astrid-runtime/astrid · error

manifest exceeds its installed capability approval: {details

Error message

manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion

What it means

The installed manifest requests capabilities beyond those approved in the authority receipt (expansions detected). The library refuses to run a capsule whose permission surface grew since install and tells the user to reinstall and explicitly approve the expansion.

Source

Thrown at crates/astrid-capsule-install/src/authority.rs:576

    {
        bail!(
            "installed capsule identity/version differs from its authority receipt (approved {} {}, found {} {})",
            authority.capsule_id,
            authority.version,
            manifest.package.name,
            manifest.package.version
        );
    }
    let expansions = manifest
        .capabilities
        .expansions_from(&authority.approved_capabilities);
    if !expansions.is_empty() {
        let details = expansions
            .into_iter()
            .map(|expansion| format!("{}=[{}]", expansion.name, expansion.added.join(", ")))
            .collect::<Vec<_>>()
            .join("; ");
        bail!(
            "manifest exceeds its installed capability approval: {details}; reinstall and approve the expansion"
        );
    }
    if authority.manifest_digest != current_manifest_digest {
        bail!(
            "installed Capsule.toml differs from the exact manifest approved at install; reinstall the capsule"
        );
    }
    if !authority.wasm_hash_pinned {
        authority.wasm_hash_pinned = true;
        authority.approved_wasm_hash = executable_hash;
        AuthorityReceiptTransaction::stage(home, target_dir, &authority)?
            .commit()
            .context("failed to migrate installed authority executable pin")?;
    } else if authority.approved_wasm_hash != executable_hash {
        bail!(
            "installed WASM executable differs from its authority receipt (approved {}, found {})",
            authority

View on GitHub (pinned to affd8760f4)

Solutions

1. Reinstall the capsule through the authorized install flow so the new capabilities are presented for explicit approval
2. Revert Capsule.toml to the capability set recorded in the receipt
3. If the expansion is expected, remove the stale receipt and re-approve the expanded manifest

Example fix

// before
// added "api.example.com" to allowed domains after install
verify_installed_authority(&home, &target_dir, &manifest, None)?;
// after
reinstall_with_approval(&home, &target_dir)?; // approve domain expansion interactively

let expansions = diff_capabilities(&approved_receipt.capabilities, &manifest.capabilities)?;
if !expansions.is_empty() {
    return Err(anyhow!("manifest adds capabilities {:?} not in approval; reinstall to approve", expansions.iter().map(|e| &e.name).collect::<Vec<_>>()));
}

When it happens

Trigger: verify_installed_authority finds non-empty capability expansions — the installed Capsule.toml grants permissions (e.g. new domains, paths) absent from the receipt's approved capability set.

Common situations: Editing Capsule.toml post-install to add network or filesystem capabilities; pulling updated capsule sources into the same install directory; a capsule update that changed permissions without re-approval.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• capsule '{}' is {}; explicit local approval is required
• cannot remove capsule authority while an install transaction
• an incomplete capsule authority update exists at {}; remove
• unsupported installed authority schema {}
• installed capsule identity/version differs from its authorit

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/3cd76f60e7d47594. Report an issue: GitHub.