Source closure
Frozen identities
Cabinet source
Sealed tree
Data schema
Re-hash every file listed in SHA256SUMS. Any changed byte fails the entire check.
Source binding runs at boot. Full byte verification is available over HTTP(S); file-origin browser restrictions are reported rather than bypassed.