{"record":{"id":"777747531cf9ebcc","repo":"astrid-runtime/astrid","slug":"distro-lock-capsule-hash-disagrees-with-the-d","errorCode":null,"errorMessage":"Distro.lock capsule '{}' hash disagrees with the daemon registry","messagePattern":"Distro\\.lock capsule '(.+?)' hash disagrees with the daemon registry","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_grant.rs","lineNumber":329,"sourceCode":"                .iter()\n                .find(|entry| entry.name == capsule.name)\n                .ok_or_else(|| {\n                    anyhow::anyhow!(\n                        \"Distro.lock capsule '{}' is absent from the daemon registry\",\n                        capsule.name\n                    )\n                })?;\n            if !capsule.version.is_empty() && entry.version != capsule.version {\n                bail!(\n                    \"Distro.lock capsule '{}' expects version {}, but the daemon registry reports {}\",\n                    capsule.name,\n                    capsule.version,\n                    entry.version\n                );\n            }\n            let expected_hash = capsule.hash.strip_prefix(\"blake3:\");\n            if expected_hash != entry.wasm_hash.as_deref() {\n                bail!(\n                    \"Distro.lock capsule '{}' hash disagrees with the daemon registry\",\n                    capsule.name\n                );\n            }\n            installed.push(expected.as_str().to_owned());\n        }\n        Ok::<_, anyhow::Error>(installed)\n    }\n    .await;\n    match result {\n        Ok(installed) => Some(installed),\n        Err(error) => {\n            eprintln!(\n                \"{}\",\n                Theme::warning(&format!(\n                    \"Distro.lock is current but installed state failed verification ({error:#}); reinstalling\"\n                ))\n            );","sourceCodeStart":311,"sourceCodeEnd":347,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_grant.rs#L311-L347","documentation":"The CLI verifies that each Distro.lock capsule's blake3:<hex> WASM hash matches the wasm_hash recorded by the daemon registry. A mismatch means the installed WASM artifact differs from the locked one, so reuse of prior grants is refused to prevent granting access to unverified code.","triggerScenarios":"validated_grant_set_for_reuse strips the 'blake3:' prefix from capsule.hash and compares it with entry.wasm_hash; the bail fires when they are not equal (including when the registry reports no hash).","commonSituations":"Rebuilt capsule producing a non-reproducible WASM binary, capsule updated since the lockfile was written, daemon registry entry pointing at a different artifact, or hand-edited lockfile hash.","solutions":["Reinstall the capsule so the daemon holds the exact WASM artifact whose hash is in Distro.lock.","Regenerate Distro.lock to capture the current artifact hash, then retry the grant.","Ensure the capsule build is reproducible (same toolchain/flags) if the lockfile hash is intended to be stable.","Remove stale registry entries and re-register the correct capsule."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let expected = capsule.hash.strip_prefix(\"blake3:\");\nif expected != entry.wasm_hash.as_deref() {\n    return Err(anyhow!(\"hash mismatch for {}\", capsule.name));\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = validate_hashes(&lock, &registry) {\n    eprintln!(\"lockfile out of date: {e}; regenerating\");\n    regenerate_lockfile().await?;\n}","preventionTips":["Build capsules reproducibly (pin toolchain and flags) so hashes stay stable.","Commit Distro.lock only after a final verified build.","Diff lockfile hashes against the registry before automating grants."],"tags":["checksum-mismatch","hash","lockfile","wasm"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}