Distro install committed, but the self grant failed unexpect

Error message

Distro install committed, but the self grant failed unexpectedly: {other:?}; the installed set is not invokable until a retry completes

What it means

apply_self_grant performs the distro install commit and then the self grant; the self grant step returns a typed result. If the grant step ends in an unexpected (non-success, non-retryable) state after the install already committed, this bail fires, warning that the installed capsule set is not invokable until a successful grant retry completes.

Source

Thrown at crates/astrid-cli/src/commands/init_grant.rs:84

        "{}",
        Theme::info(&format!("Granting Distro capsule access to '{caller}'..."))
    );
    let mut client = crate::admin_client::connect_for_workspace_as(caller.clone())
        .await
        .context("Distro install committed, but connecting for the self grant failed")?;
    let body = client
        .request(AdminRequestKind::DistroSelfGrant)
        .await
        .context("Distro install committed, but the self-grant request failed")?;
    match crate::admin_client::into_result(body)? {
        AdminResponseBody::Success(_) => {
            eprintln!(
                "{}",
                Theme::success("Distro apply and self grant completed.")
            );
            Ok(())
        },
        other => bail!(
            "Distro install committed, but the self grant failed unexpectedly: {other:?}; \
             the installed set is not invokable until a retry completes"
        ),
    }
}

/// What the post-install grant step should do, given the flag and how many
/// capsules installed. Explicit requests always exercise the kernel grant
/// path; the CLI never infers privilege from a principal name.
#[derive(Debug, PartialEq, Eq)]
enum GrantAction {
    /// Nothing installed this run — no grants, no hint.
    Nothing,
    /// Flag omitted — print the manual hint.
    Hint,
    /// Flag set — apply the grants.
    Grant,
}

View on GitHub (pinned to affd8760f4)

Solutions

Retry the grant step (rerun init or the grant command) — the install is committed, only the grant is missing.
Check CLI/kernel version compatibility; upgrade the CLI so all grant result variants are handled.
Inspect kernel/client logs around the grant request to identify the unexpected variant's cause.
As a last resort, re-run the full init; the committed install will be detected and grants retried.

Defensive patterns

Strategy: retry

Validate before calling

// after a failed self grant, check whether grants exist before reinstalling
let granted = client.request(KernelRequest::GetCapsuleMetadata).await?;
// if install committed but grants missing, re-run only the grant step

Try / catch

match apply_self_grant().await {
    Ok(()) => {},
    Err(e) if e.to_string().contains("self grant failed unexpectedly") => {
        eprintln!("install committed; retrying grant...");
        retry_grant().await?;
    }
    Err(e) => return Err(e),
}

Prevention

Keep CLI and kernel versions matched to avoid unhandled result variants.
Retry the grant step rather than a full reinstall — the install already committed.
Log the `other:?` variant to make unknown grant results actionable.
Wrap install+grant in a resumable workflow.

When it happens

Trigger: During init with self-granting, the distro install committed successfully but the subsequent self-grant call returned an unexpected result variant (`other`).

Common situations: Kernel/client returned an unanticipated error mid-grant (connection drop producing an unexpected variant, protocol mismatch between CLI and kernel version); a bug in the grant result enum handling.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/ac7f6732e29b4a28. Report an issue: GitHub.