What causes "daemon rejected capsule install: {message}" in astrid-runtime/astrid?

Read the {message} text in the error — it is the daemon kernel's reason for rejection.

daemon rejected capsule install: {message}

Error message

daemon rejected capsule install: {message}

What it means

install_local_via_daemon_for_target_with_generation matches on KernelResponse from the daemon during a capsule install. The explicit KernelResponse::Error(message) arm bails with the daemon's own rejection message. The install was rejected server-side, so the message text comes from the kernel, not the CLI.

Source

Thrown at crates/astrid-cli/src/commands/capsule/install_daemon.rs:245

                apply_values(&mut admin, target, capsule_id.as_str(), &values).await?;
            }
            let version = output
                .get("installed_version")
                .and_then(serde_json::Value::as_str)
                .unwrap_or(manifest.package.version.as_str())
                .to_owned();
            let wasm_hash = output
                .get("wasm_hash")
                .and_then(serde_json::Value::as_str)
                .map(str::to_owned);
            Ok(InstalledCapsuleOutcome {
                id: capsule_id,
                version,
                wasm_hash,
                skipped: false,
            })
        },
        KernelResponse::Error(message) => bail!("daemon rejected capsule install: {message}"),
        other => bail!("unexpected daemon response: {other:?}"),
    }
}

fn resume_generation_from_receipt(
    receipt: Option<CapsuleInstallResumeReceipt>,
    expected_id: &CapsuleId,
    source_digest: &str,
    expected_generation_hint: Option<&InstalledCapsuleGeneration>,
) -> Option<InstalledCapsuleGeneration> {
    let receipt = receipt?;
    if receipt.id != expected_id.as_str()
        || !is_digest(source_digest)
        || receipt.archive_digest != source_digest
        || !is_generation_well_formed(&receipt.generation)
        || expected_generation_hint.is_some_and(|hint| hint != &receipt.generation)
    {
        return None;

View on GitHub (pinned to affd8760f4)

Solutions

Read the {message} text in the error — it is the daemon kernel's reason for rejection.
Verify the capsule id, version, and wasm hash are consistent with any prior install/receipt.
Use the resume/generation flags (see resume_generation_from_receipt) to retry from the last receipt instead of reinstalling.
Check daemon logs for the kernel-side rejection details.

Defensive patterns

Strategy: try-catch

Validate before calling

// verify id/version/hash consistency with prior receipt before install
assert!(receipt.capsule_id == capsule_id && receipt.version == version)

Type guard

if let KernelResponse::Error(msg) = resp { return Err(msg); }

Try / catch

catch the error, surface the daemon's {message} verbatim to the operator, and only retry with resume flags if the reason is transient.

Prevention

Never change wasm contents without bumping the capsule version.
Reuse the install receipt/generation for retries instead of fresh installs.
Confirm the principal has install permission for the target capsule.

When it happens

Trigger: Sending a capsule install kernel request where the daemon kernel answers KernelResponse::Error — e.g. invalid capsule id/version, wasm hash mismatch, quota or policy rejection.

Common situations: Installing a capsule whose wasm_hash doesn't match a previously registered one; version conflicts on reinstall; daemon policy forbidding the principal to install that capsule.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/4e1d08748620fa04. Report an issue: GitHub.