nautechsystems/nautilus_trader · error · anyhow::Error

Payload rewrap requires an active payload key

Error message

Payload rewrap requires an active payload key

What it means

rewrap_payload_storage() re-encrypts the execution payload storage under fresh keys, but it refuses to run when no active payload key set is loaded on the client. The keys are loaded from durable storage during connect/protect flows; without them the rewrap cannot authenticate or produce valid ciphertext. This is a deliberate guard preventing data corruption from operating on an unkeyed database.

Source

Thrown at crates/adapters/blockchain/src/execution/client.rs:899

            .ok_or_else(|| anyhow::anyhow!("Payload protection requires an active payload key"))?;
        database.ensure_execution_payload_storage(&keys).await
    }

    /// Rewraps all protected payloads in this execution database with the configured active key.
    ///
    /// The prior active key must remain configured as a retired key until this method and a
    /// subsequent full check both succeed.
    ///
    /// # Errors
    ///
    /// Returns an error if the client is connected, storage is not protected, required keys are
    /// unavailable, or any bounded rewrap batch fails authentication.
    pub async fn rewrap_payload_storage(&self, batch_size: usize) -> anyhow::Result<()> {
        let batch_size = validate_payload_operation_batch_size(batch_size)?;
        let database = self.payload_operation_database().await?;
        let keys = self
            .load_payload_keys()?
            .ok_or_else(|| anyhow::anyhow!("Payload rewrap requires an active payload key"))?;
        database
            .rewrap_execution_payload_storage(&keys, batch_size)
            .await
    }

    /// Restores authenticated plaintext payloads and removes protection from this database.
    ///
    /// This incident-only operation is resumable. Keep the complete key set configured until it
    /// succeeds and the unprotected database passes a full payload check.
    ///
    /// # Errors
    ///
    /// Returns an error if the client is connected, storage is not protected, required keys are
    /// unavailable, or any bounded rollback batch fails authentication.
    pub async fn rollback_payload_storage(&self, batch_size: usize) -> anyhow::Result<()> {
        let batch_size = validate_payload_operation_batch_size(batch_size)?;
        let database = self.payload_operation_database().await?;
        let keys = self

View on GitHub (pinned to 18893faf8b)

Solutions

1. Call protect_payload_storage() (after connecting) to initialize and persist payload keys before rewrapping.
2. Verify the key store / config so load_payload_keys() can find the persisted key set.
3. Check payload key status via check_payload_storage() before attempting rewrap.
4. Ensure the Postgres cache database configured is the same one that holds the protected payloads.

Example fix

// before
client.rewrap_payload_storage(1000).await?;
// after
if client.load_payload_key_status()?.is_some() {
    client.rewrap_payload_storage(1000).await?;
} else {
    client.protect_payload_storage(1000).await?;
}

let keys = client.load_payload_key_status()?;
anyhow::ensure!(keys.is_some(), "initialize payload keys (protect_payload_storage) before rewrap");
client.rewrap_payload_storage(batch_size).await?;

When it happens

Trigger: Calling client.rewrap_payload_storage(batch_size) before the client has connected/initialized payload keys, after keys were cleared, or when load_payload_keys() returns None because no key set was persisted or protected.

Common situations: Running rewrap on a fresh environment before the initial protect_payload_storage call; a wiped or misconfigured key store; pointing the client at a database never initialized with payload protection.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Payload rollback requires an active payload key
• Execution payload storage is in {operation} maintenance; com
• Execution payload protection is active, but no payload key i
• Execution payload storage is in {operation} maintenance, not
• Execution payload storage is in {operation} maintenance, not

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/57e0e95a023132cd. Report an issue: GitHub.