Back to Maintenance Mode

How we hardened ZeroLabs visual runtime provenance gates

We hardened ZeroContentPipeline so fresh visual runs stop ingesting template placeholders, register runtime provenance explicitly, and block invalid creative-runtime states before publish.

Last updated: 2026-04-02 · Tested against ZeroContentPipeline v0.2.0

What changed in the workflow owner?

This pass stayed inside

text1 lines
ZeroContentPipeline
. ZeroCreative still handles rendering and generation, while the pipeline now records more of the handoff before anything is uploaded to ZeroLabs.

The main change was treating runtime-backed assets as first-class records instead of generic files. When a creative result is registered now, the manifest can keep fields such as

text1 lines
job_kind
,
text1 lines
job_id
,
text1 lines
correlation_id
,
text1 lines
publish_candidate
,
text1 lines
engine
,
text1 lines
provider_model_id
,
text1 lines
normalized
, and
text1 lines
expires_at
.

We also added visual-policy gates for deprecated

text1 lines
code_image_render
, conceptual-only proof states, raw-only image-generation output, missing creative provenance, and invalid terminal recording provenance.

Filesrc/zerocontent_pipeline/creative_runtime.pypython9 lines
# File: src/zerocontent_pipeline/creative_runtime.py
runtime_fields = {
    "source_kind": "creative_runtime",
    "job_kind": job_kind,
    "job_id": str(job_payload.get("job_id") or "").strip(),
    "correlation_id": str(job_payload.get("correlation_id") or "").strip(),
    "runtime_artifacts": runtime_artifacts,
    "publish_candidate": bool(primary_descriptor.get("publish_candidate", True)),
}

Why do raw and normalized image assets need separate treatment?

The current Google Gemini image-generation documentation describes image generation controls such as aspect ratio and image size, but it does not describe a native WebP output switch for the preview model used here (Google Gemini image generation docs). In this workflow, ZeroCreative returns provider output and the pipeline registers the normalized publish asset separately.

The conceptual illustration asset registered with

text1 lines
normalized: true
, while the raw support artifact remained attached under
text1 lines
runtime_artifacts
with a TTL-backed
text1 lines
expires_at
value.

For terminal capture, the workflow expects

text1 lines
capture_runtime: asciinema
when a terminal proof asset is present. That lines up with the asciinema CLI model for recording terminal sessions into
text1 lines
.cast
files (asciinema CLI manual).

What did the live verification run demonstrate?

The publish-path check for this post used three article visuals: a rendered diagram, a deterministic snippet export, and a conceptual illustration. The conceptual illustration came back from the live runtime as

text1 lines
job-35d77a6f05a1
, and the registered asset kept
text1 lines
job_id
,
text1 lines
correlation_id
,
text1 lines
engine
,
text1 lines
provider_model_id
,
text1 lines
normalized: true
, and the raw runtime artifact with
text1 lines
expires_at
.

That is the practical point of this hardening phase. The review and publish steps can now look at a real asset record and decide whether it is a truthful publish candidate or only a support artifact.

Final takeaway

The important change is not a new renderer. It is a stricter contract between the workflow owner and the runtime.

When the pipeline can distinguish placeholders, conceptual images, snippet exports, proof captures, raw provider artifacts, and normalized publish assets, the publish gate can make a more informed decision about what reaches the final post.

Want the broader context behind these hardening passes? Read more in Maintenance Mode or browse the library in Resources.

Architecture diagram for How we hardened ZeroLabs visual runtime provenance gates
Generated diagram asset for How we hardened ZeroLabs visual runtime provenance gates

Code snippet for How we hardened ZeroLabs visual runtime provenance gates
Deterministic snippet export for How we hardened ZeroLabs visual runtime provenance gates

Conceptual illustration for How we hardened ZeroLabs visual runtime provenance gates
Nano Banana illustration for How we hardened ZeroLabs visual runtime provenance gates

Share