{"record":{"id":"e4d49530befa9cdd","repo":"xai-org/x-algorithm","slug":"backbone-hash-mismatch-file-actual-manifest-ma","errorCode":null,"errorMessage":"backbone hash mismatch: file={actual} manifest={manifest.get('file_sha256')} pinned={PINNED_BACKBONE_SHA256} — refusing to start","messagePattern":"backbone hash mismatch: file=(.+?) manifest=(.+?) pinned=(.+?) — refusing to start","errorType":"validation","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"bdsm/runtime/gpu_scorer.py","lineNumber":59,"sourceCode":"    p.add_argument(\"--kafka-password\", required=True)\n    p.add_argument(\"--input-topic\", default=\"abuse_ready_batches\")\n    p.add_argument(\"--output-topic\", default=\"abuse_scored_results\")\n    p.add_argument(\"--kafka-group\", default=\"bdsm-gpu-scorer\")\n    p.add_argument(\"--backbone-dir\", required=True)\n    p.add_argument(\"--head-checkpoint\", required=True)\n    p.add_argument(\"--model-version\", default=PINNED_RUN_NAME)\n    p.add_argument(\"--health-port\", type=int, default=8081)\n    return p.parse_args()\n\n\ndef _verify_pinned_weights(args) -> tuple[dict, dict, list[str]]:\n    manifest_path = os.path.join(args.backbone_dir, \"MANIFEST.json\")\n    with open(manifest_path) as f:\n        manifest = json.load(f)\n    npz_path = os.path.join(args.backbone_dir, \"backbone.npz\")\n    actual = _file_sha256(npz_path)\n    if actual != PINNED_BACKBONE_SHA256 or manifest.get(\"file_sha256\") != PINNED_BACKBONE_SHA256:\n        raise RuntimeError(\n            f\"backbone hash mismatch: file={actual} manifest={manifest.get('file_sha256')} \"\n            f\"pinned={PINNED_BACKBONE_SHA256} — refusing to start\"\n        )\n\n    with open(os.path.join(args.head_checkpoint, \"config.json\")) as f:\n        head_cfg = json.load(f)\n    if head_cfg.get(\"head_registry_hash\") != PINNED_HEAD_REGISTRY_HASH:\n        raise RuntimeError(\n            f\"head registry hash {head_cfg.get('head_registry_hash')} != \"\n            f\"{PINNED_HEAD_REGISTRY_HASH} — refusing to start\"\n        )\n    if head_cfg.get(\"backbone_sha256\") != PINNED_BACKBONE_SHA256:\n        raise RuntimeError(\n            \"head checkpoint was trained against a different backbone — refusing to start\"\n        )\n    head_names = list(head_cfg[\"head_names\"])\n    unknown = [n for n in head_names if n not in HEAD_ORDER]\n    if unknown:","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/xai-org/x-algorithm/blob/24c60942c5c5fdad3a6addffb4c6e6d2f228f04f/bdsm/runtime/gpu_scorer.py#L41-L77","documentation":"The GPU scorer pins model weights by sha256. _verify_pinned_weights hashes backbone.npz and cross-checks MANIFEST.json's file_sha256 against the compiled-in PINNED_BACKBONE_SHA256; any disagreement aborts startup so the scoring service can never run on tampered or stale weights.","triggerScenarios":"Starting the scorer with a backbone.npz that was re-saved, re-quantized, or truncated; MANIFEST.json regenerated with a different hash; code updated with a new PINNED_BACKBONE_SHA256 but the deployed backbone_dir not refreshed (or vice versa); corrupted download.","commonSituations":"Deployment skew between the pinned-constants build and the artifact bundle; someone hand-edited or re-packed the npz; partial file sync to the GPU host; supply-chain verification catching an unexpected artifact.","solutions":["Compare sha256sum of backbone_dir/backbone.npz against PINNED_BACKBONE_SHA256 in the deployed code","If code was updated, redeploy the matching artifact bundle (or roll back code to the bundle's pin)","If the artifact is legitimately new, update PINNED_BACKBONE_SHA256 and MANIFEST.json together and rebuild","Check for truncated/corrupted file transfer and re-sync the backbone directory"],"exampleFix":"# verify before start:\nsha256sum /models/backbone/backbone.npz  # must equal PINNED_BACKBONE_SHA256\n# if not, redeploy the matching artifact bundle","handlingStrategy":"validation","validationCode":"import hashlib\nh = hashlib.sha256(open(f\"{args.backbone_dir}/backbone.npz\", 'rb').read()).hexdigest()\nassert h == PINNED_BACKBONE_SHA256, f\"backbone drift: {h}\"","typeGuard":null,"tryCatchPattern":"try:\n    _verify_pinned_weights(args)\nexcept RuntimeError as e:\n    if 'hash mismatch' in str(e):\n        redeploy_artifacts(); sys.exit(2)\n    raise","preventionTips":["Deploy backbone artifacts and scorer binary as one atomic bundle","Add a pre-start checksum verification step in the deploy pipeline","Alert on any pinned-weights failure; never bypass it"],"tags":["python","model-integrity","sha256","deployment"],"backgroundTag":"artifact-checksum-mismatch","analyzedSha":"24c60942c5c5fdad3a6addffb4c6e6d2f228f04f","analyzedAt":"2026-08-28T11:40:14.686Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}