ruvnet/ruflo · error

ConformanceRunner requires an explicit signingKey

Error message

ConformanceRunner requires an explicit signingKey

What it means

ConformanceRunner orchestrates the memory-clerk conformance kit, signing artifacts with a key passed as the second positional constructor argument. Like ArtifactLedger and EvolutionPipeline, it hard-fails without an explicit signingKey — no insecure default. Note the argument order: `new ConformanceRunner(authority?, signingKey?)`, so passing only an authority (or only a key, shifting positions) trips the guard.

Source

Thrown at v3/@claude-flow/guidance/src/conformance-kit.ts:701

    replayDecision: string;
  }>;
}

// ============================================================================
// Conformance Runner
// ============================================================================

/**
 * Orchestrates conformance tests by creating all control plane components,
 * running the MemoryClerkCell, and verifying every invariant.
 */
export class ConformanceRunner {
  private readonly authority: MemoryAuthority;
  private readonly signingKey: string;

  constructor(authority?: MemoryAuthority, signingKey?: string) {
    if (!signingKey) {
      throw new Error('ConformanceRunner requires an explicit signingKey');
    }
    this.signingKey = signingKey;
    this.authority = authority ?? {
      agentId: 'memory-clerk-agent',
      role: 'worker',
      namespaces: ['clerk-workspace'],
      maxWritesPerMinute: 100,
      canDelete: false,
      canOverwrite: true,
      trustLevel: 0.8,
    };
  }

  /**
   * Run the full conformance test suite and return a structured result
   * with individual pass/fail checks.
   */
  runConformanceTest(): ConformanceTestResult {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Construct with both args: `new ConformanceRunner(authority, process.env.CONFORMANCE_SIGNING_KEY!)`
2. Check the env var at startup and fail fast with a clear message before constructing the runner
3. Load secrets from the secret manager before any conformance component is built

Example fix

// before
const runner = new ConformanceRunner(authority); // throws

// after
const signingKey = requiredEnv('CONFORMANCE_SIGNING_KEY');
const runner = new ConformanceRunner(authority, signingKey);

const signingKey = process.env.CONFORMANCE_SIGNING_KEY;
if (!signingKey) {
  throw new Error('CONFORMANCE_SIGNING_KEY must be set before ConformanceRunner');
}

When it happens

Trigger: `new ConformanceRunner()`; `new ConformanceRunner(myAuthority)` with no second argument; passing the key as the first argument (positional mix-up) so signingKey stays undefined; env var for the key unset in CI.

Common situations: Running the conformance kit in CI where the secret env var is not injected; refactor swapping argument order; secrets fetched async after construction.

Related errors

• ArtifactLedger requires an explicit signingKey — hardcoded d
• EvolutionPipeline requires an explicit signingKey — hardcode
• ProofChain requires an explicit signingKey — hardcoded defau
• TruthAnchorStore requires a signingKey in config. Anchors ca
• Pattern rejected: nested quantifiers detected (potential ReD

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/fe47f2c264089110. Report an issue: GitHub.