nexu-io/open-design · error · SystemExit

job {job_id} may not use deterministic mirror provenance

Error message

job {job_id} may not use deterministic mirror provenance

What it means

validate_mirror_hash is only valid for the running-left job. Any other job whose source_provenance is deterministic-mirror triggers this: only the left sprite may be a deterministic mirror of running-right; all other states must be real $imagegen outputs.

Source

Thrown at skills/hatch-pet/scripts/finalize_pet_run.py:83

        )
    if not source.is_file():
        raise SystemExit(f"job {job_id} source image no longer exists: {source}")
    if not output.is_file():
        raise SystemExit(f"job {job_id} decoded output is missing: {output}")
    source_hash = file_sha256(source)
    output_hash = file_sha256(output)
    if source_hash != expected_hash:
        raise SystemExit(f"job {job_id} source image hash does not match imagegen-jobs.json")
    if output_hash != expected_hash:
        raise SystemExit(
            f"job {job_id} decoded output does not match its recorded source image; "
            "do not rewrite decoded visual outputs locally"
        )


def validate_mirror_hash(job: dict[str, object], *, source: Path, output: Path, job_id: str) -> None:
    if job_id != "running-left":
        raise SystemExit(f"job {job_id} may not use deterministic mirror provenance")
    if job.get("derived_from") != "running-right":
        raise SystemExit("running-left mirror job must derive from running-right")
    decision = job.get("mirror_decision")
    if not isinstance(decision, dict) or decision.get("approved") is not True:
        raise SystemExit(
            "running-left mirror job is missing an approved mirror_decision; "
            "use derive_running_left_from_running_right.py after visual review"
        )

    expected_source_hash = job.get("source_sha256")
    expected_output_hash = job.get("output_sha256")
    if not isinstance(expected_source_hash, str) or not expected_source_hash:
        raise SystemExit("running-left mirror job is missing source_sha256")
    if not isinstance(expected_output_hash, str) or not expected_output_hash:
        raise SystemExit("running-left mirror job is missing output_sha256")
    if not source.is_file():
        raise SystemExit(f"running-left mirror source image no longer exists: {source}")
    if not output.is_file():

View on GitHub (pinned to 5be4028344)

Solutions

For non-left jobs, set source_provenance to "built-in-imagegen" and ingest the real source via record_imagegen_result.py.
Only the running-left job may carry source_provenance: deterministic-mirror.
Re-run finalize_pet_run.py.

Example fix

// before (idle job)
{ "id": "idle", "source_provenance": "deterministic-mirror" }
// after
{ "id": "idle", "source_provenance": "built-in-imagegen", "source_path": "<generated_images>/ig_xxx.png" }

Defensive patterns

Strategy: type-guard

Validate before calling

import json
from pathlib import Path

manifest = json.loads(Path("<run_dir>/imagegen-jobs.json").read_text())
for job in manifest["jobs"]:
    prov = job.get("source_provenance")
    if prov == "deterministic-mirror":
        assert job.get("id") == "running-left", f"{job.get('id')} may not use deterministic-mirror provenance"

Type guard

def provenance_allowed(job: dict) -> bool:
    if job.get("source_provenance") == "deterministic-mirror":
        return job.get("id") == "running-left"
    return True

Prevention

Only running-left may be a deterministic mirror; every other state needs a real $imagegen source.
Avoid copy-pasting provenance fields between jobs when editing the manifest.
Run record_imagegen_result.py for non-mirror jobs so provenance is set correctly.

When it happens

Trigger: A non-running-left job (e.g. idle, waving, jumping) carries source_provenance: "deterministic-mirror" in the manifest, dispatching it to the mirror validator.

Common situations: Copy-pasting provenance across jobs when hand-editing the manifest; a buggy job-recording script that tags the wrong job.

Related errors

AI-assisted analysis of nexu-io/open-design@5be4028344 (2026-08-12). Data as JSON: /api/errors/e3a6776a41001722. Report an issue: GitHub.