astrid-runtime/astrid · error

durable capsule {id} failed authoritative verification

Error message

durable capsule {id} failed authoritative verification

What it means

Thrown after a durable capsule passes snapshot readback: read_verified_durable_package_for_owner returned None, meaning no verified authoritative package could be read back from the durable store for this owner. The registry accepted the install but the authoritative verification layer cannot confirm the published bytes, so migration refuses to retire the legacy capsule.

Source

Thrown at crates/astrid-capsule-install/src/storage/migration.rs:188

        let durable_authority_bytes = serde_json::to_vec_pretty(&durable_authority)
            .with_context(|| format!("serialize durable legacy capsule authority {id}"))?;
        let package = CapsulePackage::new(archive, meta_bytes, durable_authority_bytes);
        let expectation = match registry.get_snapshot(&owner, id)? {
            None => CapsuleInstallExpectation::Absent,
            Some(snapshot) if snapshot.package() == &package => {
                CapsuleInstallExpectation::Generation(snapshot.generation())
            },
            Some(_) => bail!("durable capsule {id} conflicts with legacy native content"),
        };
        registry.install(&owner, id, &package, expectation)?;
        let readback = registry
            .get_snapshot(&owner, id)?
            .ok_or_else(|| anyhow::anyhow!("durable capsule {id} disappeared after publish"))?;
        if readback.package() != &package {
            bail!("durable capsule {id} failed byte-for-byte readback");
        }
        read_verified_durable_package_for_owner(store, &owner, id)?.ok_or_else(|| {
            anyhow::anyhow!("durable capsule {id} failed authoritative verification")
        })?;
        astrid_core::platform_fs::verify_no_redirects(&target)
            .with_context(|| format!("verify legacy capsule {id} before retirement"))?;
        let final_archive = canonical_legacy_archive(home, &target, &meta, &manifest)?;
        if final_archive != package.archive {
            bail!("legacy capsule {id} changed before retirement");
        }
        if fs::read(target.join("meta.json"))? != package.metadata {
            bail!("legacy capsule {id} metadata changed before retirement");
        }
        if read_installed_authority_bytes(home, &target)?.as_deref()
            != Some(source_authority_bytes.as_slice())
        {
            bail!("legacy capsule {id} authority changed before retirement");
        }
        astrid_core::platform_fs::verify_no_redirects(&target)
            .with_context(|| format!("verify legacy capsule {id} retirement boundary"))?;
        astrid_core::dirs::retire_legacy_source_tree(&target)

View on GitHub (pinned to affd8760f4)

Solutions

1. Re-run migration so receipts are re-ingested; relocated capsules are handled by the ingest-or-quarantine receipt path
2. Inspect the owner's durable store for missing/stale verification receipts and remove partial migration state before retrying
3. Confirm the capsule files were not modified between install and verification (antivirus, cloud sync, backup tools)
4. Check that migration runs under the same user/owner that owns the capsule store

// before migration, confirm authority receipts are valid
match read_verified_durable_package_for_owner(store, &owner, &id) {
    Some(pkg) => println!("verified: {}", pkg.archive),
    None => eprintln!("capsule {id} will fail verification — clean stale state first"),
}

if let Err(e) = migrate_native_capsules(&home) {
    if e.to_string().contains("failed authoritative verification") {
        // clear partial migration state and retry so receipts are re-ingested
        purge_partial_migration_state(&home)?;
        migrate_native_capsules(&home)?;
    } else { return Err(e); }
}

When it happens

Trigger: migrate_native_capsules_with_report runs; registry.install() and get_snapshot() succeed and bytes match, but read_verified_durable_package_for_owner(store, &owner, id) finds no verified durable package record — e.g. verification receipts were not written, were quarantined (see relocated_path_hashed_receipts_are_ingested_or_quarantined), or the durable record references a stale path/hash.

Common situations: Legacy capsules relocated on disk so path-hashed authority receipts no longer match; interrupted previous migration leaving installs without receipts; anti-virus or sync tools (Dropbox etc.) altering files after install; running migration as a different user so owner-scoped store paths differ.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• durable capsule {id} disappeared after publish
• installed capsule identity/version differs from its authorit
• installed Capsule.toml differs from the exact manifest appro
• durable capsule {} is missing its pinned contracts blob
• durable capsule {} contracts blob digest mismatch

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/53d34e494ff587ad. Report an issue: GitHub.