\n\n// after\nconst signingKey = requiredEnv('CONFORMANCE_SIGNING_KEY');\nconst runner = new ConformanceRunner(authority, signingKey);","handlingStrategy":"validation","validationCode":"const signingKey = process.env.CONFORMANCE_SIGNING_KEY;\nif (!signingKey) {\n  throw new Error('CONFORMANCE_SIGNING_KEY must be set before ConformanceRunner');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember the constructor is positional: (authority, signingKey)","Inject signing secrets in CI before test jobs run","Fail fast on missing env vars at startup"],"tags":["security","signing-key","configuration","conformance","guidance"],"backgroundTag":"missing-required-config","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}