astrid-runtime/astrid · critical · anyhow::Error

Failed to load admitted-home boot policy

Error message

Failed to load admitted-home boot policy: {error:#}

What it means

After the kernel boots, the daemon reloads configuration from the 'admitted home' (astrid home + workspace layout) to bind boot-time local egress policy. If `Config::load_with_home_and_layout` fails, this error wraps the detailed cause; the daemon refuses to continue because the security policy must be bound before any capsule can load.

Solutions

1. Inspect the wrapped `{error:#}` chain for the exact parse/validation problem.
2. Fix or regenerate the config file in the astrid home / workspace root.
3. Ensure the config matches the current schema for your astrid version.
4. Check file permissions on the home directory so the config is readable.

// shell
# pre-flight: ensure admitted-home config parses before launching daemon
astrid config check --home "$ASTRID_HOME" || exit 1

// rust
if let Err(e) = daemon::run(args).await {
    eprintln!("{e:#}"); // full chain reveals which config field/parse step failed
    std::process::exit(1);
}

When it happens

Trigger: Daemon `run()` reaching the post-admission config reload where the config file at the admitted home is missing required fields, malformed TOML, or unreadable.

Common situations: Hand-edited config with a typo introduced after admission; a config schema written by a newer/older version of the tool; restrictive file permissions on the astrid home.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Failed to bind boot policy
• astrid distro apply requires a signed Distro…
• Astrid durable media is redirected or not a regular file
• ASTRID_ENFORCED_DISTRO must not be empty
• ASTRID_HOME must be an absolute path

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/63dadb26b475cb4f. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-daemon/src/lib.rs:275

    let kernel = astrid_kernel::Kernel::new_with_workspace_layout(
        session_id.clone(),
        workspace_root,
        runtime_limits,
        std::collections::HashMap::new(),
        http_limits,
        workspace_layout,
    )
    .await
    .map_err(|e| anyhow::anyhow!("Failed to boot Kernel: {e}"))?;

    // Local egress is security policy at durable-root authority, so read it
    // only after admission and bind it once before any capsule can load.
    let admitted_config = astrid_config::Config::load_with_home_and_layout(
        Some(&kernel.workspace_root),
        astrid_home.root(),
        kernel.workspace_layout(),
    )
    .map_err(|error| anyhow::anyhow!("Failed to load admitted-home boot policy: {error:#}"))?;
    kernel
        .bind_boot_local_egress(admitted_config.config.security.capsule_local_egress)
        .map_err(|error| anyhow::anyhow!("Failed to bind boot policy: {error}"))?;

    if defer_logging {
        init_logging(&log_config);
    }
    kernel
        .set_system_capsules(
            unified_cfg
                .as_ref()
                .into_iter()
                .flat_map(|config| config.uplinks.iter())
                .map(|uplink| uplink.plugin.clone()),
        )
        .await;

    // Astrid owns its baseline control plane. Start it before loading optional

View on GitHub (pinned to affd8760f4)