{"record":{"id":"12021b04c5ff8c05","repo":"nexu-io/open-design","slug":"job-job-id-decoded-output-does-not-match-its-rec","errorCode":null,"errorMessage":"job {job_id} decoded output does not match its recorded source image; do not rewrite decoded visual outputs locally","messagePattern":"job (.+?) decoded output does not match its recorded source image; do not rewrite decoded visual outputs locally","errorType":"exception","errorClass":"SystemExit","httpStatus":null,"severity":"error","filePath":"skills/hatch-pet/scripts/finalize_pet_run.py","lineNumber":75,"sourceCode":"\n\ndef validate_hash(job: dict[str, object], *, source: Path, output: Path, job_id: str) -> None:\n    expected_hash = job.get(\"source_sha256\")\n    if not isinstance(expected_hash, str) or not expected_hash:\n        raise SystemExit(\n            f\"job {job_id} is missing source_sha256; ingest visual outputs with \"\n            \"record_imagegen_result.py instead of editing imagegen-jobs.json\"\n        )\n    if not source.is_file():\n        raise SystemExit(f\"job {job_id} source image no longer exists: {source}\")\n    if not output.is_file():\n        raise SystemExit(f\"job {job_id} decoded output is missing: {output}\")\n    source_hash = file_sha256(source)\n    output_hash = file_sha256(output)\n    if source_hash != expected_hash:\n        raise SystemExit(f\"job {job_id} source image hash does not match imagegen-jobs.json\")\n    if output_hash != expected_hash:\n        raise SystemExit(\n            f\"job {job_id} decoded output does not match its recorded source image; \"\n            \"do not rewrite decoded visual outputs locally\"\n        )\n\n\ndef validate_mirror_hash(job: dict[str, object], *, source: Path, output: Path, job_id: str) -> None:\n    if job_id != \"running-left\":\n        raise SystemExit(f\"job {job_id} may not use deterministic mirror provenance\")\n    if job.get(\"derived_from\") != \"running-right\":\n        raise SystemExit(\"running-left mirror job must derive from running-right\")\n    decision = job.get(\"mirror_decision\")\n    if not isinstance(decision, dict) or decision.get(\"approved\") is not True:\n        raise SystemExit(\n            \"running-left mirror job is missing an approved mirror_decision; \"\n            \"use derive_running_left_from_running_right.py after visual review\"\n        )\n\n    expected_source_hash = job.get(\"source_sha256\")","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/nexu-io/open-design/blob/5be4028344c2eb4c667c5a97bda8f750c5597ef7/skills/hatch-pet/scripts/finalize_pet_run.py#L57-L93","documentation":"The decoded output's sha256 differs from the source's recorded hash. Decoded outputs must be byte-identical to their source image, so this fires when someone re-decoded, re-exported, or edited decoded/<state>.png locally instead of using the canonical decode path.","triggerScenarios":"Manually editing decoded/<state>.png in an image editor; re-exporting through a tool that re-encodes or re-compresses; a decode step that is not byte-preserving.","commonSituations":"Opening the decoded PNG to tweak it and saving; running a non-canonical decoder that rewrites PNGs lossily; a sync tool that re-encodes images.","solutions":["Regenerate the decoded output via the canonical decode/ingest (record_imagegen_result.py) from the original source.","Never edit decoded visual outputs by hand — they must equal the source bytes.","Re-run finalize_pet_run.py."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"import hashlib, json\nfrom pathlib import Path\n\ndef sha256(p: Path) -> str:\n    h = hashlib.sha256()\n    with p.open(\"rb\") as f:\n        for chunk in iter(lambda: f.read(1 << 20), b\"\"):\n            h.update(chunk)\n    return h.hexdigest()\n\nrun_dir = Path(\"<run_dir>\")\nmanifest = json.loads((run_dir / \"imagegen-jobs.json\").read_text())\nfor job in manifest[\"jobs\"]:\n    if job.get(\"status\") != \"complete\":\n        continue\n    out = run_dir / job[\"output_path\"] if not Path(job[\"output_path\"]).is_absolute() else Path(job[\"output_path\"])\n    assert sha256(out) == job[\"source_sha256\"], f\"decoded output drift for {job.get('id')}; regenerate via record_imagegen_result.py\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat decoded outputs as read-only; never open and re-save them.","Only the canonical decode path (record_imagegen_result.py) may write decoded/*.png.","If a sync/backup tool re-encodes images, exclude decoded/ from it."],"tags":["hatch-pet","integrity","decoded","hash"],"backgroundTag":null,"analyzedSha":"5be4028344c2eb4c667c5a97bda8f750c5597ef7","analyzedAt":"2026-08-12T12:03:58.812Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}