Distro.lock capsule '{capsule}' declares WASM but has no ins

Error message

Distro.lock capsule '{capsule}' declares WASM but has no installed WASM hash

What it means

validate_locked_wasm checks consistency between the capsule manifest and installed metadata. If the manifest declares WASM but no installed WASM hash (meta_hash) is available, the lockfile data is incomplete relative to the manifest, so validation bails rather than granting against a possibly wrong artifact.

Source

Thrown at crates/astrid-cli/src/commands/init_grant.rs:364

                ))
            );
            None
        },
    }
}

fn validate_locked_wasm(
    home: &AstridHome,
    capsule: &CapsuleId,
    manifest: &CapsuleManifest,
    meta_hash: Option<&str>,
    locked_hash: &str,
    store: Option<&astrid_storage::RuntimePrincipalStore>,
) -> anyhow::Result<()> {
    let declares_wasm = manifest_declares_wasm(manifest);
    let Some(meta_hash) = meta_hash else {
        if declares_wasm {
            bail!("Distro.lock capsule '{capsule}' declares WASM but has no installed WASM hash");
        }
        if !locked_hash.is_empty() {
            bail!("Distro.lock non-WASM capsule '{capsule}' must not carry a WASM hash");
        }
        return Ok(());
    };

    if !declares_wasm {
        bail!(
            "Distro.lock capsule '{capsule}' does not declare WASM but installed metadata carries a WASM hash"
        );
    }
    let locked = parse_locked_blake3(capsule, locked_hash)?;
    let locked_hex = locked.to_hex().to_string();
    if meta_hash != locked_hex {
        bail!("Distro.lock capsule '{capsule}' hash disagrees with installed metadata");
    }
    let bytes = if let Some(store) = store {

View on GitHub (pinned to affd8760f4)

Solutions

Reinstall the capsule so installed metadata includes the WASM hash.
Update the manifest to not declare WASM if the capsule truly has none.
Delete and recreate the installed metadata entry for the capsule.
Re-run init so the grant set is generated from a complete install.

Defensive patterns

Strategy: validation

Validate before calling

if manifest_declares_wasm(&manifest) && installed.wasm_hash.is_none() {
    return Err(anyhow!("{} declares wasm but has no installed hash", capsule));
}

Try / catch

match validate_lock(&lock) {
    Err(e) if e.to_string().contains("no installed WASM hash") => reinstall_capsule(capsule)?,
    other => other?,
}

Prevention

Reinstall capsules whenever their manifest changes wasm declarations.
Never delete installed-metadata files manually.
Run a full init from a clean state after tooling upgrades.

When it happens

Trigger: Call validate_locked_capsules_with_store -> validate_locked_wasm with manifest_declares_wasm(manifest) == true and meta_hash == None.

Common situations: Capsule installed without its WASM artifact metadata, metadata file deleted or corrupted, an older installer that did not record WASM hashes, or manifest changed to add WASM after install.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/85050547bf6fe7d5. Report an issue: GitHub.