E1203. Policy bundle signature mismatch

Severity: ERROR. Class: BundleSignatureError. Treat as a tamper signal.

What happened

The signed policy bundle the SDK pulled from the backend has a signature that does not match the expected public key. This is a tamper signal: someone may have modified the bundle in transit or on disk.

How to fix

Delete the cached bundle, restart the SDK, and re-pull. Cached bundles live under the cache directory and use the .czpolicy extension. When the SDK is running under a named client (every coding-agent hook sets one), the cache is namespaced per client, so clear both locations:

rm -f ~/.controlzero/cache/bundle-*.czpolicy
rm -f ~/.controlzero/integrations/*/cache/bundle-*.czpolicy
controlzero policy-pull

bundle-*.bin is the legacy filename and is still read if present. Clear it too on an older installation:

rm -f ~/.controlzero/cache/bundle-*.bin ~/.controlzero/integrations/*/cache/bundle-*.bin

If the error recurs, escalate to support.

See also

• E1302 -- Stale bundle for rotated key
• Errors index