[codex] Structure relay publish signature errors

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}

[juliusmarminge]

Summary

• preserve compact-token, JWT/schema, and replay-thumbprint failures as the publish-signature error cause
• attach environment, thread, constrained reason, and validation-stage context
• distinguish replay rejection from malformed signature or payload diagnostics

Validation

• vp test infra/relay/src/environments/EnvironmentPublishSignatures.test.ts --no-cache
• vp check
• vp run typecheck
• vpr typecheck

Overlap audit

• no active service/error-refactor PR overlaps these files; feat: Workflow Boards — kanban state machines that drive coding agents #3135 and feat(relay): enforce resource limits #2925 are unrelated broad feature branches

---

Note

Medium Risk
Touches relay activity publish proof validation (auth-adjacent); behavior is unchanged but error shape and messages differ, which may affect downstream error mapping if anything pattern-matched the old minimal errors.

Overview
Relay environment publish signature verification now returns richer, structured failures instead of a bare invalid-signature error.

EnvironmentPublishSignatureInvalid gains threadId, a contract reason (invalid_signature_or_payload vs replayed_nonce), a validation stage (decode, verify, claims, expiration, thumbprint, nonce), and an optional cause so JWT/decode failures are preserved. Expired signatures now include environment and thread in the error and message. Each failure path in verify maps to the appropriate stage/reason; replay rejection is explicitly replayed_nonce at consume_nonce.

Tests assert these fields for tampered state, bad JWT signatures (including RelayJwtError cause), and replayed nonces, plus a new case for corrupted JWT signatures.

^{Reviewed by Cursor Bugbot for commit 2ac77d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Structure relay publish signature errors with stage, reason, and cause fields

• Extends EnvironmentPublishSignatureInvalid and EnvironmentPublishSignatureExpired error schemas to include threadId, environmentId, a reason (e.g. invalid_signature_or_payload, replayed_nonce), a stage literal indicating where the failure occurred, and an optional cause.
• Updates the EnvironmentPublishSignatures.verify handler to emit structured errors at each failure point: decode_token, verify_proof, validate_claims, validate_expiration, generate_replay_thumbprint, and consume_nonce.
• Underlying errors (e.g. JWT verification failures tagged RelayJwtError) are now preserved in the cause field rather than discarded.
• Behavioral Change: error messages for both error classes have changed to include environmentId, threadId, stage, and reason.

^{Macroscope summarized 2ac77d5.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: a906a9c9-e324-4077-a576-aaed0c4e4773

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/relay-environment-publish-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR adds structured fields (threadId, reason, stage, cause) to existing error classes for better debugging context. No changes to when errors are thrown or business logic—purely diagnostic improvements with corresponding test coverage.

^{You can customize Macroscope's approvability policy. Learn more.}