{"record":{"id":"ac7f6732e29b4a28","repo":"astrid-runtime/astrid","slug":"distro-install-committed-but-the-self-grant-faile","errorCode":null,"errorMessage":"Distro install committed, but the self grant failed unexpectedly: {other:?}; the installed set is not invokable until a retry completes","messagePattern":"Distro install committed, but the self grant failed unexpectedly: (.+?); the installed set is not invokable until a retry completes","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_grant.rs","lineNumber":84,"sourceCode":"        \"{}\",\n        Theme::info(&format!(\"Granting Distro capsule access to '{caller}'...\"))\n    );\n    let mut client = crate::admin_client::connect_for_workspace_as(caller.clone())\n        .await\n        .context(\"Distro install committed, but connecting for the self grant failed\")?;\n    let body = client\n        .request(AdminRequestKind::DistroSelfGrant)\n        .await\n        .context(\"Distro install committed, but the self-grant request failed\")?;\n    match crate::admin_client::into_result(body)? {\n        AdminResponseBody::Success(_) => {\n            eprintln!(\n                \"{}\",\n                Theme::success(\"Distro apply and self grant completed.\")\n            );\n            Ok(())\n        },\n        other => bail!(\n            \"Distro install committed, but the self grant failed unexpectedly: {other:?}; \\\n             the installed set is not invokable until a retry completes\"\n        ),\n    }\n}\n\n/// What the post-install grant step should do, given the flag and how many\n/// capsules installed. Explicit requests always exercise the kernel grant\n/// path; the CLI never infers privilege from a principal name.\n#[derive(Debug, PartialEq, Eq)]\nenum GrantAction {\n    /// Nothing installed this run — no grants, no hint.\n    Nothing,\n    /// Flag omitted — print the manual hint.\n    Hint,\n    /// Flag set — apply the grants.\n    Grant,\n}","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_grant.rs#L66-L102","documentation":"apply_self_grant performs the distro install commit and then the self grant; the self grant step returns a typed result. If the grant step ends in an unexpected (non-success, non-retryable) state after the install already committed, this bail fires, warning that the installed capsule set is not invokable until a successful grant retry completes.","triggerScenarios":"During init with self-granting, the distro install committed successfully but the subsequent self-grant call returned an unexpected result variant (`other`).","commonSituations":"Kernel/client returned an unanticipated error mid-grant (connection drop producing an unexpected variant, protocol mismatch between CLI and kernel version); a bug in the grant result enum handling.","solutions":["Retry the grant step (rerun init or the grant command) — the install is committed, only the grant is missing.","Check CLI/kernel version compatibility; upgrade the CLI so all grant result variants are handled.","Inspect kernel/client logs around the grant request to identify the unexpected variant's cause.","As a last resort, re-run the full init; the committed install will be detected and grants retried."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// after a failed self grant, check whether grants exist before reinstalling\nlet granted = client.request(KernelRequest::GetCapsuleMetadata).await?;\n// if install committed but grants missing, re-run only the grant step","typeGuard":null,"tryCatchPattern":"match apply_self_grant().await {\n    Ok(()) => {},\n    Err(e) if e.to_string().contains(\"self grant failed unexpectedly\") => {\n        eprintln!(\"install committed; retrying grant...\");\n        retry_grant().await?;\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Keep CLI and kernel versions matched to avoid unhandled result variants.","Retry the grant step rather than a full reinstall — the install already committed.","Log the `other:?` variant to make unknown grant results actionable.","Wrap install+grant in a resumable workflow."],"tags":["grant","partial-failure","state"],"backgroundTag":"invalid-state-transition","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}