{"record":{"id":"85050547bf6fe7d5","repo":"astrid-runtime/astrid","slug":"distro-lock-capsule-capsule-declares-wasm-but","errorCode":null,"errorMessage":"Distro.lock capsule '{capsule}' declares WASM but has no installed WASM hash","messagePattern":"Distro\\.lock capsule '(.+?)' declares WASM but has no installed WASM hash","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_grant.rs","lineNumber":364,"sourceCode":"                ))\n            );\n            None\n        },\n    }\n}\n\nfn validate_locked_wasm(\n    home: &AstridHome,\n    capsule: &CapsuleId,\n    manifest: &CapsuleManifest,\n    meta_hash: Option<&str>,\n    locked_hash: &str,\n    store: Option<&astrid_storage::RuntimePrincipalStore>,\n) -> anyhow::Result<()> {\n    let declares_wasm = manifest_declares_wasm(manifest);\n    let Some(meta_hash) = meta_hash else {\n        if declares_wasm {\n            bail!(\"Distro.lock capsule '{capsule}' declares WASM but has no installed WASM hash\");\n        }\n        if !locked_hash.is_empty() {\n            bail!(\"Distro.lock non-WASM capsule '{capsule}' must not carry a WASM hash\");\n        }\n        return Ok(());\n    };\n\n    if !declares_wasm {\n        bail!(\n            \"Distro.lock capsule '{capsule}' does not declare WASM but installed metadata carries a WASM hash\"\n        );\n    }\n    let locked = parse_locked_blake3(capsule, locked_hash)?;\n    let locked_hex = locked.to_hex().to_string();\n    if meta_hash != locked_hex {\n        bail!(\"Distro.lock capsule '{capsule}' hash disagrees with installed metadata\");\n    }\n    let bytes = if let Some(store) = store {","sourceCodeStart":346,"sourceCodeEnd":382,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_grant.rs#L346-L382","documentation":"validate_locked_wasm checks consistency between the capsule manifest and installed metadata. If the manifest declares WASM but no installed WASM hash (meta_hash) is available, the lockfile data is incomplete relative to the manifest, so validation bails rather than granting against a possibly wrong artifact.","triggerScenarios":"Call validate_locked_capsules_with_store -> validate_locked_wasm with manifest_declares_wasm(manifest) == true and meta_hash == None.","commonSituations":"Capsule installed without its WASM artifact metadata, metadata file deleted or corrupted, an older installer that did not record WASM hashes, or manifest changed to add WASM after install.","solutions":["Reinstall the capsule so installed metadata includes the WASM hash.","Update the manifest to not declare WASM if the capsule truly has none.","Delete and recreate the installed metadata entry for the capsule.","Re-run init so the grant set is generated from a complete install."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if manifest_declares_wasm(&manifest) && installed.wasm_hash.is_none() {\n    return Err(anyhow!(\"{} declares wasm but has no installed hash\", capsule));\n}","typeGuard":null,"tryCatchPattern":"match validate_lock(&lock) {\n    Err(e) if e.to_string().contains(\"no installed WASM hash\") => reinstall_capsule(capsule)?,\n    other => other?,\n}","preventionTips":["Reinstall capsules whenever their manifest changes wasm declarations.","Never delete installed-metadata files manually.","Run a full init from a clean state after tooling upgrades."],"tags":["lockfile","wasm","metadata","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}