ruvnet/ruflo · error · Error

Invalid manifest signature for endpoint: ${endpoint}

Error message

Invalid manifest signature for endpoint: ${endpoint}

What it means

addStaticPeer() ran the manifest through the configured verifyManifest signature check and it came back invalid — the manifest's signature does not match its content or the verifier rejects its key. Untrusted manifests are refused instead of registering an unauthenticated peer.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/domain/services/discovery-service.ts:111

          metadata: { discoveryMechanism: 'static' },
        });
        this.knownPeers.set(node.nodeId, node);
        discovered.push(node);
        this.deps.onPeerDiscovered?.(node);
      }
    }

    return discovered;
  }

  async addStaticPeer(endpoint: string, manifest?: FederationManifest): Promise<FederationNode> {
    if (manifest) {
      if (manifest.endpoint !== endpoint) {
        throw new Error(`Manifest endpoint mismatch: expected ${endpoint}`);
      }
      const valid = await this.deps.verifyManifest(manifest);
      if (!valid) {
        throw new Error(`Invalid manifest signature for endpoint: ${endpoint}`);
      }
    }

    const nodeId = manifest?.nodeId ?? `static-${this.hashEndpoint(endpoint)}`;
    const existing = this.knownPeers.get(nodeId);
    if (existing) {
      existing.markSeen();
      return existing;
    }

    const node = FederationNode.create({
      nodeId,
      publicKey: manifest?.publicKey ?? '',
      endpoint,
      capabilities: manifest?.capabilities ?? {
        agentTypes: [],
        maxConcurrentSessions: 1,
        supportedProtocols: ['websocket', 'http'],

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Verify the pinned public key for the endpoint is current.
2. Refuse the peer and alert; do not proceed with an invalidly signed manifest.
3. Re-fetch the manifest in case of a transient corruption.

When it happens

Trigger: Signature verification of a discovered peer manifest fails for the given endpoint.

Common situations: Tampered manifest, wrong pinned public key, or key rotation not yet propagated.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/174029ba7a5a48ca. Report an issue: GitHub.