{"record":{"id":"9b49bab5accc21c9","repo":"astrid-runtime/astrid","slug":"fskit-callback-path-is-not-the-kernel-lease-endpoi","errorCode":null,"errorMessage":"FSKit callback path is not the kernel lease endpoint","messagePattern":"FSKit callback path is not the kernel lease endpoint","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fskit/src/service.rs","lineNumber":161,"sourceCode":"    if lease.lease_token.len() < 16 || lease.lease_token.len() > 4096 {\n        bail!(\"FSKit lease callback token is invalid\");\n    }\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .context(\"read system clock\")?\n        .as_secs();\n    if lease.expires_at_epoch_secs < now {\n        bail!(\"FSKit lease is expired\");\n    }\n    if !lease.resource_path.is_absolute() || !lease.callback_path.is_absolute() {\n        bail!(\"FSKit lease paths must be absolute\");\n    }\n    #[cfg(target_os = \"macos\")]\n    astrid_core::fskit_socket::validate_callback_path(lease.mount_id, &lease.callback_path)\n        .map_err(anyhow::Error::msg)?;\n    #[cfg(not(target_os = \"macos\"))]\n    if lease.callback_path != lease.resource_path.join(\"control.sock\") {\n        bail!(\"FSKit callback path is not the kernel lease endpoint\");\n    }\n    platform_fs::validate_private_directory(&lease.resource_path)\n        .context(\"validate private FSKit lease resource\")?;\n    platform_fs::verify_no_redirects(&lease.resource_path)\n        .context(\"reject redirected FSKit lease resource\")?;\n    platform_fs::validate_private_file(&lease.resource_path.join(\"lease.json\"))\n        .context(\"validate private FSKit lease manifest\")?;\n    let manifest = std::fs::read(lease.resource_path.join(\"lease.json\"))\n        .context(\"read FSKit lease manifest\")?;\n    if manifest.len() > 64 * 1024 {\n        bail!(\"FSKit lease manifest exceeds the bounded size\");\n    }\n    let admitted: astrid_core::storage_filesystem::StorageMountLeaseV1 =\n        serde_json::from_slice(&manifest).context(\"decode FSKit lease manifest\")?;\n    if admitted != *lease {\n        bail!(\"FSKit launch lease does not match the kernel manifest\");\n    }\n    Ok(())","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fskit/src/service.rs#L143-L179","documentation":"On non-macOS platforms, validate_lease requires lease.callback_path to equal resource_path.join(\"control.sock\") — the fixed kernel lease endpoint layout. Any other callback location is rejected. (On macOS the astrid_core::fskit_socket::validate_callback_path check applies instead.)","triggerScenarios":"validate_lease (via validate_launch or live_managed_callback_lease_is_accepted) on Linux/other with callback_path != resource_path/control.sock, e.g. a custom socket name or a callback path in another directory.","commonSituations":"Hand-edited lease JSON pointing callback_path elsewhere; tooling that moves the socket to a tmp directory; leases generated by a different version with a different endpoint convention.","solutions":["Set callback_path to resource_path.join(\"control.sock\") in the lease","Regenerate the lease with the provider so the endpoint layout matches","On macOS, ensure the callback path satisfies fskit_socket::validate_callback_path for the mount_id"],"exampleFix":"// before\ncallback_path: \"/tmp/control.sock\".into()\n// after\ncallback_path: lease.resource_path.join(\"control.sock\")","handlingStrategy":"validation","validationCode":"fn callback_ok(lease: &StorageMountLeaseV1) -> bool {\n    #[cfg(target_os = \"macos\")]\n    { let _ = lease; true /* validated by fskit_socket */ }\n    #[cfg(not(target_os = \"macos\"))]\n    lease.callback_path == lease.resource_path.join(\"control.sock\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always derive callback_path from resource_path, never hardcode it","Keep endpoint naming consistent across provider versions","Don't move sockets to /tmp or other directories in deployment scripts"],"tags":["fskit","lease","socket-path","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}