ruvnet/ruflo · error

policy-trust-key-missing

Error message

policy-trust-key-missing

What it means

An anchor exists for the project but the 32-byte trust key needed to recompute the state HMAC is missing from the policy-trust directory (and create=false, so it will not be regenerated). Without the key the recorded authentication cannot be verified, so anchoring verification fails.

Source

Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:101

    if (!create) return undefined;
    mkdirSync(dirname(key), { recursive: true, mode: 0o700 });
    writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });
  }
  const material = readFileSync(key);
  if (material.length !== 32) throw new Error('invalid-policy-trust-key');
  return material;
}

function stateAuthentication(state: PolicyState, key: Buffer): string {
  return createHmac('sha256', key).update(JSON.stringify(state)).digest('hex');
}

function verifyStateAnchor(projectRoot: string, state: PolicyState | undefined): void {
  const { anchor } = trustPaths(projectRoot);
  if (!existsSync(anchor)) return;
  if (!state) throw new Error('policy-state-missing-for-anchored-project');
  const key = trustKey(projectRoot, false);
  if (!key) throw new Error('policy-trust-key-missing');
  const record = JSON.parse(readFileSync(anchor, 'utf8')) as { authentication?: string };
  const expected = stateAuthentication(state, key);
  const actual = record.authentication ?? '';
  if (!/^[a-f0-9]{64}$/.test(actual)
    || !timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(actual, 'hex'))) {
    throw new Error('policy-state-authentication-failed');
  }
}

function writePolicyState(projectRoot: string, statePath: string, state: PolicyState): void {
  const anchorPath = trustPaths(projectRoot).anchor;
  if (state.mode === 'enforce' || existsSync(anchorPath)) {
    const key = trustKey(projectRoot, true)!;
    const anchor = {
      version: 1,
      projectRoot: realpathSync(projectRoot),
      mode: state.mode,
      authentication: stateAuthentication(state, key),

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Provision the policy trust key before anchoring policy state

Example fix

Provision the policy trust key for this project and retry the operation.

When it happens

Trigger: Thrown at v3/@claude-flow/cli/src/services/policy-runtime.ts:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/4dc623cfb464391b. Report an issue: GitHub.