What causes "trusted Windows authority boundary does not exist: {}" in astrid-runtime/astrid?

Create the boundary directory (recursively, as real directories) before capturing the guard.

NotFound

NotFound

Error message

trusted Windows authority boundary does not exist: {}

What it means

This NotFound error is raised by `TrustedPathGuard::capture` when the walk over path components never produced a locked component whose path equals the requested path — i.e. the authority boundary directory itself does not exist. Intermediate missing components are skipped (NotFound continues the loop), so only a fully missing final boundary yields this error after the loop, distinguishing it from intermediate not-found cases.

Solutions

Create the boundary directory (recursively, as real directories) before capturing the guard.
Verify the path exists and is a directory: `path.is_dir()` before capture, and fail with your own message if not.
Ensure you pass an absolute local path (drive-letter rooted); relative or UNC-redirected paths are not valid boundaries.
Check for cleanup races: another process or a previous failed run may have removed the directory; recreate it.

Example fix

// before
let base = Path::new(env_var_or_default("MYAPP_BASE")); // may not exist
let guard = TrustedPathGuard::capture(base)?; // NotFound

// after
let base = PathBuf::from(env_var_or_default("MYAPP_BASE"));
std::fs::create_dir_all(&base)?;
assert!(base.is_absolute());
let guard = TrustedPathGuard::capture(&base)?;

Defensive patterns

Strategy: validation

Validate before calling

if !path.is_absolute() {
    return Err("authority boundary must be an absolute local path".into());
}
std::fs::create_dir_all(&path)?; // ensure the boundary exists before capture
let guard = TrustedPathGuard::capture(&path)?;

Type guard

fn boundary_ready(p: &Path) -> bool {
    p.is_absolute() && p.is_dir()
}

Try / catch

match TrustedPathGuard::capture(&path) {
    Err(e) if e.kind() == io::ErrorKind::NotFound
        && e.to_string().contains("authority boundary does not exist") => {
        std::fs::create_dir_all(&path)?;
        let guard = TrustedPathGuard::capture(&path)?;
    }
    other => other?,
}

Prevention

Always `create_dir_all` the boundary directory before capturing a guard.
Assert the path is absolute and drive-rooted; relative paths never root the component walk.
Guard against concurrent cleanup: recreate the directory if a previous run removed it.
Validate env-derived base directories exist at startup, not deep inside transactions.

When it happens

Trigger: Calling `TrustedPathGuard::capture` (as done by `prepare_executable_transaction`, `acquire_named_private_lock`, staging, and verify_contract flows) with a path that does not exist on disk, was deleted between planning and capture, or whose final component is a file rather than a created directory; also a non-rooted/relative path that never sets `rooted`, leaving `components` empty.

Common situations: A staging/temp directory that a previous run cleaned up; a typo'd or env-dependent base directory (`%PROGRAMDATA%` variant not present); running the installer flow before the install directory is created; passing a relative path where an absolute local path is required.

Understand the failure class

Background: "Not Found" / HTTP 404 Errors: What They Mean and How to Fix Them Across Libraries — this error's family across 6 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/9cc09182c738ea52. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-core/src/platform_fs/windows/path.rs:231

            let (handle, identity) = if let Some(parent) = components.last() {
                open_directory_identity_relative(
                    parent.handle.0,
                    component.as_os_str(),
                    current == path,
                )?
            } else if current == path {
                open_locked_directory(&current)?
            } else {
                open_directory_identity(&current, true)?
            };
            components.push(LockedPathComponent {
                path: current.clone(),
                identity,
                handle,
            });
        }
        if components.last().map(|component| component.path.as_path()) != Some(path) {
            return Err(io::Error::new(
                io::ErrorKind::NotFound,
                format!(
                    "trusted Windows authority boundary does not exist: {}",
                    path.display()
                ),
            ));
        }
        // System ancestors such as the volume root and `Users` deliberately
        // grant limited authority to principals outside Astrid's trust set.
        // They remain open as identity handles while the caller-selected owned
        // directory is the rename-locked ACL authority boundary. Critical
        // child mutations resolve relative to that boundary handle, so an
        // ancestor rename cannot redirect the operation into another tree.
        let result = Self {
            components,
            authority_boundary: path.to_path_buf(),
        };
        validate_trusted_parent_acl_handle(

View on GitHub (pinned to affd8760f4)