astrid-runtime/astrid · error

installed capsule identity/version differs from its authorit

Error message

installed capsule identity/version differs from its authority receipt (approved {} {}, found {} {})

What it means

Verification compares the capsule_id and version recorded in the installed authority receipt against the capsule manifest actually found on disk. If either differs, the installed files no longer correspond to what was approved at install time, so the mismatch is rejected. This guards against swapping capsule contents without re-approval.

Source

Thrown at crates/astrid-capsule-install/src/authority.rs:559

            signature: None,
            approved_capabilities: manifest.capabilities.clone(),
            wasm_hash_pinned: true,
            approved_wasm_hash: executable_hash,
        };
        AuthorityReceiptTransaction::stage(home, target_dir, &migrated)?.commit()?;
        return Ok(());
    };
    let mut authority = authority;
    if authority.schema_version != 1 {
        bail!(
            "unsupported installed authority schema {}",
            authority.schema_version
        );
    }
    if authority.capsule_id != manifest.package.name
        || authority.version != manifest.package.version
    {
        bail!(
            "installed capsule identity/version differs from its authority receipt (approved {} {}, found {} {})",
            authority.capsule_id,
            authority.version,
            manifest.package.name,
            manifest.package.version
        );
    }
    let expansions = manifest
        .capabilities
        .expansions_from(&authority.approved_capabilities);
    if !expansions.is_empty() {
        let details = expansions
            .into_iter()
            .map(|expansion| format!("{}=[{}]", expansion.name, expansion.added.join(", ")))
            .collect::<Vec<_>>()
            .join("; ");
        bail!(
            "manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion"

View on GitHub (pinned to affd8760f4)

Solutions

1. Reinstall the capsule via the authorized install path so a fresh receipt matching the current manifest is written
2. Restore the original capsule version that the receipt approves
3. If intentional, remove the old authority receipt and approve the new identity/version explicitly

Example fix

// before
// capsule dir overwritten with v2 files, receipt still says v1
verify_installed_authority(&home, &target_dir, &manifest, None)?;
// after
unpack_and_install_authorized_for_principal_in_workspace(/* reinstalls v2 with new receipt */)?;

let m = read_installed_manifest(&target_dir)?;
let a = read_authority_receipt(&home, &target_dir)?;
if a.capsule_id != m.package.name || a.version != m.package.version {
    return Err(anyhow!("receipt approves {} {}, disk has {} {} — reinstall", a.capsule_id, a.version, m.package.name, m.package.version));
}

When it happens

Trigger: verify_installed_authority encounters authority.capsule_id != manifest.package.name or authority.version != manifest.package.version — e.g. the capsule directory was overwritten with a different capsule/version after approval.

Common situations: Manually replacing a capsule's files or Capsule.toml after install; installing a new version over the old directory without re-running the authorized install flow; copy/paste of capsule directories across projects.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• durable capsule {id} version differs across package records
• signed Distro.lock entry '{}' does not match Distro.toml
• installed Capsule.toml differs from the exact manifest appro
• durable capsule {id} identity differs across archive and aut
• durable capsule {id} manifest digest differs from authority

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/272d0979b3b300bb. Report an issue: GitHub.