ruvnet/ruflo · error

policy-ledger-verification-failed

Error message

policy-ledger-verification-failed

What it means

Inside withPolicyTransaction, verification of the policy ledger/evidence failed after the state was reloaded under lock — the ledger's integrity check (evidence verifier or anchor chain) did not hold. The transaction aborts before any mutation is written so a broken ledger cannot be extended.

Source

Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:235

  projectRoot: string,
  operation: (engine: AgenticPolicyEngine) => T | Promise<T>,
  options: {
    approvalIssuerVerifier?: (issuer: string) => boolean;
  } = {},
): Promise<T> {
  const target = paths(projectRoot);
  mkdirSync(target.dir, { recursive: true, mode: 0o700 });
  const release = await acquireLock(target.lock);
  try {
    const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {
      signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
      keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
      evidenceVerifier: verifyPolicyEvidence,
      approvalIssuerVerifier: options.approvalIssuerVerifier,
    });
    const result = await operation(engine);
    const nextState = engine.exportState();
    if (!engine.verifyLedger().valid) throw new Error('policy-ledger-verification-failed');
    writePolicyState(projectRoot, target.state, nextState);
    return result;
  } finally {
    release();
  }
}

function verifyPolicyEvidence(evidence: PolicyEvidence): boolean {
  if (!evidence.keyId || !evidence.contentHash || !evidence.signature) return false;
  let keys: Record<string, string>;
  try {
    keys = JSON.parse(process.env.CLAUDE_FLOW_POLICY_EVIDENCE_KEYS ?? '{}') as Record<string, string>;
  } catch {
    return false;
  }
  const key = keys[evidence.keyId];
  if (!key || key.length < 16 || !/^sha256:[a-f0-9]{64}$/i.test(evidence.contentHash)) return false;
  const signedClaims = JSON.stringify({

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Inspect the policy ledger for tampering or corruption
2. Restore the ledger from a verified snapshot and retry

Example fix

Investigate the policy ledger for tampering or corruption; restore from a verified snapshot and re-verify before proceeding.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:235 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/e0140affe9d30afb. Report an issue: GitHub.