{"record":{"id":"aab2dd5d735504dc","repo":"astrid-runtime/astrid","slug":"installed-wasm-executable-differs-from-its-authori","errorCode":null,"errorMessage":"installed WASM executable differs from its authority receipt (approved {}, found {})","messagePattern":"installed WASM executable differs from its authority receipt \\(approved (.+?), found (.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":592,"sourceCode":"            .collect::<Vec<_>>()\n            .join(\"; \");\n        bail!(\n            \"manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion\"\n        );\n    }\n    if authority.manifest_digest != current_manifest_digest {\n        bail!(\n            \"installed Capsule.toml differs from the exact manifest approved at install; reinstall the capsule\"\n        );\n    }\n    if !authority.wasm_hash_pinned {\n        authority.wasm_hash_pinned = true;\n        authority.approved_wasm_hash = executable_hash;\n        AuthorityReceiptTransaction::stage(home, target_dir, &authority)?\n            .commit()\n            .context(\"failed to migrate installed authority executable pin\")?;\n    } else if authority.approved_wasm_hash != executable_hash {\n        bail!(\n            \"installed WASM executable differs from its authority receipt (approved {}, found {})\",\n            authority\n                .approved_wasm_hash\n                .as_deref()\n                .unwrap_or(\"<non-WASM>\"),\n            executable_hash.as_deref().unwrap_or(\"<non-WASM>\"),\n        );\n    }\n    Ok(())\n}\n\n/// Read and hash the exact executable the WASM engine would load.\n///\n/// `meta.json` is treated as a pointer, never as proof: the pointed-to bytes\n/// are re-hashed before an authority receipt is compared or migrated.\nfn verified_installed_wasm_hash(\n    home: &AstridHome,\n    target_dir: &Path,","sourceCodeStart":574,"sourceCodeEnd":610,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L574-L610","documentation":"The receipt pins (or, post-migration, is expected to pin) the BLAKE3 hash of the installed WASM executable. If the approved hash differs from the hash of the executable actually on disk, the binary was changed after approval and verification fails. The message shows both the approved and found hashes, using \"<non-WASM>\" when either side is absent.","triggerScenarios":"verify_installed_authority detects authority.approved_wasm_hash != executable_hash — the installed .wasm file was replaced, rebuilt, or corrupted after the receipt pinned its hash.","commonSituations":"Overwriting the installed wasm with a locally rebuilt binary; a partial/failed update leaving a truncated wasm; mixing artifacts from different builds in the capsule directory.","solutions":["Reinstall the capsule from the approved artifact so the wasm matches the receipt hash","Restore the original wasm binary that was approved at install","If the new binary is intentional, re-run the authorized install to approve and pin its new hash"],"exampleFix":"// before\n// replaced installed module.wasm with a rebuilt one\nverify_installed_authority(&home, &target_dir, &manifest, None)?;\n// after\ncp approved-build/module.wasm ~/.astrid/capsules/my-capsule/module.wasm\nverify_installed_authority(&home, &target_dir, &manifest, None)?;","handlingStrategy":"validation","validationCode":"let h = blake3::hash(std::fs::read(target_dir.join(\"module.wasm\"))?.as_slice()).to_hex();\nif Some(h.as_str()) != approved_receipt.approved_wasm_hash.as_deref() {\n    return Err(anyhow!(\"wasm {} != approved {} — reinstall\", h, approved_receipt.approved_wasm_hash.as_deref().unwrap_or(\"<non-WASM>\")));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never swap installed wasm binaries outside the install flow","Verify artifact hashes before and after deployment","Keep approved build artifacts archived so the pinned binary can be restored"],"tags":["capsule","wasm","integrity","hash-mismatch","security"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}