capsule metadata/authority does not match source manifest

Error message

capsule metadata/authority does not match source manifest

What it means

publish_directory_package refuses to publish a capsule directory when its identity disagrees with the approved authority. The library computes the manifest id/version from the source directory and requires that authority.capsule_id, authority.version, and meta.version all agree before creating the durable archive. This is an integrity guard ensuring you publish exactly the capsule that was approved.

Source

Thrown at crates/astrid-capsule-install/src/storage.rs:427

/// conflict instead of silently overwriting a concurrent update.
pub fn publish_directory_package(
    store: &Arc<RuntimePrincipalStore>,
    principal: &PrincipalId,
    source_dir: &Path,
    target_dir: &Path,
    meta: &CapsuleMeta,
    authority: &InstalledAuthority,
) -> anyhow::Result<()> {
    let uid = store
        .principal_directory()
        .uid_for(principal)
        .with_context(|| format!("resolve durable uid for principal {principal}"))?;
    let (manifest_id, manifest_version) = manifest_identity(source_dir)?;
    if authority.capsule_id != manifest_id
        || authority.version != manifest_version
        || meta.version != authority.version
    {
        bail!("capsule metadata/authority does not match source manifest");
    }
    let archive = canonical_capsule_archive(source_dir)?;
    let verification = artifact::verify_archive_bytes(&archive)
        .context("verify canonical durable capsule archive")?;
    let mut durable_authority = authority.clone();
    // Directory approval binds the complete checked source tree, while the
    // durable package intentionally omits build/VCS/cache material. Rebind the
    // receipt to the deterministic package produced by that trusted transform;
    // the manifest/capability/WASM pins remain unchanged and are verified
    // again below before publication succeeds.
    verification
        .content_digest()
        .clone_into(&mut durable_authority.content_digest);
    let metadata = fs::read(target_dir.join("meta.json")).with_context(|| {
        format!(
            "read generated capsule metadata from {}",
            target_dir.display()
        )

View on GitHub (pinned to affd8760f4)

Solutions

Regenerate the directory approval/authority against the current source tree so capsule_id and version match manifest_identity(source_dir).
Align capsule meta.version, the manifest version, and authority.version to the same value before publishing.
Verify you are passing the authority produced for this exact source_dir, not another capsule's.
If the source changed intentionally, re-run the full publish/approval workflow from scratch instead of reusing the old authority.

Example fix

// before
let authority = load_stale_authority();
publish_directory_package(&source_dir, &authority, &meta)?;
// after
let (manifest_id, manifest_version) = manifest_identity(&source_dir)?;
assert_eq!(authority.capsule_id, manifest_id);
assert_eq!(authority.version, manifest_version);
assert_eq!(meta.version, authority.version);
publish_directory_package(&source_dir, &authority, &meta)?;

Defensive patterns

Strategy: validation

Validate before calling

let (id, ver) = manifest_identity(&source_dir)?;
if authority.capsule_id != id || authority.version != ver || meta.version != authority.version {
    return Err(anyhow!("publish aborted: authority/meta do not match source manifest"));
}
publish_directory_package(&source_dir, &authority, &meta)?;

Try / catch

match publish_directory_package(&src, &authority, &meta) {
    Ok(()) => info!("published"),
    Err(e) if e.to_string().contains("does not match source manifest") => {
        warn!("source changed since approval; re-approving");
        reapprove_and_publish(&src)?;
    }
    Err(e) => return Err(e),
}

Prevention

Always derive the authority from the same source_dir you publish, in the same run.
Keep version in a single source of truth mirrored into meta and manifest by one build step.
Never reuse a directory approval after editing the source tree; re-run the approval workflow.

When it happens

Trigger: Calling publish_directory_package(source_dir, ...) where (a) authority.capsule_id != manifest_identity(source_dir).id, (b) authority.version != manifest version, or (c) meta.version != authority.version — i.e. the directory was edited, re-versioned, or the wrong authority/meta was passed after approval.

Common situations: Editing capsule metadata or source after obtaining directory approval; bumping the version in one place (Cargo/meta/manifest) but not the others; passing an authority fetched for a different capsule directory; stale cached meta file next to a regenerated manifest.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/792490c86884d407. Report an issue: GitHub.