E1203. Policy bundle signature mismatch
Severity: ERROR. Class:
BundleSignatureError. Treat as a tamper signal.
What happened
The signed policy bundle the SDK pulled from the backend has a signature that does not match the expected public key. This is a tamper signal: someone may have modified the bundle in transit or on disk.
How to fix
Delete the cached bundle, restart the SDK, and re-pull. Cached bundles
live under the cache directory and use the .czpolicy extension. When
the SDK is running under a named client (every coding-agent hook sets
one), the cache is namespaced per client, so clear both locations:
rm -f ~/.controlzero/cache/bundle-*.czpolicy
rm -f ~/.controlzero/integrations/*/cache/bundle-*.czpolicy
controlzero policy-pull
bundle-*.bin is the legacy filename and is still read if present. Clear it
too on an older installation:
rm -f ~/.controlzero/cache/bundle-*.bin ~/.controlzero/integrations/*/cache/bundle-*.bin
If the error recurs, escalate to support.