{"record":{"id":"fe696db30fea8e91","repo":"ruvnet/ruflo","slug":"artifactledger-requires-an-explicit-signingkey-h","errorCode":null,"errorMessage":"ArtifactLedger requires an explicit signingKey — hardcoded defaults are not secure","messagePattern":"ArtifactLedger requires an explicit signingKey — hardcoded defaults are not secure","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/guidance/src/artifacts.ts","lineNumber":226,"sourceCode":"  tags?: string[];\n}\n\n/**\n * A tamper-evident ledger for production artifacts.\n *\n * Every artifact is signed and content-hashed on creation. The ledger\n * supports retrieval by ID, run, kind, cell, and arbitrary search queries.\n * Full lineage traversal allows tracing any artifact back through its\n * entire ancestry chain.\n */\nexport class ArtifactLedger {\n  private artifacts: Map<string, Artifact> = new Map();\n  private readonly signingKey: string;\n  private readonly maxArtifacts: number;\n\n  constructor(config: ArtifactLedgerConfig = {}) {\n    if (!config.signingKey) {\n      throw new Error('ArtifactLedger requires an explicit signingKey — hardcoded defaults are not secure');\n    }\n    this.signingKey = config.signingKey;\n    this.maxArtifacts = config.maxArtifacts ?? DEFAULT_MAX_ARTIFACTS;\n  }\n\n  /**\n   * Record a new artifact in the ledger.\n   *\n   * Computes the content hash, signs the envelope, and stores the artifact.\n   * If the ledger exceeds maxArtifacts, the oldest artifact is evicted.\n   *\n   * @param params - Artifact creation parameters\n   * @returns The fully signed and stored Artifact\n   */\n  record(params: RecordArtifactParams): Artifact {\n    const contentHash = this.computeContentHash(params.content);\n    const contentSize = this.computeContentSize(params.content);\n","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/guidance/src/artifacts.ts#L208-L244","documentation":"ArtifactLedger signs and content-hashes every artifact envelope at creation, so it refuses to construct without an explicit `signingKey`. The error message states the design intent: a hardcoded default key would let anyone forge artifact signatures, so there is deliberately no fallback. Constructing `new ArtifactLedger()` or omitting signingKey in the config throws immediately.","triggerScenarios":"`new ArtifactLedger()` with no config; `new ArtifactLedger({ maxArtifacts: 500 })` — any config object without signingKey; key read from `process.env` in an environment where the variable is unset (CI, fresh clone).","commonSituations":"Following older examples that predate the required-key hardening; CI pipelines missing the env var; secrets loaded asynchronously (vault fetch) after the ledger is constructed; local dev without a .env entry.","solutions":["Pass an explicit key: `new ArtifactLedger({ signingKey: process.env.ARTIFACT_SIGNING_KEY! })`","Resolve secrets from your secret manager BEFORE constructing the ledger","Fail fast at boot: assert required env vars are present before any component construction","Never add a fallback default key — generate one per environment if needed (`node -e \"console.log(crypto.randomBytes(32).toString('hex'))\"`)"],"exampleFix":"// before\nconst ledger = new ArtifactLedger({ maxArtifacts: 1000 }); // throws\n\n// after\nconst signingKey = requiredEnv('ARTIFACT_SIGNING_KEY');\nconst ledger = new ArtifactLedger({ signingKey, maxArtifacts: 1000 });","handlingStrategy":"validation","validationCode":"if (!process.env.ARTIFACT_SIGNING_KEY) {\n  throw new Error('ARTIFACT_SIGNING_KEY must be set before creating ArtifactLedger');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assert required env vars at process start, not deep in library code","Never commit a fallback signing key","Provision signing keys per environment via a secret manager"],"tags":["security","signing-key","configuration","artifact-ledger","guidance","hmac"],"backgroundTag":"missing-required-config","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-08-22T04:17:13.399Z"}