Inbound rejected: bad signature from ${sourceNodeId} (addr=$

Error message

Inbound rejected: bad signature from ${sourceNodeId} (addr=${address})

What it means

Log warning in dispatchInbound: Ed25519 verification of the envelope's signature against the peer's public key returned false (or threw); the message is audited and rejected for a bad signature.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:354

  if (deps.verifyEnvelope) {
    const sig = typeof meta.signature === 'string' ? meta.signature : null;
    let ok = false;
    try {
      ok = deps.verifyEnvelope(canonicalEnvelope, sig, peer.publicKey);
    } catch {
      await deps.audit.log('message_rejected', {
        sourceNodeId,
        metadata: { address, reason: 'INVALID_PAYLOAD' },
      });
      deps.logger.warn(`Inbound rejected: non-canonical payload from ${sourceNodeId} (addr=${address})`);
      return { accepted: false, reason: 'INVALID_PAYLOAD' };
    }
    if (!ok) {
      await deps.audit.log('message_rejected', {
        sourceNodeId,
        metadata: { address, reason: 'INVALID_SIGNATURE' },
      });
      deps.logger.warn(`Inbound rejected: bad signature from ${sourceNodeId} (addr=${address})`);
      return { accepted: false, reason: 'INVALID_SIGNATURE' };
    }
  }

  // The legacy serializer omits nested fields. No policy grant can make those
  // unauthenticated bytes safe for a consequential operation, so this gate is
  // independent of authorization compatibility mode.
  if (
    signatureVersion === 'legacy-v1' &&
    !isLegacyEnvelopeTypeAllowed(message.type)
  ) {
    await deps.audit.log('message_rejected', {
      sourceNodeId,
      metadata: {
        address,
        reason: 'LEGACY_SIGNATURE_TYPE_REJECTED',
        messageType: message.type,
      },

View on GitHub (pinned to fa13ee4ad6)

Solutions

Verify the signing key on the sending node matches the registered key in discovery; bad signatures are rejected.

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:354 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/3003fd531fa34670. Report an issue: GitHub.