astrid-runtime/astrid · critical

durable capsule {id} version differs across package records

Error message

durable capsule {id} version differs across package records

What it means

verify_package_identity throws this when the version recorded in the authority receipt, the archive manifest (package.version), and the durable metadata do not all agree. All three records must carry the same version for a capsule to be considered coherently installed; disagreement means one record is stale, from a different release, or was tampered with. This protects consumers from loading an artifact other than the one the authority approved.

Source

Thrown at crates/astrid-capsule-install/src/storage.rs:270

    id: &str,
    manifest: &CapsuleManifest,
    metadata: &CapsuleMeta,
    authority: &InstalledAuthority,
    manifest_bytes: &[u8],
    verification: &ArtifactVerification,
    archive_files: &std::collections::BTreeMap<String, Vec<u8>>,
) -> anyhow::Result<()> {
    if authority.schema_version != 1 {
        bail!(
            "durable capsule {id} has unsupported authority schema {}",
            authority.schema_version
        );
    }
    if authority.capsule_id != id || manifest.package.name != id {
        bail!("durable capsule {id} identity differs across archive and authority");
    }
    if authority.version != manifest.package.version || metadata.version != authority.version {
        bail!("durable capsule {id} version differs across package records");
    }
    let manifest_digest = crate::authority::digest_manifest(manifest_bytes);
    if authority.manifest_digest != manifest_digest {
        bail!("durable capsule {id} manifest digest differs from authority receipt");
    }
    if authority.content_digest != verification.content_digest() {
        bail!("durable capsule {id} content digest differs from authority receipt");
    }
    let expected_imports = crate::wit::version_map_to_strings(&manifest.imports, |definition| {
        definition.version.to_string()
    });
    if metadata.imports != expected_imports {
        bail!("durable capsule {id} imports differ between metadata and archive");
    }
    let expected_exports = crate::wit::version_map_to_strings(&manifest.exports, |definition| {
        definition.version.to_string()
    });
    if metadata.exports != expected_exports {

View on GitHub (pinned to affd8760f4)

Solutions

1. Reinstall the capsule at the intended version so manifest, metadata, and authority receipt are all rewritten consistently.
2. Delete the stale durable metadata/authority files for the capsule and re-run the install flow.
3. Verify which version each record claims and pick one canonical version, then republish/re-approve the capsule at that version.
4. Restore the whole capsule directory from a single consistent backup instead of partial files.

Example fix

// before: partial upgrade left metadata at old version
// metadata.version = "1.0.0", authority.version = "1.1.0"
// after: remove stale state and reinstall the exact version
store.remove_durable(owner, "my-capsule")?;
store.install(owner, &capsule_archive_v1_1_0)?;

fn versions_agree(manifest: &CapsuleManifest, metadata: &CapsuleMeta, authority: &InstalledAuthority) -> bool {
    authority.version == manifest.package.version && metadata.version == authority.version
}

fn is_coherent_version(meta: &CapsuleMeta, a: &InstalledAuthority) -> bool { meta.version == a.version }

match store.read_verified_durable_package_for_owner(owner, id) {
    Ok(pkg) => pkg,
    Err(e) if e.to_string().contains("version differs across package records") => {
        store.remove_durable(owner, id)?;
        store.install(owner, &archive)?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: read_verified_durable_package_for_owner encounters InstalledAuthority.version != manifest.package.version, or CapsuleMeta.version != authority.version — e.g. after a partial upgrade that updated the archive but not the metadata, or vice versa.

Common situations: Upgrading a capsule in place and the metadata write failing midway; restoring only some files from backup so manifest and metadata come from different versions; republishing a capsule at a new version while an old authority receipt is still on disk; sharing install directories between machines with different capsule versions.

Related errors

• installed capsule identity/version differs from its authorit
• signed Distro.lock entry '{}' does not match Distro.toml
• installed Capsule.toml differs from the exact manifest appro
• durable capsule {id} identity differs across archive and aut
• durable capsule {id} manifest digest differs from authority

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/c07b80ff04e414c1. Report an issue: GitHub.