{"record":{"id":"f032e277e142d65c","repo":"astrid-runtime/astrid","slug":"wasm-capsule-has-no-blake3-hash-in-meta-json","errorCode":null,"errorMessage":"WASM capsule has no BLAKE3 hash in meta.json","messagePattern":"WASM capsule has no BLAKE3 hash in meta\\.json","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-capsule-install/src/authority.rs","lineNumber":618,"sourceCode":"    }\n    Ok(())\n}\n\n/// Read and hash the exact executable the WASM engine would load.\n///\n/// `meta.json` is treated as a pointer, never as proof: the pointed-to bytes\n/// are re-hashed before an authority receipt is compared or migrated.\nfn verified_installed_wasm_hash(\n    home: &AstridHome,\n    target_dir: &Path,\n    manifest: &CapsuleManifest,\n    store: Option<&RuntimePrincipalStore>,\n) -> anyhow::Result<Option<String>> {\n    let Some(component) = manifest.components.first() else {\n        return Ok(None);\n    };\n    let Some(expected) = crate::read_meta(target_dir).and_then(|meta| meta.wasm_hash) else {\n        bail!(\"WASM capsule has no BLAKE3 hash in meta.json\");\n    };\n    if let Some(store) = store {\n        return Ok(Some(\n            crate::wasm::catalog_wasm_hash(store, &expected)\n                .context(\"read installed WASM from system catalog\")?,\n        ));\n    }\n    let executable = if component.path.is_absolute() {\n        component.path.clone()\n    } else {\n        let local = target_dir.join(&component.path);\n        if local.exists() {\n            local\n        } else {\n            home.bin_dir().join(format!(\"{expected}.wasm\"))\n        }\n    };\n    let mut bytes = Vec::new();","sourceCodeStart":600,"sourceCodeEnd":636,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-capsule-install/src/authority.rs#L600-L636","documentation":"verified_installed_wasm_hash needs the expected BLAKE3 hash recorded in the capsule's meta.json to look up or compare the installed WASM. If meta.json is missing, unreadable, or lacks wasm_hash for a capsule that declares a WASM component, verification cannot proceed and bails. This catches incomplete or corrupted install metadata.","triggerScenarios":"verify_installed_authority_inner -> verified_installed_wasm_hash on a manifest with a first component, where read_meta(target_dir) fails or returns meta with wasm_hash == None.","commonSituations":"Install interrupted before meta.json was written; hand-edited or deleted meta.json; capsule copied without its meta.json; a non-WASM capsule mis-declared as having a WASM component (or vice versa).","solutions":["Reinstall the capsule so meta.json is regenerated with the wasm_hash field","Restore meta.json from the original artifact or package it shipped with","Confirm the capsule actually contains a WASM component and the artifact is complete"],"exampleFix":"// before\n// meta.json missing wasm_hash\nverify_installed_authority(&home, &target_dir, &manifest, None)?;\n// after\nreinstall_capsule(&home, &target_dir)?; // regenerates meta.json with wasm_hash","handlingStrategy":"validation","validationCode":"let meta = read_meta(&target_dir)?;\nif manifest_has_wasm_component(&manifest) && meta.and_then(|m| m.wasm_hash).is_none() {\n    return Err(anyhow!(\"meta.json missing wasm_hash; reinstall the capsule\"));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy capsule directories as complete packages including meta.json","Verify install completion before running (meta.json present with wasm_hash)","Never hand-edit or trim meta.json"],"tags":["capsule","wasm","metadata","blake3","rust"],"backgroundTag":"missing-required-config-field","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}