ruvnet/ruflo · error

policy-state-missing-for-anchored-project

Error message

policy-state-missing-for-anchored-project

What it means

A state anchor file exists for this project (a previous run pinned policy state), but no PolicyState was passed to verifyStateAnchor — the state file is missing or unreadable while the anchor remains. The mismatch is reported rather than silently trusting an unanchored state.

Source

Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:99

  const { key } = trustPaths(projectRoot);
  if (!existsSync(key)) {
    if (!create) return undefined;
    mkdirSync(dirname(key), { recursive: true, mode: 0o700 });
    writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });
  }
  const material = readFileSync(key);
  if (material.length !== 32) throw new Error('invalid-policy-trust-key');
  return material;
}

function stateAuthentication(state: PolicyState, key: Buffer): string {
  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');
}

function verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {
  const { anchor } = trustPaths(projectRoot);
  if (!existsSync(anchor)) return;
  if (!state) throw new Error('policy-state-missing-for-anchored-project');
  const key = trustKey(projectRoot, false);
  if (!key) throw new Error('policy-trust-key-missing');
  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };
  const expected = stateAuthentication(state, key);
  const actual = record.authentication ?? '';
  if (!/^[a-f0-9]{64}$/.test(actual)
    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {
    throw new Error('policy-state-authentication-failed');
  }
}

function writePolicyState(projectRoot: string, statePath: string, state: PolicyState): void {
  const anchorPath = trustPaths(projectRoot).anchor;
  if (state.mode === 'enforce' || existsSync(anchorPath)) {
    const key = trustKey(projectRoot, true)!;
    const anchor = {
      version: 1,
      projectRoot: realpathSync(projectRoot),

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Initialize policy state for the anchored project
2. Run the policy bootstrap command for the project root

Example fix

Initialize policy state for the anchored project (run the policy bootstrap/init command) before operating on it.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/541d52da20d5afb2. Report an issue: GitHub.