paperclipai/paperclip · error

Cloud runtime identity provider is not initialized

Error message

Cloud runtime identity provider is not initialized

What it means

applyCloudRuntimeIdentityAssertion requires that initCloudRuntimeIdentity (initialization) ran first; the module-level `initialized` flag guards all apply operations. It throws when an assertion is applied before the provider was initialized with its signing/verification environment, because verification keys and configuration are not yet loaded.

Source

Thrown at server/src/services/cloud-runtime-identity.ts:371

  const right = Buffer.from(JSON.stringify([
    claims.sub,
    claims.claimId,
    claims.previousOrigin,
    claims.canonicalOrigin,
    claims.stackSlug,
  ]));
  return left.length === right.length && timingSafeEqual(left, right);
}

/** Verify and durably apply the one-time Cloud claim assertion. */
export async function applyCloudRuntimeIdentityAssertion(input: {
  db: Db;
  compactJws: string;
  env?: NodeJS.ProcessEnv;
  now?: Date;
}): Promise<CloudRuntimeIdentitySnapshot> {
  const env = input.env ?? process.env;
  if (!initialized) throw new Error("Cloud runtime identity provider is not initialized");
  const claims = verifyCloudRuntimeIdentityAssertion({
    compactJws: input.compactJws,
    env,
    now: input.now,
    // After a natural restart the provider env may already be canonical, but
    // an identical retry of the original claim is still safe and idempotent.
    // The durable row preserves the pool origin that assertion had to match
    // on first application.
    expectedPreviousOrigin: currentIdentity?.previousOrigin ?? startupOrigin,
  });
  const previousOrigin = claims.previousOrigin;
  const canonicalOrigin = claims.canonicalOrigin;

  const row = await input.db.transaction(async (tx) => {
    const existing = await readPersistedIdentity(tx);
    if (existing) {
      if (!assertionsEqual(existing, claims)) {
        throw new Error("Cloud runtime identity is already claimed by another assertion");

View on GitHub (pinned to 01ad858492)

Solutions

1. Ensure provider initialization is awaited before the middleware/apply path is reachable (await init in bootstrapping before server.listen)
2. Check boot logs for a failed initialization that left `initialized` false
3. In tests, call the init function before exercising assertion endpoints
4. Add a readiness gate so traffic only arrives after initialization completes

Example fix

// before
app.use(cloudRuntimeIdentityMiddleware());
await initCloudRuntimeIdentity({ env: process.env });
// after
await initCloudRuntimeIdentity({ env: process.env });
app.use(cloudRuntimeIdentityMiddleware());

if (!isCloudRuntimeIdentityInitialized()) {
  await initCloudRuntimeIdentity({ env: process.env });
}
await applyCloudRuntimeIdentityAssertion({ db, compactJws: jws });

function isCloudRuntimeIdentityInitialized(): boolean {
  return Boolean(process.env.PAPERCLIP_CLOUD_STACK_ID) && cloudIdentityInitCompleted;
}

try {
  await applyCloudRuntimeIdentityAssertion({ db, compactJws: jws });
} catch (e) {
  if (e.message.includes('not initialized')) {
    await initCloudRuntimeIdentity({ env: process.env });
    return applyCloudRuntimeIdentityAssertion({ db, compactJws: jws }); // retry once after init
  }
  throw e;
}

When it happens

Trigger: cloudRuntimeIdentityMiddleware or direct applyCloudRuntimeIdentityAssertion call on a server process where the identity provider's initialization step was skipped, failed, or has not run yet (e.g. early request during boot, init skipped in tests).

Common situations: Middleware mounted before async init completed; initialization error swallowed so the flag stayed false; test harness constructing routes without calling init; server restarted into a partial boot state.

Related errors

• PRP provider thread is not started
• provider turn ended with status ${turn.status}
• Plugin UI is not available (status: ${plugin.status})
• Plugin is not ready (current status: ${plugin.status})
• ${message}

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/b54c89e2ba7ca3cf. Report an issue: GitHub.