Distro.lock capsule '{}' hash disagrees with the daemon regi

Error message

Distro.lock capsule '{}' hash disagrees with the daemon registry

What it means

The CLI verifies that each Distro.lock capsule's blake3:<hex> WASM hash matches the wasm_hash recorded by the daemon registry. A mismatch means the installed WASM artifact differs from the locked one, so reuse of prior grants is refused to prevent granting access to unverified code.

Source

Thrown at crates/astrid-cli/src/commands/init_grant.rs:329

                .iter()
                .find(|entry| entry.name == capsule.name)
                .ok_or_else(|| {
                    anyhow::anyhow!(
                        "Distro.lock capsule '{}' is absent from the daemon registry",
                        capsule.name
                    )
                })?;
            if !capsule.version.is_empty() && entry.version != capsule.version {
                bail!(
                    "Distro.lock capsule '{}' expects version {}, but the daemon registry reports {}",
                    capsule.name,
                    capsule.version,
                    entry.version
                );
            }
            let expected_hash = capsule.hash.strip_prefix("blake3:");
            if expected_hash != entry.wasm_hash.as_deref() {
                bail!(
                    "Distro.lock capsule '{}' hash disagrees with the daemon registry",
                    capsule.name
                );
            }
            installed.push(expected.as_str().to_owned());
        }
        Ok::<_, anyhow::Error>(installed)
    }
    .await;
    match result {
        Ok(installed) => Some(installed),
        Err(error) => {
            eprintln!(
                "{}",
                Theme::warning(&format!(
                    "Distro.lock is current but installed state failed verification ({error:#}); reinstalling"
                ))
            );

View on GitHub (pinned to affd8760f4)

Solutions

Reinstall the capsule so the daemon holds the exact WASM artifact whose hash is in Distro.lock.
Regenerate Distro.lock to capture the current artifact hash, then retry the grant.
Ensure the capsule build is reproducible (same toolchain/flags) if the lockfile hash is intended to be stable.
Remove stale registry entries and re-register the correct capsule.

Defensive patterns

Strategy: validation

Validate before calling

let expected = capsule.hash.strip_prefix("blake3:");
if expected != entry.wasm_hash.as_deref() {
    return Err(anyhow!("hash mismatch for {}", capsule.name));
}

Try / catch

if let Err(e) = validate_hashes(&lock, &registry) {
    eprintln!("lockfile out of date: {e}; regenerating");
    regenerate_lockfile().await?;
}

Prevention

Build capsules reproducibly (pin toolchain and flags) so hashes stay stable.
Commit Distro.lock only after a final verified build.
Diff lockfile hashes against the registry before automating grants.

When it happens

Trigger: validated_grant_set_for_reuse strips the 'blake3:' prefix from capsule.hash and compares it with entry.wasm_hash; the bail fires when they are not equal (including when the registry reports no hash).

Common situations: Rebuilt capsule producing a non-reproducible WASM binary, capsule updated since the lockfile was written, daemon registry entry pointing at a different artifact, or hand-edited lockfile hash.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/777747531cf9ebcc. Report an issue: GitHub.