ruvnet/ruflo · error

policy-state-authentication-failed

Error message

policy-state-authentication-failed

What it means

The HMAC recomputed over the supplied PolicyState does not match the authentication recorded in the project's state.anchor.json — the state has been modified, rolled back, or forged since it was anchored. The tamper check fails and the state is not trusted.

Source

Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:107

  return material;
}

function stateAuthentication(state: PolicyState, key: Buffer): string {
  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');
}

function verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {
  const { anchor } = trustPaths(projectRoot);
  if (!existsSync(anchor)) return;
  if (!state) throw new Error('policy-state-missing-for-anchored-project');
  const key = trustKey(projectRoot, false);
  if (!key) throw new Error('policy-trust-key-missing');
  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };
  const expected = stateAuthentication(state, key);
  const actual = record.authentication ?? '';
  if (!/^[a-f0-9]{64}$/.test(actual)
    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {
    throw new Error('policy-state-authentication-failed');
  }
}

function writePolicyState(projectRoot: string, statePath: string, state: PolicyState): void {
  const anchorPath = trustPaths(projectRoot).anchor;
  if (state.mode === 'enforce' || existsSync(anchorPath)) {
    const key = trustKey(projectRoot, true)!;
    const anchor = {
      version: 1,
      projectRoot: realpathSync(projectRoot),
      mode: state.mode,
      authentication: stateAuthentication(state, key),
      updatedAt: Date.now(),
    };
    // On first enforcement, establish the external trust record first. A
    // crash then leaves either a valid pair or an anchored mismatch that
    // fails closed; it can never leave enforce state silently unanchored.
    if (!existsSync(anchorPath)) {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Authenticate with the credentials bound to the policy state
2. Re-run the authentication flow and retry

Example fix

Re-authenticate the policy state with the correct trust key; verify the key matches the one used to seal the state.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:107 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/53a7a5fc3787d66d. Report an issue: GitHub.