ruvnet/ruflo · error

authoritative-worker-policy-root-unavailable

Error message

authoritative-worker-policy-root-unavailable

What it means

authorizeMcpTool throws when the git common directory cannot be resolved for the current worktree, so the authoritative (coordinator) policy root cannot be located and the request cannot be safely authorized.

Source

Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:345

        throw new Error('not an object');
      }
      processEnvelope = parsed as CapabilityEnvelope;
    } catch {
      throw new Error('invalid-worker-capability-envelope');
    }
    // Linked git worktrees share one immutable common git directory. Derive
    // the coordinator checkout from that directory so a worker cannot fall
    // back to independent legacy policy state in its isolated worktree.
    try {
      const cwd = realpathSync(process.cwd());
      const common = execFileSync(
        'git',
        ['-C', cwd, 'rev-parse', '--path-format=absolute', '--git-common-dir'],
        { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
      ).trim();
      projectRoot = dirname(realpathSync(common));
    } catch {
      throw new Error('authoritative-worker-policy-root-unavailable');
    }
  }
  return evaluatePolicyRequest({
    identity: {
      id: process.env.CLAUDE_FLOW_PRINCIPAL_ID ?? 'legacy-cli',
      type: process.env.CLAUDE_FLOW_PRINCIPAL_ID ? 'agent' : 'legacy',
    },
    action: {
      type: attributes.actionType ?? 'mcp.tool.call',
      resource: toolName,
      tool: toolName,
      server: typeof context.serverId === 'string' ? context.serverId : 'ruflo',
      namespace: typeof input.namespace === 'string' ? input.namespace : undefined,
      environment: typeof context.environment === 'string' ? context.environment : undefined,
      costUsd: attributes.costUsd,
      tokens: attributes.tokens,
      concurrency: attributes.concurrency,
      network: attributes.network === true,

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Ensure the authoritative worker policy root is reachable/mounted
2. Initialize the policy root if it does not exist

Example fix

Start or restore the authoritative worker policy root service before dispatching workers.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:345 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/2b1fa07d8a8b6c26. Report an issue: GitHub.