durable capsule {id} manifest exceeds its authority receipt

Error message

durable capsule {id} manifest exceeds its authority receipt

What it means

After merging manifest-level and per-component capabilities, the effective capability set contains expansions that are not covered by the approved capabilities in the InstalledAuthority receipt. The library rejects the package because a durable capsule may never grant more permissions than its authority receipt approves; the manifest would otherwise silently escalate privileges at install time.

Source

Thrown at crates/astrid-capsule-install/src/storage.rs:330

                bail!("durable capsule {id} WASM hash differs between metadata and archive");
            }
        } else if metadata.wasm_hash.is_some() {
            bail!("durable capsule {id} metadata names a hash for a non-WASM component");
        }
    } else if metadata.wasm_hash.is_some() {
        bail!("durable capsule {id} metadata names a component absent from its archive");
    }
    let mut effective_capabilities = manifest.capabilities.clone();
    for component in &manifest.components {
        if let Some(capabilities) = &component.capabilities {
            effective_capabilities.merge_from(capabilities);
        }
    }
    if !effective_capabilities
        .expansions_from(&authority.approved_capabilities)
        .is_empty()
    {
        bail!("durable capsule {id} manifest exceeds its authority receipt");
    }
    match verification {
        ArtifactVerification::Signed(provenance) => {
            let signer = provenance.signer.to_string();
            let signature = provenance.signature.to_string();
            if authority.signer.as_deref() != Some(signer.as_str())
                || authority.signature.as_deref() != Some(signature.as_str())
            {
                bail!("durable capsule {id} provenance differs from authority receipt");
            }
        },
        ArtifactVerification::Unsigned { .. } => {
            if authority.signer.is_some() || authority.signature.is_some() {
                bail!("durable capsule {id} authority claims provenance absent from archive");
            }
        },
    }
    Ok(())

View on GitHub (pinned to affd8760f4)

Solutions

Re-issue or update the authority receipt so approved_capabilities covers the manifest's requested capabilities.
Remove the extra capabilities from the manifest/component capabilities blocks to match the receipt.
Regenerate the receipt as part of the publish flow whenever capabilities change.
Diff effective vs approved capabilities (expansions_from output) to see exactly which grants are rejected.

Example fix

// before: manifest requests more than receipt approves
manifest.capabilities.add(Capability::NetworkOutbound);
// after: request receipt approval first, or remove the grant
// authority.approved_capabilities must include Capability::NetworkOutbound
// or delete the capability from the manifest

Defensive patterns

Strategy: validation

Validate before calling

let mut effective = manifest.capabilities.clone();
for c in &manifest.components {
    if let Some(caps) = &c.capabilities { effective.merge_from(caps); }
}
if !effective.expansions_from(&authority.approved_capabilities).is_empty() {
    return Err("manifest requests capabilities not in authority receipt");
}

Type guard

fn within_authority(manifest: &CapsuleManifest, authority: &InstalledAuthority) -> bool {
    let mut effective = manifest.capabilities.clone();
    for c in &manifest.components {
        if let Some(caps) = &c.capabilities { effective.merge_from(caps); }
    }
    effective.expansions_from(&authority.approved_capabilities).is_empty()
}

Try / catch

match read_verified_durable_package_for_owner(&store, owner, id).await {
    Ok(pkg) => pkg,
    Err(e) if e.to_string().contains("exceeds its authority receipt") => {
        // re-issue receipt or trim capabilities
    },
    Err(e) => return Err(e),
}

Prevention

Re-issue the authority receipt whenever manifest capabilities change.
Treat the receipt as the single source of truth for allowed capabilities.
Run expansions_from as a pre-publish lint.

When it happens

Trigger: read_verified_durable_package_for_owner when effective_capabilities.expansions_from(authority.approved_capabilities) is non-empty — i.e. the manifest (or a component's capabilities block) requests a capability (network, fs, etc.) not present in the authority receipt.

Common situations: Editing the manifest to add a capability without re-issuing the authority receipt; reusing an old authority receipt with an upgraded manifest; copying a manifest between capsules with different approved capability sets.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/452ab85e9d724f95. Report an issue: GitHub.