Contracts: Verifying an App
The whole point of content addressing is that you can verify. To confirm an app is exactly what it claims:
- Recompile the source and check the hash matches the on-chain component hash. (Same bytes ⇒ same hash.)
- Render against multiple RPCs and diff — byte-identical output proves nothing is injected by a provider.
- Read the grade (
TrustGradeView.analyze) and check the deviation list matches what you expect. - Check the version posture (
SubnameVersionRegistry.nameInfo) — is the name frozen, or timelocked with a pending version? A pending version is public and delayed; you can audit it before it activates.
Nothing requires trusting an operator. Everything is a reproducible read. This is the guarantee ChainRender exists to provide.