ruvnet/ruflo · error

PEER_SIGNATURE_PROTOCOL_UNSUPPORTED

Error message

PEER_SIGNATURE_PROTOCOL_UNSUPPORTED

What it means

selectEnvelopeSignatureVersion() could not negotiate a signature protocol: the mode requires JCS (e.g. 'require-jcs') but the peer's advertised protocol list does not include the JCS signature protocol. With no common envelope-signature protocol, message exchange is refused rather than downgraded insecurely.

Source

Thrown at v3/@claude-flow/plugin-agent-federation/src/application/inbound-dispatcher.ts:222

  if (version === undefined) return 'legacy-v1';
  if (version === 'jcs-v1') return version;
  throw new TypeError(`Unsupported federation signature version: ${String(version)}`);
}

export function selectEnvelopeSignatureVersion(
  mode: EnvelopeSignatureMode,
  peerProtocols: readonly string[],
  messageType?: string,
): EnvelopeSignatureVersion {
  const selected = mode === 'legacy'
    ? 'legacy-v1'
    : peerProtocols.includes(JCS_SIGNATURE_PROTOCOL)
      ? 'jcs-v1'
      : mode === 'prefer-jcs'
        ? 'legacy-v1'
        : null;
  if (selected === null) {
    throw new Error('PEER_SIGNATURE_PROTOCOL_UNSUPPORTED');
  }
  if (
    selected === 'legacy-v1'
    && messageType !== undefined
    && !isLegacyEnvelopeTypeAllowed(messageType)
  ) {
    throw new Error(`PEER_SIGNATURE_PROTOCOL_UNSUPPORTED_FOR_MESSAGE: ${messageType}`);
  }
  return selected;
}

export function canonicalizeEnvelopeForVerify(
  message: AgentMessage,
  requestedVersion?: EnvelopeSignatureVersion,
): string {
  const meta = (message.metadata ?? {}) as Record<string, unknown>;
  // Strip signature from metadata if present (we verify the rest)
  const { signature: _sig, ...metaForSig } = meta;

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Upgrade the local federation plugin to a version supporting the peer's signature protocol.
2. Configure the peer to negotiate a mutually supported signature version.
3. Reject the peer gracefully and log the supported versions for diagnostics.

When it happens

Trigger: An inbound federation message is signed with a signature protocol version the local node does not support.

Common situations: Peer runs a newer or older federation protocol version than this node.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/65b2fc7207ef3e18. Report an issue: GitHub.