How we hardened ZeroLabs visual runtime provenance gates
We hardened ZeroContentPipeline so fresh visual runs stop ingesting template placeholders, register runtime provenance explicitly, and block invalid creative-runtime states before publish.
Last updated: 2026-04-02 · Tested against ZeroContentPipeline v0.2.0
What changed in the workflow owner?
This pass stayed inside
text1 lines
ZeroContentPipeline
. ZeroCreative still handles rendering and generation, while the pipeline now records more of the handoff before anything is uploaded to ZeroLabs.
The main change was treating runtime-backed assets as first-class records instead of generic files. When a creative result is registered now, the manifest can keep fields such as
Why do raw and normalized image assets need separate treatment?
The current Google Gemini image-generation documentation describes image generation controls such as aspect ratio and image size, but it does not describe a native WebP output switch for the preview model used here (Google Gemini image generation docs). In this workflow, ZeroCreative returns provider output and the pipeline registers the normalized publish asset separately.
The conceptual illustration asset registered with
text1 lines
normalized: true
, while the raw support artifact remained attached under
text1 lines
runtime_artifacts
with a TTL-backed
text1 lines
expires_at
value.
For terminal capture, the workflow expects
text1 lines
capture_runtime: asciinema
when a terminal proof asset is present. That lines up with the asciinema CLI model for recording terminal sessions into
The publish-path check for this post used three article visuals: a rendered diagram, a deterministic snippet export, and a conceptual illustration. The conceptual illustration came back from the live runtime as
text1 lines
job-35d77a6f05a1
, and the registered asset kept
text1 lines
job_id
,
text1 lines
correlation_id
,
text1 lines
engine
,
text1 lines
provider_model_id
,
text1 lines
normalized: true
, and the raw runtime artifact with
text1 lines
expires_at
.
That is the practical point of this hardening phase. The review and publish steps can now look at a real asset record and decide whether it is a truthful publish candidate or only a support artifact.
Final takeaway
The important change is not a new renderer. It is a stricter contract between the workflow owner and the runtime.
When the pipeline can distinguish placeholders, conceptual images, snippet exports, proof captures, raw provider artifacts, and normalized publish assets, the publish gate can make a more informed decision about what reaches the final post.
Want the broader context behind these hardening passes? Read more in Maintenance Mode or browse the library in Resources.
Generated diagram asset for How we hardened ZeroLabs visual runtime provenance gates
Deterministic snippet export for How we hardened ZeroLabs visual runtime provenance gates
Nano Banana illustration for How we hardened ZeroLabs visual runtime provenance gates
Builds production multi-agent AI systems and automation infrastructure. Previously founded and operated Australia's first communal motorcycle workshop, scaling it to 1,000+ members and $1M+ annual turnover with zero employees. Now applies that operator mindset to AI.