AssetFurnace GLB Handoff: Keep the Provenance Sidecar

Keep the mesh and its record together

Before handing off an AssetFurnace asset, keep the original GLB with its generation record, compare the recorded output SHA-256 with that exact file, and preserve separate records for later edits. A matching hash confirms a byte match against a supplied value. It does not prove that the recorded history is authentic, the model is game-ready, or commercial use is permitted.[7]

In an October 11, 2026 X post, AssetFurnace author Nikhil Shahane asked for difficult humanoid examples while improving rigging and animation. That is a development discussion, not proof that every character works. When comparing attempts or reporting a failure, knowing which mesh and processing steps you are looking at matters. This guide focuses on that file-identity problem.[1]

Recognize three different kinds of JSON

We inspected the following record builders at repository revision 7793fd3. The changelog at that revision lists v0.4.3 dated October 10, 2026. These observations describe that code, not a test of the application or a guarantee about future versions.[6]

Do not choose a JSON file by extension alone. A run manifest can be an input recipe, a generation record can identify output bytes, and a processing report can describe a later transformation. Read the fields and identify the stage before making a comparison. The lab accepts a file and a record explicitly; it never follows paths embedded in JSON.

Compare bytes before comparing filenames

Copy the raw GLB and its record into an unchanged source folder. Calculate the GLB’s SHA-256 and compare it with output.sha256 where that field exists. Renaming a file without editing its contents leaves this content hash unchanged. Re-exporting or altering it can produce different bytes even when the model looks similar.[9]

• Match: this file agrees with the supplied hash. Continue checking the source and completeness of the record.
• Mismatch: stop pairing these two as the same output. Find the raw file, the correct record, or the documented transformation. Do not overwrite the old hash just to silence the warning.
• Absent hash or unsupported record: retain the record as context, but do not claim that it binds these output bytes.

A sidecar is an ordinary editable file. Someone can change both the asset and its recorded hash. SPDX makes the same distinction: checksum-based protection against intentional changes depends on authenticating the checksum. Our checker does not provide a signature, trusted timestamp or identity verification.[7]

Try the small, offline consistency lab

The accompanying Python lab checks only a narrow set of generation-record shapes and their output hashes. It reads explicitly selected regular files, applies size limits and reports unsupported or invalid inputs. It does not load a model, run AssetFurnace, launch an engine or contact a service. Its README includes commands, fixtures, tests and exact scope limits.

The authored fixtures use synthetic bytes and simplified records, not real generated models. They demonstrate a matching record, a changed file, and a Finish-style report without a recorded output hash. The public report is produced by running the checker on those fixtures. Use it to understand the distinctions before examining a copy of your own files.

A successful byte comparison is not a complete provenance audit. This helper does not validate mesh structure, input-image rights, dependency licenses, the full processing chain or truthful authorship. Read any recorded labels as claims to investigate, not an automatic permission decision.

Record each transformation without rewriting history

The inspected Finish builder records source and output paths, stage settings and timing, but does not include an output SHA-256 in that report. Comparing its result to the raw generator’s output hash is therefore the wrong expectation. A mismatch after processing may be entirely expected; it still needs an explicit relationship between the two files.[4]

• Keep the original generation asset and sidecar unchanged.
• For each derivative, record source-file hash, resulting-file hash, tool version and the operation actually performed. Keep this separate record clearly labeled as your own handoff record.
• Repeat after retexturing, rigging, animation or another export. Do not assume every route preserves the same sidecar fields.
• Give the recipient the specific files and records for the stage being reviewed. Use a separate working copy for experiments.

A GLB that opens correctly is not a substitute for these records. In glTF 2.0, generator and copyright metadata are optional; extras is application-specific. The format does not require a complete history or licensing inventory.[8]

Separate recorded license labels from permission

AssetFurnace’s documentation distinguishes its own Apache-2.0 code from the terms attached to the models and other components it uses. Hardware support also varies by route. Check the current setup instructions and the actual upstream terms for the components recorded in your run; a local installation does not remove those conditions. We did not install or run the pipeline for this article.[5]

Treat a license name, URL or classification in a sidecar as a starting point for review. Check the input art, each relevant component and your intended distribution. SPDX separates discovered license information from a concluded license; our lab makes neither conclusion and is not an SPDX validator. Missing or unclear information remains unresolved.[7]

Keep useful project records internally, but inspect them before sharing: paths, prompts and filenames can reveal private work. Prepare a deliberate handoff copy without changing the preserved originals. Record any redaction so the recipient knows what is absent.

Use the same handoff habit in a browser workflow

If your project starts with a visual reference, Goblin3D offers browser-based Image to 3D, with GLB, OBJ and FBX exports on paid plans. Keep the chosen reference and the exact export together, then document your own later edits. This is a general file-handoff practice, not a claim that Goblin3D writes AssetFurnace sidecars or integrates with that pipeline.[10]

The finish line is a recipient who can identify the exact asset, understand which records describe it, and see which checks remain open. Keep technical quality, file identity and usage rights as separate questions; one green result should not answer all three.