{"record":{"id":"185321da684364ba","repo":"astrid-runtime/astrid","slug":"capsule-operation-exceeds-or-cannot-prove-i","errorCode":null,"errorMessage":"capsule {operation} '{}' exceeds or cannot prove its installed authority: {error:#}","messagePattern":"capsule (.+?) '(.+?)' exceeds or cannot prove its installed authority: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-kernel/src/capsule_materialization.rs","lineNumber":148,"sourceCode":"            )?;\n            return Ok(Some(BoundMaterialization {\n                snapshot,\n                runtime_dir,\n                manifest: bound_manifest,\n            }));\n        }\n        if !self.verify_registry_materialization(dir, principal, manifest)? {\n            if self.principal_store.is_some()\n                && !dir.starts_with(self.workspace_selection.state_dir())\n            {\n                anyhow::bail!(\n                    \"capsule {operation} '{}' is outside the explicit workspace portal and \\\n                     has no durable registry authority\",\n                    manifest.package.name\n                );\n            }\n            self.verify_installed_authority_for_runtime(dir, manifest).map_err(|error| {\n                anyhow::anyhow!(\n                    \"capsule {operation} '{}' exceeds or cannot prove its installed authority: {error:#}\",\n                    manifest.package.name\n                )\n            })?;\n        }\n        Ok(None)\n    }\n\n    /// Repair a stale or missing cache generation from one exact snapshot.\n    #[cfg(not(all(target_arch = \"wasm32\", target_os = \"unknown\")))]\n    pub(crate) fn ensure_published_materialization(\n        &self,\n        target: &Path,\n        principal: &astrid_core::principal::PrincipalId,\n        manifest: &astrid_capsule_types::manifest::CapsuleManifest,\n        snapshot: &astrid_storage::CapsulePackageSnapshot,\n    ) -> anyhow::Result<astrid_capsule_types::manifest::CapsuleManifest> {\n        self.repair_published_materialization(target, principal, manifest, snapshot)","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-kernel/src/capsule_materialization.rs#L130-L166","documentation":"When a capsule has no durable registry authority (published_capsule_snapshot returned None) and verify_registry_materialization did not bind it, capture_bound_materialization calls verify_installed_authority_for_runtime to prove the capsule's manifest does not exceed its installed authority. Any failure from that check is re-wrapped with this message naming the operation and capsule package name. The library throws it because running an unbound capsule outside the workspace portal is only allowed if its runtime manifest can be proven within the authority recorded at install time.","triggerScenarios":"load_capsule or prepare_runtime_replacement is invoked for a capsule that (a) is not present in the durable registry, (b) is not inside the explicit workspace state dir (otherwise the earlier 'outside the explicit workspace portal' bail fires first), and (c) fails verify_installed_authority_for_runtime — e.g. the manifest requests capabilities beyond the installed authority.json, or the installed authority cannot be read/verified in the local materialization.","commonSituations":"Developers pointing a capsule at a manually copied or hand-edited directory instead of installing it through the registry; editing Capsule.toml to add capabilities that were never approved; moving a capsule dir outside the workspace portal; running with principal_store disabled so no durable authority exists; stale/missing authority.json next to the runtime.","solutions":["Install/publish the capsule into the durable registry so published_capsule_snapshot can bind it, then retry the operation.","If the capsule is meant to be local, keep it inside the workspace portal state dir (dir must start with workspace_selection.state_dir()).","Reduce the manifest's requested capabilities to those approved in the installed authority.json, or re-approve/upgrade the authority and reinstall.","Inspect the inner {error:#} chain: fix the specific failure in verify_installed_authority_for_runtime (missing/corrupt authority.json, unreadable file, capability expansion mismatch) before retrying."],"exampleFix":"// before: hand-edited manifest requesting unapproved capabilities\nlet bound = kernel.load_capsule(&dir, &principal, &manifest_with_new_caps)?;\n\n// after: reinstall so authority covers the manifest capabilities\n// $ astrid install ./my-capsule   # regenerates approved authority\nlet bound = kernel.load_capsule(&dir, &principal, &approved_manifest)?;","handlingStrategy":"validation","validationCode":"// Prove local authority before calling the API for an unbound capsule\nfn can_prove_installed_authority(dir: &std::path::Path) -> Result<(), String> {\n    let authority = std::fs::read(dir.join(\"authority.json\"))\n        .map_err(|e| format!(\"installed authority unreadable: {e}\"))?;\n    let manifest = std::fs::read_to_string(dir.join(\"Capsule.toml\"))\n        .map_err(|e| format!(\"manifest unreadable: {e}\"))?;\n    if authority.is_empty() { return Err(\"installed authority is empty\".into()); }\n    // additionally compare requested capabilities against approved authority\n    Ok(())\n}","typeGuard":null,"tryCatchPattern":"match kernel.load_capsule(&dir, &principal, &manifest) {\n    Ok(bound) => /* proceed */,\n    Err(e) if e.to_string().contains(\"exceeds or cannot prove its installed authority\") => {\n        // fallback: install into the durable registry, then retry\n        // astrid install ./my-capsule\n        let bound = kernel.load_capsule(&dir, &principal, &manifest)?;\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Install capsules through the registry rather than hand-copying directories, so durable authority always exists.","Keep capsules that run without registry authority inside the workspace portal state dir.","Never add capabilities to Capsule.toml without re-approving the authority and reinstalling.","Read the inner {error:#} chain first — it names the exact unproven authority failure."],"tags":["capsule","authority","capability","validation","security"],"backgroundTag":"insufficient-permissions","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}