capsule identity or version changed after authority decision

Error message

capsule identity or version changed after authority decision

What it means

`authority_for_install_source` checks that the capsule id (`manifest.package.name`) and version in the re-read manifest still match the approved authority decision. This error is thrown when the manifest's package name or version changed after the authority decision was recorded, meaning the approval applies to a different capsule release than the one being installed.

Source

Thrown at crates/astrid-capsule-install/src/authority.rs:934

    let content_digest = verification.content_digest().to_string();
    let manifest_digest = digest_manifest(&std::fs::read(source_dir.join("Capsule.toml"))?);
    let (signer, signature) = verification_provenance(&verification);

    if let Some(approved) = approved {
        if approved.content_digest != content_digest {
            bail!(
                "capsule content changed after authority decision (approved {}, found {})",
                approved.content_digest,
                content_digest
            );
        }
        if approved.signer != signer || approved.signature != signature {
            bail!("capsule provenance changed after authority decision");
        }
        if approved.capsule_id != manifest.package.name
            || approved.version != manifest.package.version
        {
            bail!("capsule identity or version changed after authority decision");
        }
        if approved.manifest_digest != manifest_digest {
            bail!("capsule manifest changed after authority decision");
        }
        if approved.approved_capabilities != manifest.capabilities {
            bail!("capsule capabilities changed after authority decision");
        }
        return Ok(approved);
    }

    // Calling the legacy library install API is itself an operator-authority
    // action. User-facing CLI and daemon entry points use explicit decisions;
    // this path preserves the existing trusted embedding API while recording
    // the same exact content and capability ceiling.
    Ok(InstalledAuthority {
        schema_version: 1,
        source: AuthoritySource::OperatorDistribution,
        capsule_id: manifest.package.name.clone(),

View on GitHub (pinned to affd8760f4)

Solutions

Re-run the authority approval for the current capsule id/version and pass the new receipt to the install
Revert Capsule.toml's name/version to the values present when the authority decision was made
Install the exact reviewed version instead of the modified one

Example fix

// before
bail!("capsule identity or version changed after authority decision");
// after: re-approve the bumped release
// let authority = decision::approve(source_dir)?;  // records new version
// install_from_local_path_internal(source_dir, Some(authority))

Defensive patterns

Strategy: validation

Validate before calling

// Confirm manifest identity matches the approved decision before install
let manifest = load_manifest(source_dir.join("Capsule.toml"))?;
assert_eq!(approved.capsule_id, manifest.package.name);
assert_eq!(approved.version, manifest.package.version);

Type guard

fn identity_unchanged(approved: &InstalledAuthority, m: &CapsuleManifest) -> bool {
    approved.capsule_id == m.package.name && approved.version == m.package.version
}

Try / catch

match authority_for_install_source(source_dir, &manifest, Some(approved)) {
    Err(e) if e.to_string().contains("identity or version changed") => reapprove_release(),
    other => other.map(install),
}

Prevention

Bump version only as part of a full review + approval cycle
Pin the reviewed commit and install from exactly that state
Avoid renaming packages in place; create a new target/receipt instead
Diff Capsule.toml against the reviewed version before installing

When it happens

Trigger: Calling `install_from_local_path_internal` with an approved `InstalledAuthority` where `approved.capsule_id != manifest.package.name` or `approved.version != manifest.package.version` — e.g. `Capsule.toml` was bumped or renamed between approval and install.

Common situations: Bumping the version in Capsule.toml after review but before install; renaming the package; checking out a different branch/commit with a different version after the approval was captured.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/b7072c0d5391b727. Report an issue: GitHub.