Federation authorization is in ADR-325 legacy compatibility

Error message

Federation authorization is in ADR-325 legacy compatibility mode; use observe before enabling enforce

What it means

Startup notice from plugin initialize: the federation authorizationMode config resolved to the ADR-325 'legacy' default (or was explicitly set to legacy), meaning policy checks observe but do not block. Operators should run 'observe' to collect claim/policy evidence before switching to enforce.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/plugin.ts:276

    const authorizationMode =
      (config['authorizationMode'] as FederationAuthorizationMode | undefined) ?? 'legacy';
    const grantedClaims = Array.isArray(config['federationClaims'])
      ? config['federationClaims'].filter((claim): claim is string => typeof claim === 'string')
      : [];
    const claimChecker = createFederationClaimChecker({
      mode: authorizationMode,
      grantedClaims,
      onObservation: (claim, granted) => {
        context.eventBus.emit('federation:policy-observation', {
          claim,
          granted,
          mode: authorizationMode,
        });
      },
    });
    if (claimChecker.mode === 'legacy') {
      context.logger.warn(
        'Federation authorization is in ADR-325 legacy compatibility mode; ' +
          'use observe before enabling enforce',
      );
    }
    const policyEngine = new PolicyEngine({ checkClaim: claimChecker.checkClaim });

    const sessions: Map<string, import('./domain/entities/federation-session.js').FederationSession> = new Map();

    // ADR-104 + ADR-120: load wire transport. WebSocket fallback by
    // default; native QUIC when AGENTIC_FLOW_QUIC_NATIVE=1 (ADR-108) or
    // MIDSTREAMER_QUIC_NATIVE=1 (ADR-120 Step 1, when midstream@0.3.0
    // ships its real QUIC build). The midstream-aware loader picks the
    // best available transport transparently. Failures downgrade to
    // in-process noop (logged), preserving backward compat for
    // tests/environments without ws available.
    let transport: LoadedTransport | null = null;
    try {
      const loaded = await loadFederationTransport({

View on GitHub (pinned to fa13ee4ad6)

Solutions

Run in observe mode first and validate the authorization decisions, then switch from legacy to enforce per ADR-325.

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at v3/@claude-flow/plugin-agent-federation/src/plugin.ts:276 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/9dfc584b40231937. Report an issue: GitHub.