When an approved cover is replaced, treat the replacement as a new release candidate even if its filename is still cover.png. The safe handoff is not “the cover looks new.” It is a chain of two signatures: the source image checksum and the checksum of the exported EPUB whose manifest identifies that image as cover-image. If either signature belongs to an earlier candidate, stop before upload.
This Kindle Direct Publishing cover EPUB workflow is an audit for a replacement asset, not a general lesson on choosing or initially assigning a cover. It answers a narrower production question: after artwork changes late in the schedule, how can an editor prove that the package sent onward contains the newly approved bytes rather than an older file with the same name?
The measured specimen supplies one baseline chain. Its synthetic source cover.png has SHA-256 431ced6916a2a21a156e38701afe55bbd7f88969fbbfc56d7fe099d47f265460. Rune Studio recorded that path for volume 0, exported a four-chapter EPUB, and produced package SHA-256 ed24e3fb8bb1b111608622bb33df95b058b93e42af0e7aacba00178b5704ccaa. Inside that exact package, the manifest row is id=image_cover, href=Images/cover.png, and properties=cover-image, with the same source checksum. Those four values form the baseline signature.
Open a replacement ticket before touching the workspace
A replacement begins with a ticket, not a file copy. Record the candidate’s approval authority, absolute source path, byte size, SHA-256, intended volume, and the previous signed package it supersedes. The filename is descriptive metadata; it is not identity. A designer can export new pixels over cover.png while Finder and the workspace still show the familiar name.
Keep the previous source and previous EPUB read-only until the replacement package passes. If the new candidate is rejected, rollback then means selecting the earlier signed pair, not reconstructing it from memory. The replacement ticket should also say why the change exists—such as corrected title lettering or revised artwork—without claiming that the local packaging test approved visual quality.
The persisted specimen is deliberately tiny: the cover file is 68 bytes. That size is useful for a structural test but not for retail production. Its checksum proves which bytes entered the measured chain; it does not prove resolution, legibility, color, copyright clearance, or suitability for Amazon. A real replacement needs a separate visual and rights approval before this packaging audit begins.
The first failure condition is simple. If the candidate path resolves but its checksum does not equal the ticket, do not run the assignment command. Return to the asset handoff and find the approved export. Renaming the mismatched file to the expected name would hide the problem rather than fix it.
Capture the assignment transition as an input receipt
For the baseline, the exact recorded command was rune epub cover set --workspace /private/tmp/rune-g2c3-studio-289-njjyylqg --number 0 --path /private/tmp/rune-g2c3-studio-289-njjyylqg/cover.png --json. It exited with code 0 and returned coverImagePath=cover.png. The associated volume record used number 0, version 3.1, and publication date 2026-10-09.
That response is an input receipt only. It establishes which relative path the workspace stored for that volume at that moment. It does not establish that a later export used those bytes. A replacement ticket therefore records the command, exit code, returned relative path, intended volume, and the source checksum calculated immediately before assignment.
Three mismatches stop the lane here. A different volume number sends the editor back to volume selection. A returned path other than cover.png sends the editor back to the candidate path. A source checksum that changes between approval and assignment sends the editor back to the asset owner. None of these failures should be repaired by inserting the image into chapter content, because an inline image does not create the manifest’s cover role.
The /private/tmp workspace above identifies the historical controlled run. Reproducible evidence is preserved under eighth100_evidence_artifacts/group2_cycle3/STUDIO-289/, including the command log, workspace data, source files, and generated EPUB with recorded checksums. A production ticket should likewise point to retained artifacts rather than depending on a temporary path that may no longer exist.
Match the source signature to the package signature
After assignment, export to a new filename and hash the result before opening any older package. The measured baseline is studio-289-260903.120000.epub, 9,283 bytes, SHA-256 ed24e3fb8bb1b111608622bb33df95b058b93e42af0e7aacba00178b5704ccaa. Local inspection reported valid=true, and the archive contained 26 entries.
The decisive observation is the manifest tuple, not the total image count. In the baseline package, image_cover points to Images/cover.png, carries properties=cover-image, has 68 bytes, and has SHA-256 431ced6916a2a21a156e38701afe55bbd7f88969fbbfc56d7fe099d47f265460. The package signature is accepted only when that embedded-image checksum equals the source checksum on the replacement ticket.
This specimen provides a useful trap: its three synthetic body-image sources use the same tiny PNG bytes as the cover. Across four chapters they create twelve ordinary image references. Thus, checksum equality by itself cannot determine role in this test. The manifest property distinguishes the one cover entry from the ordinary entries. For a replacement audit, record both identity and role; either one alone can produce a false positive.
If the source checksum changes but the EPUB checksum remains the previously signed value, assume an older artifact may have been inspected and stop. If the EPUB checksum changes but the manifest’s cover checksum remains old, return to assignment and export. If the embedded checksum is new but the cover-image property is absent, the new bytes entered the archive without the required cover role. Each failure has a different return point, which is why “the image is somewhere in the EPUB” is not an acceptance rule.
Compare the replacement against the last signed pair
Use two rows: previous release candidate and replacement candidate. For each row, store source path, source SHA-256, assignment receipt, EPUB filename, EPUB SHA-256, manifest ID, manifest href, manifest properties, and embedded-image SHA-256. Mark the newer row accepted only when it is internally consistent and explicitly supersedes the older row.
Do not require the EPUB checksum to change for a reason unrelated to the cover. The point is causality: when the approved source bytes change and the package is deterministically rebuilt, the retained package must be the one whose embedded cover checksum matches the new source. Metadata or chapter edits performed in the same run make that causal check harder, so freeze manuscript content during a cover-only replacement audit.
The controlled baseline selected four chapter files and returned fileCount=4 and chapterCount=4. Its reading order contained cover, title, navigation, four content documents, and colophon; navigation and NCX each had four matching chapter labels. These facts confirm which baseline package was inspected. They are not instructions to redesign chapter order during a cover replacement. If those manuscript facts unexpectedly change, stop and investigate the broader build rather than approving the cover lane in isolation.
A common near miss is to overwrite the old EPUB using the same output name. Even if the new file is correct, the handoff loses a clean rollback artifact and invites someone to hash the wrong cached copy. Give each candidate a distinct package name or immutable storage key, calculate the digest after the file is closed, and attach that digest to the ticket before it moves to the next system.
Hand off a signed bundle, then begin retailer checks
The local handoff bundle contains the approved source image, its checksum, the assignment receipt for the intended volume, the exported EPUB, its checksum, and the manifest observation tying cover-image to the embedded checksum. It also names the superseded bundle. Another editor should be able to verify the chain without reopening the original setup screen or trusting a filename such as “final-final.”
This audit ends before retailer judgment. Local valid=true does not establish KDP acceptance, storefront appearance, device rendering, image sharpness, or rights clearance. After the signed bundle is uploaded, use KDP’s current preview and submission feedback as a new evidence lane. A retailer-side failure does not erase the local signature; it creates a new candidate with a documented reason for change.
Rune Studio can record the cover path, export the selected volume, and support inspection of the resulting package within the measured Mac workflow. It cannot decide whether artwork was approved or guarantee how Amazon will process it. Check the current Rune Studio feature scope, preserve both source and package signatures, and release only the candidate whose embedded cover-image checksum matches the replacement ticket.
