This directory makes Homebase releases reproducible: the same git ref always produces a byte-identical bundle, on any machine. That turns "the deployed app matches the public source" from a promise into a check.

Why it matters here: for a governance platform, control of the frontend is a governance question — a tampered bundle can misrepresent what users sign, without any trace in the source repository. Reproducibility is the foundation for distributing Homebase through channels that don't require trusting any single host or maintainer (content-addressed hosting, release registries, independent build attestation). It runs in parallel with the existing hosted deployment, which continues unchanged.

# Build the current commit; artifact + fingerprint land in distribution/out/
distribution/build.sh

# Verify a release against its published hash (from the GitHub Release page)
distribution/verify.sh v1.2.3 <expected-sha256>

# Verify a release against the ON-CHAIN registry (trustless: commit + hash
# are read from the release-registry contract, then rebuilt and compared)
distribution/verify.sh --registry <mainnet|shadownet> <registry-address> <version-key>

# RUN a verified release locally (zero dependencies, Node 18+): reads the
# DAO-approved record from the registry, fetches the artifact from any
# mirror, verifies every file against the on-chain fingerprint, and serves
# the app on localhost. Refuses to serve on any mismatch.
node distribution/run.js --network shadownet --registry <registry-address> --key v6.0.0

run.js is deliberately a single dependency-free file: it is the trust anchor of local distribution, so the entire trusted surface should be readable in one sitting. With it, the hosting layer (Netlify, the domain, even GitHub) is demoted to interchangeable mirrors: what you run is provably what governance approved, regardless of who served the bytes.

BUILDHASH is the sha256 over the sorted per-file sha256s of build/ (BUILDMANIFEST holds the per-file list, so any mismatch can be localized to the exact file).

Pushing a v* tag triggers .github/workflows/reproducible-build.yml, which builds, rebuilds from scratch and fails unless both hashes match, then publishes the artifact, BUILDHASH.txt, and the manifest on the GitHub Release.

Releases are recorded in the Registry contract of a Homebase EVM DAO (the app's own audited governance stack — the release process dogfoods the product). Each approved release is a registry entry: key vX.Y.Z, value {"commit":"<sha>","buildhash":"<sha256>","artifact":"<url>"}. Entries only change through a governance proposal (propose → vote → timelock → execute), so "the official build" is a DAO decision, not a hosting-account setting. verify.sh --registry closes the loop: on-chain record → source commit → reproducible rebuild → hash comparison, with no trusted intermediary.

Current registries:

• env.build must never contain a secret. A browser bundle cannot keep secrets; anything here is public the moment the app ships.
• Reproducibility certifies the bundle, not the services it talks to — the app still depends on the indexer/API endpoints listed in env.build.
• The hosted deployment (Netlify) builds separately and is not expected to match BUILDHASH; verifiable distribution channels (content-addressed mirrors) are the next phase and will serve exactly the fingerprinted artifact.