{"record":{"id":"7e941aec89f3e0fb","repo":"astrid-runtime/astrid","slug":"installed-authority-receipt-does-not-match-capsule","errorCode":null,"errorMessage":"installed authority receipt does not match capsule '{capsule_id}'","messagePattern":"installed authority receipt does not match capsule '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":886,"sourceCode":"                ArtifactProvenance::LocalRuntime { signer, signature }\n            } else {\n                ArtifactProvenance::ForeignRuntime { signer, signature }\n            }\n        },\n    };\n    let capsule_id = CapsuleId::new(manifest.package.name.clone())?;\n    let target_dir = resolve_target_dir_for_in_workspace(\n        home,\n        target_principal,\n        capsule_id.as_str(),\n        workspace,\n        workspace_root,\n        workspace_layout,\n    )?;\n    let approved = match read_installed_authority(home, &target_dir)? {\n        Some(authority) => {\n            if authority.schema_version != 1 || authority.capsule_id != capsule_id.as_str() {\n                bail!(\"installed authority receipt does not match capsule '{capsule_id}'\");\n            }\n            Some(authority.approved_capabilities)\n        },\n        None => None,\n    }\n    .or_else(|| {\n        astrid_capsule::discovery::load_manifest(&target_dir.join(\"Capsule.toml\"))\n            .ok()\n            .map(|installed| installed.capabilities)\n    })\n    .unwrap_or_default();\n    let capability_expansions = manifest.capabilities.expansions_from(&approved);\n    Ok(InstallInspection {\n        capsule_id,\n        version: manifest.package.version,\n        content_digest,\n        provenance,\n        capability_expansions,","sourceCodeStart":868,"sourceCodeEnd":904,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L868-L904","documentation":"During install inspection, `inspect_manifest` reads any previously persisted authority receipt for the capsule's target directory and validates it against the capsule being installed. This error is thrown when the on-disk receipt has a schema version other than 1 or its `capsule_id` differs from the capsule id derived from the manifest being installed. The library refuses to silently apply an authority decision recorded for a different capsule or an incompatible receipt format.","triggerScenarios":"Calling `inspect_archive_for_principal_in_workspace` or `inspect_directory_for_principal_in_workspace` when the target directory already contains an installed-authority receipt where `schema_version != 1` or `receipt.capsule_id != <manifest package name>`. Typical causes: a stale receipt left over from a capsule that was renamed, a home directory reused across capsule identities, or a receipt written by an older/newer format version.","commonSituations":"Renaming or repurposing a capsule while reusing the same install target directory; restoring an Astrid home from a backup or another machine where receipts do not correspond to current manifests; upgrading/downgrading the runtime so the receipt schema changed; hand-editing or copying receipts between targets.","solutions":["Remove or quarantine the stale receipt under the authority receipt directory for that target so a fresh one is written on the next install","Verify the manifest `package.name` matches the capsule the receipt was issued for; install the correct capsule into the correct target directory","Upgrade or align the astrid-capsule-install version so receipt schema_version expectations (1) match what is on disk","Reinstall the capsule from source so a new matching authority decision is recorded"],"exampleFix":"// before: reinstalling 'my-capsule' into a dir whose receipt belongs to 'old-capsule'\nbail!(\"installed authority receipt does not match capsule '{capsule_id}'\");\n// after: clear the mismatched receipt first\n// rm <home>/etc/capsule-authority/<hash>.json  (or quarantine it)\n// then re-run the install so a fresh schema-1 receipt is written","handlingStrategy":"validation","validationCode":"// Before installing, check any existing receipt matches the capsule and schema\nif let Some(receipt) = read_installed_authority(&home, &target_dir)? {\n    if receipt.schema_version != 1 || receipt.capsule_id != capsule_id {\n        // quarantine/remove the stale receipt or route to re-approval before installing\n    }\n}","typeGuard":"fn receipt_matches(receipt: &InstalledAuthority, capsule_id: &str) -> bool {\n    receipt.schema_version == 1 && receipt.capsule_id == capsule_id\n}","tryCatchPattern":null,"preventionTips":["Never reuse an install target directory across differently-named capsules without clearing receipts","Keep receipt schema expectations in sync with the runtime version you deploy","Avoid hand-copying receipts between homes or target directories","After restoring a home from backup, run the leftover-receipt sweep before installing"],"tags":["security","authority-receipt","install","schema-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}