{"record":{"id":"bab240498865c1bf","repo":"astrid-runtime/astrid","slug":"installed-capsule-toml-differs-from-the-exact-mani","errorCode":null,"errorMessage":"installed Capsule.toml differs from the exact manifest approved at install; reinstall the capsule","messagePattern":"installed Capsule\\.toml differs from the exact manifest approved at install; reinstall the capsule","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":581,"sourceCode":"            manifest.package.name,\n            manifest.package.version\n        );\n    }\n    let expansions = manifest\n        .capabilities\n        .expansions_from(&authority.approved_capabilities);\n    if !expansions.is_empty() {\n        let details = expansions\n            .into_iter()\n            .map(|expansion| format!(\"{}=[{}]\", expansion.name, expansion.added.join(\", \")))\n            .collect::<Vec<_>>()\n            .join(\"; \");\n        bail!(\n            \"manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion\"\n        );\n    }\n    if authority.manifest_digest != current_manifest_digest {\n        bail!(\n            \"installed Capsule.toml differs from the exact manifest approved at install; reinstall the capsule\"\n        );\n    }\n    if !authority.wasm_hash_pinned {\n        authority.wasm_hash_pinned = true;\n        authority.approved_wasm_hash = executable_hash;\n        AuthorityReceiptTransaction::stage(home, target_dir, &authority)?\n            .commit()\n            .context(\"failed to migrate installed authority executable pin\")?;\n    } else if authority.approved_wasm_hash != executable_hash {\n        bail!(\n            \"installed WASM executable differs from its authority receipt (approved {}, found {})\",\n            authority\n                .approved_wasm_hash\n                .as_deref()\n                .unwrap_or(\"<non-WASM>\"),\n            executable_hash.as_deref().unwrap_or(\"<non-WASM>\"),\n        );","sourceCodeStart":563,"sourceCodeEnd":599,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L563-L599","documentation":"The receipt stores the exact digest of the Capsule.toml approved at install. If the manifest file on disk hashes differently, even byte-level edits unrelated to capabilities invalidate the approval, since approvals are bound to the exact manifest bytes.","triggerScenarios":"verify_installed_authority computes current_manifest_digest and finds it differs from authority.manifest_digest — any modification (formatting, comments, reordering) to the installed Capsule.toml after install.","commonSituations":"Hand-editing Capsule.toml after install (comments, formatting); tooling rewriting the manifest with normalized formatting; partially written manifest after an interrupted update.","solutions":["Reinstall the capsule so the current manifest bytes are re-approved and a new digest is stored","Restore the original Capsule.toml exactly as approved (e.g. from version control)","If the change is intentional, run the authorized install flow to approve the new manifest"],"exampleFix":"// before\n// hand-edited installed Capsule.toml (whitespace/comment changes)\nverify_installed_authority(&home, &target_dir, &manifest, None)?;\n// after\ngit -C ~/.astrid/capsules/my-capsule checkout -- Capsule.toml\nverify_installed_authority(&home, &target_dir, &manifest, None)?;","handlingStrategy":"validation","validationCode":"let digest = blake3::hash(std::fs::read(target_dir.join(\"Capsule.toml\"))?.as_slice()).to_hex();\nif digest != approved_receipt.manifest_digest {\n    return Err(anyhow!(\"Capsule.toml modified since approval; reinstall\"));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never edit the installed Capsule.toml in place","Disable tools that auto-format files inside capsule install directories","Record the approved manifest in version control for exact restore"],"tags":["capsule","integrity","digest-mismatch","rust"],"backgroundTag":"checksum-mismatch","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}