E1302. Stale bundle for rotated key
Severity: ERROR. Reported by the T104 cache garbage collector.
What happened
T104 cache GC found a cached bundle whose key prefix no longer matches any active key in your enrollment. Almost always means a key rotated and the old bundle should be discarded.
How to fix
Run controlzero policy-pull to refresh. If that does not clear it,
delete the stale bundle and pull again. Cached bundles use the
.czpolicy extension, and the cache is namespaced per client when the
SDK runs under a named client (every coding-agent hook sets one), so
clear both locations:
rm -f ~/.controlzero/cache/bundle-*.czpolicy
rm -f ~/.controlzero/integrations/*/cache/bundle-*.czpolicy
controlzero policy-pull
bundle-*.bin is the legacy filename and is still read if present. Clear it
too on an older installation:
rm -f ~/.controlzero/cache/bundle-*.bin ~/.controlzero/integrations/*/cache/bundle-*.bin