astrid-runtime/astrid · error

WASM capsule has no BLAKE3 hash in meta.json

Error message

WASM capsule has no BLAKE3 hash in meta.json

What it means

verified_installed_wasm_hash needs the expected BLAKE3 hash recorded in the capsule's meta.json to look up or compare the installed WASM. If meta.json is missing, unreadable, or lacks wasm_hash for a capsule that declares a WASM component, verification cannot proceed and bails. This catches incomplete or corrupted install metadata.

Source

Thrown at crates/astrid-capsule-install/src/authority.rs:618

    }
    Ok(())
}

/// Read and hash the exact executable the WASM engine would load.
///
/// `meta.json` is treated as a pointer, never as proof: the pointed-to bytes
/// are re-hashed before an authority receipt is compared or migrated.
fn verified_installed_wasm_hash(
    home: &AstridHome,
    target_dir: &Path,
    manifest: &CapsuleManifest,
    store: Option<&RuntimePrincipalStore>,
) -> anyhow::Result<Option<String>> {
    let Some(component) = manifest.components.first() else {
        return Ok(None);
    };
    let Some(expected) = crate::read_meta(target_dir).and_then(|meta| meta.wasm_hash) else {
        bail!("WASM capsule has no BLAKE3 hash in meta.json");
    };
    if let Some(store) = store {
        return Ok(Some(
            crate::wasm::catalog_wasm_hash(store, &expected)
                .context("read installed WASM from system catalog")?,
        ));
    }
    let executable = if component.path.is_absolute() {
        component.path.clone()
    } else {
        let local = target_dir.join(&component.path);
        if local.exists() {
            local
        } else {
            home.bin_dir().join(format!("{expected}.wasm"))
        }
    };
    let mut bytes = Vec::new();

View on GitHub (pinned to affd8760f4)

Solutions

1. Reinstall the capsule so meta.json is regenerated with the wasm_hash field
2. Restore meta.json from the original artifact or package it shipped with
3. Confirm the capsule actually contains a WASM component and the artifact is complete

Example fix

// before
// meta.json missing wasm_hash
verify_installed_authority(&home, &target_dir, &manifest, None)?;
// after
reinstall_capsule(&home, &target_dir)?; // regenerates meta.json with wasm_hash

let meta = read_meta(&target_dir)?;
if manifest_has_wasm_component(&manifest) && meta.and_then(|m| m.wasm_hash).is_none() {
    return Err(anyhow!("meta.json missing wasm_hash; reinstall the capsule"));
}

When it happens

Trigger: verify_installed_authority_inner -> verified_installed_wasm_hash on a manifest with a first component, where read_meta(target_dir) fails or returns meta with wasm_hash == None.

Common situations: Install interrupted before meta.json was written; hand-edited or deleted meta.json; capsule copied without its meta.json; a non-WASM capsule mis-declared as having a WASM component (or vice versa).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• installed WASM integrity check failed: expected BLAKE3 {expe
• durable capsule {} has malformed contracts pin
• durable capsule {id} imports differ between metadata and arc
• installed WASM integrity check failed: expected BLAKE3 {expe
• cannot remove capsule authority while an install transaction

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/f032e277e142d65c. Report an issue: GitHub.