# Verifying the client — the code your browser runs Everything a browser runs for a Space comes from a web origin, and an origin can be compromised: a hijacked hosting account, a bad deploy, a poisoned cache. Sealed storage and an attested server mean little if the page itself can be swapped. This page is how the client is pinned, how anyone can check it, and how the server checks it back. How the app is put together inside the browser — the vault, the Kernel and Atlas — is the next page: [the app as an operating system](./app-os.md). --- ## Every release is a reproducible, logged build A release of the web app is not "whatever we deployed last". Each **Official** release is rebuilt from its source commit inside a separate build enclave, which signs its verdict with a key born inside it; the verdict — the release's hash (`frontendSha256`), commit and version — goes into an append-only release log and into **Rekor**, Sigstore's public transparency log. A deploy is refused unless the bytes rebuild to the logged hash, and never moves backwards to an older release. Devices choose a channel: **Official** (the newest logged release) or **Beta** (the newest build, not rebuilt by the enclave). The service worker downloads a release completely before the app switches to it. ## The page pins everything it loads The shell names every file it will load **by its hash**, and the browser refuses anything else: | What | How it is pinned | |---|---| | **Every JavaScript module** | An import map carries a sha384 `integrity` for each module; the browser checks each module as it loads it (Chrome 127+, iOS Safari; older engines ignore it). | | **Script tags** | Subresource Integrity on each `