{"record":{"id":"3cd76f60e7d47594","repo":"astrid-runtime/astrid","slug":"manifest-exceeds-its-installed-capability-approval","errorCode":null,"errorMessage":"manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion","messagePattern":"manifest exceeds its installed capability approval: (.+?); reinstall and approve the expansion","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":576,"sourceCode":"    {\n        bail!(\n            \"installed capsule identity/version differs from its authority receipt (approved {} {}, found {} {})\",\n            authority.capsule_id,\n            authority.version,\n            manifest.package.name,\n            manifest.package.version\n        );\n    }\n    let expansions = manifest\n        .capabilities\n        .expansions_from(&authority.approved_capabilities);\n    if !expansions.is_empty() {\n        let details = expansions\n            .into_iter()\n            .map(|expansion| format!(\"{}=[{}]\", expansion.name, expansion.added.join(\", \")))\n            .collect::<Vec<_>>()\n            .join(\"; \");\n        bail!(\n            \"manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion\"\n        );\n    }\n    if authority.manifest_digest != current_manifest_digest {\n        bail!(\n            \"installed Capsule.toml differs from the exact manifest approved at install; reinstall the capsule\"\n        );\n    }\n    if !authority.wasm_hash_pinned {\n        authority.wasm_hash_pinned = true;\n        authority.approved_wasm_hash = executable_hash;\n        AuthorityReceiptTransaction::stage(home, target_dir, &authority)?\n            .commit()\n            .context(\"failed to migrate installed authority executable pin\")?;\n    } else if authority.approved_wasm_hash != executable_hash {\n        bail!(\n            \"installed WASM executable differs from its authority receipt (approved {}, found {})\",\n            authority","sourceCodeStart":558,"sourceCodeEnd":594,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L558-L594","documentation":"The installed manifest requests capabilities beyond those approved in the authority receipt (expansions detected). The library refuses to run a capsule whose permission surface grew since install and tells the user to reinstall and explicitly approve the expansion.","triggerScenarios":"verify_installed_authority finds non-empty capability expansions — the installed Capsule.toml grants permissions (e.g. new domains, paths) absent from the receipt's approved capability set.","commonSituations":"Editing Capsule.toml post-install to add network or filesystem capabilities; pulling updated capsule sources into the same install directory; a capsule update that changed permissions without re-approval.","solutions":["Reinstall the capsule through the authorized install flow so the new capabilities are presented for explicit approval","Revert Capsule.toml to the capability set recorded in the receipt","If the expansion is expected, remove the stale receipt and re-approve the expanded manifest"],"exampleFix":"// before\n// added \"api.example.com\" to allowed domains after install\nverify_installed_authority(&home, &target_dir, &manifest, None)?;\n// after\nreinstall_with_approval(&home, &target_dir)?; // approve domain expansion interactively","handlingStrategy":"validation","validationCode":"let expansions = diff_capabilities(&approved_receipt.capabilities, &manifest.capabilities)?;\nif !expansions.is_empty() {\n    return Err(anyhow!(\"manifest adds capabilities {:?} not in approval; reinstall to approve\", expansions.iter().map(|e| &e.name).collect::<Vec<_>>()));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat installed Capsule.toml as immutable; edit sources and reinstall instead","Review capability diffs before each reinstall","Keep capability changes in version control with explicit approval commits"],"tags":["capsule","capabilities","security","approval","rust"],"backgroundTag":"invalid-config-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}