ACPX provider runtime executable identity changed after veri

Error message

ACPX provider runtime executable identity changed after verification

What it means

openCommand re-opens the qualified runtime executable at launch and compares its freshly computed identity (device/inode plus digest metadata) with the identity captured during verifyQualifiedAcpxInstallation. If they differ, the runtime binary was replaced, re-linked, or re-created between verification and launch, so the lease is refused to prevent executing an unverified binary.

Source

Thrown at packages/paperclip-runner/src/drivers/acpx/installation-integrity.ts:724

        await currentDirectory.handle.close();
        throw new Error(
          "ACPX provider executable directory identity changed after verification",
        );
      }
      let currentDependencyAncestors: FileHandle[] = [];
      let currentRuntimeExecutable: FileHandle | null = null;
      try {
        currentDependencyAncestors =
          await openDependencyAncestors(dependencyAncestors);
        if (runtimeExecutable !== null) {
          const current = await openVerifiedRuntimeExecutable(
            runtimeExecutable.path,
            runtimeExecutable.digest,
            profile.agent,
          );
          if (!sameIdentity(current.identity, runtimeExecutable.identity)) {
            await current.handle.close();
            throw new Error(
              "ACPX provider runtime executable identity changed after verification",
            );
          }
          currentRuntimeExecutable = current.handle;
        }
        const current = await inspectCommand(
          commandPath,
          commandDigest,
          "provider",
        );
        if (!sameIdentity(current.identity, commandIdentity)) {
          current.bytes.fill(0);
          throw new Error(
            "ACPX provider executable identity changed after verification",
          );
        }
        const privateSnapshot = process.platform === "darwin"
          ? await createAcpxPrivateSnapshot([commandDirectory, ...dependencyAncestors.map((root) => root.path)], currentRuntimeExecutable)

View on GitHub (pinned to 01ad858492)

Solutions

Re-run the verification (installation) step to produce a fresh lease against the new binary, then openCommand again — do not reuse a stale lease.
Ensure no package manager/updater runs concurrently with agent launch; serialize installs and launches.
Check for processes rewriting files under the runtime package directory (updaters, AV, sync tools like Dropbox) and exclude the install path.
If this recurs, pin the install directory and reinstall the exact qualified runtime version so identities are stable.

Example fix

// before
const lease = await verified.openCommand(); // binary replaced by concurrent npm install
// after
await installPromise;            // wait for installs to finish
const lease = await reverified.openCommand(); // re-verify against current binary

Defensive patterns

Strategy: retry

Validate before calling

const before = fs.statSync(runtimeExecutable.path, { bigint: true });
// ... ensure no installers running ...
const after = fs.statSync(runtimeExecutable.path, { bigint: true });
if (before.ino !== after.ino) throw new Error("runtime binary changed before open; re-verify first");

Try / catch

try {
  lease = await verified.openCommand();
} catch (e) {
  if (e.message === "ACPX provider runtime executable identity changed after verification") {
    verified = await verifyQualifiedAcpxInstallation(input); // fresh verification
    lease = await verified.openCommand(); // single retry
  } else throw e;
}

Prevention

Serialize package installs and agent launches; never run npm/pnpm while an agent may open a lease.
Exclude the install directory from auto-updaters, antivirus rewrite, and file-sync tools.
Treat leases as single-shot: re-verify whenever the environment may have changed.

When it happens

Trigger: Calling openCommand on a verified ACPX lease after openVerifiedRuntimeExecutable returns a handle whose sameIdentity(current.identity, runtimeExecutable.identity) is false — the file at runtimeExecutable.path changed its inode/identity after verification.

Common situations: Package manager or auto-updater replaced the binary between verify and open (e.g. npm install ran concurrently); the install directory was wiped and recreated; antivirus/quarantine rewrote the file; a container image rebuild raced the launch.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/5b20c19b1c84f3ed. Report an issue: GitHub.