ruvnet/ruflo · error · Error

inbox identity hash collision

Error message

inbox identity hash collision

What it means

Thrown when two inbox identities hash to the same value. Defense: include enough distinguishing fields (issuer, audience, namespace) in the identity input; treat a collision as a hard failure rather than overwriting.

Source

Thrown at v3/@claude-flow/codex/src/harness/in-memory-inbox-reference.ts:94

    }
    if (suppliedDigest !== message.contentDigest) {
      this.quarantine(message, 'content-digest-mismatch', receivedAt);
      throw new Error('message contentDigest does not match canonical content');
    }
    try {
      parseCanonicalUnsigned(message.sequence, 'message sequence');
    } catch {
      throw new Error('message sequence must be a canonical unsigned decimal integer');
    }
    if (message.expiresAt !== undefined && !Number.isFinite(Date.parse(message.expiresAt))) {
      throw new Error('message expiresAt must be an ISO timestamp');
    }

    const envelopeDigest = sha256(canonicalJson(message));
    const prior = this.byIdentity.get(identity);
    if (prior) {
      if (prior.issuer !== message.issuer || prior.messageId !== message.messageId) {
        throw new Error('inbox identity hash collision');
      }
      if (prior.envelopeDigest !== envelopeDigest) {
        this.quarantine(message, 'message-id-content-conflict', receivedAt);
        throw new Error('message ID was reused with different content');
      }
      return { messageId: message.messageId, acceptedAt: prior.record.receivedAt, duplicate: true };
    }

    const record: InMemoryInboxRecord = {
      cursor: (this.nextCursor++).toString(),
      message: clone(message),
      receivedAt,
    };
    this.records.push(record);
    this.byIdentity.set(identity, {
      issuer: message.issuer,
      messageId: message.messageId,
      envelopeDigest,

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Use a stronger or longer hash for inbox identity so distinct identities cannot collide.
2. Include issuer and audience in the identity derivation to disambiguate colliding hashes.

When it happens

Trigger: Thrown at v3/@claude-flow/codex/src/harness/in-memory-inbox-reference.ts:94 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/d06eee404c54b91b. Report an issue: GitHub.