2. Reproducing the build

Identical inputs must produce a byte-identical dist/, or the manifest root hash means nothing: you could not have checked it.

git clone git@github.com:Xaxis/nullroute.git
cd nullroute
git checkout <commit>          # the commit you are verifying; no release is tagged yet
make install                   # npm ci, exact versions from the lockfile
make build
make manifest-check            # refuses untracked files under the roots, then checks every lock entry's hash

Then compare the root hash you computed with the one on your device's lock screen. With no release there is no published third value. Two values, equal, or something is wrong.

CI runs a double build on every push to main and every pull request, and fails if the two differ. It compares the tsc output in each package's dist/; the Vite bundle the device serves, packages/ui/dist-app, is not compared.

What makes it reproducible

• Every dependency pinned exactly, npm ci only, lockfile committed
• ignore-scripts=true: no package can run code at install time and change the tree underneath you
• SOURCE_DATE_EPOCH is not set for this build, since nothing in the Node toolchain reads it. The image build, which does honour it, sets it from the commit timestamp
• File ordering sorted, not filesystem-dependent
• Output file names fixed in the device UI's Vite build, not content-hashed

---