{"record":{"id":"02dfb2522522d721","repo":"Hmbown/CodeWhale","slug":"fleet-artifact-checksum-does-not-match-the-recorded-receipt","errorCode":null,"errorMessage":"Fleet artifact checksum does not match the recorded receipt","messagePattern":"Fleet artifact checksum does not match the recorded receipt","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/tui/src/fleet/artifacts.rs","lineNumber":88,"sourceCode":"    // The digest and returned preview consume exactly the same bytes from the\n    // same opened file. A changed/replaced pathname is never reopened for data.\n    let mut reader = (&file).take(size + 1);\n    loop {\n        let count = reader.read(&mut buffer)?;\n        if count == 0 {\n            break;\n        }\n        total += count as u64;\n        ensure!(total <= size, \"Fleet artifact grew while being read\");\n        hasher.update(&buffer[..count]);\n        let remaining = preview_limit.saturating_sub(preview.len() as u64) as usize;\n        preview.extend_from_slice(&buffer[..count.min(remaining)]);\n    }\n    ensure!(\n        total == size && file.metadata()?.len() == size,\n        \"Fleet artifact size changed while being read\"\n    );\n    ensure!(\n        format!(\"sha256:{}\", crate::hashing::hex_bytes(hasher.finalize())) == checksum,\n        \"Fleet artifact checksum does not match the recorded receipt\"\n    );\n    Ok((preview, size))\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use codewhale_protocol::fleet::FleetArtifactKind;\n\n    fn reference(path: &str, bytes: &[u8]) -> FleetArtifactRef {\n        FleetArtifactRef {\n            kind: FleetArtifactKind::Receipt,\n            path: path.into(),\n            checksum: Some(format!(\"sha256:{}\", crate::hashing::sha256_hex(bytes))),\n            mime_type: None,\n            size_bytes: Some(bytes.len() as u64),","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/fleet/artifacts.rs#L70-L106","documentation":"read_verified hashes the streamed bytes and requires the result to equal the sha256 checksum recorded in the FleetArtifactRef receipt ('sha256:<hex>'). A mismatch means the file content differs from what was published, so the artifact is not valid evidence and verification fails closed.","triggerScenarios":"The bytes streamed from the artifact hash to a digest different from artifact.checksum — content was modified, corrupted, or the receipt belongs to a different file/version despite matching size.","commonSituations":"Bit rot or filesystem corruption; manual editing of a published artifact; a receipt copied from another run/path; a writer that bypassed artifacts::write and wrote different content at the same size.","solutions":["Treat the artifact as compromised: do not use it as evidence; re-publish the correct content via artifacts::write to get a fresh receipt.","Restore the original file from a backup or the producing run's output.","Verify the FleetArtifactRef actually belongs to this path/run — a copied or stale receipt will not match different content.","Check storage health (disk, sync layer) if corruption recurs across artifacts."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// trust nothing: verify receipt checksum before using artifact evidence\nlet (preview, size) = read_verified(ws, &artifact, preview_limit)?; // fails closed on mismatch\nassert_eq!(artifact.size_bytes, Some(size));","typeGuard":null,"tryCatchPattern":"match read_verified(ws, &artifact, preview_limit) {\n    Err(e) if e.to_string().contains(\"checksum does not match\") => {\n        eprintln!(\"artifact {} is not valid evidence; re-publish from source\", artifact.path.display());\n    }\n    other => other?,\n}","preventionTips":["Always verify via read_verified before consuming artifact content as evidence.","Never edit published artifacts; republish under a new receipt instead.","Keep receipts and artifacts from the same run together; don't reuse refs across runs.","Investigate storage health if checksum failures recur."],"tags":["fleet","artifacts","integrity","sha256","verification"],"backgroundTag":"checksum-mismatch","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T06:17:15.046Z"}