What causes "FSKit lease callback token is invalid" in astrid-runtime/astrid?

Obtain the lease token from the real kernel/provider issuance path instead of hand-crafting it

FSKit lease callback token is invalid

Error message

FSKit lease callback token is invalid

What it means

validate_lease checks that the StorageMountLeaseV1 lease_token is between 16 and 4096 bytes long. A token outside this range cannot be a valid kernel-issued callback token, so launch is rejected. This bounds the token to a sane size for storage and transmission.

Source

Thrown at crates/astrid-storage-provider-fskit/src/service.rs:144

    }
    validate_launch_parent(&launch.parent)?;
    validate_lease(&launch.lease)?;
    crate::validate_mountpoint_layout(&launch.mountpoint)?;
    if launch.mountpoint == launch.lease.resource_path
        || launch.mountpoint.starts_with(&launch.lease.resource_path)
        || launch.lease.resource_path.starts_with(&launch.mountpoint)
    {
        bail!("FSKit service mountpoint overlaps the lease resource");
    }
    crate::validate_mountpoint_ancestors(&launch.mountpoint)?;
    crate::validate_unmounted_mountpoint(&launch.mountpoint)?;
    validate_control_path(&launch.control_path, &launch.lease.resource_path)?;
    Ok(())
}

fn validate_lease(lease: &astrid_core::storage_filesystem::StorageMountLeaseV1) -> Result<()> {
    if lease.lease_token.len() < 16 || lease.lease_token.len() > 4096 {
        bail!("FSKit lease callback token is invalid");
    }
    let now = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .context("read system clock")?
        .as_secs();
    if lease.expires_at_epoch_secs < now {
        bail!("FSKit lease is expired");
    }
    if !lease.resource_path.is_absolute() || !lease.callback_path.is_absolute() {
        bail!("FSKit lease paths must be absolute");
    }
    #[cfg(target_os = "macos")]
    astrid_core::fskit_socket::validate_callback_path(lease.mount_id, &lease.callback_path)
        .map_err(anyhow::Error::msg)?;
    #[cfg(not(target_os = "macos"))]
    if lease.callback_path != lease.resource_path.join("control.sock") {
        bail!("FSKit callback path is not the kernel lease endpoint");
    }

View on GitHub (pinned to affd8760f4)

Solutions

Obtain the lease token from the real kernel/provider issuance path instead of hand-crafting it
Ensure the token string is 16-4096 characters and re-issue the lease if it was truncated
Re-read lease.json from the resource_path to get the admitted token and use that verbatim

Example fix

// before
"lease_token": "abc"
// after
"lease_token": "<kernel-issued token, 16..=4096 chars>"

Defensive patterns

Strategy: validation

Validate before calling

fn token_ok(lease: &StorageMountLeaseV1) -> bool {
    (16..=4096).contains(&lease.lease_token.len())
}

Try / catch

match validate_lease(&lease) {
    Err(e) if e.to_string().contains("callback token is invalid") => reissue_lease(),
    Err(e) => return Err(e),
    Ok(()) => {}
}

Prevention

Always obtain tokens from the kernel issuance path, never hand-write them
Check token length before persisting or transmitting leases
Watch for truncation when serializing leases through logs or env vars

When it happens

Trigger: validate_lease (via validate_launch or live_managed_callback_lease_is_accepted) receives a lease whose lease_token is shorter than 16 chars or longer than 4096 chars, e.g. an empty, placeholder, or oversized token.

Common situations: Hand-constructed lease JSON in tests with a dummy short token; config where the token field was left empty; a truncated or corrupted lease file; older clients emitting tokens in a different format.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/4c942c7afddf31be. Report an issue: GitHub.